- Email: [email protected]
Erroneous Beliefs About Nuclear Safety
CHAPTER
ERRONEOUS BELIEFS ABOUT NUCLEAR SAFETY
27
It is worth mentioning and discussing some beliefs prevalent in the field of nuclear safety. A shutdown plant cannot have an accident!
The opposite is true as the probabilistic safety analyses addressing this problem have concluded that a large part of the risk of a nuclear plant is related to plant situations of shutdown or low power. A plant is shut down for inspection and periodic maintenance, and often safety systems are disabled, the containment opened, and “unusual” operations are performed which decrease the usual defences, so that accidents are possible which could not happen in other conditions. In a pressurized reactor, a ‘solid system’ has to be avoided by all means!
A “solid system,” in the jargon of PWR operators, is a primary cooling system completely filled with water, that is, without the steam bubble in the pressurizer. In solid system conditions, the pressure resisting structures of the primary system are in effect exposed to undue overstressing as a compressible element in the fluid part of the system is lacking: one can think of an effect of local overheating and consequent thermal expansion of the fluid, or of the start up of a high head pump connected with the primary system, etc. Operators are warned about the danger of a solid system condition during their training. Experience indicates that sometimes the risks of this operating condition are exaggerated, almost identifying it with a situation of unavoidable accident to the primary structures. It must be remembered that, during the Three Mile Island accident, the operators blocked the operation of the safety injection system which had regularly been automatically started, precisely for the fear of being in a solid system condition (on the basis of the indications of the pressurizer level). It is necessary, in fact, to remember that other protections exist against the overpressurization of the primary system such as safety valves. However, they could be damaged (as they were at Three Mile Island) by a liquid efflux, having been designed for a steam efflux. The fear of damaging them or causing a leak in them after reclosure was, therefore, well founded. What had not perhaps been sufficiently made clear to the operators was that between the two possible evils (the safety valve not perfectly reclosing after opening because of the discharge of liquid, and lack of emergency core cooling), the potentially more serious situation was the second. Pouring water on an overheated core must be avoided!
Nuclear Safety. DOI: https://doi.org/10.1016/B978-0-12-818326-7.00027-5 © 2020 Elsevier Ltd. All rights reserved.
317
318
CHAPTER 27 ERRONEOUS BELIEFS ABOUT NUCLEAR SAFETY
This “myth” has been dangerously circulated in the field of nuclear safety for years, before being firmly refuted by an international group of experts on accident management (NEA, 1995). Indeed, pouring large amounts of cold water on an overheated, possibly partially molten, core without mature deliberation may in principle cause: • • •
instantaneous thermal stresses and structural damage; production of large quantities of hydrogen by metal water reactions; possible steam explosions.
A core in these conditions must be cooled and the means available in a water reactor is, indeed, cold water. It is up to the judgment of the operator to decide, case by case, the way by which the cooling operation has to be performed (e.g., proceeding by low duration injections and observing the result before continuing, or conveniently graduating the liquid injection flow rate). However, the injection of cold water in an overheated core must always take place, even if it means going through a transient seemingly worse situation. Timely action is beneficial, as this limitates the possibility of unforeseen aggravating phenomena. The actuation of the containment spray must be avoided in a severe accident!
There is some truth in this (possibly) common mistake. The spraying of water, in fact, causes the condensation of the steam in the containment, which may “deinert” the possible hydrogen oxygen explosive mixture. It can be concluded that in some cases this deinerting has to be avoided. However, in many other cases the spraying of the containment must be performed, for example, if this is a condition for the cooling of the core. This issue must be studied, case by case, during the preparation of the severe accident management program available at all plants. The operators should have all the diagnostic and intervention means needed for taking the correct decision in any situation, including the instrumentation for the difficult measurement of the explosivity within the container. The containment is a passive system!
Fortunately, this belief is not heard anymore, but, at one time, some people thought that the containment function was predominantly performed by the container shell and that, with an integer containment, a substantial separation of the internal atmosphere from the outside could be relied on. In reality, the containment is a machine which, in order to be able to perform its function, must pass from a state of multiple communication with the outside through the hundreds of mechanical penetrations usually present, to a state of isolation from the outside, by the closure of isolation valves and analogous devices. It must be remembered that the specified maximum design leakage of a containment is equivalent to the presence of a small hole, typically of about 3 mm diameter in the container shell. It is, therefore, vital that all the active isolation devices perfectly close in case of actuation of the containment isolation. Pipes crack, leak, wear out . . . but they don’t break!
This was one of the “battle cries” of many optimistic engineers (after one of them, an expert nuclear engineer, created it), who had a critical attitude, before Three Mile Island, toward the precautions imposed by the nuclear safety criteria and, in particular, toward the assumption of a break
REFERENCES
319
in the largest pipe of the plant and of the consequent need for the provision of a pressure resisting and leak-proof containment. A guillotine break of the largest primary pipe has never happened; however, the corresponding conservative assumptions made from the outset has provided a useful “envelope” for a series of other events (lack of valve reclosure, break of sealing and closure devices of components, detachment of bolted flanges of steam generators inspection ports or of valves and pumps, cracks of various types in many pipes, etc.) which the subsequent experience has demonstrated to be both possible and insidious. Catastrophic breaks of large pipes have happened on the secondary cooling circuit, less protected by the safety standards. In order to avoid criticality in new fuel storage it is sufficient that it is not completely flooded!
This mistake is not made any more. However, it is worthwhile repeating that the maximum reactivity of fresh fuel storage is generally obtained when the room is full of partial density water, that is for a situation of water sprayed on the fuel, more than for the complete flooding of it. Performing analyses with conservative assumptions always favors safety!
Why is this apparently correct statement not always true? Because the analyses performed with too many conservative assumptions, in the end gives a completely distorted picture of the real behavior of the system studied. The following consideration of Prof. Norman Rasmussen, coordinator of the famous Reactor Safety Study Wash-1400 (the Rasmussen report), is relevant (OECD, 1994): One unexpected event at TMI was the presence of a hydrogen-steam bubble in the primary vessel during the course of the accident. The fact that non-condensable hydrogen might be trapped in the vessel head was, as far as I can remember, never discussed during the RSS. The principal reason for this was that the RSS analysis made the conservative assumption that large amounts of hydrogen could only be generated if a significant fraction of fuel melted. Further, to be conservative, it was assumed this molten fuel would melt through the bottom head of the vessel. Thus, a situation in which large amounts of hydrogen could be trapped in the vessel was never encountered.
Any analysis should be performed in the most realistic way, using, at any step, the most probable assumptions, except for adding, at the end, for conservatism, a generous safety factor to the result, following the indications of an uncertainty analysis. In this process, it is, moreover, very useful to have the best estimate analysis followed by an analysis of the sensitivity of the result to variation in the assumed parameters.
REFERENCES NEA, 1995. Summary and Conclusions. Specialist Meeting on Severe Accident Management Implementation, NEA/CSNI/R(95)16, Niantic, CT, 12 14 June. OECD, 1994. Three Mile Island Reactor Pressure Vessel Investigation Project. Paris.
ERRONEOUS BELIEFS ABOUT NUCLEAR SAFETY
27
It is worth mentioning and discussing some beliefs prevalent in the field of nuclear safety. A shutdown plant cannot have an accident!
The opposite is true as the probabilistic safety analyses addressing this problem have concluded that a large part of the risk of a nuclear plant is related to plant situations of shutdown or low power. A plant is shut down for inspection and periodic maintenance, and often safety systems are disabled, the containment opened, and “unusual” operations are performed which decrease the usual defences, so that accidents are possible which could not happen in other conditions. In a pressurized reactor, a ‘solid system’ has to be avoided by all means!
A “solid system,” in the jargon of PWR operators, is a primary cooling system completely filled with water, that is, without the steam bubble in the pressurizer. In solid system conditions, the pressure resisting structures of the primary system are in effect exposed to undue overstressing as a compressible element in the fluid part of the system is lacking: one can think of an effect of local overheating and consequent thermal expansion of the fluid, or of the start up of a high head pump connected with the primary system, etc. Operators are warned about the danger of a solid system condition during their training. Experience indicates that sometimes the risks of this operating condition are exaggerated, almost identifying it with a situation of unavoidable accident to the primary structures. It must be remembered that, during the Three Mile Island accident, the operators blocked the operation of the safety injection system which had regularly been automatically started, precisely for the fear of being in a solid system condition (on the basis of the indications of the pressurizer level). It is necessary, in fact, to remember that other protections exist against the overpressurization of the primary system such as safety valves. However, they could be damaged (as they were at Three Mile Island) by a liquid efflux, having been designed for a steam efflux. The fear of damaging them or causing a leak in them after reclosure was, therefore, well founded. What had not perhaps been sufficiently made clear to the operators was that between the two possible evils (the safety valve not perfectly reclosing after opening because of the discharge of liquid, and lack of emergency core cooling), the potentially more serious situation was the second. Pouring water on an overheated core must be avoided!
Nuclear Safety. DOI: https://doi.org/10.1016/B978-0-12-818326-7.00027-5 © 2020 Elsevier Ltd. All rights reserved.
317
318
CHAPTER 27 ERRONEOUS BELIEFS ABOUT NUCLEAR SAFETY
This “myth” has been dangerously circulated in the field of nuclear safety for years, before being firmly refuted by an international group of experts on accident management (NEA, 1995). Indeed, pouring large amounts of cold water on an overheated, possibly partially molten, core without mature deliberation may in principle cause: • • •
instantaneous thermal stresses and structural damage; production of large quantities of hydrogen by metal water reactions; possible steam explosions.
A core in these conditions must be cooled and the means available in a water reactor is, indeed, cold water. It is up to the judgment of the operator to decide, case by case, the way by which the cooling operation has to be performed (e.g., proceeding by low duration injections and observing the result before continuing, or conveniently graduating the liquid injection flow rate). However, the injection of cold water in an overheated core must always take place, even if it means going through a transient seemingly worse situation. Timely action is beneficial, as this limitates the possibility of unforeseen aggravating phenomena. The actuation of the containment spray must be avoided in a severe accident!
There is some truth in this (possibly) common mistake. The spraying of water, in fact, causes the condensation of the steam in the containment, which may “deinert” the possible hydrogen oxygen explosive mixture. It can be concluded that in some cases this deinerting has to be avoided. However, in many other cases the spraying of the containment must be performed, for example, if this is a condition for the cooling of the core. This issue must be studied, case by case, during the preparation of the severe accident management program available at all plants. The operators should have all the diagnostic and intervention means needed for taking the correct decision in any situation, including the instrumentation for the difficult measurement of the explosivity within the container. The containment is a passive system!
Fortunately, this belief is not heard anymore, but, at one time, some people thought that the containment function was predominantly performed by the container shell and that, with an integer containment, a substantial separation of the internal atmosphere from the outside could be relied on. In reality, the containment is a machine which, in order to be able to perform its function, must pass from a state of multiple communication with the outside through the hundreds of mechanical penetrations usually present, to a state of isolation from the outside, by the closure of isolation valves and analogous devices. It must be remembered that the specified maximum design leakage of a containment is equivalent to the presence of a small hole, typically of about 3 mm diameter in the container shell. It is, therefore, vital that all the active isolation devices perfectly close in case of actuation of the containment isolation. Pipes crack, leak, wear out . . . but they don’t break!
This was one of the “battle cries” of many optimistic engineers (after one of them, an expert nuclear engineer, created it), who had a critical attitude, before Three Mile Island, toward the precautions imposed by the nuclear safety criteria and, in particular, toward the assumption of a break
REFERENCES
319
in the largest pipe of the plant and of the consequent need for the provision of a pressure resisting and leak-proof containment. A guillotine break of the largest primary pipe has never happened; however, the corresponding conservative assumptions made from the outset has provided a useful “envelope” for a series of other events (lack of valve reclosure, break of sealing and closure devices of components, detachment of bolted flanges of steam generators inspection ports or of valves and pumps, cracks of various types in many pipes, etc.) which the subsequent experience has demonstrated to be both possible and insidious. Catastrophic breaks of large pipes have happened on the secondary cooling circuit, less protected by the safety standards. In order to avoid criticality in new fuel storage it is sufficient that it is not completely flooded!
This mistake is not made any more. However, it is worthwhile repeating that the maximum reactivity of fresh fuel storage is generally obtained when the room is full of partial density water, that is for a situation of water sprayed on the fuel, more than for the complete flooding of it. Performing analyses with conservative assumptions always favors safety!
Why is this apparently correct statement not always true? Because the analyses performed with too many conservative assumptions, in the end gives a completely distorted picture of the real behavior of the system studied. The following consideration of Prof. Norman Rasmussen, coordinator of the famous Reactor Safety Study Wash-1400 (the Rasmussen report), is relevant (OECD, 1994): One unexpected event at TMI was the presence of a hydrogen-steam bubble in the primary vessel during the course of the accident. The fact that non-condensable hydrogen might be trapped in the vessel head was, as far as I can remember, never discussed during the RSS. The principal reason for this was that the RSS analysis made the conservative assumption that large amounts of hydrogen could only be generated if a significant fraction of fuel melted. Further, to be conservative, it was assumed this molten fuel would melt through the bottom head of the vessel. Thus, a situation in which large amounts of hydrogen could be trapped in the vessel was never encountered.
Any analysis should be performed in the most realistic way, using, at any step, the most probable assumptions, except for adding, at the end, for conservatism, a generous safety factor to the result, following the indications of an uncertainty analysis. In this process, it is, moreover, very useful to have the best estimate analysis followed by an analysis of the sensitivity of the result to variation in the assumed parameters.
REFERENCES NEA, 1995. Summary and Conclusions. Specialist Meeting on Severe Accident Management Implementation, NEA/CSNI/R(95)16, Niantic, CT, 12 14 June. OECD, 1994. Three Mile Island Reactor Pressure Vessel Investigation Project. Paris.