THE SAFETY CONCEPT OF THE FRM-II

A. Axmann and K. Boening Technische Universitat¨ Munchen,¨ Germany

Abstract This paper gives a brief report on the technical data and the construction of the new FRM-II. The safety concept is described and discussed in connection with licensing aspects of inpile experimental installations.

1 THE DESIGN OF THE FRM-II The new research reactor FRM-II will replace the old FRM (Forschungsreaktor Munchen)¨ of the Tech- nical University of on its campus at . In what follows a short description will be given with the help of several illustrations. Figure 1 shows the FRM-II facility which has been erected close

to the old FRM (on the left). The reactor building (on the right) is 32 m high and has the cross section of a square of 42x42 m . The thickness of the walls of the building is 1.8 m. Theses walls consist of reinforced concrete, are airtight and withstand the crash of a military jet. The new guide hall can be seen in the middle of the photography and the air cooling tower in the foreground.

Fig. 1: Overview of the new research reactor FRM-II at Garching

Table 1 gives a listing of the main design features of the reactor.

26 The new High-Flux Research Reactor FRM-II of the Technical University of Munich at Garching

Thermal Power (P): 20 MW

 Thermal ( ): ¡£¢¥¤§¦©¨  (unperturbed, outside of the core) Flux Ratio ( /P): highest of the world Fuel Element (FE): only one, compact, cylindrical 24 cm diam. (active zone 70 cm high)

Uranium Loading: 8.1 kg U, highly enriched (93  ), high U density

(graded, 3.0 and 1.5 gU/cm  ), in 113 involute fuel plates Reactor Cycle: 52 full power days, with 5 cycles per year

Light Water Circuit (H O): primary cooling circuit (for FE), virtually closed, also acting as in-core moderator

Heavy water Tank (D O): external moderator and reflector, cylindrical (both 250 cm diameter and height)

Experimental Utilization: with beam tubes, irradiation channels, etc., in D O tank 1 Control Rod: central, Hf absorber with Be follower, also acting as independent shutdown system 5 Shutdown Rods: independent shutdown system, 5 rods in

D O tank, fully withdrawn during operation

Table 1: Main design features of the FRM-II

Figure 2 shows a view of the fuel element during the fabrication process. The 113 plates are involutely curved so that the coolant channels between them have a constant width of 2.2 mm; they are welded to the inner and outer core tubes.

Fig. 2: View of the fuel element (consisting of 113 involutely curved plates) during fabrication.

Figure 3 shows a view of the experimental hall (ground floor level) with the reactor block in the center.

27 Fig. 3: View of the experimental hall of the FRM-II with the central reactor block

Figure 4 shows a vertical cross section through the reactor pool, storage pool and primary cell (from left to right).

Fig. 4: Vertical cross section through the reactor pool, storage pool, and primary cell (from left to right). The reactor operation hall in the upper part of the building is separated from the experimental hall in the lower part by an airtight ceiling.

28 The reactor operation hall in the upper part of the building is separated from the experimental hall in the lower part by an airtight ceiling. The H O pool water is kept under all accident conditions - even in the case of an airplane crash. This aim is met by connecting the two ceilings of the building to the reactor block via flexible joints in order to keep shock waves away from it. For the same reason the reactor block is separated from the outer walls of the reactor building by a gap (left side of Fig. 4). Further, the reactor block is made out of watertight reinforced concrete and a steel liner. The air flow of the ventilation system is directed from the experimental hall to the reactor hall by a small pressure difference. The ventilation system of the reactor hall is designed to filter and control the air release through the stack particularly in the case of accidents. The H O primary circuit is is totally placed inside of the reactor block. The four primary pumps and the two heat exchangers to the secondary circuit are mounted in the primary cell which is part of the watertight reactor block. In Fig. 4 one can also identify the first fast shutdown system which consists of five shutdown rods in the D O moderator which are totally withdrawn during operation. The second fast shutdown system consists of the central control rod which is coupled to the actuator by a magnetic clutch so that it can be released immediately. Figure 5 shows a view of the reactor pool. On top of the D O moderator tank the actuators of the control rod and of the five shutdown rods are mounted. The inlet of the primary circuit, which is virtualy closed, into the central channel tube of the moderator tank, where the single fuel element is placed, consists of the horizontal tube coming from the upper right corner of the picture. Three emergency pumps feed cooling water from the pool into this tube after shutdown of the four primary pumps. Three hours later the emergency pumps can be switched off, too, whence two redundant flaps in the horizontal part of the primary circuit inlet tube open just by gravity so that the residual decay heat can be removed by natural convection.

Fig. 5: View of the reactor pool. On top of the D O moderator tank the actuators of the control rod and of the five shutdown rods are mounted.

Figure 6 shows a horizontal cross section through the reactor pool in the experimental plane. One

29 sees the cylindrical reactor core in the central channel tube of the moderator tank, surrounded by the five shutdown rods (in their shutdown position) and the experimental facilities as horizontal beam tubes

etc.. One beam tube is a through tube allowing access from both sides. The beam tubes provide several

barriers to prevent loss of H O pool water or loss of D O moderator. The first barrier is the beam tube itself (with respect to D O) and the compensator tube (with respect to H O) which is water tight connected to the liner of the pool. This tube further penetrates the concrete shielding and so connects the liner with the outer heavy cover plate of the beam tube. In the region of the concrete pool wall a heavy shutter is placed which allows to open and close the neutron beam channels. On the outer cover plate two redundant neutron beam windows are mounted.

Fig. 6: Horizontal cross section through the reactor pool in the experimental plane. One sees the cylindrical reactor core in the central channel tube of the moderator tank, surrounded by the five shutdown rods (in their shutdown position) and the experimental facilities as horizontal beam tubes etc..

30 2 THE SAFETY CONCEPT OF THE FRM-II 2.1 Inherent safety features

Due to its small core the FRM-II provides some essential inherent safety features. The reactor would

become subcritical if the D O in the moderator tank would be replaced by H O or if a substantial fraction

of H O would be mixed into the D O. If the H O in the fuel element would be replaced by D O or if the

H O would be removed from the core (for example due to boiling) the reactor would become subcritical. The essential safety feature concerning handling of the fuel element is that it is highly subcritical in pure

H O without any additional absorber.

2.2 General aspects of the safety concept A large number of guidelines and regulations concerning design, construction and operation of nuclear power plants have to be followed also for a research reactor. The methodology of the safety analysis of the FRM-II, see Table 2, distinguishes between operational events and incidents, design basis accidents and beyond design basis accidents. The safety analysis of operational events and incidents and of the design basis accidents has to be purely deterministic. The arguments to be given for beyond design basis accidents must be plausible.

operation design basis accidents beyond design basis accidents safe operation reactivity, criticality accidents aircraft crashes design features: operational events, incidents core cooling accidents blast waves conditions storm radioactivity accidents loss of core cooling initiating events lightning internal and external fires, (decay heat removal) explosions and floodings loss of both shutdown syst. earthquakes human errors ¡ £¢¥¤§¦©¨ /a probability deterministic analysis, high reliability and solidity of safety plausible demonstrations safety approach, relevant systems and components, single failure criteria building and pool integrity principles conservativity, quality assurance mitigation measures to re- measures duce radiolog. consequ. failure of equipment does not automatic reactor shutdown or disaster control require plant shutdown obligation of manual shutdown 0.3 mSv/a by air- or water path max. 50 mSv 100 mSv radiolog. limits

Table 2: Safety concept of the FRM-II

Operational events and incidents - for example failure of components - need not require plant shutdown. Design basis accidents are incidents with the potential of higher radiological consequences (see bottom line of Table 2). At occurence of such incidents the reactor will be shut down automatically. The design of the reactor must make sure that such incidents do not have radiological consequences or are not expected to occur during plant lifetime. Systematically, three types of design basis accidents have to be distinguished (first three lines of column 2). Some internal and external hazards are constraints of

the analysis (see also column 2).

Beyond design basis accidents must have occurrence probabilities which are small against 10 /a. Mitigation measures must reduce radiological consequences below limits which would demand the con- sideration of public evacuation (column 3). For the FRM-II this demand is fulfilled by maintaining the integrity of building and pool even in the case of aircraft crashes and blast waves from industrial facil- ities. Radiological limits for the environment which are set by the Radiation Protection Ordinance are given in the bottom line of Table 2. Other limits are set especially at normal operation for the personnel and for individuals of the public.

31 2.3 Strategy of the reactor protection The strategy of the reactor protection of the FRM-II is explained in Table 3. Three barriers protect the environment against a release of radioactivity from the reactor (column 1). These barriers are defended by a number of safety functions and technical measures. Core cooling must be guaranteed under all circumstances. A catastrophic breakdown of the primary circuit is excluded by special requirements concerning the solidity and reliability of the materials used. At shutdown of the reactor three redundant emergency pumps are started to remove the decay heat. After three hours the pumps can be switched off and two redundant flaps open so that the residual decay heat can be removed by natural convection. The

primary circuit is open to the pool by a sieve in the low pressure part of the circuit so that the 700 m  of pool water can guarantee the core cooling for long time without active elements. The pool water plays an important role not only for core cooling but also for filtering radioactive releases from the core. During normal operation these releases are due to contaminations of the plates of the fuel element with fissile materials. As a result of a beyond design basis accident radioactivity could be released due to fuel melting. The pool water therefore must be kept under all accident conditions. This aim is met by the watertight reactor block, two walls and three barriers of pool wall penetrations and siphon breakers in all circuits going out of the pool. The last barrier against radioactive release is the confinement of the building and the ventilation system (last line of Table 3).

barriers safety functions technical measures core cooling: fuel matrix - during operation 4 primary pumps and cladding exclusion of primary circuit breakdown - after shutdown of fly wheels primary pumps 3 emergency pumps - long time decay 2 natural heat removal convection flaps

700 m  of pool water reactor shutdown 1 control rod 5 shutdown rods pool water covering of core by water massive, tight reactor block with reactor pool, storage pool and primary cell beam tubes with 2 walls and 3 barriers siphon breakers confinement of control and filtering integrity of building, small radioactive substances of radioactive release leakage closure flaps of ventilation system hierarchic pressure system air circulation system

Table 3: Reactor Protection Strategy

32 2.4 Reactor safety control system The instrumentation of the reactor and the reactor protection system control the safety criteria of the reactor and trigger the safety actions if limits are reached. Table 4 shows the criteria for reactor protection actions for a number of design basis accidents. Each accident has to be monitored by at least two criteria which are diverse (as one can see from column 2) with the measurement circuits being redundant. Only one design basis accident - the hypothetical melt-down of 15 plates of the fuel element - has radiological consequences for the environment. The maximum dose of 1.68 mSv in the environment is low in comparison with the limits set by the Radiation Protection Ordinance. This hypothetical accident is the basis for the layout of the ventilation system.

accident criteria for reactor radiological protection action consequences reactor power reactor period: no radiological excursion: consequences - withdrawal of - start up range control rod during start up or - at power operation - power middle range

d(nflux) -N16)  neutron flux 114 failure of 1 mass flow no radiological primary pump pressure drop consequences failure of all mass flow no radiological primary pumps pressure drop consequences coolant temperature leakage of primary mass flow no radiological

coolant circuit pressure drop consequences

( ¡ 25 cm )

hypothetical melt- ¢ -dose rate dose in the down of 15 fuel - primary circuit environment plates - on pool top (ventilation system 1.68 mSv layout)

Table 4: Design basis accidents - envelope -

Table 5 shows three actions of the reactor protection system:

reactor shutdown by two independent fast systems startup of three emergency pumps closure of ventilation system air outlets in case of a release of radioactivity

Table 5: Reactor protection system actions

33 3 LICENSING ASPECTS FOR IN-PILE EXPERIMENTS According to the German Atomic Law a license is necessary for new installations close to the reactor core and for all types of facilities involving nuclear fissions. The application for the license must include a demonstration of long-term waste handling and disposal (state of the art is direct storage in transportation and storage containers). Such a licence can be granted by the authority without presentation of the safety report to the public if the requirements are fulfilled. Table 6 summarizes these safety requirements for ’inpile experiments’, i.e. for permanent exper- imental installations in the D O moderator tank such as a cold source, hot source, fission converter and irradiation facilities.

the accident control of the reactor must not be affected: - no change of the spectrum of reactor accidents - no change of the radiological consequences of reactor accidents - the load on components of the reactor accident control system must not be increased - the reliability of such components must not be reduced the integrity of barriers between inpile experiments and the reactor pool or moderator tank must be guaranteed during all experimental internal incidents and external hazards the radioactive release of experiments must be covered by the limits set by the reactor license reactor shutdown to avoid damage to the experiments is possible

Table 6: Safety requirements for inpile experiments

ACKNOWLEDGEMENT The safety concept of the FRM-II has been developed by Interatom GmbH and Siemens-KWU in coop- eration with the Technical University of Munich.

34