ML20215D961
| ML20215D961 | |
| Person / Time | |
|---|---|
| Issue date: | 11/18/1964 |
| From: | Kouts H Advisory Committee on Reactor Safeguards |
| To: | Seaborg G US ATOMIC ENERGY COMMISSION (AEC) |
| Shared Package | |
| ML20215D926 | List: |
| References | |
| FOIA-86-483 ACRS-GENERAL, NUDOCS 8610140375 | |
| Download: ML20215D961 (15) | |
Text
.
V ADVISORY COMMITTEE ON REACTOR SAFEGUARDS UNITED STATES ATOMIC ENERGY COMMI55loN WASHINGTON D.C. s0845 i
November 18, 19@
Honorable Glenn T. Seaborg Chairman U. S. Atomic Energy Connission i
Washington, D. C.
Subject:
REPORT ON ENGINEERED SAPEGUARDS
Dear Dr. Seaborg:
In response to the request of the Commission, the Advisory Connittee en Reactor Safeguards has reviewed the question of " engineered safe-guards" as they are used now or are currently considered for use in nuclear reactor power plants. This letter sunnarizes the results of the Cennittee's reviews.
S e number of sites economically suitable for the location of large nuclear power reactors is limited. Apart from safety considerations, tne calei requin ments are (a) a sufficient cooling water supply must be available for the turbine condensers and (b) the cost of electrical transmission frcan the reactor plant to the area of use must be kept low. Se first askes it me.cessary to select sites bordering on large rivers, large lakes or the seacoast; while the second askes it desir-cble to locate as close as feasible to civic or industrial centers.
Presently stated site guides do not favor selection of many economic-ally desirable locations, j
Se health and safety of the public are assured if fission products are retained within the reactor or its containment. To accomplish this aim, a strong program stressing nuclear reactor safety has been adopted in the United States. Strenuous effort is made to be sure that accidentavill not occur. This effort starts in the original design groups and is carried along through the construction and oper-tion phases with reviews and approvals required at appropriate inter-vals. It is the intent of this effort to eliminate reactor accidents.
However, since the field of nuclear reactor technology is new and since there may still be some hazards which have been overlooked, dependence must also be placed upon safeguards engineered specifically to limit the consequences in the unlikely event of a major accident, or to pre.
Vent such an accident.
8610140375 860726 FOIA PDR PDR REYTBLA86-403 2117
g,
.. November 18, 1964 Honorable Glenn T. Seaborg i
In each case, the engineered safeguard must be considered with respect It 10 equally to the specific nuclear plant for which it is intended.
important to assess the degree of confidence that the safeguard vil function properly in an emergency.
remain operable for the life of the plant but cannot be tested without ruinous effects would not usually be accorded the same izqportance as r
one that can be tested periodically.
It is important to recognize that engineered safeguards are designed s
to allow the siting of reactors at locations where, without such safe-The advantages guards, protection of the public vould not be adequate.
of a remote site cannot be exactly balanced by engineered safeguanis.
On the other hand, the advantages of a remote site may be temporary, if appreciable increases in population density occur near the reactor.
Few sites presently in use are such that some engineered safeguards I
Thus, the protection of the public ultimately de-i are not desirable.
pends on a combination of engineered safeguards and adequate distances.,
Engineered safeguards whichcanjustify decrease of the distances must be extraordinarily reliable cad consistent with the best engineering practices as used for applications where failures canI designed, constructed and installed, equipped with adequate auxiliary power, and continuously maintained. engineering principles sup In any case, provisions for require developmental and proof testing. regular and careful te The acceptance of engineered safeguards to mitigate unfavor-able aspects of reactor sites should continue to be based on positive pected.
In addition, evidence that these design objectives can be attained.
there vill probably be a continuing need to develop new devices and design concepts as reactors are proposed for less and less remote sites.
(1) containment ani con-The principal engineered safeguards include:
firement, (2) containment pressure and temperature reducing) systems, (3) air cleaning systems to remove fission products, and (4 Discu core spray and safety injection systems.
these is appended hereto, as are conclusions regardira their value.
An extract of the conclusions is as follour,:
When competently designed, constructed, maintained, ani test-ed, containment and certain confinement systems are considered to be 1.
effective safeguards.
00009
g,,
Honorable Glenn T. Seaborg November 18, 1964 With careful attention to the containment vessel ani to the 2.
external connections, such as the use of reliably actuated valves in series in primary system lines and a means of preventing pressure buildup from afterheat, a pressure suppression method is an acceptable engineered safeguard against primary coolant line rupture.
A building spray system can be a valuable adjunct to con-3 tainment, if it is carefully designed and maintained, if it has ade-g -
quate water supply and backup emergency power, and if it is periodic.
Conservative ally tested for proper functioning of its components.
estimates of the ability to reduce containment pressure are then con-sidered acceptable.
e 4.
With the same reservations as are applied to building spray systems, beat exchange methods of limiting cont *4 = nt pressure build-up are considered to be acceptable. engineered safeguards.
Because it has not been shown that all accidents which could 5
occur in a reactor are of a sequential nature involving first, a re-lease of stored energy, and later of fission fragments, ani because the enstineering design of pressure control syste=s is in the process of development, a confinement system based on sequential release is not generally considered to be of sufficient reliability for use as an engineered safeguard in populated areas.
6.
The nature of fission product releases to be expected in the unlikely event of a major accident is not yet well enough known to per-mit more than conservative lover bounis on the efficiency to be deter-Reliable lower limits may, however, be mined for air cleaning systems.
assumed when individual cases are reviewed.'
Core spray and safety injection systems cannot be relied upon 7
Neverthe-as the sole engineered safeguards in a nuclear power plant.
less, prevention of core melting after an unlikely loss of primary cool-ant would greatly reduce the exposure of the public.
Thus, the inclu-core fission product heat reroval system as an en-sion of a reactor gineered safeguard is usually essential.
It is the opinion of the Advisory Cer:cittee on Reactor Safeguards that the including of properly engineered safeguards in reactor plants can 2119
8 Ho=ornbic Clenn T. Seaborg 4-Ecyc=her 18, 1964 permit the reduction of distances required for protection of the pub-lie, and that engineered safeguards of selected type should make fea-sible the siting of power reactors at many locations not otherwise considered as suitable.
Sincerely yours,
/s/BerbertKouts Herbert Kouts Chairman s
0
~
2120
--w-
---w-
Report on Engineend Safeguards Addandum #1 CONTAINM!mT AND CONFIPDENT l
Containment is designed to prevent the escape of injurious amounts of fission products resulting from any failure in a nuclear system.
In the usual plant, fission products are held within sequential barriers:
first, in the fuel; second, inside the fuel cleMing; third, within the primary cooling system; and fourth, in the plant containmant or g
confinement system. This discussion is directed primarily to the last, implying that failure of the first thne to hold fission products must usually be considered credible.
The term containment or confinement as used here vill mean the contain-ment shell or structure, and its accessories as described later.
Con-
+minments are intended to hold the fission products and primary cool-ant which may be released, except for inherent leskage, Confinements usually allow the materials discharged by the accident including noble ll gases to be released in a directed manner during which time most of the radioactive halogens and particulates may be trapped and retained.
- i Various versions of these systems are given below, with the expected perfomance in retaining fission products in the unlikely event of a
~*
major accident:
1.
Double containment, i.e., two envelopes, in which leskage throuEh the inner may be (a) pumped back to the contained space, or (b) directed to a stack
..I i
'i with or without air cleaning. Fission products
'i released may be held below a very small fraction per day of the content of the containment gas.
i l
2.
Single containment of the nuclear system includ-ing the entire primary coolant system. Fission products released might vary from a fraction of a percent to several percent per day cf the con-tainment contents.
I 3
single containment of the nuclear system except that, as in some boiling water reactors, the pri-mary coolant may pass outside the containment to a turbine and condenser and be returned. In these partial containnents, the isolation valves in the 2121
/ w
m-1
. Addendum #1 (Cont'd) coolant lines are essential parts of the contain-Expected fission product release may be ment.
about as in (2) above.
Confinement consists of a structure from which gases and vapors may be drawn by a blower through 4.
Since air clean-air cleaning systems.and vented.
ing systems ordinarily do not remove noble gases, i
as much as half of the radioactive content of the Con-gases in the confinement might be released.
finement systems may include designs for release of the large amount of energy in non-radioactive vapors and gases, such as pressurized water, be-fore release of fission products from fuel cladding, e.g., in case of failure of a pipe in the primary cooling system.
Design maximum pressure in the containment may vary from inche The containment or confinerr.ent structure may vary frcm an industrial-type by W ha which is no=inally gas tight, to to several atmospheres.
Concrete without a steel or reinforced concrete pressure container. lining is tainer.
There are various codes applicable to the design, construction and h
of containment structures such as the Uniform Building Code, and t os Con-of the American Society of Mechanical Engineers and the crete Institute.
Mere compliance with appropriate codes may be in-cation and testing.
Competent designers vill be aware adequate for this nuclear service.
of such additional needs.
There are many accessories and auxiliaries that if incorporated mu A re-be considered as integral parts of the containme f
some of their i=portant features:
access openings and closures including air (a) locks, (seals; airlock door interlocks; certainty)of door closure during reactor operation,
vacuum relief valves or syste=s (assurance (b) of closure.then needed; safe disposal ofeffluent
A-
~.
Addendun $1 (Cont'd) (c) ventilating air inlet ani outlet isolation valves (double valving and last-ditch manual control),
(d) penetration seals for pipes and electric and control leads (age deterioration of sealing 1
compounds),
(e) valves for closing pipes penetrating the con-mechanical failure at the penetration) prevent tainment (double valving; supports to (f) thermal insulation to enable keeping the tem-perature of steel contaiwnt vessels within the ductile range, (g) protection against missiles,,
(b) special protection against earthquakes, tsuna=is, hi6h winds, etc.,
(i) essential electric pcver, water and compressed air supplies and emergency back-up for them (alternateautomaticoperatingpowersources; controls for valving and am414 eies with last-ditch manual control; suitable operating con-trols for auxiliaries in emergencies), and (j) chutes or canal gates for fuel handling.
Testing of the containment and of its accessories and auxiliaries is Initial tests the only assurance of their capability and reliability.
for mechanical strength after construction are routine.
Icak testing involves detection of the leaks and the determination of total leak-Since many leaks, such as those through access seals and age rate.
seals around electrical leads, may increase as the sealant ages, peri-odic testing is necessary. Isaks through metal cracks or fissures do not generally show increased flow with pressure other than that ex-pected from hydro-dynamics. Sealed joints, however, may be tight at low pressure and leak at higher pressure. Testing these below service or design pressure is not always definitive. In many cases, double seals at penetrations enable testing of these seals without pressuriz-l l
ing the entire containment. This is a desirable and effective test of l
such seals, but it tells nothing about the rest of the containment.
2123.
m i
l Addendum #1 (Cont'd) Increased leakage rate of the composite containment during service is an indication of deterioration. Continuous monitoring of leak-age where possible is desirable as a check against misoperation.
Careful design and testing of gas handling equipment is required.
i Containment effectiveness is greatly dependent on administrative control. This includes assurance that operationssuch as the clos-ing of openings and valves and the maintenance of seals, valves, closure operating mechanisms, controls and auxiliary services are Perfectly carried out. Follow-up checks of critical operations and independent re-checks after all maintenance is necessary and should be made a matter of written record. Periodic inspection of oper-ability of apparatus and control and sensing mechanisms should be made and recorded.
The type and design of each containment must be dependent on the needs of the nuclear plant of which it is a part. The amount of leakage permissible depends on the type, power, design and opera-tion of the plant, as well as the nature of the site. The con-
+=4=nt is a machine and must be designed, constructed, operated, checked, serviced, repaired and maintained as one. Since safety of many people may depend on its performing as intended in an emer-gency, each of these operations should be better done than compar-able non-nuclear operations.
When competently designed, constructed, maintained, and tested, con-tainment and certain confin ~ nt systems are considered to be effec-tive safeguards.
l I
I 2124
~
Report on Engir.eered Safeguards Addendum #2 PESSUE_RgECTION.SYSJTm Containment systems for water reactors (boiling and pressurized) are required to maintain their integrity upon release of the energy evolved j
in the unlikely event of nuclear excursions, metal-water reactions, and complete primary system depressurization as might occur following a major rupture. The principal contribution of energy, and hence contain-i j.
ment system pressures, would result from the flashing of primary system
)
vater. Several methods may be employed to remove heat ani thus to re-g\\.
j duce containment design size and pressure.
i 8
One means of pressure reduction, known as the pressure suppression sys-
- l tem, involves use of a large reservoir of water through which all con-tained vapors must pass via multiple submerged vents.' Steam, the prin-cipal contributor to containment pressure, is condensed in passage through the water, and non-condensible gases are cooled. This method has been specifically adapted to the direct cycle boiling water reactor t
in which only the reactor vessel and a few auxiliaries and connecting piping are contained. The method is dependent on maintenance of water level in the suppression pool, and on reliability of valving in steam, feed water and other piping penetrating the containment. The entire method has not been tested under accident conditions, but elements have been satisfactorily tested under simulated accident conditions. Since reliability of the method does not depend on action of personnel or mechanical ccurponents, pressure suppression performance tests do not appear racessary. With careful attention to the containment vessel and its external connections, such as the use of reliably actuated valves in series in primary system lines and a means of preventing pressure buildup from afterheat, the pressure suppression method pro-vides an adequate engineered safeguard against primary coolant line rupture.
A second method of pressure reduction involves the use of a spray sys-tem within a containment structure.. This system is effective in con-densing water vapor and removing sensible heat from contained gases.
It may be actuated either automatically or===11y.
The effective-ness of a spray system must be carefully evaluated for each application, using a conservatively calculated sequence of events. Testing under accident conditions is usually not practical due to potential da n ge to electrical and control eqdpment. A building spray system can be a valuable adjunct to containment, if it is carefully designed ani i
i 2125
~
m.
..o-
.. m o., o cye-% _ _m n
g e
a Addendum #2(Cont'd),
maintained, if it has adequate water supply and backup emergency power, and if it is periodically tested for proper functioning of its can;ponents.
Conservative estinates of the ability to reduce containment pressure are then considered acceptable.
A third method of pressure reduction involves the removal of vapor space beat by beat exchangers (see discussion under Air Cleaning Systems).
Beat generated within the contaiment during normal operation as well as heat pAoduced following an accident may be controlled or removed by air g
recirculation. Such systems usually consist of multiple fans and heat exchangers.- Beat accumulated in the heat exchangers may be transferred to the normal coolant systems, or to a separate or alternate supply of coolant water. The use.of such systems during normal operating times gives a higher assurance of availability under accident conditions. Back-up coolant supplies and alternate or parallel power supply are essential to make certain such units will function adequately and for the necessary time after an accident. The system is of greatest value in main +*4ning reasonable pressures and temperatures in contaiment structures for long periodsfollowing accidental releases. With the same reservations as are applied to building spray systems, heat exchange methods of limiting con-tainment pressure buildup are considered to be acceptable engineered safeguards.
A fourth method of pressure control involves release of water vapor to the environment following a systenrupture, and then establishing con-tainment prior to core melting and fission product release. Tts acci-dent for which this system is designed consists of a loss of coolant in which the steam release precedes the fuel relting by a predictable period. This system requires the use of very large dampers which must close tight, necessary reliable administrative control, and a proper understanding of the accident conditions. Such a system, at the present time, is not considered of sufficient reliability as an engineered safe-guard for use in populated areas.
4 8
2126
O-Report on Engineered Safeguards Addendum #3 AIR CLEANING SYSTE!3 2e function of an air cleaning system as an engineered safeguard is to remove and to retain fission products from an unlikely partial or total fuel melt-down. Fission products that are thus zetained should be fixed in a form that prevents redispersion.
Components of the air cleaning system should be so located that decontamination and essential I
handling can be. accomplished readily and without hazard to the health and safety of-the public.
For cleaning or decontamination purposes, the released fission products from a reactor fuel melt-down may be divided into four groups. These are: the noble gases (krypton and xenon); the halogens (bromine and iodine); volatile solids (such as tellurium, selenium, cesium and authenium); and other solids (pr4-11y stront'ium, yttrium and barium).
Because of their chemical nature and short half-life, radioactive noble gases can usually be treated only by containment or controlled release from elevated locations such as tall stacks. Berefore, with noble gases consideration must be given to meteorological dispersion and dilu-i I
tion as influenced by characteristics of the surrounding environment.
It is convenient to divide the remaining fission products into two phy-sical groups -- gases and particulates. Gases (essentially iodine and bromine in elemental fom) are removed by adsorbents such as activated charcoal, by chemi-sorption on silver, or by absorption in a reactant solution. Particulates which range in size from several microns down to less than 0.1 micron can be removed by impingement scrubbers, elec-trostatic precipators, or filters. Se final device in a particulate cleaning train is usually one based on me4nical filtration princi-P es. Containment spray or " dousing" systems for condensing steam may l
l also serve as decontamination systems because of the gas contacting and impingement action of the spray droplets. The multiple contacting i
which is possible within a contained gas volume makes a containment vessel with sprays equivalent to a scrubbing chcaber.
Balogen gases may be adsorted upon the surfaces of released particulates and may react with them. Bence, it is necessary to use a combination of adsorption, absorption, and filtration devices to remove halogens.
Because iodine may occur in both inorganic and organic states, the gas cleaning system must be capable of removing both. Since the halogens 2127
. ~.
Moendum (3 adsorbed on particulates are not irreversibly bound, it is necessary i
to follow the filter with an adsorber. A liquid scrubber should be followed by both when maximum decontamination is necessary.
The air cleaning components of a reactor safety system include:
a ventilation system, a heat removal device, air cleaners, and an air mover with motor. he system must be capable of working continuously in hot, saturated steam environments for a period of time long enough to remove the required portion of the released fission products from the containment or confinement system. To handle the anticipated release, the air cleaning system must have sufficient capacity in flow, in adsorbent and chemically reactive materials, and in filtration surface.- Msorption and filtration systems must be designed and in-staned so that the decay heat of conected fission products vill not
- cause combustion or destruction of their media or overheating to the point where conected fission products will be redispersed. Se media must also be protected against shock waves, missiles, moisture entrain-ment, liquid slugging, and radiation damage, as well as corrosion ami chemical attack. The duct work and filter housing should be' protected against mechanical injury or n.issile damage to avoid bypassing or leakage of untreated air. The system should be leak tested at the same pressure differential as it would have to endure under accident condi-tions.
Because electrical power is necessary for circulating and recirculating both air and water, it is essential that backup power be available for maint24 nina min 4=1 flow rates.
The decontamination efficiency required of an air cleaning system vill depend on whether the system is once-through or recirculating. The decontamination factors needed will be based on the dose to the environ-ment and the dilution to be assumed for stack dispersion.
In recirculat-ing systems, the decontamination factor is related to the number of con-tainment volumes passed through the cleanup system. Decontamination factors of 10 to 1000 or more may be required in most applications.
Gas leaks which bypass filters or adsorbers in effect decrease air cleaning efficiency. When an iodine removal efficiency of 9J) is pro-jected, a bypass or leak around the beds of 1% leads to double the iodine release. Appropriate design and testing of associated gas handling equipment is required.
he reliable perfomance of an air cleaning system must be assured by frequent "in-place" testing which includes monitoring with gases and 2128
Addend = #3 (cont'd) '
particulates that simulate the expected fission products. Esse of test-ing for leaks, and access for inspection of seals, gaskets and else s are necessary. A continuous monitor of resistance or pressure drop through the cleaning system is desirable where the~ decontamination unit is always in use. In the case of emergency or standby cleaning systems, at least quarterly operation and checking of both air mover and cleaner is desirable.
The nature of fission product releases to be expected in the unlikely event of a major accident is not yet well enough known to permit more than conservative lower bounds on the efficiency to be detemined for air cleaning. Reliable lower bounds may, however, be assumed when individual cases are reviewed.
l l
i l
2129 W..
w,,
am Report on Engineered Safeguards Addendum @
CORE-SPRAY AND SAITI'Y-INJECTION SYSTE2S The tems core-spray and safety-injection are used to designate systems designed to supply coolant to the core of a water reactor to prevent meltdown in the event of an un1 hely loss of coolant accident or a major coolant leak.. These syste=s are intended to remove the fission-product heat produced in the core after the reactor has been shut down. How-ever, they might not function for several reasons in the event of an accident, such as, severed lines to the reactor vessel ani low water supplies. Therefore, reliance cannot be placed on systems such as these as the sole engineered safeguards in the plant. Nevertheless, preven-tion of core melting after an unlikely loss of primary coolant vould greatly reduce the exposure of the public. 'Jhus, the inclusion of a reactor core fission product heat removal system as an engineered safe-guard is usually essential.
The core-spray and safety-injection systems consist of the piping, which connects the reactor-plant water storage facilities to the reactor cool-nnt system, and also any necessary pumps, valves, auxiliary piping, spray nozzles or rings in the vessel, and instrumentation. The design details vill vary from one nuclear plant to another. In the unlikely event of a major loss-of-coolant accident, these systems are designed to introduce large volumes of water into the reactor coolant system to replace water passing out of the rupture into the containment vessel. When this is done through separate' spray rings located in the reactor vessel that distribute water over the core, the system is called a spray system; in other foms it is called a safety-injection system. A second funttion may be to circulate and cool, through heat exchanGers, the water that has accumulated in the containment vessel. If the reactor requires a soluble neutron poison for cold shutdown, the system should drav vater from a storage tank maintained with the necessary concentration of poison and heated if necessary.
Chief smong the factors that must be considered in the design of a core-spray or safety-injection system are:
1.
. Assurance that the system vill start when needed and vill deliver the required a=ount of water.
Adequate e=crgency power sources must be assured.
2.
Provisions to prevent damage to supply lines during normal operation and any accident 2130
Addendum $4 (Cont'd) conditions that might involve motion of the reacter vessel.
3 Slow distribution over the core. Many reac-tor designs involve components in the struc-tulewhich could interfere with the injection of emergency coolant. It is often difficult to establish the circumstances under which adequate distribution can be achieved. Care-ful analyses and tests are required to deter-mine whether the safety injection system as
-designed can prevent core meltdown and even metal-waterreactions(incertaincores)in the unlikely event of a loss-of-coolant accident.
l 4.
Provision for missile protection and accidental i
injury to important components of the systems.
5 Avoidance of th m::n1 shock problems. Failure due to thermal shock could impair the opera-bility of the system.
6.
Protection of external parts of the safety injection system against freezing.
7 Provision for periodic check on operability of components.
2131
%