*1

I..

I.

A CRITIQU1, Or- A1h SX! , A~CI

IleD'ynie F. Ford

THEi UNION. or, OMNIIE ScINITx;S'x4 Cambridge, iMassachusetts

* .9

* ., . .4. .4. 4*

4 * 4,..

81010R 711025 PDRADOK 0500247, 0DR

~3.

C'

0 1

* .... , (~;

.9

2 ~h.

,.

0

E~cc. ~,

0

"Heavy relialicb has b=en placed on engieerij safety features such as. the 1=CS [nneixycricy.Core-Cool1ng y~ tem] , where. technolog .y is cmiPlex . Sanme of.-the ifomiation nece4 to confirm convJncirgly the adeqluacy of~ such pystsntw, which are'intended'to arrest thq course of.hyothotJe!cal latrge, Pr*way py-Stem falures, isrmt yet; available,

-- Gpoie MJ. Yavanagjh,, Assist~ant General Managew for Reoactors I US;: Atonic 4rirgy caiim-dsioin (quo Led:

9

J. AfacKenzte Nucea L PhyziLcst, Joint Srl c~n 6.1C Staff, MAachwseYA g Nationat Audubon SodLeVtcs. ChoOuiian, Union o6 Concernd SLe.ntL5t6

>2'

we wLsh to thank D., Ian A, Folibes o the Nu.cear En.n.dmnq Dep , net 1 o t1he Lowett InsstLtute o Tecilboog 6ortt mny hdptt2. dAcuzs).n dwang the pi.jxpmaton o6 thiz papel. . Vr Fol.vz ha exprcu4ed -o-t.a agiceemen Utath the copndu.!iotms and 4eomndation6,6 th 4hkA Aot*

THE UNION OF CONCERNED SCIEN7STS

The U.Uo.nia o Cof-.uv~ned Sc-.entLstA L5 a Boston auaea 'oalition o6 6evet.'rt' hund2ted s c.eni6.t6, enginets, and othe, 04 o1 e6zionaez who au concuJt.necd tw.tIh the 4mpact o6 tnkonvtotted tecJhotoef onzoety,. LICS was 6ounded on Mwtch 4, 1969 and has been most .activc in the mtea4 of Wuu cont)Wo avtd envWtonm.ta. poZui..on.

UCS Ls an advocat.e owigawzaton decd- ated to tJh poteatt.on o6 .the. tonq-teun pubVc. int#tez.t, -ts Comitte.e on Envn on menta PotwtZion has worked on problrins jte2ate.d to uc.teOeL powet, air and watut potbation, oUZ sptZU, Ith4way Qoif+utction, and un'itedZcd peWi tdc. uMe..

The Union o6 Concerned Seientists t6 Ate. Bozto i chapte'4 p6 the W.h-Lngton-bazed Fedematon of Ane4 .can Sc ,entLzt,

'VanL4CZ F. Fo'd Economii.t. CooadinatoA, cnvb)Lonm mentat /Le¢ea'ch, flw.ad EconomcL Res e.Vchl PrLoject, f aVLvruld Uni)t.cLv ty

tne.mtJ W. KendaU - Nuceat and ! gh Enetgy PhLo,r-t, Facutty, Physim DepAJc nQ , MmfsaaluAs - . lnzt ti:e o, Tcclinotogy. Chai&1Man, U aon o6 ConceAned Seen t6 CommitCee on Env.'to wmi .tar. PoltZ on

-I

TAB3LE Or b

I INnDUC2IO&

J2 T{1~I TRI4 CiRIThIR2A XT ~EDDO.'UYRCD

III CRICISMS OF r4]i 114.Tn:1

IV CRICJ11S 01 Tin] CXVPUL COME 1.6

V MCLawSxoS AND RrMVIDaTICNS 26

I . IbflDUCTION

Nuclear powe. reactors are expected to play an inc.r:easingly imlnorpUtnt

role :i supplying electric power to th11e nation, Elec-ric pC0.;cm cmsump

tion has a rate of growth miu- y times that of the U. F. op Jul.atio, anc],

with increasing difficulties in obta.lin. clean fossil fue.s, the pras

sures to tap copiously the energies locked in the atUmic nucleus will

soon beo-uLe very great. Already 22 nuclear power stations are oprati'.,

55 are under construction, and 44 more reactors are ordered.

Unique and very substantial hazards are associated with nuc]ear

power reactors and daiinant priority must be given to the protcti.on o.

the public health., Nuclear roactors contain enormous inventor.lIes of

radioactive materials, the lashes' frcn t- fission of uraniun, whose

accidenLal release into the environmcnt would be a catastrophic evont.

Great reli~ace is placed on safety features (the so-called 'enginerccred

safC\juardr') to prevent. or largely mitigate the cons equences of reactor

:accidents. Foreost aTnong safety systems is thie KnIe^genCy core-coJ-.inr

systans designed to prevent a rupture il a reacLor prhJmLy coolJi]j .,,-s

tea frcm causjin a meltdown of the reactor core and s ubsequncnt releaso

of leLhal radioactivity into tie virorment, The cme.rgcency o-_re'"c~o.J.irj

systm is intended to coooi the reactor cxre if the primary c olahi-L is

lost, for example, through a pipe rupture.

Recently developed evidence, frca vz.:ious c. ;f.ejmioentL; conducLed

under the auspices of tih United States Atcmic EIM:rcy C i ' (2"

suggests that anergenc.y coreo-qozoirj sy5stMs uony well be unable to p: r

form the functions for iichj they are designed, and thlat the margin of

safety previously thought to exiot.in these systns' olerations durd .g a

loss-of-coolant accident is very much emaller than ha. s been eXpected or

may, in fact, be non-existent. Four m(-xabers of tho Uiiion of. Cnderi led

.Scientl.sts, res. nding to reports of deficiencieMs in currentl.y designed

emergency core-cooling systTis, carried out a detaicd techlical amsscnn

ment o~f :tbo ne*w evidence. The Union of Oncerd ' c... ntJs .eport

Nuctem. ReacoL4 Saftty: An Evatuoa-ton o6 Nea EvMdenic (C-,mbridge, NW3.,

July 1971; reprinted in NuJevL Nes, Septai-br 19'i), disc.in cE th re-

cent evidcmce of inadeauacies in the anergency core-cooling f;yst fl 3 in

the rsp.ective of It th an analysis of fthe severe conscx,{uences that would

accmpany these inadequacies in a loss-of-coolant accident i nd a gennral

review of the available expertnental data partainig to the ey:pct(-c pr

formance of presently designed ce~ergency core-coolilj sys-.cms. Tho re

suits of calculations were presented indicatinjg that a rmajor acci dent

nighh well expose ve)y large numbers (possfilWy tent; Or hundcreds of thou'

sands) of y-ople to lethal level.s of radioactivity. Infoiiation as,.em

bled fra-n the AM's own assessments of tlhe prcjrotss of it sf-Ly e-

sea:ch prcjra indicated a fAmdamnc.tal lack of basi:Lc Rnvlcr.bce abouL the rnature and noeque~o of events during a loss-of-oolaon t accie-nL 'n"t zn

extensive lackc of 'exprimtal data confirmij the rel.ia:l).lity of

mcargency core-cooli.g systems.

The Atcmic Energy Cannission, also evidently disturbed by he - replicationr, of the accunulating evidence of emrgency core.-c-ccYlnl sys

tem inadequacy, tcinporarily delayed nuclear power pl.rnt .licen!i1 (see

Wa6zhington PoSt, May 26, 1971, p. 1) and onvoned m ad hoc Task, Force,

selec Lcd fran1 within the ABC iegulatory taff, to review the ad. quacy of

aiergeney core-cooling sysLas in the light of the recent pc:rnnts.

This intern AEC Task Force has not as yet released any report on its

levaluation of the recelt indications of ejgn :gcy core-coo].i ng pysLm

deficiencies. Without waiting for its Task Force to ccanpcto its work,

the AFC2 has meanwhile resumed nuclear power plant licusing ard adopteo

an Inter.im Policy StatrTent entitled Intabn Acceptaice Ci U Xe4La for

Emetgency CotCJ-Cootg SyAtea1 . o, igl Ught-Watut. Poom ReqacAt.. 71lsi

Interiln Policy Statanent was pu].it;hed in the Fcdctow.. Rcg.AtemL on

June 29, 1971 [FR Dou nent No. 71-9185], and was acccaipin.lcd by a

waiver of tihe usual sixty-day. waitirrj period duuring which written cm

ments on the proposed policy could Ie filed with thne Ca m.ission for

consAderation before final zxdoption of the new critecirt,. In j ni.t.atlgi

such an cx Lraordinaty procedure, the wari.tsion note:.

-3-

"In view of the public hoalthi and. safety considerations _ 'i-,the Ccnimission has fomd that: tie icnterhi acc:i)t.wce

criteria con c- od herein should be prailulgatcd withc'ut delay, that notice of the proposed issuatncQ inc public procedure thereon are bhpracdicable, and that-good -cause exists for making the sat-Rccnt of policy effc.tive upon publication in the Fedvv-Z Rvq-- -."

We believe thM the Carmission r;hould have waited until th Rc<cjatory Stnff Task Force's r-evaluai-on of emergency co:,:e.-co.i.nj

yst-a reliability was available befor. it: pronulgat.ed new d.ijn cri

teria. According to Task Force head, Dr, Stephen Ilaiiaucr, only Can oral,

rexr.t on its prelminary impressions was presented to the Cm:d.ssion

by the Task Force prior to issuance of new design criteria; b!aic',.

the r. is subsLanUial mucerLainty about the new critcria.

'he Unfion of Concorned Scientists han found abun;tut ev.1dnoa of

weakness hi the Interim Criteria. We have evaluated lle 'Interim Critpria,

in the absence of the Task Force report, as par. of a Wontinui g scrutiny

of roactor safeT.iards and as a follyw--up to our earlier relport. 7his

evtjuati.on of the Interim Criteria has shohmn that thr y are ,umbr ta H ally

hnadojuate and, we-believe,, cmnot add even nM~rcx na]i.y to the prenently

narrow or. issibly non-exi.stent nargi nb of safety iln a -os'-of-cmJ.ant

accideuit. It is the Plyrlose of this pap r to desclha Cm: cvald:ion

of the Inte:rim Criteria' and our a sessmnft of the weiwagcyc- ssuranco the.ir

application can provide. Ofl thi basis of our ovwluatd.on, .

reom1mcndations for the first .imjvrLnt steps I be tak1n -todeelop

ade0quate reactor safuty crit-ei.a.

Tho next soction outl'le3s the Interj iter;L izcl. i (sci..i

the co-mputer codes .that are required for their application. The next

following two sections di scuss the weakness in the CriteiJ.a an.d the

limitations presently lnhorcint in the o=Viutor crxdes. A fCnl i.ction

st.warize, tie o~nclusion of this study ai,.- prCsents our .

* .. . .* '4

II -ME INTEMR 7 CRMtERIA AND ITC QNj3D OTER COOD1Y1

The Interlm Policy Statr~ment on oe.rjency aore-cooling 'ystciii .issu.Z4 by

the ARlC on June 29, 1971, was divided into two parts: oDe FCt eLL.1. Ve]:

fo.rmance stancdards that every, acergncy ciDx.-,coo..rvj ,ystcmr !hou.d meetIli

the otli]c: rcxlouendiJ alytical tools (c, npu(.t cx-cp) to dcL, nLh u ..a

whether a given energency corc-co ingj systun mcats the genc:a]. titul

dardo. This section outl.ies the -new standards pranul.1ated by the AEC

and deucritxe-s the reccumended ccrnpu ter codes,

The Interia Cr.texia reqmire, for att ljjIt.-wate.r p.,,er roactors,

t4hat acforgeIcy core-coo.ixj systeii . be so desJhgned th~: 1: tlj catcutatcc.d

cou. -e of any loss-of-coohl!it: accident is limitcd ',. folICY,: 1. The catcuta-ted xn pi , u fuel lcmrt: cadd:[nj tcX pc atLue

does not exc% d 23000 P

21. The W10ont of fuel elenct claldb. that reacts chlicically

with water or steam does not excecd 1% of the totl. anloun

'of cladding in ,the reactor. 3, Th cJad t-mperature transient Is t-eminated a[t a tA when

the core geometry is still za-nabl to co, )l.ni, an.1 xbfore

the cladding is go c lrnittled ci to fail clUJ.ng or afterquenchi-. "-i:...

4. The core tm >oratureis reduced -unl: deciay heat ;remeoVcd fo

n .extended Period of time, as rMui. 2 by the lorg--liv-.l

radioactivity x -.-inj in thle core.

Reactors gran ted operating ~ensIems before January 2, 1968, neced not coply with the criter-ia before July 1, 1974; oteiain.se, wqnplJ.anc0

is requircO before Octobe-r , 1971, Ri actors in the fJx; L group, to the

extent thvat they are not in ownpliance wth. the critria, ale subjccL to

additional criteria, including scheduling of 4wprovaae its., au .tujnentc-i inservice inspection proj.ram,, and .ist Alation of cuqi .rxn~t to facJl li

tate detection of.prinuiy-sytc-n lm .ige. Extensie provision, ii made for var. .ances fron the applicaLion of the Intorlin Criter:ia.

Inadton to def ining cri~teria I.hat an nccqpLnblecx.c g

cqro-eoliing systcm hiouild aeet, .the Interim Pol icy cttLniinL i0. s0 omiCcix-.

mends the use oftappropriate icipu1:er =k.iQs to vaiuietee~2l.3p

formaince. of each reactor' s cxnergency oe-cooliair b~ys Lm~ i.n acci dcnt.

situations. The. evaluations require omnputations of fl 10 Mr,.iimui c] adrq

t pratures and predictioils of tho -xLeofhmci (at.l3T(.S

canputer cocles iwlbOdy inathem-itical moxecls thait'axe i ntemiiC 1 to allcJ o.re

diction of the. tanperature history of the fuel1 rod cladlig, dwLDig it

loss-of-coolant accident.,. This procedure yields tho cialculaU.-d cc), i I.

of a loss-of-coolant accident to hich the Interin Critocria 'rp.y.

The crinputcr odb calcul ations generinaly involve two or )Poj:te

steps. First,the cxre. fluid flow condiljions are d1rn : by oi-z:(X)T

puter progjraii. Then these canputed core f luid rondi t1ons x ~iu f

input information' in acr et-rnfe r~~mta calculatesth

peak clcdding tmrperatu-re reached durirg core heat-Up in1 a loss-oQf'

coolait accident with th. emergjency core-oocling y~~ op- rz tbUyj. Coi

formanco withi tho intari4 Criteria is 0hsspx&1 to boe daoernIrxl

by .comiparhin.t output of these cciputer =ozes withi tho four rzectift.:e

rrentE spacified: on page 4.

Ilia marqin of isafety established by'conformiaice to the Interi in

Criteria Jis thus detai~bin&4 both by the igounaips~s of - lie cri.t:r.iA tlicli

selves. wyd yf' the! validity of the cciiputatonal ndAs. T juc~ .u1.ty of

teia itilal assui~ptions,- the nature of th3 ilpproxinllationfo ei cuqc).ro

miscs Utt must, bec mm ide in producing. a mathcrnticAl woloJ. and JJY1L1

MU ng it on a cpter, wnd the exetto wh.ich thei quait ofterC!~J

-ingj, procedur.es have been confixmed by: e r-ipental nipmiIrmon-t, muxst a]I.T.

be. determined in order to establishi whather, there J.n, i Dict, Fi

Ciont marginCj of S afet1y. In tlin next sectiont, dscisr, scyordil bae-ia- c of thuo

Intri Crteia. In the section fol1o1m~, annI:of 'J.'u1;iccn

Cies in Ihe ctnputer oodes are analyzed.

I II CITYCISMS oFri TIT I VrJRIM CRIl)".7A

"Reul rodJ u Lur cuswe the hoop

resi-irrj frox th imion gas prbsueLXC.'~ the strength of, the cladding. CowsiAdei:ib1c fi A ling .(plastici defo raJon)o erchwiyox prior to ruptuire and oiic th-aS~9 for the anergonicy cxoolan t through- portions of thc cxre.

Flivq blockages can be. hyFpxI:hecod whJich vxul Cl resuilt in transiont tennina Lion beig cori ow-.1y delayed, .tnarearsfinj the probab.iity of cirit.Ue-7 ment and subsecluent dishntejrftioli c-4d/ur liil.ing of the. cladding and fupl."

-- P. L, Yitenhiouse and R. A. R.:,z i, "1Preface; Symposiu-n on Fuel Ibd Failure' and,1 Itq JBffcts, NLucCxea,' TewchfOeoqy,tXI( .4, P. 473 ()AucjusL -1911)

-."TheZixcaloy-olad funA rods of a 1icjht.-vat-0). react*ok will1 dofom -by wollirrj d~trii' thle hrnal- trmisient associated with A los--o-cxxo ai i accidet (YX\.TIf swalling may ciAlSe' OXIELaTL.

channel blockagc of suc6h njnitucile'that owcoxgeny cooliig may be: impaired.".

-- R,Dq Waddell, Jr, "Mamreinant cf. Light-Water. Reactor Coolanlt Chrmcl BIr, duction. Aribbing fronci Caddio u foiaLi:

Duigar tOS5-fCoolant Accidontf, NuLcteci TeChiiqt~qqyf X11 4 , p. 491. (Augut191

Ube naturca.cokirse of a 3.co-of!-cx)ant accident. can. be hIvLted Ji ta

gaecrocecooling of te coq C an be h initiatced w~thin thoe t-hi~e

(fraction of amrinute),.before thie irreverjble -cvQI4 of, cPxo nltewr

has bc3qUn. 01,1ch irrevers. ble, events Pro rtartc.dylicm altra~ttew In

core gecu ry. prevent ors sbtzntial.y constrict coln Ju iIc13

major portion of the colre, especiall~y arkound a c01-0~ izA or wehean

temperatura: ex~cursions have iitiito ebundwlt mletal-w-ater: or r~

stemn reactic-s'. $evcra coolant flow reduc tio, rn r-a il :,a m ( ay, i....

dUCO GLICh cixcur$Jioi. It is knownVm that appreciable ~~a-L~i/ae

rctLon., c ce'L)1 s-ar --Q, cmn genlerite large quanttim of Vc~ciL oind ~u f

ficient pr-essure to rupture or hur.t reactor con taiinxt-:vsic. 4t1

* water, reactions mnay very 1Jihe.y :follow- on: tie hecrs, of major cbolanmt

f low restrictLions and. can bo' considered as rsticcossivc nEpe LLS o4 f- the. do-,

veloplimit of -a Einqle acqident, one causing thb. othr,

nrgcency core-coolin g syst~m -Porfonwince in- - a 1.o- o~o~

acident wOlIC be considerc-4 successfil if the v2u;of t I e relevn

vrbesWere )'-cpL below-the threaholds definingj the onset of the r

versib e event of core ynOltd3omn 7b. sqt'trustwc)rthy cSiJfl criteria forj

an acjnecmnercjeincy core--cooling systcrn, threforni J r, to 're y 1. 6r

cisely the Iznoton threshold values for the key variali, aw PO n ed1 ix.r

haps , b y a so-called] iwrgin 'of aafaty, 7noe $orP, design1 critorta Eae

to bo ovaluatod in termns of both boq deteii .w4t1 and h'nvi woxvani-ccd ar-e

thle Jlitits they incorporate. Mior eover, the design- criteria .covering dif.

fereinL vrariables s;hould bs. internally consistent. 14w.'3, isofair 115 th,:,

o0.x Lent of matca-water reactiona and the alteration of 'core. gx,.tyy eire.

dap,-x:ndc i: on cladcjing' -te1pe:Pt.ure the Standard for 61h~~ ad ~~ding taii

paraturp. IF-ould he Such that it A'O consifitent With 1111 adeqcua lx."y pnil

Intil-V1LC'3: roaction .ilit w'Ad wifth keeping c'ra jca:Lry in- a confic'mra

dion'icnable to cooling.

In taxlhs of requirite fpecificity, itcms I mnc*1 of thi_ 1iterm al Criteria. (page Q), which actually rapecify nuraeric-al. Nalues for aruimin

fuel elb-icnL cladding tcxnerature a d the panmilsrdble cxtenrLveonass of

I eta].-watcm: reactions, and -item 4,for hidch 4' nullerical val-laue ban f

readily ampul'od for any specif ic tvactor arc biu~ aifcoy

(In othe r respects, as we shall G~elater, thiey irc no~t ratisfacLory,

Itmn 3, hadever, relating to cnre goznitry, is. quite un1satisfal..Wry in

thaL i cit-ler. quantitativa. nor dtizied qualitative p ccif icatiori I~s givcn. Since: the Idiid of alteredor aente th .are n~ti 1 rl cna

blo to co31.rjj by ' nerxjency cnrc-cx'ooling ~systcfj cqxratj on rxnot rpcv'c%

fiod in itmr 3, th- rcqui rcent 11-at-"the clad, 'fYrIUC tlni.ft

is: tenninabod at ra when the: a re gnr'cati. -irs si1 a). oo'4.

" L~ng"-J.: oi.raltion lly var me an1 riiicimles.g, Until the rpcJ.f;catiod,

Which Should be czt 1irshcd by a suitable c prJiental pror m, for suc!.

unor.Uioodox but acceptabe gemetrics -are prov.idled a; xirt of thx dCs:. n

criteria by the Ccamission, conformance with this part of t1±e InLerlin

Criteria cannot be ascertajied. The vagueness of the Interimij Criteria, itcu 3, with rcspf:!cL to

Core cgecmetry, is eoxpla-inel by the fact tbat basic .c ca.ch on the. Su. 7

cep'Lbility of alterxed, core gcmetriesP to cooling, (md on wl-t corQ.01 gca,.

etxy cbhxgcs aro induced during a loss-of-coolant acc ider-t., irre.X-Cdlvt.e

of their cffecLs on anoling, has only recent-.y atatned. No adequ te

fraction of the progira has been cXnipleted. A1thougjh .,'<o p1ol:himy

thc ..- tical calculations Jjiicate that coolnnt flow restijctl.onsi of up

to 900 (which could b' brougjhL about by kno t ,to].i.ilcJ of fuel Y.x)

I 1may have n deleter-inur Cff ect 0 nVrgc1yn cooling ,.1LILCy, there are

other engneer.ing rclports thiat appear to contrxn lct t1in. Mbreover., Vim

predic:tonCs imselves are of uncertai n validity. TesLs of adcecp ate

scope (i.nvolv ncj flow resist zoice Jn distorted core teciwhr:,,r.) t "tl

this .ivmv rLamt question have not b en carr.ed out., but i o ktv my oth&b:

tetLi, Lre plaffed.. It ib abo]utely cleat ffhat cUC)iL.UT flcy.'rr .ric

tionr npproIching 100% cannoL bp toleralt ed aid there in i.rwjdffi r,1evL

assurance, acain resulting frLc lack of tes;ts of adre.uatj pcop, iliat

core clna,ugje in an accident will riOt lead to nearly tot-al flow reU:i.-

ions ii a large enough port"on of a reac~or core-p that n major acx4

dent. .,mIlo L b. prewnted.

One of the Oik Ridge.National L-a bato:y' s p.ini. -.. est.i(J

tors of chang.iig core gccmetry during a 1o F-of--c-einn aiccidlent, .D, "

Waddell, Jr. strm.nrizd the stats of lrnowledIjo with..rjard t..) te 00..i

bility of xcliug altered core gecietrics when ]): flat.y taLed. ? .It would

be p-st'.ptuous at this tne to pr:edict whmaL level of ox,].,,Lt aea r :

duction could be toleratid-in, a I. (1,.0-of-co al accident) ," (Wah....,

op. ci.t, p. 501)

In addition to U indetenmiina:,c e:z s of ite 3 of UdLu:in

Criteria coverincj core gceace-try, owing to tA~o basl.c lack of hiaow-,d.u in

this area, itcmn 3 is also bconLiSteflt with itn i. of th. :rtcrxn C.i

teria: the specification of nax:-Umn allowble fuel. cJladding nr )-aLLr

(2300 F)., Two Aece.at exapewt6 ind tcate. Th40M C o ad .wCU fig: and

teven ucpWLC( tatake ptace at tempvm- vm y much &,L As 2 tan 23000- , .Both swc cii mid rup.tw'C ae.p/ceI emt )JJvv CbhC caicuze- iii .e e "10.

tit.y tat couC.d Zead to cnmp.Ccte. c'or icltcown, Tmch .; tie nt1cr1.1.

Criteri.a, for want of basic. }nowljCege ill Orc mi-ea, cannot F-'eify which

altercl core gcccrtries are amen.ble. o cxMo.ing, thQ Cviteoxa must pro

sumro that the value plaied on the trwixprature dW mnwuxun.t of Doe

rica)l chmages will be Consistult with preservilig eS:nti d. core g(. t.,

Tis assumption is ro4ngly clhallenged by the results of Cupiiclc. invcl

t.iations oonducLcl at th -e Oak' Ridqu Nat.ional. idbora.tory 0id -at- the Nation

al Reactor .- esting J]acilty (Idi ,eo). J1 e ronaiider ofXth.i P A d p Lc: i s a

presntati~n id discussion of these experimental results and their Jm'p.icad-.on.- for te adequacy of the Interlm Criteri'., (It oul.d be o.

ted tlbi.t LtI~esC experanonts had ben coainp.eted before th1n, In.orh Critex.,t'.

-w.re pxm i'u.gated b thea CcRnIs,son,,),

he first .ndication of tih frailti. cf the Jjitc "hn (,:L..a

cones frcm a sinlle l.'aL of fue] r.d fail.uccs 141 a ihiiul).ahed Los-o-

coolmi L acc11ert, carried out at. te C1i Okdx .ce NaLt:ion;tl, i.,,vxato:':y, 'J.1ie

reir on these tests is entitled:-, Pnka pq.po-'t .ell the U4izt', Fu e Rod

F.Liewve T'Lsaiclt Tet aa. acoW-Cld F e Rod Chwa.tcL b TRrAT, by R.: Lorenz, D. I'lobson, and C va, - 0m ,. k idgke' Natioca. L.-.lx~rilt.o wo•]

4G35), M-rch).971, "

'Ibe Oak Ridge test cnploycd a smcmll :;pcil-. tc! 3L reactori (called

'iuAT) using fuelorods pmerided with beliu~n to sinmulate tho. buildup

of fissi -gas nomanal in partial)y cq? nded fuel c]3. cnts. The rods wer'e

exposed to steanm flow, sjmulatinig 'conditions after the blowaown IXortion

of an accideit. Residual, fission-prOxuct heat i ng, ch ractc:r-istic of a

real ac:c id int, was s.inulatca by fission he.at gcniea LiJ on o-nly wAitil the 4 C 'i.t re ached. a prd nntO.Mcd tcir r a IwC ii ratuxe a]nd I N wI ..itanX1 tia.ly

-10-

ten~tiinatcd. In a real accident the residual heating does n1o~t teVrdnaxxtc i.n

this manner but continues to dbwimnish only pl1A, withl tjuwc. The test

reactor was operatcd at steady power* for 28 secnds. so as to br:j. th e "

maximua mev'asured fuel cladding tVmperatures to 1770 V. At this inv;

reactivity zand hence heat geieration wan sc4 to Ohdidn.-d-J wi wa' .:.re

ly mlted two secondB laLer, SW]ilation of xn ycfldrn wan tlu.u riotpj2.-d

at this time. ( As wo have said in a real acc:Ldcuit, Tfistuu.c produiL 1bC;,t nLj

would cont.biue, not subject to Control.) Fuel. rod ruptuenF had,- by...0"iifi:..

becxmxe ext:ensive. AU * fuel e ments were m~ollen- bi.<c. Oii- of

th) elU-1unts, p.iuviously irradiated in another reactx.r in a.uriL (jLd,

valent to a few percent of its normal fuel, bu)rnup, ru}:~bucx, releadj parts of its u niui d'i. oide fuel and fisision prooduLs i nW the c.:e an'

steLh. ts failwuac initiated what a17ar s to ha bonn thm t.ta4 of-an

unxpxcccd, puopaja.tivg, f e4..ev. Ta-&t .utie. lodc., Ilydr'mjen cje.ic',.tl-xd

by Zir 1niuca-sto.a-a reactions was ideatifled. .In the vo/ids 04 ,. 0C po4:t,

"The Wf.a.oy ceaddztg Awe-t.C od4n d wu teptdcI -t a 4a boLakogc o0 6'he bmdAJ de Cootallnt hai.et cr.tea at :the. Zaca.Uton o6 ,max biut 41d'C.Uo.g ,"

-"c minvL, .4o n itevJetCCed duct~e wp~wtu aid. h i~ m,! 6ict o xygr en' p1 up". Tiha relevance of thene results ccxnes franl the fact that 44e. tie it

"Was Co0ldwLcte.d (tnde th. moz ot LOaaz't; Zo,6,-o d-ooeant acc.lde.n-t .id.

V{onw o6 anyJ ex.pezbilent .to dave.," investiqators foujr,0 th fuel. r.xI

ruptu'es were close trxjtcor a=1 concluded, '".Thi.s Ii],|.catem a high nrsn..,

".vity to .t/ro ijrature ." *,'Tis sens:tivity !.s 'eJ ficd in oL:]oc tent .

carriied out bq,,y R.D. Wadlell., Jri, at Oak Pfldge.'

One wonderri what would occur in an aceicDat that devolopl-d acladding tcwpzrature of 2300 0 F(500 n F greater thnn in thin test), t.he

tCmj--..:at.u;re eXcur;Sion genC-ral.y 6 cxted 4n a imajor vc:i.d-ct and 0c' .:

table uner Ii e Interim Criteria,

It hasz been est-iislK.1. by tlix, tes. and dta. cataz (s' e itI,-8'/ .

that fuel ].CliCflts presm;urized to 300 -p:. by .fisuion j se s are neac th,1r ""

uJ.tbijA,e sLrength when at sc~mwhat abovcj 16000. F and that :apid fuel rod "

.Selling beins at this tonQ1xrature. Ruptiwe, as tb-. Ok Ri.cl test

sh,.::, will occur b--fora 18000 F. At. Jx.,er prelq ur the 0:1itwi ion I.,

-1.-

worse: tube s.,o].lixj is 11*re uri.forn fnid greater dllnnel. Po aS occUu:s " 'before tube ruptune te-Irdates SWell,

V1nE- Interim Criteria plow tje ccmiputed fuell clAdIin. t-:,.Ltc0: . , -4.

excursi.o ns ,in Jl .asned losed -of-¢xownt actcident to reach 23000 F We • consider thiS to ba excesvely hiqh, One coonsuezrce Of thj:s 1dh .It1-peraLure, indereAen-nL of thie, cfeat4s we have st (i. cu- sed, . s tli 0JA-.-"

ly YnssMility of Petallu.gical reactions thcd ca eus, danace .i at oore a.O to its contamonL vesse]s SO severe as to ttlf c ue.itt.: .

thir xg:inninjs of unconLrolled maottown, U.The sucnd of, the retii cer. ,1I[nts on re(.cLor accidents fl igs ight on this itjsu. Tests 7-3, Zr-4F aid Zr--5 W-Eare devised kulA rn bye.the .dcdl]o Nucl.ear Corp .xcz.[:4Joil (TIC) under contx:ac : with tI 10 Atnmiec n32)jy •xbmission to etilc.iic th' c of Z:irca-loy-,2 fuel claddin.j to C4crgenc-y coro-co--', .tj cori :i;ions pubjecting the fuel cladding to a tplpratura cyc!ee in the px'e.r:ne of st:on.

T.,he rout; jre reccnt iu)dc are rop:irtcxI 411 an INC dIcc.H:2nI: M.J. M,. r, W.B. Ve7clsky, and R.E.: Scimunk, A Mct(d lqci. V Vua.t..on 06 $.mt(cated NQR, IVwc)jciiuzj Coioje-Coo ' 0 "1¢4b (.N-1453), Fe.rim.y .9"..

'Ivel.ve foot lJon rj -n.s of1 49 elcctrically .heal:-d I ulatcd fue'.. rods wc,.v cinployed. A].udnavimin pscw as a filler 11-l. t-ie r.-cojnitmI xrofTs " " in place of the usual uraniun dicudide fuel, pith ro3. rp:id..ng JnvInlaiwd

by Inco Il springs, uch, rprillsjs 4txo crionly sed .in largo rccetors; al.umina is noL, Electrical heatrin was ws c to brIn.. ta. rcds x: trn

pratu-cs ,cn 'what Jxwoa 21.00 F ' "" " peraturo cxcursiois Up to 2940 ,. T t .7. wd ..p.cmt..t.a t.

metaJl steam react:i.on produced toperrature c' curs-c.JnE,." "Post-tus L e>mni. nation of the bundIos shows extensive cladding d.ptage, confi. f:i , i.

• yg-taniipc-ataura h]d-catiols. "Photi-cjraphs v-ho', ,,,i th i; ron; 'clad.

diiyq dcjr :dation which exiital after eich of the. te L-."s areas of 0,aag,1e shri the white Color typic2. of severe oxi dation of .Izxconiurm, considerable frapeltat.on,; and sme fusing tcxj(.d-h•r= of 011C) cladding on a rod-to-rod basis,'!! T1here: w4s "etepsivp. -claUdin9- daiw.y" i I all Iirea t.esLs. '.fO tu]ybec: !!werq attack;ed by thli st-oan" and miubl:anta] crubrit-tlcMnnnt; occurred. Crrcal.n and. nickel ija1 the Ivi onel fI.(L hoy.attza0kcd th1 c.cld.in atE:1-pn L of - ,4q, t, - Accordinc to-t.be auLocs, " ,[

Idaho :Nuc.eaOr Corx)rat.jn has, subsequent :o the )_ji efe.red to i this .1e}'.r, bC2C(I tlba AOJ1a U1 NUroje . ir c-r", - rtion.

Of th(c] tublx,3.!P re cvealcAd vm,^iu= dcree,.of AnI~CH.0u at.. pi;

sprins' and .036' Zircuo vms. oin pYA-od" of t4 ,-V' fbrad In wdi le,

(sic) to the: Zr-Akl iqid-10'cUdi rea . on wJ, h fitezrfl." all6 test ):c.

suits (10 nob oInad to an opi U -tic v1014 Of Ut IQC I civtc'r.1y C. oe-Coi.n1r1U

systdts, tha7t nidt, the3 Initrirn Criteria. mi.~erWn ,.pr~..,,:! i ar C LiC91yal

in largo. r'acbs nd -~ po i n 11ne=ppct ed.~ of fui )ro- rUpr.

ture. aric 2ne- Ll. -water. reacH-ons at .unfortunately , Civ v xl.!"p:ctedly lcf4

tenperaturcs. Th aa u ti :r,s of. IN-1453; snhi if;.litiy ~fVE

ifac t that ne;C.ugLJ porfoimm. rnmoaisU1 trhc nu.cl ~ V.i-? cu))6

i nP7 pibUiJkiy caLn pc)CLuh: raisoes *tA cuesi io of wht~III : a~v n actu I FVC (Ebienc 1J.-ol~g Utuntion, . \c wcc~ t~cTe

go onl to tJug(Jesi that -the 4xracliatcd lucanium cio16) fue I ~ ~ t colld

reaca; withl thr.) Zirahiu;, Of *to .aclng a uT.r~, prwo ::Ii:lijr

tp thlat. c 20axve ill thc t aq s Z r - x, - hn(4 7r- 5 U 'ini :FLrvj( tiJvw

not hc-n: A-0 e. Ixlrd eyc;'ojcuce y -a xj,"oUu:xYr.d11y -e th L 'ix eforation, rosv1jf:inq frani eiutecj~c m14Liu'A I ued' )Jy the

ianer ,inj'p or rctitig from o~icr McISe 4o:1da.u,q emt Jj)t n xtaL itl the urwdilii dimxd (TJC, Q aYh oibx

tJ ,'ie ouUd tlennodymwically bumtr tpd';-1 tQ 3Wact, W.Lth 1--ho r.

calay, %v-ose. possib.ltltcS x):>00 i, J .nycn L. d. io durbiing fuuciwii."

In faot j if thoeS6 zin- J47, 4toS, are Pt A1po~~,iI3"~ h~,ijo

Now thel: Oak R idpj Of~s (a $-o nld .1iuhiLQf 4xw.dnj fis~sion prodiacL hecatirq as boat. 5-nbrntlon' b 'teLonaly- t:Cl-iiAhf

at theo rel~atively lo I px'tmu o 8O l yo tll en~ 6f m

tin].11 Ip~lWto~ c ,odto~o, 'Ahe per-,oiid tcrt wlere-- pxrrangecd to ckmcvlop inM.I:il pu-~ of 4-n' .2OO 2ton jor ,1u

200F. It too did )rnt, Fd11 4-M tinuec fission prccluc? p.air 1 an

the unz~rined. t --ratupt ris~'ta nch alif, chL on ) co c1uja and coo~lnt. 10ow constl:otionlp In pt lir~je rec or zxvcidlent, 3Jv

cur0,. rt. zoj0'iiv P i *11 1~cj aof un).-i )"dtnj~ AJL ;Uaa

Trhe Iniiations of thbO5tvo P0~ pr-oJfl .ak~ cthez f1 .0

Att AE:,A: o~ qatz jlbvr -1600 F, lti~pg th dr~U4?U Or(rhw

_ t~rt~s With onpseu ent o.tgeooi~ g I~ans At

1800 F oe epect coo.~thann1'~ o 0 )ocxl 10' 0n Ot blocko,

de~nv~rjonth itena. iew of. thindv rocs, i n~sv

fupel occmmt rwvpturo to lave. ii1CZ,.1X

*of fuel. cl'*dn ndtbn prJo pyhv exi h rp~~r~

Su)I xr ts or E4-c_ if 6hy oornta, J ;vckl ;,!,V eAr~~tn-~kltc

tic ntelts at 17P00 F, ana ihe54il M14lte driti wCl rtlc hcni4

ly th ~leasing' dnnig heat,,Th, 7110 n -oil m- ate rti

* is om~Le, ~orlwic ~rpes p~ dtemin 4 con prkufla V,11 c~ir~a o

2 (Pxj9 4), U-9-ing ,i f1iay-1tr octin, h.oo

is at tanpratuob1 itich, WvVP ASCO i,- th tc~ipe ra tm 0. Tl~t~llkc*o

*fccOtcvq~ar 300 Fw ~ neo co it. 01Q.: (and ( XCI Mo~crc

towi3 ve~lua even wwth O4.inpedea po1lnt. 4i~? iJt S~ a, aeoa~le nd

incoc~a ikey, X~d~ui~ntht w~e~ecec~c~a3~nJ ndfulea Lions

Wwi s tciar wi1 clcweJ6; opl*ar t~nwtr ppke i 3fnceild mo hiV-q

'fur Lho : fuel. Io prfo6n n adc .t& v6y o hecre, dmi0.

MosLt of tvihse ih~mcr1yN1C1 o00,1= trougjh *ncvimis not o~dio

tinj ue cijren fai.ur i44_cas ~QflJTO rApRCV nd

core d~src~r than t ~ Wnn foree, O Uhtntii1fiiw-pcc 0c-a~ will :h- ocurdit the Ob u-nent, It, shlould' be rcx- J

nize l tat those. -IQ' The 1t.. caey bnn~t4~ecoUlolrl(~

p-pnt of a,-n ac~idon in a,~ge 04#1~ i.mqod 'Oact coru a 30 F

could Io be aerstfe-dV.1 . thai 'V'.415 tzTVpoatu-re cniv'opy core

-iin wter, loqvd th-en x'vti 'nIy toagrvte, tb acCidvnt,

Ell.t pRcopzigat 1yraiaUylaro o inc4tecr&Tc 973 roarp- mIt *A'u~o6

9. -14- 9

assessment of the design safety margins for such accidents requires

better information on fuel limits, failure damage, and the oondit4on0.n that might lead to failure propagation.''

According to the Interim Criteria, the 23000 F cladding t Pnpxrature limit has been "chosen on the basis of available data on cbr.ttle-. mentl and possible subsequent sh-attering of the cladding.." It is wholly inappropriate to base the maximtm allowed cladding tanperature on coniderations of enbrittlement, if the onset of extensive core damage and

coolant channel constrictions can occur at a lier tcmiperature. It is clear haw critically important it becanes to ensure an undisturbed flow. of coolant at low'enough temperatures so there is no possibility of. metal-water reactions. Selection of the mnaxim= calculated t"nperature" must'rreflect this requirement.

In addition to coolant flow interference from ni anisma related to temperature transients and metallurgical phencnen4, there are other mechanisms that might alter core gecmetry during a losi-of-coolant accident.. The loss of primary coolant, with attendant shock waves and water-. hammer effects, could well be a brusque and destructive event, with violent coolant flow conditions that a reactor core may be unable to withstand. In addition to shock wave and water-hamer damage to the oro in an accideit there is also a presumption that thernml shoc) to the fuel rods frn contact with emergency core coolant may also prove highly dama- ging. The Interim Criteria fail to consider all such mdchanisms that Imight render the coolant .flow ineffective. Indeed, owing to t01 cerious shortcomings of:the reactor safety research program, little is k.nown about the magnitude and consequenoes of destructive forces and abrupt cooling on the core; by cmission,, the Interim Policy Statent nakes the wholly unjustified assumption that they do not matter,

G.O. Bright, in discussing blotown md.emergency core coolant delivery (previous citation), writes with respect to a loss-of-opoant accident: "The present need in this area is to establish the accuracy of the methods used- to predict tenperature excursions a-d a -rgency core cooling effectiveness, taking into consideration conditions.. in whieh bypass flow and other :efects may reduce the design ECC flow rates to the

@ '-15-.@

core." This is hardly a reassuring statement in view of the negl.ect of these effects in the applications of the Interim Criteria,

The Interim Criteria, contrary to strong experinental evidence, ,.allow the use of computer codes which assme that uninhibited emergency coolant flow will persist through ah essentially unchanged core gcanetx,.

Moreover,, :the Criteria penrdt cladding temperaturo s below %hich, exoperi

ments indicate, core danage and substantial metallurgical reactions can occur, It is these Criteria that have recently been applied to large power reactors that are being constructed ever closer to populated areas. It is clear to us that the Criteria offer little assuranca of public safety in the event of a loss-of-coolant accident. A maximun per-mitted cladding temperature of 23000 F is excessive. Experi4ental evidence indicates that 1600' F is the threshold temperature above which core geometry alters increasingly rapidly and cladding rupture may take place. Inasmud as the altered geometry may be inconsistent-with effective a'Tergency core-cooling system operation, a muchlocr. peak clad tei• perature than 23000 F should be set, Metal-water reactions, involving eutectic alloys, are not considered and they,.too, are importan t , t peratures below 23000 F. This- lower peak. clad t= perature, which hou ...ld . be determined by a suitable Qxperimental program,. should be substituted for the 23000 F limit allowable tudor the Interim Criteria. Ina.-much as little data is available pertaining to the kinds of altered co)re genotries still amenable to cooling, qon ervative design criteria should be. set specifying a peak clad temperature that is the threshold defining any major gecmetrical alterations in the core.

9 - 16-

IVCRITICISMS OF T11E OtMTIER CODES

"A lion tamer must not let the beasts frighten _him. All a cunputer does is tell a consistent story: a consistent truth or, if the procjr.nmer's guesses are unlucky, a consistent fiction. Cmputers as a group speak with forked tongue-.. each one tells a'different consistent story,"

-- Paul A. Samuelson, Professor of Econanics, M.1,T".

Full and tuequivocal confidence in the successful operation of reactor safety systains can cane only after the canpletion of a major prcgran of engin~ering research and study, including closely controlled, large, scale, "near-real" accident simulations. Such a p r m has not been, carried out. There is presently available only an exceptionally thin'. base of engineerinq experience with eme'rgency core-cooling systrn behavior. None of the engineering studies have been conducted to date' under "near-real" conditions. Moreover, studies havs been daiinantly d.iretcted toward frapents and pieces of the whole problem, We have seen this in the two experiments discussed in the preceding section, The recenttechnical literature contains other example In N.0,U Tehbnogq (August 1971) there is a report on experiments on fuel rod expansion durin sudden heatig.. Iie authors quality thie general relevance of the.r. investigations by noting:

"Interest in the degrees of strain experienced by the cladding (during a loss-of-coolant accident] focuqes on the ob ectave that defojnations will not: be so extensive as to prevent residual heat removal after- cooling is n ally restored, 1he data presented here are not intended to answr, the question directly and generally."

One can seard elsewhere as well and not find the question answered irectly and generally". Otherb at s, the rcnt

tur, on tle lits of present enginer-ing knowledge of emercjency corecooling system behavior. are noted in this section..

9, -17

Mathanatical models of safety systen operation can be constructcd and their input asstmpLions,. methods, and predictions verified by canpar

'ison with experimentally derived data. Such models penit the synthesi

zing and manipulation of known data and hypotheses concerning reatc or

accident phenauena and can facilitate developnent of quantitative aialy

sis of safety systcm operation during accident situaLions. MKinor gaip

in experi4ental knowledge can, in principle, be filled usin. those nxDols

The use of mathematical modelsmay be necessary when, for oxaplo, full

!test realisn is too hazardous or when acquisitiop: of enginear .r ng owledge

is unhappily delayed. It is absolutely clear, howevor, that mathematical mdels cannot

be used reliably to span large gaps in engineering knowledge, owing to

the very great uncertainties that accunulate in long and unverified chains of inference. The quality of the mathcmtical simulation; is influenced

in a vital way by the extent to which the modeling procodtu.-ed has been based upon experimentallywarranted assupt4.ons and parameters and con-

firmed by suitable tests. Without presently missing engineering experience it is difficult, if not in fact impossible,: to, dotcnwtno whether,

these models are truly accurate and useful, The lack of critical data is likely to lead to elegant but empty theorzing. It. is,. however,... ..

possible to detenMine if obvious weaknesses exist in a code that reluce

or eliminate confidence in its application. Accordingly,. _eperimental confizmation of the accuracy of the -- "

codes is a canpellini prerequisite for their use in determiing, the

suitability of nuclear power plants',for: safe operation.

-The Atanic Energy Ccnission, nevertheless, has taken :the position that certain mathematical models may be used to span the very substantial gap between the meager conolusions one can draw from available

experimental infoniation and credible assurance of the datisfacLory par

fornance of untested emergency- cooli.V systams, The AEC placed its re

liance on the predictive capabilities of Mathcnatical models enbodiel in

ccnputor codes being developed by its own researchers and by reacLor manufacturers. Such codes were recmendcd in thu Inxhe'.hi Policy State-

pwint of June 2 1971, to deterine a nuclear power reactor's x-pcted

behavior diring a loss'-of-coolant accident n order to as r/esfi its: col

fornnance with thie ,Interuu Criteria for amrrgency oore-cbolb-d~~~~

performnce. We dicuss those- ntthatical mwde1pi in this pection. i:

A reliable estimation of the expccted prfoor icof. the o=or

gency core-ooling, systan during a loss-of-coolant accident in alarg

reactor would require a mst sophisticated matlumtical model together .

with the. resources of a very large c .cqmter. It is likely that no mod-' ern computer is of adequate size. " This mathomatical model, Csbod4.ed in

a caciuter prcxjrain, or c ode, would have to sinulat accurately (t oom

plex phicnm-na expected to occur in a loss-of-coolant accident; the

dyna=ic coilyitions mad directions of coolant flow throughoutq the prim r "

loop, and especially in the vicinity..of the oore. hot-spots; the cool1ing

provided by exiting prknary ooolantl the heat transfer, conitions that

will occurat Various stages, of the accident: thecore gecmzwtxy. - -c:p VS

-fuel rod. prZorations, swelling, and bowing, and possIblo subscjuent

flow blockages, core .fragtmtation, propagating' fuel element failures,

steam expn sion, anl chcical reactions bptieen .fuel and cladding; Zirt

caloy-water reactions;. the. tine required to brir ,.the pap for the cecr-"

gency coolant to speed and the effect of-essel pressure on pump perfoi:

mance; Lcidenfrost migration of the e nergeIcy coolant and other pheno

mena., To onnFtruct a, coda e that iwould cia hl, thlis 'reliably- ia W ty

beyond Vie.: pent eapabi.Wte of: einoring science. Feasible ecOf

puter prKjrams thaL attampt .to represent.these events will. be forcod to

make very substantial capprcmises in their desoriptLon of events becauno

of the cx!iplexity of. themathceatics and uncertainty in, or total lack

of, Jniqort nt engineering data. Many of the phencniena listed above must

be anittcd or only approxinately described. To, l;jit.,the scale jdxw.can

plexity to mangeable proportions, approx-mations will WAve -to ba nidOe.

The validity of the nmdels -- their ability. to, make reliable predictions

.about the consequences of-a loss-of-coolant accident P-will be deply.

affected by thesc mathematical slmplifications, ccWutational njjrokt

mations, and by neglec4 or oversinplified treament of in;zy processes.

that are expected to be 'I)portant, or whose i4portance is not preontly

recognized.

here is abundant evidence that the cmputer codes presently i

use are insufficiently refined, from a mathmiatical point of View,

inadequately tested in a suitable experimental prXJgraR, and GMLXAy Unsw tis

factory simplifications of the real situations, Zey cannot provide any,

reasonable bases for predicting thYe perfornwice of presently designed '

emergency core-cooling systens during loss-of-coolant accidents, We

present in this chapter several bDasic criticisms of the cTiiputor CoDdes

reccirmended in Appmndix A, parts 1-3, of the Interim Policy Statcitient

of Jiue 29, 1971, for use in thle as sesznent of .'- rgecy cwe-coo.i-q

systm exlected perfomance. In presenting these criticiuas, wo o ot .

wish to belittle the talent and eergy that has been expended in codqe

develor-ment; we present these criticisms with considerable regard for

these efforts and with an appreciation of the substanitial difficulties

faced by ccde developers. Nevertheless, for at least the reasons enuera-.

ted wid ,docuen Led below, we believe, that the available ccmputer corlcs

do not yet approach the staje of develorjment wereAn tiQCy Mouldbe .used,

to adequately describe the phenoena associated withi a loss-of-coolant

accident in an assuredly realistic way aryl to oonfiin conviJCJ ArJly the

adequacy of presently designed emergency core-cooling system s.

Our specific critic iuns of the codes are;

1. All of the reommended computer codes ariu-ne that there are

no major* clhnges in core geometry during the cpu.se of a 1,oss-of-ooolantz

accident. .In light of the extensive expertiental evidence preseinted

in the preceding chapter, this assuption of constant fuel rod aWx core

geometry is ctLCO&t am.ty wlton, It 4s apparent that code results

ba-se on this incorrect assuption canot be accepted as valid.

Pudict0ions made at Oak PAdge National Iaboratory of the reduc-.

tion of coolant channel flow, based on tubing expansion data, indicate

that the reduction will be 100 , or coolant flow. totzlly bloeked, undo:

certain conditions, It should pot prove difficult to wonf.imi that no

reactor bn a: loss-of-coolant accident oDuld tolerate 4,.'4 zero flow;,

-SQm cmxxes assume, h hevcr, a charje in tbe gap w.'en cladding and fuel.

vw

-20

Happily, experimexits and predictions are not in ajr=wnt, owi. to

deficiencies Ji the model, although redtictions aaproaching 9 0, hlve -been

observed in multi-rod experiments at Oak Ridge, lss hava Po far. not

been Carried out for initial pressures above 400 pni, although such tests

are especially relevant for pressurized water reactor fuel elements, The

missing tests are planned.

2. In assuming thlat there are no nmujor changes in core gccmetry

during a loss-of-coolant accident, the cputer codes bgj tle ques Lion

of the anergency core-cooling systen' a capability to maintain core geaie-:

try in a coolable configuration. The codes are not capab.e, thereforo, of

determnin-g conformance with itn 3 of the InterJm Cr.teria (page 4).

3. No adequate experimental oonfirmation of the iccuracy of the

codes has been carried out under realistio loss-of-wloolt accCdlt- com.

ditions,

4. Parameters in the ornputer oodes used to analyze a1en.g.ncy

core-cooling systets are of necessity speculative:and to scme extent,

arbitrawy, owing to an extensive lack of experimental data on various

aspects of a loss-of-coolant accide4nt, Since the nature and pequenco of

events during a loss-of-coolant accident as represented by the codes have

not ben established by definitive experiments .- as a specific exanple,

Idaho Nuclear Corporation researchers state in document IN-1389, "puring

a loss-of-coolant accident the Zircaloy cladding will be subjected to

forces that are largely undefined at this time "- the codes' soenaxios

for loss-of-coolant accident phenomena are largely, products of conjeo

ture. Accordingly, tenuous chains. of inference and not wll-established

facts determine the ccmputer codes' s m .dlations of loss-of-c].ant acci

dents.

Two quite recent exanples illustrate just how uncertain modSling

can be that is based on assunptions neither tested nor otherwise tied to

experimental evidence. They are.takeni frc tle Suppltenent to the S6e

EvauatLion by the Division of Peacor Licensing, US AEC, in the autter

of Vermont Yank.3 Nuclear Power Station4JTuly. 19, 1971.). In conncction

withi core spray effecLiveneso du ring an assumed lss-of-coolfnt accident,.

-21-

Gcn 'ca El.eotxic and Idaho Nuclear Corporation (XNC) develop.ed indqxn denL mdels appropriate to the Situation, The m]ppl licnt says, "Gil uses a correlation based on th-oretical analysis to calculate tuna to quench. XIN estimates the quench time fraa available data and predicts " significantly longer ties to quench. The net. result of thir differenca

..is that in cases of interest, INC predicts pek clad tunm Dratures whch are 10% to 15% higher than those predicted by GE." It should be noLe that differences as large as these can date~ine whet-her a reactor aci- " dent is brought under control or develops into an ireIculabls tr-agedy. In ti.s exzjmpl the A= did not penlit G to use its tb)eoretic liy predicted quenc. times Vwithout correction.

In another portion of the GE analysi. "a value of 0.6 was ut% .ed for the ciissivity of bothi stainless steel rods a4d harmlel. b),x, 5ubsequent tests made to measure .the cmissivity of stainless steel limcndes indicated that a value of 0.9 would ba appzo iate." The onseucces of the error brought to light by the measurements were. such that th!e A., required the ana.ysis to be repeated with the correct aissivity, In each of those exzinples, the error consequent on the use of ins~lffic. ently verificd, conjecture was' such as to ova"4.aat6 te e66e t'.ep..w6' of a reacto)- safety systn...

For detailed do.!umentation pf thie extensive gap!.> in our ep.rimentzally derived understanding of, reactor accident eninenand cC the perfoimuace capailities of wnergency systems, refer to;

(a) C.G..1-awson, ,Emav4qeq'cy COUe-COc,.?nq . ton."604 u-&'~e~. Cooeed PoweA Re~act , Oa Diie Naticnal L9-boratory, OIiLr* NSIC-24, 1968"

(b) us 1x, WMt.,l.-Reaato4 Safe-tv Ptopj.un Peail, W11H,-1146, lEbruary, 1970

(C) Camittee on Reactor Safety Tec ology (CR1'uT), uropen Nuclear Energy kjency, WkteACooted Reacm.c Saf ', OP , Paris, May 1970

(d) Ian A. Forbes, Daluiel Fi Ford, Henry W. Kendall, and Jez.li Ms J.. Mac!enzio, Nct , e Re.acto4 Saeft; An k-vataj, No e Evidence, Cubridge, Mass., Tho Ur.ion of Concerned 1cir'ntists, July 19711 reprinted in N~de. Nek, fkptembr 3.971

-22.-

(e) NUL.CteA Technology, August 1971 -- an issue artia1.y devoted to a symposiun on fuel rod failure and its effects Nuctem(f) N Safetj, September-October, 1971 -- pially the articles by G.O. Bright wai P.L. RitteNhouse o

5. The suggested codes, franma fonil, mathematical point of view,.are presently inadequate as devices to simulate the dynimic conditions of a loss-of-coolant accident., As tihe Idalio Nuclear Cor"oration noted in presontixv. Jts repxrt on one of the codles whose ISe waS reom-mended in tle Inberim Policy Statxpent, 77-1,7A 1- -13,

"The fluid dynamic and heat transfer procsesse occurrin ..g in a nuclear reactor core during a loss-of-coolant icoi-. dent are extrenely cavplex. To accurately detid no the response of the fuel rods, the o0plete set of consewation equations must be solved in detail throughout theprimary systen. Currently a code of Pufficier)t cunp,.exity does not exist," (IN-145 AYbury17, .

6. Ile rcomnided codes ( e.g., TEMA 1-.l, PT!r AP 3, e.) are in a very early state of develoM'ent and, As indicated by their developers,* are' inappropri a te to the ta .sk of evaluatingM the: re6liabilt of the cnenjency core-oobling systens in connection: with reactor iicons" inq.: The Interim Policy Statient plac* te 'responsiity for dotcmining emergency core-cooling syseim adequacy on code, " " 't r"l.eSent houristic develorpent efforts in 'the ficla Qf accident evaluation ratlerthan fin isheod and refined analyt cal tools. wlose accuracyhis been c.n

vincingly. confi =,ed, by engineering data. As then authors, ofIfJA1l affirm,

The code was designed re as a deveio'ment tcl tn as a production'cpde." (IN-1445, February 1971, p. 2)

A similar qulification of the use of the re rnende i io-tLer PLdes was given by the developers of-RELAP 3:

"The I -AP 3 progrm is being released, not as a finial product, but as a current method for investigatIng the transients e-t cted.

.in pressurized water reactor accidents. Modifications currently planed to improve and extenld the area of usefulness of t1e calculations will be included il the next version of he JWJ P ccnute; code." (IN1321,. June 1970, p? .1)

9 -23-0

7. De)spto indications that non-u borii (i e., radial). cooln

flcfd cLtstrxbutions'during ,thq blow own W-4 crnerjoncy Core. 0colt, injoC.

tionl phases of in loss-of-coolant,,accident could' Pose. a o:)o].inj pob].c Of great seriousness, the reacmerdc cautr codes do not s~ul te such

flow Patterns.

()Altliough presr isepcted to be Pitjnificanl qr'Vo

a Iround the bore hot-Ppolt tha n 0 10 -*wh ICtro, Tk1IA 1-13 ri Wet U -hoa

siinplifyicJi ass nption,,typi~cal of all the OS 1, .vcavrjie

core pressure as mfputed by TEL7k1 3 Pexists at te cloreht;jt

F ("Since TIhRNA 1-B solves only tha f luid n oceuto n o

tho coupled set of- equations for the fluid, several Upi:lfy.Ing.

as suidons are required. Thie prrssure arnd naSS f lux, zareasuijcd.

to be' uniformn through*,the9 channel. at any instaiit in tJmo 110sv

average core pressure as ommnited by 1~IMUA was use uz p the

pressure in the fluid channel."- IN-1445, p. 36)

(b) Although steam expansi.o Ond .ILedenfro,9t .iigrAtion 6nd

attendant radial f IVfd and coolant-bypass problcins durivig a.

loss-of-coolant 6ccident have been noted ("aJculatin 3-nli~

*cate that this problaq' [tidial. flow] my cnol. the nrcj'.1. of saeypreviul thuh to cxist in =i~goncy core coling

syst~ns." -XN-1-387, P" iii) no at upt bas bcen waad tb in

clude such facto-rs, in. thd codes to. be. used to nalyzp O.9.9pcfly

core-coolimng systiqn por.fort~nce.

..Sn icl etresults 'Ate~ usk-d in code (]cvol pT I e t wn in*

check ing existing codes, even thou~gh the'Atanic Lnrcjy Ccrinission, i

rcspnscto t1he failure of the: siulated' emergenc core-oirJssc

in the racent Idaho S emiscale tes ts, has, staLed that sciniiscalo moc'Jprs

were very inadequate simiula.aons- of "crauercial-s ze power reactorr3

zic use- of saniscalote st rosults -in code am;& inant and devoJ?

-intws af f imed by the -Idaho Nuclear Corpora1Lioj in i_~poiinx

report Sc)) cote Tez*6 '84"5 Tlvwu~h 85.1, June 29i 1.971, p.* I-1;

-24-

"The purpoze of the project [Scviscala Dlowdown ind 3nagauxcy Core Coolirj, (EC)] i to obtain experimental Jnfonmatiai reS .grding the hydraulic, ternmcdynamic and mechanlcal baliavior procesres which are expacted to be characterjs ic of a reactor system during a loss-of-coolant accident (n02A). ein foramtion is to be used for developing and evaluating analytical models and codes for reactor safety asesaiient ad for support an~d guidance of the WDIOT Intojral Test Prcxriun." The Atai 1nergy CcmAssion's position on t-e ielevanco. of the

srtiscale test data to determination of emergency oore-cOolirj systcm reliability on cOcnnrcial-size power reactors was expresse Jn the /uEc N&ws Release of May 27, 1971:

"The recent mnall mockup tests at NRI'S were not designed to represent the response of a actual operating puclear xfvlkr ' plant to a loss of cooltnt accident. There were sigmificwnt differences in the experimental system which was tested as .. conipared to m operating reactor.". .

Sie .ce. reported that AEC Director of R Ieactor Dsvelolinent and Techu.lojy, Milt-in Shaw, '"insists. these finding, [Idaho.San is.cale TeTs result8s hava little direct bearing on the safety of: Puclear reactors" (May 8, .1971,

One ist 1bin feature o natn Pt osudy th qluality (or lack of it) in safety system perf6On€Yc is that a nwib6&,: of cainp.ter

codes, developed by reactor nanufaoturerp to nalyze tho performnnce of their system.s during accident conditions, ar not available for public examination. The vendors consider these c 4s to be proprietary infor". mation. Sufficient public data has been, pr'ided on: the' assuoptU61nn Mui ployed Ji U. codes, and on the basic equations they incorporate, o that we have bean able to conduct a- Artilro'e ofhe&d'atuc.rs and adequacies, We have concluded that tie proprietaryco=es are no more acceptable than those in the publ.c dcmwin, we believe it is very wroneg to conceal. oven partia.ly frm pl: U viLw Material which Fo evj.drently affects fl1e. .ublic health and ni .cty and especiailly so since, them. iwia deep suspicion of its adequlacy.

In s rnary, we have concludcd LhAt the gaps. in cnineerin'g knowledge of safety system perfonm•u*v1 aX1 sImply too great to b3 bridged ade-quatoly by, prCi xt ,Inailnatical iits 9,,*,1. It. is.clear tlat t10 model4- en-

dorscxl under the.Inter=1 Criteria for oonfidentl.danstxrating reactor

safety-syster. acceptability v4=n moasured by the Scale of Vhe czritcaJ.

f.nton they are(asked--to-per QMn x ~~ 4d-~~

'-26-

V NCM9INS AND) PI(FMMTA.XO

Teevidenice of grave weaknes.s in mayidpnetapcsiftexnteric

Criteria is co a bundant' and coning that in our opin1io vruall 11

poti.on of the Criteria can contribute usefully to .a:Pp~tiv in

ofer cctor, safety 7 h vn fa15-fcoatacdn.O h basis of our studly And review of theo Criteria and of, relai.C-d ~4 1i~

oatria, We state -oloIng biccUcnr of the iterin, Policy

Stat-Crent:

1. ~~te~ Th ain~ ldigtw ature of .23,000'F is, excos sIve. Evidencie frcm. the fu l-rod failure testq n ',2flJ!AT,. the mast:' realistic simulation of the losp-of-coolant accident conxditions to date, indicate that 160 F is the t1wrcnhC'oJ.c dxbvewhlich core gecmetry begins to alter. :Inaanucib as; tto L

tered gjeiietxy may be -inconsistent with eff Fctive cwnx:-,rjon*cy core-cooling syptxn opeoration, a inuch 1c?%Yer -eak'cliad xn perature based on experinuentaly detennned throshold tomn-, peratures for core qeavietxy' alterations 'shoultd be- sUbqtftuq

tdfor the 23007 F allowablo under the-.,~ rhij CUJ-, ria.

2.' Fince the ktZnd of altered core gcxinies i a W. il nmenable to cooling by emrgency core-cooling sys Lruim operfl

tion are not specific4 in the Interim Policy statmw -ut,' tho reqcirent that "1the clad temperatmra transient is termvina.ted. at a time when the core gecmey is still arnmnable to cooling" is operationally vegue arnd Pipanincjless. Until the specifications , which, rhouJld be estJ-itbAlimh 'by 4;UitAI) experincnts,, for such. coolaible goanoitries. aq py*ro A, b~y the Ccz-mission, conformance with. this pir oft-e ntri Criteria cannotbeacrind

3. Mhe co.mputer codes, recwiiMended in tlie Interka Policy, Statemrtfor -analyzing anergoency core-rcooling Gyf~trLi pc - ~ o ill-MC: 0

Capabilities a-6-6wie thiat.thereL are no. nmjor ciznjes ii or gc'cmery. duringj, the course of a loss-of-'.coolanit . accidcrit. Tii ansunption is in confli ct with c].ear exparimcwtal indiCations Of such changjes in core gcanetxy durhxg a l~f cool-tnt acqidenit. T1his assumpjtion, moreoverV, 4Kxjs 'the -CjLuo'tion of an aynorgency core.-coolingl sy iten'111; cpTiIiy mzxintain core gIIEanet-r' in "I Co01ableo bonfiidtion

-27

4. Sane of the praueters used in the ccnputer cxxe U tjgc -,ted in the Interiim Policy Statment for use Jn tie .nan.ysis of ... ergency core-coolingj systafl performance are approxi.mto

and arbitrary, owing to an extensive lack of ex r/rental data on the nature and :se!uence of major events during a. lossof cont accident,

5. No adequate exporimental confimaLtlon of the accuracy of th e codes has been carried out urder realistic los.of-oolant accident conditions,

6. 11e suggested codes are in an early state of C-eve.omot " and the nature of the initial assvnpt4 ons, ccmjprcni~sOs forced by the complexity of the mathnatica-l model, etc., are puch that they.can only be regarded as deVelorment effol.ts in the

field of accident evaluation rather than As fini ied d re.fined analytical tools whose accuracy has be en. convinclncly. confirmed and which can be used to reliably simul.ate the dynamic conditions of a loss-of-coolant acci.demt. We f id the use of the codes, as they are presently constitutCd, to be

en Ye~~ bwotmeL ~th r ry means. of doCtezm nJi

whether or not. the emergency 9o9 -coolii3. ,pSytct:: is -4atiofactory.b

7.. -Exprimental knowledge, 0f metal'-water, reabtiorj, icluding eutectic alloys, indicates that the predict-ions of V,1..rci-loywater reactions alone, as employed to conform to Ciiteria No 2, greatly underest4ate, the extent to wfiich itetal.-watcr'. reactions may occur, for temperatures much be -23007 F,

8, Saniscale test results are used in code devel.opnt and for

checkilng existing codes, even though the Aumic nue-rgy Ccxn-.

mission, in response to the failu.re of tje smulated tests has stated that-the sniiscale-mockup8 were very inadequat simulations of conziercial-oize power reactors. Despite . this view on thie dissimilarity of semiscale and cxICIercial-' size reactos, canputex, codes based on sm-uscale systan data are recawiended for use in analyzinj comerclal-p i zeo "

power reactor emergency core-coolig sys tems.

9. Despite indications that, non-uniform coolant, fl.ow distribu

tions withi.n the oore durinr, blo1own and c mrjcy coiecoolmnt injection may cancel, the margin of. sIfeLy previoutly thought to cxtstin.c. rgency oo-o ling ys.; LC, the

O~~ ~ :,s..1:1 Co'h . ,3

* recamiEfddd mcnltc-tr codes 00 not &Imllate i.h. raclial. * flcw. For excaplo:, tlhovgh presruro is c-xpoc Lcl to Yo

significantly greater =~ound tho core lot-u~p~L: tban 1 i', DTiUAY I-B iivO~enq the Mimpifying assu-nptJ.on -that averi' ce-wxu pressure as ccxnputxpd by: M~AP, 3 exists 4t the core. hot-r pot.,

We note i particular cimwvi tliat there are, a ntm~~r re

tors. ncf.% oparating whichi do not, and Will not be exr)cbd for, owie yearst:

to =cet the Int.6ri Criteria.- 'ibis adds acldit ioncal. forc3 -to oar u efl

Reoactor rafoty with1 rebpcct to, major. accclcntu nr on IULjl

wJide-sprea-d iiwago and loss of J1ifo is in a va 'y .8rit -iaptm.y ftatc-.

Tho Intrim * Criteria mAce no adequpate roredil crntrUxutioi i wd cian

servo only. to prolomg public expQr3ure ta. extrcme ri~ks ovLor which tbere,

isinadequzite, control. and, which: the.,Criteria9.rsoe ihol h

apxCarNc' and 3.Jlusnion of safety.: Theituationi r-fiuld lio *ba lJiv"e

to V.:rsist.

71 ie acuto failitgs of the, Intcwlr3i Cciter.a t iat ~iiy9~J3

weakno:-xon, in reactor safety atmurmtnce )Xf F1 wzt a subrtzrnthl iii-rxxyfdJion

by tie% Atomlc Energ CcnwdJSln of its m1 v 1I.r responsibi~ity to enm.i'i

th- publtic safety. It. i.s apparent' ficri t1 jis that )ha AEC utnnot (uuLtOn

fficaLvoly ais thetsupporter at-d initiLator. of 'a major natJon111A. pgri"M'

to "nuclearize" the Country and, at the Pans. time, have total- redrbnsihili

t~y f or the most -critical. aspects of reactor Safety. Ou ~ ~ t.l

of tle Intrin Criteria cMIpaEsizoa how, Imiortaj-nt It. j s that tlie orLJani-d

vation that dircts{ th%3 procxjrans of reactor dlevolopuient OlAV].] not 1-10d.

thei major responibility kor cleve loping and onforcin-g, thre_ critoria of

safety. Moreover, the latgo iiumbor of: reactors. now oparettimng or uLneder

consti.uction and the weaknesses of the. Interim Criteria itluhoc i~t uryen L

to effect the separation o f .the respons;ibility for keactxr safety frcui

the ADX2 as pranrptly ,as possible, so ,thaLt, annang otharn reatsons, fully.

adequate criteria for reac tor =:ftycnbe sWiftly, sonltd he aii

tornativa will ))3 a highly undesirable increase of Vh wadt which,

th.! Pinorican public I.i presently cxportcb To detcnidnc how4 acute! this

hazard is and whiat' steps 'mist be taken to clarify m~nd au1Xoae . re

matters of national: concern cnd MuSt also be pranptly mi~d cle"Arly do..4cted. Corrective action of. adcquate acp ca uhn )x- initiabtcl

without delay.. Accordigly1 eroxrod

,Ani :himexdiate separat-on, frcm Oic AtU~i~c Enrc]-jy I (bdi.on of the re.9.onsibility fodcxninjcitraorl1 ar~La of.:niclear powier re =-tor oafet n o oversocixj cacIpiiio with the criterif%, including unes~ I di ary 6ozitrl both

b. of planned and of wiplanned releasos off rod-ioactive imiterital. The responsibility. must; be aasumed4 m Wan ) ace .W nepe)ndent ; of the Am)

2. Pranpt in4.tiat:i-on of a thoronhm cu -i. ca J -njiee. H

s tudy, Icyaqualifiocl group,. In yockt %fte (,wh ob jective would be:

(a o iew. the expe Ie poi f nCe of cbcrjec

core-colaJ, systwo inst4leo -in oparat.t yxqer reactors' (a. suggestion wo. male. carl. imr

(b) To detexliJnie the hazard: to the public c X ot4£~~ *the reactors ria,4 under cxmitruct-ion or plmned an1

(c) 7b'develop the outline pf pn adecato prgram of. engineering research, nd devomient'that WOMld 'clarify

o the neiture nd mean 'of iiitigating loop of- 6001at it AccidentD, aprCqruII loave national

We ih to chasizo t'e contin Y.w i~pW)tahco of tho rc.!ien*clation of ouir earlier paper: A total balt to thie iEnciwiU.or ovapiatn'

licenses for nuclear xorreacor rsnl under ckr. nctiAon until. safegujxards of assured perfOznance czn bepovid(d

We are. not 'alone in 4 recdaunedipng fe a frum tba 7E of authority to dexmn reactor safety-standards I lTcaevcr, it is frcin on~sideration of 010 conserqueices of major reactor O.ccidents wnd how the IM~X has act--ed,

* to prevent or ndmitot such 'accidents'that this rccumncldatiaoI (jets its princirjxil1 force. %bis And' our. earli#V study illuiMnate clearly the Mag

* nitudo of tho kisks of major accidents and the frailty of the S'f eguWd.

agai4t t-hcin. JMdquatc safety .critqr~a based On 130CI7n70 kn( I..cjeCA have

bcji lar.];i ri-j during thc.a rly.:l fi 1ftee mYcwa rin vhi c: h 3, acr rc~taoin: Co01-

0 - 0 8txucLion has continued in the United States. Te lack cmnot bo MoreC

'teA too rcxiptly.

I.

I..

I, ii

q , d.