ML20074A963

Comparison of Crbr Design Basis Events with Those of Foreign LMFBR Plants

ML20074A963
Person / Time
Site:	Clinch River
Issue date:	04/30/1983
From:	Ami Agrawal BROOKHAVEN NATIONAL LABORATORY
To:	Office of Nuclear Reactor Regulation
References
CON-FIN-A-3364 BNL-NUREG-51663, NUREG-CR-3240, NUDOCS 8305170086
Download: ML20074A963 (85)

Text

NUREG/CR-3240 BNL/NUREG-51663 Comparison of CRBR Design Basis Events with Those of l Foreign LMFBR Plants Prepared by A. K. Agrawal Brookhaven National Laboratory b uclear Regulatory Report issue Date: March 1983 hog 5 86 830430 CR-3240 R pon

NOTICE This report was prepared as an account of work sponsored by an agency of the United States Government. Neither the United States Government nor any agency thereof, or any of their employees, makes any warranty, expressed or implied, or assumes any legal liability of re.

sponsibility for any third party's use, or the results of such use, of any information, apparatus, product or process disclosed in this report, or represents that its use by such third party would not infringe privately owned rights.

Availability of Reference Materials Cited in NRC Publications Most documents cited in NRC publications will be available from one of the following sources:

1. The NRC Publi:: Document Room,1717 H Street, N.W.

Washington, DC 20555

2. The NRC/GPO Sales Program, U.S. Nuclear Regulatory Commission, Washington, DC 20555

3. The National Technical Information Service, Springfield, VA 22161 Although the listing that follows represents the majority of documents cited in NRC publications, it is not intended to be exhaustive.

Referenced documents available for inspection and copying for a fee from the NRC Public Docu-ment Room include N RC correspondence and ir,ternal NRC memoranda: NRC Office of Inspection and Enforcement bulletins, circulars, information notices, inspection and investigation notices; Licensee Event Reports; vendor reports and correspondence; Commission papers; and applicant and licensee documents and correspondence.

The following documents in the NUREG series are available for purchase from the NRC/GPO Sales Program: formal NRC staff and contractor reports, NRC-sponsored conference proceedings, and NRC booklets and brochures. Also available are Regulatory Guides, NRC regulations in the Code of Federal Regulations, and Naclear Regulatory Commission issuances.

Documents available from the National Technical Information Service include NUREG series reports and technical reports prepared by other federal agencies and reports prepared by the Atomic Energy Commission, forerunner agency to the Nuclear Regulatory Commission.

Documents available from public and special technical libraries include all open literature items, such as books, journal and periodical articles, and transactions. Federal Register notices, federal and state legis:ation, and congressional reports can usually be obtained from these libraries.

Documents such as theses, disserations, foreign reports and translations,and non-NRC conference proceedings are available for purchase from the organization sponsoring the publication cited.

Single copies of NRC draft reports are available free upon written request to the Division of Tech-nical Information and Document Control, U.S. Nuclear Regulatory Commission, Washington, DC .

20555. j Copies of industry codes and standards used in a substantive manner in the N RC regulatory process are maintained at the NRC Library, 7920 Norfolk Avenue, Bethesda, Maryland, and are available there for reference use by the public. Codes and standards are usually copyrighted and may be {

purchased from the originating organization or, if they are American National Standards, from the American National Standards Institute,1430 Broadway, New York, NY 10018.

GPO Pnnted copy price: _$5.00

NUREG/CR-3240 BNL/NUREG-51663 Comparison of CRBR Design Basis Events with Those of Foreign LMFBR Plants ats u hed n1 Prepared by A. K. Agrawal Brookhaven National Laboretory Drpartment of Nuclear Energy Upton, NY 11973 Prspared for Clinch River Breeder Reactor Project Office Office of Nuclear Reactor Regulation U.S. Nuclear Regulatory Commission Washington, D.C, 20666 NRC FIN A3364 l

- . . . .--,,,_ .n,, --,--. , -- , - , . , , . . -. . . , , ,, ,* , , . -.,---..,--.L, , --n._,,..,---

~

i l

i ABSTRACT

As a part of the Construction Permit (CP) review of the Clinch River Breeder Reactor Plant (CRBR), the Brookhaven National Laboratory was asked to compare

- the Design Basis Accidents that are considered-in CRBR Preliminary Safety An-alysis Report with.those of the' foreign contemporary plants (PHENIX, SUPER-PHENIX, SNR-300, PFR, and MONJU). A brief introductory review of any special or unusual characteristics of these plants is given. This is followed by dis-cussions 'of the design basis accidents and their acceptance criteria. In spite of some _ discrepancies due either to semantics or to licensing decisions, there appears to be a considerable degree of unanimity in the selection (defi-nition) of DBAs in all of these plants.

~

4 e

iii T

r TABLE OF CONTENTS Page ABSTRACT.................................................................. iii LIST OF FIGURES........................................................... vi L I S T 0 F . TA B L E S . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v ii

1. INTRODUCTION.......................................................... 1 1.1 Scope............................................................ 1 1.2 Background....................................................... 1 1.3 LMFBR Safety and Licensing Problems.............................. 2 1.4 The Applicant's Position and Justification....................... 4

1. 5 . R e po r t S umma ry . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

2. LMFBR DESIGN DESCRIPTION.............................................. 12 2.1 CRBK............................................................. 12 2.2 PHENIX........................................................... 19 2.3 SUPER PHENIX..................................................... 22-2.4 SNR-300.......................................................... 25 2.5 PFR.............................................................. 26 2.6 M0NJU............................................................ 33

3. DISCUSSIONS........................................................... 34 4 3.1 -CRBR............................................................. 34 3.1.1 Ac ce pt a nc e C ri t e ri a . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 3.1.2 Design Basi s Accident and Analyses. . . . . . . . . . . . . . . . . . . . . . . . 34 3.2 SUPER. PHENIX..................................................... 41 3.2.1 Design Basi s Accidents and 'Requi rements. . . . . . . . . . . . . . . . . . . 41 3.3 SNR-300.......................................................... 45 3.3.1 Design Basi s Accidents and Requi rements . . . . . . . . . . . . . . . . . . . 45 3.3.2 Transient Analysis........................................ 48 I 3.4'M0NJU............................................................ 50 3.4.1 Sa fety De s i g n C ri t e ri a . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50 f 3.4.2 Design Basis Accidents.................................... 59 3.5 General Comments................................................. 67 ACKNOWLEDGMENTS........................................................... 70 REFERENCES................................................................ 71 V

LIST OF FIGURES Figure Title Page 1 A simplified illustration of the DBA and beyond DBA events........ 5 2 CRBR plant layout................................................. 13 3 CRBR heterogeneous core design.................................... 18 4 PHENIX plant layout............................................... 20 1

5 SUPER PHENIX plant layout......................................... 24 l 6 SNR-300 reactor vessel schematic.................................. 27 7 S N R - 3 0 0 p l a n t l ay o u t . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 8 SNR-300 shutdown system design.................................... 30 9 P F R re a c t o r t a n k l ay o u t . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 ,

l I

s I

d vi

LIST OF TABLES Table Title Page I. LMFBR projects.................................................... 3 II. Representative types of events to be analyzed in Chapter 15.0 of the SAR per SFAC.................................................. 7 III. Additional events considered by the appl icant. . . . . . . . . . . . . . . . . . . . . 11 IV. Key desi gn data for contempora ry LMFRR pl ants. . . . . . . . . . . . . . . . . . . . . 14 V. Comparison between the first and second shutdown systems of SNR-300........................................................... 29 VI. Event classification and damage severity limits for CRBR.......... 35 VII. Acceptance criteria for preliminary safety evaluation for CRBR.... 36 VIII. Primary and secondary shutdown system damage severity limits for CRBR.......................................................... 37 IX. Cl as si fication of accidents used i n M0NJU. . . . . . . . . . . . . . . . . . . . . . . . . 51 X. List of abnormal events considered and the results of analysis for MONJU p1 ant....................................................... 61 XI. List of accident events considered and the results of analysis for MO NJ U p l a n t . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64 XII. A compa ri son of shutdown heat removal systems. . . . . . . . . . . . . . . . . . . . . 69

/'

vii

,1. . INTRODUCTION 1.1 Scope As part of the Construction Pemit (CP) review of the Clinch River Breeder Re-actor Plant (CRBR), the Brookhaven National Laboratory was asked to compare .

the Design Basis Accidents-(DBA) that are considered by the' applicant in their Preliminary Safety Analysis Report (PSAR) with those of the foreign contempor-ary plants such as PHENIX and SUPER PHENIX in France, SPR-300 in the Federal Republic:of Germany, PFR in Great Britain, and MONJU in Japan. In a companion effort, the. Idaho National- Engineering Laboratory was asked to compare the

- CRBR DBA. events with those considered by other domestic LMFBR facilities (in-cluding EBR-I, EBR-II, FERMI, SEFOR, FFTF, and LDP). This report is the re-sult of findings on the foreign plants.'Hanson [1] has compiled a report on

- the domestic DBA comparison study.

The current study has been somewhat affected by the lack of public availabil-ity of the PSARs or their equivalents for foreign plants. In general, public documents on foreign plants tend to be either design oriented or they discuss beyond design basis accidents or the hypothetical core disruptive accidents.

A complete comparison of DBAs, therefore, was a difficult task. The compila-tion within this report is based on the published reports as well as data ob-1tained at a personal level.

This report is organized as follows: The first part- includes a brief back .-

ground of LMFBR design, operating experiences, and the safety issues, followed by the applicant's position and sisnmary of the report. The second part is an attempt to include-key design features of the foreign plants. This is done to put in perspective other design options and their significance. Discussions

- of the types of accident events considered by different countries are noted in-the third part. Finally, a list of documents / papers reviewed or potentially useful papers are noted under bibliography.

1.2 Background

The first nuclear reactor ever to generate electrical energy was a li metal fast breeder reactor-the Experimental Breeder Reactor-I-(EBR-I) quid-when it lit a bulb on 20th December 1951. . Since then, more than thirty-one years of

~

research and development programs both in the United States and overseas (most notably France, Federal Republic of Gemany, Great Britain, -India, Italy, Japan, and the U.S.S.R.) have resulted in a mature LMFBR technology to the point that large experimental plants such as EBR-II and FFTF in.the.V.S.A.,

! Rapsodie in France, KNK-2 in F.R.G., DFR in Great' Britain, FBTR in India,~ J0Y0 i . in Japan, and BR-10, B0R-60 in the U.S.S.R;, are currently operational. Such r

demonstration-size plants as the PHENIX in France, PFR in Great Britain, and BN-350 in the U.S.S.R. have also been in operation for a minimum of eight

- years. _ Commercial-size plants have also advanced significantly. For example, BN-600 in the U.S.S.R. has been in operation since February 1980, and

. France's SUPER PHENIX is expected to go critical in 1983. In this comparison, the1 Clinch River Breeder Reactor Plant (CRBRP) is oniy a demonstration-size American plant. More than 130 reactor years of operating experience with

.'( 1 h

= --ru

either experimental, demonstration or commercial-size LMFBR plants have now been attained (see Table I).

. Experience gained from the above-mentioned LMFBR projects have resulted in l basically two different designs - loop-type and pool-type plants. In both de-signs,'the primary radioactive sodium transfers heat to the water / steam cir-cuit via an intemediate sodin heat transfer system. The key difference is that in the loop designs, the reactor vessel.contains fuel, blanket, control, and shielding assemblies, and the nuclear-generated heat is piped through a i piping network, pap, and the intemediate heat exchanger all placed outside the reactor vessel. In pool designs, the entire radioactive primary cooling system is integrated in a large tank filled with sodium. Penetrations to this tank are provided for intemediate sodim pipes.

There are favorable aspects of both loop and pool designs. The loop systems have smaller radioactive sodium inventories and employ more compact reactor i vessels than those of the pool systems. The loop systes also provide greater l flexibility in maintenance of key components such as valves, pumps, and the intemediate heat exchangers. They also offer, generally speaking, simpler vessel head designs, but several penetrations for the inlet and outlet of sod-im must be provided. The loop systems are more susceptible to severe pipe ruptures than the pool systems but the secondary vessels and the guard pipe can provide acceptable mitigative protection.

The pool designs, on the other hand, involve much larger primary sodium inven-tory which provides considerably larger themal inertia than the loop systems do. No coolant nozzle penetrations are involved but the reactor vessel head becomes rather complicated as all connections with the intermediate heat transfer circuit must go through them. The severity of consequences due to primary pipe rupture is almost insignificant. Amongst the disadvantages of the pool designs, the increased size, severe themal transients, and seismic factors are the key ones. Also a much larger inventory of radioactive sodium has to be handled, thereby a potential exists for more energetic sodium fires than in the loop designs. Either of the two designs can be built to meet the requirements imposed on them. The choice between the two concepts, of course, has to be made on the basis of detailed consideration of such factors as past design and operating experiences as well as licensing needs.

1.3- LMFBR Safety and Licensing Issues LMFBR safety issues tend to be rather dissimilar to those of LWRs in several ways. To begin with, LMFBRs are cooled by liquid sodium which has excellent heat removal characteristics. In a properly designed plant, the natural con- j vection that is established can be sufficient to remove the shutdown heat pas-sively. Secondly, the system is at essentially "zero" pressure and operates at the peak sodium temperature of.several hundred. degrees (Fahrenheit) below the coolant seturation temperature at the atmospheric pressure. The coolant flashing is therefore not possible. The consequences of a loss of coolant accident (LOCA) via massive pipe rupture can be designed to be rather benign.

.The pool-type designs provide better protection but in the loop-type designs (e.g., CR8R), a double-wall (i.e., a guard pipe) concept is used to mitigate the consequences. Alternatively, the most critical region of the pipe (i.e.,

2

Table I. LMFBR Projects Power, MW (thermal / Basic Type of Years of Operation Reactor electrical) Design Facility till 1982 France Rapsodie 40/- Loop Experimental 9 PHENIX- 563/250 Pool Damonstration 8 SUPER PHENIX 3000/1200 Pool ' Commercial Criticality 1983 Germany, F.R.

KNK-2 58/20 Loop Experimental 5 SNR-300 762/327 Loop Demonstration Criticality'84 '85 Great Britain DFR 60/14 Loop Experimental Decommissioned after 18 yrs of operation PFR 600/250 Pool Demonstration 9 India TETF- 42.5/15 Loop Experimental Criticality 1983 100/- Loop Experimental 5 MONJU 714/300 Loop Demonstration Criticality 1987 U.S.S.R.

BR-5 5/- Loop Experimental 15 (upgraded to BR-10)

BR-10 10/- Loop Experimental 9 BOR-60 60/12 Loop Experimental 13 BN-350 1000/350 Loop Demonstration 10 BN-600 1470/600 Pool Commercial 2 BN-800 w/800 Pool Commercial Criticality 1985 U.S.A.

EBR-I 1/0.2 l.oop Experimental Decommissioned after 7 years of operation y EBR-II 62.5/20 Pool Experimental 19 FERMI 200/66 Loop Experimental Decommissioned after 9 years of operation SEFOR 20/- Loop Experimental Decommissioned after 3 years of operation FFTF 400/- Loop Experimental 2 CRBR 975/350 Loop Demonstration 3

y , - - - - - - - . - .

the downcomer) can be-located inside the reactor vessel (such as in the SNR-300) and thus protection is significantly improved.

LMFBR transient events have been categorized in a number.of ways: The appli-cant makes use of three levels of design; the American Society of Mechanical Engineers (ASME) classifies plant conditions into four categories according to their anticipated frequency of occurrence and the potential radiological con-sequences to the public; and the AEC's definition of Class 1-9 events (these were proposed by AEC in 1971 but have now been withdrawn by NRC). The intent of all of these classifications is to ascertain that the safety analysis of a plant is carried out systematically. The ultimate goal of these categoriza-tions is to develop a comprehensive set of DBA events. In fact, the two major kinds of decisions to be mada in LMFBR licensing are the following:

(1) The definition of the set of DBA events to be used in the project de-sign, safety analysis, and fulfillment of the radiological conse-quence limitations.

(2) Definition of the design requirements for beyond design basis events that must also be considered in developing the engineered safety sys-tems.

A simplified illustration of the connection between the DBA events and beyond DBA is shown in Fig. 1. The beyond DBA events are generally accidents in which an anticipated transient occurs and is not followed by an automatic scram when required. These are also some times called Anticipated Transients Without Scram ( ATWS). Generally speaking, these accidents involve at least some degree of fuel melting or core disruption (also known as Hypothetical Core Disruptive Accidents, HCDA). Special accommodation devices may then be required to contain the consequences of these beyond design basis events.

1.4 The Applicant's Position and Justification The applicant's approach to .the CRBR safety analysis is developed upon three levels of design. The first level focuses on the reliability of operation and prevention of accidents througn such intrinsic features as-design, construc-tion, and operation of the plant. The second level focuses on protection against " Anticipated" and "Unlikely" faults which might be expected to occur

,at least once during the plant's lifetime. The third focuses on low proba-bility " Extremely Unlikely" events which are included in the Design Basis .

Accident events. These events are not expected to occur during the plant's li fetime. In addition to the three levels of design, the applicant has also considered what they tenn as the beyond design basis accidents and provided q the engineering safety features to accommodate them. These beyond design.

basis events are primarily the hypothetical core disruptive accidents involv-ing various degrees of core melt. j The applicant has relied on a number of sources in selecting the DBA events for CRBR. These sources include (1) Standard Fonnat and Content of Safety An-alysis Reports for Nuclear Power Plants-LMFBR Edition [2], (2) the similar document for the water reactors [3], and (3) operating experience gained from other LMFBR facilities such as EBR-II and FFTF and to a small extent from 4

Undercooling Single ' failure events 4

Overheating DBA Events Local Faults coupled with

, additional failure (c)

Sodium Fires External Events  !

Beyond DBA Events Figure 1 A simplified illustration of the DBA and beyond DBA events.

l-i l

! 5 l

foreign LMFBRs. The SFAC for LMFBRs provided a list of 67 events that must be i considered in the DBA evaluation. These events, shown in Table II, are repre-sentative but not necessarily conclusive. The applicant has also identified an additional-five events (listed in Table III). All of these seventy-two events were categorized as follows:

(a) Reactivity insertion events

'(b) Undercooling events (c) (In-core) local failure events (d) Fuel handling and storage events e Sodiun spills and fires f Other events These have been analyzed in the Chapter 15.0 of the PSAR. The adequacy of the analysis of these events is not considered in this report (this is being ad- l dressed separately by Brookhaven National Laboratory and the Los Alamos .

National Laboratory). l A remaining potential issue is whether all significant accidents have been considered by the applicant. In this connection, it is important to note that the applicant has voluntarily agreed to identify and quantify all accident initiators via the use of the fault trees and event trees as a part of his PRA 1 work. In addition these accident events have also been compared (see Ref.  !

[1]) with those used in other domestic LMFBR facilities.

1.5 Report Summary PHENIX, SUPER PHENIX, SNR-300, PFR, and MONJU plants are briefly described in Chapter 2. Any unusual or special characteristics of these plants, as evi-denced through the available reports, are also noted here.

Chapter 3 discusses the design basis accidents, acceptance criteria, and the analyses of DBAs for CRBR, SUPER PHENIX, SNR-300, and MONJU plants. Although there is a considerable degree of unanimity in the selection of DBAs, some difficulties prevail due either to semantics or to licensing decisions. All of these plants have redundant and diverse shutdown systems. The shutdown heat removal systems do differ appreciably in terms of their diversity and re-liability.

6

Table II. Representative types of events to be analyzed in Chapter 1S.0 of the SAR per SFAC Number Event Description 1 Uncontrolled control rod assembly withdrawal from a subcritical condition assuming the most unfavorable reactivity conditions of the core and reactor coolant system.

2 Uncontrolled control rod assembly withdrawal at power assuming the most unfavorable reactivity conditions of the core and reactor coolant system which yield the most severe results (hot at zero power, full power, etc).

3 Control rod misoperation or sequence of misoperations.

4 Partial and total loss of reactor coolant flow including trip of pumps and pump seizures.

5 Start-up of an inactive reactor coolant loop or recirculating loop at incorrect temperature.

6 Loss of normal and/or emergency.feedwater flow.

7 Loss of all ac power to the station auxiliaries and loss of emergency diesel generators (station blackout).

8 Loss of intermediate coolant flow.

9 Heat removal greater than heat generation due to (1) feedwater

. system malfunctions, (2) a pressure regulator failure, or inadvertent opening of a relief valve or safety valve, and (3) a regulating instrument failure.

10 ' Maloperation of reactor plant controllers.

11 Internal and external events such as major and minor fires, flood, storms, or earthquakes.

12 Loss of coolant accidents resulting from the spectrum of postulat-ed piping breaks within the reactor coolant system.

13 Spectrum of postulated intennediate coolant system piping breaks inside and outside containment.

I 14 Inadvertent loading and operation of a fuel assembly into an improper position.

15 Waste gas decay tank leakage or rupture.

7

w Table II. Representative types of events to be analyzed in Chapter 15.0 of the SAR per SFAC (Cont.)

Number Event Description 16 Failure of cover gas purification system.

-17 The spectrum of rod ejection accidents.

18 Fuel-handling accident.

, 19 - Small spills or leaks of radioactive material outside containment.

20 Fuel cladding failure combined with intermediate heat exchanger and steam generator leaks. <

21 Control room uninhabitability.

22 l Loss of heat sink.

23 Turbine trip with coincioant failure of turbine bypass valves to open.

24 Loss of one (redundant) de system.

25 Turbine trip with failure of generator breaker to open.

26 Loss of instrument air system.

27 Local blockages of a few subchannels within a fuel subassembly.

28 Leak in control rod drive housing.

29 Inadvertent release of oil in pump seal into sodium.

30 Failure of a few steam generator tubes.

31 Leaks in intermediate heat exchanger.

32 Abnormally high or low cover gas pressure.

33 Core flow maldistribution due to fuel loading error. I 34 Gas bubbles passing through core.

35 Failure of steam dump system.

36 Inadvertent closure of either reactor coolant valves or inter-mediate coolant valves.

37 Spurious reactor trip.

8

F ---

Table II. ' Representative types of events to be analyzed in Chapter 15.0 of the SAR per SFAC (Cont.)

Number Event Description 38 ' Inadvertent drop (delatching) of a single control rod.

39 Failure of reactor vessel cover seal.

40 Plugging of reactor overflow line.

41 Failure of core clamping mechanism.

42 Accidental opening of valves to a drained isolated loop.

43 Large leak (rupture) in steam or feedwater piping.

44 Enrichment error in fuel assembly.

45 Misloaded fuel assembly.

46 Dropped fuel assembly.

47 Unknown stuck control rod.

48 Loss of normal shutdown cooling system.

49. Simultaneous leak of reactor overflow tank.

50 Inadvertent closure of floor valve on canister during fuel handli ng.

51 Failure of any single active component in fuel handling system.

52 Loss of site power during fuel handling.

53 Fuel-handling machine jams.

54 Leak in fuel storage vessel.

55 Failure of single active component in fuel storage cooling system.

56 Failure to seat fuel assembly properly.

57 Inadvertent opening of floor valve with shield plug removed and fuel-handling machine not in place.

58 Leak in fuel canister.

~

9

F Table'II. Representative types of events to be analyzed

. in Chapter 15.0.of the SAR per SFAC (Cont.)

Number Event Description 59 Inadvertent' opening of fuel-handling. machine valve during transfer

60 Attempt ;to . insert a fuel assembly into occupied position.

61 Collision of fuel-handling. machine with control rods.

62 . Dropping shipping cask from maximum 'possible crane height.

63 Collision between fuel-handling machine.and crane.

64 Loss of all power to fuel-handling machine.

65 Removal of. jammed fuel assembly.

66 Blocked coolant flow to control rods.

67 Intermediate coolant system fire.

10

M*

i Table III. Additional events considered by the applicant Number Event Description 1 Seismic reactivity insertion due to 0BE.

2 Core, radial blanket, and control rod movement due to SSE.

3 Sudden core radial movement. '

4 Inadvertent -actuation of the sodium / water reaction pressure relief system.

5 Stochastic pin failure.

I l

11

2. LMFBR DESIGN DESCRIPTION

~ A brief description of the major salient features of the contemporary LMFBR

. projects including CRBR for which NRC is reviewing the CP application, PHENIX and SUPER' PHENIX plants, SNR-300, PFR, and MONJU is' given. . A number of smal-ler-(experimental) plants are left out. Also excluded are those plants (LDP-in U.S.A. , beyond SUPER PHENIX; it .is a 1500-MWe plant but uses the same size.

reactor tank as 1200-MWe SUPER PHENIX, SNR-2, and CFR) which are in advanced stages of design, but, due to even more severe lack of detailed data, any fur-ther discussion is not.possible.

2.1 CRBR

.The Clinch River Breeder Reactor Plant is the first demonstration-size plant which.has had the benefit, not all of it by its own choice, of more extensive design.developoment and study than perhaps any other plant. It.has been wide-ly documented, culminating with an elaborate fourteen-plus; volume Preliminary .

Safety Analysis Report. The reactor plant uses a loop-type design (see Fig.2) similar~ to that of the currently operating FFTF. It uses nearly identical fuel design. It also has a three-loop system but differs from the FFTF in that the steam generators (two evaporators and one _superheater in each loop) are em-ployed to produce steam for electric generation.

Table IV lists key design information for the CRBR-plant. One of the most outstanding features of the CRBR core design is its heterogeneous arrangement of the fuel and the inner blanket assemblies (see Fig.3). In this arrange-ment,156 fuel assemblies are intemixed with 82 inner blanket assemblies all of which are replaced as a batch every two years. In alternate years, six partly burned inner blanket assemblies are replaced with six fresh fuel assem-blies. The heterogeneous core has two advantages: increased breeding ratio and reduced reactivity worth due to sodium void. A major distinction of the heterogeneous core is the increased complication in orificing the assemblies .

to avoid excessive radial temperature gradients across assemblies during their . '

li fetime.- l The: reactor heat transport system .is designed to take advantage of the natural convection as a passive mode of decay heat dissipation. Protection against major leakages / ruptures is provided by either a double tank systen around the reactor vessel, pumps, and the IHXs, or a double pipe arrangement for pipings below the elevation of the tops of the guard vessels.

The shutdown heat removal system consists of the main primary and intemediate heat transport' systems and the steam generating system as the nomal (prefer- ,

red) mode. In the event that the main heat sink or main feedwater supply is unavailable, a safety-related system (the Steam Generator Auxiliary Heat Re-moval- System, SGAHRS) is provided. This system perfoms its-functions using f short- and long-tem heat removal- subsystems. Short tem-heat removal is by venting of steam from the steam drum. The expended water is replaced by water from a protected water storage tank. Long-tem heat removal is accomplished

. by condensing steam through a protected air-cooled condenser. In addition to the SGAHRS, a supplementary means of removing long-tem decay heat is also pro-vided. This Direct Heat Removal Service (DHRS) system consists of circulating 12

E N N O t FR I 8 H T l i  !

R 06 8 /

A U9 L P T L MF .

M OI G0 O08 . UCUP T S0P 0, R6 R 5 2 1 F4 RS C E

I f F_

A35 1, ER R ,

0 8

11 TE 4 AT- 5 WA E R D E E H T EP l l i A

FH J W_

- M N L

R _ O D I r

M _

T A

A L E U

- T _ C

- S R

l

_ I C

_ E_

- R E

R _

m T _ -

A . - 2 _ t E

- u H

R - < gfl o y

E _  : a P -

U . = S 1

. S R O

- t

} . T - n l l

- A a R l

~ [ (I O P

~

y P A

V E

R B

F o . R 0 - C 5 3 4

8 '

afl 2

. e

- r u

F g

• i 2

2 F

9

- E M

_ F 0 T P 1 AG I 0 5

_ 6 D0 E 5, M92 R a 8 g ' l l E P N

_ X TM E

_ H NU T I P I

I I l a A I

N D Y E Y R A R E M R M RPF A M0 0 F M E T A R T A 0M E MU 5 9 7 P 0

0 I

N W TS R P 9 I

3, G 3 7

P I P 3

_ R D -

_ O N - -

_ T E

_ C G A E -

E L R -

_. g

Table IV. Key design data for contemporary LMFBR plants Plant PFR PHENIX SUPER- SNR-300 MONJU CRBRP PHENIX Parameter (UK) (France) .(France) (Germany) (Japan) (USA)

I. General

1. Power (MWt/MWe) 600/250 563/250 3000/1200 762/327 714/300 975/350

2. HTS Design Type Pool Pool Pool Loop Loop Loop

3. Coolant (Primary / Na/Na Na/Na Na/Na. Na/Na Na/Na Na/Na Secondary) Loop

4. Max Coolant Temp., C 652/532 552/543 545/525 546/520 540/515 535/502 (Primary / Secondary)

5. No. of Heat Transfer Loops 3 3 4 3- 3 3

6. 3 team Conditions at Tuibine Inlet (Full Power)

Pressure (MPa) 16.9 16.3 21.0 16.7 12.5 10.0 Temperature (C) '

538 510 487 500 482 482

7. Status Criticality Criticality In con- In con- In con- CP review Aug. 31, 1973 Aug. 31, 1973 struction struction struction stage Full power critical-in 1974 ity 1983 II. Reactor Physics Core Configuration Homogeneous Homogeneous Homogen- Homogen- Homogen- Hetero-eous eous eous geneous Fuel Composition U02-Pu02 002-Pu02 UO2 -Pu02 UO2 -Pu02 UO2 -Pu02 U02 -Pu02 No. of Fuel Enrichment Zones 2 2 2 2 2 1

_n -__ -. _ . - . _ _ - _ . . . - _ _ _ _ _ . -

- ~ - --- . _ - - . _ .- . . _ -

Table 11. Kay dssign data for contemporary LMFBR ' plants (Cont.)

Plant PFR PHENIX SUPER- SNR-300 MONJU CRBRP '

PHENIX Parameter (UK) (France) (France) (Germany) (Japan) (USA)

Equiv. Mean Pu 239 Enrichment (%) 15.12 19 32.8

~ 20%

Equiv. Mass of Pu-239 (kg) 4800 1200 1500 Core Height (m) 0.91 0.85 1.0 0.95 0.90 0.91 Core Diameter (m) 1.39 3.5 1.78 1.78 2.02 Volume (t) 1385 10,000 2630 2230 2.500 Power Density (kW/t) 406 300 290 320 390 Refueling (months)

Peak Core Burnup (% heavy atom)

(mwd /kg) 75(avg) 50 70 (8.3%) 90 80 (avg) 110 Maximum Linear Heating Rate (kW/m) 48 43 45-48 38 52 III. Reactor Core Design No. of Fuel Assemblies 78 103 364 205 156+6*

No. of Pins per Fuel Assembly 325 217 271 169_ 169 217 No. of Inner Blanket Assemblies - - - - -

76+6*

No. of Blanket Assemblies 51 '90 233 96 126 No. of Pins per Assembly 85 61 91 61 61 61 Mixed-Mean Core AT (C) 160 167 150 175 150 147

• See text.

Table IV. Key design data for contemporary LMFBR plants (Cont.)

Plant PFR PHENIX SUPER- SNR-300 MONJU CRBRP-PHENIX.

Parameter (UK) (France) (France) (Germany) (Japan) (USA)

IV. Control Assemblies '

No. of Primary / Secondary 11/10 9/6' No. of Absorber Rods per Assembly-Primary / Secondary 31/31 37/31 Control Material BC 4 BC4 90% enrich- 90% en-ed B10 r

i B{ghed Ancillary Shutdown System - -

Yes .

No. of Assemblies in Core - - 3 - - -

V. Operating Data Total Mass of Na in Primary (103 kg) 850 3500 620 Nominal Flow Rate (103 kg/s) 2.9 2.76 16.9 3.5 5.2 IHX Outlet Temperature (C) 400 397 392 388 Core Inlet Temperature (C) 400 395 375 390 Core Outlet Temperature (C) 560 545 550 540 IHX Inlet Temperature (C) 560 542 545 535

Table IV. Key design data for contemporary LMFBR plants (Cont.)

Plant PFR PHENIX SUPER- SNR-300 MONJU CRBRP PHENIX Parameter (UK) (France) (France) (Germany)' (Japan) (USA)

Total Mass of Na in Secondary .

(103 kg) 1500 570 Nominal Flow Rate (10 3 kg/s) 2.9 2.21 13.1- 3.3 4.8 Steam Generator Outlet Tempera-ture (C) 370 345 320 IHX Inlet Temperature (C) 343 345' 328 344 IHX Outlet Temperature (C)- 543 525 521 502 Steam Generator Inlet Temperature (C) 530 525 515 Water Temperature at SG Input (C) 235 Steam Temperature at Turbine (C) 510 487 Water Pressure at SG Inlet (MPa) 21.0 Steam Pressure at Turbine (MPa) 16.3 17.7 10.0 Nominal Flow Rate (kg/s) 1360 420 Primary Pump Location Cold Leg Cold Leg Hot Leg Cold Leg Hot Leg Intennediate Pump Location Cold Leg Cold Leg Cold Leg Cold Leg Cold Leg

CRBRP HETEROGENEOUS CORE DESIGN

- \

,,, l" "

.1 .

, l

-llll . , l /-

...;f[ 'H:'l "

b HH H_ , h >

'l . "

. .[" , ,H. . . ...  !  ;.. ..

../

^

ll'l, w ./ l

' ^

'"i.

I

- H l F-(. lh"

[

':..,[

"-) (!

i"'

..)"

x.

<...') ... .

~ 'p . .:

CYCLES ODD EVEN 156 162 h FUEL ASSEMBLIES O stANxET ASSEmsty 2i. 2o8 306 h RADIAL SHIELD ASSEMBLIES s

O PRiuARY CONTRot ASSEustiES 6

$ SECONDARY CONTROL ASSEMBLIES 6

@ ALTERNATE FUEL /8LANKET Figure 3 CRBR heterogeneous core desigi..

18 i

e 6

hot .sodim from the reactor vessel upper plenum through a Na/NaK heat ex-

-changer which pumps NaK through an air blast exchanger. This eystem requires integrity of the PHTS syste as.well as the availability of all three PHTS.

pony motors to provide sodium flow through the core. The entire heat trans-port system has been evaluated by Brookhaven National Laboratory and the findings are noted in a draft report [4].

The CRBR plant is protected by two independent and diverse _ shutdown systems either one of which is capable of effecting.a shutdown.- As an extra margin of safety, core-melt accidents-(HCDAs). have been considered and structural and themal margins beyond the design base (SMDBD and TMBDB) are.provided. - Ade-quacy of such margins against a range of HCDAs is being examined by the NRC and its consultants at Los. Alamos National Laboratory and hence are not dis-cussed here.

2.2 PHENIX 3.

PHENIX is the world's first demonstration-size LMFBR plant. The design'of .

this plant was' based on the research done with RAPS 0 DIE for fuel elements, and i MASURCA and HARMONIE facilities for the pump and heat exchangers. It is in-teresting to note that the PHENIX plant is of tha pool type, although consid-4 erable experience was gained from' years of RAPSOCIE (a loop-type design plant) operation. Construction work began in 1968 and the reactor went critical on

August 31, 1973, followed by full power operation in 1974. The basic objec-l tives were

! ~(1) - The power' rating should be sufficiently high to pemit future extrap-j olation to 1000 MWe.

(2) The plant should be operable at different power levels to conduct ex-periments as well as to supply power to the electrical. grid.

L This plant (see Fig. 4) employs the pool-type design. This' integrated reactor design provides for confinement in the case of incidents within the reactor

' block itself, thereby obviating the necessity of providing an impervious outer containment capable of withstanding high pressures. The components of.this l primary contaiment.and the devices sealing it off from the atmosphere in the building are designed to withstand a pressure of five to six bars. The re-actor building, of conventional design and constructed to contain an overpres-sure of 40 millibars (about 0.6 psig), is a controlled leakage structure cap-able of confining nomal and accidental contamination with control of ex-haustion to the atmosphere. The key design. parameters are listed in Table IV.

The safety design criteria for PHENIX.are similar to those used in the SUPER PHENIX, and hence are not discussed here. Here, some discussions of the in-strumentation and control systems are provided since the detailed level of instrumentation employed in PHENIX is indicative of a new generation of plants.

19

l T I A  !! Il I

L h &

C 1500 6N I

,R .

%n) f Working area c.ssa l ng ' Transfer arm l

lu AgDOCll l '**" , Rotating plug .

Controi rods m w .i y

, '][T

Spent elementswI

1 ' ,7] yxA~- 7--

3\

,l_

M i - - .

3.- z d F,,

• i t,1 M "

g h hotcelt 9JdlT

'= .

,f[_.L p

4 u -' pp (97 p.

i

-p rh

\y'I ::: (

-- n i ..

ins,ewon q kr1 p r"'.s*"i e l- tgg-Q[r'ra=-

g ng ,r a { cor.'j. ll g D

- -- p _j l I"**'"I-] N ._ _

.QyMI -g 1 .

_3 I II IO I Ii . A a d I i

Figure 4 PHENIX plant layout.

k t

20

1. Reactor Monitoring Systems The nuclear monitoring, manual control, and safety of the reactor are ensured by meaguring the neutron flux over an eleven decade (from 3x10-4 to 3x10' n/cm2-s) dynamic range. This is carried out by employing (a) two pre-startup pulse channels, (b) three startup pulse channels, (c) three power channels, and (d) two controlling measure-ment channels. The reactivity meters afford an adequate solution for mongtoring small changes in core reactivity. A change of 5 pcm (i.e.,

10- Ak/k) in reactivity is considered as anomalous when at steady state power. Adjusting safety thresholds to this value bposes oper-ating obligations and requires the use of an automatic inhibitor for

! this safety during nomal reactivity changes (primary pump shutdown, l

under 3 seconds, voltage failures, control rod drops).

The thermal monitoring of the reactor is accomplished by monitoring all of the 121 fuel assemblies by a system comprised of two themo-couples for each assembly and two independent digital computers, each one processing temperature measurements of each assembly. These com- .

puters monitor any unusual temperature increases which may not be com-patible with the reactor power and sodium ficw rate for each assem-bly.

In addition,12 sodium boiling detectors are located at the assembly outl et. These detectors listen to the level of ultrasonic noise, which is caused by implosion of the vapor bubbles when contacting col-der regions.

2. The Fafled Fuel Detection System The thin cladding of the fuel pins and the high burn-up rate envisaged for the assemblies require that the integrity of the cladding should be rr.onitored. The total monitoring facilities must ensure the three following functions: viz., to detect, identify, and locate the failed fuel assemblies. Taerefore, the chosen devices involve sampling of sodium and the argon cover gas. Global detection (DND/G) of the io-dine and bromine, which are delayed neutron-emitting fission products, is ensured by six samples of sodium taken from the vessel at the in-take of the six intemediate heat exchangers. Fuel failures are lo-cated by individual sodium sampling (DND/LRG) at the outlet of each fuel assembly.

All fuel assemblies are tagged with gaseous Xe and Kr. The sampling of the argon cover gas reveals the location of the failed element.

3. Sodium Instrumentation l This instrumentation includes the electromagnetic flowmeters and the intemittent or continuous sodiun level gauges. The sodium flow-meters on the PHENIX primary and secondary circuits are installed on large-diameter tubes. The continuous sodiun level measurements are based on the priiiciple of variation in' the mutual inductance of two f' 21

intercoupled windings submitted to.the effect of the sodium level around them outside a protective sheath. A temperature-compensating device is associated with each measurement probe. The flowneters and continuous sodium level measuring instruments are calibrated before being fitted in the power station.

4. Central Data Processing This processing is carried out by two different circuits. One is as-signed to the monitoring of nuclear boiler circuitry and the other to the electric generation plant circuitry and the electric power supply station's auxiliaries. These two computers do not share in l the automated systems of the power station except for the failed fuel i detection system. l S. Electric Power Supplies The power station auxiliaries are supplied with electric power by a 50-MVA distribution transfomer connected at the 20-kV level of the coaxial connection cables between the generator and the 20/225-kV trans fomer. A local 15-kV network provides emergency supply should the 225-kV grid fail, and as its power is restricted to 6 MVA, the power station is stopped in such a case.

Should these two sources fail, the standby auxiliaries are fed from two 2300 kW diesel-driven generators. Electric batteries keep the safety auxiliaries going, i.e., the primary sodium punps auxiliary motors, the turbo-generator set emergency lubrication penp, and the various electric supplies required for the monitoring and control system (DC/AC inverters, etc.).

2.3 SUPER PHENIX SUPER PHENIX (also known as the Creys-Malville Plant) is the world's first full-scale LMFBR. The construction of this multinational (51% Electricite' de France, 33% Ente Nazionale Kernkraftwerksgesellschaft)per l'Energia breeder reactorElettrica, andin16%

was started 1977.Schnell-Bruter This plant is expected to go critical in 1983. The basic principles used in the design are:

(1) Continuity with PHENIX - Adhering to the PHENIX design as much as possible (primarily meant using the pool concept, and core design).

(2) Safety regulations - The Service central de Surete' des installations nucleaires very early (1975) decided a list of safety condit' ions that must be met. These are sunmarized in Section 3.2.1.

(3) Base load plant - This plant must be capable of operating on base load planned annual utilization of 75%.

22

This plant (see Fig. 5) employs the pool-type design, similar to the one used in PHENIX. This integrated design of the primary circuits offers the follow-ing advantages:

(1) Facilitates ~the confinement of the reactor assembly, and therefore of the primary active and contaminated sodium, as well as of the argon (cover gasi circuits, (2) Provides large thermal inertia, allowing easy removal of the residual heat, and protects the structures against thermal expansion.

(3) Provides greater safety of cooling the core, even in the case of rup-ture of pipe connecting the pump with the vessel inlet.

The key design parameters are listed in Table IV. ,

The SUPER PHENIX plant has been con ~sidered, from the' point of view of safety, in the same manner as any other nuclear plant in France. The licensing autho-rities provided guidelines in a basic document, entitled " Recommendations Covering Safety Criteria for the 1200 MWe SUPER PHENIX Fast Neutron Plant," in 1973. .Most of the major recommendations were noted earlier. The key safety features may be grouped under (a) Protective Measures and (b) Active Measures.

It appears that considerable emphasis was given to core surveillance. Any malfunction in cooling the core is detected by instrumentation on an individ-ual assembly as well as the overall core surveillance. This is accomplished by (1) installation of two chromium /alumel thermocouples per assembly for all fissile and the first row of fertile assemblies, (2) installation of a fast response sodium-steel thermocouple per assembly, (3) sampling of sodium outlet of each assembly to detect fuel cladding failure location, (4) sampling of bulk sodium and argon to detect fuel cladding failure, (5) detection of. sodium boiling by acoustic system, and (6) the measurement of sodium flow at primary pumps inlet. In addition there is a parallel computerized processing system.

The protection from aircraft and other missiles was based on a probabilistic analysis covering three ranges of missiles. Since the probability of impact of a light aircraft (g700 kg with air impact speed of 100 m/s) on the reactor building is about 10- per year, a 1-m-thick concrete enclosure was provided

for. The probability of a large aircraft (110 tons with an impac l 100m/s)crashingonthereactorbuildingisconsideredtobe10gspeedof per year l which is very low and hence no specific protection against this type of mis-sile is provided. The turbine-generators are located in such a way as to prevent missiles being propelled directly on the reactor building.

The magnitude of the design basis earthquake (termed as an operating basis earthquake, OBE, in our terminology) is obtained from historical data and the geological survey of the region. The value used for the maximum horizontal -

soil acceleration is 0.10 g. Automatic shutdown is provided for. Subsequent operation after inspection is expected. The safe shutdown earthquake (SSE) is l considered to be twice the acceleration of the OBE. The shutdown is also

automatic for this level of acceleration and the plant is kept in a safe shut-down condition after such an event.

l l

23

l 1

I

. Control rod mechanisms Core closure plate large Smoll ,

Transfer machine inspection u

hale i j 0"' a P -

l

\ '

us , V Cover T I h ---

m c g i , L i .I, _

il ,_

<- =

ij_~ _

u h - v+ 2M mm v

{ +.

f h m-- m, i

t

_t

-- s =

e

t. __k -

g

/

g l

Int;rmedict

e f --

gogg k;j M heat g - -

sc M s /

% o cooling

, -u>i- dic cxchanger g /- d m ,

irysulation g - L- circuit l g

I {

f-f l - ,

Cootng - L I

f

• r i

baffles q z .r i "e ( l l l M l

- f , P fry pump of main  ? 4 j

~

( / /

/ 4}' 4

// [/

tank b

NoLevel //

c t

/

• 4 p w i

g

) n w rc n L "

L5 is.q is-4 3 g l

] {

inner tank g"' ra

[

i i Core k f 2

O int.11,000 Q'

s } l Y g j j- q p -

[ f i i

(

ll!

l{ g[

fummy de.gnd

( -

, 9 s

N, *1 4eutron t laterol l

'g "

l i

I , shielding Main tonk p 21,000 mm

• trongbock

{ j \ hCore diagnd

.f h ._ N , _/

i p

J ossemblies N _

g p, g [ g [ rg ver#p . i I

Sofity tank 9 22,450 mm R,-

[i _y t s j

/ .

c [ "

[7 mergency cootng circuit E

Core catcher f [

E J 2 _

_ _ _ , p 9

Rh E ii--

Neutron mecsurement cell

""""""""" A O : '

Figure 5 SUPER PHENIX plant layout.

9 24 -

A Three different shutdown systems are used in SUPER PHENIX . Neutronic shut-down is ensured by two independent systems comprised of ten or eleven absor-ber assemblies. The safety circuit is duplicated.- The design is similar to the one used in PHENIX. These twenty-one rods are used for, both control and safety. Four rods are sufficient to shut down the reactor. Furthemore, an additional shutdown system, comprised of three absorber rods, is also provided to enhance the reliability of the shutdown.

The decay heat is removed as follows:

i (a) '

In nomal conditions, decay heat is dissipated through the four secondary loops, the four steam generators, and the appropriate

, water / steam circuits. Only one of the four secondary circuits f

• together with its water circuit is able to reject the decay heat.

l (b) Each secondary sodium loop is ' equipped with one sodium-to-air heat exchanger able to remove the decay heat even by natural convection.

Of the four sodium-air heat exchangers, only two are sufficient t6 maintain the primary sodiun temperature without affecting plant ,

safety.

' (c) In the. highly unlikely case that all four secondary sodium loops are not available, two emergency cooling circuits have been provided.

These are water circuits located outside the safety tank and close to the concrete reactor cavity. These circuits operate continuously and each of them is designed to limit the primary bulk sodium temperature to 700'C.

The containment of this plant is designed to accommodate'the loss-of-flow ac-cident with a further assumption that none of the 24 safety rods is inserted in the core. The following assumptions have to be made to culminate this ev-erit: (a) the loss of electrical power, (b) failure of the diesels to supply power,=(c) none of the two banks of rods is inserted, and (d) none of the

, three additional backup control rods is inserted. (Note: SUPER PHENIX dif-fers from the PHENIX in that the fomer incorporates the three additional backup control rods.) The likelihood of this event is thus classified as highly hypothetical, since even with the insertion of a single rod (out of 24)

~

' -the power level attained could be removed by natural convection through the sodiun-to-air heat exchangers, without the sodiun (primary) boiling tempera-ture.being reached. This accident 1.eads to an ultimate mechanical energy re-lease of 550 MW-sec (i.e. , 550 MJ). The perfomance of the containment has been checked for 800-MJ mechanical energy release, and even with this energy i release, the integrity of the primary containment (safety tank and vault) would be preserved.

2.4 SNR-300

. SNR-300 breeder reactor (also known as the Kalkar nuclear power station)'is a i demonstration-size LMFBR under construction in the Federal Republic of Ger-many. This plant is a joint effort by the DEBENELUX countries (70% FRG,15%

Belgiuim, and 15% the Netherlands). Although SNR-300 is a loop-type design, it does provide mitigating protection against the guillotine pipe rupture

- accident by incorporating the downcomer inside the reactor vessel. The con-struction work was started in April 1973; initial criticality is likely to be '

attained in 1985.

25

g Q~ ,

7 A schematic of the reactor cell _and vessel is. shown in Fig. 6. Figure _7 shows

~

the, general plant layout 'and the containment system. . The key design param-eters are listed in Table IV. There are a number of important-design features of this _ plant such as:

(a) The reactor core is designed for two types of fuel ~ pins._ The dimen-sions noted in Table' IV represent the: Mark IA fuel employing _ fuel

~ pins of' outer diameter of 6.0 mm. Since it is economically advanta-

'geous'to use larger diameter pins, the reload core (identified as s

-Mark II) will empioy 7.6 mm o.d. pins.

E (b)' The' design of the reactor vessel allows ;for the inlet downcomer to be; placed inside the vessel. This pipe is surrounded by liquid sodim.

In the event 'of rupture of this pipe, the consequences of the reactor core will not be as severe as if this pipe were-outside the vessel.

In fact, the primary sodium temperature is not expected to reach its saturation value even for the " hot" channel .

(c)' Six emergency decay heat exchangers are located inside the reactor tank.: These heat exchangers, operating in parallel, transfer the de-cay heat to two forced convection air coolers via separate (nonradio-active) sodium loops equipped with electromagnetic (not centrifugal as used in the~ main ~ heat transport circuits) peps.

The design of the SNR-300 plant, along with its-Plant Protection System, was influenced by the KNK-2 which itself was converted from the thermal test re-

, actor KNK-1.- The KNK-2 is a loop-type experimental facility (58 MWt, 20 MWe)

.in operation since 1977. The main emphasis at the SNR-300:from its start in -

1970 was based on'the. strategy.of assuring nuclear safety via accident preven--

., tion and not mitigation. = This is because the prediction of the course' of an-X accident is much more reliable than the quantitative description of destruc-G'.tive consequences. Furthemore, this philosophy gives the fullest possible .

. protection, to the invested capital . With these considerations _in mind, it is

' helpful ~ to discuss the shutdown system of SNR-300.

q :' The' SNR-300 plant is equipped with two independent and diverse shutdown sys-tens, some key design' parameters are noted .in Table V schematically shown in

-Figure 8. 'These and all other safety activators are controlled by two'spati-

~

ally and functionally independent PPS. There is no cross-connection between

-them. Both, however, overlap functionally with respect to their general tasks, especially in the protection of the integrity of the fuel assemblies.

. \

2.5 PFR 1 The Prototype Fast Reactor (PFR) is Great Britian's first demonstration-size LMFBR built after a. number of years of operation of a 60-MW DFR. The PFR has  !

. a design power output of 600 MWt (250MWe). It serves as an intemediate step between DFR and the commercial unit. It is a pool-type LMFBR with the whole of the primary circuit contained in a tank suspended from the roof in a vault below ground. level and surrounded by a close-fitting leak jacket. Inside the primary vessel:and also suspended from the roof is the support structure which carries the diagrid on which the fuel, blanket, and reflector assemblies are 26

..,......, ~ .

\

k Operater floor v +17.2m

{ LJ #

t i

s

~IV 11 Controirods v + 12 m - - -

Liner - -- -

-n u--6 Reactor plug 4' 4- ip ~

P

• iS

j y~ ,_a P

.' ~.

M Pnmary shield Sodium outlet

~

a L

7 1 .

] '

Core center v 10 Reactor vessel

! P Guard vessef 37 .l - J O6_700 j

"f '

Pnmary W cavey 7 insui, tion Biological shield

= W plenum

-O- / tion system 2 - LQ.3 m i \ ' 'l F I,,,,_

v - 13.6 m l KKW Kalkar Reactor celland vessel Figure 6 SNR-300 reactor vessel schematic.

27

l C

C i

! 5 6 7

'd T k1

. s , W sy _,,

P y -

l11

_ [ - -;

n b ~, "i ]

i J

.nn.

4 I N

2]g s - u ,

2 Emergency cooling system

{

10--- l g. .h E l.

3 Primary sodium pump 4 Intermediate heat exchanger

!i g!! 8 i 5 Secondary sodium pump l j ,

6 Evaporator l^d -- l I

9

! ] 7 8Superheater Cavities j

9 Core retention system 10 Reventing gap KKW Kalkar, conta.inment system 11ThermalcapacityceH Figure 7 SNR-300 plant layout.

s 28

h . Tabl e V . Comparison between the first and second shutdown systems of SNR-300 l

Parameter l 1st Shutdown System 2nd Shutdown System

1. Accident reactivity Identical amount Identical amount compensation

2. Sensing Diverse and redundant Diverse and redundant but different set points

. l

3. Logic System Different manufacturer Different manufacturer

4. Absorber Rigid rod bundle Flexible (three rod

bundles)

Standby fission Above core Below core Insertion mode Free drop by gravity Pulled upwards by ,

tensioned springs

5. Scram release Indirectly by scram Directly by scram magnet magnet opening a mechanical scram clutch

6. Centering Centering tube held Centering tube held down down by spring forces by spindle

7. Max tolerable 26 mm 40 mm misalignment between axes of absorber and plug penetration 1

8. Max tolerable angle 1.3* 2.2 between absorber guide tube and con-nection rod i

I 29

i First Shutdown System Second Shutdown System  ;

indirect release: _,_ $ direct release: '

. scram magnet h I L

I C:D e C!

. mechanical clutch h  :];

. scram magnet  ;

d lj rotating plug a

sodium level

_E__-

_ kh__7 % ---

yshock absorber piston b G a Y

/

rigid absorber rod s a (rod bundle), F above core region ,

i l l I@

r g, core L articulated absorber rod r J (3 rod bundles),

below core region i u

ShR-300: SFUTDOW\ SYSTEVS L I

Figure 8 SNR-300 shutdown system design.

30

I assemblies are mounted. There are three intemediate heat transport circuits, each connected with two intermediate heat exchangers in parallel. The three centrifugal pumps are located in the cold leg of sodium. This reactor achiev-ed criticality on August 31, 1973.

Some of the important design parameters are noted in Table IV. The arrange-ment of components within the main reactor tank is shown in Figure 9. As is common with all pool-type designs, there is no penetration of the tank below the sodium coolant level which thus assures the highest possible integrity against loss of coolant. The PFR safety principles are:

1. Loss of coolant from the core is discounted on the basis of rigorous design of the primary tank with all penetrations through the roof, and provision of a completely separate leak jacket. The arrangement of the primary circuit and leak jacket is such that they are con-tained in a concrete vault below ground, level.

2. Temperature transients, due to coolant flow failure, are controlled by tripping the reactor (guaranteed by a multiplicity of trip para-meters) and provision of sufficient pump inertia to restrict the max-imum temperature to acceptable values. The larger volume of sodium in the primary tank is directly cooled at all times by a number of independent natural convection loops.

f 3. Reactivity transients are controlled by limiting the maximum rate of reactivity insertion, assuming all absorber is moved simultaneously, to a value such that the transient can be terminated by reactivity trips without exceeding fuel-failure temperatures. j 1

4. Propagation of certain subassembly faults could not be ruled out and l therefore the inherent strength of the primary tank, leak jacket, and '

vault has been exploited to provide a containment system. A series of model tests has demonstrated the ability of the containment ar-rangement to withstand a considerable explosive energy release.

The reactor hall is a low-pressure containment building, designed to withstand a relatively modest internal pressure of 20 in. of water with a reasonable low l leak rate, and provided with a chemical cleanup plant. The core design pro-vides for extensive use of fuel-failure detection equipment employing delayed neutron monitors, in addition to subassembly exit themocouples and neutron flux instrumentation. Special provisions, in the form of a specially cooled 3

structure below the core support plates, have been made to hold a disrupted or partly melted core within the primary vessel, in the unlikely event of this situation.

A significant aspect of the PFR fuel design is the location of the fission gas plenum. In PFR, the fission gas plenum is located at the bottom of each pin, in contrast with almost all other plants. This design provides for a lower likelihood of accidental gas release since the plenum temperature is essen-tially at the cold sodium temperature. On the other hand, in the event of leaks due to fabrication flaw or other causes, the released fission gas will have to escape through the heat-producing region. This will result in (1) a 31

= _

Reactor Roof 1 y ,

1 1,

I C

• < \

, \

w *

~S _

ey

• m 1

P q%<

_ . . .r l I.n.&_l

., , i _,

-e .e . . _ . -

Insulation / ~J ' -

Sodium Le m .j g-2 seet exch.noer-

-lj i l

Primary Vessel--

l

[ ,

_] _

-E g _%

I l r s /,l

. _; Neutmn Sheeld

+.ct _ _ _

p-gl -

/. Insulation W Support _ iagrid Structure

.c .a m===o r ' - 1 s e, [ j 3

1 Figure 9 PFR reactor tank layout.

1 32 4

f temporary gas _ blanketing-of the heated section causing additional overheating, and (2) a reactivity insertion due to sodium void thus caused.

2.6 MONJU MONJU is-a prototype. fast breeder reactor under construction in Japan. It succeeds-the experimental fast reactor J0Y0 which has been in operation since 1977. MONJU is a loop-type LMFBR with thermal power output of 714 MW. The key design parameters are noted in Table IV. The reactor. vessel and the prim-ary coolant system are situated in the containment building. The secondary 3 system, steam generators, turbine, and electrical system are located in the auxiliary buildings. The containment building is made of a low leakage steel and houses the reactor and primary coolant system.

Guard vessels surround the reactor vessel, the pumps, and the intermediate heat exchangers. All elevated primary pipings are surrounded by a guard pipe.

Thus, in the event of any breach in the coolant boundary, the reactor core is assured to be covered (this does not preclude any damage to the' fuel and blan-ket assemblies).

33 ,

s

7 - > -

, a 30 DISCUSSION' This'section isfintended to discuss _(1) design criteria used, (2)' design basis

' accident definitions, and (3) important observations on the accident analyses.

JSuch a discussion for the CRBR plant, which is under review for the construc-tion permit, is taken largely from the applicant's PSAR and various-informa-tion exchange meetings held over the past year between the applicantcand the-NRC's CRBR-Program 0ffice. For foreign plants this information was hard to ~<

Eget. ' A complete point-by-point comparison is: thus not possible.

3.1' -CRBR -i 3.1.1 Acceptance Criteria The applicant, in conjunction with the U.S. Department of Energy, has develop -

ed a set of. acceptance criteria for LMFBRs in general and for the CRBR plant ~

4 in particular. All incidents are first categorized and the acceptable sever-ity levels are defined (see Table VI). The acceptance criteria used by the

. applicant are given'in Table VII.:

i The acceptance criteria noted in' Table VII are to be applied for event termin-ation 'due'to the primary shutdown system. If the primary shutdown system is postulated to fail, then:the next higher level of damage is allowed for.the x event: termination with the secondary shutdown. system. The rationale is that ~

failure to actuate the primary shutdown-system is a low probability event so that the combined probability of.the event occurring and the secondary shut-down system' activation being: required is much lower than the probability of the event; occurring. Thus the resulting damage severity limits for either the primary system or the secondary system only functioning are noted in Table VIII.

3.1.2 Design Basis Accident and Analyses

.In a ' previous .section (Sec. l.4), the applicant's position on the design basis

' accidents was discussed. All of the 67 SFAC events and the five additional events. for ~a total of 72 events have been grouped two ways: (a) in terms of their classifications and (b) in terms of their analyses. The classification of these _ events basically defines the acceptance criteria.

The events considered in the CRBR are grouped as follows: l

.(a) Reactivity. Insertion Events

1. Uncontrolled control rod assembly withdrawal from a subcritical condition assuming the most unfa/orable reactivity conditions of the core and reactor coolant system (1). i

~

2. Uncontrolled control rod assembly withdrawal at power assuming .

the most unfavorable reactivity conditions of the core and re- l actor coolant system which yield the most severe results (hot at zero power, full power, etc.). (2).

34 4

1 l

l i

Table VI. Event classification and damage severity limits for CRBR Event Classification Severity Level Mechanical Design RDT Standard C-16-1 ROT Standard C-16-1 (Chapter 4)

> Nonnal: Normal Operation: No Damage:

Any condition of system startup, Normal operation includes No damage is defined as 1) no design range operations, hot steady power opera. ions and significant loss of effective standby, or shutdown other than those departures from steady fuel lifetime; 2) accomodation>

an upset, emergency, faulted or operation which are expected within the fuel and plant testing conditions, frequently or regularly in operating margins without the course of power operations, requiring automatic or manual refueling, maintenance, or protective action; and 3) no ma9euvering of the plant. planned release of radioactivity.

Upset: Anticipated Faulted: Operational Incident:

Any abnormal incident not An off-normal condition which An operational incident is causing a forced outage or individually may be expected defined as an occurrence which causing a forced outage for to occur once or more during results in 1) no reduction of which the corrective action the plant lifetime. effective fuel lifetime below does not include any repair the design values; 2) accomo-of mechanical damage. dation with, at most, a reactor trip that assures the plant will be capable of returning to operation after corrective action to clear the trip cause; and/or 3) plant radioactivity releases that may approach the 10CFR20 guidelines.

Emergency: Unlikely Faulted: Minor Incident:

Infrequent incident requiring An off-normal condition which A minor incident is defined as shutdown for correction of individually is not expected an occurrence which results in the condition or repair of to occur during the plant life- 1) a general reduction in the damage in the system. No time; however, when integrated fael burnup capability and, at loss of structural integrity. over all plant components, most, a small fraction of fuel events in this category may be rod cladding failures; expected to occur a number of 2) sufficient plant or fuel times. rod damage that could preclude resumption of operation for a considerable time and/or

3) plant radioactivity releases that may exceed 10CFR20 guide-lines, but does not result in interruption or restriction of public use of areas beyond the exclusion boundary.

Faulted: Extremely Unlikely Faulted: Major Incident:

Postulated event and conse- An off-normal condition of A major incident is defined as cuences where integrity and such extremely low proba- an occurrence which results in operability may be impaired bility that no events in this 1) substantial fuel and/or i to the extent that consid- category are expected to occur cladding melting or distortion erations of public health during the plant lifetime, but in individual fuel rods, but and safety are involved. which nevertheless represents the configuration remains extreme or limiting cases of coolable; 2) plant damage that failures which are ider.tified may preclude resumption of plant as design bases, operations, but no loss of safety functions necessary to cope with the occurrence; and/or 3) radioactivity release that may exceed the 10CFR20 guidelines but are well within the 10CFR100 guidelines.

35 s

k

\

k

i i

Table VII. Acceptance criteria for. preliminary safety evaluation for CRBR i

Event Cladding Coolant Severity I4) Fuel Temperature Classification Level Temperature (*F) Temp

• F)(erature Anticipated Operational So11dus(1),(2) 1500 II) N/A i Fault Incident Unlikely Minor Solidus (1),2) 1600 II} N/A

Fault Incident Extremely Major ---

Solidus Saturation (3)

Unlikely Incident (2475) w Fault or

• Postulated Accident NOTES:

l

(1) For temperatures in excess of these values, transients shall be assessed using mechanical j design procedures and design limits of Chapter 4.2.of CRBR PSAR.

j (2) No fuel melting at existing conditions.

(3) No sodium boiling at existing pressure.

1 (4) Applicable " Event Class"or " Severity Level" is based on Primary Shutdown System action . For Secondary System Shutdown see Table 4.2-35.

I

_ _ _ . _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . _ _ ___A _ . _ . _ _ , _ _ _ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ _ _ _-- _ _ , -__ _ _ ._m , _ ___.

Table VIII. Primary and secondary shutdown system damage severity limits for CRBR Damage Severity Limit Primary System Only Functioning Secondary System Only Functioningl Event Classification .

Fuel

• Cladding Coolant Fuel Cladding Coolant Temperature Temperature Temperature Temperature Temperature Temperature Anticipated Solidus 1500 F N/A Solidus 1600 F N/A Faults Unlikely Solidus 1600 F N/A ---

Solidus Saturatior2 Faults (2475 F) w Extremely Un- ---

Solidus Saturation 2 Not a Design Basis 3 likely Faults (2475 F)

(1) Failure of the primary system to scram when required for an anticipated fault is defined as an ex-tremely unlikely event (fault condition). However, the damage severity limit for the secondary shutdown system is conservatively specified to assure fuel pin integrity even for the concurrent anticipated fault and failure of the primary shutdown system.

(2) No sodium boiling at existing pressure.

(3) Combined probability of two independent failures (extremely unlikely fault and failure of primary control rod system) is exceedingly low and not appropriate as a design basis. However, as an ex-ception, the following concurrent events are being used as a design basis: a) loss of offsite power resulting from a safe shutdown earthquake (with a consequent reactivity insertion of 60() and b) failure of the primary control rod system. With these concurrent events, the secondary shutdown system shall be capable of shutting down the reactor without exceeding major incident limits (i.e.,

no sodium boiling and the cladding belcw its solidus temperature).

3. Control rod misoperation or sequence of misoperations (3).

4. Start-up of an inactive reactor coolant loop or recirculating loop at incorrect temperature (5).

5. Maloperation of reactor plant controllers (10).

6. The spectrum of rod ejection accidents-(17).

7. Gas bubbles passing through the core (34).

8. Inadvertent drop (delatching) of a single control rod (38).

9. Failure of core clamping mechanism (41).

10. Unknown stuck control rod (47).

(b) Undercooling Events

11. Partial and total loss of reactor ccolant flow including trip of '

_pumpsandpumpseizures(4).

12. Loss of normal and/or emergency feedwater flow (6).

13. Loss of all AC power to the station auxiliaries and loss of emergency diesel generators (station blackout) (7).

14. Loss of intermediate coolant flow (8).

15. Loss of coolant accidents resulting from the spectrum of postu-lated piping breaks within the reactor coolant system (12).

16. Spectrum of postulated intermediate coolant system piping breaks inside and outside of the containment '(13).-

17. Loss of heat sink (22).

18. Turbine trip with coincident failure of tubi,ne bypass valves to open(23).

19. Failure of a few steam generator tubes (30).

20. Failure of steam dump system (35).

21. Inadvertent closure of either reactor coolant valves or inter-mediate coolant valves (36).

22. Spurious reactor trip (37).

23. Plugging of reactor overflow line (40).

24. Accidental opening of valves to a drained isolated loop (42).

25. Large leak (rupture) in steam or feedwater piping (43).

38 l

{

26. Loss of normal shutdown cooling system (48).

27. Simultaneous leak of reactor overflow tank (49).

28. Heat removal greater than heat generation due to (a) feedwater system malfunctions, (b) a pressure regulatory failure, or in-advertent opening of a relief valve or safety valve, and (c) a regulating instrument failure (9).

(c) In-core Local Failure Events

29. Inadvertent loading and operation of a fuel assembly in to an improper position (14).

30. Local blockages of a few subchannels within a fuel subassembly (27).

31. Core flow maldistribution due to fuel loading error (33).

32. Gas bubbles passing through the core (34).

33. Enrichment error in fuel assembly (44).

34. Misloaded fuel assembly (45).

35. Blocked coolant flow to control rods (66).

(d) Fuel-Handling and Storage Events

36. Fuel-handling accident (18).

37. Dropped fuel assembly (46).

38. Inadvertent closure of floor valve on canister during fuel hand-ling (50).

40. Loss of site power during fuel handling (52).

41. Fuel-handlingmachinejams(53).

42. Leak in fuel storage vessel (54).

43. Failure of single active component in fuel storage cooling sys-tem (55).

44. Failure to seat fuel assembly properly (56).

45. Inadvertent opening of floor valve with shield plug removed and fuel-handling machine not in place (57).

46. Leak in fuel canister (58).

, 39

1

47. Inadvertent opening of fuel handling machine valve during trans-fer(59).

48. Attempt to insert a fuel assembly into occupied position (60).

49. Collision of fuel-handling machine with control rods (61).

50. Dropping shipping cask from maximum possible crane height (62).

51. Collision between fuel-handling machine and crane (63).

52. Loss of all power to fuel-handling machine (64).

53. Removal of jammed fuel assembly (65).

(e) Sodium Spills and Fires

54. Internal and external events such as major and minor fires, flood, storms, or earthquakes (11).

55. Loss of coolant accidents resulting from the spectrum of postu-lated piping breaks within the reactor coolant system (12).

56. Spectrum of postulated intermediate coolant system piping breaks inside and outside containment (13).

57. Intemediate coolant system fire (67).

(f) Other Events

58. Waste gas decay tank leakage or rupture (15).

59. Small spills or leaks of radioactive material outside con-tainment (19).

60. Fuel cladding failure combined with intermediate heat exchanger and steam generator leaks (20).

61. Loss of one (redundant) DC system (24).

62. Turbine trip with failure of generator breaker to open (25).

63. Loss of instrument air system (26).

64. Leak in control rod drive housing (28).

65. Inadvertent release of oil in pump seal into sodium (29).

66. Leaks in intermediate heat exchanger (31).

67. Abnormally high or low cover gas pressure (32).

68. Failure of reactor vessel cover seal (39).

40

L L

L Note that the numbers after the identification of events corresponds to the l numbering used in the SFAC list (Table II). The remaining four events are f non-events. All _ of these events have been analyzed in the PSAR where they are shown to meet the acceptance criteria.

) 3.2 SUPER PHENIX' 3.2.1 Design Basis Accidents and Requirements The Nuclear Safety Department of CEA provided in 1972 the following recommen-i dations for the safety criteria for SUPER PHENIX in order to give safety de-

)- sign guidance to the constructors at the pre-design stage. The final form of a 40-page typewritten document was presented officially at the end of 1972

) after consultation with all the participants in the program and several edi-l tions were made. The safety guidance document was approved in February 1973

by the licensing authority under the title of

" Recommendations for Safety l criteria Applying to the 1200 MWe SUPER PHENIX Fast Power Station."

As background, it is important to note that the safety design bases are recom-mendations only. Secondly, these criteria have been written in tems of gene -

ral principles. Thirdly, these criteria were established on the following:

! (1) First and foremost, recent French knowledge of sodium fast reactors

[ based on more than 20 years of experience, especially on RAPS 0 DIE and PHENIX. PHENIX, in particular, has been a constant reference and re-sults of its startup, power rise, and full power operation served to l confinn some major safety options such as core-monitoring instrumen-f tation performance, natural circulation, emergency cooling, etc.

I (2) International experience, especially from the U.K. , U.S. A. , and Ger-

} many. 'In particular, although a direct transposition of USAEC LWR f criteria was not possible, some of them have been used or adapted.

(3) This station will be a prototype, operated on a site situated in a low-population density area. One must also note that the reactor will be of a pool type and some of the recommendations are strictly f linked with this concept.

} This safety guidance document has three main chapters: Chapter One deals with

! general design criteria, Chapter Two is a list of the accidents that must be assessed in the safety analysis, and Chapter Three gives detailed design prin-ciples of protection against the accidents listed, in terms of methods for i prevention, detection, and action to cope with them or to limit their conse-quences if an accident reaches further stages.

l Because of the unavailability of this document in the U.S.A., the following seven points - protective system, primary system, core accidents prevention, whole-core accident and containment, sodium fires protection, seismic design, and external missiles protection - are briefly discussed.

l 41 1

1

1. Protective System Important factors about design basis requirements for this system are:

- Two systems are recommended, a main system and a backup system based on a different principle. For the main system, the following requirements are given:

- It must be divided into two completely independent systems, q each one actuating half of the control rods. This includes geographic separation of all circuits, connections, and power supplies.

i

- The reactor must be able to be scrammed in less than one second and maintained subcritical in the cold condition as- i suming simultaneous failure to trip of one system and of one <

rod of the other system.

- The protective system and the core reactivity must be designed i such that with either a single rod ejection, or complete and uncontrolled withdrawal of one group of rods at maximum pos-sible speed (one group being the maximum that can be actuated one at a time), reactor trip must safely control the trans-ient, or if the trip fails, technological limits on fuel pins will not be reached (that does not mean, of course, that the specified limits for normal operation will not be reached).

2. Primary System This part refers to a pool-type concept for which the whole volume of the primary sodium, including auxiliary systems, is entirely contained inside a single primary containment without any external pipes. (This was almost the case for PHENIX except for auxiliary systems; for SUPER-PHENIX, everything is designed to be integrated).

The various required characteristics are divided into two main categories referring to the containment function of the primary system and to its cooling function.

a) In terms of containment function:

- Constructive dispositions will be taken in order to make accidental or spurious draining out of primary system impossible.

- A safety vessel will be provided around the main vessel, designed to allow in-service inspection of the main vessel, and be such that in case of a failure of the main vessel, the sodium level will be high-er than the core and IHX inlet levels, thus allowing decay heat re- '

moval by natural circulation.

- The safety vessel, its upper closure structures, and structures around them must safely contain the consequences of whole-core ac-cidents (we will come back to this point later). {

42

b) In terms of cooling function:

- Natural circulation must be possible in the whole primary systec: <J (this is a very important advantage of the LMFBR system in its abil-ity to ensure emergency decay heat removal by simple and static means based on natural convection).

l - Decay heat removal system will be ensured by several . independent and redundant paths with, in case of complete loss of the normal system (including complete loss of power supply for forced convection), an emergency system completely independent. SUPER-PHENIX is being de-signed in this regard with very large inertia systems on primary-pump power supply aiming, at the limit, at avoiding damage to fuel in case the pumps run down without a scram.

- An emergency cooling system external to the primary containment, in-r' dependent of any system connected with primary sodium forced convec-tion and away from the influence of direct mechanical consequences of accidental core-disruptive accidents. it will consist of a water system, over-designed and separted in several independent loops, used in normal operation to cool the concrete around the primary containment. Such a. system, which is static, permanently tested and independent of primary system internals is a major safety character-istic.

- Besides, an internal core catcher is under design.

L 3. Core Accident Protection i Fast reactor cores are sensitive to cooling defects due to high power den-sities that develop in a compact geometry which is divided into small coolant channels. The cooling-defect-type accident must be prevented and detected not only because of the immeaiate consequences, but also because it is possible that theoretically, through a propagation process, a whole-core accident might be initiated.

a) Prevention In addition to the important classical requirements for quality con-trol of all. components, we list the following design requirements to prevent occurrence of cooling accidents at core level:

- Hydraulic holddown of subassembly (S/A).

- Mechanical systems to physically prevent S/A positioning in wrong i flow positions.

- S/A inlets designed to prevent complete flow blockages, with several large lateral feeding holes around a cylinder. ,

43

I

- Prohibition of reactor operation with failed fuel that could release solid particulates of oxides into the sodium in order not to risk heating local blockages inside S/A. This means that permanent in-dividual delayed-neutron detection (DND) must be provided and there-fore a sodium sampling system is necessary for each S/A. This also means that the characterization of different modes of fuel failure must be known since it would be too large a penalty to for- bid any kind of operation with failed fuel.

b) Core Monitoring System Considerations of the nature of potential risks and of the importance of the problem to be solved leads to the concept of a core monitoring system cap-able of early detection of any cooling disturbance and of tripping the reactor prior to propagation towards an irreversible situation.

This system must be based, for obvious complementarity and redundancy reasons, on individual S/A detection, global core detection, and correlation between the two types of signals.

4. Whole-Core Accident and Containment When the recommendations were written, the mechanistic analyses of possible whole-core accidents were not undertaken. It was stated at that time that the double potential risk of prompt nuclear excursion in case of large core melt-ing, and of subsequent sodium-fuel interaction had to be taken into account for the dimensioning of the primary and secondary containiment in a conserva-tive way, even quite arbitrarily and regardless of the initial causes.

In continuity with PHENIX, the project has taken a working hypothesis of a co-herent gravity compaction of the core leading to a 60 $/s ramp rate. The con-tainment designed on this basis consists of a primary containment (main and safety vessels) with a reactor cover, in addition to a tight, resistant, me-tallic dome above the roof. This dome serves as the primary containment boundary in the case of primary sodium leakage around large component penetra-tions through the roof of mare than 1.1 tons of primary sodium. It also pro-tects the roof from external missiles and secondary sodium fires.

5. Sodium Fi T Primary and secondary sodium fires have quite different characteristics:

- Primary sodium fires are always radioactive and may happen under the form of spray fires which give the worst thermodynamic consequences (in terms of pressure and temperature for a given mass of sodium reacting with air) if they result from an expulsion through roof penetrations following a core explosion. In that case, however, containment and limitations of masses of sodium that could be released in non-inerted partsof the reactor are relatively easy to achieve.

- Secondary sodium fires are not radioactive and are much more likely to be pool-type fires, but the limitation of the masses that could react with air is quite difficult.

44

/

l l

Recommendations, therefore, are different according to the type of fire. Be-cause of the radioactive character of primary fires, it is necessary to have at least three tight and resistant barriers between primary sodium and air at all times, and to confine any radioactive sodium circuits in inerted cells.

For secondary sodium fires, there are two general criteria: First, the pri-mary system must be protected from all secondary fires. Secondly, large secondary Na fires at definite sensitive points or components such as pipes, pumps, valves, tanks, and steam generators must not be allowed to spread and cause severe damage to other sensitive parts of the plant. These recommenda-tions are in addition to the classical requirements for leaks and fire detec-tion and alann systems wherever sodium is present.

6. SEISMIC DESIGN Seismic design requirements entail taking into account a given design earth-quake. The plant must not suffer any damage that would require any major re-pair. Furthemore, for an earthquake of magnitude one degree higher than the above noted level, the nuclear safety of the plant must be guaranteed.

7. MISSILES

a. Internal Missiles In addition to the general recommendation protection against missiles in-ternal to the plant, two particular points are stated with specific criteria:

(1) there must be an antimissile protection around the inertia wheels of pri-mary punps, (2) the axis of the turbine must be perpendicular to the main axis of reactor and plant building in order that it be protected against rotor tur-bine rupture consequences.

b. External Missiles A probability analysis of aircraft-crash risk showed that the SUPER PHENIX site is outside any airport landing or approach zone, and consequently only the crash of light planes up to 12,500 lbs. must be taken into account. The probability of such an accident is slightly lower than 10-6, extrapolated to the year 1990.

! Here, the criteria state that primary containment must maintain integrity and

that reactor shutdown and decay heat rejection must be safely achieved.

l 3.3 SNR-300 3.3.1 Design Basis Accidents and Requirements The design basis accidents for SNR-300 consisted (at least initially) of a y broad range of internal events all of which can be categorized as either un-dercooling, overheating, local faults (in-core), and sodium fires. In addi-tion, a set of external events had to be considered. The plant protection system was then designed to accommodate all these events. The core disrup-tive accidents were initially considered by the Gennan licensing authorities to be hypothetical in terms of their likelihood of occurrence. Current li-censing opinion has mandated that the plant be designed to protect against a prescribed mechanical energy release of 370 MW-sec.

45

The design basis accidents against external events can best be described by categorizing the external events themselves:

(a) Earthquake - The design requirements for the design earth-quake are that hgrizontal andg)vertical (i.e., 0.05 and accelera-tionso{50cm/s 25 cm/s (i .e. , 0.025 g), respectively, be tolerated as an upset condition. For the safety earthquake, acgelerations of 120 cm/s2 (0.12 g) and 60 cm/s (0.06 g) should be accommodat-ed as an emergency condition.

(b) Aircraft Crash - The design case for an aircraft crash accident is defined as the impact of a phantom plane with 0.65 Mach vertical to the building. The model j of the loading process considers the elastic- I plastic deformation of the aigcraft and results l in a maximum force of 7.6x10- MN on the build- )

ing.

(c) External Explosion - An external explosion is anticipated as a conse-quence of a ship collision on the Rhine river.

The peak pressures in the reflection wave and the final static load were prescribed.

All these loadings (except for the design earthquake) must be individually ap-plied to all systems necessary to keep the reactor in a shutdown condition.

The decay heat must be dissipated and the radioactivity must be contained.

Corresponding to the single failure criterion, a further failure (additional to the external event) must be assumed if such an additional failure has a not too remote probability of occurring.

The Plant Protection System of the SNR-300 is designed per KTA-rule 3501 to the following essential requirements- 1 Analysis of the course of the transients without taking into account I 1.

PPS action.

2. The initial plant condition is defined as the most unfavorable normal operating condition, where set point deviations and a disturbance due i to one random failure, for instance within the control system, are to l be included. l

3. For each accident to be guarded by the PPS, pref erably physically di-verse means of sensing have to be used. If this is not possible, a higher degree of redundancy and diversity within the various equipment has to be achieved. -

4. If process variables common to the control system and the PPS have to be used (e.g., core outlet temperature), a detailed failure analysis in the area of data acquisition has to be performed. If channels of the PPS also serve control functions (e.g., permanent magnet flow-meter) its harmlessness also has to be demonstrated.

46 l

l

5. Disturbances initiating faults within the PPS must not impair safety actions when called upon. The transient analyses have to begin with the assumption of a random fault, a systematic fault, and failures which might have been caused by those faults or by the considered

. transient. The criterion must also be fulfilled even if the system is in a condition of maintenance or repair (exception: a random fault and a systematic fault must not be assumed simultaneously within a time interval of 100 hours0.00116 days <br />0.0278 hours <br />1.653439e-4 weeks <br />3.805e-5 months <br />). The probability of a systematic fault can possibly be reduced by adequate means, so that its assumption is no longer necessary.

u.

l

6. Manual actions are acceptable only if there is more i.han a 1/2-hour l

time period available in the case of internal events, and 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> in the case of external events.

7. The design of the plant protection system must not dictate the un-availability of the safety system.

The general idea to fulfill the requirements against either internal or ex-ternal events is to provide (1) a diverse and independent shutdown system (as noted above) and (2) two redundant decay heat removal systems which are, together with all auxiliary systems necessary to operate them, completely independent from each other with the exception of those systems as the emer-gency power supply (which is housed in a building fully protected against ex-ternal events).

The first redundancy is represented by the normal decay heat removal system.

It comprises the main sodium loops, the steam generators. the water-steam sys-tems for decay heat removal, the Rhine water cooling system, and the control room. Any one of the three sets of loops should be capable of dissipating de-cay heat. In the case of external events mentioned above, the first redun-dancy is assumed to be lost. The second redundancy is represented by the emergency cooling system. It comprises the in-vessel immersed cooler and as-sociated circuits, emergency power, water supply, and emergency control func-tions. This path of heat removal consists of two circuits, either of which should be fully capable of discharging decay heat. This second level of re-dundancy is fully protected against external events mentioned earlier, at l least those which can damage the first redundancy. Both systems are protected against internal events such as fires in accordance with the single failure criterion.

The fundamental internal event is the guillotine rupture of a pipe. It has to be assumed to occur primarily somewhere in the high pressure pipes of the water steam system. But it has also to be applied to sodium pipes, if the dissipation of the decay heat is concerned. Dynamic forces transferred by the breaking pipes to adjacent structures, sodium or hydrogen fires, and expansion of high pressure steam or water in the room in which the pipe fails are the relevant conditions to be considered as the consequences of such a primary internal event.

l l

47

3.3.2 Transient Analysis The safety assessment of the SM-300 piant was made in accordance with the KTA  ;

rule 3501 mentioned earlier. The following parameters are analyzed:

(a) Error in the measurement signal and the scram set point

_(b) Failure of scram initiation-signals (c) _ Shutdown with a reduced number of rods (d) Excessive delay during the rod insertion phase (e) Superposition of such failures.

In each case it is of interest to determine the degree of failure that is tolerable without impairing the integrity of the core.

Example of events analyzed are:

(a) Nomal Scram There are among others, the following set points at which PPS initiates scram:

Function First' PPS Second PPS Neutron flux 112% -

Ratio-flux to loop flow 1.2 -

Ratio-flux to core flow -

1.2 Core outlet temperature To + 30 K To + 30 K Temperature change AT 40 K -

lATl -

40 K

, Flux change 0.3 -

Normal operation at 100% load results in the flux to loop flow ratio of 1 and T ois the core outlet temperature at normal load. At 30% load, the normal value for the flux to loop flow ratio is 1 but the normal core outlet temperature is 40 K below j that for the 100% load condition.

Scram can be initiated by the first PPS or the second PPS.' The neutron flux decrease is prompt while the coolant flow reduces with a half-time of three seconds. Shutdown is assured with all 12 rods, but the activation of one re two rods would be enough 48

to fulfill the essential safety requirements. The sensitivities due to delay in activating insertion of control rods and the insertion time are also analyzed. A delay of up to 5 seconds in activating and 15 seconds in insertion time is tolerable.

(b) . Lots of Power to all Purpps The worst anticipated flow reduction is due to a simultaneous coastdown of all pups as in the case of a complete loss of electric rower. Each .DPS contains three scram signals which are sufficiently sensitive to scram the reactor in time. The first PPS is the flux to flow ratio (which causes scram at 1.5 s), the seccond PPS is the core outlet temperature (scram at 3.6_s), and the third PPS is the temperature change of 40 K (scram at 4.0 s). These scram times may be compared with 5.6-s delay required to boil sodium. Similar results for flow coastdown at 30% load are obtained.

(c) Pump Seizure The spontaneous pump seizure of one primary pep produces smoother transients than loss of power to all pumps. Failure of one primary pep without scram would reduce the core flow to ab-out 55% in the most unfavorable case. Even in this case, boil-ing would not occur.

(d) Withdrawal of Control Rods Withdrawal of a control road and eight shim rods will result in a maximum reactivity insertion of 4t/sec. Four different signals fra the first PPS are able to limit the transient with-out fuel melting. The first scram is due to exceeding (in 3.0 seconds) the setting of flux to loop flow function. The second scram function is the flux to core flow ratio which is exceeded in 4.9 s. The core outlet temperature setting is reached in 9.8 s and the temperature change signal is reached at 11.5 s.

Higher reactivity insertions are less demanding since the plant is scrammed earlier.

(e) Guillotine Pipe Rupture i,

The guillotine pipe rupture in the high pressure water / steam pipe initiates reactor scram, and the decay heat is dissipated through other loop / steam generators. The guilletine pipe rup-ture of the primary sodiun piping is also considered as a de-sign basis accident. For all rupture locations independent of initial power level, the flux-to-core flow function of the second PPS becomes effective immediately after the accident and trips the reactor and peps within 0.6 to 2.6 s depending on the initial power level . The second signal would be the sodium 49

e

)

[ '

1 l

,j level in the reactor tank for which, because of the relatively late nuclear tripping, sodium boiling in " hot" channel would -

have'to be expected. In addition to the reactor and pump trip .

.no further active measures are necessary to control ~ the pipe rupture accident in respect of effective core cooling. .The cav-E ity concept ensures a leakage limitation in time and in volume '

and thereby a long-tenn decay heat removal via the two remaining operable main circuits. It is further noted that even for this situation, the. in-vessel emergency core cooling is still avail-able as a backup system. ,

~

3.4 MONJU~

3.4.1 -Safety Design Criteria -

The safety design philosophy 'of MONJU is similar to that of CRBR. It.is '

implemented by (a) setting up safety standards which provide the design basis, (b) completion of safety design, (c) . design approval by safety evaluation, (d) quality assurance in component manufacturing, plant construction and-post- .

construction, (e) in-service inspection, and (f) safety demonstration. Since MONJU, like CRBR, is-the first prototype LMFBR, essential design criteria are not.available. The development of basic criteria is one of the objectives in the MONJU project. .

For.the purpose of accident analyses, all accidents are classified on the basis of their frequency of occurrence as follows:

Category A: Single-failure events which can occur several times during--

the 11fe 'of plant.

Category B: The probability of occurrence of failure of a single com-ponent may be small, but such an event is expected to occur ,

once during the' life of plant. .

Category C: Probability of- occurrence is very small during plant's life, and it. is considered to be unlikely, but such an occurrence is postulated for the safety design criteria.

Category D: An event which has the probability of occurrence smaller than that of Category C, or.which is a combination of Category A plus postulation of scram failure.

This classification of ev'ents is very similar to the CRBR approach in that J Classes 1 through 3 are equivalent to Categories A through C, and the Cate- l gory D appears to be similar to beyond the design basis events. The expected 1 i

consequences for these categories are noted in Table IX.

The safety design criteria thus evolved for MONJU are listed below by com-ponents.

50

t Table IX. Classification of accidents used in MONJU Category of Expected Frequency Consequences Events of Occurrence A

(Minor Accidents) o Single Failure o Continuous smooth operation possible o Expected to occur several times during o Fuel does not melt plant life o Cladding does not fail o Causes are anticipated B o Replaceable system components not so (Medium Accidents) o Single Failure damaged as to decrease their life time o Expected to occur once during plant's life o In the case of the system component that o Causes are anticipated can be maintained, it is possible to re-u, pair it during refueling o In the case of the system component that cannot be replaced'or maintained, a damage that decreases its . life time is unacceptable

o. Fuel melting in minor region o Cladding strength decreases C o Repair will be required (Major Accidents) o Accidents are postulated to' happen in the o Operational trouble repairable within' a worst case few months o Fuel melt in small region o Cladding failure possible - fission product gas may be released to the primary coolant

t 4

4 Table IX. Classification of accidents used in MONJU (Cont.)

Category of Expected Frequency Consequences Events of Occurrence D o It 'is impossible to replace, repair, and-(Hypothetical o Accidents postulated hypothetically reoperate'tne damage system components o Fuel and core materials are melted

~

Accident) 0 Core geometry has been damaged u, o Core disruptive accident occur's . .

"* o Containment integrity is maintained, the.

system components needed for maintaining- e containment integrity are not damaged,:

and their functions are retained o System integrity needed for the decay' heat removal after core disruption is maintained and required functions are provided 7-- L 6 M. .

~

Reactor Core Design

a. Reactor core, blanket, and associated cooling systems shall be designed such that the prompt power coefficient and the overall power coefficient ,

in the power operating range should not be positive through the reactor '

life.

., b. Reactor core, blanket, associated cooling systems, and control and pro-tection systems should be designed not to exceed the fuel damage limits mentioned in the classification of accidents.

c. Assembly bowing shall be constrained by core clamping mechanisms which can accommodate fuel handling, scram characteristics, and core (nuclear, thermal) characteristics.

d. Core deformation by thermal, mechanical, and hydrodynamic forces under the

-normal operating and anticipated accident conditions shall be limited so as to prevent reactivity changes which may produce safety problems due to core defomation. Core deformation by earthquakes or other forces shall be limited so as to prevent positive reactivity insertion.

e. Fuel element vibration etc. by coolant flow does not cause nuclear and mechanical impropriety in the core.

• f. Coolant flow rate in core shall be determined by considering material corrosion, etc. Pressure drop in the core shall be decided by consider-ing the prevention of cavitation and the insurance of natural covection.

Fuel Design

a. Fuel element shall be designed to prevent fuel failure by fission product gas pressure, thermal expansion of fuel pellets and cladding, and swelling deformation, etc.

s j b. Maximum fuel temperature on overpower conditions should not exceed the i fuel melting temperature during reactor operation.

E l c. Fuel element shall be designed so that an accident which exceeds the fuel damage limits does not occur by reactivity changes even if the axial fuel movement happens in the clad.

d. Reactor core shall be designed to minimize the probability of local block-2

- . ages in a fuel assembly by impurities, debris, and foreign materials in sodium.

e. Fuel element must be designed so that mechanical, hydrodynamic and themal F effects by local failure do not impose any bad effects for adjacent as-semblies, the extent of which are specified in the classification of ac-cidents. Insertion of safety rods shall be ensured under the local ac-cident.

53

f. Proper measures must be taken to prevent core damage by fuel-handling er-rors if the core is composed of different kinds of fuel assembly. Mech-anical means shall be.provided for. protecting the insertion of core fuel into blanket region and vice versa.

Control and Safety Rod Design

a. Mecha'nical integrity and oparational capability of both control and safety rods shall be ensured if any anticipated accident happens.

3:

b. Safety rods shall be divided into two independent shutdown systems, with drive mechanisms operating on different principles from each other.

c. One of the shutdown systems has a. margin of 1% Ak/k under the condition of one stuck rod. When one system cannot act, shutdown shall be ensured by other shutdown systen and the shutdown condition shall be maintained under the cold critical,

d. Maximum reactivity worth of a control rod together with its withdrawal

~

speed shall be limited to the extent such that the fuel damage limits mentioned in the classification of accidents is not exceeded.

e. Safety rods shall be inserted into the reactor core within one second after the scram signal reaches the drive mechanism.

f. Control rods, safety rods, and their drive mechanisms shall be designed to prevent movement in the directions which add the reactivity.

Reactor Vessel Design

a. Reactor vessel shall be designed, constructed, installed, and tested according to the highest-quality criteria that are practical.

b. Under stress due to normal operation, maintenance, testing, and accident conditions far the reactor vessel integrity shall be evaluated with suf-ficient margins with respect to (a) embrittlement characteristic behavior, (b) radiation effects on material characteristics, and (c) size of defect.

c. Reactor vessel shall be designed with consideration to thermal shock due to reactor scram.

i For reducing radiation damage of reactor vessel, it is necessary to in-d.

stall neutron shielding.

. e. Reactor vessel shall be designed to ensure the integrity of vessel in the

- event of a hypothetical core-disruptive accident.

er 54

_m -g -

e- , - -,- .w , , - - - - - - --- - - - - - - - - - - - - - - - "

f. To prevent oxides from depositing in the region where sodium flow is stagnant, it is necessary to ensure the sodium flow even in such small areas as gaps between assemblies.

g. Vent holes shall be provided for removing gas from the reactor vessel, in-let plenun, and internals. However, core internals shall be designed to limit entry into the core of large quantities of gas bubbles.

h. Core internals including shielding materials shall be designed to be re-moved when refueling or maintenance is required.

1. The entrance nozzle is designed to have a large reverse flow resistance for ensuring the core integrity in the event of pipe failure near the entrance nozzle.

J. Drain system shall be installed to check or maintain the core internals.

However, soditsn must not be drained as the result of operator error, con-

' trol malfunction, and/or drain piping failure.

k. Reactor vessel shall be designed for easy periodic testing or inspections required by in-service inspection plan which is necessary for evaluating the structural integrity of important parts.

Shield Plug Design

a. Shield plug shall be designed to protect operating personnel from radia-tion during nonnal maintenance and fuel handling,

b. Cover gas leakage shall be severely limited to prevent the leakage of radioactive materials, to maintain cover gas pressure during nonnal oper-ation, and to prevent impurities entrance into coolant.

c. Measures shall be taken to prevent sodium leakage through the gaps between shield plug and reactor vessel or equipment plugs on shield plug caused by pressure buildup in the reactor vessel due to the hypothetical core dis-ruptive accident.

d. Proper measures shall be taken for preventirg the % 6d plug and equip-l ment on it from ejecting like missiles because of pressure buildup in the reactor vessel during a hypothetical core-disruptive accident.

Guard Vessel Design C

a. Guard vessel shall be of simple structure, for example, fewer nozzles and l of symmetrical configuration, and shall be designed of independent struc-l ture to prevent the direct external loads from other components.

b. Guard vessel shall contain and hold the leaked sodium safely under any l circumstances.

55

c. Guard vessel shall be designed with-space for installing leak detectors capable of detecting sodium leakage from reactor vessel or primary piping.

5

d. Space between reactor vessel and guard vessel and height of guard vessels shall be detennined by considering the sodium level in the reactor vessel required for the decay heat removal after the primary pipe failure acci-dent.

e. Gaps between components and their guard vessels shall be large enough size

.to satisfy the in-service inspection requirement.

Main Cooling Systems Device

a. Main coolant piping shall be of single wall.

b. Suitable design must be provided not to exceed the fuel failure limits.

For example, the reverse flow resistance of the inlet aozzles and the flow resistance between the reactor and the guard vessels should be enhanced as much as possible.

c. The design of the primary and secondary loops shall provide the sufficient capability of decay heat removal both by natural circulation and by the inertia of pumps.

d. The primary loops shall be designed to ensure,- in the event of a small

, pipe failure, a positive pressure at normal operation to prevent entrance of small gas bubbles into the coolant systems.

e. The main coolant system shall be designed to maintain its integrity against thermal shocks and cyclings of the frequency and amplitude an-ticipated during the plant life,

f. To prevent the sodium level in the reactor vessel from falling below the emergency level in the event of the primary loop piping failure, all the primary loop piping is contained within the guard vessel or is elevated to a horizontal level above the top of the guard vessels.

g. Check valves shall be installed in the primary loops and shall be reliable and maintainable,

h. Supply of the cover gas shall be terminated if the main primary piping fails so as to minimize the core flow decrease. Proper measures must be taken, however, not to make the pressure decrease excessive. v 1.- Sodium purity shall be controlled to minimize the effects of sodium impurities on the materials and the occurrence of local blockages in the Core.

Emergency Core Cooling System Design

a. The emergency core cooling system shall be installed to maintain a reactor flow in the event of a component failure and the breach of the coolant boundary.

56

b. The emergency core cooling system shall be designed to provide the reactor flow for ensuring the core integrity both by forced circulation and by natural convection.

c. The emergency core cooling system shall be designed to perfom its safety function even if the following conditions are assumed: (1) a single fail-ure of any active conponent after a short time, and (2) a single failure of any active or passive component a long time after accident.

Protection Systems and Engineered Safety Features Design Protection systems and engineered safety features must be designed to satisfy the following requirements:

a. Fail-safe design.

b. Foolproof design.

c. Design as passive as possible.

d. Redundant and diverse design.

e. Design which allows maintenance and inspection during reactor operation.

f. Seismic design of Class As or A.

g. . Designs independent of one another; for example, the failure of one sys-tem will not cause damage to another.

Containment Design

a. The containment shall be of a double-containment structure consisting of primary and secondary containments.

b. The leakage rate from the containment system including access openings, penetrations, etc. shall be. designed not to exceed the design value with a sufficient margin. Under the hypothetica? accidents, the containment sys-tem shall not fail because of missiles of equipment and it shall contain the released fission products or plutonium. The containment system shall withstand the pressure and temperature of the maximum postulated sodium leakage, and it shall be designed to minimize the radiation dose to the p public within the limit in the " guide for investigation of reactor site l condition."

c. The reactor building and containment shall be designed to withstand with a 9 sufficient margin natural disasters such as earthquakes, tornadoes, floods, tsunamis (tidal waves), and wind.

I

d. The oxygen content in nitrogen atmosphere within the primary equipment cells and the access cover pit shall be controlled at a low level so as to diminish the possibility of sodiun fire.

57

1

e. A floor area that might be immersed in leaked sodium shall be partitioned so as to limit the size of a sodium pool fire.

f. Within the containment, use of water shall be prohibited and 'the use of

-lubrication oils of carbon-hydride and of freon shall be minimized.

Tuel-Handling Systems Design

a. Fuel storage facility for fresh and irradiated fuel elements shall be de-signed geometrically against criticality under normal fuel handling.

b. Cladding temperature of irradiated fuel-(including elements removed) shall )

be designed not to exceed the allowable maximum temperature at normal operation.

c. An appropriate cleanup system and shielding shall be provided to protect the operating personnel from radioactivity.

d. Every component of the fuel handling system shall be designed to protect fuel elements against mechanical failure under normal fuel handling.

Seismic Design Basis For the purpose of seismic design, all buildings, structures, pipings, and components and their appurtenances are separated into the following four seis-mic classes according to the importance of their functions in reactor safety:

Class As: Especially important installations for reactor safety, such as reactor containment and the reactor-shutdown devices.

Class A: Installations necessary to protect the public from radia-tion hazards in the event of nuclear incidents and whose <

functional failure would lead to an occurrence of nuclear ac-cident.

Class B: Installations related to highly radioactive materials except those in the Classes As and A. ,

Class C: Installations not included in the Classes As, A, and B.

The design principles are:

I (a) All installations in the Classes As and A must maintain their functions, even if adjacent systems in the lower classes fail. ,

(b) Components and pipings in the Classes As and A, as a rule, must be supported by buildings and structures of Class A or B. In case of )

supporting components and pipings of Class A by buildings and struc-tures of Class B, these supporters must be examined dynamically as  !

Class A.

i 58

(c) Important high tamperature-pipings must be designed in the rigid re-gion without excessive restraint of thermal defonnation and to avoid the resonance vibration. Moreover,.a supporting system with proper supporting arrangement must be selected to protect against the exter-nal deformation force by their supporting mechanisms or supporting structures.

.(d) The station power system, measurement and control systems, and their-supporting mechanisms must be designed in the rigid region in accor-dance with the analytical method of each class in the event of de-sign basis earthquake.

3.4.2 Design Basis Accidents The design' basis accidents considered in MONJU are divided in two parts: ab-normal transients and accidents. The abnormal transients are events in which external . disturbances ~ exceeding normal operation of the plant are expected .to occur because of simple mechanical failure, erroneous actuation, or orarator errors as well as those events which are unexpected but which nevertheless may still occur. The accidants are abnormal events whose consequences may exceed those studied under abnormal transients,.and though they have only a slight possibility of occurrence yet they must be considered in the safety analysis.

These two' categories of events together appear to comprise DBA events. . While most of the' abnormal transients considered in MONJU may be given the 'antici-pated' . grade in our terminology, some of these events could be under the

'unlikely' grade. 'Similarly, the accident events may be analogous to the

'unlikely' and ' extremely unlikely' events.

.The acceptance criteria for the abnormal transients may be summarized as the following: the core must be maintained in a state in which reversion to usual

. operation of the plant is possible without any reduction in plant life. The standards for judging this are as follows:

(i) The temperature at the center of the cladding tube must be below 830 C (1526 F) so that the fuel cladding tube does not burst as the result of internal pressure of plenum gas.

(ii)

The core sodium temperature must be below 920 C (1668 F) to ensure that the coolant does not boil.

l (iii) The fuel temperature must be below its melting point to ensure that p the . fuel cladding tube does not burst due to fuel melting.

(iv) The temperature of the reactor coolant boundaries'must not exceed F either 600 C (1112 F) or 1.4 times the maximum temperature used'(in Y

C) whichever is lower.

The acceptance criteria for accidents may be summarized as the following: the victoity of the site must not be greatly affected by the radiation and the danger of core melting must be prevented. The standards for judging this are as follows:

59

-(i) The core should not suffer major damage and sufficient cooling should be possible.

.(ii) The tenperature of the reactor coolant boundaries must not exceed either 650 C (1202 F) or 1.6 times the maximum temperature used (in -

C) whichever is lower.

(iii) The pressure imposed on the reactor containment boundary should be below the maximum pressure used.

(iv) There should be no risk of extreme radiation exposure to the sur-rounding populace. .

All abnormal transients are grouped as:-

(a) Transients which induce abnomalities in reactivity and power

~

(1) Abnormal withdrawal of control rods from the subcritical state

'(2) Abnormal withdrawal of control rods during power operation (3) Control rod drop .

(b) Transients which induce abnormalities in the primary coolant flow

rate (4) Reduction in the primary coolant flow rate (5) Increase in the primary coolant flow rate (6) Loss of external power (c) Transients which cause abnonnalities in the primary coolant tem-perature

'(7) Reduction in the secondary coolant. flow rate (8) Increase in the secondary coolant flow rate (9) Reduction in feedwater flow rate (10) Increase in the feedwater flow rate q (11) Loss of load (12) Small leak in steam generator -

All of these abnonnal conditions are analyzed and the predicted maximum fuel and cladding temperatures are noted in Table X. Some details of.these ana-lytical assumptions are also given in this table. The reactor is assumed to 60 t'

, . - ~w.,..- , , . - . -n,.

- - , . - -_ m _ _ __._ _

Table X. List of abnormal events considered and thelresults of analysis for MONJU plant

.i l Conclusions i

Number Event. Description Analysis Maximum Temperature C Fuel Cladding i 1 Abnonnal withdrawal of control 3d/sec reactivity insertion 460- 245-

rods from subcritical state from subcritical j 2 Abnormal withdrawal of control 3t/sec reactivity insertion- 2480 700'

rods during power operation i 3 Control rod drop Max. negative reactivity .in- 2575 700 sertion to avoid scram, auto-S matic controller on 4 Reduction in primary. coolant One primary pump tripped, pony 2375 710 flow rate motor operation of this pump l forbidden J

! 5 Increase in primary coolant All pumps operate at their. 2550 675-flow rate- upper speed limit i 6 Loss of external power Loss of power in two power 2375 720 lines (primary and secondary punps tripped simultaneously) i i

i

Table X. List of abnormal events. considered and the results of analysis for MONJU plant (Cont.)

Conclusions .

Number Event Description Analysis Maximum Temperature C Fuel Cladding 7 Reduction in secondary coolant . One secondary pump is tripped 2375 680 flow rate 8 Increase in secondary coolant All secondary pumps operate at 2525 6881 ficw rate their upper speed limit 9 Reduction in feedwater flow Two main feedwater pumps are 2375 -680 R3 rate tripped simultaneously 10 Increase in feedwater flow Feedwater adjustments of three + 2525 .685 rate loops are opened simultane-ously 11 Loss of load Complete loss of load, main 2375 -680 feedwater pump tripped 12 Small leak in steam generator Range of water leakage from 2375 0.00 to 0.1 gal /sec

-__<-_____r_. . . .

i be' operating at its rated power of 714 MWt. The reactor trip signal is issued when the process quantity monitored by the Plant Protection System exceeds the set level.

The MONJU plant is also analyzed .for a range of " accident" conditions. These are grouped as follows:

(a)- Accidents resulting in reactivity (1) Rapid withdrawal of control rod at the maximum permissible rate (2) Fuel slumping accident (3) Bubble passage through the core

'(b) Accidents resulting in reduction in cooling capability (4) Coolant channel blockage (5) Primary pump seizure (6) Secondary pump seizure (7) Main feedwater pump seizure (8) Primary coolant leakage (9) Secondary coolant leakage (10) Main steam pipe rupture (11) Main feedwater pipe rupture (12) Pipe rupture in a steam generator (c) Accidents resulting in discharge of other radioactivity matter (13) Primary sodium arxiliary facilities leakage (14) Primary argon gas leakage (15) Fuel replacement handling accident (16) Gaseous waste treatment system rupture accident.

7 These accidents are analyzed and the predicted responses are noted in Table

! XI. In addition to the above-mentioned abnormal transients and accidents, the MONJU plant also considers two major accidents and a hypothetical accident.

The two major accidents are:

(1) Primary argon gas leakage accident, (2) Primary coolant leakage accident.

63

. . ,aw -y - - - - -

, , , , , - -. - y,

Table XI. List of accident events considered and the results of analysis for MONJU plant Conclusions Number Event Description Analysis Maximum Temperature C Fuel Cladding' 1 Rapid withdrawal of control rod Reactivity. insertion of 7(/sec (corresponds to the (a) at start-up maximum conceivable adjustment 500 260 .

rate of rod drive motor)

(b) at power 2400 700 2 Fuel slumping Max. reactivity fuel assembly 2525 700 slumping (fuel is assumed to reach 100% TD due to slumping)

E 3 Passage of bubble through the 20-liter bubble passage 2400 685-core through the core 4 Coolant channel blockage One subchannel in the fuel 2375 730 assembly is completely blocked instantaneously near the top of the core 5 Primary pump seizure One pump binds instantaneously _

2390 780 6 Secondary pump seizure One pump binds instantaneously 2375 685 7 Main feedwater pump seizure' One feedwater pump binds in- 2375 685 stantaneously

Table XI. List of accident events considered and the results of analysis for MONJU plant (Cont.)

Conclusions Number Event Description Analysis Maximum Temperature C Fuel Cladding ,

l 8 Primary coolant leakage 2cm2 rupture at the inlet 2375 720 l nozzle of the reactor vessel; power is also lost simultane- Na discharge rate of 79 ously kg/sec (normal Na flow rate 4270 kg/sec). Sq- I dium leakage of 250 m3 (63,0 240 mg0 (63,400 gallons) in RV, gal-lons in the primary coolant chamber. The o, maximum containment o'

pressurerjseof 0.008kg/cm (0.11 psi).

9 Secondary Coolant leakage Rupture of the secondary 2375 680 piping between the IHX and the pump - no heat removal from Fire-proof partitions this IHX in each secondary coolant piping as well as fire detection equipment control spread of sodium fire 10 Main steam pipe rupture Rupture of pipe between tur- 2375 680 bine and steam generator 11 Main feedwater pipe rupture Rupture of pipe between the 2375 680 steam generator and the main feedwater

Table XI. List of_ accident events considered and the results of analysis for-MONJU plant (Cont.)-

Conclusions Number Event Description Analysis Maximum Temperature C-Fuel Cladding i

12 Pipe rupture in a steam gen- Instantaneous guillotine rup- The integrity of the erator ture of one tube intermediate loop and the IHX maintained i

13 Primary sodium auxiliary facil- (a) . sodium leakage from dump The amount of sodium ities leakage _ tank combustion is 3.3 tons (b) sodium leakage from over-flow system oi o' (c) sodium leakage from-cold The amount of sodium trap combustion is 1.0 ton 14 Primary argon gas leakage 15 Fuel-replacement-handling acci-dent 16 Gaseous waste treatment system rupture c_ =. s_

The primary argon gas leakage accident considered previously as an " accident"

.results in the release of iodine (1131 equivalent of approximately 1.1 Ci and dilute gases (converted to 0.5-meV gamma -ray))of 42.4x10 C1. The level of releases under ' major. accident' are 2.5 Ci and 7.8x104 C1, respectively.

Similarly, the amount of leakage of. radioactivity considered under ' major

, accident' is considerably larger as compared with the ' accident' classifica-i i

tion. The hypothetical accident envisioned was the primary coolant leakage accident just discussed (major accident) except that even larger amounts of radioactivity releases were used. -

, 3.5 General Comments 1 1. The Design Basis Accidents are a set of credible incidents which :nay occur or are expected to occur in an LMFBR or a group of LMFBRs. All these events must be factored in the plant design. Accordingly,

the entire system need not be designed for hypothetical events such as HCDAs. The Clinch River Breeder Reactor Plant has been thus de-signed by considering all identifiable events as DBAs. Additionally, the CRBR provides structural and themal margins for events beyond the Design Basis Accidents (SMBDB and TMBDM). The accommodation for these beyond DBAs is reviewed by the NRC and its consultants else-

~

where... This delineation between the design basis and beyond design basis events is somewhat harder to make in foreign plants.

l 2. There is considerable interest in following HCDA progression. In fact, most of the readily available literature on the foreign plants tend to be in this area.

3.. In tems of the DBAs and their. accommodation by t'he plant, the Plant

,' Protection System plays a key role both in tems of the functions used and in the set points. For example, in SNR-300 DBA analyses, the first PPS function was always discredited. Even some delays in i

the actuation of the control rods and their insertion time were found to be acceptable.

4. In the case of FFTF, a potential . problem had to do with the freezing of sodiun. As the heat is dissipated directly to air, perhaps such an event plays an important role in the DBA set for FFTF. In .

SNR-300, there is a reactor scram function based on low feedwater temperature. This setting is used primarily to protect the steam l- generator and possibly to prevent sodiun from freezing. The CRBR

PSAR relies on control and surveillance.

l S. The role of delayed neutron detection needs some further consider-

~

ation. Once an acceptance level for the number of failed fuel pins

'is established, it may be helpful to provide a scram signal when DND activity exceeds a set value as opposed to providing just an.alam (as in the case in CRBR). The prime justification for this recommen-dation is to arrest potential assembly-to-assembly failure propaga-tion. This type of event can proceed either by a sudden blockage of an assembly or by loading errors. The fomer was responsible for the partial meltdown of the FERMI reactor. This situation is largely 67

designed-out in more contemporary plants such as FFTF, CRBR, PHENIX, and others. The SNR-300 has scram function based on the DND activ-ity.

6. The SNR-300 plant has protective settings based on the high as well as the low cover gas pressures. The CRBR PSAR has control and sur-veillance functions based on the cover gas pressure.

7. All of the plants studied and discussed here provide for at least two independent and diverse shutdown systems.

8. The shutdown heat removal systems tend to vary somewhat from one plant to another. While the pool systems appear to provide greater flexibility and more time in handling decay heat, the loop systems are also quite sophisticated. The shutdown heat removal systems for CRBR, PHENIX, SNR-300, MONJU, and PFR are summarized in Table XII.

a i

p .. . . , . . . n . -~ . . . . . - - - -

Table I!!. A ccmperf son of shutdown heat removal systems Decay Heat Removal Through Steam Circuits Decay Heat Removal from Primary Sodium System Plant Main Loop Natural Pony Motor-Heat Sink Redundancy Power Supply Redundancy Feedwater Redundancy Location Redundancy Circulation Requirements CR8R Main condenser; pro- 2 FW pumps (electric 2 supplies with pro- Main vessel sodi- 1 system. 2 air , All three (3 Loops) tected air-cooled motors); tected water tanks; um overflow sys- heat enchanger . -? pony motors condensers (x 3); IFWpump(turbo 3 FW pumps tem (DHRS) heat sinks. required to blowoff vents orfven); promote mix.

Natural circulation ing capablifty PHE NIX Main Condenser; air Four independent elec- Three FW pumps Continuous water 2 systems Yes Yes plus (Pool) cooling arrangements trical sources cooling of main flywheels .

for steam generator reactor guard g vessel SUPER PHENIX Main condenser; sec. Continuous water Yes Yes (Pool) ondary sodf um circuit cooling of main air coolers (x 4) reactor guard .

vessel

$1st-300 Main consenser; blow- Specific heat removal 3 FW pumps; 3 emer- Immersion in- 6 systems (3sys- Not (3Loeps) off vents; loop spe- systems have backup gency FW pumps - vessel cooler tems have 1001 used cific water / steam power supplies for all capability (x 3) 3 loops MONJU Main condenser; blow. 2 Turbo FW pumps; 3 FW pumps Dip heat exchaug- 3 systems Yes. but not Yes (3 Loops) off vents 1 electric FW pump ers in primary retted on IHX Main condenser; blow. FW pump diversity 3 FW pumph PFR Dfp heat exchang- 3 Systems each : Yes -Yes (Pool) off vents ers in primary with 2 dip HI each Part system vessel 5 MW in continuous operation

ACKNOWLEDGMENTS This work was done under the auspices of the US Nuclear Regulatory Commission.

The author would like to thank C. Allen for encouragement and R. A. Bari for technical and supervisory support. Informal discussions with G. Kessler (KfK) and H.J. Hubel (Interatom) were also very helpful. Thanks are also expressed to C. Moore and N. Nelson for typing this manuscript under very demanding con-ditions, and to M. Rustad for editorial assistance.

)

)

70 L

REFERENCES

1. J.E. Hanson, " Comparison of Clinch River Breeder Reactor Design Basis Ac-cidents with those for Light Water Reactors and Liquid-Metal Cooled Fast Reactors", Idaho National Engineering Laboratory, EGG-NTAP-6152, January 1983.

2. " Standard Fomat and Content of Safety Analysis Reports for Nuclear Power Plants - LMFBR Edition", issued by US Nuclear Regulatory Consnission, February 1974.

3. " Standard Format and Content of Safety Analysis Reports for (LWR) . Nuclear Power Plants", issued by US Nuclear Regulatory Coninission, October 1972.

4. J.G. Guppy et. al ., " Technical Evaluation of the CRBR Heat Transport Sys-tem Design", Draft Report, Brookhaven National Laboratory, April 1982.

5. L.F. Franzen, "The Nuclear Licensing and Supervisory Procedures for Nu-clear Facilities in the Federal Republic of Gemany", Gesellschaft fur Reaktorsicherheit (GRS) Report, GRS-43, February 1982.

6. M.W. Golay and M. Castillo, " Comparative Analysis of LMFBR Licensing in the United States and Other Countries - Notably France", Charles River Research Report CRR-001, UCRL-15425, September 1981.

7. "Risikoorientierte Analyse zum SNR-300 - Bericht der GRS", Gesellschaft fur Reaktorsicherheit (GRS) mbH, West Gemany, Report No. GRS-A-700 Vol .

I and 2, April 1982.

In addition to the above references, a number of other papers were used to excerpt the infomation on the foreign plants. These publications are grouped by the plant concerned.

SNR-300

1. H.J. Hubel, "The Safety-related C'iteria and Design Features for SNR", in Proc. of the Fast Reactor Safety Meeting, Beverly Hills, California, April 2-4,1974, CONF-740401.

2. F.H. Morgenstern, H. Buchholz, H. Kruger and H. Rohrs, " Diverse Shutdown Systems for the KNK-1, KNK-2 and SNR-300 Reactors" in Proc. of the Fast Reactor Safety Meeting, Beverly Hills, Califo;nia, April 2-4, 1974, CONF-740401.

L

3. D. Smidt, !' Selection of Safety Design Basis of Fast Reactors in the

. Federal Republic of Germany", in Proc. of the Fast Reactor Safety Meet-ing, Beverly Hills, California, April 2-4, 1974, CONF-740401, p. 1635.

4. E. Kugler and S. Wiesner, " Licensing Aspects in the Verification of the SNR-300 Design Concept against Hypothetical Accidents", in Proc. of the International Meeting on Fast Reactor Safety and Related Physics, Chicago, October 5-8,1976, CONF-761001, Vol . I, p.14.

71

5. H. Oeynhausen, F. Morgenstern, U. Scholle, L. Lange, and G. Waldhor, "De-sign Requirements for the SNR-300 Containment System", in Proc. of the enternational Meeting on Fast Reactor Safety and Related Physics, Ehicago,- October 5-8,1976, CONF-761001, Vol . II, p. 452.

-6. F.H. Morgenstern, W. Gyr. D. Stotzel, H. Vossebrecker, "The Decay Heat Removal Plan of the SNR-300 - A Licensed Concept", in Proc. of the Inter-national Meeting on Fast Reactor Safety and Related Physics, Chicago, October 5-8, 1976, CONF-761001, Vol. II, p. 442.

7. K. Traube,"SafetyDesignofSNR-300",inProc.oftheikernational Meeting on Fast Reactor Safety and Related Physics, Chicago, October 5-8, 1976, CONF-761001, Vol . I, p. 84.

8. G. Kessler, " Safety Levels Satisfactory for the Commercialization of the LMFBR", in Proc. of the International Meeting on Fast Reactor Safety Technology, Seattle, Washington, August 19-23, 1979, Vol. V, p. 2672.

9. W. Lindner, K. Mendle, and H. Reimann, " Experiments on the Reventing Sys-tem of the SNR-300 as t.9t of the Containment under Simulated Accident Conditions", in Proc. of the International Meeting on Fast Reactor Safety Technology, Seattle, Washington, August 19-23, 1979, Vol III, P.1211.

10. F.H. Morgenstern, F. Brandl, V. Ertel and A. Schonsiegel, "The Plant Protection System of the SNR-300 - Requirements and Design", in Proc. of the Fast Reactor Safety Technology, Seattle, Washington, August 19-23, 1979, Vol . V, p. 2602.

11. H. Vossebrecker and A. Kellner, " Inherent Safety Characteristics of Loop-type LMFBRs", in Proc. of the International . Meeting on Fast Reactor Safety Technology, Seattle, Washington, August 19-23, 1979 Vol. II, p.

554.

12. V. Ertel and F. Brandl, " Safety Margins in the Protection of the SNR-300 Core", in Proc. of the International Topical Meeting on Liquid Metal Fast Breeder Reactor Safety and Related Design and Operational Aspects, Lyon,.

France, July 19-23, 1982.

13. D. Struwe, P. Royl and R. Frohlich, " Vessel Failure Event Tree Analysis of SNR-300 for a Hypothetical Unprotected Loss-of-Flow Accident", in Proc. of the International Topical Meeting on Liquid Metal Fast Breeder Reactor Safety and Related Design and Operational Aspects, Lyon, France, July 19-23, 1982.

l

14. H. Zeibig, L. Gruter and M. Fortmann, " Safety Concept of SNR-300 and SNR-2 with respect to Sodium Leakages", in Proc. of the International Topical Meeting on Liquid Metal Fast Breeder Reactor Safety and Related Design and Operational Aspects, Lyon, France, July 19-23, 1982.

15. U. Daunert, R. Lamarche, and H.K. Mani, "The German-Belgium-Dutch Fast Breeder Collaboration: Its Aim and Organization", Nucl. Eng. Inter-national, 21_, p. 39, July 1976.

72

16. A. Brandstetter and A.W. Eitz, "The Tripartie Fast Breeder Programme: A utility / Industry View", Nucl . eng. International 2_1_, p. 40, July 1976."

17. J.M. Morelle, K.W. Stohr and J. Vogel, "The Kalkar Station, Design and Safety Aspects", Nucl . Eng. International, _2_1,, p. 43, July 1976.

18. S. Dreyer, "The Heat Transfer System of SNR-300", Nucl. Eng. Internation-al , 21_, p. 49, July 1976.

19. A.H. de Haas van Dorsser, " Main Heat Transfer Components for SNR-300",

Nucl. Eng. International, 21 , p. 51, July 1976.

20. J.P. Van Dievoet, "The Fuel for SNR-300", Nucl. Eng. International, 21, p.54, July 1976.

21. F. Vogt, "The SNR-300 Fuel Handling System", Nucl . Eng. International, 21, p. 56, July 1976.

MONJU

1. K. Terata, T. Saito and Y. Nishikawa, " Selection of Safety Design Bases for MONJU", in Proc. of the Fast Reactor Safety Meeting, Beverly Hills, California, April 2-4, 1974, CONF-740401, p. 51.

2. S. An and Y. Togc, " Key Issues on Safety Design Basis Selection and Safety Assessment", in Proc. of the International Meeting on Fast Reactor Safety and Related Physics, Chicago, October 5-8, 1976, CONF-761001, p.

2.

3. K. Kawashima and Y. Suzuki, " Safety-Related Design of MONJU", in Proc. of the International Meeting on Fast Reactor Safety and Related Physics, Chicago, October 5-8,1976, CONF-761001, p. 98.

PHENIX

1. R. Carle, J. Megy and J.C. Moreau, " Fast Neutron Power Reactor PHENIX",

Nucl. Eng. International, H , 557(1971).

2. M. Labat, " Site Work for the PHENIX Plant", Nucl . Eng. International, H, 564 (1971).

3. J.L. Befre, J.P. Delisle and M.G. Robin, " Circuits and Main Components",

Nucl . Eng. International, H, 567 (1971).

4. E. Benoist and C. Boulinier, " Fuel and Special Handling Facilities for PHENIX", Nucl. Eng. International, M , 571 (1971).

5. M. Chapelot, " Instrumentation, Control and Monitoring Systems", Nucl.

Eng. International, M , 577(1971).

73

6. R. Carle, J. Megy and B. Guillemard, " PHENIX Startup", in Proc. of the Fast Reactor Safety Meeting, Beverly Hills, California, April 2-4, 1974,

• CONF-740401, p.1009.

7. J. Goddet, " Operating Experience with the PHENIX Nuclear Power Station from the Point of View of Safety", in Proc. of the International Meeting on Fast Reactor Safety and Related Physics, Chicago, October 5-8, 1976, CONF-761001, p. 76.

SUPER PHENIX

1. J. Megy, J. Leduc., A. Cht ?, A. Guidicelli, E. Robert, E. Rodet, J.P. Crette, ed C. Malas ' , " SUPER-PHENIX Preliminary Safety Analysis:

General Relateo Criterb and Main Features", in Proc. of the Fast Reactor Safety Meeting, Beverly Hills, California, April 2-4, 1974, CONF-740401,

p. 29.

2. J.F. Petit, " Safety Design Basis for Power LMFBR", in Proc. of the Fast Reactor Safety Meeting, Beverly Hills, California; April 2-4, 1974, CONF-740401, p. 1683.

3. P. Tanguy, J. Petit and F. Justin, " Key Safety Issues for Fast Breeder Re-actors", in Proc. of the International Meeting on Fast Reactor Safety and Related Physics, Chicago, October 5-8,1976, CONF-761001, p. 24.

4. E. Robert, G. Lucenet, A. Chalot and J. Leduc, " Main Safety Features of the SUPER-PHENIX Project", in Proc. of the International Meeting on Fast Reactor Safety and Related Physics, Chicago, October 5-8, 1976, CONF-761001, p. 164.

5. J.C. Lefevre, M. Livolant and G. Lucenet, " Seismic Analysis for the SUPER-PHENIX Reactor", in Proc. of the International Meeting on Fast Re-actor Safety and Related Physics, Chicago, October 5-8, 1976, CONF-761001, p. 180.

6. J.F. Petit, " Summary on Licensing Considerations and Selection of safety Design Basis: Sunenary on Safety-Related Operation / Design Experience Pertaining to Demonstration and Large Fast Breeder Plants", in Proc. of the International Meeting on Fast Reactor Safety and Related Physics, Chicago, October 5-8,1976, CONF-761001, p. 302.

7. M. Banal, " Work Starts on SUPER PHENIX at the Creys-Malville Site", Nucl .

Eng. International, 2_2, 2 41 (1977).

PFR

1. A.G. Frame, W.G. Hutchinson, J.M. Laithwaite and H.F. Parker, " Design of the Prototype Fast Reactor", Proc. London Conf. on Fast Breeder Reactors, May 17-19, 1966, pp. 291-315.

2. R.V. Moore, "The Dounreay Prototype Fast Reactor", Nucl. Eng. Internation-al ,1_6, 629 (1971) .

74

3. J.0. Grieves, "The Place of Fast Reactors in the U.K. Power Programe".

Nucl . Eng. International, 16,630(1971).

4. K.J. Hen , " Technical Description of PFR", Nucl . Eng. International,16, 632(1971

5. J. Hannaford and D.R.H. Fryer, " Safety Issues in Licensing Commercial LMFBR's", in Proc. of the International Meeting on Fast Reactor Safety and Related Physics, Chicago, October 5-8, 1976, CONF-761001, p. 33.

4 75

'f,r mu , 33s - U.S. NUCLEAR REGULATcRY CCMMISSION t, REPORT NUM8ER (Assesne 6y DOCJ BIBLIOGRAPHIC DATA SHEET NUREG/CR-3240

4. TITLE AND SUOTITLE (A dd Volume No.,ilmprmrosari BNLnl0 REG-51663

2. (Leave blank)

COMPARISON OF CRBR DESIGN BASIS EVENTS WITH THOSE'0F FOREIGN 3. RECIPIENT *S ACCESSION NO.

LMFRR PIANTS

7. AUTHORfSt

3. DATE REPORT COMPLETED MpNTH Ashok E Agrawal lYLAs January- -1983 0, PEHFORMING ORGANIZATION NAME AND MAILING ADDRESS (/nclude 2,'p Codel DATE REPORT ISSUEO Department of Nuclear. Energy MONTM lV84e Brookhaven National Laboratory April 1983 Upt:n, New York .11973 ift,,,,,,,,,,

B. (Leowe vaat)

12. SPONSORING ORGANIZATION NAME AND MAILING ADDRESS (lac /ude 2,'a Cadel p ,

Clinch River Breeder _ Reactor Project Office Office,of Nuclear Reactor Regulation si. CONTRACT No.

~U. S. Nuclear Regulatory Commission

. Washington, D. C. 20555 A3364-

13. TYPE OF REPORT PE RIOD COVE RE D (inclusive defesJ Technical

13. SUPPLEMENTARY NOTES

14. (te,,,orane)

16. ABSTRACT (200 words or less)

As a part of the Construction Permit (CP) review of the Clinch River Breeder Reactor Plant (CRBR). the Brookhaven National Laboratory was asked to compare the Design Basis Accidents that are considered in CRBR Preliminary Safety Analysis Report with those of the foreign csntemporary plants (PHENIX, SUPER-PHENIX, SNR-300, PFR, and MONJU). A brief introductory review of any special or unusual characteristics of these plants is given. This is fol-lowed by discussions of the design basis accidents and their acceptance criteria. In spite of some discrepancies due either to semantics or to licensing ~ decisions, there appears to be a considerable degree of unanimity in the selection (definition) of DBAs in all of these pl ants.

Il KCY V/OHOS AND DCCUMCfdT ANALYSl3 17a DCSCluPTORS CRBR LMFBR Design Basis Accident CRBR Safety Analysis "n. icsn ririr ns:crEn r :ot e rEn .w t.

'C AveitasetirY STA E . ta r a se eu,n i , .;: e..;;. , r . .,,  : .,o y e,.,.t s u Ur.1 i:: i ted Unclassified .

o , c , . s .,..,,,,, , ,cg C M y., , y y ,

rovna class wait Z UfetTED STATES C Posuse a ssas rao IGUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20586

.$$*,,*o c $

neun =. in O o

lD ,i OFFICIAL SUSwetSS PENAtiv FOR PRIVATE U5t,4300 el n

8 a

O E:

m 3

8' 2

1 0

m-n 2

co 7

O E

5 Z

W D

E!

m m

<m 120555078877 1 C00793 ,

Z US NRC H ADM DIV OF TIDC "

PCLICY E PUB MGT 9R-PCP NUREG 5 W-501 -4 WASHINGTON DC 20555 Z

-4 Z

O m

O m

m O

x M

O Z

r-E m

W1

D m

f" Z

n m

b r-CD iS

-__