ML20235M946
| ML20235M946 | |
| Person / Time | |
|---|---|
| Issue date: | 04/18/1969 |
| From: | Okrent D Advisory Committee on Reactor Safeguards |
| To: | Fraley R Advisory Committee on Reactor Safeguards |
| Shared Package | |
| ML20235M427 | List: |
| References | |
| FOIA-87-40 ACRS-GENERAL, NUDOCS 8707170383 | |
| Download: ML20235M946 (12) | |
Text
. _ _ - .. . -_ _ - . -_ _ _ _
e?
[, &
u aces M+ c
.I 'F~e. i p - M a L w VK n:w:t 1G m
'gg April 18, 1969 55 /T 21 /W 10 3 9 [ l
+ - -. . ,:
($ -. (CH;t 4 ;IE 01 To: R. F. Fralc # (for distribution to ACRS members) . Ee3 ' , it
/
Prom: D. Okrent
Subject:
REPORT ON TRIP TO ENGIAND AND GERMANY, March,1969.
I am assuming that Dr. S. Hanauer is providing a fairly detailed report on this trip; therefore, I shall only give a few highlights of the group meetings and of the discussions I held separately at Karlsruhe on March 26 and in Iondon on March 27.
- 1. Discussions at Rislev on Fast Reactor Safety, March 21, p. m.
l A. The presentation on the recuired reliability for shutdown cooling
! and the possible means of getting it was quite interesting. Since a loss of offsite power bnd reactor shutdown)is a highly probable event, a very high probability of successful function is asked of the shutdown cooling system over extended periods of time. The UK speaker did.not believe such reliability could be accomplished from a system which relied on the steam '
. generators for ultimate dissipation of heat (note that the current Atomics International design employs just such an approach). His preferred shutdown ;
heat removal system employed separate, specially provided heat exchange j units from the primary system coolant to the atmosphere (as have been provided at EBR-II). For large reactors such systems may require active .
components, and as such, require careful design and review in order to achieve high reliability (according to the UK speaker).
I personally found the relative reliability approach taken by the UK l
speaker to be of considerable value and think that it would be well to find some means of more frequently implementing such methods in the US.
B. The discussions of possible sodium fires was interesting in that ,
it brought to mind the possibility that fires arising from secondary system 'l sodium may threaten primary system integrity if this feature is not watched in design. Also, the reliability of cranes and other heavy handling equipment .
as a possible safety issue was introduced (both for fast reactors and other designs) where facility design is such that crane failure may cause an accident. The British found that unless special attention was given, cranes !
are likely to be quite subject to failure.
l l
l 8707170303 870713 ;
THOMAS 87-40 l
r
-l II. Discussions at Bonn on Water Reactor Safety, March 24 and 25 A. Urban Sitina Groos stated that the German Government plans to spend money studying the possibility of building reactors underground in connection with urban siting. He would prefer a more passive containment, especially for the BWR's. He is especially concerned about the possibility of a simultaneous occurrence of small accidents and a minor failure in containment. (In general, the Germans appear not to attribute a very great reliability to containments of current design; a reliability like 99/100 has been mentioned. )
Kellermann thought that building reactors underground would provide protection against effects of conventional weapons in war time.
The Germans generally seem to feel that they would like to have more time available for evacuation of the public in connection with an accident which-gets out of hand at urban sites. Their experience with emergency plans convinces them that current measures are ineffective, that considerable time is needed. If undergraur.d siting provided such time, rather than perfect safety .it would appear to be an important step, from their point of view.
While.Kellermann, the Director of the TUV Institute, seems to think that reactors of current design, if designed, built, and inspected very care--
fully (including in-service) could be built in urban sites, it appears that -
the representatives of the German Ministry and the German ACRS do not agree and feel that changes in design to provide greater safety are required.
At Karlsruhe on March 26, Dr. D. Smidt, a member of the German ACRS who was unable to attend the Bonn meeting, confirmed that the German ACRS did not support Kellermann's view. Smidt indicated, among other l things, that some protection against a loss in pressure vessel integrity should be provided.
B. Emercencv Plans Ritter mentioned an interest in a better means for detection and monitoring the course of a bad accident. He believes that it should be the duty of the operating staff to make the first measurements for radioactivity l cutside the containment. Groos believes that detailed emergency plans must l really be drawn up. He said that they found that the local authorities are ineffective; hence, the reactor operator must give attention to the region outside the reactor. Zuehlke suggested that authorities could be alerted by a computer in the event of an accident.
C. Water Reactor Safety Problems _
l Birkhofer believes that blowdown forces and core heatup require further research. In particular, he emphasized the need to mock up actual l
I
. t l 1
i flow resistance, for example as it relates to (1) parallel flow in PWR's; (2) flow redistribution and steam blanketing; (3) different resistances for 1 hot and for cold leg breaks. I He indicated that they plan to use acoustic methods for looking ;
for vibrations on-line. Birkhofer also wonders whether enough is known i about the pressure suppression system for large BWR's (1000 MWe).
D. In strumentation Merz mentioned that 24 relays failed at the same time, allowing a reactor to run for two weeks without a protective system. Replacement relays had been manufactured with a defect. Rules no longer permit replacement of a component all at once. (Have we paid adequate attention l to maintenance procedures and training, or to other aspects of facility I hou sekeeping ?) Merz feels that nuclear instrumentation, as used in the l power reactor, is frequently prototypical in nature and does not benefit l from the quality control of mass production. A deficiency lies in the !
frequent situation that there is no way of testing the instrumentation )
adequately on site. '
E. Inspection and Inspectability The German ACRS has adopted Kellermann's recommendations i concerning in-service inspection for pressure vessels. These are more 3 extensive than proposed in the current N-45 standard and Kellermann i stated his opinion that N-45 was not adequate either in extent or frequency l of inspection. Kellermann stated that the German regulations will also l require in-service inspection of plate where it is appreciably irradiated or l where the stresses are large. A periodic hydro will be required every eight )
years at 125% of design pressure at elevated temperature (every four years l
) if adequate non-destructive testing cannot be accomplished). They believe i
the new PWR's will be fully inspectable from the outside because eight inches of free space will be left between the vessel wall and insulation.
Kellermann said there were no safety objections from utilities to the periodic hydrostatic tests at 125%. only economic. They normally use 130% for non-nuclear vessels.
It is clear that the German Regulatory body is provided far more extensive and direct assurance that a design has received independent review and that the propose:f quality control is being exercised, than is the USAEC. '
The independent TUV groups spend about 1/2 million dollars on each reactor in performing this service. The utility pays for the service.
. . i l
III. Discussion of Fast Reactor Safety at Karlsruhe with Drs. D. Smidt and K. Ga st, March 26,1969 l
Smidt and Gast believe that rod ejection, a large gas bubble, and rapid, l large-scale, fuel failure propagation must have the same low probability.of i occurrence as failure of scram on the loss of power to the primary system i pumps. They also feel one should try to make the probability of gross core voiding negligible. The Germans do not propose spoiling the core geometry in order to minimize positive reactivity effects from sodium voiding. Thus, l while the 1000 MWe reactor may have a larger total reactivity to be gained j from sodium voiding, an appreciable reactivity gain is also available in the
~ 400 MWe size (as AtomicsInternational has shown). Smidt and Gast feel that through hydraulic effects, or possibly fuel-coolant interaction effects (as discussed by Battelle Northwest in the two-day subc~ommittee meeting on fast reactor safety), one can postulate large reactivity insertion rates from sodium voiding during an excursion.
Smidt and Gast now place great emphasis on studying the molten fuel-sodium interaction as it relates to fuel failure propagation. As do the British, they place great emphasis on achieving a combination of instrumentation l plus core design Which will assure timely shutdown of the reactor, prior to much )
spreading of any propagation, should it occur. The Germans. indicated that !
Europe is developing a considerable experimental program on the molten fuel- I sodium interaction. They mentioned that Battelle Frankfort obtained more than )
80 atm peak pressure from a few grams of molten oxide dropped into low pressure water.
l Smidt is rather confident that a large amount of sodium superheat is very i unlikely in actual reactors, either because of small gas bubbles in the sodium l' or other effects, natural or deliberate.
The Germans mentioned that high gas solubility may be of interest as a i possible source of a large gas bubble in connection with the natural circulation l mode of cooling. They envisage venting of evolved gases from high points. l They are doing studies of gas solubilities in sodium.
While the Germans favor performing in-pile experiments involving boiling and fuel melting within a subassembly, they do not expect such a program to be definitive since there are too many variables possible.
IV. Discussion of PCRV Safety with Bowen in London on March 27 i
l Bowen, who is one of Farmer's chief lieutenants, provided the attached j document (Safex/P. 87) for ACRS use only. It summarizes his thinking quite well. As discussed in paragraphs No. 4 and 5 of the document, his primary ,
concern with PCRV's lies in a possible shear mode of failure in the end slab.
l Whether a bending or shear failure occurs in an end slab depends on the span l
l l
to depth ratio of the slab (a low ratio favors shear) and the value of the pre-stre s s. Tests show that the position of the cracks follow lines of principal stress where this is a few hundred psi tensile. The designs aim to prevent any appreciably tensile stresses so that if the' load is increased, the first cracks are of the bending type. However, if the concrete changes its -
properties locally--for example, due to shrinkage or temperature expansion, pre-stress in the slab may vary with time, and regions of low pre-stress may arise and the end slab be vulnerable to shear failure. Bowen thinks that the tests run at the University of Illinois have had too large a ratio of span to depth to provide information bearing directly on this question.
Bowen believes that the primary: purpose of a model is to test anchorages and that a good 1/10 scale mockup is required.
Also attached is an outline on PCRV questions provided by Bowen in which he mer,tions, among othcr things, a neod for instrumentation develop-ment, particularly stress gauges.
V. Discussions of Fast Reactor Safety with Bowen, Gilby, and Teague in Inndon on March 27, 1969 The British place very great emphasis on the need to accomplish a combination of instrumentation and reactor design adecuate to assure reactor shutdown in the event of considerable fuel melting and a subsequent pressure pulse within a subassembly. Based on the Spert iD second pressure pulse, the Space Technology laboratory accomplishment of large pressure pulses from molten metal-water interactions out-of-pile, British analysis of steam explosions in various industrial plants, etc. , Farmer's group currently feel one :annot rule out the possibility that rapid heat transfer between molten fuel and coolant can occur; they feel that an experimental program can only give a rough idea about the likelihood of the event, for the particular para- i meters used. 1 I
Gilby seems to feel that local overheating is most likely to occur within a subassembly because of fuel swelling, or crumbling of fuel and its collection on spacers.
It was stated that PFR now plans to use subassembly flow meters in three subassemblies in order to provide additional detection of gross flow-changes (as might be caused by a loss of pumps). It was also planned to use pressure sensors near the core in order to provide an additional parameter for detection of local fuel-coolant interactions.
The British have been devoting analytical effort toward gaining a better understanding of the differences between a disruptive nuclear excursion and the " equivalent" high explosive usually assumed in fast reactor accident analysis, as to effects on the containment structure. Their studies indicate that the reactor accident should lead to a much smaller initial pressure pulse on the system boundaries, but that the fellow-on pressure a few hundred
l s
i J
~
microseconds later will be larger for the reactor than with the high explosive.
They feel that unless one considers the differences before the reactor and high explosive, there may be insufficient allowances for this quasi-steady-state pressure which follows the shock wave. Their studies indicate that the pressure loading on the top structure of the reactor tank is very sensitive ;
to the free volume of gas in the vault above the normal sodium level (more l free volume leads to lower pressures). Their studies indicate that the pressure l on the upper structure is not very sensitive to the disruptive forces (the violence) involved in the nuclear accident. A large fraction of the total energy release goes into heating and melting the fuel rather than into production of the .
first shock wave. The relatively modest additional amounts of energy associated with increasingly sharp explosions do not contribute markedly to the quasi-steady-state pressure which arises hundreds of microseconds later and which results primarily from large masses of coolant receiving heat from large masses of hot fuel. ;
i They talked about avasi-steady-state pressures of 100-200 psi es achievable mechanically for the structure and as suitable limits if enough free volume were left (this is in the context of the primary pool type).
l The British do believe that a need exists to protect the lower containment boundaries from molten fuel and that, in principal, such protection appears ,
l to be possible. They clearly suffer from limitations of space in the existing. I I PFR design and do not have full freedom of design action. I was somewhat .
surprised that they did not seem to propose an R and D program to examine I questions relating to the efficacy of a post-accident heat removal system. )
l l
l l -
1 l
1
~-
yow Mtfan 10rgg twW S/JEX/P.67 CVP/N.44 THE I: ERIT 3 OF A GRADUAL MODE OF FAILURE FCD k PEEST:1SSS'3 CO':CRET'E PRESSURD VESSEL ,
- 1. Cen-idorction of Loccc
/anoct cny structure would have a gradual mode of failure under fixed strain - a car windscreen is a notable exception.. (If made of ordinary glass it would just crack and stay in its frcme - a gradual mode of failure). This sicple excaple chows the advantaSe to be gained - seeing the crack gives the
. opportunity for repair without much loss of convenience.
More usually the condition is of constant load. This would apply to a bridge, where the load is (essentially) the scif-weight.
Sometimes one seeks a limited interval of stability in the face of an increasing load. This increase occurred for exacple at Rcnan Poir.t; and is to be erpected en pressure vessels under accidental pressure surges. The main cases are:-
Multiple beiler tube (or header) e Required Prosauree Guekzedfrequency 10- /yr. Reliability 1.25P
! fcilure; and fcilure to i isolate fculty unit. 10-3 a
Fail to shut doun on loss Required
- of flow 10~ /yr. Reliability 1.4 P 10-1 ,
t In both cases the pressure rises over minutes. In normal working the required reliability is of order 10-7.
- 2. Gradual Yailure of the Barrel Recion of a Pressure Vessel The basic sequence of fcilure of the barrel of a pepv is that up to a pressure, typically 1) to 2 times working pressure, the concrete has expanded elastica 11y to Give a dilation of diameter say 3" on a full size vessel.
Beyond this pressure the concrete cracks and the tendons stretch elastica 11y to Civeafurtherfootorsodilationbeforefailureat2)to3timesworking pressure.
These facts suggest the following safety argument;- At a certain pressure, if the concrete has not cracked (en obvious fact) then the pressure could be further raised before the tendons would fail. This would be ensured provided the tendons were initially stressed to Icss than their ultimate. Thus the only control needed (from the point of view of a Safety Regulatory Authority) would be over the ratio of tendon prostress to ultimate. No stress calculations enter this argument; nothing about concrete strenSth; and the control over j tendon stressing extends over thousands of separate tendons making individual ,
errors unimportant. However, this apparent simplicity is fallacious. l l
l i i l 1
- - x It is likely the the concrete vill not crack traea th2 prssoura juct )
.- balances the initici .ndon lond, but at a com:what h' cr prs :urs, dua to l the tencile strength of the concretc, which although cmall is not n gligiblo l in this context. Furthermore, if pressurized fluid enters the cracks in the concrete. the load on the tendens increases due to the additional crea pressurized. Both effects tend to make the tendon load increase discontinu-ously at the point of concrete cracking, and reduce the apparent margin between pressure to cause cracking cnd that to cause ultimate failure, ,
I In the usual design the pepv is a flat-ended cylinder; restraint from end-slab fixing over the movement of the barrel might further postpone the incidence of concrete cracking. This is scre difficult to calculate but is ,
usually resolved by a model test. Thus at least three conditions erode l I
confidence in a gradual mode of failure for the barrel.
- Certainly one can design to get it; but the arguments as te why it will occur are quite complex.
3 Merits of Gradus 1 Tailure at the Scrrel i
Among the requirements which have em &ged in Sec. 2, if one specifies gradual failure for the barrel, the prestressing tendons must be prestressed to not higher than a certain fraction of their ultimate load. It would imply very little core to claim a knowledge of the actual tendon load (as opposed i
to the knowledge that it is not greater than a critical figure). Given the l cotual tenden load it is a simple calculation to decide when this is equalled i by the gas pressure. Thus, (for the ' barrel region), the hi hest usable l 5 ,
pressure enn be predicted with the same confidence as can the exist'ence of a l post-wcrking linit state. To fix ideas, consider the following possibilities i 5
for a vessel with a design pressure of 600 p.s.i. -
(a) " Gradual failure desien" l
Tendon - Cracking pressure Ultincte prosaure bitimate ,
Working '
Prestress 60% ultimate 900 p.s.i. 1,260 p.s.i. =2 l
(b) "Fnetor of safety desirn" Tendon prestress . . Cracking pressure Ultimate 7..gg 75% ultimate 1,125 Working The merit of (a) over (b) can hardly lie in the'slightly different' factcr-of-safety - this could easily be changed. It is intended to lic in the smaller knowledge required of the vessel state; but for the barrel portion this difference is anyway ccrginal.
- 4. Gradual Failure of End Slab 3 The failure sequence for an end slab is more uncertain. At a rather high pressure of about 2P it is expected to crack due to bending; and then to develop further resistance up to 3P in the same way as a cracked prestressed bean - by favourable changes in the lines of the loads relative to the neutral axis. This sequence could take an alternative form in which the first crr.eks are due to sheer, occurring within the interior of the roef thickness. It is not known whether total failure follows without increase of load or whether further strength is developed; and if the latter, what cycptoms are observable. ,
2 9
- . - - - _ - - - _ _ - . _ _ - _ _ __ __ J
Uncther a bendin or shecr failure occurs d: pends an tha span-to-d:pth ratio of the sicb (a > rctio favours shear) and the
- aun cf ths prs;tr:ss.
Tests shou that the positions of the cracks follow lines of principal stress, where this is a few hundred p.s.i. tensile. The designs, therefore, aim thtt in cny envisaged stcte no principc1 stresses are appreciably tensile; and In that, if the load is increased, the first cracks are of the bending type.
centrast to the barrel, however, it is possible for the prestress in the slab l
to vcry with time so thct core prestress is taken by one area and less by l cnother. This could happen ,1f concrete locally changed its properties - e.g.,
due to Ltrinkage or temperature expansion. Regions of low prestress may then l
be vulnerable te shear failure.
S. Merits of Grndual Failure of End Slabs I
Thc mcgnitude of the prestress, from point to point within the end slab, determines the mode of failure and the pressure load at which it occurs. If the concrete properties coul - 1 foreccst over the life of the vessel there is no reason to mistrust the cab. Lated principal stress as an index of cracking.
The principal concrete changes are shrinhcse due to ageing (drying);
differential thermal expansion; and differential creep due to the effect of the centre regicn being penetrated by steel tubes. The uncertainties on these ,
I are not commensurate with the required reliability of 10-7.
It is difficult to guess in advance how much confidence will be generated by tests showin5 a gradual code for the shear type failure. A wide range of prestress distributions and span ratios need to be embraced by the arguments; it is to be hoped that a few tests will demonstrate a definite physical sequence sufficiently clearly. i 1
- 6. Discussion of Grtdual Failure Philesechv l To be of maximum use, a vessel should be specified for gradual failure in the following terms:-
1 1 That at sete unknown pressure PS the incipient failure condition becomes detectable; that'the vessel will not fail dangerously unless P1 is raised to l
bPS ; and that at some intermediate pressure aP1 the vessel can survive for a l
(_ certain time (e.g., half an hour). Then this specification would apply to the special loads mentioned in (1) as follows. A transient pressure rise might cause the incipient failure condition just above working pret,sure; i.e., P1 equals working pressure. Then bP1 chould exceed 1.4 P1 (using the numbers of Sec. 1); i.e., a = 1.4.
Almost by definition, the vessel will be cracked at aP1 ; any additional ;
forces due to fluid pressure in the cracks cust be taken into account in ;
Also the hot fluid l establishing (perhaps CO2that aPq)does at 600 not ecuse C will cause localcatastrophic failure. and local tendon concrete expansion, ,
l creep, in flowing through the cracks. This must also be allowed for in pre-dicting a survival time at cpg.
Uhen the tendon heating is taken into account, it appears that for A.G.R.
conditione, hot Eas flowing through open cracks may cause tendon failure within cinutes, This type of cracking does occur in the second stage of failure in the barrel region. Therefore, from this point of view also, one questious the merits of a gradual failure mode design for the barrel region. It appears more logical to invest any strength in prolonging the elastic. region.
3
- - - - - - - - - - - ~ _ _ _ y
( -
. .s . , ,
For the roof-s1 c, however, the bending failyre du a not cc. usa creeks
' ' richt across the section. F.egarding the shear failure, if it is stcble, it vill be because no through cracks exist; so it need not be anticipated that tendon overheating must prevent demonstration: of stable shear cracking of the roof, llhen considering the bcrrel region the pene't rations require special thought.
In their vicinity the sc::e sort of problem arise as for the roof slab; and it ,
would be sid.larly desircble to design these features along linee which ensure a gradual mode of failure. The prestress at the penetrations is reduced much, core by the pressure than it is in the roof.
7 cone 1usiens (1) A gradual mode of failure design is of little value for the barrel section, as the safe elastic limit may be determined as readily as the
. ultimat e, lir.it .
(ii) Assurance of a gradual mode of failure would be of great value for )
the slabs (roof and floor); it would offset uncertainties about changes in the concrete with age.
(iii) The limit state must allow for the. flow of hot gas through cracks; this is an additional reason for disregarding the ultimate phase in the barrel, but need not prevent its usefulness in the slabs.
(iv) A gradual mode of failure is desirable for the penetrations.
l J. H. BO'.IIN -
4 21st February, 196h i
Distribution
~
Nembers of SAFI:X Working Party Members of Concrete Working Party ,
9 e
e
. i 4
l e
l i
A~-PEDIX: Notes on Present Results of Foulness Tests The codels have all been an idealised form of an existing A.G.R. design; all have withstood more th:.: double design prc~ssure. The end slab strength ,
was intended to be higher than that of the barrel, and the tests have confirmed I
this. Consequently all that has been cbserved so far. is the mode of failure j of.the barrel. The first four vessels were wound with the hoop prestress at about 75% ulti=cte; consequently the sedond failure phase of_ extension of tendons after concrete cracking was rather brief. This was easily rectified on the next two by reducing prestress to 65% ultimate. As argued in the paper, either represents a satisfactory design.
The latter vessel, having been cracked in a' hydraulic test without destruction, is now being used with gas pressure to measure the effect of the gas Ln the cracks. -
l l
l i
-- - _ _ - - - - - - - _ _ _ _ _ _ - - - - - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ ____ ___ _ _ __ _ i
CONCRETE PRESSURE VESSEI. PROBLD4S, MARCH,1969 4
AIDE MH!OIR y l
Any review at the coment ought to include the following problems:
- 1. Ded en Philoconhy Elastic versus limit state design; gradual failure modes; criteria for acceptable cracking; safety factors scaled to probability of loading. )
- 2. Desien Technical Problems 1
2.1 Methods of calculating stresses throu5 h out lifetime (including temperature and shrinkage).
2.2 Allowance for defects and distortions.
23 Design of penetrations.
2.4 Control of vessel cooling ,
l I l 25 Liner problems; predicting the strain history; . criterion of failure; consequences of failure.
2.6 Insulation behavitur; possibility and consequences of liner hot spots. j 3 Miscellaneous Problems 31 Grouted tendons 32 Allowance for effects of gas in cracks
/7 b 3 3 Need for instrumentation development; steaan- gauges.
J. H. Bowen l
j . -
i