Advanced Nuclear Reactor Safety

[JimD]

First let me say that a person closer to the support for the TEPCO than I am confirms the suspicion that the Japanese regulatory system never accepted the beyond design basis safety initiatives used in the U. S.. So the damaged reactors had no instructions for what to do when they got hit with a beyond design basis earthquake and Tsunami. That resulted in the total loss of electrical power. The resulting damage would have been much less severe, however, if the TEPCO operators had kept the water level up in the spent fuel pit (something their diesel fire pumps could do well) and if they had started seawater cooling of the cores of Units 1-3 earlier. These are the kind of instructions that would exist in the U. S. and did not in Japan.

I bring this up to say that I don't think advanced reactors are necessary to avoid the damage we are witnessing in Japan.

But I got usefull clarification of the advanced cooling system of the AP1000, the only truly advanced nuclear reactor available at the moment in my opinion, that I want to pass along. The basic design principle of the AP1000 is to have an inner steel containment vessel inside a shaped concrete outer containment. Current nuclear plants have the steel liner in contact with the contrete and the steel inner is not sufficient to contain the pressure without the concrete, the AP1000 steel inner is much thicker. Air flow between the steel inner and concrete outer is what cools the plant if offsite power is lost. This is aided by a large tank of water that coats the outer surface of the steel inner containment with water (for evaporative cooling) for 3 days. This allows the core to cool a lot, the decay fissions would be nearly totally gone so there would be a fraction of a percent of the normal power to be removed. After that point, you have 5 to 35 days to put more water in the tank (using a fire hose or whatever you have) or the pressure in containment would begin to rise. It is 5 days at minus 40 F and 35 days at 115 F (the cooling is apparently better at higher temperatures (not intuitively obvious why)). The inner containment would never be breached if water was not put back in the tank but the core might be damaged. In other words, the public would not be at risk because the radioactivity would be contained but the utilities economic interest in the plant is at considerable risk if the water is not put back in the plant within a week to a month after power is lost.

I am not trying to imply that AP1000s are perfect, only that they do not have the same reliance on power that was an issue on the Japanese plants. If you are interested, this link should get you to a lot more informaiton on AP1000s:

http://www.ap1000.westinghousenuclear.com/

The only new plants that have "moved dirt" in the U. S. are AP1000s. TVA is planning to finish Belefonte but it is very old technology that started construction in the 70s and is planning to resume (why would be a good question). TVA will start up Watts Bar 2 late this year or early next. It is also old technology (but better than Belefonte IMHO). No new BWRs are currently planned in the U. S. (not that they are unsafe or inferior, that is just the status).

Jim

[LCHIEN]

The AP1000 sounds very interesting, Jim.

Good point about the lack of beyond design basis plans.
One thing I've been hearing is that there were some "fatal" delays in decision making leading to much too late cooling efforts. this would be caused by
1. total breakdown in communications for an extended period (which is also an effect of natural disasters i.e. earthquake alone or tsunami alone much less together)
2. Lack of plans for loss of cooling power a beyond design basis incident.

But it also suggests that they had no one on site that knew what to do and what the risks are. Shouldn't a person in charge of 1-6 reactors (worth >$30 Bln) and about 4-5 GW of power be informed as to what would constitute a meltdown (e.g the basic disaster that can befall a nuclear plant). I mean there should be a guy within uninterruptible communication with the plant who says what, we have total loss of cooling power and its been an hour and there's no relief in sight - its going to be days, Holy sh*t we'd better do something fast!.

And, there are 6 reactors at this site, fortunately three were already "shut down", can you imagine how much bigger this would have been had all 6 been involved with partial core melts?

So finally I think the advanced designs of the AP1000 makes sense. If its really true then I'd say we are prepared to install more new plant using such a design.

The issues remaining/going forward would be
1. Worldwide standards of operation
2. Worldwide standards of design and construction (this is a real problem there are many countries with a culture of corruption - a nuke plant is an opportunity for unscrupulous contractors to cut corners that may probably never be noticed (until its way too late). ANd don't say inspectors - the contractors will buy them off, too.
3. Human factors - human errors are still a prime cause of nuclear problems, Chernobyl and TMI were human errors, arguably natural "disasters" tripped off Fukshima but I think human errors following compounded the problems rapidly, if human errors are not also to blame for underdesigning and not upgrading the plant for large tsunamis.
4. Retirement of old plants. If the new plants are significantly more safe and they need to be then should not old plants be shut down rapidly? This is a risk analysis exercise, probably not a good thing to undertake while the public is still emotionally involved in Fukushima although that's what certain groups are hoping for.
5. Something gotta be done about spent fuel. The gov't promised to do something about this and failed.
6. Costs. Going to be huge. Who's footing the bills and the risks.

I must say its been truly fascinating watching what some have called a slow motion train wreck unfold.
I think they have now gotten the upper hand - the plants are reducing nuclear decay very gradually and they've got much more help (no longer stuck on self-sufficiency).
We're in for a very, very long haul of restoring basic operational needs for the cooling and then decommissioning and decontaminating the plant. They're having to dump contaminated water in the ocean which is Very bad in practice (I don't care how much it dilutes and decays rapidly - its just bad) - I think it reflects a lack of planning again - it should have been obvious, I think, that at some point there would be a lot of water to get rid of. They should have started digging pits or getting barges much sooner. I realize that without dumping this water they would be dumping even more radioactive water and or melting the cores again but it seem like it might have been preventable.

[jackellis]

Jim, thanks for the primer on the AP-1000. I'm still trying to figure out why containment cooling is better at lower temperatures than at higher temperatures. Probably a simple explanation but it sure is counterintuitive.

[JimD]

There is a big preference in the nuclear industry for engineered safeguards. Engineered safeguards are things that are designed so that it is at least very hard to use them in a way that would be unsafe. For instance, we store UO2 powder during the fuel fabrication process, in large plastic containers that hold ~10-20KgU. If there was moisture in the powder (we haven't tested yet at this stage of the process) there is not enough uranium for the container to fission. If we used a large enough container, it could. So the size and shape of the container prevents fissioning. That is much preferable to having a procedure that prevents the operator from completely filling a larger container when they are working with higher enrichment material. An the surface, either system could be equally safe. But if we have to depend on people doing the right thing, we start to get a little worried. For criticality, there are always at least two reasons you should not go there. The size and shape of the container could be one and a procedure directing the operators could be another. Two procedures (somebody with a procedural obligation to check somebody else's work) could be two reasons but we try hard not to do it this way.

There is also a large effort to address human factors more directly. We use cards to be filled out by all the manufacturing mangement documenting that they have done observations of their personnel in specific areas, for instance. This is based upon the observation that workers are more inclined to do what they are supposed to when they know somebody is checking. While admittedly imperfect, this process is IMHO a good idea and not something that all industries do.

Japan is far from our shining example but the nuclear industry is really pretty careful. We have to be given the potential consequences of a mistake. Japan is not exactly a mistake but there is a developing list of things that could have been done better and will be in the future (have beyond basis operating guidance for operators is an obvious inclusion). Japan will also need to think about the magnitude earthquake their plants should be designed to handle and especially needs to think about designing for bigger tsunamis. The same principles need to be addressed worldwide. There are already existing mechanisms to make this happen. INPO and NRC involvement in the recovery will help make sure it happens in this country.

I don't want to run down the Japanese but you might also remember that about 10 years ago they had a criticality incident during fuel manufacture. Nobody else in the West has had that sort of incident before or since (not sure about Russia - relatively closed system). Their manufacturing process was light on engineered controls and there were a number of clear procedure violations. So there is some non-positive history of significance unfortunately. A few workers died in the criticality incident. Culture is one of the toughest issues to deal with but might also be involved in this Japanese incident.

Jim

[Kristofor]

After that point, you have 5 to 35 days to put more water in the tank (using a fire hose or whatever you have) or the pressure in containment would begin to rise. It is 5 days at minus 40 F and 35 days at 115 F (the cooling is apparently better at higher temperatures (not intuitively obvious why)).

In this house we obey the laws of thermal dynamics! - America's most well known nuclear industry worker.

The amount of heat disipated by the evaporation of a fixed mass of water should be pretty close to a constant... Add in the energy absorbed by warming the colder water and I think there must be some other facet of this process that's been left out. I suppose if they just flip the switch and let the water run out fast enough that it reaches the floor as a liquid and doesn't all evaporate maybe that would explain it?

[180x]

There are many things that our government has placed stringent regulations on that are unnecessary and counterproductive. But when it comes to the operation of a commercial nuclear power plant they are typically on point. There regulations are geared to public safety, not power generation. However, the US nuclear industry goes beyond what is required by the NRC by "policing" itself with INPO. This was one of the many good things that came out of the TMI incident, which by the way we re-analyze every year during one of our training cycles. INPO's purpose is not only to make certain plants operate within the regulations, but to also help them achieve “operational excellence.” Being an INPO 1, their highest rating, and in the 1st quartile of their performance indicators is a badge of honor and not easily attained. NRC inspections are a piece of cake when compared to INPO inspections (neither are funny however). Again, they are not a government or regulating agency, but an entity formed by the industry to police itself.

The US nuclear industry is also good about sharing information. If something happens @ one facility, regardless of how minor, it is shared with the rest of the industry. This includes both equipment failures and human performance issues. As we have seen from our Japanese counterparts, behaviors and mindsets have just as much of an impact in attempting to mitigate accidents as equipment reliability does.

I think Jim is right in the fact that Japanese regulators may not have been as aggressive as ours in making sure older plants make constant upgrades and don't remain in their original design. We were one of the last plants to come on line and have gone through numerous design changes, some voluntary and others mandated. We have even dramatically upgraded how the plant is secured (it may be easier to get to the President than in here). This was one change mandated by the NRC to drastically minimize a terrorist threat.

[JimD]

I suspect that the negative cooling correlation with temperature has to do with the way the air moves between the concrete outer containment and the steel inner containment. It is like a cooling tower, kind of, and is shaped to have some chimney effect. The most typical temperature is higher so I think it is optimized to maximize airflow at higher temperatures. But that is a bit of a guess. We know for sure that cooling of the steel inner containment will occur more quickly when cooler air flows past it so the only way for it to cool slower is it must be less cool air and more warm air - that is my logic.

[gerti]

So what happens when a fully fueled heavy plane crashes into an AP-1000? Sadly a possibility that has to be considered these days.

[jackellis]

You can't compare what happens when a plane hits a concrete containment building with what happened on 9/11. In the latter case, fuel was spread all over the inside of the building adjacent to the impact area, it ignited, and the heat from the resulting fire softened the steel framing. When it softened enough, one floor collapsed, which caused the floor below to collapse, and so on.

If that same airplane hit a containment building, fire would not penetrate the containment structure. Any fire would have to burn right up against the concrete for many hours before enough heat could be transferred to the steel reinforcing bars to warm them up, much less weaken them. The airplane structure would either bounce off or shatter.

I thought I remembered seeing video of a test but the only references I could find quickly involved computer modeling.

I suspect containment structures around newer plants will be hardened even further than existing ones. So long as the containment structures don't have easily penetrated openings, I think the risk is pretty low.

[LCHIEN]

You can't compare what happens when a plane hits a concrete containment building with what happened on 9/11. In the latter case, fuel was spread all over the inside of the building adjacent to the impact area, it ignited, and the heat from the resulting fire softened the steel framing. When it softened enough, one floor collapsed, which caused the floor below to collapse, and so on.

If that same airplane hit a containment building, fire would not penetrate the containment structure. Any fire would have to burn right up against the concrete for many hours before enough heat could be transferred to the steel reinforcing bars to warm them up, much less weaken them. The airplane structure would either bounce off or shatter.

I thought I remembered seeing video of a test but the only references I could find quickly involved computer modeling.

I suspect containment structures around newer plants will be hardened even further than existing ones. So long as the containment structures don't have easily penetrated openings, I think the risk is pretty low.

I will agree with jack that a hardened containment building does not compare to a modern skyscraper - probably the containment structure will be reasonably intact if attacked directly with a plane.

However, what the Japanese event shows is that the vulnerable parts aren't all in the containment building. An attack crashing a large fuel-laden airliner into the surrounding support equipment may cause a meltdown accident. The resulting intense fire and physical destruction of hitting buildings adjacent to the reactor containment, lets say in a plant with two operating reactors, can possibly and likely
1. destroy incoming power feeds
2. destroy command and control and instruments and cabling
3. destroy emergency generators and fuel and the power cabling from them
4. destroy piping and cooling pumps and electrical controls for same
5. render the site inaccessible for days due to fires, heat and debris
6. deny access to the containment buildings.
7. kill key personnel
8. rupture spent fuel cooling pools leading to loss of coolant and uncovering of fuel rods.

I daresay the combination of any three or four of the 8 above would lead to a loss of cooling and if the reactor is, like the bulk of them, not fully safe with passive cooling (and even the AP1000 discussed is only good for 72 hours) you could have two serious core melting incidents and possibly spent fuel incidents before it could be brought under control. Even if the core containment stays intact there can be a lot of collateral damage as we've seen in Japan.

One of the lessons to be learned from the japan experience is that disaster often denies you more than one of your primary and backup systems simultaneously.

[JimD]

Loring,

You aren't giving the industry enough credit. After 9-11, there were a bunch of added security measures added. The guards where I work never carried guns before. Now they do. That was a bit scary because initially the guards didn't change. I was hoping they were following the Barney Fife rule (remember Andy and Barney?). Now they have to pass proficiency tests. We also had to put in protection against truck bombs as did all other plants that contain special nuclear material (uranium or fission products).

But more to the point, another thing that happened after 9-11 was airplane strikes became part of the design basis for new plants. Existing plants had to do studies and show acceptable consequences. The details are not available to those without a need to know (so I haven't seen them) but I am confident they do not include uncovered fuel. Competitive pressures, essentially, forced the bar up for new plants. The French EPR claimed an advantage of the AP-1000 (I assume it was real) and the French regulator started talking to the U. S. regulator. So the AP-1000 design was changed to give it similar "airplane resistance". The key change was to the design of the concrete outer building surrounding the inner steel containment vessel. It will be made differently to make it stronger under these conditions.

The containment vessel of a nuclear reactor is sturdier than nearly any building you can think of. It has to be because it has to resist the design overpressure. But you are also right that outlying buildings are not nearly as sturdy. But the whole thing has been studied and the consequences of an airplane strike determined to be acceptable. One factor to be considered is the nuclear plant is not an easy target. Compared to the World Trade Center, it is much much closer to the ground and therefore more difficult to target accurately. I doubt you can credibly target most of the outlying buildings because the stonger containment/cooling structure is by far the tallest building and the others are directly connected. But I have not seen the justification, I just know it exists and has passed regulatory review.

I don't want to say this because I work in the industry but the best target for terrorists to target in the U. S. are its nuclear facilities. I am much more worried about an attack to a gas pipline, a petrolium refinery, a large office building etc.. Armed guards 24 hours a day, buildings designed to be protected, structures around the buildings to prevent forced entry are all unusual. The industry and the regulator also do "force-on-force" drills which are graded. They have simulated terrorists attack a facility and see how they do. They are announced (so the simulated terrorists are not shot) but the design of the exercise is a surprise as is the exact timing.

Jim

[LCHIEN]

better to give them not enough credit rather than too much.

I hope you are right. Human errors are always a worry. Especially when you are defensive. They say when you are on defense your stuff must always be ready and be 100% reliable, for attackers their stuff only has to work at the time of the attack.

[sscherin]

Well I for one would not want to mess around with the Hanford Patrol..
Those folks are closer to a military outfit than police force..

http://www.wstoa.org/team_profile_hanford.php

http://www.kndu.com/Global/story.asp?S=13967920

I can't attest to how the facilities are built.. I just do IT work for Hanford from an office outside the fence.

[leehljp]

I have said it before and will say it again - in different words: Japanese are totally "Group" oriented, not individuals. Decisions are made by consensus within groups for most of their lives, from pre-school through adulthood. A life long "group thinking" and "consensus decision making" does not develop the critical decision making process that is found in an "individual" society.

Japan's leadership comes from the oldest, or the longest tenured, or a relative, or the most educated from a business perspective, not the engineering geniuses. The more genius you manifest, the more you are stuck in a hole! It is culture.

This situation is going to force some changes on their culture as it deals with leadership decisions in crises and it is going to be "interesting" to see how it works out.

[LCHIEN]

I see the Japanese NISA has finally raised the Nuclear incident severity level from a 5 to a 7. Initially they kept it at a 4 for a long time. Each number represents a 10X increase in severity. TMI was a 5 and Chernobyl was a 7. Some of the factors involved in the increase is the multiple reactors involved, the amount of radioactive material emitted (something like estimated 700 thousand trillion becquerels released to date) and the fact that the radioactive pollution is crossing national boundaries in significant amounts.

Admittedly a becquerel is small but there's like 18 zeros in the prefix.