Severe accidents

Dr. Malik Osei from the materials group joins Hana for the severe accident chapter, because so much of it is about what happens to zirconium, steel, concrete and fuel at temperatures far beyond anything in normal operation. "Design basis analysis stops at the acceptance criteria," he says. "Severe accident analysis starts where they are exceeded. The question is no longer whether the core is damaged but how far the damage goes, what it does to containment, and what the operators can still do about it." They begin with the severe accident management guidelines that every US plant now maintains.

What makes an accident severe

A severe accident is one in which the reactor core is significantly damaged, usually through prolonged loss of cooling. It is beyond the design basis by definition: the safety systems that should have prevented it have failed or been overwhelmed. Severe accidents are rare, and the probabilistic assessments of modern plants estimate their frequencies at well below one in ten thousand reactor-years. Their consequences, however, can be large, and the two severe accidents with major releases, at Chernobyl and Fukushima Daiichi, shaped public opinion and policy for decades. Understanding how severe accidents progress is essential both for preventing them and for limiting their consequences if prevention fails.

Progression in a water-cooled reactor

A severe accident in a light water reactor typically begins with a loss of the ability to remove heat. Decay heat boils off the water covering the core, and the upper part of the fuel uncovers. In steam, the cladding heats up. Above about 1 200 °C the reaction between zirconium and steam accelerates sharply. It is strongly exothermic and produces hydrogen, so the oxidation itself adds heat and the cladding temperature climbs rapidly. Cladding balloons and bursts, releasing the gaseous and volatile fission products held in the gap. Control rod materials and structural steel melt at lower temperatures than the fuel and begin to relocate.

As heating continues, the fuel and the oxidized cladding form a mixture that melts at around 2 000 to 2 500 °C, below the melting point of pure uranium dioxide because of interactions between the materials. Molten material flows down through the core and can freeze in cooler regions, forming crusts and blockages. Eventually a large mass of molten core material, called corium, relocates into the lower plenum of the reactor vessel. If the water there cannot cool it and the outside of the vessel is not cooled, the lower head heats up and fails, and corium enters the containment.

Once outside the vessel, corium threatens containment in several ways. If it falls into a dry cavity, it reacts with the concrete floor, producing gases and eroding the basemat. If the vessel fails at high pressure, corium can be dispersed into the containment atmosphere and heat it directly. Steam from quenching corium in water raises pressure. Hydrogen from zirconium oxidation, and later from core-concrete interaction, can reach flammable concentrations and burn or detonate. Without heat removal, containment pressure rises slowly over hours or days until it reaches the failure pressure.

The BWRX-300 and other passive designs aim to slow or prevent this progression by providing large passive heat sinks. In the BWRX-300, isolation condensers can remove decay heat for days without power or operator action. In large dry PWR containments, the containment volume itself provides time before pressure becomes a threat, and in ice condenser containments, such as those at TVA's Sequoyah and Watts Bar plants, hydrogen igniters were installed after Three Mile Island to burn hydrogen in small, controlled amounts.

Hydrogen

Hydrogen is one of the most important severe accident threats. Each kilogram of zirconium that reacts with steam produces about 44 grams of hydrogen, and a large reactor core contains tens of metric tons of zirconium. Hydrogen is flammable in air from about 4 percent by volume, can burn as a flame at higher concentrations and can detonate at higher concentrations still, especially in confined spaces. In a containment that is filled with steam, combustion is suppressed until the steam condenses, which can create a hazard later in the accident.

# Hydrogen from zirconium-steam reaction and its concentration in containment.
# Zr + 2 H2O -> ZrO2 + 2 H2 ; 1 kg Zr gives about 0.0442 kg H2
zr_core = 25000.0          # kg of zirconium in the core (illustrative large PWR)
frac = [0.1, 0.25, 0.5, 0.75]
V = 70000.0                # m3 free volume of a large dry containment
n_air = 101325 * V / (8.314 * 330)   # mol of gas at 1 atm, 330 K
for x in frac:
    m_h2 = zr_core * x * 2 * 2.016 / 91.22
    n_h2 = m_h2 * 1000 / 2.016
    c = n_h2 / (n_h2 + n_air) * 100
    note = "below 4 % lower flammability limit" if c < 4 else "flammable range; recombiners or igniters needed"
    print(f"{x*100:3.0f} % of cladding oxidized: {m_h2:6.0f} kg H2, about {c:4.1f} % by volume, {note}")

 10 % of cladding oxidized:    111 kg H2, about  2.1 % by volume, below 4 % lower flammability limit
 25 % of cladding oxidized:    276 kg H2, about  5.0 % by volume, flammable range; recombiners or igniters needed
 50 % of cladding oxidized:    553 kg H2, about  9.6 % by volume, flammable range; recombiners or igniters needed
 75 % of cladding oxidized:    829 kg H2, about 13.7 % by volume, flammable range; recombiners or igniters needed

The program shows that oxidizing a quarter of the cladding in a large PWR produces roughly 280 kilograms of hydrogen, giving an average concentration of about 5 percent in a large dry containment, above the lower flammability limit. In a smaller containment or a compartment the local concentration would be much higher. Containments are therefore protected by passive autocatalytic recombiners, which combine hydrogen with oxygen on catalyst plates without power, by igniters that burn hydrogen in small amounts before it accumulates, or, in boiling water reactors with small containments, by filling the containment with nitrogen during operation so that there is too little oxygen to burn.

Fission product release and source term

The radiological consequences of a severe accident depend on the source term: the amount, timing and chemical form of the radioactive material released to the environment. Noble gases such as xenon and krypton escape almost completely once fuel is damaged, but they are chemically inert and deliver dose mainly as external exposure while the plume passes. The volatile elements iodine and cesium are the most important for health and land contamination. Iodine-131, with a half-life of eight days, concentrates in the thyroid. Cesium-137, with a half-life of thirty years, contaminates land for decades. Less volatile elements, such as strontium and the actinides, are released in much smaller fractions.

Much of the material released from the fuel does not reach the environment. It deposits on surfaces in the reactor coolant system, is washed out by containment sprays, dissolves in water pools or settles as aerosol in the containment. The water in a suppression pool or a scrubbing filter removes most aerosols. Containment integrity is therefore the decisive factor: as long as containment holds, even severe core damage leads to a small release. The Three Mile Island accident damaged half the core, yet the release of iodine and cesium was very small because containment held. Fukushima Daiichi released much more because containment was damaged or vented without full filtration.

Severe accident management

Severe accident management is the set of actions taken during an accident that has gone beyond the design basis, to prevent or limit core damage, maintain containment integrity and minimize releases. Its first priority is to restore cooling to the core by any available means, including non-safety systems and portable equipment. If core damage cannot be prevented, the priorities shift to keeping the vessel intact, for example by flooding the outside of the lower head, to protecting containment against overpressure and hydrogen, and to reducing releases, for example by scrubbing vented gases through water or filters.

US licensees have implemented severe accident management guidelines developed by the owners' groups, and after Fukushima the NRC's Mitigation Strategies Order, later made a rule in 10 CFR 50.155, required FLEX strategies with portable equipment and connection points, stored in protected locations, together with offsite response centers. Boiling water reactors with Mark I and Mark II containments were also required to install reliable hardened containment vents capable of operating under severe accident conditions.

Research and analysis tools

Knowledge of severe accidents comes from decades of experimental programs, the analysis of the Three Mile Island and Fukushima accidents, and integral codes such as MELCOR, MAAP and ASTEC that model the whole accident from core uncovery to release. International experiments such as PHEBUS-FP, which melted fuel in a research reactor to study fission product transport, and the OECD programs on molten core-concrete interaction and in-vessel retention provided much of the data. The NRC's State-of-the-Art Reactor Consequence Analyses, SOARCA, published in 2012, used modern codes to estimate that well-mitigated or even unmitigated severe accidents at the plants studied would release less and more slowly than earlier studies had assumed, giving essentially zero early fatalities and individual latent cancer risks far below the safety goal.

Containment failure modes

Analysts classify containment failure by its timing and mode, because both affect the release. Early failure, at or soon after vessel failure, is the most serious because the fission products have had little time to deposit and the public has had little time to evacuate. It can result from a hydrogen detonation, from direct heating of the containment atmosphere by dispersed corium, or from a steam explosion strong enough to damage the structure. Late failure, after many hours or days, results from slow overpressure by steam and non-condensable gases or from basemat melt-through by core-concrete interaction, and generally leads to much smaller releases. A containment can also be bypassed, for example through a ruptured steam generator tube or an interfacing system break, so that fission products escape without the containment being challenged at all.

Severe accident analysis, the second level of a probabilistic assessment, estimates the probability of each failure mode for each plant damage state. The results show which phenomena dominate the risk of large releases and guide accident management. If late overpressure dominates, filtered venting is an effective measure; if hydrogen dominates, recombiners or igniters are needed; if bypass dominates, measures to isolate the bypass path or to scrub the release are most important.

Accident management guidelines in use

Severe accident management guidelines are written differently from emergency operating procedures. Emergency procedures give specific steps for the crew to follow from symptoms. Severe accident guidelines are used by a technical support team, usually at an emergency center on or near the site, who evaluate the plant state and choose among strategies, weighing their benefits against possible negative effects. Injecting water into a damaged core, for example, cools it and can stop the progression, but it also produces steam and can briefly increase hydrogen production. Venting containment protects it from overpressure but releases some radioactive material. The guidelines provide the information to make these trade-offs, and regular exercises keep the teams practiced.

Instrumentation is a recurring concern. In a severe accident, many normal instruments may fail or give misleading readings because of high temperatures, radiation or loss of power. Post-Fukushima improvements include robust instruments for key parameters, such as containment pressure, hydrogen concentration and water level, with independent power supplies.