Safety analysis

Sofia's safety analysis is the longest task on the critical path, and the one the reviewers will read most closely. Lise Fortin, who leads safety analysis at Meridian Nuclear Engineering, agrees to review her plan. “Don't start with the accidents you find interesting,” Lise tells her. “Start with a systematic list of what can go wrong, decide which events bound the others, and then analyze those with conservative assumptions. Then do a simple probabilistic model to check that you haven't missed a combination of failures that matters more than the design basis events.”

This lesson develops the safety analysis of Kestrel-10. It covers defense in depth and plant states, the identification and grouping of initiating events, deterministic analysis of the bounding events with acceptance criteria, the loss-of-heat-sink and loss-of-pool-water cases that test the grace period, an uncontrolled rod withdrawal analyzed with point kinetics, and a simple probabilistic safety assessment with a fault tree and an event tree.

Defense in depth and plant states

Defense in depth is the organizing principle of reactor safety. It provides several independent levels of protection, so that a failure at one level is caught by the next. The first level prevents abnormal operation through conservative design and high-quality construction and operation. The second detects and controls deviations from normal operation, using the control systems and operating procedures. The third controls design basis accidents with safety systems and protection functions. The fourth controls severe conditions beyond the design basis and mitigates their consequences. The fifth mitigates the radiological consequences of any significant release through emergency response. The physical barriers to the release of radioactive material, from the fuel pellet and cladding to the pool water and the building, form a parallel line of defense.

Safety analysis considers the plant in a range of states. Normal operation includes startup, power operation, shutdown and refueling. Anticipated operational occurrences are events expected at least once in the life of the plant, such as loss of offsite power or a trip of the intermediate loop pump. Design basis accidents are less frequent events that the plant must withstand with its safety systems and acceptable consequences. Design extension conditions, or beyond-design-basis accidents, include multiple failures and very rare events, for which the aim is to prevent severe fuel damage or, failing that, to limit its consequences. Each state has acceptance criteria: for anticipated operational occurrences, no fuel damage and doses well within normal limits; for design basis accidents, limited fuel damage at most and doses below regulatory criteria.

US regulations set dose criteria for power reactor accidents in terms of the dose at the exclusion area boundary, and research reactor applications have commonly compared the consequences of their maximum hypothetical accident with the public dose limits of Part 20. Because Kestrel-10 would be a commercial heating facility rather than a research reactor, Sofia adopts conservative criteria of her own: an effective dose at the campus boundary below 0.5 mSv(50 mrem) for any anticipated operational occurrence and below 20 mSv(2 rem) for any design basis accident, together with the team's own requirements: no cladding damage in any anticipated operational occurrence, no boiling in the core in normal operation, and a grace period of at least seven days for decay heat removal.

Identifying initiating events

An initiating event is an event that disturbs the plant and requires a response from the control or safety systems. The list must be systematic, because the most important lesson of reactor safety history is that accidents often begin with events nobody analyzed. Sofia uses three complementary methods. A master logic diagram starts from the undesired outcome, release of radioactive material, and works downward through the ways each barrier could fail. A failure modes and effects analysis goes system by system, asking how each component can fail and what follows. And a review of operating experience from pool-type research reactors adds events that have actually happened, such as fuel handling errors, leaks from pool liners and beam tubes, and loss of pool water through siphoning in connected pipes.

The resulting list has about forty initiating events, which Sofia groups by the safety function they challenge. Events that challenge reactivity control include control rod withdrawal errors, a dropped or misplaced fuel assembly during refueling and the insertion of an experiment with positive reactivity. Events that challenge heat removal include loss of offsite power, failure of the intermediate loop pump, loss of campus heat demand and blockage of a coolant channel. Events that challenge confinement include pool leaks, pipe breaks below the pool surface, a dropped fuel assembly and a fuel cladding defect. External hazards include earthquakes, severe winter storms, flooding, fire, aircraft and an explosion on the gas pipeline serving the campus heating plant. For each group, Sofia identifies the bounding event, the one whose consequences envelope the rest, and analyses it in detail.

Loss of heat sink and the grace period

The bounding heat removal event is a complete loss of heat removal from the pool: the intermediate loop stops, offsite power is lost and the diesel generator is assumed unavailable. The reactor trips, either on the loss of power or on a high pool temperature signal, and the decay heat goes into the pool water. Nothing else happens: there are no pumps to restart, no valves to open and no operator actions to perform. The question is how long the pool can absorb the heat before it boils, and how long after that before the water level falls far enough to matter.

Decay heat after shutdown can be estimated with the Way-Wigner formula, which fits the combined decay power of the fission products as a function of time after shutdown t and operating time before shutdown T, both in seconds:

The formula is accurate to about 20 to 30 percent over most of the range of interest, which is adequate for a concept study when combined with conservative inputs. Sofia assumes three years of continuous operation at full power before the event, which overstates the decay heat because the real reactor runs at about half its rated output on average.

# Loss of heat sink: decay heat (Way-Wigner) and the time for the pool to heat up and boil down.
P0 = 10.0e6                    # W, power before shutdown
T_op = 3 * 365 * 86400         # s of operation before shutdown (three years, conservative for decay heat)
def decay(t):                  # fraction of P0 at t seconds after shutdown
    return 0.0622 * (t ** -0.2 - (t + T_op) ** -0.2)
for label, t in (("10 s", 10), ("1 min", 60), ("1 h", 3600), ("1 day", 86400), ("1 week", 604800), ("30 days", 2.592e6)):
    print(f"decay heat at {label:>7s}: {decay(t) * 100:5.2f} % = {decay(t) * P0 / 1000:7.0f} kW")
# Pool: 6.0 m diameter, 11.0 m of water, 9.0 m of it above the top of the core
area = 3.14159 * 3.0 ** 2
V_pool, V_above = area * 11.0, area * 9.0
rho_w, cp, h_fg = 975.0, 4190.0, 2.257e6
E_heat = V_pool * rho_w * cp * (100.0 - 62.0)      # sensible heat from 62 C average to boiling
E_boil = V_above * 0.5 * rho_w * h_fg              # boil off half the water above the core
t, dt, E, t_boil, t_half = 1.0, 1.0, 0.0, None, None   # integrate decay energy with growing time steps
while t_half is None:
    E += decay(t) * P0 * dt
    if t_boil is None and E >= E_heat: t_boil = t
    if t_boil is not None and E >= E_heat + E_boil: t_half = t
    t += dt; dt = max(1.0, t * 0.001)
print(f"pool water {V_pool:.0f} m^3; sensible heat to boiling {E_heat / 1e9:.1f} GJ; boil-off of half the water above the core {E_boil / 1e9:.0f} GJ")
print(f"no cooling and no makeup: pool reaches 100 C after {t_boil / 3600:.0f} h ({t_boil / 86400:.1f} days)")
print(f"half the water above the core boiled away after {t_half / 86400:.0f} days")
print(f"makeup needed to stop the boil-down at 30 days: {decay(2.592e6) * P0 / h_fg * 3600:.0f} kg/h of water")

decay heat at    10 s:  3.77 % =     377 kW
decay heat at   1 min:  2.58 % =     258 kW
decay heat at     1 h:  1.05 % =     105 kW
decay heat at   1 day:  0.48 % =      48 kW
decay heat at  1 week:  0.28 % =      28 kW
decay heat at 30 days:  0.17 % =      17 kW
pool water 311 m^3; sensible heat to boiling 48.3 GJ; boil-off of half the water above the core 280 GJ
no cooling and no makeup: pool reaches 100 C after 473 h (19.7 days)
half the water above the core boiled away after 459 days
makeup needed to stop the boil-down at 30 days: 27 kg/h of water

The results are striking. With no cooling at all and no credit for heat losses through the pool walls and surface, the pool takes about 20 days to reach 100 °C and well over a year to boil away half the water above the core. Requirement R-08, seven days without power or operator action, is met with a large margin. Even after the pool boils, the fuel remains covered for so long that any makeup source would suffice: about 27 kg of water per hour, the flow of a garden hose, would stop the boil-down after a month. This is the essential safety feature of a low-power pool reactor, and Sofia makes it the centerpiece of the safety case.

Uncontrolled rod withdrawal

The bounding reactivity event is an uncontrolled withdrawal of the strongest control rod from full power, caused by a failure in the rod control system. Reactivity rises steadily at the withdrawal rate; power rises; the fuel and moderator heat and their negative feedback partly offset the inserted reactivity. The protection system trips the reactor when power reaches 115 percent of rated, and after a short delay for the signal and the release of the rods, the rods fall into the core. Sofia models this with point kinetics, using one group of delayed neutrons and a lumped model of fuel and moderator temperatures:

where n is the relative power, C the precursor concentration, ρ the total reactivity including feedback, β the delayed neutron fraction, Λ the neutron generation time and λ the precursor decay constant. The equations are integrated with small time steps, and the trip is modeled as a delay followed by a linear insertion of the rods.

# Uncontrolled rod withdrawal at full power: point kinetics (one delayed group) with temperature feedback and a trip.
beta, lam, Lam = 0.0072, 0.08, 6.0e-5        # delayed fraction, decay constant (1/s), generation time (s)
a_f, a_m = -2.6e-5, -11.0e-5                 # dk/k per K: fuel (Doppler) and moderator
P0 = 10.0e6
C_f, C_m = 1.6e6, 4.5e6                      # J/K: fuel heat capacity and the moderator in the core and chimney
UA_fm = P0 / 38.0                            # W/K: fuel-to-coolant conductance (core-average fuel 38 K above water)
W_cp = 165 * 4190.0                          # W/K: natural circulation flow times heat capacity
def run(rate_pcm_s, trip_at=1.15, trip_delay=0.4, insert_time=1.2, t_end=20.0):
    n, c = 1.0, beta / (lam * Lam)           # relative power and precursors at equilibrium
    Tf, Tm = 0.0, 0.0                        # temperature changes from the initial steady state
    rho_ext, t, dt = 0.0, 0.0, 2e-4
    t_trip, peak = None, (1.0, 0.0, 0.0)
    while t < t_end:
        if t_trip is None:
            rho_ext = rate_pcm_s * 1e-5 * t
            if n >= trip_at: t_trip = t
        elif t > t_trip + trip_delay:        # rods fall: 10,050 pcm inserted linearly over insert_time
            frac = min(1.0, (t - t_trip - trip_delay) / insert_time)
            rho_ext = rate_pcm_s * 1e-5 * t_trip - 0.1005 * frac
        rho = rho_ext + a_f * Tf + a_m * Tm
        dn = ((rho - beta) / Lam * n + lam * c) * dt
        dc = (beta / Lam * n - lam * c) * dt
        q_fm = UA_fm * (Tf - Tm + 38.0) - P0  # extra heat flow fuel -> water compared with steady state
        Tf += (P0 * (n - 1) - q_fm) / C_f * dt
        Tm += (q_fm - W_cp * 2 * Tm) / C_m * dt
        n += dn; c += dc; t += dt
        if n > peak[0]: peak = (n, Tf, t)
    return t_trip, peak
for rate in (5, 20, 60):
    t_trip, (n_pk, dTf, t_pk) = run(rate)
    print(f"withdrawal {rate:3d} pcm/s: trip at {t_trip:5.2f} s, peak power {n_pk * 100:5.1f} % at {t_pk:5.2f} s, fuel +{dTf:4.1f} K at the power peak")
t_trip, (n_pk, dTf, t_pk) = run(20, trip_at=99.0)
print(f"no trip at 20 pcm/s: power reaches {n_pk * 100:.0f} % of nominal within 20 s (feedback slows but does not stop the rise)")

withdrawal   5 pcm/s: trip at 14.49 s, peak power 115.2 % at 14.89 s, fuel + 3.6 K at the power peak
withdrawal  20 pcm/s: trip at  4.28 s, peak power 115.3 % at  4.68 s, fuel + 1.8 K at the power peak
withdrawal  60 pcm/s: trip at  1.52 s, peak power 115.4 % at  1.92 s, fuel + 0.9 K at the power peak
no trip at 20 pcm/s: power reaches 250 % of nominal within 20 s (feedback slows but does not stop the rise)

For withdrawal rates from 5 to 60 pcm per second, the trip occurs between about 1.5 and 15 s after the start, power peaks at about 115 percent and the fuel temperature rises by only a few kelvin. The case with no trip shows why the trip matters: feedback slows the rise but does not stop it, and power reaches about two and a half times rated within 20 s at 20 pcm per second, after which boiling in the core would add void feedback. The rod drive speed limit specified in the neutronics design, and two independent and diverse trip parameters, high power and short reactor period, keep the event within the acceptance criteria. Sofia also checks a withdrawal from low power during startup, where the period trip acts first, and finds similar margins.

Loss of pool water

A leak in the pool liner or a break in a pipe connected below the pool surface could drain water from the pool. The design minimizes the possibility: the pool is a stainless steel liner inside a reinforced concrete structure, with a leak-detection channel between them; all pipes enter the pool from above the surface; and pipes that dip below the surface have anti-siphon holes near the surface, so that a break outside the pool cannot siphon water below that level. A credible leak would therefore be slow, detected by the leak-detection system and the pool level instruments, and made up from the makeup system.

To check that this argument does not depend on a single system, Sofia builds a probabilistic model of the leak sequence. The makeup system has two pumps drawing from a makeup tank, and an alternate path from the campus fire-water system that operators can connect by hand. A fault tree gives the probability that makeup fails on demand, combining the failures of both pumps, including a common-cause failure that disables both at once, with failure of the tank and failure of the alternate path. An event tree then follows the leak through the questions that matter: is the leak isolated, and does makeup work?

# Simple probabilistic safety assessment: fault tree for pool makeup and an event tree for a pool leak.
# Rare-event approximation: OR gate ~ sum, AND gate = product. All data are illustrative.
pump_fail = 3e-3        # per demand, each makeup pump (fails to start or run for 24 h)
ccf_beta = 0.05         # common-cause fraction for the two identical pumps
tank_fail = 1e-4        # makeup water tank unavailable
op_error = 1e-2         # operators fail to align the fire-water connection within 24 h
fw_fail = 2e-3          # fire-water supply fails
# Fault tree: "makeup fails" = (both pumps fail OR tank unavailable) AND (fire-water path fails)
both_pumps = (pump_fail * (1 - ccf_beta)) ** 2 + ccf_beta * pump_fail
normal_path = both_pumps + tank_fail
alt_path = op_error + fw_fail
makeup_fails = normal_path * alt_path
print(f"both pumps fail: {both_pumps:.2e} (common cause {ccf_beta * pump_fail:.1e} dominates)")
print(f"normal makeup path fails: {normal_path:.2e}; alternate fire-water path fails: {alt_path:.2e}")
print(f"makeup fails on demand: {makeup_fails:.2e}")
# Event tree for a pool leak initiating event
f_leak = 1e-3           # per year: leak larger than the purification system can mask
iso = 2e-2              # leak is not isolated (the pool liner leaks into the leak-detection channel, not to soil)
siphon = 1e-4           # anti-siphon devices fail and the pool drains through a broken pipe
sequences = {
    "leak isolated or small: OK": f_leak * (1 - iso),
    "leak not isolated, makeup works: OK": f_leak * iso * (1 - makeup_fails),
    "leak not isolated, makeup fails: core uncovery after many days": f_leak * iso * makeup_fails,
    "pipe break with siphon failure: early uncovery path": f_leak * siphon * makeup_fails,
}
for s, f in sequences.items():
    print(f"  {s:66s}{f:9.1e} /yr")
fdf = sequences["leak not isolated, makeup fails: core uncovery after many days"] + sequences["pipe break with siphon failure: early uncovery path"]
print(f"fuel damage frequency from pool leaks: {fdf:.1e} per reactor-year (target below 1e-5)")
# Importance: what if the common-cause fraction were twice as large?
bp2 = (pump_fail * 0.9) ** 2 + 0.10 * pump_fail
print(f"with a 10 % common-cause fraction: makeup fails {(bp2 + tank_fail) * alt_path:.2e} on demand")

both pumps fail: 1.58e-04 (common cause 1.5e-04 dominates)
normal makeup path fails: 2.58e-04; alternate fire-water path fails: 1.20e-02
makeup fails on demand: 3.10e-06
  leak isolated or small: OK                                          9.8e-04 /yr
  leak not isolated, makeup works: OK                                 2.0e-05 /yr
  leak not isolated, makeup fails: core uncovery after many days      6.2e-11 /yr
  pipe break with siphon failure: early uncovery path                 3.1e-13 /yr
fuel damage frequency from pool leaks: 6.2e-11 per reactor-year (target below 1e-5)
with a 10 % common-cause fraction: makeup fails 4.89e-06 on demand

The fuel damage frequency from pool leaks comes out at about 6 × 10⁻¹¹ per year, far below the 10⁻⁵ target of R-10. Sofia is careful about what this number means. It shows that the design has no obvious weak combination of failures, and that common-cause failure of the pumps dominates the makeup failure probability, which tells the designers where diversity would help most. It does not show that core damage is a one-in-ten-billion-year event. Numbers this small are dominated by things the simple model leaves out: an earthquake that cracks both the liner and the concrete, an error during maintenance that drains the pool, or a failure to notice the leak at all. Rohan reminds the team that probabilistic safety assessment is most valuable for comparing options and finding dominant contributors, and least reliable for absolute numbers at the very low end.

Fuel handling and external hazards

The bounding confinement event is a fuel assembly dropped during refueling, which damages the cladding of every rod in the assembly. Because the fuel runs at such low temperature, the inventory of volatile fission products in the gap between pellet and cladding is small, and the release would pass through at least 9 m of water, which retains nearly all the iodine and cesium. The noble gases would escape to the reactor hall and be exhausted through the filtered ventilation. Sofia's conservative estimate of the dose at the campus boundary is well below the 20 mSv design basis criterion, but she notes that the calculation depends on assumptions about gap inventory and water retention that will need to be justified in more detail.

External hazards are assessed by asking whether each could disable a safety function. The pool and core support structure are designed for a design basis earthquake, with the control rods able to insert under seismic loads, a requirement that becomes design review action DR-03 because the chimney and core support have not yet been analyzed. Flooding is excluded by the site elevation. An explosion on the gas pipeline is addressed by the separation distance between the pipeline and the reactor building and by the below-grade construction. Severe winter storms are the event most likely to cut offsite power for days, which is exactly the case the grace period covers.