CHAPTER 13 final Rev 7.docx

CHAPTER 13 – TABLE OF CONTENTS

List of Tables

List of Figures

Chapter 13 – Record of Revisions

13-1 13 Accident Analyses

Introduction

This chapter presents analyses to show that the health and safety of the public and workers are protected in the event of an accident. This protection results from the facility design features, the Technical Specifications (Safety Limits, Limiting Safety System Settings, and Limiting Conditions for Operation), and the well-qualified and trained staff of NCNR. All of these combine to ensure that no credible accident could lead to unacceptable consequences to people or the environment.

The accident scenarios that need to be considered were first defined for the original Safety Analysis Report (NBS, 1966, which is NBSR-9) for the NBSR and then redefined when the power level was increased to 20 MW (NBS, 1980). The present analysis conforms to the regulatory guidance for preparation of Safety Analysis Reports for test and research reactors (NUREG-1537, 1996). The scenarios take into account conservative assumptions expected to lead to the most severe consequences.

The present chapter differs from previous versions of the SAR primarily by the use of a new calculational methodology based on state-of-the-art computer tools for reactor physics and thermal-hydraulic analysis. The analysis (Carew, 2004) was carried out by Brookhaven National Laboratory staff and staff from the NIST Center for Neutron Research.

The reactor physics studies of the NBSR core were performed with the three-dimensional Monte Carlo N-Particle (MCNP) Transport code (Breimeister, 1997), and a geometric model initially developed at NIST. The final model included a plate-by-plate description of each fuel assembly, the unfueled mid-plane gap, beam tubes, cold neutron source, and tubular geometry of the shim safety arms, along with many other details of the reactor. For some of the studies, homogenization of partial regions was used for computational simplicity. Each of these cases was checked for the effect of the homogenization. The model was extensively benchmarked against measurements at NBSR of critical shim safety arm position, differential shim safety arm worth, regulating rod worth, performance of three different cold neutron source designs, neutron flux at beam tubes, and heat production in various structures. The MONTEBURNS code (Trellue, 1998), which links MCNP to ORIGEN, a code that calculates fission product production and decay, was used to calculate core inventory as a function of burnup. Models were created for beginning-, middle-, and end-of-cycle.

Time-dependent transient behavior of the reactor was calculated using RELAP5 (NUREG/CR-5535/Rev1) with a model that included the pumps, heat exchangers, fuel element geometry, and flow channels including both the six inner, and 24 outer, fuel elements. All final calculations were performed with a version of the code in which an error in the kinetic calculations that was found during the analysis was corrected. For some events MCNP results for power distributions were used to help obtain the critical heat flux ratio (CHFR, the ratio of heat flux required for film boiling to actual heat flux). The Mirshak (Mirshak, 1959) correlation, which was developed for rectangular flow cross-sections and used in NBSR-9, and the Sudo-Kaminaga (Sudo, 1993) correlation were used to obtain the critical heat flux for forced flow. All transients were also checked for Flow Instability, using the Costa correlation (Costa, 1969) and the Saha-Zuber (Saha, 1974) correlations. In order to provide a quantitative estimate of the reliability of predictions from these calculations, a statistical model of the heat transfer was developed, including estimated errors for all parameters. These errors were estimated either from manufacturing data or from fitting errors for correlations, and converted to standard deviations. All errors were assumed to be normally distributed, and a Monte Carlo technique was used to calculate the magnitude of the CHFR required to give differing confidence levels that no damage would occur. These results were used to ensure that for every accident analyzed, the total probability of fuel damage was less than 1x10-5 per year (including an estimate of the probability of the initiating event occurring). Table 13.1 lists the values of CHFR required for various levels of confidence that Departure from Nucleate Boiling (DNB) will not occur, and a more complete derivation of the statistical model is given in Carew, 2004. It should be noted that the parameters defining a hot channel are set to one (not randomly varied) for the following accident scenarios, since all scenarios were done for the (deterministic) hot channel (i.e. the channel with the smallest flow area).

The BNL study (Carew, 2004) was used as the basis for many of the accident analyses that follow, and in many cases only the salient result is quoted below; in those cases, full details are contained in Carew, 2004.

13.1 Accident-Initiating Events and Scenarios

In this section all possible accident initiators are considered and the cases with the most limiting conditions are discussed. An analysis of these accidents and their consequences is provided in Section 13.2. The Maximum Hypothetical Accident (MHA) assumes fuel damage, and analyzes the consequences.

13.1.1 Maximum Hypothetical Accident (MHA)

The Maximum Hypothetical Accident is postulated as a complete blockage of flow to one element, leading to complete melting of the fuel plates. Such blockage is very unlikely, but is assumed for this analysis in order to allow for a release of radioactive material. The origin of the blockage is not identified; it is simply assumed. The consequences of this scenario bound the consequences of all partial blockages.

13.1.2 Insertion of Excess Reactivity

Detailed analysis shows that damage to the core from insertion of excess reactivity is not credible as a result of administrative controls, engineered safety features, and passive safety features in the NBSR. It should also be noted that addition of light water to the NBSR system provides negative reactivity in all concentrations (Section 4.5.2.2.3). The following reactivity insertion initiating scenarios are considered.

13.1.2.1 Step Reactivity Insertion

It is not credible that excess reactivity can be added to the NBSR by dropping a fuel element into an empty position in a critical core, since there are no empty positions. Also, refueling is only performed when the reactor is fully shut down with shim safety arms fully inserted. Further, only one element is ever moved at one time, so that an empty position could only arise from an element that had already been removed, making the reactor even further subcritical. When the core is being restored from the storage pool, it is possible to have empty locations in a nearly critical core, but procedural controls are in place to ensure that the shim safety arms are fully inserted when fuel is being moved. Having the shim safety arms inserted would preclude criticality even if the fuel were inserted improperly. No other mechanisms have been identified for a step (or very fast ramp) insertion of excess reactivity.

13.1.2.2 Ramp Reactivity Insertion

Two possible mechanisms for a ramp insertion of excess reactivity have been considered; the scenarios are given below. The result of an insertion of cold D2O was considered in NBSR-9, and shown to be a slow ramp insertion of less than 1% in 45 seconds. The consequences of such a scenario are clearly bounded by the two cases considered below.

13.1.2.2.1 Startup Accident

For this initiating event, we assume that in violation of training and procedures, the reactor operator continues to withdraw the shim safety arms from the reactor at a rate equivalent to the 5x10 -4 Δρ per second (a rate in excess of the measured maximum rate at any shim safety arm position). The period scram, which is effective for powers below 2 MW, is assumed to be inoperative for consistency with earlier analyses (NBSR-9).

13.1.2.2.2 Rapid Removal of Experiments

The excess reactivity of any single removable experiment in the NBSR is limited by Technical Specification 3.8.1 to 0.5% Δρ. Thus, the maximum credible excess reactivity insertion that could be caused by removal of a single experiment would be 0.5% Δρ, and this could certainly not be accomplished in less than 0.5 s. Thus, an accident in which a single experiment with the maximum allowed reactivity (0.5%Δρ) is removed in 0.5 s, which is a 1.0 %Δρ/s ramp, was analyzed.

13.1.3 Loss of Primary Coolant

A sudden loss of primary coolant from the NBSR is not credible. The main piping is located in protected areas, system pressures are low, and flow rates are small so that wear is not an issue. Nonetheless, the scenario assumes a major pipe break in the process room, which allows all of the primary coolant to drain from the reactor vessel into the process room located under the reactor while the reactor is operating at 20 MW.

13.1.4 Loss of Primary Coolant Flow

Six different scenarios for loss of primary coolant flow have been analyzed.

13.1.4.1 Loss of Off-Site Power

In this scenario, off-site power is lost, and the three primary coolant pumps trip. The reactor scrams on low flow.

13.1.4.2 Seizure of One Primary Coolant Pump

In this scenario, one of three primary pumps is assumed to seize up suddenly, imposing a rapid flow decrease, but the reactor scram as a result of low flow is delayed.

13.1.4.3 Throttling of Primary Coolant Flow to the Inner Plenum

Because of the two-plenum structure of the NBSR primary system (see Chapter 5), the possibility of inadvertent blockage of flow to the inner plenum exists, presenting another scenario for a loss-of-flow transient.

13.1.4.4 Throttling of Primary Coolant Flow to the Outer Plenum

Because of the two-plenum configuration of the NBSR primary system (see Chapter 5), the possibility of inadvertent blockage of flow to the outer plenum exists, presenting another scenario for a loss-of-flow transient.

13.1.4.5 Loss of Both Shutdown Pumps

In this scenario, the loss of off-site power analyzed in Scenario 1 above is followed by a complete failure of all backup power sources (a highly unlikely event, as all systems undergo regular surveillance testing). The only core cooling after flow coast down is due to natural convection in the vessel and primary system.

13.1.4.6 Inadvertent Closure of Valve DWV-19

Valve DWV-19 is a motorized 18 inch butterfly valve mounted in the outlet line from the NBSR, with a measured stroke time, fully open to fully closed, of 21 seconds. Although this valve is only used during maintenance when the reactor is shut down, it is conceivable that it could receive a spurious signal while operating at full power, resulting in a loss of primary flow. The only cooling mechanisms present after the valve is completely closed are the thermal capacity of the primary coolant in the vessel, and heat transfer from the reactor vessel to the biological shield.

13.1.5 Mishandling or Malfunction of Fuel

Four separate scenarios involving mishandling of fuel were extensively analyzed in NBSR-9, Addendum 1 (NBS, 1980), and shown to present no significant risks. These accidents were: a refueling accident involving a dropped element; dropping of a fuel element into the storage pool; dropping of a heavy object onto the fuel rack in the storage pool; and dropping of the spent fuel cask during a shipping operation. There has been no change in any of these accidents so the previous analysis remains valid. In addition to these scenarios, the possibility of an element being inserted into an incorrect position during refueling has now been analyzed, and shown to present no possibility of core damage. This analysis is presented in Section 13.2.5.

All fuel for the NBSR is subject to stringent quality control to ensure that there will be no “leaky” elements that could release fission products into the primary cooling system. In addition, if any element were to leak, the fission products would be detected immediately, and the faulty element would be identified and removed. This has only happened once in the operating history of the NBSR, and there were no releases to the atmosphere. The releases to the primary coolant were small, and the normal water treatment system quickly removed all traces of activity once the element was removed.

13.1.6 Experiment Malfunction

All experiments associated with the NBSR are carefully reviewed for hazards prior to being approved for construction and installation. Beam experiments external to the biological shield present a very small potential hazard to the reactor. Nevertheless, an experimental proposal must be prepared or amended before they can be installed or significantly modified. All proposals are reviewed in accordance with the Technical Specifications and Administrative Procedures. The Safety Evaluation Committee makes a recommendation to the Director of the NIST Center for Neutron Research, who has responsibility for final approval of any experiment. Thus, except for the reactivity issues addressed in Section 13.1.2, experiment malfunctions are not a credible threat to the core.

13.1.7 Loss of Normal Power

A Loss of Normal Power event is addressed in Section 13.1.4.1 above.

13.1.8 External Events

Damage to the core from external events, such as tornados, hurricanes, floods and earthquakes is not considered credible as a result of design features, administrative controls and the seismological and climatological characteristics of the site. Details are provided in Section 13.2.8.

13.2 Accident Analysis and Determination of Consequences

The NBSR is the only test reactor licensed and regulated by the Nuclear Regulatory Commission (NRC). As such, it is subject to the requirements of 10 CFR Part 100 in analyzing the consequences of any postulated accidents. It is used entirely as a source of neutrons for research in materials science, biology, chemistry, physics, and engineering. The power is limited to 20 MW, and there are no loop experiments or large-volume experiments (either permanent or removable) installed in the core. The reactor was designed with many passive safety features that limit the possibility of accidents resulting in fuel damage or radioactive releases (Section 1.2.3). The reactor is of the tank type, with a fully enclosed primary cooling system, moderator, and reflector. The reactor incorporates a passive emergency core cooling system. Reactivity decreases with increasing temperature. Reactivity also decreases with void formation in the primary coolant and with introduction of light water into the primary system. Thus, there is minimal potential for an accident with off-site radiological consequences. The exclusion zone is set at 400 m (entirely within the perimeter fence at the NIST site boundary) in Technical Specification 5.1, and all dose limits are calculated at this distance. This Emergency Planning Zone (EPZ) was chosen in accord with the guidance in NUREG-0849, Appendix II. The analyses for the present case were computed at this distance, and show that this is completely adequate for the EPZ.

In this chapter, several accidents are analyzed and all except the MHA, which was expressly postulated to cause fuel damage with no credible initiating event, are shown to cause no fuel damage. This is the basis for Technical Specification (TS) 2.1 which establishes as the safety limit that the fuel cladding temperature shall not exceed 450 °C, which is the minimum temperature at which fuel blistering has been observed. In each case, it is sufficient to ensure that neither a Departure from Nucleate Boiling (DNB) nor Onset of Flow Instability (OFI) occurs. This TS is at the heart of all analyses except for the MHA. In what follows, the TS relevant to each accident analyzed is presented and analyzed for relevance to the bases of the Technical Specifications and to the conditions assumed in any mitigating action taken. The initial conditions for each accident analyzed (except for the MHA for which the initial reactor conditions are irrelevant) are given below.

In every case, RELAP analyses were conducted for very conservative conditions, with the reactor power, coolant level, inlet temperature and flow at the limit of their normal operating range. These conditions are:

Also, the hot channel (the one with limiting gap, and hence flow area) was used to derive the CHFR, rather than the normal channel. The statistical model was revised to account for this choice.

13.2.1 Maximum Hypothetical Accident (MHA)

Limiting Assumptions:

A complete flow blockage of one element is assumed, with no credible initiating event.

The entire fission product inventory from this element is assumed to be released to the primary water immediately.

Technical Specifications

TS 3.2.2 specifies that the reactor will scram on high effluent air, and this is used to terminate reactor operation.

TS 3.4.1 specifies that confinement must be present when the reactor is operating, and this is assumed for calculation of consequences.

TS 3.5 specifies that ventilation (normal and emergency) must be operational, including both effluent and recirculation filters, and this is assumed for calculation of consequences.

TS 5.1 establishes a 400 m exclusion zone around the reactor, and this provides the boundary that excludes the public, and therefore the distance at which public doses are calculated.

For this accident the Technical Specifications above provide assurance that the mitigating factors assumed are present. The analysis shows that that the doses are less than those specified in 10 CFR Part 100.

In this scenario, all primary coolant flow to one element is blocked by unspecified means. This would result in a rapid decrease in reactivity as the water in the element boiled and was expelled from the fueled region of that element. As fuel temperature rises, local boiling of the moderator would occur, and cause power fluctuations. We assume that none of these leads to a shutdown, so that the element heats steadily until the fuel plates melt, releasing all of their fission products to the primary coolant. At this point, the reactor would be shut down for one of the following reasons:

· The fission product monitor would alarm shortly after the first release, leading to a manual reactor scram.

· As the fuel plates melt, fuel would drop out of the core region, leading to loss of reactivity and shutdown.

· The stack monitors in the effluent air exhaust would alarm, leading to an automatic major scram (TS Table 3.1).

It should be noted that the melting of fuel would occur far below 1000° C, which is the temperature at which metal-water interactions needs to be considered. The reactor would be shut down, and heating rates would rapidly drop, precluding further temperature rise. Under any of these scenarios, normal ventilation is secured, confinement is isolated, and emergency ventilation would be automatically established by the high stack activity. This condition is assumed for the duration of the accident. At this stage, it is necessary to consider the timing and nature of the fission product release to the confinement building. Since the MHA does not involve a release of primary coolant, the important fission products are the noble gases and iodine (which may remain volatile at the temperatures that would be reached). The inventory of noble gas and iodine fission products in the most heavily irradiated element is given in Table 13.2, as determined by the computer code ORIGEN2 (Croff, 1980). The most heavily irradiated element is used to ensure maximum release of fission products. The highest concentration of gaseous fission products could not exceed the value of this element by more than 16%, the maximum power factor in the NBSR.

All of the noble gas fission products would be released into the primary coolant and then, since they are insoluble in water, would quickly collect in the helium space at the top of the reactor vessel, which has a volume of approximately 0.7 m3. The iodine releases require separate consideration. In past analyses, it was assumed, based on existing guidance, (DiNunno, 1962), (WASH-1400,1975), (Soffer, 1995) that 50% of the iodine would be released to the confinement building, with half of that available to the ventilation system. However, there has been extensive research into the iodine chemistry (Weber, 1992) that would take place in the aftermath of severe accidents. Although most of these analyses were aimed at power reactors, the results have also been used to develop an analysis (Weber, 1993) of a severe accident at the High Flux Isotope Reactor (HFIR) at Oak Ridge National Laboratory. The salient result of these studies for the present case is that for the temperatures that would occur in the NIST MHA, 99.9% of the iodine would be in the form of CsI, and would remain in solution in the primary coolant water. Radiolysis can transform CsI to I2 gas, especially for low pH (up to 5% for pH = 5) situations, at high radiation doses. Nevertheless, consideration of these effects leads to the conclusion that less than 3% of the total iodine release will be present as I2. Gaseous I2 is soluble in water at up to 0.3 g/l at 298 K, with Henry’s constant = 3.1 (dimensionless) (NIST, 2004). The large volume of primary coolant in the reactor vessel (which will remain below boiling temperature throughout the accident) will lead to very low I2 concentrations, with correspondingly low vapor pressure, and I2 will evaporate slowly into the helium space. This analysis makes the assumption that 3% of the initial iodine is released as I2. Further, it makes the conservative assumption that the vapor pressure of 1.x10-9 bar, corresponding to the solution of this amount, is immediately available in the helium space at the top of the reactor vessel. It should be noted that the hypothesis is instantaneous release, so that the different behavior of different fuels is not considered.

The preceding analysis describes the gaseous fission products that are immediately available in the helium space at the top of the reactor vessel. These will be released to the confinement building along with helium at a rate characteristic of the tightness of the primary system under emergency ventilation conditions (no normal building exhaust). This leak rate has been measured by observation of the increasing tritium levels in confinement during a prolonged shutdown of the building ventilation system for asbestos removal in February and March of 1989 (NIST, 1989). Table 13.3 shows the leak rates determined for the three areas of confinement. Exhaust rates to the stack from these spaces are then determined by the emergency ventilation system. The removal or release rates from each space are also shown in the Table 13.3. The removal rates calculated assume that the emergency ventilation system is activated, that the filters perform as described in Section 6.2.3.2 of this SAR, and that no deposition (which would increase removal rates substantially) occurs.

These data provide the source term for estimating doses to the general public at the 400 meter exclusion radius, and to the staff in the building, under the conditions postulated for the MHA.

The doses to the public have been calculated following standard techniques. For doses resulting from the passage of radioactive clouds, the codes HOTSPOT (Lawrence Livermore National Laboratory, 2004) for short-term doses (first day), and CAP88 (Environmental Protection Agency, 2004) for estimation of long-term doses (>1 day), have been used. The direct doses have been calculated following the methods used in NBSR-9, allowing for the depletion of the fission products in the building as the gases are released. The scattering from the air above the confinement building is calculated with SKYDOSE (Shultis, et. al., 1999). The iodine dose to the public is entirely negligible, as shown in Table 13.4. This is a direct result of the aqueous iodine chemistry, the mitigating effect of the filters, and the closed primary system. All dose components are small, and well within regulatory requirements.

To estimate the dose to the staff, the model of the release of noble gases and iodine developed above was used to calculate concentrations in rooms C-100 (the experimental floor) and C-200 (the operations level, where the control room is located) as a function of time spent in the area. The latest approved coefficients for immersion (Eckerman and Ryan, 1993) and inhalation were used to convert these concentrations into dose equivalents. The calculated dose to the staff is highest on C-200, where the reactor operators would be during an accident. The calculated dose on the first floor, where experimenters would be located, will be significantly lower as a result of the slower release rate to that area. To estimate doses, we assume immediate complete mixing (this is conservative, as the concentration will be highest in the middle of the room, while the control room is located nearer the outer perimeter walls). By procedure the operators would evacuate the building of all non-essential personnel immediately upon seeing the high readings of stack monitor and fission product monitor. They would then proceed to place the reactor in a safe condition, and leave themselves. For purposes of dose estimation, we assume that this takes 10 minutes, although it could be done more quickly. The doses are given in Table 13.5.

These calculated doses are based on conservative assumptions, and show that the reactor can be put into a safe condition and all personnel evacuated within the dose limits allowed for an emergency (exclusion from lifetime doses of 25 rem CEDE and 300 rem CDE to the thyroid). In practice, drills have shown that the occupants of C-100 can be evacuated from C-wing within 2-5 minutes without any difficulty. The reactor operators, who are stationed on C-200, would require more time to ensure that systems are properly secured, but would be able to evacuate within 10 minutes, leaving the reactor in a completely safe configuration. If required, operators could re-enter the confinement building to perform surveillance or other tasks. In fact, they could remain in C-200 for up to 25 minutes without exceeding the 25 rem CEDE emergency dose limit.

The above calculation of the estimated dose to the staff was re-examined using a more realistic yet still conservative assumption for the flow blockage of a fuel element. A screen located upstream of the core has a 0.25 inch (0.635 cm) square mesh, which could allow a thin piece of material 0.35 inch (0.89 cm) wide to pass and enter a fuel element. Assuming, conservatively, that this piece is 3 inches (7.62 cm) long, and also, conservatively, that it positioned itself so that it completely blocked flow to two channels on either side of a single plate, then only one plate (out of 34) will fail. In this case, the doses calculated above will be reduced by a factor of 34, or to 3% of the values shown in Tables 13-4 and 13-5.

On the basis of these calculations, the projected doses from the MHA are acceptable both for the general public and for the staff.

13.2.2 Insertion of Excess Reactivity

Technical Specifications

TS 2.2 specifies the Limiting Safety System Setting at which reactor power scrams are calculated as the terminating event for all accidents of this type.

TS 3.1.3 specifies the core configuration.

TS 3.2.1 specifies the shim insertion times used in the RELAP model, and also specifies the maximum allowed rate of reactivity insertion.

These three Technical Specifications are common to the reactivity insertion accidents, and the results show that the TS provide assurance that the safety limit will not be exceeded.

13.2.2.1 Step Reactivity Insertion

Limiting Assumptions

None (No credible initiating scenario)

Technical Specifications

TS 3.1.3 provides assurance that there are no empty core positions into which an element could fall accidentally.

This scenario has not been analyzed since there is no credible initiating scenario.

13.2.2.2 Ramp Reactivity Insertion

Limiting Assumptions

The startup accident assumes that reactivity is inserted at the limit specified in TS 3.2.1, starting from 100 W and continuing until the reactor scrams at the LSSS of 26 MW.

The period scram active below 2 MW is assumed not to operate.

The rod withdraw prohibit function is assumed not to function.

The rapid Removal of Experiments accident assumes that an experiment having the maximum reactivity of 0.5 % is withdrawn in 0.5 s.

Technical Specifications

TS 3.2.1 provides assurance that the shim arms will operate as designed after a scram is received, limits the rate of reactivity insertion by shim arm withdrawal, and provides assurance that the shim insertion time will be no longer than that assumed in the RELAP analysis.

TS 3.8.1 limits the worth of any single experiment to 0.5 % , which provides assurance that the insertion considered is bounding.

The analysis shows that the limits specified provide assurance that the Safety Limit will not be exceeded. This analysis also provides the basis for the Technical Specification limits.

The accidents associated with the two scenarios described in 13.1.2 have been analyzed using a point kinetics model. The reactivity worth of the shim safety arms is shown as a function of angle in Figures 13.1 and 13.2 for various cases of shim depletion due to Cd burnup. In scenarios involving excess reactivity insertion, the initial rate of insertion of negative reactivity following a scram is an important parameter. Figures 13.1 and 13.2 show clearly that this rate is lowest (for the operating range of the shim safety arms) at end-of-cycle (EOC), when the shim safety arms are fully withdrawn. Another key parameter is the hot spot heat flux, and this is a maximum for the start up core (SU). It is the interplay between these two parameters that accounts for the differences in peak power and minimum CHFR in the cases analyzed in the following sections.

13.2.2.2.1 Startup Accident

This accident has been analyzed, with the reactor at the conditions discussed in Section 13.2, except for power, which is assumed to be 100 W for this accident. Calculations were performed for both the startup core and the EOC core, and the results at EOC produced the larger energy excursion, but the startup core had the limiting CHFR. For these calculations, the reactivity insertion rate was assumed to be 5x10-4 Δρ/s, a rate equal to the limit given in Technical Specification 3.2.1. This rate is in excess of the measured maximum rate at any shim safety arm position, and particularly conservative at EOC. The scram was assumed to occur at 130% of full power, the Limiting Safety System Setting specified in Technical Specification 2.2.

The shim safety arm insertion was assumed to be described by:

Δθ = a(t-δ)2 where a=248.9 º/s2, δ = 0.0983 s, and t = time after scram initiation.

This implies a time of 0.241 s to insert the shim safety arms 5º. Conservatively no temperature or other reactivity feedback mechanism was included in the calculation. Using these assumptions, RELAP5 was used to study the transient behavior, with the result shown in Figures 13.3 and 13.4. This scenario results in a Minimum Critical Heat Flux Ratio (MCHFR) greater than 1.7, providing ample margin to ensure that no fuel damage will result. This result is conservative, for reasons that are discussed in Chapter 4 and in section 13.2.2.2.2 below. The startup accident in the SU core, however, had a lower MCHFR, 1.47, than the EOC case, even though the peak power was somewhat lower, as seen in Figure 13.3. This CHFR is equivalent to a 99.9 % probability that there will be no DNB, and thus no fuel damage. This accident assumes an operator error that is very improbable, since during operator training, the possibility of a very short period is particularly stressed. Several alarms would alert the operator to the error, and other operators would also intercede. However, if we ignore the existence of these ameliorative factors, we can very conservatively estimate the probability of an operator error as approximately 1 in 1000 attempts (SLAC ES&H Manual, 2006), and the reactor is started with a fresh core only 7-8 times per year, and there are more than 8 operators. This implies an overall probability for fuel damage from this accident of approximately 106 per year, which is an acceptable level.

The above analysis is very conservative, since there is a period scram that is operational at powers less than 1 MW, which would terminate the excursion before the reactor even reached full operating power. An analysis of this scenario, and of the scenario in which the shim arm withdrawal begins just below the power at which the period scram is disabled (1 MW) shows that the accident analyzed bounds all such accidents.

13.2.2.2.2 Rapid Removal of Experiments

The assumed accident involves removal of an experiment with the maximum reactivity of 0.5 % Δρ in the shortest time possible, 0.5 seconds. This postulated accident has been analyzed with the following assumptions:

· Initial power = 20.4 MW

· Reactor power scram occurs at the LSSS of 26 MW (130%)

· Negative feedback from increasing fuel and coolant temperatures is neglected

· Shim safety arm motion as in Section 13.2.2.2.1

· Prompt neutron lifetime of 650 μs Two cases were analyzed, one for the startup core and the second for the equilibrium EOC core, and both are described in detail in a memorandum from Brookhaven National Laboratory (Cuadra, 2007). The results for power and MCHFR as functions of time are shown in Figure 13.5 for the SU case, which has the highest heat flux and is limiting. The lowest value of the MCHFR observed occurs in the outer plenum, and is greater than 1.72, providing a substantial margin against fuel damage.

This estimate is conservative, for the following reasons:

· The effect of three dimensional heat transfer from the hot stripe and hot spot to neighboring unfueled regions was neglected. Calculations have been done using finite element heat transfer to show that this effect reduces heat fluxes at the hot spot by as much as 20-25 %. The effects of cooler water in the channel next to the hot channel are also ignored.

· The heat fluxes are estimated on the basis of the fission density, which assumes that all of the energy is deposited locally. However, 11 % of the fission energy will be deposited uniformly throughout the core, in other structures or in the moderator.

· The original model was used for heat fluxes, which is shown to be conservative in Chapter 4.

· The 650 μs prompt neutron lifetime used is conservative; the MCNP calculations presented in Chapter 4 indicate a value closer to 800 μs.

· The scram was assumed to occur at 130% of power, rather than the actual setting of 125% of power.

Since a CHFR of 1.7 implies a probability of less than 10-5 of having a Departure from Nucleate Boiling, this transient, which is in itself unrealistically conservative, will not lead to any fuel damage or to the release of fission products.

13.2.3 Loss of Primary Coolant

Limiting Assumptions

A major rupture in the cold leg of the primary system is assumed, which leads to draining the reactor core.

Technical Specifications

TS 3.3.2 provides assurance that emergency cooling is available as assumed.

TS 3.7.1 establishes a limit of 5 Ci/liter on tritium concentrations in the primary.

TS 3.4.1 ensures that confinement is established when the reactor is operating as assumed.

TS 3.5 ensures that emergency ventilation is available when the reactor is operating as assumed.

The analysis provides assurance that the limits established will protect the public and ensure that the accident is bounded by the MHA.

This scenario is extremely unlikely, for the reasons given in Section 13.1.3. However, for purposes of analysis, we assume a major pipe rupture that drains the entire contents of the reactor vessel, approximately 3,000 gal (11 m3), into the process room. The primary coolant is trapped there by a dam built for the purpose, resulting in a pool with a surface area of approximately 1080 ft2 (100 m2). The reactor scrams immediately on a loss–of-flow signal. The operation of the NBSR emergency core cooling system, for which initial action is totally passive, is fully described in Chapter 6. Primary coolant, contained above the core in the Inner Reserve Tank (IRT), drains to a distribution pan that directs the coolant to individual elements for several minutes when needed. No action is required to initiate this flow. Operation of a single valve adds the capacity of the 3,000 gallon (11 m3) D2O Emergency Cooling Tank located on the operations floor 30 ft (9.1 m) above the core. Thus, with only one operator action (which can be accomplished at any time in the first 20 minutes), the core is fully protected for 2 1/2 hours. During this time, a system already in place can be started, and lost primary water would be pumped from the dammed area in the process room up to the D2O Emergency Cooling Tank, providing virtually unlimited cooling time. Alternatively, if needed, through the addition of a single spool piece, light water can be piped into the system to provide cooling. The operation of the emergency cooling system has been analyzed (Carew, 2004), where it has been shown that the water will flow into the elements from the top for over 20 minutes. With the cooling provided by this system, the temperature of the clad will remain below any blistering temperature. Thus, no fission products will be released during this accident. However, the primary water will contain tritium as a result of neutron capture in the heavy water, and the radiological consequence of this needs to be computed.

For analysis purposes, the following conservative assumptions are made:

· The tritium concentration in the primary coolant is 5,000 μCi/ml, the maximum allowed by Technical Specification 3.7.1. In fact, tritium concentrations are generally controlled to below 2,000 μCi/ml, so this is a conservative assumption.

· After the break, emergency ventilation is immediately established.

· The process room is not isolated from the emergency ventilation system (ACV-10 is left open).

· The Emergency Ventilation System pulls a flow of 15 cfm (7.1x10-3 m3/s) from this area.

· Equilibrium between the spilled heavy water at an assumed temperature of 108˚F (42˚C) and the air in the process room is established immediately.

With these assumptions, we calculate the rate of tritium release to the stack:

R = FρD2OC where:

F = Flow rate = 7.08x10-3 m3/s, ρD2O = mass of D2O per m3 at saturated vapor pressure = 55 g/m3, and C = Tritium Concentration = 5,000 μCi/ml = 4.5x10-3 Ci/g.

Or, R = 1.8x10-3 Ci/s.

Using this release rate, the effluent concentrations have been calculated for a variety of weather conditions, using three different EPA codes (COMPLY, SCREEN3, and CAP-88). These codes have different levels of conservatism built into them, roughly in the order that they are listed with COMPLY being the most conservative. For all of the codes listed, and weather conditions used, the effluent concentration at or beyond the 400 m boundary is less than 1000 nCi/m3. This last value was found for extremely stable conditions and low wind speeds, which could not persist over any significant length of time. It should be noted that any release would be terminated within 24 hours, as remedial measures (pumping water into tanks, closing ACV-10, covering spilled water with plastic) would be taken immediately. Taking these time factors into account, no individual would receive as much as 0.2 mrem total dose even if they stood at the boundary throughout the release. If the entire inventory were to leak out in this manner, a person at the site boundary would receive less than 6.5 mrem (calculated using COMPLY), or 6.5% of the permissible annual dose to the general public. This last calculation assumes average weather conditions over the year, as measured at Ronald Reagan Washington National Airport, and assumes the entire inventory in the vessel is released. Since this accident would not result in exposures approaching 10 CFR 20 limits, there are no serious off-site consequences.

The primary coolant is confined to the process room where the tritium levels are determined by the vapor pressure. For the conditions analyzed, this will result in a concentration approaching 1.25x104 DAC. Access to this area is always strictly controlled. If prolonged access were required, special provisions would be implemented to control exposure to acceptable levels.

13.2.4 Loss of Primary Coolant Flow

Limiting Assumptions

The off-site power loss scenario assumes that all three primary pumps coast down, and that a low flow trip occurs 400 ms after the low flow condition is reached.

The seizure of one pump scenario assumes that the flow through one pump stops instantaneously and that a scram occurs at the normal setpoint (note that the flow will not drop to the LSSS, and thus that the CHFR will exceed 2 even if no scram occurs).

The throttling of flow to either the inner or outer plenums assumes that valves are fully closed, and that the reactor scrams on low flow 400 ms after the low flow condition is met.

The loss of both shutdown cooling pumps assumes the off-site power loss scenario, plus failure of both shutdown pumps. It is further assumed that shutdown cooling can be restored in the several hours before the entire vessel warms up to the boiling point.

The final loss-of-flow scenario assumes that valve DWV-19, located in the reactor outlet, receives a spurious closure signal, and fully closes.

Technical Specifications

TS 2.2 establishes the LSSS for reactor flow scrams, and the RELAP analysis uses these levels, which are shown to result in no fuel damage.

TS 3.6 assures that emergency power is available to provide shutdown cooling following a loss of off-Site power.

All accidents are shown to result in no fuel damage, providing the basis for the Technical Specifications.

Six scenarios have been given for an accident of this type, and all were analyzed (see Carew, 2004; Rowe, 2009; Hwang, 2009). None of these scenarios led to fuel damage, and the minimum value of the CHFR during the transients analyzed was found to be 2.2 for the case of loss of off-site power (Section 13.1.4.1).

The result for the fifth scenario is of particular interest, since it includes the case of loss of forced flow and onset of natural convection cooling (it should be noted that primary coolant flow is upward through the elements in the NBSR, so that no flow reversal is required to establish convection cooling). The analysis incorporates a new measurement of the flow coast-down curve for the NBSR performed during 2009, which was used to derive an analytical form for the flows in the outer and inner plena after a loss of power in which neither of the shutdown pumps started. This is a very conservative assumption, since it assumes at least three independent failures. It should be noted that the beginning of this transient is exactly the same as that for the loss of off-site power. There is some oscillation of flow as the natural convection loop begins to cool the reactor (between 40-160 seconds; see Table 5-9 in Carew, 2004), but the situation rapidly stabilizes, and there is no possibility of fuel damage. At intermediate times (18-20 s), the oscillations create unrealistic values for heat transfer coefficients for very short time intervals, which give low CHFRs (see Fig. 13.6), but these low values do not persist or any length of time. Fuel meat temperatures remain well below the safety limit throughout the transient, which ends when a stable natural convection mode is established.

The analysis of the sixth scenario shows that it is the limiting case for any loss-of-flow accident as a result of the complete lack of flow after DWV-19 is completely closed. This accident has been analyzed using RELAP to model the flow resistance through DWV-19 based upon the measured stroke time of 21 seconds, and the manufacturer’s data for flow resistance as a function of valve position. The results of this analysis are shown in Figure 13.7 and Table 13.6. A scram occurs for low flow in the outer plenum at 17.24 s, and the calculated minimum CHFR is approximately 2.2. At longer times of approximately 21 s, after all flow has stopped (DWV-19 completely closed), natural convection is set up within the fuel elements, the flooding condition (Carew, 2004) is met, and the fuel is fully protected so long as it is completely covered by water.

13.2.5 Mishandling or Malfunction of Fuel

Limiting Assumptions It is assumed that a fresh fuel element is placed sequentially in every possible position in the core, in spite of all precautions to prevent this occurrence.

Technical Specifications TS 3.1.3 controls core configuration.

TS 3.9.1 provides assurance that fuel shall not be stored so that keff can exceed 0.90 and will be not be handled in air without adequate cool down time.

During refueling of the NBSR, all 30 elements are moved; four are removed to the storage pool, the remaining 26 are moved to new positions, and four new elements are added as part of a carefully planned and executed fuel management program. During this operation, there are always two operators at the reactor top, one to move the element, and the other to verify that the move is correct. In addition, there is an operator in the control room, who also verifies and records each move. These procedures make it very unlikely that an element could be loaded into an incorrect location. Nevertheless, the following is an analysis of the case in which, in spite of all procedures, a fresh element is located in a higher flux location than planned, leading to a higher heat load.

The possible power peaking was calculated with MCNP by sequentially switching one fresh element with one of the 26 partially burned elements in the startup core. The result of this calculation allowed selection of the worst possible case for further analysis. Details of the calculation are given in Carew, 2004, and summarized in Table 13.7. The minimum value of the CHFR is 2.0, and therefore no fuel damage is anticipated (Carew, 2004).

13.2.6 Experiment Malfunction

Limiting Assumptions

None beyond the Technical Specifications.

Technical Specifications

TS 3.8.1 requires that the failure of single experiment not affect any other experiment, and that no reactor excursion shall cause an experiment to fail in a manner that could affect an accident.

TS 3.8.2 specifies the requirements on materials used in experiments to provide assurance that they will not damage reactor systems.

TS 4.8 Limits the reactivity of any single experiment TS 6.5 requires that all experiments installed in the reactor be reviewed by the SEC and approved by the NCNR Director.

Thes…