From: millerj@gn.ecn.purdue.edu (Snide Pucker)
Newsgroups: sci.energy
Subject: Potential Nuclear Accidents ; was Re: Yack's daemons (was Re: Nuke Stupidity Rebuttal)
Date: 28 Sep 92 18:40:38 GMT
Organization: Purdue University Engineering Computer Network


   Just taming some of the assertions about nuclear accident mitigation...


In article <ba_p_bl@dixie.com> jgd@dixie.com (John De Armond) writes:
#>yodaiken@chelm.cs.umass.edu (victor yodaiken) writes:
#>
#>Well either the bottom of the pot falls off or it stays partially in place.
#>If it falls off, it falls into the reactor sump and is cooled by the couple
#>of million gallons of water present.  If it stays in place, it is cooled
#>by the safety injection system, HPSI, LPSI, passive accumulator, concensate
#>cooling system, and/or river water system.  Yeah, we really do think
#>of these kinds of things when we design the multiply redundant safety 
#>systems.

   Errr....actually, few scenarios envision anything more than a partial
   cooling of any corium with the sump water.  Water in the sump can actually
   be a bad thing if enough corium is ejected, in which case you must worry
   about the pressure loading on the containment due to rapid vapor expansion
   (the "vapor explosion").  I believe the failure of the entire vessel
   (cracking in half, etc.) is very^n small at operating (or higher) temps;
   this should only be a problem during cold starts, refueling, etc. when
   the vessel is cold (and more brittle).

   A problem with the entire ECCS methodology is that for serious accidents
   (large-break LOCAs and the like), each cooling system must function
   properly to cool the core completely.  Any failure may cause core damage.
   Each system has its own failure mode, so a disastrous malfunctioning of
   the ECCS system requires something only a human could do, shut it off
   (cf. TMI).

   This isn't the same, or nearly as foolproof, as passive cooling techniques
   used in BWR MarkII (or its derivatives) or any advanced LWR (pick one).

#>Then the operator would simply close one of the other redundant valves
#>in the train.  All containment penetrations have two valves inside and 
#>two valves outside, all in series and all designed to fail closed.

   All references to TMI's PORV ignored...

#>>or that there is a
#>>lightening strike and the operators lose instrument power, 
#>
#>Then the PWR plant would cool on natural circulation until power was restored.
#>Natural circ cooling is a test performed ALL PWRs.  

   ...but has not proven to be 100% effective even for decay heat...

#>Note too
#>that all components including the heat sink are located inside the secondary
#>containment building so containment isolation does not affect their 
#>operation. 

   Which is exactly why a containment breach is required for a nuclear
   accident to emit large quantities of radioactive material.

#>>or that
#>>someone panics and opens a venting pipe 
#>
#>Then the SRO, the shift supervisor or the STA, all of which are licensed and
#>all of which are required to be in the control room at all times, 
#>would override the operator and close the valve.  Since only the shift 
#>supervisor, with the agreement of either an SRO or STA can override 
#>a written procedure, "someone panics" would not happen.

   ..., but no one's permission is required to hit the wrong button.

#>But let's pretend that something could happen to cause a massive failure
#>to insert.  [explanation of possible scenario actions]
#>The operator might occasionally trim the pressure control to keep the 
#>cladding below the ignition point but other than that, not much to do.

   All of which assumes that his instrumentation readings are fully
   functional, necessary components aren't being maintenanced, the
   situation is correctly assessed, information is properly exchanged
   between coworkers, etc.  The WORST possible accident, imho, ISN'T
   a _material_ or _component_ failure, but a _human_ or an _instrument_
   failure.  PWR ECCS is useless unless it is operational (neglecting the
   Accumulator Injection System).  Backup control rod injection methods
   aren't very helpful if the operators think all of the rods are in.
   The list goes on (and did at TMI).


   The moral of the story is that things _can_ go wrong with nuclear
   reactors.  Fortunately, there has been a significant amount of time,
   effort, and money spent on mitigating every conceivable accident
   scenario currently considered possible.  This is not to say that
   nuclear reactors can never fail completely, but that the likelihood
   is remotely small that it is a worthwhile risk compared to the 
   (relative) benefits of nuclear power.

   For nuclear reactors to NEVER fail would require definitive material
   behavior and response over the lifetime of the component/instrument
   (that is currently unavailable) and a design that acknowledged this.
-- 
---
   Jerry W. Miller                   #   "Opinions?  Of course they
   millerj@gn.ecn.purdue.edu         #    are mine, do YOU want them?"
   Purdue Univ. School of Nuclear Engg//Argonne Nat'l Lab--Reactor Engg