Transients and loss-of-coolant accidents

Rohan keeps a binder on his shelf labeled simply "events". Inside are the transient and accident analyzes for every plant his group has worked on, each one a story told in plots of power, flow, pressure and temperature. "Steady state is where the fuel lives," he says. "Transients are where we find out whether the design was right." For the next two weeks, Hana works through the binder, starting with the gentlest events and ending with the loss-of-coolant accident.

Classifying events

Safety analysis groups events by how often they are expected and requires stricter outcomes for more frequent ones.

In the United States, the NRC's General Design Criteria in Appendix A to 10 CFR Part 50 require that specified acceptable fuel design limits not be exceeded in anticipated operational occurrences. For loss-of-coolant accidents, 10 CFR 50.46 sets specific acceptance criteria for the emergency core cooling system, described below. Safety analyzes are documented in each plant's final safety analysis report.

Loss of flow

A loss of forced flow, from one pump trip up to a loss of power to all pumps, is a standard anticipated occurrence. Flow coasts down, supported by the pump flywheels, while the reactor power stays near full until a trip signal, such as low flow or low pump speed, inserts the shutdown rods. During those first seconds, heat flux stays high while flow falls, so the critical heat flux ratio drops. Fission power then falls within about a second of rod insertion, to the decay heat level, and the margin recovers as natural circulation establishes itself. The design must show that the minimum DNBR or critical power ratio stays above its limit through the dip.

A simple coastdown model writes the flow fraction as \(w(t) = 1/(1 + t/\tau)\), where \(\tau\) is a time constant of a few seconds set by the pump and flywheel inertia and the loop resistance. With \(\tau = 5\) s, flow is halved after 5 s and down to a fifth after 20 s, by which time decay heat is about 4 percent of full power.

Other anticipated transients

The loss-of-coolant accident

A loss-of-coolant accident (LOCA) is a break in the primary pressure boundary. Breaks range from small leaks, which the normal makeup system can cope with, through small breaks a few centimeters across, to the instantaneous double-ended guillotine break of the largest pipe, which has long been used as a bounding case. The phases of a large-break LOCA in a PWR are described below; CANDU and BWR phases differ in detail but follow similar physics.

During blowdown, coolant leaves through the break at the critical flow rate of Lesson 5. The pressure falls in seconds, the coolant flashes, and the core passes DNB almost immediately. Stored energy in the fuel moves into the sheath, causing an early temperature peak. As the vessel empties, cooling relies on steam flow until the emergency core cooling system (ECCS) refills the lower plenum and refloods the core. During reflood, the sheath temperatures reach their main peak and then fall as the quench front, the boundary between wetted and dry sheath, advances upward. The ECCS has passive accumulators, pressurized tanks that inject automatically, and high- and low-pressure injection pumps; later, it recirculates water from the containment sump.

In a CANDU reactor, the Canadian design, a large break voids the channels in the affected loop, and because CANDU fuel has a positive coolant void reactivity, power rises briefly until a shutdown system trips the reactor. If emergency cooling were unavailable, the surrounding moderator can remove decay heat through the channel walls, a distinctive feature of that design.

Acceptance criteria

For light water reactors, 10 CFR 50.46 requires the emergency core cooling system to meet five criteria in a LOCA: peak cladding temperature no higher than 2200 °F (1204 °C); maximum local cladding oxidation no more than 17 percent of the cladding thickness; core-wide hydrogen generation from cladding reaction no more than 1 percent of the amount possible if all cladding reacted; a coolable core geometry; and long-term cooling. Evaluation models must either follow the conservative requirements of Appendix K or use a realistic, best-estimate model with uncertainties quantified so that there is a high probability the criteria are met. The NRC has also worked for many years on a revised rule with performance-based cladding criteria that account for hydrogen pickup in cladding; Hana is told to check its current status before quoting it.

# Transients: pump coastdown, decay heat, and a lumped heatup of uncooled cladding.
import math
# Pump coastdown: flow fraction w(t) = 1/(1 + t/tau)
tau = 5.0
for t in (0, 2, 5, 10, 20):
    print(f"coastdown t = {t:2d} s: flow {100/(1+t/tau):5.1f} %")
# Adiabatic heatup of a fuel rod segment with decay heat only (no cooling), illustrative
q_avg = 17.8e3                  # W/m average linear heat rate at power
peak = 2.3                      # local peaking
mcp = 0.25 + 0.05               # kJ/K per meter: fuel ~0.25, clad ~0.05 (rounded, per m of rod)
T = 600.0                       # C, initial clad/fuel average after blowdown, illustrative
t, dt = 30.0, 1.0
while t < 300:
    P = q_avg * peak * 0.066 * t ** -0.2      # W/m decay heat
    T += P * dt / (mcp * 1000)
    t += dt
    if int(t) % 60 == 0: print(f"t = {int(t):3d} s: uncooled hot-spot temperature ~ {T:6.0f} C")
# Blowdown mass flow through a break: rough choked-flow estimate G ~ C*sqrt(2*rho*dp)
for d_mm in (50, 200, 700):
    A = math.pi * (d_mm / 1000) ** 2 / 4
    G = 0.6 * math.sqrt(2 * 700.0 * 15.0e6) * 0.35     # crude two-phase reduction
    print(f"break {d_mm:3d} mm: initial discharge ~ {G*A:7.0f} kg/s")

coastdown t =  0 s: flow 100.0 %
coastdown t =  2 s: flow  71.4 %
coastdown t =  5 s: flow  50.0 %
coastdown t = 10 s: flow  33.3 %
coastdown t = 20 s: flow  20.0 %
t =  60 s: uncooled hot-spot temperature ~    727 C
t = 120 s: uncooled hot-spot temperature ~    948 C
t = 180 s: uncooled hot-spot temperature ~   1147 C
t = 240 s: uncooled hot-spot temperature ~   1333 C
t = 300 s: uncooled hot-spot temperature ~   1509 C
break  50 mm: initial discharge ~      60 kg/s
break 200 mm: initial discharge ~     956 kg/s
break 700 mm: initial discharge ~   11712 kg/s

Small-break LOCAs

Small breaks are slower and in some ways harder to analyze. The system depressurizes gradually; the reactor trips; the pumps may be tripped by procedure; and the coolant drains by gravity to the lowest points. The behavior depends on where the break is and on the natural circulation and reflux condensation modes of Lesson 10. In PWRs, water can be held up in the pump suction loop seals until they clear, and the core level can dip temporarily. The 1979 Three Mile Island Unit 2 accident began as a small-break LOCA through a stuck-open pressurizer relief valve, compounded by misleading indications that led operators to reduce injection; its lessons transformed operator training, control room design and small-break analysis. NUC-410 covers it in detail.

Reactivity-initiated accidents

A rapid insertion of reactivity, such as the ejection of a control rod in a PWR or a rod drop in a BWR, produces a sharp power pulse lasting tens of milliseconds. The energy deposited in the fuel before Doppler feedback stops the excursion can heat the pellets and load the cladding very quickly. Acceptance criteria are expressed as limits on the fuel enthalpy rise and on cladding failure thresholds, and they have been revised as tests on high-burnup fuel showed lower failure thresholds than earlier data suggested.

Conservatism, best estimate and uncertainty

Early LOCA analyzes stacked conservative assumptions on each other: high decay heat, conservative heat transfer, worst-case break, single failure in the ECCS. Modern best-estimate plus uncertainty (BEPU) methods use realistic models and propagate uncertainties statistically, often showing that a criterion is met at the 95th percentile with 95 percent confidence. Both approaches are accepted when properly justified. They are discussed further in Lesson 12, because the codes are where the methods live.

Emergency core cooling in different designs

Different designs reach the same goal in different ways. Large light water reactors rely on several stages of injection, so that water is always being added at whatever pressure the system has reached. A boiling water reactor that cannot inject at high pressure deliberately depressurizes, through an automatic depressurization system, so that its low-pressure systems can work. CANDU emergency core cooling injects into the headers in stages and then recirculates from the building sump. The BWRX-300 takes a different approach to large breaks: its design places isolation valves directly on the vessel nozzles, so that a pipe break outside them can be isolated and the reactor inventory kept, with isolation condensers removing decay heat. In every case, the analysis must show the acceptance criteria are met assuming the worst single failure in the safety systems.

What the plots in a safety report show

Hana learns to read a LOCA analysis by its plots. Primary pressure falls from operating pressure toward containment pressure within tens of seconds for a large break, or over many minutes for a small one. Break flow starts at the critical flow rate and falls as pressure drops. Core collapsed liquid level shows when the core uncovers and when it recovers. Peak cladding temperature rises during blowdown, may dip, rises again during refill and peaks during reflood before falling as the quench front passes. Containment pressure rises and then falls as heat sinks and cooling systems absorb energy. For each plot, the analyst asks what physics drives the shape and whether the timing makes sense, the same habit Rohan has drilled into her with hand calculations throughout the course.