ML20052D701
| ML20052D701 | |
| Person / Time | |
|---|---|
| Issue date: | 02/05/1982 |
| From: | Advisory Committee on Reactor Safeguards |
| To: | Advisory Committee on Reactor Safeguards |
| References | |
| ACRS-1929, NUDOCS 8205070125 | |
| Download: ML20052D701 (72) | |
Text
fDR 6</DG T O * ;7 [
i; y, y (MINUTES OF THE ACRS SUBC0llt4ITTE
~
l N,N E v
Y ON ADVA: ICED REACTOR 5:/
ISSUED EBRUARY 5,198:
DECE!!BER 3-4, 1981 f/
Y3 ARGONNE, ILLIN0IS i'i
. - q' 03F
~
'M g.a5M y
C*i
'wN ',hj. ".f The ACRS Subcommittee on Advanced Reactors held a meeting;*on De'cember 3 and 4, W, ding 'possible safety 1981, in Argonne, Illinois, to continue discussion regar philosophy, safety 1ssues, anc R&D requirements for future commercial Ll1FBRs reactors and to prepare a report to submit to the ACRS. The meeting was in open session.
No members of the public presented any oral or written statements.
The Federal Register notice of the meeting is Attachment A; the Agenda, Attachment B.
All documents received at the meeting are on file in the ACRS office.
ACRS attendees at the meeting were ll. Carbon, Subcommittee Chairman, and C. ' lark, itember. ACRS consultants attending were G. Golden, W. Lipinski, R. Avery and J. Hartung. ACRS Consultants S. Siegel and L. voch were absent.
The Subcomr.;ittee discussed the draft write-up of the safety issues that will eventually be incorporated in a report. All the write-ups have been received and discussed at the meeting except the write-up on pool vs. loop configura-tion.
This write-up will be submitted by S. Siegel and sent to the Subcommittee when received.
The draft write-up is shown in Attachment C.
The Subcommittee decided to change the format of the report by modifying the sections in the Introduction and the relationship to Safety Philosophy.
The subcommittee decided to invite three nontechnical persons to attend the meeting on January 21-22, 1932, to discuss risk perception and aversion.
They are Dr. Roger Xasperson, Clark University; Dr. Paul Slovic, Decision l
- :"'5 l
0205070125 820205 Q\\
$929 PDR
ADVANCED REACTORS Research, Inc.; and Prof. Cora Marrett, University of Wisconsin.
The next Advanced Reactors Subcommittee meeting will be held on January 21 and 22, 1982, at the Argonne National Laboratory in Illinois.
~
I NOTE:
For add.tional details, a complete transcript of the meeting is available in the HRC P'ublic Document Room,1717 H St., NW, Washington, DC 2D555 or from Alderson Reporters, 300 Seventh St., SW, Washington, DC (202) 554-2345.
)
l L
O j
=
Poderal Register / Vcl. 46. N2. 220 / Monday. N:vember 16, 1981 / Notices 9583 A copy of the above documents are arrangements can be made to allow the Parformance(A-43)". Notice of this available for public examination and necessary tima dreing the meeting for meeting was published October 29.
copying for a fee at the Commission's such statements.
In accordance with the procedures Pubhc Document Room.1717 H Street.
De entire meeting will be open to outlined in the Federal Register on NW Washington, D.C. 20555 and at the public attendance except for those September 30.1961. (46 m 47903), oral Phoenix Public IJbrary. Science and sessions during which the Subcommittee or written statements may be g M industry Section.12 East McDowell finds 11 necessary to discuss proprietary byinembers of the public, recordings
[
Road. Phoenix, Arizona 85004.
Information. One or more closed will be permitted only during those Any person who wishes to have his sessiontmay be necessary to discuss portions of the meeting when a li o
views on the antitrust matters with such information. (Sunshine Act transcript is being kept, and questions
.f respect to the los Angeles Department Exemption 4). To the extent practicable, may be asked only by members of the of Water and Power and the Southern these closed sessions will be held so as Subcommittee. its consultantsysnd Staff.
California Public Power Authority to minimize inconvenience to members Persons desiring to make oral presented to the Attomey General for of the public in attendance.
statements should notify the Designated consideration or who desires additional
%e agends for subject meeting shall Federal Employee as far in advance as information regarding the matters be as follows: %unday and Friday.
practicable so that appropriate covered by this notice, should submit December 3 and 4.1981-4.30 a.m. until arrangements can be made to allow the such views or requests for additional the conclusion of business each day.
information to the U.S. Nuclear ne Subcommittee and its consultants necessary time during the meeting for such statements.
Regulatory Commission. Washington, will discuss possible design
%e entire meeting will be open to D C. 20555. Attention: Chief Utility considerations, issues. or criteria for Finance Branch Office of Nuclear future commercial advanced reactors public attendance except foi those Reactor Regulation, on or before and plan to prepare a report to submit to sessions of this meeting that'may be November 30,1981, the ACRS.
dosed to discuss the NRC Safety This notice was previously published Further information regarding topics Research Program as required (Sunshine in the Federal Register on September 2.
to be discussed, whether the meeting Act Exemptions (2). (6), and (9)b). to the 1981 (46 FR 44110). September 18.1981 has been cancelled or rescheduled, the extent practicable, these dosed sessions (46 8 46453). September 25.1981 (46 R Chairman a ruling on requests for the wiH be held so as to minimize 47330). and October 2.1981 (46 FR opportunity to present oral statements inconvenience to members of the public 48805).
and the time allotted therefor can be in attendance.
De agenda for subject meeting shall o la y
re tejep one caU to be r.a follows: Wednesday and Dated at Bethesda. Mar) land, this 28th day g,,,
of August 1981-Hursday. December 2 and 3.
30 For the Nuclear Regulatory Commission, g
d a.m. until the cor.dusion of bus 0
EU had I. Mirestia.
- ES esch day.
Chief Licensing Branch No. 3. Division of E,
determined. In accordance with Durnng the indal po&n &
M' Subsection 10(d) of the Federal meeting. the Subcommittee, along with in
.s w u m ies es** m)
Advisory Committee Act, that it may be any ofits consultants who may be necessary to close some portions of this present, wiu exchange pMndnary meeting to protect proprietary views regarding maners to be dered during the balance of the
[]sf3 Advisory Committee on Rasctor information. The authority for sqch Safeguards, Subcommittee on closure i emption (4) to the Sunshine ggg Advanced Heactors; MeeUng ct. 5
. 552 (c)(4).
He ACRS Subcommittee on Dated. November 10.1981-presentations by and hold discussions with representatives of the NRC Staff.
l Advanced Reactors wiu hold a meeting 8**"*l J. Cn.
their consultants. and other interested en December 3 and 4.1981, at the Secretcyofthe Cemission.
- j. j persons regarding the toples to be I
Bellevue iIotel. 505 Ceary Street. San Ir" D= m M w*t se =I discussed.
Francisco, CA to continue discussion seo coot tseHw Further information regarding topics regardmg possible design to be discussed. whether the meetina consideranons 1: sues. and criteria for has been canceUed or rescheduled. the future commercial ads anced reactors Advisory Committee on Reactor and plans to prepare a report to submit Safeguards, Subcommittee on Chairman's ruling on requests for the to the ACRS Notice of this meeting was Emergency Core CooUng Systema; opportunity to present oral statements pubbshed October 29
"" UU U
'and the time aUotted therefor can be obtained by a prepald telephone call to In accordance with the procedures ne ACRS Subcommittee on the cognizant Designated Federal l
outlined in the Federal Register on Emergency Core Cooling Systems will Employee Mr. Paul Boehnert (telephone September 30,1981. (46 FR 4'903). oral hold a meeting on December 2 and 3.
202/634-3287) between 8:15 a.m. and or written statements may be presented 1981, at the National Security and 500 p.m, EST.
by members of the public, recordings Resources Study Center. Box 1863-I have determined. in accordance with will be permitted only during those Diamond Drive. los Alamos National Subsection 10(d) Pub. L 9A'63 that11 portions of the m'eeting when a laboratory. los Alamos.NM.De may be necessary to close sessions of transcript is being kept, and questions Subcommittee will redew selected the meeting as noted above to discuna may be asked only by members of the portions of the NRC Safety Research matters which relate solely to the Subcommittee. its consultants, and Staff.
Program for the ACRS Report to internal personnel rules and practices of Persons desiring to make 3ral Congress.ne Subcommittee wiU also the agency (Excemption (2)), to discuss statements should notify the Designated discuss the status of Unresolved Safety information of a personal nature. the Federal Employee as far in advance as Issues. " Water llammer (A-1)" and disclosure of which would consutute a practicable so that appropriate
" Containment Emececy Sump clearly unwarranted invaelon of kirAC4msor b
\\'-
ACRS SU3C0ftMITTEE !EETING Oil ADVANCED REACTORS DECEfEER 3-4, 1981 - ARGO*lNE. ILLINDIS Agenda The Subcommittee was in open session for two days. Major emphasis was on the report preparation concerning safety issues and philosophy in the design of a commercial-size LMFBR.
Attachment B
DRAFT - J. Hartung/S. Siep..
'b r
C0i;TE!1TS Page f
1.
Introduction........................................................
2 11.
S a fe ty P h i l o s o p hy...................................................
3 1
Safety Goals....................................................
3 Cost-Ber.ofit Considerations.....................................
4 Regulatory Approach.............................................
5 1
Safety Criteria.....................................'............
5 Reactor Siting..................................................
5 Defense in Depth................................................
6 Accident Prevention.............................................
7 l
Ac c i d e n t lii t i g a t i o n............................................. 7 1
Safety Evaluation...............................................
8 Proba bi l i s ti c Ri s k As s es srae nt................................... 8 i
a r
i 1
4 4
i I
4 II i
4 4
4 4
1 i
I ACit/WGAlY T
.m--
y
,--,,,,.m---
y
-e
I.
INTRODUCTION t
There is durrently a major worldwide effort to develop LMFBR power r'. ants for potential commercial application.
The United States is contributing to this -
effort through its principal L'JBR projects and supporting base technology pro-grams.
Both NRC and DOE are conducting safety research and development that support possible future commercialization of large LMFBRs.
The ACRS has during the past year studied the principal safety issues associ-i ated with LMFBR plants in the context of overall safety goals and specific LMFBR characteristics.
Based on this study, the following comments are offered on overall LMFBR safety philosophy,. specific LMFBR safety issues, and LMFBR research and development needs and priorities.
4 0
t e
l i
2
II.
SAFETY PHILOSOPHY The nuclear industry has matured greatly in the approximately two decades since the introduction of commercial nuclear power plants.
Consequently, there.
is today a fairly large and growing technological and operating experience found-ation on which to base the development of future LMFBRs.
Past experience has highlighted both strengths and weaknesses in conventional safety philosophy. The lessons learned from this experience should be both understood and acted upon to improve the process by which the safety and licensability of future LMFBRs is assured.
Full-scale deployment of the LMFBR system will not occur for at least several decades.
Safety criteria are nevertheless needed for LMFBRs to guide development of the technology and to help assure public acceptance of this energy option when it is required.
These criteria, their methods of implementation, and the proce-g,.
g dures for assuring that they have been met, should be transparent enough to be widely understood and intelligently debated by a broad segment of the public.
The criteria should be stringent enough to assure safe and reliable system operation, yet avoid overly burdensome and/or costly requirements of negligible safety benefit.
In the evolution of these safety criteria, the institutional, organizational, and management issues which affect safety and reliability should be considered as well as the technical features of the plant and system.
Safety Goals Early definition of a safety goal for LMFBR power plants could help to provide a rational environment for the development of LMFBR safety criteria.
Such an LMFBR goal should be one element of a broader safety goal for the entire nuclear enterprise.
It is hoped that the current safety goal deliberations will lead to development of a safety goal which can be used for future large LMFBR power plants.
3
The LMFBR safety goal should ideally limit risks to both society at large and to individuals, promote rational allocation of societal resources, and foster a balanced defense-in-depth approach, with emphasis but not total reliance on accident prevention.
Throughout, it should be recognized that the use of this goal poses the traditional problems of decision under uncertainty.
The public's aversion to nuclear risks should be considered in the develop-
, ment of this safety goal and in the evolution of safety criteria based on it.
This aversion is apparently much broader than the widely recoghized aversion to
.f high-consequence events.
It also appears to include an aversion to other forms j
g of nuclear risks, such as stress-provoking accidents (even though actual public consequences may be minor), low-level radiation, plutonium diversion and nuclear weapons proliferation.
These aversions must be acccpted as having a perceived reality comparable to those quantities which can be more easily measured if public acceptance is to be achieved.
Cost-Benefit Considerations Cost-benefit considerations should be a major driving force behind all LMFBR safety decisions, including establishment of the overall safety goal mentioned l
above.
The objective of cost-benefit deliberations should be to minimize the '
total social cost of energy rather than bus bar electrical generation costs.
Given this premise, weight should be given to all societal costs and benefits associated with the generation and use of energy, including the cost of accidents (e.g.
plant damage, replacement power, public property damage, health effects, and r'ipple effects) and the benefit derived by society from the use of diverse i
energy sources and indigenous raw materials for energy generation.
The objec-tive function in these cost-benefit analyses (i.e., social cost of energy) necessarily includes factors which are relatively intangible and resistant to simple quantification.
Therefore, qualitative judgments will usually play an important role in cost-benefit decisions.
i 4
s Regulatory Approach An attemp.t should be made to provide early regulatory and public input into LMFBR safety decisions.
One approach for doing this is by establishing an overall LMFBR safety goal and cost-benefit guidelines as described above.
Another approach is by establishing key safety criteria early in the design process, preferrably based on discussions between regulators, design groups, and other interested responsible parties.
These criteria must be reasonably complete and explicit if they are to be meaningful, but should not contain details or overly prescriptive statements lest they result in unnecessary and possibly counterproductive design constraints or premature standardization.
Safety Criteria The safety criteria for LMFBR systems and components should be developed from first principles to the maximum extent practical rather than taken from comparable systems and components in LWR power plants.
There are important differences between LWRs and LMFBRs, and many LMFBR systems and components have a
no direct counterparts in LUR plants.
Even those systems and components which do have direct counterparts, however, may have different safety functions, or their safety functions may have different importance in their respective plants.
Consequently, LMFBR safety criteria should be developed from first principles rather than taken from comparable LWR systems and components.
Reactor Siting Conventional premises regarding the deployment and siting of nuclear power plants may have to be reexamined for LMFBRs.
When and if such plants are to be built, the decision to do so will likely be an element of national energy policy (or at least a joint decision by a group of utilities) rather than a unilateral decision by a single utility acting alone. This, along with the need for fuel reprocessing, may lead to colocation of several plants on dedicated site (s). The 5
e
~
use of such energy parks for LfEBRs should be encouraged, especially if they can be located in low population areas and operated by highly qualified organization (s) with in-depth technical capabilities.
Such energy parks could result in important construction and operating efficiencies as well as improve safety and simplify
]
the task of preventing diversion of sensitive materials.
Ragardless of how plants are to be sited, however, they should include a sufficient complement of
~
safety features to allow siting on a range of sites.
Remote siting does not appreciably reduce the necd to build safe plants even though it does enhance the margin of safety.
Defense in Depth The concept of defense in depth has been an important contributor to the safety of nuclear power plants.
The TMI accident illustrated both the value of this concept and an area in which it needs improvement.
In this accident, the multiple defenses provided for accident prevention failed, but the fission pro-ducts released from the core were still largely ccntained.
The primary lesson to be learned from this accident is the need to strengthen defense in depth to more reliably prevent accidents, such as with improved man-machine interfaces.
How-ever, an important secondary lesson is the value of accident mitigation as an element of defense in depth, flevertheless, accident mitigation is only a necessary but not sufficient condition for public acceptance, which must be more broadly defined than in terms of radiological health injury alone.
Even a contained accident results in mental y
stress, personal dislocations, and perhaps even evacuation.
In safeguarding the
~
public health and safety, the mental health of person,s living around the plant as well as the financial well-being of electricity users must be considered to the extent that these factors can affect health and safety.
These considerations dictate the need for reliable accident prevention regardless of the mitigation features provided.
6
\\
Accident Prevention _
i Accident prevention can and should be emphasized in future LMFBR power plants.
Defense in depth should be used to more reliably prevent potentially serious accidents, with emphasis on preventing accidents involving the reactor core and spent fuel.
Ample redundancy should be provided to virtually eliminate the chances of independent component failures resulting in serious accidents.
Furthermore, everything practical should be done to reduce the chances of human errors or common cause failures compromising the effectiveness of these multiple defenses.
This should include the use of inherent safety features where techno-logy permits and diversity in key safety systems.
Because human factors play such an important role in accident prevention, at all stages from initial design to construction, operation, and maintenance, institutional as well as technical advances are needed to optimize safety and 5
reliability.
The " man-machine" interface is comprised of much more than merely the oper ator at the control console.
It includes the institutions and the organi-zations in which the humans involved in the nuclear enterprise function.
Accident Mitigation Given uncertainties and the demonstrated value of accident mitigation as an j
element of defense in depth, LMTBRs should also include features to accommodate accidents, including major core melting and loss of spent fuel cooling accidents as well as Hypothetical Core Disruptive Accidents.
These features should be evaluated based on conservative bounding calculations where practical.
- However, where this approach leads to designs which are either impractical or unsafe in other ways, the accident mitigation features may be evaluated based on realistic rather than conservative assumptions, with appropriate consideration of uncertain-ties.
The reliability of these accident-mitigation features need not be as high as that required for prevention features, however.
7
- ~.
d Safety Evaluation The safety evaluation of LMTBR power plants should address plant operability as well as design adequacy.
Emphasis should be placed on assuring that the oper-ating staff can diagnose accidents and take appropriate corrective action. The effect of both small and large accidents, ranging from minon' plant perturbations r'
through severe core damage and Hypothetical Core Disruptive Accidents, should be evaluated with no undue emphasis in any area.
The effect of multiple as well as single failures should be considered based on their expected frequency of occur-rence and potential consequences.
Emphasis should be placed on determining the expected plant response based on realistic assumptions.
Conservative calculations should be performed only where bounding calculations are really needed or are most appropriate.
Scnsitivity and uncertainty analyses should be used to explore the range of possible plant responses and accident progression paths where uncertain-l ties are large.
Probabilistic Risk Assessment A probabilistic risk assessment should be performed early in the development l
of new or novel LMFBR designs.
This risk assessment should be updated periodically and used (in conjunction with other engineering methods and judgment) to help make safety decisions relating to plant siting, design, construction, and operation.
J J
i l
i mjb:122 l
8 l
l I
k3 o-I 1
l i
I. REACTOR SHUTDOWN SYSTEM A reliabi'e reactor shutdown system is needed in LMFBR power plants. The current trend of providing two separate and diverse shutdown systems appears to '
be a reasonable approach for achieving this reliability.
These two systems should be as diverse and redundant as practical with respect to each other and
[
each should be capable of performing its safety function following a single failure.
This diversity and redundancy should extend all the way from the plant protection system instrumentation and logic through the shutdown system actuation devices and absorber assemblies.
The shutdown systua should -be provided with enough redundancy so that the chances of its failure due to independent component failures is very small.
It should also be designed to be as insensitive as practiccl to common cause fail-ures.
This requires, in addition to the above-mentioned diversity, that its design be as simple as practical with a minimum number of interconnections, appropriately conservative design margins, and adequate protection and segrega-tion of redundant cooporients.
The design should be fail-safe wherever practicable.
New and novel design features and approaches should be carefully developed and thoroughly tested over a wide range of conditions to guard against common cause failures.
The major safety R&D need in the area of reactor shutdown is to develop a self-actuated shutdown system.
Such a system is probably not necessary for safe operation of future large LMFBR power plants, but its use could improve safety margins by reducing the chances of operator errors and enhancing the diversity within the shutdown system.
A secondary R&D need is to test currently available LMfBR shutdown system designs,to help assure their reliability.
clb:1202 L
k 364 h
~
2 SHUTDOWN HEAT REMOVAL SYSTEM A reliabl' shutdown heat removal system is needed in LMFBR pper plants.
c 3..., +
r..
The current trend of providing two separate and diverse shutdown heat removal %.ti. o systems appears to be a reasonable approach for achieving this reliability.
These two systems should be as diverse and redundant as practical with respect to each other and each should be capable of performing its safety function following a single failure.
This diversity and redundancy should extend from as close to the reactor core as practical, to the ultimate heat sink (s), and should encompass support and service systems and power supplies as well as the main heat rejection components.
If practical, one of these systenis should remove decay heat directly from the reactor vessel and not rely on the primary or intermediate loops.
An excellent approach for achieving diversity in power supplies is by providing natural circulation capabilities in one of the systems.
It is also desirable that at least one of the systems be inherent (i.e., no operator actions or control power required) to limit its sensitivity to operator errors and loss of l
control power.
The shutdown heat removal system should be provided with enough redundancy 50 that the chances of its failure due to independent component failures is very small.
It should also be designed to be as insensitive as practical to common cause failures. This requires, in addition to the above-mentioned diversity and inherency, that its design be as simple as practical, with a minimum of inter-connections, appropriately conservative design margins, and adequate separation and protection of redundant components.
New and novel design features and ap-proaches (e.g., natural circulation) should also be carefully developed and thoroughly tested over a wide range of conditions to guard against common cause failures.
The principal safety R&D need relating to shutdown heat removal is to develop an improved understanding of sodium natural circulation, both on the component and system level. This will probably re. quire phenomenological, scale model, and operating plant tests as well as supporting analytical studies.
A secondary R&D need is to de/elop and test new and/or novel components for decay heat removal service.
clb:1202
L. J. Koch 11/24/81 13.
Spent Fuel Handling and Storage
Background
Spent fuel from any power reactor is highly radioactive and generates heat due to fission-product decay.
Therefore, it must be shielded to prevent radiation exposure to people in the vicinity and must be cooled to remove the decay heat.
Spent fuel assemblies from LMFBR's pose some unique problems.
The fuel operates at a higher power density than in an LWR (approx-imately a factor of ten) and therefore at comparable times, the decay heat is generated at approximately 10 times as high a power density.
The fuel in a LMFBR is cooled by sodium and the spent fuel must continue to be cooled by sodium, or a transition must be made to a different coolant.
Either of these alternatives complicate the spent fuel handling process as compared to LWR's (where the process is carried out in water).
Status of Technoloay Spent fuel handling and storage systems have been built and operated satisfactorily.
These systems have employed continuing use of sodium as the coolant and have used alternative coolants.
For example, EBR-II makes a coolant transition from sodium, to inert gas to air (after a steam-cleaning step).
This transition is made after a nominal 15-day cooling period (in sodium) following reactor shutdown.
Other systems utilize " cooling pots" containing i
sodium to transport spent fuel assemblies and in which the sodium transfers the decay heat to the pot from which it can be removed.
e Spent Fu31 Handling cnd Storega prga 2 Sodium is an excellent heat transfer fluid and it is only necessary to keep the spent fuel assembly submerged in sodium to ensure adequate fission product decay heat removal from the fuel (and provided that the heat is subsequently removed from the sodium).
Sodium is also very active chemically and must be isolated from air and water.
This requirement complicates spent fuel handling and failure to maintain such isolation provides a potential mechanism for a loss of cooling situation during spent fuel handling operations.
A similar potential for inadequate cooling exists during the transi-tion from sodium cooling to an alternative cooling medium.
The basic technology is understood and adequately developed.
The capability exists to design systems which adequately perform the required functions.
Basic R&D is not needed, but demonstration of design features and operation of unique'devicesis certainly warranted.
Reliability and safety evaluations should be performed on specific concepts to identify sources of problems and their con-sequences.
It is reasonable to conclude that delaying the transition from sodium cooling of the spent' fuel to alternative cooling methods is desirable because of the reduction in cooling requirements as the fission product activity decays.
This advantage must be balanced against the continuing requirement for reliably isolating the fuel because of the chemical activity of the sodium coolant.
?
I I
~
l
9 Sp;nt Fual Htndling and Storego p ga 3 Special attention also is warranted to ensure that a spent fuel handling mishap will not propogate and generate a serious hazard to the public or jeopardize the ability of the plant staff to operate the plant.
Because efficient operation of an LMFBR requires recycle of the fuel, the spent fuel handling and storage methods should reflect t_he requirements of the total fuel cycle. These considerations should include the transport to the fuel processing facilities, the cooling medium / environment and any transitions required, the time cycle and cooling requirements, etc.
e S
LLW..-
4.
SEISMIC DESIGN CONSIDERATIONS A.
Background
The reliability of reactor systems under seismic conditions is a major concern in safety analysis. For earthquakes ' equal to the Operating Basis Earthquake (OBE), the reactor structures, components, and systems neces-sary for continued operation should be designed to remain functional; for earthquakes equal to the Safe Shutdown Earthquake (SSE), the reactor struc-tures, components, and systems which are important to safety must be designed to remain functional. The capability to shutdown a reactor and to maintain it in a safe shutdown condition is essential in the prevention of accidents.
Certain critical alignments between the control assemblies and control rods must be maintained and the relative displacement between the re-actor f.ead cover and the reactor core must be kept within the safe shutdown limit during a seismic event. Misalignment or excessive oscillations of con-trol assemblies, the reactor head cover, and the core support can increase scram time and reactivity insertion rate, thereby hampering the safe operation and shutdown of the reactor during earthquakes. Thus, the methods used in the safety analysis must be able to predict accurately the responses of the reac-tor core, control rods, core support structure, head cover, and reactor vessel under seismic conditions.
B.
Technical Issues An LMFBR reactor core contains hundreds of hexagonal assemblies.
Each assembly, fuel, blanket, control, or shield, is individually placed in a thin-walled hexcan duct and supported at the bottom by the support grids on the core support structure.
During seismic disturbances, the response of the core is highly nonlinear and depends strongly on the motion of the core sup-port and core barrel and interactions of the core assemblies with the sur-rounding fluid. To assess the reliability of core assemblies and the proba-l bility of their failure, nonlinear effects such as the effects of squeezing out the fluid between assemblies and impact between3djacent assemblies must be known. Analysis of assemblies without 'nclusion of the fluid would be unduly conservative. On the other hand, little is known about the precise effects of this phenomenon on impact loads.
I
\\
In LMFBR reactors, all igortant cogonents of the primary system such as the reactor core, blanket, shield, core barrel, core support struc-ture, instrument tree, and fuel handling mechanism are required to be placed within the reactor vessel. Since the primary system is not pressurized, the vessel wall is relatively thin. During seismic disturbances, liquid sloshing becomes a concern in the safety analysis. There are indications that the inertia of the soditsn mass can generate large forces on the reactor vessel wall as well as on in-vessel components, when the vessel moves under the seismic forces. Vertical acceleration of the reactor vessel can also produce
~
cavitation in liquid. There is also the possibility that a large thin-walled reactor vessel may buckle locally under seismic excitation. Thus, siglified approaches which treat the reactor vessel as a rigid body, and which ignore the coupling effects of fluid structure interaction are no longer appropriate.
In addition, internal structures such as baffle tank and insulated internal tanks are of ten provided in LMFBR reactors to separate the cold and hot coolant. This further complicates the analysis of the reactor vessel and in-creases the need of using sophisticated niethodology for analyzing seismic induced coolant forces and the response of reactor vessel, C.
Status of Technology Since important reactor cogonents are immersed in the sodium coolant and contained in the primary vessel, their motions under seismic dis-turbances are affected by the inertia effect of the fluid shich surrounds the components, and the interactions of the fluid with the primary vessel. For purposes of performing a realistic dynamic analysis of the reactor system under seismic disturbances, the fluid must be properly modeled and its effects on the conponent response nust be properly included in the analysis. Unfortu-nately, the current methods used in seismic analysis are essentially all linear. The sodium coolant is treated as a lumped mass or an equivalent hy-dro@namic mass to the surrounding components. Although these linear analyses t
are useful because they are readily accoglished by existing corrputer soft-ware, certain important nonlinear aspects of the seismic induced phenomena such as squeezing out of fluid between adjacent components and fluid sloshing are ignored.
l
Although the SSE is defined to be the maximam earthquake potential at the plant site, opinion among the experts regarding the magnitude of the
$$E varies.
If linear analyses are egloyed to predict the response of reac-tor cogonents, conservative design values must be used in the calculations to cogensate for the approximations which might be introduced from the use of siglified approaches. The final design which reflects the compoundeo con-servatism in each step may at times be very conservative. Although such a margin of safety may be desirable, it may be unduly conservative and thus add I
significantly to the cost of these cogonents.
Recently, research programs aimed at evaluating the safety margin of seismic analysis have been sponsored by NRC and EPRI for Light Water Reactors (LWRs). However, due to the differences between Light Water Reactors and Liquid Metal Fast Breeder Reactors (LMFBRs), some critical areas which are unique to the LMFBR safety are not being currently investigated. One such i
area is the effects of assembly igact on scram insertion of control rods.
Another area which is not addressed in the NRC and EPRI programs is the fluid modeling and its effects on cogonent responses. The current DOE /RRT Seismic I
Safety Program is exclusively formulated for LMFBR safety. Mathematical models and methods of analysis to determine the response of LMFBR structures and components, under seismically induced loads will be developed. Close con-tact with LWR seismic research groups will be maintained. Also, this program has an active interaction with working group members of DOE's Breeder Reactor Seismic Technolog Plan (BRST).
D.
Relationship to Safety Philosophy Seismic analysis using linear methods could lead to costly designs which are not necessarily safer. For example, increasing the pipe wall thick-ness to accommodate the conservative seismic loads does not necessarily pro-l duce a safer piping system for it may create excessive thermal stresses in the pipe wall. Thus, the results of linear analysis are not always on the con-l servative side. The purpose of the DOE /RRT Seismic Safety Program is to pro-vide methodoloy which can be used to analyze the reactor cogonents more realistically and to reduce the unnecessary conservatism. This approach is consistant with the safety philosophy considering both costs and the safety of structures and systems under seismic events.
f
l l
E.
Guidelines The three cogonents of the ground motion should be considered si-altaneously in the seismic analysis. Two-dimensional models may be used t
Wre it can be reasonably demonstrated that they are appropriate; otherwise three-dimensional models should be used. Fluid must be properly modeled in the mathematical model to account for the igortant seismic-indJced phenomena such as gap impact between assembly hexcan ducts and squeezing out of fluid between adjacent cogonents. Fluid sloshing due to an earthquake can occur in the reactor vessel. These effects should be evaluated and taken into account in the design. Coolant sloshing can increase the fluid $namic pressures on the submerged structures and may result in a reduction of functional perform-l ance of the reactor vessel.
1 F.
R&D Requirements Seismic design considerations of this nature would require high level of effort. As a practical matter to achieve effective use of limited manpower it will be necessary to first explore.in somewhat greater depth an i
understanding of methodology in those areas and then to develop a priority listing which appears to hold the greatest potential of payoff from increased research effort. Again, methodology developed must be evaluated in an overall f
cost / benefit context. For exagle, a coglete representation of the reactor core including fuel, blanket, control, and shield assemblies, together with other cogonents such as the core barrel, core support structure, baffle plates, reactor vessel, and coolant, using a detailed finite difference or finite element model, would result in a large r. umber of cogutational meshes j
or elements and requires an extraordinary large amount of computer storage.
Thus, mathematical models developed for coguter analysis must be able to fit i
the capacity of the computer storage and the computer time available for
' safety analysis. To understand the effects of fluid modeling on structural response, several representative fluid models should be examined first. Cal-culations should be performed with linear and nonlinear methods to evaluate the relative merits of the two approaches, to stu @ the importance of non-linear phenomena such as igact between adjacent cogonents, squeezing out of fluid between components, liquid sloshing in seismic analysis, and to estab-lish the value of igroved methodology in OBE and SSE analysis.
1 w.
.----..n
41&S u]
5.ib, PRIMARY AND INTERMEDIATE SYSTEM INTEGRITY The key s'afety functions of the primary and intermediate system boundaries are to contain and provide a flow path for primary and intermediate sodium, respectively. These system boundaries must be very reliabie to minimize the chances of sodium leaks (which could result in sodium fires, reduction in core flow or sodium level, or sodium-water interactions) and to preserve their function-ability as heat removal paths for those plants in which they are used for decay heat renioval.
The prin.ary and intermediate system boundaries should be designed, construc-ted, and operated to high standards to minimize the chances of sodium leaks.
The sodium piping systens in large LMFBRs must be relatively thin-walled and flexible to accommodate thermal gradients and thermal expansion. The structural design of these piping systems is typically controlled by thermal and seismic loads.
Emphasis should therefore be placed on assuring that these loads are properly accommodated by the design. The system used to support these pipes must allow expansion and dampen seismic loads but not result in unacceptable stress concentrations.
Appropriate provisions should be made for monitoring and/or testing these support systems throughout the life of the plant to assure their continued proper performance and functionability.
The sodium-water boundary in the steam generators should be designed for high reliability.
However, recognizing that leaks will occur, the plant should be designed to accommodate them, and operators should be trained in the appropri-ate response. The potential for both small and large leaks should be considered as well as possible common cause failure of more than one steam generator.
Instrumentation should be provided to detect small leaks in the primary and intermediate system.
The purpose of this instrumentation should be to inform i
plant operators of leakage so that they may take appropriate corrective actions.
n However, consideration should also be given to providing backup or automatic 4
i safety system actuation signals (e.g., based on loss of core flow or low sodium level) in case the sodium leak detection system fails or if the plant operators fail to take appropriate corrective actions.
The design of high reliability sodium piping systems is within current state of the art and is adequately covered by existing codes and standards.
The consequences of intermediate heat exchanger leaks are not sufficiently bad to constitute a major safety concern.
The key safety R&D need in this area is, therefore, to develop reliable steam generators to limit the chances of sodium-water interactions.
A secondary R&D need is to develop good sodium-water leak detection systems.
clb:1202 i
i L. J. Koch 11/24/81
,In-Service Inspection In-Service Inspection (ISI) involves periodic non-destructive testing (NDT) of critical system components during the operating lifetime of those components.
The primary thrust of ISI has been directed to the coolant pressure boundary of Light Water Reactors (LWR).
It involves NDT of pipe, vessels, valves and other primary coolant-containing components.
These examinations involve ultra-sonic and radiographic methods.
Because of difficulty of access and high radiation background, very sophisticated remotely controlled systems have been developed to perform these examinations of heavy-walled sections and weldments.
Fast reactors operata at low-pressure and the sodium coolant is contained in relatively thin-walled systems.
Coolant boundary integrity, however, is still a critical consideration because of the chemical activity of the coolant and the similar desire to avoid a loss of coolant accident.
Status The primary material of construction for coolant-containing components is austenitic stainless steel.
The information of interest, to be obtained by periodic examination is quite different than for LWR's.
Crack formation and early detection are not as critical in low-pressure systems.
Therefore, a comparable ISI technology has not been developed and a comparable program of examination has not i
been established.
!~
o In-Sarvice Insp2ction pego 2 i
Program Evaluations should be performed to identify required information to be developed by examination of critical components during their operating lifetime.
These should include the coolant boundary, but should emphasize those parameters of particular importance to retaining coolant boundary integrity in an LMFBR.
For example, sodium-piping system stresses are due to thermal expansion rather thaninternal pressure.
Examination for early identification of potential stress induced failures must reflect such indications.
Strain measurements includina outside the elastic range may be needed.
Cyclic loads can occur and measurements of these effects are also needed.
ISI of the coolant boundary will be cuite different for LMFBR's.
Some of the experience derived from the LWR program may be applice able, such as the remotely controlled equipment capable of working in areas of restricted access, but the examination devices and the measurements to be made will be quite different.
The ISI program for LMPBR's will require greater emphasis on
.in-reactor material surveillance.
Of particular interest will be the effects of fast neutron irradiation structural materials.
Measure-ment of this effect will require retrieval of samples for measurement and mapping; in situ measurement of physical changes (displacement, distortion, etc.) and possibly material property changes.
This program should be planned for the operating lifetime of the plant.
It should provide a continuous (periodic) record to permit extrapo-lation and predictive capability of future conditions.
h:. h
.s 8.
MAN-MACHINE INTERACTION A.
Background
Since the TMI-2 accident, much emphasis has been given to improving the man-machine interface (MMI), especially for LWR systems.
The objective is to improve the met. hods of control, diagnosis, and ultimate safety of nuclear power plants. Work in MMI can, in a crude characterization, be divided into soft and hard tecnnology. Soft techno-logy includes operator training, operator response to emergencies, human factors, and control panel design.
It is the present point of focus for LWR plants. Hard technology in the MMI area emphasizes the use of computers for on-line automatic diagnosis, control, and protection.
Two basic facts exist regarding the hard technology aspects of MMI:
(1) Proven techniques of failure detection and control for complicated and large systems exist in the military and aerospace industry, and (2) these techniques, to be successfully applied to reactor systems, must first be demonstrated in reactor power plants.
LWR plants are largely constrained to applying proven concepts and minimizing problems of retrofit. The LMFBR program is less constrained, since the opportunity exists to apply advanced concepts to a new and developing plant design in a systems sense.
B.
Technical Issues Technical issues for the MMI area include:
(1) Techniques of automatically identifying and eliminating incorrect information received from failing or failed sensors.
(2)
In the absence of complete information from plant sensors, correctly inferring plant status through use of on-line, real-time, plant dynamic models, f
(3) applying techniques of automatic control that, like the automatic plant protection system, improve overall plant reliability in i
a defendable manner for licensing, and
(4) developing computer hardware that is tolerant of internal faults and is highly reliable.
Underlying the foregoing issues is development of LMFBR power plant designs that emphasize operating characteristics to minimize demands on the operators, control system, and plant protection system.
LMFBRs have a potential for many safety-related advantages over LWRs in this regard.
C.
Status of Technoloay As previously noted, the MMI technology is highly developed, principally through work accomplished in the military and aerospace industries.
For example, Charles Stark Draper Laboratory has developed hardware and sof tware for control of military aircraft and missiles that maximize reliability of automatic control systems in combat situations.
The question is whether this technology can be successfully translated-to reactor power plants.
Soft technology aspects of MMI, as specifically applied to reactor power plants, are presently under intensive commercial develop-ment and are fairly well advanced.
However, hard technology aspects of MMI, as applied to either LMFBR or LWR systems, are not well developed and require basic demonstration of techniques in an operating power -
plant.
D.
Relationship to Safety philosophy The MMI concept goes far beyond control room design and operator psychology; it is, in fact, an integrated systems approach to l
nuclear power plant design and operation. properly applied, MMI techniques l
aid directly in accident prevention by assuring that operators will be -
able to diagnose accidents rapidly and accurately, and take appropriate corrective action.
l i
E.
Guidelines Control and diagnostic system design that, like the PPS, improve plant reliability in a manner defendable for licensing is the ultimate goal of this work. Computers should do what they do best, i.e., high speed calculations, dependable retrieval of large amounts of data, and dependable response to well defined situations, thereby freeing the operator to do what he does best, i.e., supervisory tasks, overall plant surveillance, and response to ill-defined events where judgments are required to make a decision.
The improvements in control system design will mature in stages. The current emphasis is on operator training, human factors, and control panel design.
Improvements in these areas can be realized first and with least perturbation to current plant designs. The next step will be improvements in diagnostic systems to provide an on-line indication of the reactor plants condition or " safety-state." This aspect utilizes the increasing capability of computer systems. The final step will be to develop and utilize fault-tolerant automatic control and diagnostic systems, applying the technology available for military and aerospace applications.
F.
R & D Requirements Demonstration of MMI techniques should be accomplished in existing experimental nuclear facilities such as
, EBR-II, and FFTF, and should be accomplished in close cooperation with those who have developed the techniques in other fields. This demonstration involves several stages to be successfully applied to advanced plant designs.
These stages are adaptation of techniques from other fields, testing the individual pieces of control and diagnostic system design, integration of the techniques into a systems design, and incorporating the results into an advanced reactor plant design.
hb -
9.
CORE DESIGN CONSIDERATIONS A.
Background
LMFCR core design considerations generally have safety implica-tions and in some cases are interrelated. These cesign considerations have become more sharply focused as woricwide LFSR design and operating experience accumulates. The EBR-I incident emphasized the need to under-stand the dynamics of reactivity feedback, while the Fermi incident under-lined the necessity of precluding flow blocakge in fuel assemblies.
Certain safety-related core design considerations are treated elsewhere in this document as specific issues. These in:lude core instrumentation, local faults in fuel and blanket assemblies, homogeneous vs. heterogeneous cores, and fuel type. The considerations discussed here relate more, but not completely, to mechanical aspects of core design; they begin with the fuel element and progress to whole-core behavior under upset conditions.
Regarding the fuel element, there is concern specific to oxide fuel of going to more aggressive designs. The choice of lower, rather than upper, fission gas plenum is no longer viewed as giving rise to safety problems. With the fuel assembly the concerns are wire vs. grid spacers, closed vs. open duct, and whether mechanical hold-down is required for seismic protection. With the fuel element cladding, assembly duct, control rod guide tube, and diagrid there is concern about acconnodating or reducing neutron-induced swelling. The extent of lateral core restraint provided relates both to the reactivity feedback and seismic response characteristics of the reactor. The reactivity feedback and stability, which depend upon the neutronic and mechanical characteristics of the reactor, assure its safe behavior under anticipated and unlikely upset, as well as normal, operating condi tions. Safe behavior under highly unlikely conditions, namely an unprotected loss-of-flow event, is a highly desirable design objective.
B.
Technical Isr>ues Mixed oxide fuel has relatively long doubling time characteristics.
Improvements may be realized by going to higher smeared fuel density, thinner-wall cladding, higher burnup, or higher linear power.
Each of these design changes will tend to increase the probability of cladding breach in an element. Consequences of such breaches are discussed in Safety Issue 21. Fuel Type. The technical issue here is the impact on plant factor (and thus doubling time) of safety requirements for operation with b ? ached fuel.
The fission gas plenum can be placed either at the top or bottom of a fuel element. A top plenum runs hotter and thus causes a greater hecp stress on the cladding at a given burnup. This may not be a dominant factor if fuel-cladding mechanical interaction is the major cause of c'3dding failure. A bottom plenum runs cooler and thus can be made smaller tc provide additional neutron shielding for the diagrid.
Earlier, there was concern that a bottom plenum breach would release fission gas that would recute the heat transfer from cladding to cool u t in the core.
Extensive analytical and experimental work at ANL and elsewhere has shown that fis-sicn gas release from breached fuel elements over a wide range of release rates would not result in enough overheating of adjacent elements to produce in:er-element failure prot,agation.
Wire spacers for fuel elements have the advantage of relative ease of fabricatun and low probability of solid particle or gas bubble hangup as long as they maintain adequate spacing. They have the dis-ac/antage of allowing contact between elements that can lead to local hotspots. Grid spacing has the advantage of maintaining separation be-tween elements and of having less structural material in-core, but may suffer the disadvantage of allowing hangup of particles or gas bubbles.
A perforated or open duct in an assembly provides additional protection against inlet flow blockage. Adequate protection is probably provided, however, by using multiple inlet ports. Further, open ducts will com-plicate the flow of coolant through an assembly.
Fuel ass 9mblies are usually held in place by mechanical as well as inherent hydraulic hold-down and gravity. Mechanical hold-down devices are an additional pro-tection against seismic events; they are located in the upper internal structure (UIS).
It is not clear that mechanical hold-down is necessary, and it complicates the design of the UIS. The issues here are whether there is any real improvement in safety in using one type of spacer in-stead of the other; in further pursuit of open-duct assembly design; and in requiring mechanical hold-down of assemblies.
Acconnodation of structural swelling was at one time handled simply by enlarging clearances, thus reducing breeding and increasing re-activity feedback due to assembly bowing. This issue is thus related to the method used for lateral core restraint. However, designers have learned to live with the problem for relatively high-swelling structural materials, and materials people have had considerable success in developing low-swelling alloys. Thus, although there are areas where the designer must be particularly attentive to structural swelling (e.g., differential swelling between element cladding and duct; shielding of diagrid) there appear to be no overriding technical problems at this time.
The EBR-II and PHENIX reactors are laterally unrestrained.
- FFTF, CRBR, Monju, and SNR-300 use passive restraint, where reactor assemblies are allowed to " flower" out to a restraining ring.
There is indication that an unrestrained core may result in less severe mechanical interaction during an earthquake.
The issue here is what lateral restraint of the core is preferable.
The issue of reactor feedback and stability for normal operation has always been of paramount importance in reactor design; it was brought into even sharper focus by the EBR-I accident. Requirements here are thus well-identified, both in 10CFR50A and in ANSI N214 (draft).
The role of reactivity feedback in response to reactor accidents has also received considerable attention. There is increasing belief in France, the UK, and the US that a large LMFBR can be designed to survive an unprotected loss-of-flow event.
Here " survive" implies that the con-sequences of this highly unlikely event would not have public safety implications.
It does not mean there would be no core damage, but rather that such damage would be minimal. Two conditions would have to be met for survival. First, primary flow coastdown would have to be slow enough to keep the power-to-flow ratio below an acceptable limit during an initial period of some tens of seconds. Second, sufficient inherent negative re-activity feedback would have to be introduced to drive the power down to a point where extensive sodium boiling in the core did not occur. Adequate feedback may be obtainable from thermal expansion of control rod drive-lines and of the diagrid, as well as from " flowering" of the core.
C.
Status of Technology Consequences of operation with brea:hed mixed oxide fuel elements are being addressed n the Run-Beyond-Claddin;-Breach and Operational Tran-sient programs at EBR-II.
Little or no work is currently underway in the US on the lower fission gas plenum.
It is nc:eworthy, however, that most countries with LMFBR programs, except the US and Japan, use lower fission gas plenums in their fuel elements.
Irradiation testing and modeling of con-sequences of contact between fuel elements hating wire spacers is underway in the US and France. Similar work on elements having grid spacers is being done in Germany. No definitive conclusions are presently emerging regarding one type of spacer vs. the other.
Little work is known to be underway on closed vs. open ducts and hold-dcwn requirements.
Design work to accommodate swelling of structural materials and testing of low-swelling materials is underway throughout the world.
Similarly, work is being done at ANL, W-ARD, and elsewhere on the best approach to lateral restraint of an LMFBR, a consideration of increasing importance with regard to seismic protection. As indicated earlier, LMFBR core designers are sensitive to the problem of providing adequate reactor feedback and stability. Finally, an increasing amount of analytical work is being done to explore further the possibility of survival of an unprotected loss of flow.
D.
Relationship to Safety Philosophy Most core design (and many plant design) considerations have safety implications that must be evaluated in an overall cost / benefit context, which is a key requirement of the safety philosophy. One such consideration is the consequences of providing features to mitigate or prevent an unprotected loss-of-flow event. This event is highly unlikely to occur. Thus, the question is whether providing protection against this highly unlikely event will increase the probability of damage from more likely events, such as scrams.
E.
Guidelines Supplemental safety features to protect against or mitigate consequences of highly unlikely events should not compromise core or plant performance under more likely upset conditions. That is, such features must be evaluated in an overall cost / benefit context.
o
~.
F.
R&D Requirements Testir.g of more aggressive designs of mixed oxide fuel elements is underway.
The scope of the test program is judged at this point to be adequate to resolve tha identified safety issues. The use of lower fission gas plenums in LMFBR fuel elements in the US should be re-evaluated.
Further work should be done on irradiation testing and modeling of consequences of contact between wire-wrapped fuel elements (see item 11. Local Faults in Fuel and Blanket Assemblies). The advantages and disadvantages of closed vs. open assembly ducts should be delineated.
It should be established that mechani-cal hold-down of assemblies is or is not necessary and how best to handle lateral restraint of a core. Finally, more analysis and testing is needed to determine whether appropriate core design features can be developed to prevent or mitigate consequences of an unprotected Icss of flow, and whether inclusion of these features introduces new safety-related problems.
d
%. s %
l 10.
CDRE INSTRUMENTATION A.
B'ackground Foreign fast reactors have been equipped with core exit thermo-couples which are used for automatic reactor shutdown.
U. S. fast reactors such as FFTF and CRBR use thermocouples to monitor core performance but do not automatically cause shutdown if limits are exceeded. FFTF includes one eddy-current flowmeter in addition to 3 thermocouples at each sub-assembly outlet. The FFTP flowmeters are not connected to the reactor shutdown system.
B.
Technical Issues LMFBR's are planned to be operated with partially failed fuel.
Instrumentation is required to detect and to locate fuel failures should they occur. If a failure occurs, does the failure propagate in a manner which leads to core damage?
Therefore, should instrumentation be provided to monitor core performance and to automatically shutdown the reactor if some specified limit is exceeded?
C.
Status of Technology Thermocouples, flowmeters, boiling detectors, and delayed neutron detectors have been developed for use in an LMFBR environment.
Due to lack of operational data, reliability estimates for these components have large uncertainties and therefore there is reluctance in the U. S.
to include core performance sensors in the automatic shutdown system.
D.
_ Relationship to Safety Philosophy Failed fuel is an expected event, therefore instrumentation used to detect failed fuel and to monitor core performance can be classified as important to accident prevention.
E.
Guidelines currently no guidelines exist on the requirements for LMFBR core instrumentation.
F.
R & D Requirements The R&D requirements for LHFBR core instrumentation is closely related to the R&D being performed for fuel failure propagation. Resolution is required for the issue as to whether core instrumentation can be effectively used to prevent accidents if fuel failure occurs and significantly alters core performance and whether the instrument signals should be i
included in the automatic reactor trip system.
l l
i l
l A
e bds
- 11. LOCAL FAULTS IN FUEL AND BLANKET ASSEMBLIES A.
Background
Local faults are abnormal local conditions of power or flow in LMFBR driver fuel and blanket assemblies which have the potential of causing failure of a significant number of elements, or in the extreme, causing failure of adjacent assemblies.
Because of the high power density and close packing of fuel elements, local faults have been a significant concern in the design and operation of power-producing LMFBRs. The safety interest focuses on the potential for propagative failure between fuel elements and the ability to detect a significant failure state, while the designer interest centers on the consequences of less severe individual fuel ele-ment failures and their detection.
Based upon extensive experimental data and analyses, it has been concluded that for current fuel element designs using mixed-oxide fuel and stainless steel cladding, and under normal operating conditions, local faults would neither lead to rapid element-to-element nor assembly-to-assembly failure propagation without being de-tected and remedial action taken.
However, systematic studies have not been made of off-normal transient effects on local faults, nor has exten-sive work been done on advanced driver fuel and blanket elements having aggressive design features such as higher density fuel, thinner wall cladding, new cladding alloys, higher power rating, etc.
B.
Technical Issues The main technical issue that requires resolution through testing is whether continued operation of a comercial LMFBR can be allowed with known local faults and, if continued operation is allowed, what degree of degradation is safely acceptable. The secondary issue is whether local faults can be reliably monitored so as te insure that no dangerous or untested condition can be present. To enable intelligent action to be taken, the operator must be provided with accurate information about the nature and source of the fault.
It is thus necessary to develop an operating
+
philosophy that permits operation not only beyond an indication of fission gas release from breached elements to the cover gas, but beyond a detectable delayed neutron (DN) signal to a DN shutdown limit.
2-C.
Status of Technolooy Local-faults testing has been identified as a najor item in the DOE /RRT LMFBR Safety Program plan, with the goal of reaching final resolu-tion over the next few years.
Such testing is directed to prevention, detection, location, and accommodation of local faults.
Although both the national Run-Beyond-Cladding-Breach (RBCB) and Operational Transient (OT) programs, which are being conducted in EBR-II as part of fuel development efforts, will address transient effects on fuel performance, the degree of fuel breach and the extent of fault detection will be limited. The EBR-II Local Faults Test (LFT) program will test fuel elements with more severe defects and additional faults (e.g., elements in line contact) and under more severe transient conditions. Here the study of fault detection techniques to insure operational safety and to strengthen the li:ensing position for future LMFBRs will receive major emphasis.
This work will build upon and be an extension of detection-and accommodation-oriented tests carried out in the SLSF in ETR. This latter work culminated in the multiple-heat-generating-blockage P4 test.
D.
Relationship to Safety Philosophy An unduly conservative LMFBR operating philosophy can be selected to eliminate local fault safety issues, namely oper ition only to the point of initial release of fission gas to the cover gas. But greater demands will be made upon fuel performance as the LMFBR is economically optimized.
The purpose of the 00E/RRT LFT program is to provide the basis for a more aggressive mode of reactor operation while providing assurance that opera-tors will be able to take appropriate corrective action when a local fault condition is present in the reactor. This basis relates to safety philosophy through consideratiens of cost vs. benefit, accident prevention, and acci-dent mitigation.
E.
Guidelines Mixed oxide fuel and blanket assemblies should be operated be-yond the points of fission gas release to the cover gas and of initial DN signal up to a safety-related DN limit.
In order to operate to this limit
3-it will be necessary to demonstrate that local faults in fuel and blanket assemblies can be detected and be accommodated to some extent. For such operation it will also be necessary to demonstrate that an assembly con-taining a local fault can be located so that it can be removed, if necessary, in a situation where other assemblies are leaking fission gas to the cover gas. The goal is an operating strategy that:
(1) permits operation with all assemblies to their goal burnup, even if some contain locat faults; (2) if this is not possible, to continue operat'on to the next scheduled refueling interval, and; (3) if this is not possible to determine at what DN signal level to require reactor shutdown. Moreover, it is highly de-sirable that this strategy allow operation without instrumentation at the outlet of each fuel assembly.
F.
R&D Requirements g
It is expected that the R&D requirements in this area will be met in the course of the LFT program. These requirements are in the areas of prevention, detection, location, and accommodation of local faults.
T. ; )
w.,
l l
l
N:.
t 5
e g
12.,DBA and CDA CONSIDERATIONS A.
Background
In tne current licensing approach a set of design basis accidents (DBAs) are defined. The system is then designed to accommodate these DBAs.
Furthermore, it is stipulated that in the analysis associated with showing that the system can accommodate the DBAs, conservative assumptions are to be used at every turn. Various codes and standards are applied to assure that appropriate margins are associated with the DBAs. At every point where there is uncertainty one must make the most pessimistic assumptions.
It is within this legalistic framework that DBAs are analyzed.
It has become usual for regulatory considerations on fast breeder reactors to consider the effects of a core disruptive accident (CDA).
In this connection we define the core disruptive accident to be one that leads to a major loss of geometry within the system. Specifically, we associate the term
" core disruptive accident" to disruption that may or ney not be energetic.
The substantive point here is that some times the term " core disruptive accident" is used to mean only an energetic disassembly accident, but in our terminology we use the more general definition.
Such core disruptive accidents are considered in analyzing this system and reflect themselves in various ways back in the design. The question that does occur is whether such core disruptive accidents should be considered among the set of DBAs. The general practice up to now has been to exclude the CDA from the set of DBAs. Nevertheless, the impact of the CDA on the safety of the system is a key part of the regulatory process. This has led to considerable confusion in that an accident that is not a design basis l
2 accident nevertheless has a key impact on design.
{
B.
Technical Issues The technical issues that are associated with this problem relate to the degree of knowledge that is associated with the analyses of the various DBAs and also the analyses associated with the CDA.
In order to have an accident within the family of the DBAs, one must be able to analyze such events with considerable certainty. This is clearly the case if the event has the potential for being serious or can be ratcheted into a serious situation. Such analyses must be performed and the system designed in a way that provides high assurance that the DBA can be accommodated. The technical issue related to core disruptive accidents is whether such events are inherently analyzable with sufficient precision to be useful as DBAs.
C.
Status of Technology Although a large amount has been learned about the events occurring in core disruptive accidents, the status of the technology now and in the foreseeable future is such that it cannot easily fit into the DBA constraints. One can make reasonable best estimates and even reasonably conservative assumptions that would allow defensible analyses. But one cannot make the most pessimistic assumption at every turn and still find a design that could accommodate the event. The phenomena associated with core disruption, degree of fuel and other material, fuel coolability, mechanisms by which the core enters the transition phase, how the event terminates, and if debris is formed what its subsequent behavior is, all have elements of non-reproducibility and uncertainty that preclude a design basis accident approach. Specific major uncertainties exist on early fuel motion, early clad l
l i
3 motion, failure of fuel under high power conditions, and subsequent energetics and post accident behavior. Defensible limits can be put which would limit the energetics with reasonable conservatism such that the system could accosmodate the event, but not under the most pessimistic assumptions.
D.
Relationship to Safety Philosophy Consistent with the balanced defense in depth safety philosophy, in addition to showing that the system can accommodate all DBAs,- the core disruptive accident must be shown to have extremely low probability and also must be shown that it can be accommodated with reasonable certainty. The latter nost be shown with reasonable but conservative estimates.
E.
Guidelines The recommended guidelines are, if possible, to eliminate the design i
basis accident approach so that we can remove the confusion resulting from considering some events (CDAs) in the design but labelling them as non DBAs.
CDAs should be then considered in the design in some reasonably conservative framework. Within such analysis, the design should be shown to be able to accommodate the core disruptive accident. Even though it will be impossible to discuss in great detail the precise scenario of the core disruptive accident, certain bounding aspects can he provided which show that the design can be such as to accommodate the CDA. The specific design implications are likely to then reflect themselves in primary i;ystem containment requirements that are designed to withstand some reasonably high energetics, in the range of 1000 MW sec. Also, some proc'.!:1 for accommodation of core debris should be made for the system that would allow containment integrity to be preserved without venting for some specified length of time, perhaps of the order of one
4 or more ckys. Other lesser events that fall in the category of currently defined design basis accidents would also be designed against or accommodation provided, perhaps with muchgieater certainty than is the case for the core disruptive accident.
F.
R&D Requirements The essential R&D requirements relate to understanding and characterizing the phenomena and likely consequences of core disruptive accidents. Various core disruptive accidents with different initiators, such as transient overpower, loss-of-flow, and loss-of flow driven transient overpower all must be considered. The essential requirement is to establish limiting and defensible limits on the core disruptive phenomena; in particular, this includes the establishment of defensible limits on energetics. Similarly, one must establish the characteristics of debris formation and subsequent behavior and design the system to suitably accommodate the debris. Both energetics and debris accommodation will be required in order to defend positions related to containment integrity.
blQ.-
- 13. ACCIDENT ENERGETICS A.
Background
' '/
One of the major concerns associated with core disruptive accidents is the degree to which there is accident energetics. The other major item is debris accommodation. The threat to containment comes either through a pressure loading associated with accident energetics or a threat from debris behavior which could result either in a thennal or a pressure loading challenge to containment.
In assessing the likely sources of energetics from a core disruptive accident, the various phenomena under consideration are limited to three primary challenges.
(1) Recriticality.
i As a core disruptive accident progresses, it may not terminate immediately with mechanical disassembly but rather go into a generally disrupted phase frequently called the trans! tion phase in which the core materials become a large molten mass but not sufficiently subcritical to have terminated the event once and for all. Then, in this mode, the potential exists, at least in principle, for some mechanism to compact the core, j
thereby increasing the reactivity and leading to a significant energetics burst.
(2) Fuel-coolant interaction.
1 As the core disrupts and heats up, the molten material, I
consisting of fuel and structural material, can reach temperatures that are thousands of degrees higher than the
,e 2
~.
boiling point of sodium.
If a mechanism exists for the energy to be transferred rapidly (in the order of milliseconds) to the sodium then, in principle, the sodium could vaporize explosively and become the working fluid. With sodium vapor as the working fluid, far larger energetics can be. reached than if fuel vapor is the working fluid.
(3) Positive sodium void coefficient.
Large unifonn LMFBR cores have large positive sodium void coefficients of reactivity.
If sodium should be lost from much of the core, reactivity additions of the order of $6 or $8 could result. This introduces, at least in principle, the possibility that large reactivity insertion rates could arise under accident conditions from the rapid ejection of sodium from the core.
We do not include among the sources of energetics the possibility of a very large reactivity ramp rate increase arising from some external source (i.e., not associated with recriticality or sodium void coefficient). We believe that this exclusion is appropriate even though such external events are possible. One source of a high reactivity rate might be the catastrophic failure of the core support structure which, by the resultant pulling away of the core under gravity from the control rods, could lead to a large reactivity j-insertion rate. However, such events are of sufficiently low probability that J
they do not merit serious consideration. In any event, these events are v
bounded by the other sources of energetics that are being analyzed.
3 B.
Technical Issues The issues generally fall into the following three areas.
(1) Recriticality.
The technical issues include the behavior of the transition phase in the investigation of whether there are any feasible phenomena that could lead to high reactivity ramp rates in this phase. The main issue here relates to whether' there are inherently dispersive mechanisms that offset any tendency to compactive motions. One mode of high recriticality ramp rate might result from the ejection of molten fuel into a sodium region. One is concerned then with the degree to which sodium vapor that is formed through interaction of molten fuel with the sodium may force the molten fuel back into the core region.
It should be noted that a sodium interaction far weaker than that required for an explosive fuel-coolant interaction (of concern with respect to direct damage to primary containment) could lead to high reactivity rLc? etes of concern with respect to recriticality. The essentiai technical issue is whether inherently dispersive mechanisms preclude recriticality.
(2) Fuel-coolant interaction.
In the event of a fuel-coolant interaction, the essential technical issue arises from considerations of whether, in the oxide fuel system, molten oxide interacting with sodium under 1
reactor conditions can lead to explosive fuel-coolant thermal 1
i
t' it5 N *.-
- 21. FUEL TYPE A.
Background
.The reference LMFBR fuel in the U.S. as well as abroad is mixed oxide, (U-Pu)0. This universal choice resulted largely from favorable 2
fabrication and operating experience with UO fuel in LWR's.
Extensive 2
worldwide operating experience with mixed oxide fuel in LMFBR's has con-firmed its excellent performance as long as its cladding remains unbreached or, if breached, leaks fission gas but does not expose fuel directly to the primary sodium coolant.
It has always been recognized that an inherent problem with mixed oxide fuel is its low theoretical density relative to that of mixed carbide, (U-Pu)C, or (U-Pu) diluent metal alloy fuel. That is, a mixed oxide-fueled LMFBR has inherently poorer breeding characteristics than either a corresponding mixed carbide or metal-fueled LMFBR. Mainly for this reason, some R&D has been done on mixed carbide, and to a much lesser extent, on mixed metal fuel.
B.
Technical Issues Mixed oxide, carbide, and metal fuel all have, broadly safety-related issues that are currently unresolved.
If sodium is ingested by a breached mixed oxide fuel element, chemical reaction will occur to form a lower density sodium uranate-plutonate, Na3 (U-Pu)0.
Formation of this 4
material in the element may lead to breach extension, particularly if the element has undergone extensive irradiation resulting in embrittlement of its cladding. The technical issues are whether extended breach will result in contamination of sodium by fission products and fuel or whether the breached element will cause failure of its neighbors. Accordingly, the operating issues are:
(1) whether a breached element that has ingested sodium can remain in the reactor until the next scheduled shutdown for refueling if it is required to withstand upset, as well as normal, operation; (2) if it cannot do so, when must it be removed; (3) can breach area be correlated with delayed neutron signal; and (4) can a breached element be located rapidly and with adequate reliability.
It appears that these l
l
A
.2-1ssues are more likely to relate to plant availability than to public safety, although they will have to be addressed in controlling safety documents such as Technical Specifications.
Neither mixed carbide rior metal fuel reacts chemically with sodium, which is often used as a thermal bond in elements containing these fuels. On the other hand, fuel loss may occur from breached carbide elcments by simple erosion in flowing sodium.
Furthermore, unlike oxide fuel, mixed carbide fuel has the potential for severe molten fuel-coolant interaction (MFCI) In a core-disruptive accident (CDA).
If'real, this is a public safety issue. Metal fuel is not susceptible to such severe thermal interaction with coolant, but it has the potential for cladding breach from penetration by eutectic if sodium boiling results from a loss of heat sink accident. 'w i s minest--lN1y a plent-4vailahility issue.
C.
Status of Technoloay The technical issues related to the performance of breached, as well as unbreached, mixed oxide fuel elements.under normal and moderate upset conditions are being addressed in the Run Beyond Cladding Breach (RBCB), Operational Transient (OT), and Local Fault Test (LFT) programs in EBR-II. Testing of such fuel under severe upset conditions is an ongoing program in TREAT and was done in SLSF/ETR.
Tests are underway at ANL and elsewhere to better understand the potential for mixed carbide fuel to undergo MFCI. No testing of metal fuel is currently planned to determine the extent of eutectic penetration of cladding under sodium boiling conditions.
D.
Relationship to Safety Philosophy All of the three fuel types thus have intrinsic characteristics that are in the case of oxide, or may be in the case of carbide and metal, undesirable. Of the three, however, only the carbide may have a problem that directly impacts public safety.
If carbide does undergo a severe MFCI, its use would be contrary to the safety philosophy of requiring an LMFBR to include features to accommodate accidents, including major core damage and its consequences. Proper testing of oxide fuel should
3-4 provide assurance that operators will be able to diagnose sequential fuel element cladding breaches and take oppropriate corrective action.
If the 4>
MFCI probl'em with carbide fuel is real and if metal fuel can survive m<I*'
operation under sodium boiling conditions, then metal fuel would be the b:
most inherently safe of the three fuel types.
E.
Guidelines It is reasonable to assume tnat mixed oxide fuel will be used e
in at least early generation LMFBR's. Whether it will be used subsequently will depend upon such factors as the impact of breached element operation on plant performance and the ability to improve the design of oxide elements to achieve required breeding, economic, etc., goals. The perfor-f mance of oxide fuel in LMFBR's and test reactors throughout the world should continue to.be evaluated to further strengthen the argument that there are no f W
- e r u fety problems with this fuel type. Neither i
1
- mixed carbide nor metal fuel would likely be considered for whole core use at this relatively early stage of their development, but each offers long-range potential in terms of breeding and thermal performance.
F.
R&D Requirements Further safety-related testing of mixed oxide fuel in EBR-II and TREAT should be done to demonstrate its inherently safe behavior under faulted, as well as normal, operating conditions. Before investing much more effort in the steady-state irradiation of mixed carbide fuel, its potential MFCI problem should be resolved. Similarly, the ability of metal fuel to survive operation in boiling sodium should be demonstrated as a beginning of work on this fuel.
t l
s
, W-D 22.
SABOTAGE A.
Background
Title 10, Chapter 1, Code of Federal Regulations, Part 50, Domestic Licensing of Production and Utilization Facilities, in Paragraph 50.34, Contents of Applications: Technical Information, requires the following:
Section (c) Physica'l security plan Section (d) Safeguards contingency plan The NRC Regulatory position is given in Regulatori Guide 1.17, Protection of Nuclear Power Plants Against Industrial Sabotage.
The NRC has sponsored work at Sandia National Laboratory on sabotage, security and safeguards relating to light water reactor power plants.
Classified reports on this work have been issued by Sandia and appear in the attached list of references.
B.
Technical Issues An LMTBR power plant should be designed to meet the requirements of R.G. 1.17.
The following statements have been extracted from R.G.1.17 to summarize the technical issue as related to LMFBR plant design:
"In addition to the procedural measures described in ANSI N18.17, the design of structures, systems, and components important to safety (e.g., such features as redundancy, automation, independence, diversity, protection against common-mode failures, and the placement of facilities and equipment) can also provide protection against acts of industrial sabotage. Therefore, it is considered prudent to enhance this form of protection by protecting the vital equipment against surreptitious acts of industrial sabotage that could impair the performaace of its intended safety functions. It is important that such protection be considered early in the design stage and that protective measures be described in the application for a construction permit."
" Appropriate design features and equipment arrangements should be provided and be consistent with other safety requirements to reduce the opportunity for successful industrial sabotage of vital equipment.
To the extent feasible, these features should include measures to protect against undetected intentional acts that could impair equip-ment performance, such as automatic indication of inoperability."
C.
Status of Technology The design of an LMFBR includes features which compartmentalize the components of sodium systems. Sodium fires are suppressed by providing
'2-inerting atmospheres. These design features inherently limit ready access to vital pieces of equipment and support the R.G.1.17 require-ment to reduce the opportunity for successful industrial sabotage of vital eqaipment.
D.
Relationship to Safety Philosophy The need to design an LMFBR to be resistant to direct acts of sabotage is directly rel,ated to accident prevention.
E.
Guidelines Standard ANS-3 1/N18.17, "American National Standard for Industrial Security for Nuclear Power Plants" provides criteria for industrial security programs to protect operational nuclear power plants from acts of industrial sabotage that could lead to a threat to the health and safety of the public. Regulatory Guide 1.17 goes beyond the procedural measures described in ANS-3.3/N18.17 and offers general guidance with respect to plant design features.
F.
R & D Requirements The same concepts applied by Sandia National Laboratory to assess the vulnerability of a PWR to acts of sabotage should be applied to an LMFBR.
As stated previously, the LMFBR uses the feature of com-partmentalization of sodium systems which reduces the susceptibility of an LMFBR to acts of sabotage, but there are other key LMEBR systems which should be assessed, such as the natural circulation shutdown heat removal system and ultimate heat sink.
~
o REFERDJCES CLASSIFIED v..<
1.
SAND 74-0069 Part I - Case Study of a Typical PWR Plant, March 1975 2.
SAND 75-0336 Part II - Case Study of a Typical BNP Plant, October 1975 3.
SAND 76-0108 Safety and' Security of Nuclear Power Reactors to Acts of Sabotage Part III - Current U.S. LWR Plants, March 1977 4.
NUREC/CR-0334 SAND 78-0268 Sabotage, Security and Safeguards in Urban Area Transport of Radio-active Materials -- Interim Report David M. Ericson, Jr., December,1978 5.
SAND 77-0644 Reactor Safeguards Systems Assessment and Design, Volume II G. Bruce Varnado, David M. Ericson, Jr, Sharon L. Daniel, Harold A. Bennett, and Bernie L. Hulme, April 1979 UNCLASSIFIED 6.
D. M. Erickson and G. Bruce Varnado, " Nuclear Power Plant Design Concepts for Sabotage Protection", Vol.1, NUREQ/CR-1345, SAND 80-0477/1, January 1981 7.
D. M. Erickson and G. Bruce Varnado, " Nuclear Power Plant Design Concepts for Sabotage Protection", Vol. 2, Appendices D, E, F, and G, NUREQ/CR-1345, SAND 80-0477/ 2, January 1981.
I I
I l
l
o M91. h 7 Diversion of Breeder Reactor Fuel.
j The possibility of the diversion of fissile material--whether highly enriched uranium (HEU) or plutonium--has long been a matter of concern in connection with nuclear operations. Plutonium has often been supposed to constitute a more serious concern than HEU, in part as a consequence of its relatively high toxicity and partly because of the fact that a smaller amount would suffice to produce a nuclear explosion. Such concern will be accentuated Cs a result of the advent of commercial breeder reactors because of the large amounts of Pu involved, although many aspects of the matter are not really very different from those presently applying in connection with the weapons program, or those which would be presented by reprocessing commercial LWR fuel.
Without questioning the fact that strict safeguards will be necessary in connection with a reactor fuel cycle using Pu, a number of relevant points should be kept in mind:
1.
Pu in an operating reactor or in spent fuel storage does not offer an attractive target since these materials are self-protecting. The places requiring attention are the output end of fuel reprocessing operations, Pu storage facilities, and new fuel fabrication plants.
1 2.
It is true that Pu is potentially lethal in very small amounts but it is scarcely the most toxic substance in existence; and botulin or cyanide, which are also lethal in very small amounts, are easier to come by, as easy or easier to distribute, and act much more promptly.
In addition, Pu is also hazardous for the would-be saboteur so that he
\\
l l
2 must observe very much more strict precautions in handling Pu than for U-235.
3.
The difference in critical mass, which would translate roughly into the difference in amounts required for an explosive is about a factor of three for weapons grade Pu, and rather less for reactor-grade.
However, the difference in detectability is more than a factor of ten, so that a portal monitor which would detect 10 grams of U-235, would, with equal efforts at shielding or concealment, detect less than 1 gram Pu.
4.
The fuel for the CRBR is reactor-grade Pu and contains
- 22% of the even Pu isotopes (238, 240, 242). As a result it has a quite strong neutron source; and the Pu in a breeder reactor cycle would normally be even more marked in this respect. Such material can certainly be used to produce an effective explosion; but it requires a much higher assembly velocity (which is to say a higher level of art) than would suffice to produce an explosion with U-235.
In addition, the CRBR plutonium fuel has a heat source of about 10 W/kg, and material from an operating cycle will have a larger heat source. This feature could also cause problems in device design.
5.
Considering only the neutron physics involved, even the fresh fuel for a breeder reactor (Pu 0 P us UO in a ratio of about 1 to 3) is a l
2 2
potentially explosive material.
If one were to attempt to use it directly however, because of the large dilution with inert UO and 2
the relatively low density attainable in the fabricated parts (certainly
.a
=
3 I
less than the crystal density, and probably considerably less) quite large amounts of material would have to be diverted--one or a few hundred kg. Since it would also be necessary to use a high explosive assembly method to obtain a significant explosion, a total device weight would be at least a few tons. Anyone capable of handling this material in this fone would find it preferable to separate the Pu from f
the U and reduce the material to metal.
t i
i 6.
The separation of Pu from breeder fuel is a chemical operation and is enormously simpler than an isotope separation. The necessary steps for the process are fully described in the open literature. Never-theless, the operation can not be regarded as really simple, nor appropriate for inexperienced people, since rather special equipment is required and a variety of serious hazards are involved, all of which would have to be understood and provided against.
7.
Though Pu has be(n regarded as important in the weapons programs of the nuclear weapons states there is no evidence that any of these have made appreciable use of reactor-grade Pu for this purpose.
- Indeed, for the U.S. it is clear that this has not been the case in spite of the fact that considerable quantities of reactor-grade Pu are avail-l able.
l l
l l
^
~ \\ ~~
'~
4 l
From the points mentioned above it becomes clear that the diverteur or saboteur interested in acquiring the material for only one or a few explosive devices will have a strong order of preference as to materials: HEU, weapons-grade Pu, or reactor-grade Pu.
For such a purpose HEU is in a class by itself, i
since it offers more latitude in design options, including some much simpler options. The natural order of preference would, of course, be overridden if one of these materials were relatively much more easily available., Pu from the breeder reactor cycle would warrant more serious concern than the others only if the safeguards for it were appreciably less adequate. The important conclusion is that all of them require safeguards.
JCH: lam I
l f
e e
4 interactions.
It is known that such thermal explosions can and do occur under appropriate conditions in a number of industries. Whether such events can occur in a reactor depends upon the properties of the two fluids involved and on the modes of interaction that are possible under reactor conditions.
It should be noted here that whether fuel-coolant interactions can occur nay be extremely dependent upon the choice of fuel.
Quite different results might occur between oxide, carbide, and metal fuel.
(3) Positive sodium void coefficient.
With respect to the sodium void coefficient, the essential technical issues relate not to the amount of reactivity associated with the positive sodium void but whether or not such large amounts of reactivity can, in fact, occur coherently enough to lead to large reactivity ramp rates. In particular, one must analyze the degree to which other mechanisms might be coming in, associated primarily with fuel dispersal, to offset the amount of positive sodium void reactivity. Such phenomena would be of particular relevance if a fair amount of incoherence exists. As the positive sodium void coefficient comes in, if offsetting negative reactivity fuel dispersal occurs with a sufficiently small time lag, the extremely high reactivity ramp rates associated with full positive sodium void would never occur.
If the positive sodium void coefficient does lead to a large overpower transient, then a new set of
5 technical issues also enter, related to the behavior of fuel which is failing into sodium filled channels and occurring at very high reactor power. The relevant phenomena entering here relate to the reactivity race between reactivity addition from extremely rapid sodium ejection and reactivity reduction from fuel dispersal.
C.
Status of Technology (1) Recriticality.
Many experiments and analyses have been performed and they generally all corroborate the theory that there is no realistic mechanism for major compaction of the core. While some small compacting motions have been seen, they are not significant enough to lead to dangerous ramp rates. They clearly all support the theory, albeit not conclusively, that dispersive mechanisms lead to generally monotonic fuel dispersal. The main dificiency in such experiments is the absence of large test bundles. However, both from theory and experiments, a good case can be made now that the risk of recriticality, either from gravity driven recompaction or pressure driven recompaction (the pressure arising from the molten fuel-sodium interaction) appear to not exist to the degree necessary for a major recriticality event. However, proof, with the required degree of certainty, is not yet available.
(2) Fuel-coolant interaction.
Many experiments have uniformly shown that for oxide fuel, no
6 fuel-coolant interaction occurs with energy large enough to challenge containment.
In any reactor simulating experiment, the efficiency (ratio of work against structures to energy potentially available) is far less than one percent. The most widely held theory also supports the conclusion of no significant energetic fuel-coolant interaction. There is large
~
concensus on this point, but not universal agreement. There are some theories that assume other phenomena that might lead to a more explosive interactfun. This issue is almost closed, but some additional work is required. At least the developments and theories ?S they are propounded by those not fully convinced should be followed.
(3) Positive sodium void coefficient.
This issue is very much up in the air. The more prudent decision at this point is to proceed with core designs that minimize the positive sodium void coefficient (see section on homogeneous vs. heterogeneous cores). At this stage, one cannot sAy that large values from the positive sodium void coefficient rey not lead to energetic events. The status of the technology is one that does not have fully definitive information on the degree of early fuel dispersal; that is, the fuel dispersal immediately following sodium voiding. This early fuel dispersal may occur in a time frame that is associated with the incoherence of voiding in different subassemblies. This early fuel dispersal could lead to enough
7 negative offsetting reactivity to avoid the very large reactivity associated with sodium void. The wort here is still at a fairly early stage and far more work must be do~n before a definitive conclusion can be reached.
D.
Relationship to Safety Philosophy The safety philosophy requires that more than reliance on prevention of core disruption must be factored into the design. Designs should have the requirement that the core is non-energetic under core disruption. There may be impacts related to fuel type. We believe that the oxide system insofar as i
the fuel coolant interaction is concerned, has been established as I
satisfactory. An open question still exists relative to advanced fuels, carbides and metals. Further work must be done to establish whether or not core designs relating to sodium void coefficient reductions are required but the essential factor is that we believe the requirement should be such that the ultimate core design selected should be one that has little energetics potential under accident conditions.
E.
Guidelines Guidelines primarily relate to the choice of a core design which has little potential for energetics, and the design of a containment system which can accommodate an energetics source term far above that expected in any reasonable analysis of core disruption.
In the selection of core design, the following issues will play a central role. Additional proof relative to the advanced fuel types is required and may limit the choice to the oxide system, but this would be a very premature conclusion at this time. The design decision would also relate to a selection of a core configuration such that
8 energetic disassembly arising from the reactivity associated with a positive sodium void coefficient cannot occur.
It is premature to decide at this point whether it would imply a heterogeneous core, but the requirement of a non-
~
energetic core should be the basis for the selection of a core design.
F.
R&D Requirements Most of the remaining R&D requirements should focus on the recriticality potential associated with the transition phase and the full impact of the positive sodium void coefficient in order to have a firm basis for selection of homogeneous vs. heterogeneous cores. Relatively little additional work associated with the fuel-coolant interaction is required, at least in the oxide system. In the event the carbide system or metal system is selected, then considerable additional work is required in the fuel-coolant interaction area.
An experimental basis must be further established for the arguments associated with the transition phase. Both in-pile and out-of-pile experiments must be performed to support and demonstrate the arguments for fuel dispersal without any major compactive motion, in order to rule out recriticality energetics. Such experiments may require larger bundle sizes than experiments to date. The need for larger bundle sizes than potentially possible within the current facility envelope is not yet clear, but has to remain a continuing issue for periodic review.
A solid experiment and theoretical base must be established relative to the need for designs to minimize the positive sodium void coefficient.
Here the primary phenomena to be investigated are the degree of coherence in
~
sodium voiding, the degree of early fuel dispersal which would offset the l
9 sodium void reactivity, and the behavior of fuel failing in sodium filled channels under high reactivity ramp rates and high reactor power levels. From a synthesis of all these phenomena, appropriate decisions can be made to establish the degree to which the various core designs have a potential for high energetics.
Additional R&D must also be performed to further demonstrate and validate the analysis associated with the response of the containment system 4
to given energetic source terms. This part of the analysis is fairly well established but may be excessively conservative. The methodology for fully considering the hydrodynamic dissipation of energy must be further developed and validated.
l l
T bM/ug(.
~
j
- 14. HOMOGENEOUS VS. HETEROGENEOUS CORES A.
Background
The positive sodium void coefficient can be much reduced by selec-l tion of core design. Over the years, a number of different approaches have been considered for this. These approaches have gone under a variety of names.
In the late 1960s, the term used was " spoiled geometry". Now, the concept is referred to as a " heterogeneous" core. The concept in all cases is the same. As is well known, systems that are neutronically small with high neutron leakage have negative sodium void coefficients or very small positive sodium void coefficients. Systems that are large have positive sodium void coefficients. Therefore, the solution is to find the system that is physic-ally large but is nevertheless neutronically small; that is, has high neutron leakage. This can be accomplished in a variety of ways.
Earlier concepts included annular cores, flat pancake cores, and modular cores. The most popular concept now is the annular, or bull's eye system with alternate annu-lar fissile and fertile regions. Such systems are referred to as heterogene-ous cores. As a practical matter, it is not feasible to reduce the six or eight dollars of reactivity that is associated with a normal large homogeneous core down to a negative value or zero value. Practical considerations pre-clude going below about two or three dollars of positive sodium void reactiv-ity. However, analysis has shown that such relatively small amounts of positive sodium void reactivity appear to preclude significant energetics from the positive sodium coid coefficient.
B.
Technical Issues The fundamental technical issues relate to whether heterogeneous cores are really required; also, what additional problems they may cause separate from the problems they solve. Clearly, they do reduce the potential l
l
i for a large reactivity increase associated with a positive sodium void co-efficient. However, at this time there has not been a careful analysis of all of the other possiN safety issues that might also be associated with hetero-geneous cores. No other major safety issues come to mind, but nevertheless a careful look must be made. There are also a host of potential engineering problems that may be related to heterogeneous cores although it appears that they can be circumvented. There are also economic problems since heterogene-ous cores would have a higher fuel inventory and, even though the breeding gain might improve some, or more likely remain approximately the same, there would be an increased doubling time. The primary technical issue, however, relates to whether such heterogeneous cores are really required to reduce the energetics potential in considering the consequences of core disruptive acci-dents.
C.
Status of Technology Several aspects of the technology are crucial to the decision on whether heterogeneous cores are necessary. One must evaluate the reactivity history associated with any given space-time profile of sodium voiding. This aspect of the technology is in good shape, and probably adequate for the problem at hand, even tacugh some improvements may be desirable.
It is then essential to calculate the profile of sodium voiding that would occur under a postulated accident sequence in the system. We believe again that this part of the problem is well in hand if we can also specify the components of the reactivity history other than sodium voiding, e.g., the reactivity due to fuel l
dispersal. Validated codes are available and it is then essentially a book-keeping job with the use of these codes to specify the voiding progression.
Next, it is necessary to assess the resulting fuel and structure motion that would accompany the evolving sodium voiding and reactivity. Here, the problem 1
~
3 i
encounters uncertainty in that we do not have validated models for fuel and structure motion as the system starts to void. Thic part of the problem will be crucial towards establishing the remaining scenario. Assuming that the system reactivity, including effects of sodium voiding and fuel and clad motion results in a significant reactivity ramp, we encounter a part of the problem where the fuel in the sodium filled channels fails. This will occur in the homogeneous case at extremely high power; in heterogeneous cores, it
~
will occur at lower power, but still at a power well above nominal power.
This part of the problem is not at all well urcrstood and would be crucial toward assessing the ultimate consequences of the event, particularly in the homogeneous case. There is room here for rather pessimistic assumptions as to how fuel may fail in the sodium filled channels and, in particular, some pessimistic assumptions may lead to fuel motions that are either not reducing reactivity or possibly even increasing reactivity.
If the race between re-activity being added as the sodium leaves the sodium filled channels outweighs the loss of reactivity associated with fuel motion in the sodium filled channels one could very much exacerbate the resulting reactivity ramp rate.
Here is a key problem towards understanding and therefore making a decision between homogeneous and heterogeneous cores. A wide variety of application studies must be performed, after adequate models are validated, in all of these cases in order to make a judgement on how the system might behave under a wide spectrum of initiating events.
In a parallel effort, both engineering i
and economic studies must be performed as well as a number of subsidiary analyses related to other possible events and accident conditions associated with the heterogeneous cores besides the bounding energetics events. Finally, some overall analysis must be performed to make the decision as to whether a heterogeneous core is required.
4 To date, it has been assumed that the bounding event is the loss-of-flow-without-scram event. Studies have shown that, in moderate size systems like CRBR, the nominal energetics in either the homogeneous or heterogeneous configuration are essentially near zero. However, there is a decided advant-age in the heterogeneous case in that far more pessimistic assumptions rela-tive to the nominal calculation can be made and still yield very low energetics.
In the homogeneous case these pessimistic assumptions can lead to high energetics. Similar conclusions of a lower energetics potential also result jn analyses of larger cores.
D.
Relationship to Safety Philosophy In accordance with the safety philosophy, a decision on the hetero-geneous core must be largely based upon the requirement that the choice lead to a non-energetic core. The burden of proof is clearly to show that the homogeneous case is acceptable.
In the absence of such definitive proof, the decision should go to the heterogeneous core.
E.
Guidelines The guidelines should reflect a natural inclination to go to the heterogeneous core in the absence of a clear case to the contrary. However, with respect to the larger systems for which a final decision need not be made for a number of years, a concerted effort should be made to establish whether or not the heterogeneous core is really required.
It is presumed that there are likely to be a number of disadvantages to going down the heterogeneous core route in economics and engineering complexity; although the full degree l
has not yet been established. It is reasonable at this point to follow the path that has been established both for the CRBR and the later CDS or LDP studies to have the heterogeneous core as the reference design. However, this should still be viewed as an open issue which requires much work before a l
l l
final decision is made. Such a final decision should not be made earlier than required if the full information to make this decision is lacking.
F.
R&D Requirements The R&D should clearly focus on those areas of uncertainty in the technical status. These relate primarily to a better understanding of early fuel dispersal following sodium voiding to establish the degree to which such fuel dispersal may offset the sodium void reactivity and thereby turn the transient around early; and then secondarily, to establish the phenomenology associated with fuel failure in sodium filled channels at very high power to establish what resultant energetics occur under these condition. With these two models in hand, and with the existing code and model development already established, enough parametric and application studies can be performed to definitively establish the result relative to severe accident conditions. In parallel with this, further studies are required in order to establish the full risk associated with either core. One should identify and study any other safety issues that might be related to the heterogeneous core apart from the severe accident part of the spectrum. While no such clear areas have been identified as leading to problems, neither has there been much investigation in this area.
It is clearly essential that a full understanding of all of the implications of heterogeneous core be available prior to a decision.
l
g
\\
~
- 15. ACCIDENT DEBRIS A.
Background
In the design of iquid metal cooled fast reactors, design margins are generally provided to mitigate the consequences of severe core damage.
Consistent with this approach to achieve a balanced plant design with a low overall risk it is necessary to consider the cooling of accident debris so that containment integrity is maintained. The length of time' that containment integrity must be maintained after a core disruptive accident is still an open issue.
The core debris which is formed as a result of a core disruptive accident could result from partial core damage with the core largely intact and coolable or be the result of complete core disruption.
In the case of complete core melting the molten core material will fragment in contact with sodium, the resultfr.g particulate will settle on horizontal surfaces.
If the resulting debris bed is not coolable it will melt through the reactor vessel and again form a debris bed in the reactor cavity.
If this bed is not cool-able or when the sodium boils away the resulting melt will begin to attack the concrete of the reactor cavity with the resulting decomposition of the con-crete and liberation of gases. The integrity of the containment could be threatened because of the accumulation of hydrogen or because of overpressure in the containment.
B.
Technical Issues As noted above, in the case of core disruption, a series of pro-l cesses fo11cws which can lead to containment failure. The best current tech-nical judgement would indicate that a substantial period of time would elapse before the containment is threatened. Major technical issues are the cooling of debris beds, the rate of per.etration/ reaction of sodium and the core melt i
i l
2 into concrete and the resulting rates of gas evaluation. Major design issues are the time that containment integrity will be required to be maintained and the need for controlled venting of the reactor containment. These design issues would be reflected in the need for sacrificial beds or other design features to retard attack by core materials on the concrete and/or provisions to vent the containment through filter systems.
C.
Status of Technology There are a number of safety issues concerned primarily with the distribution of debris, coolability of particulate beds and dense masses of core debris and concrete fuel interactions.
A limited number of small scale experiments on debris distribution c.
have been carried out which indicate that debris tends to become uniformly 4
distributed. Experiments on the coolability of debris beds, both cut-of-pile
,.g i p-
~
and in-pile have been conducted. The real material experiments conducted in-pile have led to some significant differences with earlier out-of-pile data.
Dense mass coolability has been studied extensively with simulated fluids, but correlations developed from this data cannot be directly applied J a.T y. l f
- to molten fuel because they do not take into account internal thermal-cadia _
-tion.-
A considerable data base exists on the penetration of sodium and fuel into concrete and sacrificial materials. There is still uncertainty, however, on the mechanisms controlling whether penetration into concrete is self limiting or not. The experiments with fuel have generally been small in scale.
D.
Relationship to Safety Philosophy Means of accommodating core debris and maintaining containment fr4egrity are part of the safety philosophy that emphasizes defense in depth to achieve a low overall risk.
l t
3 E.
Guidelines There have been various proposals for engineered features to cope with core debris such as core retention systems, cooling systems, venting and filtering systems for containment as well as features for in-vessel retention of core debris. There is general agreement that measures to cope with core t.t t t:
t debris are necessary but the extent of these measures is 2till an open ques _
tion.
F.
R&D Requirements An extensive R&D program to address the unresolved issues in acci-dent debris accommodation is being carried out by DOE and NRC.
Experiments in debris bed coolability need be carried out to resolve present differences which exist between in-pile and out-of-pile data. Further real material experiments need to be carried out to support the simulant fluid s
s-r, data.
Tests are underway to evaluate a hypothesis that mechanical failure in the form of cracking or crushing is responsible for cases of severe pene-tration of sodium into concrete. These tests need to be completed.
Penetration of molten core debris into concrete and sacrificial materials has been done in small scale but needs to be extended to larger scale.
Several other issues which need additional R&D are integrity of o
structures, hydrogen monitoring and cfntral and post-HCDA availability of heat sinks.
I
DRAFT - J. Hartung Ib S0DIUM FIRES The combustible nature of sodium dictates that large LMFBRs include design features to prevent, contain, and nitigate sodium fires.
These design features should minimize the chances of sodium fires and limit their' effect on plant personnel, the public, and on the remainder of the. plant.
It is especially important that sodium fires be prevented from causing worse accidents, such as by their aerosols affecting control room habitability or safety system performance.
Systems which contain hot sodium should be designed and constructed to high standards to minimize the chances of sodium leaks which may lead to sodium fires.
Similarly, these systems should be.erated carefully to prevent leaks as much as practical.
However, recognizing that sodium leaks will occur, the plant should be designed to accommodate them, and operators should be trained in the appropriate response.
One of the most effective defenses against major sodium fires is early detection of sodium leaks.
Therefore, it seems appropriate that sodium leak detection systems be emphasized in future LMFBR power plants.
These leak detection systems should be reliable (i.e., they should detect leakage when it occurs but not give false indications of leakage) if they are to be useful.
Typically, systems and components which contain significant quantities of hot radioactive sodium are enclosed in inerted cells.
This is an excellent approach for containing sodium leaks from these systems and preventing sodium fires.
If this approach is taken, however, the cell and its liner must be sufficiently strong and leaktight to prevent excessive contact between the leaked sodium and concrete and maintain a low oxygen environment following the sodium leak. Also, the possibility of sodium fires which may occur when the cell is deinerted for maintenance should be considered.
Sodium systems and components which do not contain significant quantities of radioactivity are generally enclosed in air-filled cells or buildings.
If this i
i t
s
approach is taken, and if the quantity and temperature of the sodium cor.tained in these cells is sufficient to cause major fires, then some form of fire suppression system is needed.
Such fire suppression systems should be reliable, and the cells or buildings in which they are contained should have sufficient structural margin and/or venting capability to withstand the pressures generated by the fire.
Sodium aerosols released through vents or service and support systems should be filtered as necessary to prevent unacceptable impact on nearby people or plant systems.
Sodium pool fires are fairly well understood, and the technology for contain-ing sodium leaks in inerted cells is available.
The greatest uncertainties are in the area of sodium spray fires, especially in air-filled cells.
Accordingly, the principal safety R&D necds with respect to sodium fires are to better under-stand spray fires in air and to develop and test existing and possibly improved sodium fire suppression systems for use in air-filled cells and buildings.
Another safety R&D need is to develop a better understanding of the performance of currently available sodium leak detection systems and, possibly, to develop improved systems.
4 e
i s
cib:1202 e
t s.
e y
S yn
---1
i.
L, J, Koch 11/24/81
\\n.
Containment / Confinement 1
Containment / Confinement systems for LMFBR's must achieve the same purpose as for LWR's; i.e.,
to contain fission products and isolate them from the public, and to do so under postulated adverse conditio'ns.
The conditions which must be accommodated are different and the technology (in some areas) will be different.
^
LMFBR's do not present the large stored energy problem repre-sented by the high temperature-high pressure water source in a LWR.
On the other hand, the LMFB'R presents two unique potential energy sources which must be considered; the potential core energetics pro-A.
duced by core recriticality and the potential chemical energy source
~
resulting from sodium-air (oxygen) reaction.
An important consideration in accommodating an energy release by the containment / confinement system is the prohibition of the use of water to absorb energy or reduce containment a'tmosphere pressures.
This means that suppression pools, containment sprays, etc. are not permitted,and convenient, effective heat (energy) sinks are not readily available.
The absence of rapid action energy absorption (quenching) imposes a requirement to avoid rapid energy release to the containment / confinement system.
The most probable source of a rapid energy release to be accom-modated is the sodium / air reaction.
Rapid dispersion of finely divided sodium into air can result in " explosion-like" release of energy with t
S l
-m--
_ _. am& ~
~3
Containm:nt/CenfinIm:nt prga 2 e
very rapid rise in temperature and pressure in the containment atmosphere.
System and structural designs should be developed to preclude the' possibility of energetic expulsion of sodium into the containment atmosphere.
Since the sodium systems operate at low pressure, there is no inherent large propulsion source for the i
modium, except " core energetics."
(This subject is treated else-where.)
The structure surrounding the reactor should be designed to mitigate sodium expulsion to the surrounding containment building atmosphere.
~
Sodiuta " spills" are a creditable accident which can result in fires and large heat generation.
Under certain conditions, such fires could cause a gradual increase in temperature and pressure in the containment hailding.
Such a course of events might warrant i
consideration of controlled venting of the containment.
Vented containment would require filteration of sodium particulate and sodium combustion by-products as well as releases from core damage.
Work should be done to determine filter requirements for containment 1
l venting and to develop acceptable venting r.aterials and systems.
e m
I 0 ' Y V' h
\\
l
\\
yWC 2 Dec 81 D
l SITING /
n,-i r
I.
Background
,y Conventional premises regarding the deployment and siting of nuclear power plants should be reexamined for commercial LMFBRs. When and if such plants are built, the basic decision to do so will likely be an element of national energy policy.
-r
- Y#
Decisions to bul'd individual plants are likely to be made by groups of utilities (in contrast to a unilateral decision by a single utility acting alone) or by
's,'
government-authorized organizations, possibly chartered for the specific purpose of management and operation of the unit. An equilibrium nuclear power economy may call for a balance of LWRs, LMFBRs, and their associated fuel fabrication and chemical reproce ing plants.
Factors such as diversion of fissionable materials may prove %p( more significance to the health and safety of the public than accident prevention in the reactor itself.
Co-location of several LMFBRs along with the associated fuel fabrication and fuel reprocessing facilities (and possibly permanent waste disposal'facilitied would offer numerous potential benefits including: diversion concerns could be appreciably lessened; terrorist attack and sabotage concerns could be reduced; transportation of spent fuel would be simplified; and reactor safety could likely be enhanced through greater insti-tutional continuity, greater depth of technological capability, greater training depth, dedicated management, and so on.
Since siting of the first commercial plants is at least two decades away, there is adequate time to plan carefully.
Further, there is a need to do so in order hopefully to preclude questionable siting decisions such as have arisen with LWRs.
The definition of the site suitability source term (the postulated fission product release following a reactor accident) for an LMFBR is a strong function of the magnitude of the accident assumed.
For example, for a serious accident in which fuel is melted, most of the iodine would likely be absorbed by the sodium coolant.
However, for a very serious, hypothetical accident involving core vaporization, it can be speculated that many fission products would escape the reactor vessel in the form of a large bubble without absorption or filtering by the sodium.
11.
Technical issues issues involved in siting include the following:
1.
Where should early plants be sited with repspect to population?
2.
How will this change with time?
3 How should seismicity influence site location?
4.
What role should engineered safety features play in early plant siting?
5 How can siting decisions be used to influence the public health and safety beyond straight-forward accident situations?
6.
How can the site suitability source term be defined?
m y
a t
C '-
d.4
- 19. STATION BLACKOUT A.
Background
The implications of station blackout are being reviewed by the NRC under Unresolved Safety Issue A-44, Station Blackout.
The licensees of LWR plants being reviewed for operating licenses have been requested to analyze their specific plants for a station blackout event.
B.
Technical issues A station blackout is defined as the total loss of.offsite and onsite AC power.
A secondary consequence is the eventual loss of DC power if AC power is not restored before the station batteries are dis-charged.
The NRC is reviewing the following question:
"Are the likelihood and potential accident risks of a station blackout high enough that additional preventative and/or mitigative measures should be required?"
C.
Status of Technolooy In order to resolve the issue of station blackout, th NRC has
~
sponsored the following technical programs: j* C
~~g 1.
Station Blackout Accident Sandia Sequence Analysis 3.
Plant Response to Station EG&G, ORNL, and LASL Blackout The current LMFBR designs incluie passive natural circulation for residual heat removal which functions during a station blackout, but support systems such as coolant systems for concrete are deactivated.
D.
l Relationship to Safety Philosophy Station blackout at an LMFBR plant is a safety issue which can be resolved by using probabilistic risk assessment.
Station blackout is one event which contributes its portion of risk to an overall safety goal.
E.
Guidelines s'
8 Currently there are no specific guidelines which are applicable to a station blackout event.
The NRC position on station blackout is scheduled to be issued as a NUREG document in draft form in October 1982 and as a final report in March 1983.
-- g s
=
- 5. )
E m
g s
e b
2 F.
R & D Requirements Analysis is required to assess whether the likelihood and potential accident consequences of a station blackout are high enough that additional and/or mitigative measures are required.
9 g.
S 4
9
._ _ _ _