The CRBRP containment was cylindrical with an ellipsoidal head, a flat bottom basemat, and an operating floor. The operating floor was 86 ft. above the basemat and the cylindrical portion extended 83 ft. above the operating floor. There was a 400 ton polar crane mounted near the top of the cylinder. The area above the operating floor was accessible during plant operation while the area below the operating floor was not due to the high radiation level of the Na24. The flat basemat was a consequence of the decision to adopt a cylindrical structure and the 83 ft. portion above the operating floor was probably a consequence of the removable IHX tube bundle. (To remove the tube bundle, it would be necessary to have a totally enclosed device, handled by the polar crane that would adapt to the IHX, permit evacuation and inerting, lift the bundle out of the IHX shell, and button up the IHX.) How the tube bundle, once removed, exited containment was something left for detailed design. There were large unoccupied volumes below the PHTS loops. The huge volume above the operating floor was mostly unused. The polar crane was used to lift the Auxiliary Handling Machine, the ex-vessel portion of the IVTM, and various floor valves but was probably tested to near its limit only if an IHX tube bundle replacement were necessary.
The concept advocated herein abandons the cylinder in favor of a rectilinear arrangement, so there is no need for a common elevation basemat. Other than the refueling cell, there are no operations going on, so there is no need for an operating floor. If it was alright on CRBRP for the volume below the operating floor to be inaccessible during power operations, why not put the entire containment off-limits during operations? What purpose is served by a massive polar crane if the IHX tube bundle is not removable and there is no refueling equipment to handle? There is no longer a need to store an IVTM or Auxiliary Handling Machine. A Plug Handling Machine and necessary floor valves can be stored in the refueling cell and the EVTM can be parked there. It would probably be a good idea to design the containment so there is a “soft patch” over each of the IHXs in the event that there is ever a need to replace one. Otherwise, the containment volume should be whatever is needed to house the refueling cell, reactor vessel, PHTS, overflow vessel, in-containment storage vessel, cold traps, overflow heat exchanger, RAPS (possibly), and needed auxiliaries (see Section 12). This approach reduces containment volume by at least 80% without meaningfully impairing operability, and this for a plant three times the power output of CRBRP.
Once the geometry is settled, it is now necessary to turn to the design basis. In LWRs, the containment is typically designed to accommodate the double ended primary system hot leg pipe failure. For PWRs, this leads to 580°F water exiting the break and immediately flashing to steam and pressurizing the containment structure to up to 60 psig. To contain such pressures in a relatively large structure, it is necessary to adopt the cylindrical or spherical geometry commonly observed for containment buildings at nuclear plants worldwide. It is also necessary that the containment be large. If it is desired to reduce the profile of the containment in a PWR as was the case at the Donald C. Cook plants in Michigan it becomes necessary to incorporate some sort of pressure suppression system inside containment such as ice condensers.
In the case of sodium cooled reactors, the double ended pipe break in the primary system is also considered (perhaps ill-advisedly if the leak before break postulate can be positively confirmed for low pressure ductile piping systems), but the consequences are much more benign. The sodium flowing from the postulated break is well below its boiling point, so provided the space into which it flows is inerted it does not pressurize the space other than by adding sensible heat to the surrounding atmosphere. For the design concept presented here, the entire primary heat transport system is surrounded by guard piping located in cells that are inerted with nitrogen or argon, so there is little or no reaction of the hot sodium with the atmosphere. A similar arrangement was adopted on the Hallam reactor and was referred to as “containment” for that plant, which was licensed. 50
The refueling cell has a single barrier between sodium and the cell interior. That cell is designed with a liner so any escaped sodium will not cause damage to structural concrete. While such an event may cause modest pressurization of the cell and may require the provision for some sort of concrete cooling or catch treys as were used on CRBRP, it does not require any robust containment other than shielding, at least in the conventional sense. For the design approach being advanced, there isn’t need for any protection against major primary sodium leaks since the entire primary system is double walled. The primary sodium storage vessel and the overflow vessel are unguarded inside inerted cells. The cold traps, overflow heat exchanger, and connecting piping are unguarded inside inerted cells. Short runs of the intermediate sodium will be inside containment. For these runs, there would be a choice of either enclosing the applicable runs in a double wall or lining the effected cell, with the cell liner likely to be the preferred choice.
Other events that have been proposed as potentially challenging the containment are refueling accidents where a spent fuel assembly is dropped and its fission products released. This event would require a leak tight fuel handling cell, but the cell is already obliged to be leak tight in order to keep air out and argon or helium in. A control rod ejection accident is another that has been postulated, but for oxide fueled systems it turns out to have acceptable consequences provided the reactor shutdown system does its job. Moreover, for the low pressure drop system envisioned in the concept being considered, it is difficult to postulate an event that could result in a control rod ejection. Local subassembly blockage is a very reasonable postulated accident, particularly since it has already happened on two sodium cooled reactors, SRE and Fermi-1. However, in both of those cases the consequences were contained by the primary system and it is difficult to conceive of any sequence following from a subassembly blockage that would breach the primary system and impose special requirements on a containment building.
Illustrative of this subject is a press information booklet on the Sodium Reactor Experiment (SRE) that was prepared sometime around 1957.51 “The SRE Building is not designed for containment in the sense that it can withstand an internal pressure and still be leak tight. An important aspect of the sodium-graphite concept is that it does not require a specially constructed containment shell. No foreseeable nuclear accident could so increase the pressure that an external containment shell would be necessary.” While the SRE was not a fast reactor, it was one of the sodium cooled reactors that experienced a partial meltdown from which there was no significant release.
Some operations will be undertaken in the containment that would require cell liners in places other than the refueling cell. For example, the cold traps will need to be replaced periodically and the cover gas processing system will contain components that require periodic replacement. Every place there are cell liners, it will be necessary to make provisions for them to be tested for leak tightness, which will probably involve pressurizing the cell to 5 or possibly 10 psi. Depending on the design details, it may turn out that it is most efficient to line the entire containment.
Based upon the forgoing, one could reasonably conclude that the primary need for containment is to provide adequate shielding during operation and accommodate postulated refueling events. There is one bug in the ointment. Fairly early in the development of breeder reactors, there emerged the famous Bethe-Tate model.52 This model postulates an event that would normally trip the reactor but fails to do so for some reason, overheating of the sodium coolant in the core to the point of boiling, sodium voiding which injects positive reactivity, and then a massive core meltdown followed by the unsupported upper part of the core falling into the debris at the bottom. The result is the hypothetical core disruptive accident or HCDA as it is generally known.
The Fermi-1 designers were caught up with the HCDA during licensing and what amounted to a “core catcher” was installed in the bottom of the reactor vessel. Of course, the unintended consequence was that a piece from the core catcher broke loose during plant operation blocking flow to several fuel assemblies which led to the famous partial core melt at Fermi-1 and contributed significantly to the demise of that plant. Maybe a core catcher isn’t such a good idea after all. What this proves is that it is not constructive to go overboard with safety provisions and installed complexity for hypothetical events when designing a nuclear power plant.
Since the FFTF was unlicensed53, the next time a sodium cooled reactor was obliged to confront the regulatory process was the CRBRP project. The initial approach of that project was to install a diverse and redundant reactor shutdown system and provide a containment vessel for “defense in depth”, even though there was no postulated event that required it. There was no core catcher either inside the vessel or external to it.54 The CRBRP containment was a 186 ft. diameter steel shell designed to a pressure of 10 psig. From Probabilistic Risk Analyses (PRA) it was estimated that the probability of failure of the shutdown system was less than 10-6 per year.
When the licensing process was engaged, all kinds of NRC questions surfaced dealing with the HCDA. The project wound up enlisting HCDA experts from Argonne who performed a series of analyses that were furnished to the NRC for evaluation. Numerous meetings occurred focused on the topic. The end result was that even though the containment wasn’t necessary for any realistic postulated event, the project was required to add a concrete confinement building outside the containment along with a containment cooling system, an air filtration system on the exhaust between the containment and the confinement and other systems deemed necessary by the NRC. In order to present an event that could challenge containment, the project postulated (probably with considerable “encouragement” by the NRC) a major breech of the 35,000 gallon sodium storage tank (which is normally empty) simultaneous with failure to maintain the inert environment in the cell in which that tank is normally contained, causing a sodium fire lasting for 550 hours. This event is at odds with the single failure criterion unless the tank if filled with sodium and the cell deinerted, in which case the reactor would have been shut down for long enough that the Na24 would have decayed to near ambient, i.e. two weeks or more. This sodium was also obliged to contain a radiological source term for assessment of site suitability that was somehow based on a specified (300 MW-sec) HCDA, which of course is an impossible combination. So it appears the NRC was going to buy into a non-mechanistic (i.e. non-deterministic) approach with a specified fire and source term as the basis for containment. It also appears that the ASLB had not bought into the idea yet55 and of course, the interveners were demanding that the HCDA be a DBA.56 The big problem with the HCDA being a DBA is that there are all kinds of HCDAs, depending on a plethora of assumptions. It is highly likely that HCDA=DBA means there would be no LMFBRs licensed by the NRC, which is likely exactly what the interveners had in mind.
Since then, the situation has not improved. Some entities began to endorse metal fuels as the solution to the loss of flow (LOF) and transient overpower (TOP) events without scram. For this case, it is the absence of a strong Doppler coefficient in metal fuels that comes to the rescue in ameliorating these hypothetical scenarios. So a perfectly acceptable fuel form that was selected in the first place mainly because of its strong Doppler coefficient and is supported with extensive and worldwide characterization data is proposed to be abandoned in favor of an inferior fuel form for the sake of a theoretical event. Keep in mind that it was the EBR-1 meltdown that at least partially supported the need for an effective Doppler coefficient in LMFBRs. In their JSFR-1500 design the Japanese have gone even further. They have taken to referring to beyond design basis events as “design extension conditions”57 for which they plan to use deterministic means for evaluation. They have designed a core catcher in the bottom of their reactor vessel and have modified their fuel assemblies by providing them with an inner duct which is intended to carry molten fuel away from the core. With the core catcher, they are taking the same path as Fermi-1 and inviting the same result. With their inner duct, they are compromising their fuel performance both in breeding ratio and heat generation per assembly. Economics are certain to be compromised. The Russians have not excluded themselves from this picture. They have incorporated into BN-800, 1) a passive emergency shut-down system with hydraulically suspended rods (which is possibly not a half bad idea); 2) a special cavity over the core to reduce sodium void reactivity effect; and 3) a core catcher in the lower part of the reactor vessel to collect and retain core debris under the conditions of “heavy accidents”.58
If one considers the serious accidents that have befallen the nuclear industry, they were the result of the unforeseen and the design bases provided little in the way of prevention or protection that was not incidental. In the case of Three Mile Island, the potential for an operator to misread his instrumentation and as a result take a course of action exactly contrary to that which would have been in the best interest of the plant had not been evaluated. (Of course, it would be impossible to evaluate every possible error that could be made in the operation of a plant. However, the complexity of commercial PWRs partly arising from their regulation certainly contributed to cause this operator error.59 This contribution to the TMI accident has been recognized implicitly with the requirement for increased technical support for all nuclear power plant senior operators.) Although the containment building mitigated the consequences of that event, a containment building designed for a much lower pressure would have been equally effective. Even a confinement building alone probably would have been sufficient to keep site boundary doses well below allowable limits.
The basic problem at Fukushima was the plants had not been designed for station blackout. Why is it that the regulator required the plant to be designed for a double ended pipe break in the primary system but not for the case where all the lights go out? The design bases for Fukushima did little to mitigate the consequences of that event. Then there is Chernobyl where the operator was seemingly out of his mind. Is there a design basis for that? Whatever design bases there was for that plant seemingly didn’t do much good. There will undoubtedly be more accidents and the regulators will realize they goofed again and add more requirements without eliminating the ones that may have caused the problem in the first place. The Three Mile Island operator; who did what he believed to be correct and had been trained for; simply did not realize he had been duped by his instrumentation. When plants become overwhelmingly complicated, that is bound to happen. The point of all this is that if it has been dreamed of and made a regulatory requirement, it probably won’t happen. We are still waiting for the first double ended primary system pipe break to occur on a LWR anywhere in the world. If nobody has ever considered it before, it may happen. For the case of the LMFBR there has been way too much dreaming about the HCDA.
The SRE designers had the right idea. With the exception of the refueling cell and the reactor vault, the only purpose served by the building surrounding the primary system is shielding. The refueling cell should be lined and leak tested since the reactor vessel may be open (OVR) and fuel will be transferred inside either an EVTM or sodium containing shrouds within that cell. Since the reactor vault includes the cold traps, cover gas treatment systems, and the overflow system, it too should be lined, leak tested, and inerted. There is no reason for lining and inerting the IHX vaults. Approximately five feet of concrete is required to provide access to adjacent structures and provide a generally benign environment around the plant. Interior walls inside containment are likely to be ~4 ft. in thickness in the interest of support for upper floors and to provide shielding from the reactor and PHTS. A shield of about 5 ft. concrete thickness should surround the reactor vessel.
The experience of the CRBRP project reveals that it does little good to install features in the design for vague and arbitrarily defined “defense in depth” . Under the circumstances, one should propose a design that is reasonable, is based on events that have some kind of decent probability of actually happening and let the regulatory process take its course. The containment should be rectilinear, include the primary heat transport system, the overflow vessel, the primary sodium storage tank, the primary system cold traps, the cover gas processing system, the refueling cell, possibly a PHTS drain tank that would permit draining one loop, necessary support systems, and as little else as possible. IHTS expansion loops inside containment should be avoided by placing the IHXs near the containment boundary and using bellows seals for the IHTS penetrations. It is much more economic to accommodate IHTS piping expansion within the steam generator building than inside containment. As was mentioned in section 16, the proposed JSFR-1500 containment was expected to have a volume of 20,000 m3. With the reactor vessel shortened it should be possible to keep the containment volume in the vicinity of 20,000 m3. This 20,000 m3 estimate is easily consistent with the dimensions shown on figure 20 in Section 6 and figure 32 in Section 7.
There may be some reasonable things that could be done to further enhance the safety of the design. Some of the suggestions in this paper, such as shortening the reactor vessel will improve control rod drive reliability. Simplification of the plant makes it more comprehensible for those who will be charged with operating it. Certainly, the plant should be designed for station blackout with strong natural circulation capability in the PHTS that would become operative on the occasion of an LOF event. To that end it may prove possible to eliminate safety-grade electric power including the emergency diesels, preserving only battery power supplies for instrumentation. Such a step would be a big safety improvement. Specific suggestions in this area are the topic of Section 11. Other steps to make the reactor shutdown system more reliable or innovations such as self actuating shutdown systems may be reasonable approaches that could be taken to deal with this matter. This topic is treated in Section 10. Adding abstractions such as “defense in depth” has been proven to be an unwise course of action.
Regulatory mandates to add features to the containment to deal with the HCDA are probably unavoidable, but the project leadership must insist that any such features are beyond the design basis and not advocated by the plant owner. There might be a way to design the reactor vault so that it serves as an inner containment while the containment building itself acts as the outer containment. This inner containment approach seems to have been proposed for the JSFR-1500, where a containment is shown surrounding the reactor vessel. 60 Other features may be added if they do not interfere with the plant’s operability and don’t add excessive costs. The extremes CRBRP went to are clearly beyond the pale and contributed to the Project’s termination for excessive cost. Ultimately, the plant owner can walk away from the project if licensing requirements become unreasonably costly and make the plant uneconomic. With this in mind, it would be judicious to minimize plant investment until there is a clear path through licensing. Certainly, no early component fabrication should be undertaken as was done on the CRBRP.
At this point, it is necessary to enumerate the cost reduction measures inherent in the design being advanced as compared with CRBRP as they pertain to the containment:
- 34 Adopt rectilinear containment structure vs. cylindrical and eliminate the requirement for a single elevation basemat.
- 35 Significantly reduce containment volume
- 36 Eliminate requirement for single elevation operating floor. The requirement to have a floor that is accessible during operation inside containment is unnecessary.
- 37 Reduce design pressure from 10 psi to 5 psi or any pressure that will permit reliable leak testing
- 38 Eliminate confinement building
- 39 Eliminate containment cooling system
- 40 Eliminate air filtration processes that extend beyond CAPS
- 41 Eliminate all cell liners not required for containment leak testing
endnotes
50 Beeley, R.J., Mahlmeister, J.E., Operating Experience with the Sodium Reactor Experiment and its Application to the Hallam Facility, Atomics International, undated
51 Technical Information, The Sodium Reactor Experiment; published by Atomics International; undated
52 H. A. Bethe, J. H. Tait; An estimate order of magnitude of the explosion when the core of a fast reactor collapses; UKAEA-RHM (56)/113, U. K. Atomic Energy Authority, Risley, Warrington, Lancashire, England, 1956
53 There was regulatory review of the FFTF design but at that time the regulator and the sponsoring agency, the Division of Reactor Development and Technology (RDT), were both part of the AEC. The breakup of the AEC did not occur until 1975, over three years after the CRBRP project had been initiated and utility industry participation for that project secured.
54 The precedent for the external core catcher was probably the PFR in the UK, which had installed an elaborate external core catcher under the reactor vessel.
55 Partial Initial Decision, ASLB No. 75-291-12, Feb 26, 1983
56 Sholly, Steven, UCS Comments on Supplement to FES on CRBRP, Sept. 13. 1982
57 Ichimiya, M.; Mizuna, T.; Kotake, S.; A Next Generation Sodium Cooled Fast Reactor Concept and its R&D Program; Nuclear Engineering and Technology, Vol. 39, Number 3, June 2007
58 Pakhomov, Ilia; “BN-600 and BN-800 Operating Experience” Gen. IV International Forum; Dec. 19, 2018
59 Flashing of the reference leg on the pressurizer level indicator caused erroneous high level indication during the TMI event, which led the operator to shut down the injection pumps. This was a phenomenon that was often postulated and well known on plants long before the TMI accident.
60 H. Ohira, N. Uto, Progress on Fast Reactor Development in Japan, Meeting of the Technical Working Group on Fast Reactors, June 20-22, 2012
LMFBR.com 