JULY 1994 ECN-R--94-011
energy innovation
ON THE SAFETY OF THE ALMR Some physics aspects
A.J.JANSSEN
CL 2 7 Si t 0 The Netherlands Energy Research Foundation ECN Het Energieonderzoek Centrum Nederland (ECN) is is the leading institute in the Netherlands for energy het centrale instituut voor onderzoek op energie- research. ECN carries out basic and applied research gebied in Nederland. ECN verricht fundamenteel en in the fields of nuclear energy, fossil fuels, renewable toegepast onderzoek op het gebied van kernenergie, energy sources, policy studies, environmental aspects fossiele-energiedragers, duurzame energie, beleids- of energy supply and the development and application studies, milieuaspecten van de energievoorziening en of new materials. de ontwikkeling en toepassing van nieuwe materialen. ECN employs more than 900 staff. Contracts are Bij ECN zijn ruim 900 medewerkers werkzaam. De obtained from the government and from national and opdrachten worden verkregen van de overheid en van foreign organizations and industries. organisaties en industrieën uit binnen- en buitenland. ECN's research results are published in a number of De resultaten van het ECN-onderzoek worden neer- report series, each series serving a different public, gelegd in diverse rapportenseries, bestemd voor ver- from contractors to the international scientific world. schillende doelgroepen, van opdrachtgevers tot de internationale wetenschappelijke wereld. The R-series is for research reports that make the results of ECN research available to the international De R-serie is de serie research-rapporten die de technical and scientific world. resultaten van ECN-onderzoek toegankelijk maken voor de internationale technisch-wetenschappelijke wereld.
Netherlands Energy Research Foundation ECN Energieonderzoek Centrum Nederland P.O. Box 1 Postbus l NL-1755ZG Petten 1755 ZG Petten the Netherlands Telefoon : (02246) 49 49 Telephone : +31 2246 49 49 Fax :(02246) 44 80 Fax : +31 2246 44 80 Dit rapport is te verkrijgen door het overmaken van This report is available on remittance of Dfl. 35 to: f35,-- op girorekening 3977703 ten name van: ECN, General Services, ECN, Algemene Diensten Petten, the Netherlands te Petten Postbank account No. 3977703. onder vermelding van het rapportnummer. Please quote the report number.
© Netherlands Energy Research Foundation ECN © Energieonderzoek Centrum Nederland JULY 1994 ECN-R-94-011
*DE008128003* KSO01932830 R: FI DE008128003
ON THE SAFETY OF THE ALMR Some physics aspects
A.J. JANSSEN ABSTRACT r j Reactivity coefficients of the Advanced Liquid Metal Reactor (ALMR) are defined and iterpreted. An analysis is made of potentially severe accidents in the ALMR. From this analysis conclusions are drawn with regard to the desired values of the reactivity coefficients for an inherently safe reactor design. A discussion is devoted to the question whether the proposed ALMR designs fulfil the desired criteria.
This work was performed as part of the ECN research program ENGINE
ECN Nuclear Energy acknowledges General Electric ALMR Core Engineering Division for providing additional information.
ECN-R--94-011 CONTENTS
1. INTRODUCTION 5
2. REACTIVITY COEFFICIENTS 7
3. QUASI-STATIC ANALYSIS OF ACCIDENTS 13 3.1 Introduction 13 3.2 Influence of reactivity coefficients 13 3.3 Choices for an inherently safe design 15 3.4 Some calculation results 17
4. DISCUSSION 23
5. CONCLUSION 27
6. LITERATURE 29
ECN-R--94-011 ECN-R--94-011 1. INTRODUCTION
The safety of modern nuclear power plants is based on principles like redundancy, diversity, defence-in-depth, etc. The extensive application of engineered safety features leads to higlily complex systems, entailing an increasing risk of human failure in the operation of these systems. In recent years new reactor designs have evolved which are characterized by simplification thanks to the application of inherent safety features. "Inherent safety" is defined as the elimination of inherent hazards through fundamental conceptual design choices, such that the reactor remains in a safe condition on the basis of laws of nature in all conceivable circumstances; no human interference, no triggering signals, and no supply of external energy are required to remain in a safe condition [22]. The term "passive safety" is also used frequently. Inherent safety refers to the self-control of the primary processes, whereas passive safety features come into operation (also without active triggering or energy supply) in case of a strong deviation of normal process behaviour.
Since some remote failure mechanisms will always remain, no reactor concept can be qualified as completely inherently safe. However, specific safety features can be qualified as such, depending on the plant's design and response to accident initiators. In the Netherlands, the following three generations of reactor designs are distinguished by their (increasing) use of inherent safety features:
1. Evolutionary designs, based on existing reactors, which arc already now available (e.g. the Westinghouse APWR).
2. Advanced designs: more passive and less complex systems, e.g. the SBWR of General Electric.
3. Innovative designs, inherently safe to a high degree, which arc still under development. To this third generation belong, e.g., PIUS (which stands for Process Inherent Ultimate Safety) and PRISM (which stood for Power Reactor Inherently Safe Module).
PRISM is an example of an "Advanced Liquid Metal Reactor" (ALMR). A judgement of the inherent safety of the ALMR may be based on its response to all credible accidents, assuming that all active safety provisions will fail. Many references can be found in the literature which address the safety of the ALMR. In almost all references three types of accidents are considered which - thanks to specific properties of the ALMR - develop without severe consequences, even without automatic or operator actions such as the insertion of control rods. These three accidents (which all belong to the group of Anticipated Transients Without Scram, ATWS) arc:
1. LOHS - Loss Of Heat Sink without scram. A pump failure in the water/steam circuit could be the cause of this accident.
2. LOF - Loss Of Flow without scram. A pump failure in the primary sodium circuit could be the cause of this accident.
ECN-R--94-011 On the Safety of the ALMR
3. TOP - Transient Over Power without scram, caused by the unintended withdrawal of a control rod.
Most papers which address these accidents in an ALMR are from General Electric (GE) and Argonnc National Laboratory (ANL). GE considers the PRISM design (about 450 MWth), ANL has considered a somewhat larger concept, about the size of SAFR (Safe Advanced Fast Reactor, ca 900 MWth), a concept of Rockwell International. These papers contain the results of transient calculations. The explanation and interpretation of these results are sometimes rather brief or even confusing: It is generally accepted that a negative Doppler effect is of utmust importance for the safety of a nuclear reactor of any type; nevertheless, GE states that several accidents develop benignly in PRISM thanks to "the small positive Doppler effect".
To appreciate such remarks it is necessary to understand the basic physics properties of the ALMR and to make use of them in an evaluation of the accidents mentioned above. Fortunately, a few papers of ANL [12,14] consider such basic physics properties. We will develop our thoughts along the lines set out in these papers. In chapter 2 several reactor parameters are introduced which are connected to the safety of the ALMR. In chapter 3 we will use these parameters in an analysis of the accidents mentioned above. A comparison is made between two alternative designs - one with metallic fuel and one with oxide fuel.
ECN-R-94-011 2. REACTIVITY COEFFICIENTS
In reactor physics one usually defines reactivity coefficients which arc connected to changes of fundamental physics parameters. For the ALMR, a small sodium-cooled pool-type fast reactor, we can mention:
1. aD, the Doppler coefficient, which is connected to the fuel temperature. Doppler broadening of the nuclear resonances due to a temperature rise causes an increase of the neutron absorptions in the heavy nuclides, inducing a negative reactivity effect.
2. ctE, the axial fuel expansion coefficient. Axial expansion of the fuel rods reduces the volume-averaged fuel density in the core. This causes an increase of the neutron leakage from the core, especially in the radial direction. Axial fuel expansion is sometimes related directly to fuel temperature changes but in other cases it is dictated by coolant temperature changes, viz., if the fuel cannot expand freely within the cladding but remains stuck to the cladding of which the temperature is determined mainly by the coolant temperature.
3. aNa, the sodium density coefficient, which is connected to the coolant temperature. A reduction of the sodium density has two opposite effects. There will be less moderation of the neutrons; in the resulting harder neutron spectrum the ratio of neutron productions and neutron absorptions of the heavy nuclides is larger (this is the positive spectral effect). A decrease of the sodium density also makes the core more transparant for neutrons; the neutron leakage will therefore increase (this is the negative leakage effect). The net effect is positive in the core centre and negative at the outer boundaries; the volume-averaged effect is usually positive. (A third effect of a reduction of the sodium density, viz., a reduction of the neutron absorptions in the sodium, is of less importance.) It should be noted that in the accidents to be considered the coolant temperature increases will (hopefully) be so small that the sodium density will vary only slightly, entailing relatively small reactivity effects. If voids would occur (in case of sodium boiling or in case of other types of accidents) the (large) sodium void coefficient of the ALMR should be considered.
4. CCCR, the reactivity coefficient connected to the expansion of the "Control Rod Driveline". The control rods arc connected to the reactor closure head via the control rod drivelincs and are moved into the reactor core from above. A temperature increase of the sodium flowing along the drivelines will result in an expansion of these drivelincs and a movement of the control rods deeper into the core. It should be noted that this negative reactivity effect can be compensated by an other effect: The reactor core is connected to the bottom of the reactor vessel via the lower grid plate. This vessel is suspended from a construction situated at the level of the closure head. Heating of the large sodium pool will lead to an expansion of the reactor vessel, entaiïing a downward movement of the reactor core relative to the closure head and thus a withdrawal of the control rods. We will not consider this "Vessel Expansion" effect any further since it acts rather slowly, on a time scale of about 10 minutes, whereas the other effects act much faster. It will be clear that a^ will depend on the control rod worth and the actual insertion depth of the rods. Furthermore, it is hardly feasible to consider
ECN-R--94-011 On the Safety of the ALMR
and a.E as completely independent parameters.
5. aR, the radial expansion coefficient. The positions of the fuel assemblies are fixed by the lower grid plate and two other grid plates at higher elevations. A coolant temperature increase will result in an expansion of these grid plates, a radial expansion of the core, a reduction of the volume-averaged fuel density and thus an increased neutron leakage, especially in the axial direction. It should be noted that this is a somewhat too simplistic description, since there is an other, rather complicated, mechanism that plays a role as well: There is a radial temperature profile in the core with the maximum temperature in the core centre. One half of an assembly (the one that faces the core centre) will experience a higher temperature than the other half. The differential expansion connected to this temperature difference will force the assemblies to bow towards the core centre, which would result in a strong positive reactivity effect. In order to prevent this, the "limited free bow restraint system" will be applied, involving a construction and positioning of the grid plates in such a way that the fuel assemblies are more or less forced to bow outwards instead of inwards in the active part of the core. The resulting "Bowing Reactivity" effect is said to be small but "it can be made negative by a proper design". However, experimental verification is necessary to reduce the uncertainty.
The reactivity coefficients defined above are useful parameters in ncutronics calculations: they are connected to physics parameters (in particular various temperatures) that are input to such neutronics calculations. Nevertheless, a few disadvantages can be mentioned: The various coefficients cannot always be measured independently; for instance, the Doppler effect and the axial expansion effect often work simultaneously. Furthermore, some coefficients are connected to parameters which cannot be measured directly in a working reactor; for instance, the fuel temperature is such a "hidden" quantity, it is determined by the coolant inlet temperature, the coolant flow, and the reactor power. For such reasons it can be to advantage to select some independent, well accessible, parameters and to define reactivity coefficients connected to these parameters.
For these reactivity-determining parameters one has selected the three quantities already mentioned above: 1. P, the reactor power normalized to the nominal power. 2. F, the core coolant flow normalized to the nominal flow. 3. 8Tin, the change of the coolant inlet temperature with respect to its nominal value.
We may remark that Tin is the only quantity that can be influenced from outside the reactor, i.e. from the Balance Of Plant. Inside the reactor, F can be influenced, on purpose as well as by accident; here also an external reactivity change 6pexl can be introduced, again on purpose as well as by accident (e.g., by a control rod movement). P cannot be influenced directly but is the result of all possible reactivity changes including that due to a change of P itself. However, P can be determined quite well, e.g. from Tin, F and the average coolant outlet temperature Toul.
For convenience, one has chosen not to consider F itself as an independent
ECN-R--94-011 Reactivity coefficients
parameter but the ratio P/F; if P and F arc changed such that P/F does not change, and if Tin is not changed, there will be no coolant temperature change anywhere in the reactor and the reactivity change of the reactor will be determined solely by the Doppler effect and the axial expansion.
With these definitions and choices we arrive at the following equation for the reactivity of the reactor:
Sp = A(P-l) + B(P/F-1) + C.8Tin + 5pext (1)
with
(A+B) ($) = reactivity change from zero power to 100% power and 100% flow at constant coolant inlet temperature B ($/100% P/F) = power flow coefficient A ($/100% P) = net power coefficient C ($/°C) = coolant inlet temperature coefficient.
The relations between these coefficients (A, B and C) and the more fundamental reactivity coefficients introduced earlier are shown in Table 1.
Table 1 The coefficients A, B and C, expressed in the a's. A7> is the difference between the local fuel temperature and the local coolant temperature at nominal conditions, averaged over the core. ATC = Tmt - Tln at nominal conditions
A = {aD + aE}xATF B = {aD + aE + aNa C = {aD + aE + aNa + eta* + aR}
The relations in Table 1 contain sufficient detail for the present study. It should be noted, however, that in literature slightly different expressions can be found as well. Sometimes the "Bowing Effect." is included;in B; if the fuel cannot expand freely inside the cladding A would be equal to>ctDxATF.
In Table 2 we present some representative values of the coefficients and temperatures for an ALMR with metallic fuel and an ALMR with oxide fuel. It can be seen that a metallic core has a smaller Dopplcr coefficient and a larger sodium density coefficient than an oxide core. The most striking difference, however, is the much smaller power coefficient A of the metallic core, which is due to its much lower fuel temperature. This is sometimes favourable and sometimes unfavourable, as we will see soon.
Table 2 Representative values of reactivity coefficients and temperatures ofALMRs. a's and C in Fuel aD aE OK. CtcR aR T ATC ATF -A B C in Metal -0.10 -0.12 +0.18 -0.05 -0.25 350 150 150 -33 -29 -0.34 Oxide -0.16 -0.10 +0.11 -0.05 -0.20 350 150 750 -195 -34 -0.40 ECN-R--94-011 On the Safety of the ALMR The use of Eq.(l) can be demonstrated with a simple example: Under nominal conditions (P = F = 1) the core-averaged fuel temperature of a reactor is TF = Tin + ATc/2 + ATF. Suppose that due to some cause the coolant inlet temperature increases 100°C (8Tin = 100) and that no mitigating action is taken (F remains = 1, 5pcxt = 0). After the fast transients have died away, a new (quasi-)stationary situation will be established according to Eq.(l): 0 = A(P-l) + B(P-l) + lOOxC , from which P can be derived (P < 1). The power reduction causes a reduction of the coolant temperature increase over the core (this temperature increase is proportional to P/F). The power reduction also causes a direct decrease of the fuel temperature (the difference between the fuel temperature and the coolant temperature is proportional to P). The average TF will therefore become: TF = (Tin+5Tin) + PxATc/2 + PxATF . By making use of the numerical values presented in Table 2 we obtain the results shown in Table 3. Table 3 The result of an increase of the coolant inlet temperature Tin by 10O°C. P is the relative power. T's in °C Fuel T- P T TF xin "•out Metal 350 1.00 500 575 450 0.45 518 552 Oxide 350 1.00 500 1175 450 0.83 574 1131 The average coolant outlet temperature Tou, should remain below certain limits. It should stay below the boiling temperature of sodium (about 1000°C), but also below temperatures at which substantial fuel/clad interaction occurs and at which too large thermal loads of construction materials take place (about 750°C). The results in Table 3 indicate that the metallic core behaves better thanks to its smaller power coefficient (which causes a stronger decrease of P). The fuel temperature Tn settles down at a value which is lower than the nominal value. This temperature decrease is accompanied by a positive Doppler reactivity effect, which turns out to be 2 0 for the metallic core and 7 0 for the oxide core. This small value for the metallic core is "the small positive Dopplcr effect" mentioned in the Introduction. For this particular situation the small Doppler effect of the metallic core is an advantage. However, it is useful to look also at the reversed situation: Let us assume that the inlet temperature docs not increase but decreases 100°C, e.g. due to a steam line rupture which would temporarily increase the cooling of the secondary sodium circuit. The metallic core will go to a quasi- stationary situation at a power level equal to 1.55 times nominal power, 10 ECN-R-94-011 Reactivity coefficients whereas the power in the oxide core will be only 17% above nominal. For this situation one may equally argue that the oxide core behaves better thanks to its larger Dopplcr effect. The use of Eq.(l) demonstrated above will be applied in the next chapter in an analysis of the severe accidents mentioned in the Introduction. ECN-R--94-011 11 On the Safety of the ALMR 12 ECN-R--94-011 3. QUASI-STATIC ANALYSIS OF ACCIDENTS 3.1 Introduction The accidents to be considered in this chapter may have severe consequences, but they are not accompanied by large reactivity effects; prompt supercriticality does not occur. Except for the Transient Over Power (TOP) accident, they do not belong to the true reactivity-initiated accidents. With respect to TOP we should mention that one finds analyses of this accident for reactor cores having a conversion factor (breeding ratio) equal to or greater than one. Such designs have a small burn-up reactivity swing; therefore, control rod worths can be kept very small. Moreover, the control rod drive mechanisms are provided by adjustable rod stops which mechanically limit the out-motion of the rods. One assumes that this mechanical system does not fail during accidental situations and that the stops are always positioned correctly. In summary, the TOP accident is defined as the withdrawal of one or more control rods, resulting in a total reactivity addition of ca 35 0 (ca 0.001 Ak) with a speed of 2 0 per second. It will be clear that this accident fundamentally differs from the rod-drop accident in a BWR, involving a reactivity addition Ak = 0.015 within one second. It may be concluded that - for a physical understanding - the accidents under consideration may well be analyzed by looking at quasi-stationary situations, i.e., by setting the net reactivity of the reactor under the changed conditions equal to zero and subsequently solving Eq.(l). The quasi-stationary situation found in this way, which will be reached within a few minutes, should be inherently safe, i.e., all temperatures should remain below safe limits. In the hours to follow the reactor parameters will still change slowly, but that part of the accidental situation is considered to be less crucial. That slow evolution can also be analysed quasi-statically [15], but we will not consider it in the present study. In section 3.2 we consider the dependence of the quasi-stationary situations on the magnitudes of the reactivity coefficients A, B and C. We will consider the three ATWS accidents mentioned earlier (LOHS, TOP and LOF), as well as two - equally plausible - accidents without scram which result in reactor conditions more or less opposite to the conditions resulting from LOHS and LOR In section 3.3 we indicate the most desirable combination of values for A, B and C and the way in which such a combination can be obtained. Finally, in section 3.4 we present some calculations of the reactor behaviour, where we make use of the parameter values presented in Table 2. 3.2 Influence of reactivity coefficients a. LOHS (Loss Of Heat Sink without scram) The heat removal in the Balance Of Plant (BOP) ceases, Tin will rise and the power P will drop, whilst the flow F remains constant. The reduction of P/F leads to a reduction of Toul - T!n; in the limit (P » 0, Toul « Tin) Eq.(l) gives: 5Tin = (A+B)/C ; 5Tout = 5Tin - ATC = {(A+B)/(CATC) - 1 }ATC . (2) ECN-R--94-011 13 On the Safety of the ALMR For a small temperature rise in the core during LOHS, it is desirable to have a small value of (A+B) and a large value of C ("small" and "large" refer to absolute values). b. TOP (Transient Over Power without scram) Withdrawal of a control rod introduces a positive reactivity 8pT0P; F and Tin remain unchanged. Initially the reactivity will be compensated by an increase of P and P/F, according to Eq.(l): P = 1 - 8pT0P/(A+B) ; 8T0Ut = (P/F - 1)ATC = -5pTOPxAT<7(A+B) . (3) The Balance Of Plant (BOP) can not cope with this larger heat output if no BOP actions are taken. The inlet temperature will therefore rise; the power will drop back to its nominal value (P = 1, P/F =1) and the outlet temp- erature will rise in accordance with the inlet temperature rise. Eq.(l) gives: 5Tin = 5Toul = -5pTOP/C. (4) It is clear that for this accidental situation a small control rod worth is highly desirable to limit the initial power overshoot and to limit the final temperatures in the reactor. The value of (A+B) should be large, which is in conflict with the small value desired for the LOHS accident. (One could argue that it would be favourable to aim at a small value of ATC; however, this ATC is mainly determined by the Balance Of Plant and, moreover, a reduction of ATC would also reduce B.) c. LOF (Loss Of Flow without scram) A loss of electrical power of the primary pumps causes a rundown of the pumps. The flow F will be reduced to the level of natural circulation, whilst Tin will remain unchanged, at least for some time to come. The increase of P/F causes an increase of the average temperature in the reactor, inducing a reactivity reduction. The resulting decrease of P induces a reactivity addition. From Eq.(l) we obtain for the quasi-stationary state, when P « 1: P/F = 1 + A/B ; 8Tout = (A/B)ATC . (5) An inherently safe situation without large temperature increases will be established after the LOF accident if A is small and B is large. It must be mentioned here that during the initial transient a rather large power overshoot can occur: One intends to apply electro-magnetic pumps in the primary sodium circuit. These pumps have a small moment of inertia. Their coastdown time after loss of power will be quite short, much shorter than the decay time constant of the delayed neutron precursors. The power reduction mentioned above will be delayed due to the continuing high production of delayed neutrons. P/F will temporarily be larger than Eq.(5) indicates, which results in an overshoot of T0l)t. An analysis of the reactor kinetics equations reveals that this overshoot can be limited if a constraint is fulfilled which looks like: xX(l + A/B)2|B| » 1 $, (6) where t is the pump coastdown time constant and 1A. is the delayed neutron time constant (~ 14 s). The overshoot can be reduced if the pump coastdown time is enlarged. Equation (6) also reveals that the smaller A/B is (which is 14 ECN-R-94-011 Quasi-static analysis desired to limit the asymptotic value of Tout, see Eq.(5)), the larger x should bc. GE intends to couple the primary pumps to synchronous machines in order to increase T, but it could be necessary to use pumps with larger inertia. d. Chilled inlet temperature In this scenario - the reverse of the LOHS scenario - a steam line rupture causes a (temporary) strong increase of the cooling of the secondary sodium circuit, which will result in a decrease of Tin. While the flow F will remain constant, the resulting reactivity increase will be compensated by a reactivity decrease due to the increasing power. From Eq.(l) we obtain: P = 1 + (-5Tin)C/(A+B) ; 5Tout = {CAiy(A+B) - l}{-5Tin} . (7) Of course, the requirements for the values of A, B and C arc opposite to those mentioned for the LOHS scenario. However, one can indicate an upper limit for the possible reactivity addition during this accident. By excessive cooling Tin will never drop below the solidification point of sodium (about 125°C); with still stronger cooling this accident would turn into a LOHS accident (besides, this accident will anyhow turn into a LOHS after dryout of the steam generator). With the numerical values given in Table 2 this would mean that the maximum value of (-8Tin) will be less than 1.5ATC. e. Pump overspecd Pump overspeed (F > 1) will initially induce a temperature decrease in the reactor. The power will increase, according to Eq.(l) to: P = (A+B)/(A+B/F) > 1 ; 5T0Ul = ATC(1 - F)/(B/A + F) < 0 . (8) So, the outlet temperature will decrease, notwithstanding the higher power level. However, this higher power cannot be rejected by the BOP; Tin will therefore rise and P will return to its nominal value. From Eq.(l) we obtain: STin =(1 - 1/F)B/C ; 5T0Ut = 5Tin + (1/F - 1)ATC = (1 - 1/F)(B/C - ATC). (9) For this situation B should be small and C should be large. In practice, B/C = ATc/2 (see Tables 1 and 2), which would mean that 8Tout < 0 (see Eq.(9)). The requirements for A, B and C for an inherently safe reactor design have been summarized in Table 4. One can observe that several requirements are in conflict with each other. In the next section we will indicate how these conflicts can be resolved; we will follow the reasoning developed in the USA and comment on it later in Chapter 4. 3.3 Choices for an inherently safe design If there exists a conflict between the requirements for A, B or C for the short-term behaviour of the reactor (during the initial transient following the accident) and the asymptotic behaviour (after several minutes), one considers the requirements for an acceptable asymptotic behaviour of higher priority. For instance, for the LOF accident it is required that A/B should be small to limit the asymptotic Toul, and in order to limit the - probably large - overshoot of Toul during the initial transient other measures should be taken, i.e., the pump coastdown time constant should be made sufficiently large. A small ECN-R--94-011 15 On the Safety of the ALMR Table 4 Results of a quasi-static analysis of accidents without reactor scram Accident Desired trend for inherent safety LOHS (A+B) small C large TOP (A+B) large C large 8pT0P small LOF A small B large x large (TM1+A/B)2|B 1$) Chilled Tin (A+B) large (physical limitation: C small |8Tj <1.5ATC) Pump overspeed E small C large (B/C < ATC) value of A is equally unfavourable for the initial power overshoot during a TOP. The additional measure to be taken to limit this overshoot is to design a reactor with a sufficiently small 5pT0P. The requirement for C for a LOHS is in conflict with the requirement for the chilled Tin accident. The solution here is that C should be sufficiently large that a LOHS results in acceptable temperatures but not so large that a chilled Tin would result in unacceptable outlet temperatures. If one takes into account that, at nominal conditions, there is a margin of about 3.5ATC between Tou, and the boiling point of sodium and a margin of about 1.5ATC to the point where the thermal load of construction materials becomes unacceptable, one arrives at the following compromise: Goal Remark a. A, B and C should be negative * A < 0 implies a negative prompt power coefficient; B and C < 0 imply a negative temperature coefficient b. A/B should be small, e.g. < 1 * To limit the asymptotic Tout in a LOF c. 1 < CATc/B < 2 * With (a) and (b) a balance is obtained between LOHS and the accidents with chilled Tin and with pump overspeed d. 5pT0P/1B | should be small, * Necessary, in view of (b) and (c), to e.g. < 1 make TOP inherently safe 2 e. xk(\ + A/B) |B| » 1 $ * To limit the overshoot of Toul during LOF 16 ECN-R--94-011 Quasi-static analysis Considering the numerical values given in Table 2, it is clear that the goals (a) and (c) are easily achieved. For (b) a reactor core with metallic fuel is more attractive; yet a small value of aNa and a large value of aR should be pursued in the reactor design. Requirement (d) can be fulfilled by designing a reactor with a small 8pTOP, and (e) can be fulfilled by ensuring a sufficiently large x. 3.4 Some calculation results By inserting the numerical values of Table 2 into Eqs.(2) to (9) we can easily obtain the reactor conditions during the various accidents. The results are presented in Tables 5 and 6. A few comments to these tables should be made here. For the TOP accident we assumed 5pT0P equal to 35 0, a value that is frequently used in literature (see also section 3.1). For this accident we considered two states: the intermediate state at elevated power, according to Eq.(3), and the final state at nominal power, according to Eq.(4). For the LOF accident we tried to improve Eq.(5) somewhat by including the fact that P will not drop completely to zero when the natural circulation flow is established. The equation used for this accident is, according to Eq.(l): P/F = (A+B)/(AF+B) ; 5T0Ut = A(1-F)ATC/(AF+B) . (5a) We assumed that the natural circulation flow F is 5% of the nominal flow. For the chilled Tin scenario we considered a - large - temperature decrease of 200°C. For the overspeed accident we assumed a 100% increase of the flow. For this accident we considered two states: the intermediate state at elevated power, according to Eq.(8), and the final state at nominal power, according to Eq.(9). Table 5 Normalized power and flow and average temperatures (°C) of the metal-fuelled reactor Reactor state P F Tin Tout TF Nominal 1 1 350 500 575 LOHS 0 «1 532 532 532 TOP (8pT0P = 350) interm. state 1.566 11 350 585 702 final state 1 1 453 603 678 LOF 0.10 0.05 350 653 517 Chilled Tin (5Tin = -200°C) 2.10 1 150 465 622 Overspeed (F = 2) interm. state 1.31 2 350 448 595 final state 1 2 393 468 580 ECN-R--94-011 17 On the Safety of the ALMR It can be seen that all temperatures presented for the metallic core remain within acceptable limits. For the oxide core, however, the sodium temperature becomes very high in the LOHS scenario, and in the LOF scenario sodium boiling would occur. Table 6 Normalized power and flow and average temperatures (°C) of the oxide-fuelled reactor Reactor state P F Tin Tout Nominal 1 1 350 500 1175 LOHS 0 -1 923 923 923 TOP (8pT0P = 350) interm. state 1.15 1 350 523 1301 438 588 1263 final state 1 1 350 1135 939 LOF 0.26 0.05 150 352 1263 Chilled Tin (5Tin =-200°C) 1.35 1 350 431 1201 Overspeed (F = 2) interm. state 1.08 2 393 468 1180 final state 1 2 For a proper evaluation of the reactor behaviour it is not sufficient to consider average temperatures only. For instance, Tout (which is the mixed mean outlet temperature) is of importance to judge upon acceptable structural loads in the upper part of the reactor vessel, but it does not inform us about possible local sodium boiling or clad damage. Similar arguments hold for TF, the core- averaged fuel temperature. Therefore, we have tried to derive hot channel temperatures as well: A total power peaking factor equal to 1.5 was assumed and axial and radial peaking factors where assumed to be of equal magnitude. Figure 1 shows the axial variation of the hot channel temperatures of the metal-fuelled reactor under nominal conditions. The main differences with the oxide core are (1) a negligibly small temperature difference between clad inner surface and fuel outer surface thanks to the applied sodium bonding, and (2) a much lower temperature rise in the fuel thanks to the large heat conductivity. (In the core centre, where the power density is 1.5 times the ccrc-average power density, the temperature difference at nominal conditions between clad inner surface and bulk sodium was set equal to 60°C and, for the oxide core, the temperature drop over the gap was taken to be 200°C.) Tables 7 and 8 show the assumed hot channel temperatures under nominal conditions and the calculated temperatures under the various accidental conditions. For the TOP and the Pump overspeed accidents we considered only the intermediate states (cf. Tables 5 and 6), since they are somewhat more demanding than the final states. 18 ECN-R-94-011 Quasi-static analysis ü Ü o Figure 1 Axial hot channel temperature profiles in the metal-fuelled core at nominal conditions, flc - fuellclad Table 7 Hot channel temperatures (°C) in the metal-fuelled core. The fuel hot spot at nominal conditions is at az level ~ 0.65zmu Reactor state T- Outlet temperatures Temp. at z/z_,„ = 0.65 Na Na f/c fuel Na f/c fuel interf. centre interf. centre Nominal 350 533 560 704 475 532 848 LOHS 532 532 532 532 532 532 532 TOP 350 635 677 902 545 634 1124 LOF 350 716 719 733 600 606 637 Tin - 200°C 150 534 591 893 413 532 1192 Fx2 350 470 505 694 432 507 918 ECN-R--94-011 19 On the Safety of the ALMR Table 8 Hot channel temperatures (°C) in the oxide-fuelled core. The fuel hot spot at nominal conditions is at a z level ~ 0.55zmax Reactor state Outlet temperatures Temp, at z/zm,,v = 0.55 Na Na clad fuel fuel Na clad fuel fuel inner outer centre inner outer centre Nominal 350 533 560 650 1427 453 513 712 2433 LOHS 923 923 923 923 923 923 923 923 923 TOP 350 560 591 695 1588 468 537 765 2745 LOF 350 1302 1309 1332 1534 886 901 953 1400 Tin - 200°C 150 397 433 555 1604 289 370 638 2962 Fx2 350 449 478 575 1415 406 471 685 2544 The most relevant temperatures have been plotted in Figs. 2 to 5. In Fig. 5 the maximum fuel centerline temperatures arc compared with the fuel melting points; we assumed melting temperatures of 1000°C and 2800°C for the metal fuel and the oxide fuel, respectively. One can observe that the sodium temperatures never exceed their limits in the metal-fuelled core. However, local fuel melting would occur in that core during the TOP and the chilled inlet accidents. The easiest way to mitigate this problem is to reduce the nominal power of the reactor. This is what is actually done: recent PRISM designs have a lower linear power rating than that corresponding to the temperatures shown in Table 2. This has of course economical consequences. T(oC) mixed mean outlet temperature Norn. LOHS TOP LOF Tln-200 Fx2 Figure 2 Mixed mean outlet temperatures under various conditions 20 ECN-R--94-011 Quasi-static analysis T(oC) maximum outlet temperature metal m oxide Na boiling Norn. LOWS TOP LOF TIn-200 Fx2 Figure 3 Hot channel outlet temperatures under various conditions maximum clad temperature clad damage Norn. LOHS TOP LOF TIn-200 Fx2 Figure 4 Maximum hot channel clad temperatures under various conditions. For oxide fuel the clad damage limit is about 750°C. For metal fuel a somewhat lower value of 700°C is frequently used, in view of the eutectic reaction with iron in the cladding at relatively low temperatures ECN-R--94-011 21 On the Safety of the ALMR oC T(max,fuel) - T(melt,fuel) 200 n o y//?, -200 H w.metal -400 oxide •600 H -800 -1000 H -1200 •1400 -1600 -1800 -2000 Nom. LOHS TOP LOF TIn-200 Fx2 Figure 5 Maximum hot channel fuel centerline temperatures under various conditions Local fuel melting would also occur during the chilled inlet accident in the oxide core. However, the economic consequences (in terms of a reduction of nominal power) are only marginal in this case, since the calculated fuel temperatures are, on a relative scale, only marginally too high. A much more severe situation will occur during the LOF accident in the oxide core; local sodium boiling would certainly occur if the reactor were designed to have the linear power rating assumed here. Also in the LOHS accident very high sodium and clad temperatures would occur. We will discuss the reactor behaviour further in Chapter 4. 22 ECN-R-94-011 4. DISCUSSION A metal-fuelled reactor shows a much more acceptable asymptotic behaviour during LOHS and LOF than an oxide-fuelled core. This is caused by the small value of ATF thanks to the excellent heat conductivity of metallic fuel and the filling with sodium of the gap between fuel and cladding. A substantial reduction of the linear power of oxidic fuel elements would be required to make the oxide core behave like the metallic core during LOHS and LOF. A problem to be mentioned here is that - in order to reduce the initial overshoot of Tout during LOF, in particular in the metallic core - the primary pumps should have a large coastdown time (tens of seconds for the metallic core). The solution proposed by GE is to couple the low-inertia electromagnetic pumps to high-inertia synchronous machines. It is questionable, however, whether this coupling will always keep intact during a LOF. Transient analyses have shown that a faster flow reduction (which would also occur when the LOF is caused by an internal pipe rupture) can easily result in an unacceptable situation with sodium boiling, fuel melting and cladding attack. In connection with this serious safety problem GE intends to apply so-called GEM's (Gas Expansion Modules): Several hollow metal cylinders, closed at the top and open at the bottom, are placed in assembly locations at the periphery of the core. They are filled with an inert gas that is compressed from below by the sodium, in such a way that under nominal conditions the sodium level in the cylinders stays above the upper level of the active fuel. The reduction of the sodium pressure in a LOF situation will result in a lowering of the sodium level in the cylinders. This will induce a negative sodium void reactivity effect, since the cylinders are placed at the periphery of the core. The beneficial effect of these GEM's (the reactor is brought to a subcritical state, resulting in substantially lower values of the overshoot of Tou, as well as the asymptotic Tom) has been shown in transient calculations and experiments [21]. However, this elegant method to improve reactor behaviour cannot be considered as an inherent safety feature since this mechanical construction can become defective; counteractive measures must be taken to reduce its failure probability, e.g., frequent testing on leak-tightness, frequent replacement of the GEM's [23]. The small value of TF of the metallic core (otherwise stated: its small Doppler effect), being an advantage in LOHS and LOF situations, appears to be a disadvantage in the TOP accident. 8pT0P should therefore be very small. A metallic core with sufficient internal breeding has a small burnup reactivity swing; control rod values can therefore be kept small. In Table 9 we present some data on required control rod worths. All reference PRISM designs have 6 control rods. It is required that 5 out of 6 rods can compensate the core overreactivity at Begin Of Cycle (BOC). A further requirement is that one rod can bring the reactor in a safe cold shutdown position, at 1 $ subcriticality. Notwithstanding the small burnup reactivity swing, it appears that the complete withdrawal of all rods at BOC could induce a positive reactivity of 3 $ in the metallic core (and 3.5 $ in the oxide core), which would certainly be unacceptable. The rod drivelincs will therefore be provided by rod stops which mechanically limit the out-movement of the rods, such that no more than, e.g., 35 £ can be added, that is 2.2% of the total rod worth in the metallic core. Unfortunately, such a mechanical stop mechanism cannot be ECN-R-94-011 23 On the Safety of the ALMR considered as an inherent safety feature. It should be mentioned further that in recent years several actinidc "burner" (instead of "breeder") designs of PRISM have been presented by GE, having a reactivity swing of 12 $ during a burn-up cycle of about one year. In such systems the control rod stops would have to be repositioned very frequently indeed (and moved over very short distances) to obtain the same safety characteristics with respect to the TOP accident as the breeder designs. Table 9 Required control rod reactivity worths ($). The power deficit equals -A (see Table 2), the power/flow deficit equals -B, and the temperature deficit equals -C times the difference between T!n at nominal conditions (350°C) and the sodium temperature at cold shutdown (230"C) Fuel metal oxide Built-in overreactivity to compensate for design uncertainties 1 + 1 1 ± 1 Burn-up reactivity swing 1 1.5 Ovcrrcactivity, Begin of Cycle, Hot Full Power 2± 1 2.5 ± 1 To be compensated per control rod (with one / 5 rod stuck in an out-position) 0.4+0.2 0.5±0.2 Shutdown requirement for each control rod: power deficit 0.33 1.95 power/flow deficit 0.29 0.34 temperature deficit 0.41 0.48 shutdown margin 1.00 L00 2.4±0.2 4.3+0.2 Total required worth per control rod 2.6 4.5 As stated earlier, most severe accident analyses found in literature are related to the unprotected LOHS, TOP and LOF events, with a very mild form of a TOP accident. These accidents will not lead to core damage if the various mitigating phenomena are active (control rod stops active, large pump coastdown time, GEM's active, sufficiently low nominal power density). Other, more severe transients, involving core damage, cannot be analysed in the same detail with the same calculational tools (and certainly not with the quasi-static approach of the present study). For a recent design of the metal- fuelled PRISM (with a low linear power rating) some - more qualitative - results of analyses of such severe accidents have been reported [9]. We can mention: • TOP not properly limited by control rod stops: fuel melting will occur, as well as severe clad damage; fuel will be expelled. The accident is said to be terminated "benignly" since the molten fuel will be swept out of the core by the sodium flow. • Degraded LOF (i.e., without pump coastdown or active GEM's): sodium boiling will occur as well as cladding failure and fuel dispersion. 24 ECN-R-94-011 Discussion • Gas cntrainment (e.g. from the upper plenum): sweepthrough of a gas bubble would result in core damage (the gas amount is not mentioned, neighter is the involved sodium void reactivity worth mentioned). The energetics involved in this accident are said to be sufficiently low that they do not challenge the primary sodium boundary (otherwise stated: the primary coolant boundary should be designed so that it can contain such severe accidents). Such an enumeration of possible core-disruptive accidents cannot, by definition, be exhaustive. We may refer to the unexpected events in French LMFBR's which led to the closure of these reactors. In this connection the positive sodium void reactivity of the ALMR (about 5 $ upon complete core voiding) remains a point of concern, irrespective of the question whether one can think of an event with complete core voiding or not. Recent years have shown a new trend in safety considerations of light water reactors. It was noticed that several measures had improved the safety of the reactor under operating conditions, but that the safety during shutdown, e.g. during refuelling, had stayed behind. This has led to new points of view and additional safety measures. It seems appropriate to include such considerations in the safety analysis of the ALMR. One could think of accidents during refuelling, when the reactor vessel is not hermetically sealed. In the eighties experiments have been conducted with the EBR-II reactor, in which the unprotected LOHS and LOF accidents were imitated [20]. These experiments confirmed the expected inherent shutdown of the reactor. It should be noticed, however, that EBR-II differs rather much from PRISM or other fast reactors. In Table 10 a comparison can be found of the reactivity coefficients of several fast reactors. Table 10 Reactivity coefficients of several fast reactors, expressed in 106hkl°C [18] Reactor EBR-II PRISM Superphénix FFTF Fuel metal metal oxide oxide*' Dopplcr -0.4 -6.1 -12.0 -14.6 Na density -8.7 +6.7 + 6.0 -0.7 Radial expansion -9.3 -6.9 -10.0 -22.0 Axial expansion -4.8 -2.7 -2.0 - 1.8 *J Reference 18 erroneously states that FFTF has a metallic core; see also Ref. 21 The very small value of the Doppler coefficient of EBR-II is quite remarkable, as well as the fact that its sodium density coefficient is not positive but strongly negative, which is due to its small core dimensions. So, EBR-II has very favourable properties for an inherently safe evolution of LOHS and LOF experiments; sodium voiding is of no concern. Extrapolation of the EBR-II results to PRISM is very risky, the more so because of the complicated radial expansion of PRISM. This is recognized by GE: they state that the "inherent safety" of PRISM should be demonstrated by full-scale experiments with a prototype reactor. In this connection we can mention, as a ECN-R--94-011 25 On the Safety of the ALMR nice example, the measurements of reactivity coefficients in FFTF, which together with the thorough analysis and interpretation of these measurements compel admiration [21]. 26 ECN-R--94-011 5. CONCLUSION A conclusion of this study is that the metal-fuelled ALMR has some properties which are definitely favourable for the evolution of some accidents but call for additional caution with respect to other accidents. The claimed versatility of the reactor (to burn as well as breed actinides) should be considered with some reservation; each new design calls for its own safety analysis. There is not yet a completely crystallized design. A point of concern remains the positive sodium void effect, in view of the possibility of accidents with very serious consequences. Hopefully, further research and development will not lead to an ever-increasing number of "engineered safety features" considered necessary due to shortcomings of the "inherent safety features", which would turn the ALMR into a complex system, vulnerable to human errors. The design of an inherently safe reactor is a difficult, if nqt impossible, task. In fact, the ALMR Team no longer uses such phrases as "inherent safety features" or "inherent safety", preferring instead "passive safety features" and "passive safety" [23]. This is reflected in the new meaning of the acronym PRISM, which nowadays stands for "Power Reactor Innovative Small Module". Fast reactors are indispensable if nuclear energy will ever play an important role worldwide; but, as third-generation reactors, they should also be inherently safe to the highest degree. The author is grateful to W.M.P. Franken for his interest in this study and some valuable suggestions. ECN-R--94-011 27 On the Safety of the ALMR 28 ECN-R--94-011 6. LITERATURE Calculations of GE: [I] R.C. Berglund et al., Nucl. Techn., Vol. 86, p. 22-29 (July 1989). [2] R.C. Berglund et al., Proc. Int. Topical Meeting on Safety of Next Generation of Power Reactors, Seattle, 1988, p. 599-605. [3] C.L. Cowan et al., Proc. Int. Topical Meeting on Reactor Physics, Mathematics and Computation, Paris, 1987, p. 296-305. [4] P.R. Pluta et al., Adv. in Nucl. Sci. and Techn., Vol. 19, p. 109-203 (1988). [5] P.M. Magee et al., Proc. IAEA Specialists Meeting on Passive and Active Safety Features of LMFBRS, Oarai, Japan, Nov. 1991. [6] R. Tupper et al., "Reactivity Control and Shutdown System for the U.S. ALMR". Private Comm. to K. Brinkmann (ECN). [7] A. Hunsbedt et al., Proc. ASME Winter Meeting, Anaheim, Cal., Nov. 1992 (Session on Thermal Hydraulics of Advanced and Special Purpose Reactors). [8] J.H. Bultman et al., "Actinide Breeding and Burning in Metallic and Oxide Fueled ALMR Cores". Paper presented at Global'93, Seattle, September 1993. (Coproduction of GE and ECN.) [9] J.E. Quinn, Private Comm. (May 1992). Calculations ofANL: [10] D.R. Pedersen et al., "Safety Aspects of the U.S. Advanced LMR Design". In: CONF-890841--3. (Coproduction of ANL, GE and US DoE.) [II] Ch.E. Till and Y.I. Chang, Adv. in Nucl. Sci. and Techn., Vol. 20, p. 127-154 (1989). [12] D.C. Wade and E.K. Fujita, Nucl. Sci. and Eng., Vol. 103, p. 182-195 (1989). [13] D.R. Pedcrsen and B.R. Scidcl, Nucl. Safety, Vol. 31, No. 4, p. 443-458 (1990). [14] D.C. Wade and Y.I. Chang, "The Integral Fast Reactor (IFR) Concept: Physics of Operation and Safety". Private Comm. to K. Brinkmann (ECN). Calculations of other institutes: [15] K.O. Ott (Purdue Univ.), Nucl. Sci. and Eng., Vol. 99, p. 13-27 (1988). [16] D.H. Nguyen (LLNL), Nucl. Techn., Vol. 91, p. 61-74 (1990). [17] G.J. Van Tuyle et al. (BNL), Nucl. Techn., Vol. 91, p. 165-184 (1990). [18] G.J. Van Tuyle et al. (BNL), Nucl. Techn., Vol. 91, p. 185-202 (1990). [19] G.J. Van Tuyle et al. (BNL), "Summary of Advanced LMR Evaluations PRISM and SAFR". NUREG/CR-5364 (1989). Experiments in EBR-II and FFTF: [20] L.K. Chang et al. (ANL), Nucl. Safety, Vol. 28, No. 2, p. 199-211 (1987). [21] D.H. Nguyen (LLNL), Nucl. Techn., Vol. 91, p. 61-74 (1990) (same as Ref.[16]). ECN-R-94-011 29 On the Safety of the ALMR Other references: [22] H. van Dam, Rep. Prog. Phys., Vol. 11, p. 2025-2077 (1992). [23] P.M. Magee (GE), Private Comm. (Febr. 1994). 30 ECN-R--94-011