Nuclear Reactors and Safety

30. Nuclear Reactors and Safety

April 30 – May 18, 2018 Albuquerque, New Mexico, USA

Sandia National Laboratories is a multimission laboratory managed and operated by National Technology and Engineering Solutions of Sandia LLC, a wholly owned subsidiary of Honeywell International Inc. for the U.S. Department of Energy’s National Nuclear Security Administration under SAND2018-4015 PE contract DE-NA0003525.

Reactors and Safety

Learning Objectives

After completing this module, you should be able to: • Describe key characteristics of pressurized water reactors (PWR) and research reactors • List five generic types of reactor safety systems • Recognize importance of protecting safety equipment

The Twenty-Seventh International Training Course Page 1 30 – Nuclear Reactor and Safety

Reactors and Safety

Reactor Steam Cycle

• Fission heat transferred to water • Water heated to steam Water also is necessary to slow down (moderate) . Direct (1-Loop) – Within reactor neutrons for the chain . Indirect (2-Loop) – Outside reactor in reaction to occur heat exchanger / steam generator

Boiling Water Pressurized Water Reactor (BWR) Reactor (PWR)

Courtesy of Nuclear Engineering International 3

Reactors and Safety

Reactor Steam Cycle (cont’d)

• Fission heat transferred to liquid water • Water heated to steam • Steam turns turbine-generator to produce electricity • Condenser water removes heat to increase efficiency . Once-through – natural or artificial body of water . Cooling towers • Wet • Dry

The Twenty-Seventh International Training Course Page 2 30 – Nuclear Reactor and Safety

Reactors and Safety

Multiple Barrier Containment

• Four major elements of reactor multiple-barrier containment for fission products 1. Pellet

2. Cladding

3. Primary System

4. Reactor Containment Building

Reactors and Safety

BWR/PWR Fuel

• Pellets: UO2 • Fissile: 235U 2-4 wt% • Cladding: Zircaloy

Research Reactors

• Fuel Material – UO2 • 20-90+wt% 235U • Clad rods or plates – aluminum, zirconium, steel, ...

The Twenty-Seventh International Training Course Page 3 30 – Nuclear Reactor and Safety

Reactors and Safety

PWR Fuel Bundles

Research Reactors • Single elements, small rod or plate bundles

Reactors and Safety

PWR Safety and Control Rods / Clusters

Research Reactors • 12+ Safety / Control Rods • 1 Safety Rod / 2 Control Rods 8

The Twenty-Seventh International Training Course Page 4 30 – Nuclear Reactor and Safety

Reactors and Safety

PWR Primary System

Research Reactors • Pressurized vessel / forced circulation • Open pool / natural circulation 9

Reactors and Safety

Reactor Safety

• Prevent accidents • Take protective actions . Identification and correction • Mitigate . Long-term response to and control of consequences • Conduct safety analyses

The Twenty-Seventh International Training Course Page 5 30 – Nuclear Reactor and Safety

Reactors and Safety

Reactor Energy Sources

• 98% retention of radioactive products in fuel pellets . Provide cooling . Prevent fuel melting • Stored energy in fuel, coolant, and structures • Nuclear transients . Increased power level . Large power pulse • Decay heat from fission products • Chemical reactions among fuel, cladding, and coolant • External events (natural, such as floods; human caused)

Reactors and Safety

Design-Basis Accidents

• The basis for assessing the overall safety acceptability of a particular reactor design • Classifications include: . Overcooling and undercooling . Loss-of-flow (LOFA) and Loss-of-coolant (LOCA) . Reactivity increase / neutron multiplication . Failure to shut down (“SCRAM”) . Spent-fuel system-radioactivity release . External events (natural or human-caused events) • Beyond-design-basis accidents

The Twenty-Seventh International Training Course Page 6 30 – Nuclear Reactor and Safety

Reactors and Safety

Generic Safety Systems

• Provide mitigation by . Prevent overheating, fuel melting, and other damage . Prevent large-scale dispersal of fission products . Reliability is enhanced through redundancy in subsystem function and location • Five generic safety systems 1. Reactor trip 2. Emergency core cooling 3. Post-accident heat removal 4. Post-accident radioactivity removal 5. Containment integrity

Reactors and Safety

Generic Reactor Safety Systems 4. PARR – Removal of Radionuclides 5. CI – Prevention of Dispersal of from Containment Atmosphere Radionuclides to Environment

1. RT – Rapid Shutdown of Reactor to Limit Core Heat Production

3. PAHR – Removal of Heat from Containment to Prevent 2. ECC – Core Cooling to Prevent Overpressurization Release of Radionuclides from Fuel 14

The Twenty-Seventh International Training Course Page 7 30 – Nuclear Reactor and Safety

Reactors and Safety

Reactor Trip / Emergency Core Cooling

1. Reactor trip (RT) (“SCRAM”) • Control rod . Neutron poison control rods (also used for insertion routine control) • Moderator . Injection of soluble boric-acid poison dump 2. Emergency core cooling (ECC) . Injection of borated water (cooling and reactivity reduction) • Coolant • Multiple trains injection • High, intermediate, or low pressure • Pool natural • Coincides with needs versus event history circulation . Recirculation of coolant • From reactor building sump • Long-term coolant supply 15

Reactors and Safety Post-Accident Heat / Radioactivity Removal 3. Post-accident heat removal (PAHR) . Coolant temperature reduction • Heat exchangers for ECC water recirculation • Heat . Containment-building pressure control exchanger • Containment-atmosphere coolers • Steam-condensing water sprays 4. Post-accident radioactivity removal (PARR) . Filter chemically active iodine and aerosol / particulate constituents . Noble-gas constituents can only be contained – or released in a controlled manner • Filtration . Containment sprays to remove radioactivity • Water sprays remove chemically reactive radioactive material • Additives can increase removal, e.g., of elemental iodine

The Twenty-Seventh International Training Course Page 8 30 – Nuclear Reactor and Safety

Reactors and Safety

Containment Integrity

5. Containment integrity (CI) . Last line of defense against fission-product release . Building: Leak-tight steel liner (pressure vessel); thick reinforced concrete . Isolate penetrations, e.g., with remotely operated valves . Other safety features control overall pressure

Research Reactors • Containment • Confinement (negative pressure and filter) • Open pool / water volume

Reactors and Safety

PWR

Research Reactors – Decreasing complexity 18

The Twenty-Seventh International Training Course Page 9 30 – Nuclear Reactor and Safety

Reactors and Safety

Case Study: Three Mile Island Nuclear Station

Reactors and Safety

TMI-2: Accident Sequence

• Before 4 a.m. on March 28, 1979 . Running at 97% power . Seemingly minor problems • Small loss of coolant through pressurizer valve to drain tank • Emergency feedwater valves closed – Post-maintenance – Unintentional, unknown to operators • Blockage in the demineralizer for steam-generator water

The Twenty-Seventh International Training Course Page 10 30 – Nuclear Reactor and Safety

Reactors and Safety

4:00:36 a.m. March 28, 1979

• INITIATOR: Unable to clear demineralizer blockage • No main feedwater • Main feedwater pump tripped off-line • Turbine tripped off-line • Emergency feedwater pump auto-started • Pressurizer pilot-operated relief valve (PORV) opened to reduce pressure • Reactor tripped on overpressure signal - - - Normal system response (first 8 sec) - - - . Chain-reaction shutdown . Decay-heat source remains

Reactors and Safety

The Twenty-Seventh International Training Course Page 11 30 – Nuclear Reactor and Safety

Reactors and Safety

TMI-2: Accident Sequence

• Emergency feedwater blockage Rumored to . Prevented steam-generator function be sabotage! . Distraction until valves re-opened . Overall effect on accident progression uncertain • PORV indicated “closed” (solenoid was de-energized) . PORV actually was stuck open . Unrecognized small-break loss of coolant accident (SBLOCA) in progress • High-pressure injection (HPI) auto-start • HPI throttled . Open PORV . Spurious indication of too much water

Reactors and Safety

TMI-2: Accident Sequence • Control room situation . Included 1300 annunciator lights; single klaxon . 800 alarm initiations within 14 minutes • Decay heat . 200 MWt at shutdown • → 40 MWt at 1 hr . Electric arc furnace • 130 MW-hr ↔ 300 ton Steel . Fuel melting

The Twenty-Seventh International Training Course Page 12 30 – Nuclear Reactor and Safety

Reactors and Safety

Consequences

• Environmental . Brought under control rapidly . Minimal damage . “Public apprehension” • Functional / Financial . Loss of TMI-2 reactor . Clean-up costs . 6.5-yr to restart TMI-1 • Nuclear industry . Backfit and license-related costs . Reactor orders cancelled

Reactors and Safety

Research Reactor Sabotage Scenario Types

• Direct Attack: Adversary brings energy to disperse radioactive material . Explosive or incendiary attack on inventories of radioactive material . Prevented by denial of access to radioactive material inventories • Indirect Attack: Adversary uses energy in facility process/ equipment to disperse radioactive material . Reactivity Insertion Accident (RIA) . Disable SCRAM system and heat removal . Disable decay heat removal . Disable other safety equipment required to prevent radioactive material release . Prevented by denial of access to safety equipment 26

The Twenty-Seventh International Training Course Page 13 30 – Nuclear Reactor and Safety

Reactors and Safety

Accident vs. Sabotage

TMI Accident Sabotage Equivalent Condenser blocked Condenser disabled Valves closed Close / damage valves Pressurizer open Any major coolant loss Injection throttled Injection disabled Uncover Fuel Pumps turned off Pumps disabled Hydrogen ignition Ignite hydrogen

Research Reactors • Disable cooling • Uncover fuel

Reactors and Safety

Protect Safety Equipment

• Protecting safety equipment . Engineering Safety Aspects of the Protection of Nuclear Power Against Sabotage (NSS-4) . Anything that can happen by accident can be made to happen • Consider threat capabilities • Consider events with radioactive release or where one more failure (sabotage) would cause radioactive material release • Identifying Vital Areas . Identification of Vital Areas at Nuclear Facilities (NSS-16) . Detailed guidance for identification of vital areas

The Twenty-Seventh International Training Course Page 14 30 – Nuclear Reactor and Safety

Reactors and Safety Case Study: Reactivity Insertion Accident at SL-1 Reactor

Reactors and Safety

Stationery Low Power No. 1 (SL-1) Reactor

• 3-MWT prototype for proposed arctic military application • Complex design for research reactor . Direct, boiling water cycle . 200 kW electric, 400 kW heat (disposed of directly to the environment) • 14 kg HEU (93%) in 40 aluminum fuel-plate assemblies • 9 T-shaped control rod assemblies • Steel vessel 1.4-m diameter × 4.4-m high (4.5-ft diameter × 14.5-ft high) • Turbine, condenser, piping, pumps • Multiple shielding types

The Twenty-Seventh International Training Course Page 15 30 – Nuclear Reactor and Safety

Reactors and Safety

SL-1 Schematic

Reactors and Safety Confinement and Support Buildings

Condenser & Ventilation

Operating Floor Level

Vessel & Shielding

Confinement Building Support Building 32

The Twenty-Seventh International Training Course Page 16 30 – Nuclear Reactor and Safety

Reactors and Safety

Accident Information

• January 3, 1961 – Three shifts . Maintenance of auxiliary systems . Reactor core measurement preparation (required vessel head and control rod removal) . Control rod drive reinstall – 3 operators • Site central alarm with cause unknown . Fire crew responded: Support Building radiation level 25 r/hr . Health Physics responded: Reactor Building (Confinement Building) radiation level 200 r/hr • Operator withdrew central (highest worth) control rod “as rapidly as he was able” • Caused Reactivity Insertion Accident (RIA) (“excursion”)

Reactors and Safety

Accident Video

The Twenty-Seventh International Training Course Page 17 30 – Nuclear Reactor and Safety

Reactors and Safety Accident vs. Controlled-Excursion Example • SL-1 accident scenario . System supercritical . Power increased in a 4-ms period . Coolant steam voids and fuel element expansion – and ultimately, destruction – terminated the excursion • Controlled-excursion example . Sandia’s Annular Core Research Reactor (ACRR)

• Special control rode fired (N2 pressure) out of the core • System begins a “prompt supercritical” excursion https://www.youtube.com/watch?v=pa0Fmcv83nw • Temperature feedback first slows chain reaction, then causes a self-shutdown before any fuel damage occurs . . .

Reactors and Safety Consequences and Lessons Learned • Consequences . Steam explosion scattered the core . Water hammer lifted vessel ~3 meters . Total energy release equivalent to ~28 kg of TNT . Two operators killed immediately, and the third died soon after from head injury . Reactor room highly contaminated with fission products • Dose rate 0.5 to 1 Sv/h (50 to 100 rem/h) • Only slight radiological release outside building . Three lessons for similar (prototype) reactors . More than a single control rod for critical . Minimize manual control rod operation . Pressure-tight containment required

The Twenty-Seventh International Training Course Page 18 30 – Nuclear Reactor and Safety

Reactors and Safety

Damage

Core, Vessel, Control Rods Steel Plate and Cooling Lines

Reactors and Safety

Protect Safety Equipment

• Protect Control Rod Safety . Identify decay heat removal requirements from safety analysis . If a Probabilistic Safety Analysis (PSA) has been prepared, it likely documents the consequences of loss of decay heat removal • Protect against Disabled Decay Heat Removal . Locate required safety equipment and identify disablement approaches • Insider tampering • Local sabotage • Sabotage controls / power • Attack on primary coolant boundary for water-cooled reactors • Vehicle bombs / standoff attacks (if within the DBT) may disable both decay heat removal and confinement

The Twenty-Seventh International Training Course Page 19 30 – Nuclear Reactor and Safety

Reactors and Safety

Protect Other Safety Equipment

• Operating Experience (IAEA- TECDOC-1762) • Anything that can happen by accident can be made to happen . Consider threat capabilities . Consider events with radioactive release or where one more failure (sabotage) would cause radioactive material release

Reactors and Safety

IAEA TDL-004

• Nuclear Security Management for Research Reactors and Related Facilities • Single source guidance for all aspects of nuclear security . Nuclear materials and radioactive materials . Sabotage and theft protection • Identifies synergies between theft and sabotage protection • Provides detailed guidance for establishing security systems, measures, and programs meeting NSS-13 recommendations

The Twenty-Seventh International Training Course Page 20 30 – Nuclear Reactor and Safety

Reactors and Safety

Design for Unique Security Challenges

• Design for easy experiment / core reconfiguration . More difficult to control access to equipment that: • Reconfigures core configuration • Controls reactivity • Broad visual access for teaching . More difficult to secure information about potential equipment sabotage targets • Need for multi-national experimenter access to critical areas . More difficult to verify trustworthiness of individuals with access to critical areas

Reactors and Safety

Summary • Safety systems provide mitigation by . Preventing overheating, fuel melting, and other damage . Preventing large-scale dispersal of fission products . Reliability is enhanced through redundancy in subsystem function and location • Five generic safety systems 1. Reactor trip 2. Emergency core cooling 3. Post-accident heat removal 4. Post-accident radioactivity removal 5. Containment integrity • Protect safety equipment … anything that can happen by accident can be made to happen 42

The Twenty-Seventh International Training Course Page 21