Transients and loss-of-coolant accidents

Rohan keeps a binder on his shelf labelled simply "events". Inside are the transient and accident analyses for every plant his group has worked on, each one a story told in plots of power, flow, pressure and temperature. "Steady state is where the fuel lives," he says. "Transients are where we find out whether the design was right." For the next two weeks, Hana works through the binder, starting with the gentlest events and ending with the loss-of-coolant accident.

Classifying events

Safety analysis groups events by how often they are expected and requires stricter outcomes for more frequent ones.

In Canada, the CNSC's REGDOC-2.4.1, Deterministic Safety Analysis, sets out how licensees analyse these events, including the requirement to derive quantitative acceptance criteria that protect against fuel failure, channel failure and excessive releases. For CANDU reactors, derived acceptance criteria for design basis accidents typically include limits on fuel sheath temperature and the time spent at high temperature, on fuel centre temperature, on pressure tube integrity and on the containment.

Loss of flow

A loss of forced flow, from one pump trip up to a loss of power to all pumps, is a standard anticipated occurrence. Flow coasts down, supported by the pump flywheels, while the reactor power stays near full until a trip signal, such as low flow or low pump speed, inserts the shutdown rods. During those first seconds, heat flux stays high while flow falls, so the critical heat flux ratio drops. Fission power then falls within about a second of rod insertion, to the decay heat level, and the margin recovers as natural circulation establishes itself. The design must show that the minimum DNBR or critical power ratio stays above its limit through the dip.

A simple coastdown model writes the flow fraction as \(w(t) = 1/(1 + t/\tau)\), where \(\tau\) is a time constant of a few seconds set by the pump and flywheel inertia and the loop resistance. With \(\tau = 5\) s, flow is halved after 5 s and down to a fifth after 20 s, by which time decay heat is about 4 percent of full power.

Other anticipated transients

The loss-of-coolant accident

A loss-of-coolant accident (LOCA) is a break in the primary pressure boundary. Breaks range from small leaks, which the normal makeup system can cope with, through small breaks a few centimetres across, to the instantaneous double-ended guillotine break of the largest pipe, which has long been used as a bounding case. The phases of a large-break LOCA in a PWR are described below; CANDU and BWR phases differ in detail but follow similar physics.

During blowdown, coolant leaves through the break at the critical flow rate of Lesson 5. The pressure falls in seconds, the coolant flashes, and the core passes DNB almost immediately. Stored energy in the fuel moves into the sheath, causing an early temperature peak. As the vessel empties, cooling relies on steam flow until the emergency core cooling system (ECCS) refills the lower plenum and refloods the core. During reflood, the sheath temperatures reach their main peak and then fall as the quench front, the boundary between wetted and dry sheath, advances upward. The ECCS has passive accumulators, pressurized tanks that inject automatically, and high- and low-pressure injection pumps; later, it recirculates water from the containment sump.

In a CANDU reactor, a large break voids the channels in the affected loop. CANDU fuel has a positive coolant void reactivity, so voiding briefly raises power until one of the two independent shutdown systems trips the reactor, within about a second or two. The emergency core cooling system then injects light water into the headers. If ECC were also unavailable, the moderator surrounding the calandria tubes, kept subcooled by its own cooling system, can remove decay heat through the pressure and calandria tube walls, and the shield tank around the calandria provides a further heat sink. This capacity to remove heat through the channel walls is one of the distinctive safety features of the design.

Acceptance criteria

For CANDU design basis LOCAs, licensees demonstrate that derived acceptance criteria are met: for example, that fuel sheath temperatures stay below values at which sheath embrittlement or failure would become likely, that fuel does not melt, that pressure tubes do not fail, and that releases and doses meet limits. The specific criteria and their technical basis are documented in each station's safety report and reviewed by the CNSC.

# Transients: pump coastdown, decay heat, and a lumped heatup of uncooled cladding.
import math
# Pump coastdown: flow fraction w(t) = 1/(1 + t/tau)
tau = 5.0
for t in (0, 2, 5, 10, 20):
    print(f"coastdown t = {t:2d} s: flow {100/(1+t/tau):5.1f} %")
# Adiabatic heatup of a fuel rod segment with decay heat only (no cooling), illustrative
q_avg = 17.8e3                  # W/m average linear heat rate at power
peak = 2.3                      # local peaking
mcp = 0.25 + 0.05               # kJ/K per metre: fuel ~0.25, clad ~0.05 (rounded, per m of rod)
T = 600.0                       # C, initial clad/fuel average after blowdown, illustrative
t, dt = 30.0, 1.0
while t < 300:
    P = q_avg * peak * 0.066 * t ** -0.2      # W/m decay heat
    T += P * dt / (mcp * 1000)
    t += dt
    if int(t) % 60 == 0: print(f"t = {int(t):3d} s: uncooled hot-spot temperature ~ {T:6.0f} C")
# Blowdown mass flow through a break: rough choked-flow estimate G ~ C*sqrt(2*rho*dp)
for d_mm in (50, 200, 700):
    A = math.pi * (d_mm / 1000) ** 2 / 4
    G = 0.6 * math.sqrt(2 * 700.0 * 15.0e6) * 0.35     # crude two-phase reduction
    print(f"break {d_mm:3d} mm: initial discharge ~ {G*A:7.0f} kg/s")

coastdown t =  0 s: flow 100.0 %
coastdown t =  2 s: flow  71.4 %
coastdown t =  5 s: flow  50.0 %
coastdown t = 10 s: flow  33.3 %
coastdown t = 20 s: flow  20.0 %
t =  60 s: uncooled hot-spot temperature ~    727 C
t = 120 s: uncooled hot-spot temperature ~    948 C
t = 180 s: uncooled hot-spot temperature ~   1147 C
t = 240 s: uncooled hot-spot temperature ~   1333 C
t = 300 s: uncooled hot-spot temperature ~   1509 C
break  50 mm: initial discharge ~      60 kg/s
break 200 mm: initial discharge ~     956 kg/s
break 700 mm: initial discharge ~   11712 kg/s

Small-break LOCAs

Small breaks are slower and in some ways harder to analyse. The system depressurizes gradually; the reactor trips; the pumps may be tripped by procedure; and the coolant drains by gravity to the lowest points. The behaviour depends on where the break is and on the natural circulation and reflux condensation modes of Lesson 10. In PWRs, water can be held up in the pump suction loop seals until they clear, and the core level can dip temporarily. The 1979 Three Mile Island Unit 2 accident began as a small-break LOCA through a stuck-open pressurizer relief valve, compounded by misleading indications that led operators to reduce injection; its lessons transformed operator training, control room design and small-break analysis. NUC-410 covers it in detail.

Reactivity-initiated accidents

A rapid insertion of reactivity, such as the ejection of a control rod in a PWR or a rod drop in a BWR, produces a sharp power pulse lasting tens of milliseconds. The energy deposited in the fuel before Doppler feedback stops the excursion can heat the pellets and load the cladding very quickly. Acceptance criteria are expressed as limits on the fuel enthalpy rise and on cladding failure thresholds, and they have been revised as tests on high-burnup fuel showed lower failure thresholds than earlier data suggested.

Conservatism, best estimate and uncertainty

Early LOCA analyses stacked conservative assumptions on each other: high decay heat, conservative heat transfer, worst-case break, single failure in the ECCS. Modern best-estimate plus uncertainty (BEPU) methods use realistic models and propagate uncertainties statistically, often showing that a criterion is met at the 95th percentile with 95 percent confidence. Both approaches are accepted when properly justified. They are discussed further in Lesson 12, because the codes are where the methods live.

Emergency core cooling in different designs

Different designs reach the same goal in different ways. Large light water reactors rely on several stages of injection, so that water is always being added at whatever pressure the system has reached. A boiling water reactor that cannot inject at high pressure deliberately depressurizes, through an automatic depressurization system, so that its low-pressure systems can work. CANDU emergency core cooling injects into the headers in stages and then recirculates from the building sump. The BWRX-300 takes a different approach to large breaks: its design places isolation valves directly on the vessel nozzles, so that a pipe break outside them can be isolated and the reactor inventory kept, with isolation condensers removing decay heat. In every case, the analysis must show the acceptance criteria are met assuming the worst single failure in the safety systems.

What the plots in a safety report show

Hana learns to read a LOCA analysis by its plots. Primary pressure falls from operating pressure toward containment pressure within tens of seconds for a large break, or over many minutes for a small one. Break flow starts at the critical flow rate and falls as pressure drops. Core collapsed liquid level shows when the core uncovers and when it recovers. Peak cladding temperature rises during blowdown, may dip, rises again during refill and peaks during reflood before falling as the quench front passes. Containment pressure rises and then falls as heat sinks and cooling systems absorb energy. For each plot, the analyst asks what physics drives the shape and whether the timing makes sense, the same habit Rohan has drilled into her with hand calculations throughout the course.