Outcomes Beginner Student's Book Mike Sayer
https://ebookmass.com/product/outcomes-beginner-students-book-mikesayer/
ebookmass.com
Consultant,FormerlyENEA,Italy
FormerlyUniversityofPisa,Italy
GianniPetrangeli
Butterworth-HeinemannisanimprintofElsevier
TheBoulevard,LangfordLane,Kidlington,OxfordOX51GB,UnitedKingdom 50HampshireStreet,5thFloor,Cambridge,MA02139,UnitedStates
Copyright©2020ElsevierLtd.Allrightsreserved.
Nopartofthispublicationmaybereproducedortransmittedinanyformorbyanymeans,electronicor mechanical,includingphotocopying,recording,oranyinformationstorageandretrievalsystem,withoutpermission inwritingfromthepublisher.Detailsonhowtoseekpermission,furtherinformationaboutthePublisher’ s permissionspoliciesandourarrangementswithorganizationssuchastheCopyrightClearanceCenterandthe CopyrightLicensingAgency,canbefoundatourwebsite: www.elsevier.com/permissions
ThisbookandtheindividualcontributionscontainedinitareprotectedundercopyrightbythePublisher(otherthan asmaybenotedherein).
Notices
Knowledgeandbestpracticeinthisfieldareconstantlychanging.Asnewresearchandexperiencebroadenour understanding,changesinresearchmethods,professionalpractices,ormedicaltreatmentmaybecomenecessary.
Practitionersandresearchersmustalwaysrelyontheirownexperienceandknowledgeinevaluatingandusingany information,methods,compounds,orexperimentsdescribedherein.Inusingsuchinformationormethodsthey shouldbemindfuloftheirownsafetyandthesafetyofothers,includingpartiesforwhomtheyhaveaprofessional responsibility.
Tothefullestextentofthelaw,neitherthePublishernortheauthors,contributors,oreditors,assumeanyliability foranyinjuryand/ordamagetopersonsorpropertyasamatterofproductsliability,negligenceorotherwise,or fromanyuseoroperationofanymethods,products,instructions,orideascontainedinthematerialherein.
BritishLibraryCataloguing-in-PublicationData
AcataloguerecordforthisbookisavailablefromtheBritishLibrary
LibraryofCongressCataloging-in-PublicationData
AcatalogrecordforthisbookisavailablefromtheLibraryofCongress
ISBN:978-0-12-818326-7
ForInformationonallButterworth-Heinemannpublications visitourwebsiteat https://www.elsevier.com/books-and-journals
Publisher: BrianRomer
AcquisitionEditor: MariaConvey
EditorialProjectManager: JoannaCollett
ProductionProjectManager: SruthiSatheesh
CoverDesigner: GregHarris
TypesetbyMPSLimited,Chennai,India
4.3
4.2.4ExampleofaCategory4Accident:MainSteamLineBreak......................54
4.2.5ExampleofaCategory4Accident:SuddenExpulsionofaControl RodFromtheCore........................................................................................56
4.2.6ExampleofaCategory4Accident:BreakoftheLargestPipe ofthePrimarySystem(LargeLOCA)..........................................................59
4.2.7ExampleofaCategory4Accident:FuelHandlingAccident......................61 4.2.8AreaAccidents...............................................................................................62
5.1
5.2 FuturePlants:ExtremeandPracticableSolutions..................................................71
5.3 SevereAccidentManagement:ThePresentStateofStudiesand Implementations.......................................................................................................75
5.4 DataonSevereAccidents........................................................................................76 5.5 DescriptionsofSomeTypicalAccidentSequences................................................76
5.5.1LossofStationElectricPowerSupply(TE 5 Transient 1 Loss ofElectricalSupply)......................................................................................76
5.5.2LossofElectricPowerWithLossofCoolantAccident(LOCA) FromthePumpSeals(SE 5 SmallLOCA 1 LossofElectricPower)........79
5.5.3InterfacingSystemsLOCA(V).....................................................................79
5.5.4LargeLOCAWithFailureoftheRecirculation(ALFC).............................80
5.5.5SmallLOCAWithFailureoftheRecirculation...........................................81
5.6 “SourceTerms”forSevereAccidents.....................................................................81
6.1 TheMostInterestingReleasesforSafetyEvaluations...........................................85
6.2 DispersionofReleases:Phenomena........................................................................87
6.3 ReleaseDispersion:SimpleEvaluationTechniques...............................................91
6.4 FormulaeandDiagramsfortheEvaluationofAtmosphericDispersion...............93
6.5 CalculationofAtmosphericDispersionbyComputerFluidDynamicsCodes......99
CHAPTER7HealthConsequencesofReleases
7.1 ThePrinciplesofHealthProtectionandSafety....................................................103
7.2 SomeQuantities,Terms,andUnitsofMeasureofHealthPhysics......................103
7.3 TypesofEffectsofRadiationDosesandLimits..................................................105
7.4 EvaluationoftheHealthConsequencesofReleases............................................106
7.4.1EvaluationofInhalationDosesFromRadioactiveIodine..........................106
7.4.2EvaluationofDosesDuetoSubmersioninaRadioactiveCloud..............106
7.4.3EvaluationoftheDosesofRadiationFromCaesium-137Deposited ontheGround(“Ground-Shine”Dose).......................................................107
7.4.4EvaluationoftheDoseDuetoDepositionofPlutonium ontheGround..............................................................................................107
7.4.5IndicativeEvaluationofLongDistanceDosesforVerySerious AccidentstoNuclearReactors....................................................................107
7.4.6DirectRadiationDoses................................................................................107
14.1.3FailureProbabilityofNuclearVessels......................................................153
14.1.4VesselMaterialEmbrittlementduetoNeutronIrradiation......................158
14.1.5PressurizedThermalShock.......................................................................160
14.1.6TheReactorPressureVesselofThreeMileIsland2...............................160
14.1.7GeneralPerspectiveontheEffectofSevereAccidents onthePressureVessel...............................................................................161
14.1.8RecommendationsforthePreventionofHypotheticalAccidents
14.2.1EvolutionoftheRegulatoryPositions.......................................................165
14.2.2ProblemsIndicatedbyExperience............................................................166
14.2.3LeakDetectioninWaterReactors............................................................168
14.2.4ResearchProgramsonPiping....................................................................169
29.2 RiskConceptsandEvaluationsinNuclearInstallationSafety.............................323
29.3 ResidualRisk:TheConceptofLoss-of-LifeExpectancy.....................................326
29.4 RiskFromVariousEnergySources......................................................................326
29.5 RisktoVariousHumanActivities.........................................................................327
29.6 AretheRiskAnalysesofNuclearPowerPlantsCredible?..................................327 29.7
Appendix1:TheChernobylAccident..............................................................................................335 Appendix2:CalculationoftheAccidentPressureinaContainment.............................................343 Appendix3:TableofSafetyCriteria................................................................................................
Appendix4:DoseCalculations.........................................................................................................373 Appendix5:SimplifiedThermalAnalysisofanInsufficientlyRefrigeratedCore.........................385 Appendix6:EuropeanRequirementsRevisionE,2016..................................................................389 Appendix7:NotesonFractureMechanics.......................................................................................413 Appendix8:USGeneralDesignCriteria.........................................................................................421 Appendix9:IAEACriteria...............................................................................................................435 Appendix10:PrimaryDepressurizationSystems............................................................................437 Appendix11:Thermal-HydraulicTransientsofthePrimarySystem..............................................445 Appendix12:TheAtmosphericDispersionofReleases..................................................................461 Appendix13:RegulatoryFrameworkandSafetyDocuments.........................................................467 Appendix14:USNRCRegulatoryGuidesandStandardReviewPlan...........................................477 Appendix15:SafetyCage................................................................................................................493 Appendix16:CriteriafortheSiteChart(Italy)...............................................................................499 Appendix17:TheThreeMileIslandAccident................................................................................503 Appendix18:OtherExamplesofPracticalUseofThisBook........................................................519 Websites.............................................................................................................................................563 Index..................................................................................................................................................565
Preface
Ihavewrittenthisbookbecauseofmyfirmbeliefthatitisnecessarytotrytogatherandtopreserveinwrittenform,andfromoneperspective,theaccumulatedmemoryandexperienceinthe fieldofnuclearsafetyandradiationprotection.Thisisparticularlyimportantforcountrieswhere nuclearenergyexploitationhasbeenstopped,butwhereitmighthavetoberesumedinfuture.The mainaccentofthisbookisonNuclearSafety.
Fromanotherpointofview,manyareasdevelopedinnuclearsafetystudiesareofinterestin thesafetyofprocessplantstooand,therefore,itisworthwhilewritingaboutthem.Giventhisperspective,Ihavetriedtocollecttheideas,thedata,andthemethodswhich,inmanydecadesofprofessionalworkinseveralcountries,inmyopinionarethemostusefulforevaluationof“integrated system”oftheplantsafety.
Ihaveemphasizedthecompletesite plantsystemmorethansingledetails,sothedataandthe methodsdiscussedarenotthoseappliedinthemanyspecializeddisciplinesdevotedtothein-depth studyofsafetybutarethoserequiredforoverall,firstapproximation,assessments.Inmyopinion, suchassessmentsarethemostusefulonesforthedetectionofmanysafety-relatedproblemsina plantandforthedraftingofacompletepictureofthem.Themoreaccurateandprecisethemethods are,themoreessentialitisintheoptimizationphaseofplantdesignandofitsoperationalparameters.Specialistsinreactorengineering,thermalhydraulics,radiationprotection,andstructural responseissuesmay,therefore,besurprisedtoreadthatsimplemethodsandshortcutssuggested hereareveryuseful,asmyexperienceandthatofother“generalists”suggestions.
Inaddition,thisbookaimstocoversomegeneralandsomeunusualtopics,suchastheoverall conditionstobecompliedwithbya“safe”plant,thetransboundaryconsequencesofaccidentsto plantsortospecificactivities,theconsequencesofterroristacts,andsoon.
Onsomecrucialissuestheviewsoftheworld’snuclearspecialistsarenotthesame,forexample,theviewsinWesterncountriescomparedwiththoseinformersoviet-bloccountriesonthepreChernobylapproachtonuclearsafetyinEasternEurope:theWestconsideredthesovietapproach tobearelativelylenientone,whilethesovietsthoughtthattheyconcentratedonpreventionof accidentsratherthanonthemitigationofthem.Inthesecasesthetexttriestobeobjectiveandto quotethe“Eastern”viewbesidesthe“Western”one,leavingfutureengineersandtechnicaldevelopmentstodecideonthisissue.
Exceptwhereexplicitlyindicated,thetextreferstothepressurizedwaterreactor.Extrapolation tootherkindsofplantsis,however,possible.
Thetextcomplieswithinternationallyrecognizedsafetystandards,andinparticularwith InternationalAtomicEnergyAgency(IAEA)requirements.
OnoccasionsIhavedigressed,innotes,fromthemainthrustofthetext.Ihavedonethisfor severalreasons:manynotesrelatefactsthatqualifyorjustifywhatiswritteninaprecedingparagraph;someofthemarenumericalexamplesaddedforclarification,whileothersaresimplecommentsandpersonalreflectionsonthesubject.Thesenotesaresetattheendofeachchapter.
Ihaveprovidedalistofreferencesattheendofeachchapter;howeverachapter(Additional references)listssomeorganizationsthatoffer“institutional”references[IAEA,Organizationfor EconomicCooperationandDevelopment(OECD),andUnitedStatesNuclearRegulatory Commission(USNRC)thatisoneoftherichestsourcesofpublicationsamongtheregulatory
bodies].Manyofthesereferencescanbeconsultedandevendownloadedfromthewebsiteslisted intheWebsiteschapter.
Calculationsheetsmentionedinthetextmaybedownloadedfromthepublisher’swebsite (http://dx.doi.org/10.17632/4hc54vnzx6.2);thewaytousethemisdescribedinthetext.
Finally,Iwishtounderlinethatallmyexperiencesuggeststome,aftermanypositiveandnegativelessonslearned,thattoday’snuclearplantscanbecompletelysafeandthatsignificantaccidentscanbeavoided.Thisis,however,onlytrueontheconditionthatsafetyobjectivesare carefullypursuedbytheorganizationsinvolvedintheplants;inthisarena,asitwillbeshown, evenorganizationsapparentlyveryfarfromanyspecificplantmustbe,uptoacertainextent, included(e.g.,thebodiesresponsibleforthegeneralenergystrategyofacountryandthe“media”).
Thissituationdoesnotexcludethatfuturenuclearplantsshouldbe“cheaperandsafer”than today’snuclearplants.TheorganizationWENRA(seeSection1.2.4)hasverycourageouslyputan accentontheneedthatfutureplantsbesaferthanpresentonesbydesign:along-awaitedstatement bymanyprofessionalsinterestedinnuclearsafety.Ipersonally,amongothers,askedtheparticipantstoaclosedmeetingofatopEuropeanOrganizationstothinkovertheoverwhelmingbenefit ofastatementlikethisinthe1980s,eventakingintoaccountthepossiblewronguseofitbysome sectorsofpublicopinionandpress.Itmustberemembered,indeed,thatexistingsafeplantsbenefit fromtheaccumulatedoperationalexperienceandensuingmodificationstoplantfeaturesandtheir operation:thisisanaddedsafetyvaluewhich,forfuturedifferenttypesofplants,mustbeovercompensatedbyanincreaseofsafetythroughdesign.
Ialsostresstheneedthatfutureplantsbecheaperthanpresentones:fromthesafetypointof view,thisfeaturewillmakeplantsurveillanceandsafety-usefulmodificationseasiertoacceptby investors(seeChapter18:NuclearSafetyCriteria).
IamconfidentthatfromthelistofGenerationIVreactorspresentlyunderstudy (Section1.2.4),oneplantwiththeabove-listedcharacteristicswillemerge.Veryrecently,some facts(see NuclearNews,2019 forCanada)seemtoindicatethestartofaninvestor’sinterestin GenerationIVreactors(MOLTENSALTREACTORandHTGR)beyondtheresearchactivities goingoninmanyorganizationsworldwide.
Ingeneralterms,cheaperandsafernuclearreactorsshouldhavethefollowinggood“fundamentals”or“basiccharacteristics”:
•Reducedinternalpressureofcomponents
•Reducedpresenceofhighlycorrosivefluids
•Reducedpresenceofflammablematerials
•Self-shutdowninthecaseofdangerousdisturbances
•Intrinsicallysafesiting(reduceddangerofdestructiveearthquakes,inundations,andslides)
Thechoiceofafuture,cheaperandsafer,reactortype,moreover,shouldnotbeinfluenced(as itmightbe)bytheintertwinedrelationbetweenpeacefulusesofnuclearenergyandmilitaryuses ofit(Uekoetter,2012;McPhee,1974).Inparticular,Thorium-fuelledreactorsshouldnotbe penalized.
Thisissueisnotdealtwithinthisbookforthelackofreliableandpublicnumericaldata. However,inthelightofpastexperienceandchoices,thisissueisimportant.
Iwillbeverygratefultomyreadersforanysuggestionconcerninganyimprovementstothe textandalsocorrectionstothemistakeswhicharecertainlypresentinit.Iamfullyaware,in
particular,ofthesubjectivenatureofthechoiceofthematerial:thesubjectofnuclearsafety,as doesthatconcerningthesafetyofprocessplantsingeneral,hasbecome,overtime,adiscipline comprisingmanyspecificratherautonomoussubsections.Itisnoteasy,therefore,tochoosethe materialtobeincludedinageneraltextlikethisone;inthis,practicalexperienceofwhatisnecessarywhiledoingassessmentworkofplantshasbeenmyguide.
REFERENCES
McPheeJ.,1974.TheCurveofBindingEnergy(Chapters19 22). NuclearNews,ANS(AmericanNuclearSociety),issueApril2019,International,page33.
Uekoetter,F.,2012.Fukushimaandthelessonsofhistory:remarksonthepastandfutureofnuclearpower. Source:RCCPerspectives,No.1,EuropeAfterFukushima:GermanPerspectivesontheFutureNuclear Power.RachelCarsonCenter,pp.9 32.
1.2 ASHORTHISTORYOFNUCLEARSAFETYTECHNOLOGY
1.2.1
THEEARLYYEARS
Thefirstreactor,the“Fermipile”CP1(orChicagoPile1,builtin1942)wasprovidedwithrudimentarysafetysystemsinlinewiththesenseofconfidenceinspiredbythecharismaticfigureof EnricoFermiandhisopinionconcerningtheabsenceofanydangerfromunforeseenphenomena. Thesafetysystems(Fig.1.1)areasfollows:
Spectator
Detector Recorder
ZIP rod
57 layers of uranium and graphite
Cadmium rod
THE FIRST REACTOR December 2, 1942
FIGURE1.1
DrawingoftheCP1pile.Scram—thistermmeans“fastshutdownofareactor”:variousexplanationshavebeen proposedforitsorigin.ThemostcreditedoneassumesthatitderivesfromtheabbreviatednameoftheCP1 safetyrodwhichcouldbeactuatedbyanaxe.Intheoriginaldesignsketchesofthepile,thepositionofthe operatoroftheaxewasindicatedby“SCRAM,”theabbreviationof“SafetyControlRodAxMan.”The designatedoperatorwasthephysicistNormanHilberry,subsequentlyDirectoroftheArgonneLaboratory.His colleaguesusedthename“MisterScram.”
CourtesyProf.RaymondMurray.
Cadmium solution
(Samuel Allison)
(Enrico Fermi)
(George Weil) Ax man
(Norman Hilberry)
•Gravity-drivenfastshutdownrods(onewasoperatedbycuttingaretainingropewithanaxe).
•Asecondaryshutdownsystemmadeofbucketscontainingacadmiumsulfatesolution,whichis agoodneutronabsorber.Thebucketswerelocatedatthetopofthepileandcouldbeemptied ontoitshouldtheneedarise.
Comparedwiththesetofsafetysystemssubsequentlyconsideredessential,anemergencycoolingsystemwasmissingasdecayheatwaspracticallyabsentaftershutdown,andtherewasnocontainmentsystem(exceptforacurtain!)providedastheamountoffissionproductswasnot significant.
Otherreactorsweresoonbuilt,forbothmilitaryandcivilpurposes,andsincetheywereconstructedonremotesites(e.g.,Hanford,Washington);theydidnotneedcontainmentsystems.
Inthelightofsubsequentapproachesusedinreactorsafety,probably,inthisfirstperiod,notall thenecessaryprecautionsweretaken;however,itisnecessarytoconsiderthespecifictimeandcircumstancespresent(aworldwarinprogressorjustfinished,statusofradiationprotectionknowledgenotyetsufficientlyadvanced,etc.).1
Inthe1980sand1990s,arevisionofthe“simplified”approachusedforthesefirstreactors (mainlydevotedtoplutoniumproduction)wasmade.Theywere,asaconsequence,eithershut downormodified.Inparticular,thefollowingcharacteristicsorproblemswereremovedorsolved:
•theopencyclecoolingofthereactorsandnonpressure-resistantcontainments;
•thedisposalofradioactivewasteusingunreliablemethods,suchasthelocationofradioactive liquidsinsimpleundergroundmetallictankswhichweresubjecttotheriskofcorrosionandof consequentleaks;and
•thestorageofspentfuelelementsinleakingpoolsofwater.
1.2.2 FROMTHELATE1950STOTHETHREEMILEISLANDACCIDENT
Sincetheearly1960sandevenbefore,intheWest,thecriterionoflocatingpowerreactorsina leakproofandpressure-resistantcontainmentvesselwasestablishedandconsolidated.Inthose caseswhereasignificantreleaseofradioactiveproductscouldbepossible,thedesignpressureof thecontainmentwaschosenontheassumptionthatalltheprimary(andpartofthesecondary)hot water(forawaterreactor)wasreleasedfromthecoolingsystems.
Indeed,sincethe1950s,theUS“ReactorSafeguardsCommittee,”setupbytheAtomicEnergy Commission(AEC)withthetaskofdefiningtheguidelinesfornuclearsafety,hadindicatedthat foranoncontainedreactor,alowpopulationzoneshouldbeprovided.Thisdistance, R,hadtobe equal,atleasttothatgivenby Eq.(1.1)
where Pth isthethermalpowerofthereactorinkilowatts.
Fora3000MWreactor(theusualsizetoday),thisexclusiondistanceisequaltoapproximately 30km,whichisequaltothedistanceevacuatedaftertheChernobylaccident(Bourgeoisetal., 1996).Evidently,thereferencedosesfortheshort-termevacuationwereroughlythesameforthe twocases.Anexclusiondistanceofthismagnitudeposesexcessiveproblemstositing,evenina countryendowedwithabundantlandsuchastheUnitedStates;thereforethedecisionofadoptinga containmentispracticallyacompulsoryone.
Thefirstreactorwithleakproofandpressure-resistantcontainmentwastheSR1reactor(West Milton,NewYork,builtinthe1950s).Builttoperformtestsforthedevelopmentofreactorsfor militaryshippropulsion;thisreactorwascooledbysodiumandthecontainmentwasdesignedfor thepressurecorrespondingtothecombustionofthesodiumescapingfromahypotheticalleakin thecoolingcircuit.
InWesterncountries,moreover,itwasrequiredthatthewholerefrigerationprimarycircuit shouldbelocatedcompletelyinsidethecontainment,sothat,eveninthecaseofacompleterupture ofthelargestprimarysystempipe,alltheescapedfluidwouldbeconfinedinthecontainment envelope.Thedesignpressureofthecontainmentforwaterreactors(startingwiththeShippingport, Pa,reactor,moderatedandcooledbypressurizedwater)wasderivedonthebasisoftheassumption ofthecompletereleaseoftheprimarywater.
InEasternEurope,thesecriteriawereappliedtoalesserdegree,asitwasacceptedthatthe pressurevesselalonewouldbelocatedwithinthecontainment(theruptureoflargepipeswasconsideredsufficientlyunlikelytojustifythisassumption)andthattheleakproofcontainmentcharacteristicneednotbeverystringent.Thusatthesecond AtomsforPeace conferenceinGenevain 1964,theWesternvisitorswereimpressedbutsurprisedbythemodeloftheNovovoronezhreactor, whichshowedonlyonesmallcontainmentenclosurearoundthereactorpressurevesselandwas locatedinabuildingthatfromtheoutsideresembledabigpublicofficebuilding.Stillmanyyears afterward,theRussianreactorsoftheVVER230series,althoughprovidedwithcomplete “Western-style”containment,hadaleakageratefromthecontainmentoftheorderof25%each day(tobecomparedwithfiguresoftheorderof0.2%eachdayfromtypicalWestern containments).2
Apartfromdifferencesofapproachbetweenworldregions,inthisperiodoftimeandinallthe countrieswithnuclearreactors,thesystemsinstalledintheplantsaccordingtotherequirementsof thesafetybodiesandhavingthesolepurposeofaccidentmitigation,werefrequentlythesubjectof heateddebates;inparticular,theemergencycorecoolingsystemsandthecontainmentsystems wereoftendiscussed.
Moreprecisely,theopinionsontheaccidentassumptionsevolvedintheWestweredivided. Thereferencesituationsforthereasonablyconceivableaccidentswerechosenbythejudgmentof expertcommittees.Thesesituationsincludedtheworst“credible”events(suchasthecompleteseveranceofthelargestprimarypipe).Theassumptionsconcerningtheinitiatingeventwereaccompaniedbysimultaneousconservativeassumptionsconcerningmalfunctionsinsafetysystems,suchas a“singlefailure”consistinginthefailure,simultaneouswiththeinitiatingevent(pipefailureand soon),ofoneactivecomponentofoneofthesafetysystemsdevotedtoemergencysafetyfunctions duringtheaccident(waterinjectionsystem,reactorshutdownsystem,andsoon).3
Ononeside,themorecautiousexperts,generallymembersofpublicsafetycontrolbodies, manyscholarsandmembersofnongovernmentalorganizationsforthedefenceofpublicrights, supportedtheneedforkeepingtheseconservativeassumptions;ontheotherside,moreoptimistic people(membersofmanufacturingindustriesandofelectricutilities)maintainedthattheabovementionedaccidentassumptionsentailedatruewasteofresources(thosenecessarytoprovide nuclearplantswithhugecontainmentbuildingsandpowerfulsafetysystems).Ithastobenoted thatthe“optimists”werebynomeansimprudentorreckless:asincereconvictionexistedinthe industrythatthecurrentaccidentassumptionswerenotwellfounded.4
Thecontrastbetweentheoptimistsandthepessimistswasexacerbatedbytheforeseeablecircumstancethatnotallofthelogicalconsequencesoftheinitiallyadoptedaccidentassumptions werefromthestartcleartotechnicalpeople.Asanexample,asfarastheeffectivenessofemergencycorecoolingsystemsisconcerned,itwasnotunderstoodfromthestartthatZircaloyfuel cladding(stainlesssteelbehavesinasimilarway)couldreactwithwaterinanautocatalyticwayat relativelylowtemperaturesandcouldreleaselargequantitiesofhydrogen.Neitherwasitunderstoodfromthestartthatthesamecladdingcouldswellbeforerupturingandcouldoccupythespace betweenfuelrods,preventingtheflowofcoolingwater.Theexistenceofthesephenomenawas demonstratedbystudiesandbytestsperformedbytheAEContheSemiscalefacilityattheUS NationalLaboratoryofIdahoFallstowardtheendofthe1960s,whenmanyUSreactorshad alreadybeenorderedandwerebeingdesignedorbuilt.
Similarly,atthebeginningofthe1970s,thepossibilitywasdemonstratedthatthebreakofa pipecoulddamageothernearbypipesorotherplantcomponents,startingachainofruptures (knownasthe“pipewhip”effect).
Allofthesediscoveries,madelateinthedesignandprocurementphasesofUSreactors,persuadedthecontrolbodiestostipulatethattheinherentsafetysystemsbeimprovedinordertotake themintoaccount.Otherrequestsforimprovementconcernedtheresistanceoftheplantstonatural phenomenaortoman-madeevents,inordertoreachabalanceddefencespectrumagainstallofthe realisticallypossibleaccidents;insuchawaythedefenceagainstnewphenomenabecameanalogs tothedefenceagainstthealreadyconsideredphenomenahavingacomparableorlowerprobability. Theserequestsforimprovement(“backfitting”)extendedtheconstructiontimesoftheplants, togetherwiththeircosts.
Itcanbeunderstoodthattheindustry,whichalreadyconsideredtheinitiallyadoptedaccident assumptionstobeexcessive,stronglyopposedtheseaggravatingrequests.Aspreviouslysaid,upto theThreeMileIsland(TMI)accident,notallnucleartechnicalexpertsbelievedinthereasonablenessofthecurrentaccidentassumptionsandintheneedtopursuethemwithlogicalrigorand,in thelightoftheup-to-datescientificknowledge,uptotheirextremeconsequences.5
Theincreaseincostsasaconsequenceofthecontinuousrequestsforplantimprovementswas stronglyincontrastwiththeinitialindustrialexpectations,whichwereconciselysummarizedby thethenchairmanoftheAEC,LewisStrauss,whofamouslystatedthatnuclearenergywould become“toocheaptometer.”Inthisperiod,theexpression“ratcheting”wascreatedtodescribe
Pressure channel
Isolation valve
Emergency injection line
Normal cooling line
FIGURE1.2
Sketchforadiscussiononabreakinapressuretubereactor.
theactionofthecontrolbodiesinthefieldoftheimprovementoftheplantsconcurrentlywiththe indicationsoftheprogressingstudiesandresearch.
Thiscontinuousprocessofimprovementproduced,whereitwasperformed,verysafebutalso verycostlyandrathercomplicatedplants.Indeed,theplantsweresubjecttoaseriesofsafetyfeatureadditionstoasubstantiallyunchangedbasicdesign.
InthisperiodadiverseapproachtoplantsitingdevelopedandwasconsolidatedintheUnited StatesandinWesternEurope.IntheUnitedStates,theplantsitingcriteria,asfarasdemographic aspectswereconcerned,weresubstantiallydecoupledfromthedesignfeaturesoftheplant.Onthe contrary,inEurope,criteriaforthesite plantcomplexwereadopted.TheUSsitecriteria(exceptfor seismicproblemsandforotherexternalnaturalorman-madeevents)canbesummarizedasfollows:
•Theexistenceofan“exclusionzone”aroundtheplant,wherenodwellingsorproductive settlementsexist,withaccessunderthecompletecontroloftheplantmanagement.
•Theexistenceofa“lowpopulationzone”aroundtheplant,whichcouldbequicklyevacuated (withinhours)incaseofaccidenttotheplant.
•Theradioactiveproductsreleasefromthecoretotheplantcontainmentconventionally establishedasafunctionoftheplantpoweronly:theTechnicalInformationDocument14844 (TID)release(DiNunnoetal.,1962).
•Adoselimitof250mSV(25rem)totalbodyandof3Sv(300rem)forthethyroid(children) within2hoursaftertheaccidentattheborderoftheexclusionzone.6
•Doselimitsequaltotheprecedingonesforthewholeaccidentdurationattheexternalborderof thelowpopulationzone.
Theexclusionzonewasestablishedataradiusof800 1000maroundtheplantandthelow populationzoneatroughly5kmfromtheplant(USCodeofFederalRegulations,2004a).
Theconventionalreleasefromthecorewasasfollows:
•Foriodine-131:50%ofthecoreinventory,ofwhich50%onlyisavailableinthecontainment forexternalrelease(depositionandplateoutintheprimarycircuit).
•Theiodineavailableforexternalreleaseis91%elemental,5%particulate,and4%organic iodide(methyliodide).
•Noblegasesaretotallyreleasedtothecontainment.
Independentcriteriawerethenestablishedforthedesignoftheplant.
Inthisapproach,thedecisionabouttheadequacyofaproposedsitecouldbetakenonlyonthe basisoftheplantpowerleveland,possibly,onthespecificcharacteristicsofitsfissionproduct removalsystems(tobeevaluatedandpossiblyvalidatedonacase-by-casebasis).
Incontrast,inEurope,thesiteselectioncriteriausuallyconsiderthesite plantcomplex. Thereforeforexample,ifaplantwiththeusualsafetysystemscouldnotbelocatedonaspecific sitebecauseaccidentdosesexceededthereferencelimits,itwaspossibletomaketheplant acceptableforthesamesitebytheimprovementofthesystemsforfuelintegrityprotectionincase ofaccidents.
Thedoselimitsvariedsomewhatbetweenvariouscountries,buttheywereoftheorderof 5mSv(500mrem,effectivedose)tothecriticalgroupofthepopulationoutsidetheexclusionzone foreverycredibleaccident(designbasisaccidents);someincreaseofthislimituptothelevelof tensofmillisievertforsinglespecificaccidentscouldalsobeaccepted.Inordertoevaluatethe
consequencesoftheseaccidents,then,noconventionalfigureforthereleasesisused(suchasthe TIDfigures).Onthecontrary,conservativebutmorerealisticassumptionsareadopted;typically, theiodinereleasedinthecontainmentisassumedequaltotheinventoryinthefuel cladinterface, equalto1% 5%ofthetotalcoreinventory,insteadoftheTID50%.
InEurope,theneedtotakeaccountofthespecificplantfeaturesfortheevaluationofthe acceptabilityofthesitearisesfromthemuchhigherpopulationdensityinEuropeincomparison withthatoftheUnitedStates(approximately200inhabitantspersquarekilometerand30per squarekilometer,respectively).Itisthereforemuchmoredifficulttofindlowpopulationsitesin Europe.
ThedifferentpopulationdensitiesinEuropeandtheUnitedStateshavealsobroughtaboutdifferencesinaccidentemergencyplans:intheUnitedStates,theprovisionofacompleteevacuation ofthepopulationwithin16kmoftheplantinafewhoursisadopted,whileinEuropethemaximumcomparabledistanceisequalto10km.Itisindeeddifficulttoassuretheevacuationofpopulationcenterswithtens,hundreds,orthousandsofinhabitants.Heretoo,thecountries’differences indemographicconditionshavetobecompensatedbyadditionalplantfeatures(generally,theuse ofdoublecontainmentprovidedwithintermediatefiltrationsystemsandtheuseofelevatedstacks).
ThepracticeintheFarEast(Japan,SouthKorea)issimilartotheEuropeanone.
Thesedifferencesinthefundamentalapproachtosafetyamongvariouscountrieshavealways beenthoughtbythegeneralpublictobeaweaknessofthenuclearindustry,therebyaffectingtheir acceptanceofnuclearenergy.Thesedifferenceshavealwaysbeenasourceofconfusioninthe mindofthepublicand,therefore,theyaggravatethepublicdistrustinthesafetyofthisenergy source.Manyattemptshavebeenmade,intheinternationalandcommunityarenaswherenuclear safetyisdiscussed(IAEA,OECD,EU),toadoptunifiedcriteria(seeChapter18:NuclearSafety Criteria).Theaimofagreeingoncommoncriteriahasbeenreachedonlyattheexpenseofunificationatahigherlogicallevel,thereforeleavinguntouchedthedifferencespreviouslydescribed,for example,leavingtothefreedomofeachcountrythedefinitionofacceptabledistancesordoses.
InthisperioduptotheTMIaccident,threeotherfactsinfluencednuclearsafetytechnology: defenceagainstnonnaturalexternalevents;thepreparationoftheRasmussenreport,WASH1400; andtheintroductionofqualityassurance(QA)indesign,construction,andoperationofplants.
Thefirstofthese,thedefenceagainstnonnaturalexternalevents,wouldnotdeservespecific mentionanddiscussion,exceptthatitsmotivationhaschangedwithtime.Forexample,theinitial officialincentiveforthereinforcementofplantstructuresandcomponentsofmanyreactorsconsistedinthedefenceagainsttheaccidentalfallofanaircraft,while,subsequently,itwasprovided todefendagainstsabotageperformedbytheuseofaircraft,butalsobyexplosivesofvariouskinds. Ineffect,thestrengtheningofstructuresandcomponentswasinitiallymadeinGermanyasaconsequenceofthehighnumberofcrashesoftheLockheed Starfighter fighterplaneinthe1960s. Subsequently,withtheonsetofterroristactivityinthe1970s,theneedarosetodefendnuclear plantsagainsthypotheticalexternalattacksconductedwiththeuseofprojectilesandofexplosives. Atthispoint,itwasdiscoveredthattheGermanprotectionagainsttheplanecrashcouldalsoenvelopeasufficientnumberofsabotageeventsbasedontheuseofexplosives.Thereforeasmanypeoplepreferrednottomentionthesesabotageprotectionsexplicitly,thecorrespondingprovisions werenamedintheofficialdocumentsas“protectionagainstplanecrash.”
Plantprotectionagainstthevariouseffectsoftheimpactbyafighteraircraft(weighingabout 20t)wasadoptedatleastinGermany,Belgium,Switzerland,andItaly,whereasinothercountries
theprotectionagainstthefallofasmallersportsaircraftwaschosen,frequentlyonlyifjustifiedby theproximityofanairport.Nocountryexplicitlyadoptedtheprotectionagainsttheimpactofa wide-bodiedairlineroftheJumboJettype(weighingabout350t),whichwouldbefarmoreonerous(possiblyrequiringtheundergroundlocationofplants).Itwascalculatedthattheprotection againstthefallofafighteraircraftincludedtheprotectionagainstthefallofalargeairlinertooif theimpacttakesplacewithlessdamagingcharacteristics(lowerspeedofimpact,shallowerangle ofimpact,andsoon)thanthosewhichwouldcausetheworststructuralconsequences(see Chapter17,ResistancetoExternalImpact,formoreonaircraftimpact.)
Thesecondinfluence,theRasmussenreport,firstpublishedin1975,wassponsoredbythe NuclearRegulatoryCommission(NRC—thesuccessortotheAECincontrolofpeacefulapplicationsofnuclearenergyandtheregulatorybodyonnuclearsafetymatters)withtheaimofoutlining anoverallpictureofalltheconceivableaccidentsandoftheirprobabilities,inordertoidentifythe riskconnectedtoanuclearplant.Itwasthefirsttimeastudythatincludedallconceivableaccidentshadbeenmade.Itincludedlessprobablescenariostoo,suchasthecatastrophicexplosionof areactorpressurevesselandanestimateoftheprobabilityofeachofthem.Itshouldbeunderstood thattheprobabilitydataconcerningthemostunlikelyphenomenaarescarceorevenabsentgiven theimpossibilityofstudyingthesephenomenabyexperimentaltestsandthescarcityofapplicable real-lifedata.Insomeways,quantifyingtheseeventsinareportwasabolddecision,but,oncethe objectiveofthestudywasdecidedupon,nobodyquestionedthefeasibilityofit.Subsequently, oncethereportwaspublished,criticismensued:somepeoplesaidthatitwasinscrutable,others criticizedthecompletenessofthedatabase,andotherscriticizedtheinconsistencyoftheexecutive summarywiththemainreport.Inthesecond,andfinal,editionsomeevidentinsufficiencieswere corrected,butsomeofthecriticismsremainedunresolved.Whoeveritwaswhostartedariskstudy ofthefirstcars,ofthefirstrailwaytrainsorofthefirstairplanes,wouldhavemetthesamedifficulties.However,withthepassingoftime,thereporthasremainedafundamentalreferenceforany safetyandriskevaluation.Nobodycouldsupportthevalidityoftheabsolutequantitativeriskevaluationscontainedinit,but,atthesametime,thevalidityofthisstudyandofthesimilarones whichfollowedisuniversallyacknowledgedasfarastherelativeprobabilityestimatesareconcernedfordetectionofweakpointsinaspecificdesign.Insubstance,theRasmussenreportand similarstudiesarepossiblejudgmentinstrumentsinthenuclearsafetyfield,althoughtheycannot beusedalone.Soundengineeringevaluations,basedonoperatingexperience,evenindifferentbut similarfields,andonresearchresults,arethenecessarycomplementtotheprobabilistic evaluations.
Inthehistoryofnuclearsafetytechnology,theRasmussenreportdidnotsolelyrepresenta methodologicaladvancement.Severeaccidents(thoseaccidentsmoreseriousthanthoseuptothen consideredcredible)wereincluded,especiallyaftertheTMIaccident,inthedesignconsiderations fornuclearplants.
Finally,thestartoftheapplicationofQAinnuclearengineeringhastobementioned. Accordingtothismanagementsystem,thequalityofaproductisguaranteedbythecontrolofthe productionprocesses,morethanbythecontroloftheproductsthemselves.Certainlythisrepresents remarkableprogresstowardtheachievementofproductsbettercomplyingwiththeirspecifications; however,theimplementationofthissystemrequiresasignificanteffortinthefieldofactivityplanningandofthemanagementofthedocumentation,entailingacorrespondingcostburden.
1.2.3 FROMTHETHREEMILEISLANDACCIDENTTOTHECHERNOBYLACCIDENT
InMarch1979,duringaratherfrequentplanttransient,avalveontopofthepressurizerofthe TMIplant(Pennsylvania,UnitedStates)remainedstuckopen,givingrisetoacontinuouslossof coolant.Inanextremelyconciseway,anopeninginthatposition(althoughthisfacthadnotbeen sufficientlystudiedandpublicizedinthetechnicalliterature)generatedovertimeasituationofa voidreactorpressurevesselandofafullpressurizer.
Thisaccidentdemonstratedthattheattitudeofmanytechnicalpeopletowardnuclearsafetywas carelessandoptimistic.Itcouldalsobeconcludedthatbad“surprises”causedbyanuclearplant couldbeavoidedonlyattheexpenseofastrongchangeintheirmindsettowardsafetyitself.
Theseconclusionsweresharedbypracticallyalltechnicalpeopleandallovertheworld.Some optimistsstillexisted,however.Theywereconvincedthatalltheblamefortheaccidenthadtobe placedontheoperatorswhohadnotcorrectlydiagnosedtheplantconditionsintime,andthatall theproblemscouldbesolvedbytheuseofmorestringentlyscreenedoperators.
Itcanbesaidthatthisaccidentcompletelychangedtheattitudeoftheindustrytowardsafetyin alltheOECDcountries.Theprovisionoffeaturespreviouslyconsideredtobepointlessbysome (suchasthepresenceofaleakproof,pressureresistantcontainment)wasacknowledgedasvalidin thelightofthepossibilityofunforeseeableevents.Twoorganizationswerecreatedforthe exchangeofinformationonoperationaleventsatnuclearplantsandforthepromotionofexcellence inthenuclearsafetyfield:theInstituteofNuclearPowerOperationsintheUnitedStatesandthe WorldAssociationofNuclearOperators(WANO)internationally.IntheUnitedStates,withinthe NRC,aspecificofficewascreated(AnalysisandEvaluationofOperationalData)fortheanalysis andthedisseminationofoperatingexperience.Longlistsof“lessonslearned”werepreparedanda “TMIActionPlan”compiledwhichcontainedalargenumberofspecificprovisionsagainstthe possiblerepetitionofsimilaraccidentsinthefuture.Theimplementationoftheseprovisionscost eachplantanamountofmoneyrangingbetweenseveralmilliondollarsandseveraltensofmillions ofdollars.Aboveall,twoconceptswereunderlinedandreinforced:theconceptof defenceindepth andtheconceptof safetyculture.
Accordingtoanumberofexperts,inparticularfromtheformerUSSR,theattitudeoftheindustrytowardsafetyalsochangedinEasternEuropeaftertheTMIaccident:alreadyinearly1980s, RussiandesignersofVVERreactorsproposedanumberofmeasuresforsafetyimprovements.
The defenceindepth initiativeisaconceptmeaningthatmany,mutuallyindependent,levelsof defenceagainsttheinitiationandtheprogressionofaccidentsarecreated.Thevariouslevels includephysicalbarriers,suchasthefuelcladding,theprimarysystem,andthecontainment.Five levelsaredefined:goodplantdesign,controlsystems,emergencysystems,accidentmanagement, andemergencyplans.
The safetyculture conceptisdefinedasthesetofconvictions,knowledge,andbehaviorin whichsafetyisplacedatthehighestlevelinthescaleofvaluesineveryactivityconcerningthe useofnuclearenergy.7
Theresultoftheseinitiatives,togetherwiththeRasmussenreportandtheTMIaccidentconvincedmanycountriestopayattentiontosevereaccidents.Severeaccidentoccurrencewasintroducedasaconsiderationinthedesignandoperationofplants.
A severeaccident isdefinedasoneexceedinginseveritythe DesignBasisAccidents,whichare thoseagainstwhichplantsafetysystemsaredesignedinsuchawaythat:
•Thecoredoesnotexceedthelimitsofirreversibledamageofthefuel(e.g.,1200 Cmaximum temperatureand17%localoxidationofthecladdings)(USCodeofFederalRegulations, 2004b).
•Theexternalreleasesdonotexceedthemaximumtolerableones,accordingtothenational criteriainforce.
Inmanycasesitisconsidered,asanaccidentprogressivelyworsens,thatthelimitforwhichit becomes“severe”istheattainmentof1200 Cinthefuelcladdingsinceataboutthistemperature theprogressionofthewater claddingexothermicreactionbecomesautocatalyticandproceedsata highrate.TheIAEAdefinitionforsevereaccidentsis“accidentconditionsmoreseverethana designbasisaccidentandinvolvingsignificantcoredegradation”(IAEA,SafetyofNuclearPlants: Design,SSR-2/1).
AlltheOECDcountries(butalsoothers)agreedontheadvisabilityofstudyingandofimplementing severeaccidentmanagementtechniques ontheirplants.Theseprovideequipmentand emergencyproceduresforsevereaccidentswhich,intheextremecaseofreachingasituationclose toasevereaccident,preventitsoccurrenceor,atleast,preventitfromworsening.Examplesoftypicalequipmentandproceduresforsevereaccidentsarethefollowing:
•portableelectricenergygenerators,transportablefromtheplanttoanotheronthesamesiteor onadifferentsite;
•procedurestosupplyelectricenergytotheessentialloads,incaseoftotallossofelectric power;and
•proceduresforthevoluntarydepressurizationoftheprimarysystemincaseoflossofthehigh pressureemergencyinjectionsystems,andsoon.
Bythe1980s,practicallyalltheplantsintheOECDareawereequippedwith SevereAccident ManagementPlans tovariousdegreesofcompleteness.Somecountrieshaveprogressedfurther thanothers,instigatingrealplantmodificationsasameansofimplementingtheir Accident ManagementPlans. France,Germany,andSweden(andothers)haveinstalledfilteredcontainment ventingsystemsdesignedtoavoidtheruptureofthecontainmentincaseofasevereaccident entailingtheslowoverpressurizationofthebuildingbeyonditsstrengthlimits(thissituationcould happenineveryaccidentscenariowithoutsufficientcoolingofthecoreandofthecontainment). Othercountries,suchastheUnitedStates,concludedthatthesesystemswerenotneeded,onthe basisofacost benefitanalysis.
InItaly,asetofcriteriaweredeveloped,the“95% 0.1%criterion,”accordingtowhich,by theinstallationofappropriatesystems(includingafilteredventingsystemforatleastonereactor),areleaseofiodinehigherthan0.1%ofthe coreinventorycouldbeavoidedwithaprobabilityhigherthan95%,conditionaluponcoremelt(definedasattainmentofacladdingtemperature higherthan1200 C).Obviously,nosingleeventsofverylowprobabilitywereconsidered,such asapressurevesselexplosionduetoamechanic aldefect.Asimilarcriterionwasadoptedin Sweden.
Amongtheproposalsatthistimewasonethatconcernedapreventativesystemforthevoluntarydepressurizationoftheprimarysysteminpressurizedwaterreactors(PWRs)andforthepassiveinjectionofwaterintotheprimarysystemforabout10hours.Thiscorerescuesystemcould decreasethecoremeltprobabilitybyafactorofatleast10.Thesystemwasproposedasa
modificationofthedesignchosenfortheItalianUnifiedNuclearDesign,butwasnotconsidered necessarybythedesignersatthattime.Afewyearslater,thedesignersappliedit,withmodifications,tothepassivereactorAP600.Anotherreactordesign(thistimeGerman)hasasimilarsystem.Thevoluntaryprimarysystemdepressurizationhassubsequentlybeenadoptedbyallthemore modernPWRdesigns,suchastheEuropeanPressurizedReactor(EPR)andtheSystem80.
1.2.4 THECHERNOBYLACCIDENTANDAFTER
Inmyopinionandtheopinionofotherexperts,thereweretwoprimarycausesoftheChernobyl tragedy.Thefirstwasthatalthoughtheplantwascertainlyverygoodfromaproductionpointof view,ithadbeendesignedwithexcessiveoptimismasfarassafetywasconcerned.Indeed,in someoperatingconditions(lowpower,lowsteamcontentinthepressuretubes)thereactorwas veryunstable,inthesensethatanincreaseinpoweroralossofcoolanttendedtoincreaseitsreactivity,increasingthepowerautocatalytically.Inthisway,thedestructionofthereactorandofthe plantcouldbeinitiated.Moreover,withcompletelyextractedcontrolrods(asituationforbiddenby theoperatingprocedures),thepotentialinstabilitywasmoresevereand,additionally,theuseofthe scramactedasanacceleratorandnotasabrakeinthefirstmomentsoftherodmovement(an “invertedscram”).
Thesecondfatalcircumstancewasthattheoperatorswereworking,onthatnightinApril1986, inaconditionoffrantichurryforvariousreasons.
Althoughthisreactorhadbeenprovidedwithleakproofandpressureresistantcontainmentasa resultoftheprevailingchangesinattitudealreadydiscussed,thecontainmentdidnotincludeasignificantportionofthereactoritself(aremarkabledesigndecision).Inparticular,thefuelchannel headsweredirectlyputinanormalindustrialbuilding.Acompletelyuncontainedaccident,therefore,happened.Thereasonsfortheadversedesigncharacteristicsmayhavebeenfinancial(but expertopiniondiffers).
Thegenerallessontobelearnedisalwaysthe same:noweakpointscompromising,safety mustbeleftinaplant.Humanerrors,asintheca sesofTMIandChernobyl,willsucceedinfindingthemandwillcausedisastersandfatalitie s.Idonotbelieve,assomeantinuclearpeople maintain,that“ifanaccidentcanhappen,soonerorlateritwillhappen”;however,experience indicatesthataccidentpossibili tymustbeseriouslyconsideredduringallthephasesofthelifeof anuclearplant.8
However,forthesakeofcompleteness,ithastobesaidthattheChernobyl-typereactorswere notwellknownintheWesternworld.Thepertinentinformationwaskeptsomewhatconfidential becausethisreactorcouldpotentiallybeusedforplutoniumproductionandthereforeitwasinterestingfromamilitarypointofview.9
AconfidentialsafetyanalysisofanRBMKreactor,similartotheChernobylone,wasperformedsomeyearsbeforetheaccidentbyaEuropeandesigncompany.Itconcludedthatthisreactor,inmanyrespects,didnotmeetthesafetystandardsinuseintheWesternworld.Copiesofthis safetyanalysiswerecirculatedamongtheexpertsaftertheChernobylaccident.
TheChernobylaccident,withitsconsequences(bothlocalandafar)hadnotmuchtoteachthe Westernnuclearsafetyengineersasthereactor’sshortcomingswereallaccuratelyknownand avoidedintheirdesigns.10
