by Michael G. Stevenson and James F. Jackson

Photo by Dirck Halstead, Gamma-Liaison Photo Agency

by Michael G. Stevenson and James F. Jackson

H ow do we know that the emer-gency cooling system in a nu-clear reactor will work in case

of an accident? Although an automobilecan be crash-tested to evaluate its safetyperformance, it is not practical to subjecta fullscale nuclear power plant to severeaccident conditions. Moreover, there areso many accident paths to be consideredthat the costs of full-scale experimentsfor all of them would be prohibitive.Therefore, the nuclear power industryrelies more heavily on theoreticalanalysis of design and safety featuresthan does any other high-technologyindustry.

Before the Three Mile Island accident,much of the safety analysis of com-mercial reactors focused on ahypothetical accident involving the rup-ture of a large pipe supplying coolingwater to the reactor core. This de-sign-basis loss-of-coolant accident was

LOS ALAMOS SCIENCE

thought to be worse than any event thatwould ever happen. Water and steamwould be expelled rapidly out the break(Fig. 1) and the core would be lefttemporarily uncovered and poorlycooled. Reactor designers and theircritics disagreed as to whether or not theemergency core-cooling system would beable to inject water into the reactor corein time to prevent melting of the core andpossible release of large quantities ofradioactive material to the environment,To help settle this controversy, the Nu-clear Regulatory Commission asked LosAlamos to develop a computer code thatcould realistically simulate the responseof a reactor to this very unlikely event.The code, called TRAC, predicted thatthe emergency cooling system wouldreflood the core within two or threeminutes after the break and that the coretemperature would remain far below themelting point of the fuel. The codeconfirmed results of the less accurate,more conservative analysis methods thatare the basis for reactor licensing. Thus,at the time of the Three Mile Islandaccident, most of the nuclear communitybelieved that the probability of an acci-dent involving core meltdown and majorradiation release was so low that theyshould never have to deal with one. *

The events in Harrisburg, Pennsylva-nia have changed this perspective. Cer-tainly, the careful design of reactor hard-ware was successful in preventing anastounding series of equipment malfunc-tions and misinterpretations by the reac-tor operators from developing into aserious threat to public safety. But on the

*Despite their low probability, potential radiationreleases from accidents involving core damage areformally considered in evaluating proposed sitesfor nuclear power plants.

6

Fig. 1. Originally designed as a small nuclear power plant, the Marviken facility inSweden has been converted to an experimental facility for studying the ejection ofwater from a ruptured pipe in a water-cooled reactor. Water in the reactor vessel isheated (with fossil fuel---the facility has no nuclear core) to a temperature andpressure typical of an operating reactor. The pipe break is simulated by opening alarge valve at the bottom of the vessel and allowing the steam and water to be ejectedinto the building. Shown here is the front face of the building during a test. The hugejet of steam is being vented through a large pipe (several feet in diameter) installed inthe side of the building. The scene inside the building must be awesome indeed. Datafrom these tests are being used in the development of accident-analysis codes at LosAlamos and elsewhere. (Photo courtesy of Studsvik Energiteknik AB.)

LOS ALAMOS SCIENCE

A PRIMER ON REACTOR SAFETY ANALYSIS

Fig. 2. An artist’s sketch of the first nuclear reactor constructed in 1942 in a squashcourt under the west stands of Stagg Field, University of Chicago. It was made fromabout 40 tons of natural uranium and 385 tons of graphite. Note the manuallyoperated control rod extending from the side of the “pile” and the large neutrondetectors located at the upper part of the front face. The safety systems for this firstatomic pile were especially simple. In addition to two sets of control rods, there was arod called Zip that operated by gravity through weights and a pulley. In anemergency, or if the person holding the rope collapsed and let go, the rod would bedrawn rapidly back into the pile. The back-up system was a “liquid-control squad” ofthree people standing on a platformneutron-absorbing salt solution.

morning of March 28, 1979, severalhours after the Three Mile Island acci-dent began, the reactor core was lessthan an hour away from meltdown.Melting of the fuel would not necessarilyhave resulted in a major radiation ex-posure of the public. However, the con-sequences of a possible meltdown arenow being considered much more seri-ously in the licensing process.

The inquiries following Three MileIsland identified management problemsrather than hardware problems as themain reason that a minor mechanicalfailure developed into a rather seriousaccident. The critical areas of operator

LOS ALAMOS SCIENCE

over the pile ready to flood it with a

training and human factors engineeringhad been underemphasized by the nucle-ar industry. The Nuclear RegulatoryCommission had focused most of itsattention on the licensing process, inwhich detailed safety analysis reportssubmitted by license applicants are re-viewed with the help of technical expertsand sophisticated computational tools.But the Commission was found not sowell equipped to correct operating defi-ciencies in the 70 commercial light-waterreactors now producing power in thiscountry.

The philosophy guiding the Com-mission’s work has begun to change and

with it the work done for the Com-mission by the national laboratories.Accident analysis is still one of the majortasks, but its focus has shifted to acci-dents resulting from multiple malfunc-tions of plant components. The intentnow is to simulate not only the auto-matic response of the system but also theconsequences of human intervention.Out of such analyses, the Commissionexpects to get ideas for better feedbackcontrols, to identify and catalog accidentsignatures so that operators can bettertell what is going wrong, and to developoperator responses that will mitigate theconsequences of system failures.

The Commission is also funding de-velopment of new computer codes tosimulate accidents involving core meltingand to trace the subsequent path ofradioactive materials. And the labora-tories are analyzing the capabilities ofthe containment systems that must pre-vent release of radiation should thereever be another serious accident. Theseactivities will help implement the lessonslearned at Three Mile Island.

Reactor Basics

Although a modern nuclear powerplant is a very complex system designedto exacting specifications, a nuclear re-actor, by itself, is a relatively simpledevice. In 1942 Enrico Fermi and hiscolleagues built a crude reactor on thefirst try (Fig. 2). By placing pieces ofnatural uranium in a stack of graphiteblocks, they achieved a self-sustainedand controlled nuclear fission chain re-action, and thereby demonstrated thepotential for generating a large amountof usable energy.

The energy-producing process is nu-clear fission, in which a nucleus absorbs

7

a neutron and breaks apart into severalfragments (Fig. 3). This process releasesmillions of times the amount of energyreleased in a typical chemical reactionand occurs readily in what are referredto as fissile isotopes. (Uranium-235 is theonly naturally occurring fissile isotope;other examples are p1utonium-239 anduranium-233.)

Practical application of fission as anenergy source rests on another re-markable fact. Among the products offission are additional neutrons that canthemselves initiate fission of other nucleiand so begin a chain reaction. Sustainingthis chain reaction has one basic require-ment: a sufficiently large mass of fuel,what we call a critical mass. With lessthan this critical mass, too many neu-trons escape from the fuel and the chainreaction stops.

Because thermal, or slowly moving,neutrons have a much higher probabilityof inducing fission in uranium-235 thando fast neutrons, most uranium-fueledreactors, including the first one, aredesigned to run on thermal neutrons. Toslow the fast neutrons produced by thefission process to thermal energies, thefuel is surrounded by a “moderator”containing relatively light nuclei. Theneutrons lose energy by collisions withthese light nuclei. (In Fermi’s reactor thegraphite served as a neutron moderator.)

A single fission reaction typically pro-duces two, or sometimes three, neutrons,but not all these are available to inducenew fissions. Some are absorbed withoutinducing fission and some leak out of thecore. To produce a stable power level ina reactor, the neutron population mustbe controlled so that on the average eachfission causes only one additional fission.Gross control is achieved by moving

8

NEUTRONABSORPTION

Fig. 3. The fission process. A heavy nucleus, such as uranium-235 or plutonium-239absorbs a neutron (n) and breaks up into two lighter nuclei, two or sometimes threeneutrons, and gamma rays. The lighter nuclei are usually radioactive.

control rods in and out of the core. *These control rods contain materials,such as boron or cadmium, that readilyabsorb neutrons (without undergoing fis-sion) and thereby remove some of theneutrons from further participation in anongoing chain reaction. Fail-safe sys-tems are provided to insert control rodsrapidly into the core and halt the chainreaction altogether under emergencyconditions. This process is referred to asa reactor scram.

Further control of a reactor arisesfrom negative temperature-feedback ef-fects that provide inherent stability. Asthe number of fissions increases, theresulting increased core temperature pro-duces changes in material properties thattend to shut down the chain reaction.

T h i s s e l f - r e g u l a t i o n m a k e s awell-designed reactor quite easy to con-trol.

Most of the energy released by fissionappears as kinetic energy of the lighternuclei that are formed when the heavynuclei split. These fission products col-lide with neighboring fuel nuclei and areslowed down within a very short dis-tance. Their kinetic energy is convertedto heat that transfers from the fuel to aliquid or gas coolant pumped throughthe reactor core. To prevent the corefrom overheating, the rate of heat trans-fer to the coolant must equal the rate ofenergy production in the core. The heatin the coolant can then be used toproduce steam for electric power gener-ation.

*Mechanical control of the neutron population is possible because of the delayed neutrons. For adiscussion of neutronics, see “Breeder Reactor Safety-—Modeling the Impossible” in this issue.

LOS ALAMOS SCIENCE


Commercial Light-Water Reactors

FUEL ROD ASSEMBLY

FUEL ROD

Cluster

Top Nozzle

Control Rod

F u e l R o d -

Spring Clip .Assembly

BottomN o z z l e —

The goal of commercial reactor designis to build a plant that usually generates1000 megawatts, or more, of electricpower during normal operation and doesnot allow damage to the reactor coreduring all foreseeable circumstances. Atypical reactor core is relatively smalland could fit easily on a single railroadcar. However, it contains enough fuel toproduce 1000 megawatts electric forthree years—the energy equivalent of100,000 carloads of coal. To extract thisamount of usable energy from a relative-ly small volume, a tremendous quantityof high-temperature water must bepumped through the core at a very highflow rate. In a typical pressurized-waterreactor, 7500-horsepower pumps in eachof two or four primary coolant loopsmove the water from the core to21-meter-high (70-foot) steam gener-ators.

Except for one gas-cooled reactor, allcommercial nuclear power plants in theUnited States are light-water reactors;that is, they use ordinary “light” water tocool the core rather than the “heavy”water (D20) used in some designs. Thewater also serves as a neutron mod-erator. Commercial light-water reactorsare fueled with enriched uranium thatcontains 3% by weight of the fissileisotope uranium-235 as opposed to the0.71% found in natural ores. The fuel isin the form of small ceramic pellets of

Fig. 4. Fuel rod and fuel-rod assembly for a pressurized-water reactor. Fuel rods are uranium dioxide. To make a fuel rod, theheld in a square array by spring clip assemblies and by grid assemblies at the top and fuel pellets are sealed in tubes about 4bottom. The structure is open permitting flow of coolant both horizontally and meters (12 feet) long and not much widervertically. Control-rod guide tubes are interspersed among the fuel rods. Control-rod than the diameter of a pencil. Thisassemblies are lowered into the guide tubes to absorb neutrons and control the chain protective cladding is fabricated from areaction. A typical core contains about 200 fuel-rod assemblies each containing about special zirconium alloy (Zircaloy).200 fuel rods. About 40,000 fuel rods, held rigidly in

1.0 c m

, ZircaloyCladding

Gas-Filled Gap

U 02 Fuel Pel lets

LOS ALAMOS SCIENCE 9

place with special structures, make upthe core of a light-water reactor. Ex-amples of a fuel rod and a fuel-rodassembly are shown in Fig. 4.

Figure 5 shows a typical pressur-ized-water reactor, the most commontype of light-water reactor. They aremanufactured in the United States byWestinghouse Electric Corporation,Combustion Engineering, Inc., and Bab-cock & Wilcox. The diagram shows boththe primary coolant loop, which trans-fers heat from the core to the steam

generators, and the secondary coolantloop, which transports steam from thesteam generators to drive the tur-bine-generators that produce electricity.

To preclude boiling and thereby main-tain a high rate of heat transfer from thefuel rods to the coolant, the primarycoolant water is pressurized to about150 bars.* [The reactor vessel is fabri-cated from 25-centimeter-thick (lO-inch)steel to withstand this high internal

pressure.] The coolant is pumped downthrough an annular region surroundingthe core (the downcomer) and upthrough the core where it is heated toabout 590 kelvin (about 600° Fahren-

heit). The heated water exits from thereactor vessel and flows through largesteam generators where heat is trans-ferred to water in the secondary loop.This water is at a lower pressure andrapidly boils. The steam then drives aturbine just as it does in any conven-tional power plant.

TurbineGenerator

Fig. 5. A pressurized-water reactor showing a primary loop, a 7500-horsepower centrifugal pumps through a 12-meter-highsecondary loop, and the three subsystems (labeled 1, 2, and 3) (40-foot) reactor vessel to 21-meter-high (70-foot) steamof the emergency core-cooling system. In the primary system, generators.water under high pressure (about 150 bars) is pumped by

10 LOS ALAMOS SCIENCE


Fig. 6. Control room of a commercial nuclear power plant. A myriad of lights, dials,and switches monitors and controls all the complex systems within the plant. (Photocourtesy of Florida Power & Light Company.)

Figure 5 also shows a typical emer-gency core-cooling system, which re-places water in the event of a leak in aprimary coolant loop. Three separatesubsystems are available depending onthe pressure loss resulting from the leak.If the system pressure drops from thenormal 150 bars to about 130 bars, a setof high-pressure pumps automaticallyinject water. (These pumps activatedautomatically during the early stages ofthe Three Mile Island accident but theoperators turned them off because theymisinterpreted what was occurring.) Afurther drop in pressure to about 40 bars

(14 bars for Combustion Engineeringplants) will cause the accumulator checkvalves to open automatically, allowingwater from these large pressurized tanksto flow into the reactor vessel. Finally, ata p r e s s u r e of about 14 bars,high-capacity, low-pressure pumps areactivated that can supply large volumesof water. These pumps can ultimatelyobtain their water supply from a sump inthe bottom of the reactor containmentbuilding where water would collect fromany massive leaks.

During normal operation, the systempressure is regulated by the pressurizer,

*Report of the President’s Commission on the Accident at Three Mile Island. The Need for Change: TheLegacy of TMI (U. S. Government Printing Office, Washington, D. C., 1979), p. 11.

LOS ALAMOS SCIENCE

a large tank partly filled with water andconnected to the primary system. Tocontrol the system pressure, steam in theupper part of this tank is heated withelectr ic coils or condensed withcold-water sprays. The pilot-operated re-lief valve at the top of the pressurizerwas the valve that stuck open and al-lowed a large amount of coolant toescape during the Three Mile Islandaccident.

The cooling, control, and in-depthsafety systems, together with the bal-ance-of-plant components, make a mod-ern nuclear power plant a large andawesome construction. A plant has hun-dreds of valves, pumps, piping circuits,and instruments. The large controlrooms are equipped with hundreds ofinstrument readout devices and systemcontrol switches (Fig. 6). It is believedthat this complexity was a contributingfactor to the difficulty the reactor opera-tors had in quickly diagnosing the acci-dent at Three Mile Island.*

The other type of commerciallight-water reactor, the boiling-water re-actor, is manufactured by General Elec-tric Co. Rather than primary and secon-dary cooling loops, this reactor has oneloop connecting the core to the tur-bine-generator. The cooling water ismaintained at a low enough pressure(about 70 bars) to allow boiling in thereactor core. The steam is then pipeddirectly to the turbine. Boiling-waterreactors are also equipped with emer-gency core-cooling systems.

There are fewer boiling-water reactorsthan pressurized-water reactors in com-mercial operation. Because Los Alamoshas not done extensive safety analysis ofboiling-water reactors, they will not bediscussed further.

11

Two Trouble Spots—Fission Products and Decay Heat

Two of the most troublesome aspectsof a reactor arise from the fact that thefission products are radioactive. First, ofcourse, these radioactive materials mustbe isolated from the biosphere. Second,decay of the radioactive fission productsis a heat source that cannot be turnedoff, even after the fission process hasbeen shut down (Fig. 7). In a reactor thathas been operating for some time, thepower due to decay heat is a significantfraction (about 7%) of the total power.After shutdown, decay power decreasesto about 1% in a few hours, but this 1%amounts to about 30 megawatts thermalin a large commercial reactor. Thus, toprevent damage to the core and possiblerelease of radioactive materials, everypower reactor must have provision forremoval of decay heat under all fore-seeable conditions.

During normal operation many fis-sions occur every second (about 1020 ina 1000-megawatt-electric reactor), and aspectrum of fission products results,Most fission products are neutron richand unstable, and tend to decay byemission of beta particles and gammarays.

The fission products are often charac-terized as gases, volatiles, or solids de-pending on their boiling temperatures.The gaseous products are mostly theinert gases xenon and krypton. Severalisotopes of iodine are also produced andare an important potential radiologicalhazard. Some fission products, particu-larly noble metals with high boilingpoints, remain solid in the fuel pellets atnormal operating temperatures and evenat abnormally high temperatures duringaccident conditions.

12

Fig. 7. A log-log plot of decay power as a function of time after reactor scram for theThree Mile Island Unit 2 reactor. This curve was calculated by the LaboratoryNuclear Data Group. It depends on the reactor’s power history and fuel andfission-product inventories and on details of the decay chains that fission products andtransuranics follow as they spontaneously decay to more stable nuclear states.

Also contributing to the decay powerand the potential danger posed by areactor are “transuranics,” elementsbeyond uranium in the periodic table.These are the result of neutron-inducedreactions other than fission in fuel nuclei.The transuranics generally decay byemission of alpha particles and accom-panying gamma rays.

Multiple Barriers —Design for Safety

As long as the fission products andtransuranics remain confined, the impactof a reactor on operating personnel, thepublic, and the environment is verysmall. Four distinct barriers (Fig. 8) aredesigned to confine the radioactive mate-rials: the ceramic (uranium dioxide) fuelpellets, the fuel-rod cladding, the primary

Fig. 8. The four barriers against releaseof radioactive materials in a pressur-ized-water reactor.

LOS ALAMOS SCIENCE


Fig. 9. Cross section of a typical containment building for a pressurized-waterreactor. The concrete containment building houses the entire primary system, thepressure control system, ventilation equipment, and part of the emergency core-coolingsystem. The various components are encased in concrete and surrounded by a0.63-centimeter-thick (0.25-inch) steel liner.

system boundary, and, finally, the con-tainment building.

The uranium dioxide fuel pellets pro-vide the first barrier against radiationrelease, Their exceptionally high meltingpoint (3040 kelvin, or about 5010°Fahrenheit) and chemical stability pre-vent escape of nearly all fission products

LOS ALAMOS SCIENCE

except in extreme accident conditions.In normal operation, a small amount

(about 1%) of the gaseous fission prod-ucts do leak from the pellets but, undermost conditions, are confined by thesecond barrier, the Zircaloy claddingsurrounding the fuel pellets. If the coretemperature rises during an accident, the

cladding will generally fail before the fuelpellets melt, and this small fraction ofgaseous products will escape to the pri-mary coolant. During the Three MileIsland accident, the radiation problemswere almost entirely due to gaseousfission products. (Evidently, there waslittle or no fuel-pellet melting.) It hasbeen assumed that radioactive iodinewould be one of the gaseous fissionproducts released if the cladding were tofail. However, this assumption has beenchallenged by information from theThree Mile Island accident.*

The primary system boundary (seeFig. 5) is the third barrier preventingrelease of fission products. The reliabilityof this boundary is assured by the in-herent strength of the thick vessel andpiping and also by continual inspectionof these components throughout the lifeof the plant. Nevertheless, spontaneoussmall and large breaks in this boundaryare considered as possibilities for initiat-ing loss-of-coolant accidents.

The reactor containment building isthe fourth and final barrier to fissionproduct release (Fig. 9). For light-waterreactors, the containment generally con-sists of a steel liner surrounded by a1.2-meter-thick (4-foot) structural con-crete shell. This combination preventsleaks and can withstand a substantialinternal overpressure, as well as externalimpacts caused by tornadoes, externalexplosions, or aircraft crashes. The con-tainment are designed, conservatively,to stay intact during a worst-caseloss-of-coolant accident, which wouldproduce a building pressure of about 4bars. This safety feature was important

*See “Good News about Iodine Releases” in thisissue.

13

in reducing consequences of the ThreeMile Island accident, during which thecontainment withstood a pressure spikeof about 2 bars. The pressure spike wasevidently caused by rapid burning ofhydrogen produced by oxidation of hotzirconium cladding.

But what is the maximum pressurethat these strong containment can re-sist? To answer this question, LosAlamos and Sandia National Labora-tories are carrying out a “StructuralMargins to Failure” research programfor the Nuclear Regulatory Commission.A later article summarizes some of thework in this area. *

Even with the containment intact, ra-diation can possibly be released throughan indirect path. For example, at ThreeMile Island, primary coolant water lostthrough the open pilot-operated reliefvalve eventually escaped to the contain-ment and was pumped to storage tanksin an auxiliary building nearby. These‘tanks overflowed and led to small re-leases of gaseous fission products to theenvironment through the exhaust stack.To prevent such occurrences, all possiblerelease paths and transport mechanisms,such as flowing water, must be con-sidered.

Safety Analysis

The safety analyst’s job is to de-termine, for any postulated accident,whether the maze of barriers stays intactand whether radioactive materials staycontained. But the maze is complex andchanging during an accident. The loca-tions and sizes of the barrier failures, therelease paths, and the transport mecha-nisms all depend on temperature andpressure. The analyst must start from

14

Velocities Enteringand Leaving Cell

Fig. 10. Division of a coolant pipe into computational cells. Densities, pressures, andtemperatures at the center of each cell are computed, as well as the velocities of thesteam-water mixtures entering and leaving each cell.

the beginning and predict the thermaland physical conditions throughout theentire accident.

The analysis usually requires a sophis-ticated computer model to simulate theenergy and material flows throughoutthe system, Such models break down thesystem into many cells-small boxes ofspace—and audit the mass, temperature,and velocity of the materials in each cell.Figure 10 shows a typical cell structurefor one component of a light-water reac-tor, a pipe.

The analysis begins with the reactorrunning smoothly at full power. Thensomething is assumed to go wrong—apump fails or a pipe breaks—and thecomputer calculat ion fol lows thechanges in water and steam flow ratesand in system temperatures and pres-sures. Reactor scram and injection ofemergency cooling water are also sim-ulated as they would occur in the acci-dent.

The computer model includes all or alarge part of the complicated system ofplant components. The analysis tracks intime the system’s thermal hydraulics,including compressible two-phasesteam-water flow-an engineering andcomputational problem of considerabledifficulty.**

Energy Balance in the Reactor Core

The equations used in these computercodes assume conservation of mass,energy, and momentum for all the mate-rials in each of the hundreds of cells in atypical calculation. Here we will discussenergy conservation to illustrate the fac-tors influencing the core temperature.We start with an extremely simple modelconsisting of but one cell, the core as awhole.

*See "The Structural Integrity of Reactors” inthis issue.**See “Two-phase Flow” in this issue.

LOS ALAMOS SCIENCE


Fig. 11. In a two-cell representation of the core, coolant flowing past the nuclear fuelis heated at the rate hA(Tfuel -T coolant), where h is the heat-transfer coefficient and A isthe surface area of the fuel.

Energy released by nuclear processes(fission of the fuel and radioactive decayof the fission products) is produced inthe core at a rate Q nuclear. Conservationof energy says that this energy either isstored in the core at a rate Q core or heatsthe coolant circulating through the core.The energy-conservation equation forour one cell model is thus

where W is the mass flow rate of thecoolant, cP is the specific heat of thecoolant, and Tin is the temperature of theincoming coolant. The core temperature,Tc o r e, is assumed to be the averagecoolant temperature, that is, ½ ( Tin +T out, where T out is the temperature ofthe outgoing coolant. (A more completeanalysis would include the mass- andmomentum-conservation equationsneeded to determine the coolant flowrate W. A more detailed model that“closed the loop” through the steamgenerator would provide a value forTin.)

What can be learned from this simpleenergy-conservation equation? First, tomaintain the core at a constant tem-perature, Q core, which is proportional todTcore/dt, must equal zero. Therefore, thenuclear heat production rate must beexactly balanced by the rate at whichheat is removed by the flowing coolant.

That is, Q nuclear = 2Wc p (T core – T in ).Increases in Q nuclear associated withsome normal operating procedures arecountered by increasing the flow rate W(a usual maneuver) or by decreasing theinlet temperature T in. The latter can beaccomplished by removing more heatfrom the coolant in the steam generators.

An increase in Q core can result from a


decrease in the heat-removal rate. As abounding example, suppose that all cool-ing of the core is suddenly lost while thereactor is scrammed, that is, when

Q nuclear consists only of decay powerQ decay. Then, from Eq. 1, Q core = Q decay.For a typical light-water reactor core atdecay power levels, we can estimate thatthe core temperature increases at a rateof about 0.5 to 1 kelvin (0.9 to 1.8°Fahrenheit) per second. At this rate,some tens of minutes are required for acompletely uncooled core to heat to thefuel’s melting point.

Assuming now that our model con-sists of two cells, fuel and coolant, wecan illustrate the importance of the con-vective heat-transfer rate between them(Fig. 11). The rate of this transfer is theproduct of an overall heat-transfer coef-ficient h, the fuel surface A, and thedifference between the average fuel andcoolant temperatures, T fuel — T coolant.Again, energy balances provide equa-tions for Qfuel and Qcoolant .

Q fue l = Q n u c l e a r— h A ( Tf u e l

– T c o o l a n t

(2)

and

Q coolant = hA (Tfuel - T c o o l a n t )–2 W cp ( Tc o o l a n t - T i n). ( 3 )

Here again, W and T in can be de-termined as indicated for Eq. 1.

Equation 2 illustrates the significanceof “burnout” to balancing the rates ofheating and cooling. (Burnout is thetraditional term used in the boiler in-dustry for situations where heat fluxesbecome so high that a boiler tube driesand melts, that is, burns out.) Duringnormal operating transients in whichQnuclear increases, heat is transferred

16

from fuel rods to coolant by the efficientprocesses of turbulent forced convectionand nucleate boiling. In nucleate boiling,small vapor bubbles form rapidly on thesurface and are swept away by the fast-flowing coolant. The heat-transfer coeffi-cient is very large for this process, andheat fluxes across the cladding-coolantinterface can be quite high even at lowtemperature differences. If, however, theheat flux exceeds a critical value, de-parture from nucleate boiling occurs,and the cladding surface becomes cov-ered mostly by a film of steam. Becausethe heat-transfer coefficient betweencladding and steam is very small, therate of heat removal is low even for largetemperature differences. Consequently,peak heat fluxes in an operating pressur-ized-water reactor are restricted to lessthan about 75% of the value at whichdeparture from nucleate boiling occurs,and operational control systems are de-signed to maintain this condition duringall normal power changes.

However, departure from nucleateboiling and even complete dryout of thefuel rods can occur under accident con-ditions such as the design-basis large-break loss-of-coolant accident men-tioned earlier. The rapid loss of coolantwould repressurize the primary systemand cause vaporization of the remainingwater and dryout of the fuel rods. Poorlycooled by the steam, the core wouldoverheat were it not for the automaticactivation of the emergency core-coolingsystem.

But how well do these systems actual-ly work? To reach the lower plenumbelow the core, emergency coolant mustflow down the downcomer against anupward flow of steam. Does most of thewater flow around and out the break

instead of down to the lower plenum?Once the lower plenum is filled, the coremust be reflooded with water and thefuel rods quenched. Most people arefamiliar with the vigorous boil-ing-quenching process when a fire pokerat, say, 530 kelvin (500° Fahrenheit), isinserted into a bucket of water. For areactor, think of 40,000 pokers, 4 meters(12 feet) long, and at, say, 920 kelvin(1200° Fahrenheit) plunging into a4.6-meter-diameter (15-foot) bucket ofcold water. The cooling water initiallyentering the core would be almost in-stantly vaporized, much like waterthrown into a hot skillet, and the hugeamount of steam generated would tendto prevent more water from entering thecore. How long does it take to refloodthe core and quench the rods? Will thefuel rods get hot enough to fail beforethey are quenched?

Since it is impractical to perform afull-scale demonstration of the emer-gency core-cooling system under theseextreme circumstances, the answers tothese questions have had to come fromtheoretical analyses backed by numer-ous smaller-scale experiments.

Code Development forLight-Water Reactor Safety Analysis

In 1970 the Nuclear Regulatory Com-mission developed standards forassessing the adequacy of emergencycore-cooling systems and codified themin Appendix K of Federal Regulation10CFR5O. Methods of analysis as wellas performance criteria are included. Forexample, before a reactor can belicensed, the owner of a proposed facilitymust show through analysis based on an“evaluation model” that the peak clad-

LOS ALAMOS SCIENCE


Fig. 12. Cladding temperature histories during a large-break loss-of-coolant accidentin a typical four-loop pressurized-water reactor. One history (solid curve) is a TRACanalysis [J. R. Ireland and D. R. Liles, “A TRAC-PD2 Analysis of a Large-BreakLoss-of-Coolant Accident in a Reference US PWR,” Los Alamos Program technicalnote LA-2D/3D-TN-81-10 (March 1981)]; the other (dotted curve) is an eval-uation-model, or conservative, analysis [G. W. Johnson, F. W. Childs, and J. M.Broughton, “A Comparison of ‘Best-Estimate’ and ‘Evaluation Model’ LOCACalculations: The BE/EM Study, ” Idaho National Engineering Laboratory reportPG-R-76-009 (December 1976)].

ding temperature would not exceed 1477kelvin (2200° Fahrenheit) during thedesign-basis loss-of-coolant accident.*The evaluation model defined in Appen-dix K includes conservative assump-tions. such as an unrealistically low heattransfer from the fuel rods to the coolantduring the initial depressurization of theprimary system. Despite these con-servative assumptions, evaluation-model

analyses were heavily criticized by scien-tists outside the industry. Many sim-plifications were required to perform theanalyses, and. consequently, there wasno assurance that the resulting predic-tions were, in fact, on the safe side. In1974 an American Physical Societyc o m m i t t e e i d e n t i f i e d t h ethermal-hydraulics codes used for theanalyses as the weakest link in the

licensing process.**It was to help counter this criticism

that the research arm of the NuclearRegulatory Commission began fundingthe Laboratory to develop TRAC, astate-of-the-art thermal-hydraulics codecapable of simulating the complete de-sign-basis loss-of-coolant accident se-quence in one continuous calculation.Because this large system code was toc o v e r a n e n o r m o u s r a n g e o fthermal-hydraulic phenomena in a com-plete primary system, approximate mod-els of the various phenomena had to beused. To aid and complement develop-ment of these models, the Commissionalso began funding more detailedanalyses of individual reactor compo-nents and physical processes. Some ofthese analyses are described in a laterarticle.***

Although TRAC was to include themost advanced numerical techniquesavailable at the time, there was someskepticism about whether the codewould work at all, much less providerealistic predictions in a reasonable com-puting time. But less than three yearsafter development efforts began, it pro-duced the first complete calculation of alarge-break loss-of-coolant accident inabout 30 hours on a CDC-7600. (Laterversions of TRAC run much faster.)Figure 12 shows typical results for clad-ding temperatures during a large-breakloss-of-coolant accident. The predictedpeak cladding temperature (about 1030kelvin. or 1400° Fahrenheit) is muchlower than the limit set by the NuclearRegulatory Commission. and we have

* This is the temperature above which the zirconium-steam reaction proceeds at a significant rate.**H. W. Lewis, Chairman, “Report to the American Physical Society by the study Group on Light-Water Reactor Safety,” Reviews ofModern Physics 47, Supplement No. 1 (1975).***See “Detailed Studies of Reactor Components” in this issue.


considerable assurance from loss-of-coolant experiments that this tem-perature is correct. The emergency cool-i n g p r o c e s s i s t u r b u l e n t a n dchaotic—but it works.

Both the models and methods of theTRAC code and its experimental veri-fication are discussed in a later article.*Comparison of TRAC calculations witha large number of experiments showsgenerally good agreement and has led toimproved models, particularly for heattransfer in the core. As a result, the codeis now felt to be very reliable for predict-ing reactor response during large-breakloss-of-coolant accidents.

TRAC’s applicability to different typesof accidents, such as long-duration tran-sients involving small breaks and multi-ple failures, was tested in the aftermathof Three Mile Island.** TRAC analysesof that accident requested by in-vestigative groups are in good agreementwith available plant data and provided abasis for estimates of core damage byLaboratory personnel. Recent work onthe code has concentrated on improvingnumerical efficiency and modeling foraccidents of this type.

Fast Breeder Reactors

Light-water reactors, which run onthermal neutrons and fission of the fissileisotope uranium-235, utilize only a verysmall fraction of the energy potentiallyavailable from our uranium resources.Over 99% of natural uranium isuranium-238, a “fertile” isotope that canbe converted into a fissile isotope,plutonium-239.

The fast breeder reactor is designed tocarry out this nuclear alchemy. It notonly produces power through a chainr e a c t i o n b a s e d o n f i s s i o n o fplutonium-239, but also uses the excessneutrons to convert uranium-238 intoplutonium-239 through neutron absorp-tion and subsequent beta decay:

This conversion takes place in the reac-

*See “Accident Simulation with TRAC" in this issue,**See “Three Mile Island and Multiple-Failure Accidents” in this issue.

18

t o r c o r e , wh ich con t a in s bo thplutonium-239 and uranium-238, and ina blanket of uranium-238 that surroundsthe core. To breed more fuel than itconsumes, the breeder reactor must runon fast neutrons. Therefore, moderatingmaterials, such as water, that slow downthe fast neutrons created by fission areeliminated from the core region.

Fast breeder reactors can increaseutilization of uranium resources by afactor of 50 over what can be achievedwith light-water reactors. In fact, breederreactors could supply all of our electricalenergy needs for thousands of years.

LOS ALAMOS SCIENCE


Containment Structure\

Fig. 14. A loop design for a liquid-metal-cooled fast breeder reactor showing theprimary and secondary sodium cooling loops and the steam loop to the tur-bine-generators. The second sodium loop ensures that no radioactive sodium flowsthrough the steam generators. The primary system is at near atmospheric pressureand therefore does not need a pressurizer. The reactor core contains more fissile fuelin a more compact configuration than does a light-water reactor.

Because of this high potential payoff,research on fast breeder reactors hasbeen a high-priority effort in the UnitedStates for over 20 years. Interestingly,the first reactor-generated electricitycame in 1951 from a small fast reactorprototype called the ExperimentalBreeder Reactor I (EBR-I). A sec-ond-generation reactor of this type,EBR-II, has successfully operated at Ida-ho National Engineering Laboratory forover 15 years (Fig. 13).

Liquid sodium is the primary coolantin liquid-metal-cooled fast breeder reac-tors, the most common design for fast

LOS ALAMOS SCIENCE

breeder reactors. In one form, referred toas a loop design, the general componentlayout is similar to that in a pressur-ized-water reactor (Fig. 14). The pro-posed Clinch River Breeder Reactor isan example of this design. It has nopressurizer because the coolant is main-tained at near atmospheric pressure, butit requires an extra set of heat ex-changers to ensure that the sodium flow-ing through the steam generators is not

radioactive. The steam generators mustbe very carefully designed, built, andmaintained to minimize the chance forcoolant leakage because sodium and

water react violently on contact.

SAFETY ANALYSIS OF FASTBREEDER REACTORS. L i q -uid-metal-cooled fast breeder reactorshave several safety advantages. The so-dium coolant, which is at nearly at-mospheric pressure, does not severelystress the primary system and would notbe rapidly expelled from a break. There-fore, loss-of-coolant accidents are not amajor concern. A complete loss ofcoolant can be made practically im-possible by putting catch tanks aroundall major components. Emergencycore-cooling systems are therefore notnecessary. In addition, because the reac-tor operates at coolant temperatures wellbelow the boiling point of sodium, tran-sients involving departure from nucleateboiling are not a problem, provided thecontrol systems operate correctly.Further, the sodium coolant has ex-cellent capabilities for passive (withoutpumps) decay-heat removal when thereactor is scrammed.

Despite these apparent advantages,the breeder reactor has one major disad-vantage. The core of a breeder, unlikethat of a light-water reactor, is not in itsmost reactive configuration. If the con-trol rods should fail to scram the reactorduring certain potential accidents, someof the fuel may melt and reassemble in aconfiguration that would support arapidly increasing fission rate. For-tunately, such energy-releasing ex-cursions are inherently self-limiting.High temperatures and core expansionalmost instantaneously cause sufficientnuclear feedbacks to reduce the fissionrate. Nevertheless, a large amount ofenergy can be released in a very shorttime before these feedbacks take effect.Therefore, great care is taken to provide

19

Fig. 15. Fuel for the high-temperature gas-cooled reactor is in particles are dispersed in a graphite matrix, which is formedthe form of small particles containing a kernel of either fissile into a fuel slug. The fuel slugs are inserted into holes drilled inuranium-235 or fertile thorium-232, both as dicarbides. Typi- a graphite core block; helium flows through other holes. Thecally, three barrier coatings plus an inner buffer zone encase core contains seveal thousand core blocks, some of which canthe kernel and serve to contain the fusion products. The accommodate control rods.

diverse and redundant scram systems forbreeder reactors.

Although a core-disruptive accident isextemely unlikely, it has received con-siderable attention as the worst possibleaccident—one that poses a threat to thecontainment. The Laboratory was askedto develop a computer code simulatingthis accident to determine its potentialfor damage. The result is SIMMER, acoupled neutronic-hydrodynamic com-puter code that is unique in being able totreat the complex interaction of solid,liquid, or vapor phases of fuel, steel

cladding, and sodium coolant as they areaffected by fission energy release.* Thehydrodynamic t r ea tmen t o f i n -terpenetrating materials and multiphaseflow is based on methods developed atLos Alamos by Francis H. Harlow andhis coworkers.

SIMMER analyses have been in goodagreement with experiments involvingi so l a t ed a spec t s o f a s imu la t edcore-disruptive accident. Results for theaccident as a whole indicate a muchlower potential for damage than doearlier, more conservative analyses.

*See “Breeder Reactor Safety—Modeling the Impossible” in this issue.

20

Gas-Cooled Reactors

Reactors that use a gas as the primarycoolant have been under developmentfor many years. Such reactors can oper-ate at higher temperatures than wa-ter-cooled reactors because phasechange (boiling) is not a constraint. TheBritish have been particularly active inbuilding gas-cooled reactors; the WestGermans and Japanese also have astrong interest in this approach. LosAlamos developed considerable expertiseon gas-cooled reactors through the Rov-er program, a program carried out be-

LOS ALAMOS SCIENCE


Fig. 16. A massive prestressed concrete vessel encloses the ators. The auxiliary heat exchanger removes heat from theprimary system of the Fort St. Vrain high-temperature helium when the steam generators are out of service. (Diagramgas-cooled reactor. Helium circulators force pressurized courtesy of General Atomic Company.)helium down through the core and up through steam gener-

tween 1955 and 1974 to develop areactor-powered rocket engine. As partof this program, several gas-cooled reac-tors were developed and successfullyground-tested.

The current gas-cooled reactor pro-gram in the United States centers on thehigh-temperature gas-cooled reactor, aconcept developed by General AtomicCompany. The Fort St. Vrain reactorlocated near Denver, Colorado is theonly commercial gas-cooled reactor inthe United States. Although this type ofreactor offers advantages in terms ofefficiency and safety, it is a sec-ond-generation reactor technology thatwas caught in the nuclear power down-t u r n b e f o r e i t c o u l d b e c o m ewell established commercially.

The core of a high-temperature

LOS ALAMOS SCIENCE

gas-cooled reactor is very different fromthat of the reactors discussed above. Thefuel (Fig. 15) is in the form of tiny beads.Special coatings around the beads con-tain the fission products generated dur-ing use. The beads are dispersed in agraphite binder and inserted into largegraphite blocks. These blocks are lockedtogether to form the core. The graphitealso serves as the neutron moderator.The coolant is helium pressurized to ashigh as 72 bars in recent designs. Acirculator forces the helium throughthousands of holes drilled in the coreblocks and through steam generators.Figure 16 shows a typical primary sys-tem and the monolith of prestressedconcrete that encases the entire primarysystem. A network of axial and circum-ferential cables keeps the concrete vessel

under constant compression.The unique core design of the

high-temperature gas-cooled reactor af-fords a degree of accident protection notpossible in water-cooled reactors. Herethe dispersed fuel produces a low energydensity and the large amount of graphiteprovides an enormous heat sink. Even ifthe helium circulator is not operating,several hours worth of decay heat can beabsorbed by the core before it heats tothe point of damage. After a few hoursof such heating, the fission productsbegin to diffuse from the fuel to thecoolant channels, but slowly movinghelium will transport them to colderregions of the primary system wheremost would be deposited. The graphitecore can withstand extremely high tem-perature (about 3900 kelvin, or 6500°

21

Fahrenheit) before beginning to sublimera the r t han me l t . P roponen t s o fgas-cooled reactors describe them asmore forgiving because they offer moretime to take appropriate emergencymeasures than do light-water reactors. *

Los Alamos work on gas-cooled reac-tors included development of the Rovernuclear rocket engine based on an ul-tra-high-temperature reactor with a

graphite core. Current gas-cooled reac-tor safety research at the Laboratoryconcentrates on investigation of struc-tural dynamics and on analysis of possi-ble accidents. The tool for accidentanalysis is the computer code CHAP,which resembles TRAC in its full-systemanalysis capabilities. Laboratory staffmembers also assist the Nuclear Regu-latory Commission on safety issues re-lated to the Fort St. Vrain reactor.

Safety Analysis at Los Alamos

We have emphasized the developmentof accident-simulation codes such asTRAC, SIMMER, and CHAP becauseLos Alamos is a leader in this field.These state-of-the art computer codeshave made possible realistic analyses ofaccident consequences. We have builtconfidence in their predictive capabilitiesthrough extensive testing against experi-ments and are now applying these codesto actual safety problems. For example,one controversial issue facing the nucle-ar industry is whether or not the maincoolant pumps should be turned off inthe e v e n t of a sma l l -b reakloss-of-coolant accident in a pressur-ized-water reactor. The results of ourdetailed calculations with TRAC will help

*See “The View from San Diego: Harold AgnewSpeaks Out” in this issue.

22

Fig. 17. On the basis of the Laboratory extensive research on respirators, LosAlamos personnel were requested to observe and evaluate the protection provided toworkers involved in the cleanup at Three Mile Island. The Laboratory had tested mostof the respirators in use there for effectiveness against inhalation of radionuclides,particularly iodine isotopes, and has developed techniques to assure their proper use.Here a respirator is being checked for leaks with a strong smelling solution known asbanana oil. (Photo by Alan Hack.)

provide the Nuclear Regulatory Com-mission with a technical basis for estab-lishing operating guidelines.

Another example will be the licensingof the Clinch River Breeder Reactor.This will involve calculating how strongthe containment must be to withstand acore-disruptive accident. The SIMMERcode will be used to help resolve this andother safety issues for the breeder reac-tor program.

Much of the code development workat Los Alamos is part of a broad pro-gram in reactor safety research spon-sored by the Nuclear Regulatory Com-mission and carried out in large part bythe national laboratories. Idaho National

Engineering Laboratory performs mostof the large-scale experiments, SandiaNational Laboratories (Albuquerque)performs some experiments and a con-siderable amount of risk analysis, andLos Alamos leads in the development,verification, and application of advancedcomputer techniques. Other laboratoriesinvolved include Brookhaven NationalLaboratory, Argonne National Labora-tory, Oak Ridge National Laboratory,and Battelle Memorial Institute’s Colum-bus and Pacific Northwest Laboratories.

The Nuclear Regulatory Commissionalso relies on the national laboratoriesfor technical assistance in reviewinglicense applications and investigating

LOS ALAMOS SCIENCE


TABLE I

REACTOR AND NUCLEAR FUEL CYCLE SAFETY RESEARCH PROGRAM AT LOS ALAMOS

CurrentPersonnel Lead

Activity Level Group(s)

RESEARCH FUNDED BY THE NUCLEAR REGULATORY COMMISSION

Development, assessment, and application of the TRACcode for light-water reactors 33 Q-9, Q-7

Development, assessment, and application of the SIMMERcode for liquid-metal-cooled fast breeder reactors 22 Q-7

Multinational (United States, West Germany, and Japan)reactor safety program 15 Q-8

Analytic and experimental studies of ventilation systemsfor nuclear facilities 9 WX-8

Nuclear safeguards studies 8 Q-4

Analytic and experimental studies of high-temperaturegas-cooled reactors 7 Q-13, Q-9

Respirator studies 7 H-5

Development and application of codes for light-waterreactor components 6 T-3

Analytic and experimental studies of structural marginsfor reactor containment buildings 6 Q-13

Studies of radionuclide transport in soil 5 LS-6

Risk and statistical analysis 3 S-DO

RESEARCH FUNDED BY THE DEPARTMENT OF ENERGY

Liquid-metal-cooled fast breeder reactor safety studies 7 Q-7

Application of PINEX (pinhole experiment) imaging system toliquid-metal-cooled fast breeder reactor safety experiments 4 P-15

Statistical analysis of light-water reactor component failures 1 S-DO

TECHNICAL ASSISTANCE TO THE NUCLEAR REGULATORY COMMISSIONIN IT'S REACTOR LICENSING ACTIVITIES

Identification of vital areas in nuclear power plants 6 WX-8

Reactor containment building analysis 5 Q-7, T-1, Q-13

Audits of smal1-break loss-of-coolant accident analyses 3 Q-7

Seismic reviews of reactor sites 2 G-2

Miscellaneous support 5 Q-7, WX-8


specific safety issues. The Commission’ssafety requirements summarized in Fed-eral Regulation 10CFR5O serve as thebasis for evaluating plant designs. Allpower reactors, research reactors, andfuel-cycle facilities in the private sectorare covered by this regulation.

To comply with 10CFR5O, a licenseapplicant must submit documents show-ing that the proposed facility is safe andwill not adversely affect the health of thepublic. These documents include com-plete descriptions of the reactor, theauxiliary systems, and the site, as well asdetailed safety analyses.

Los Alamos has developed multi-disciplinary teams to help the Com-mission in all phases of this technicalreview. These teams include structural,electrical, nuclear, and mechanical engi-neers, seismologists, and experts on radi-ation and its health effects.

Associated with these safety reviews,Los Alamos performs research and test-ing in cooperation with New MexicoState University to help establish stan-dards for plant ventilation systems andreactor containment structures. Thepurpose of these efforts is to ensure theconfinement of radioactive materialsduring all accidents, including thosecaused by fires, explosions, and torna-does. Experimental facilities at both LosAlamos and the University are used inthis research.

An outgrowth of this technical as-sistance work is our direct involvementin assessing the physical security plansat commercial nuclear power plants.*These assessments have includedanalyses of accident sequences that

might be initiated by sabotage.The Laboratory has other responsi-

bilities in reactor safety, some of themrather different from those mentionedabove. For example, our IndustrialHygiene Group conducts research onrespirators for protecting workers frominhaled radionuclides. The expertise de-veloped in this field has been called uponin the cleanup at Three Mile Island (Fig.17).

Table I summarizes the Laboratory’sresearch and technical assistance ac-tivities in reactor and nuclear fuel-cyclesafety.

Conclusion

Our broad involvement in safetyanalysis has brought us in direct contactwith the public, the nuclear industry, andthe government regulatory agencies. Weare asked many difficult questions aboutsafety and invariably the correct answersare not simple. Careful technical analysisis essential to any safety evaluation. Byand large our work on worst-case acci-dents has shown that nuclear powerplants have large margins to protectagainst release of radioactive materials.Now we are applying our sophisticatedanalysis tools to model the consequencesof multiple equipment failures and hu-man intervention in less severe situ-ations. The purpose is to give the opera-tors effective strategies for minimizingthe effects of system failures. We believethat the predictive capabilities we havedeveloped over the last decade will helpensure the continued safe operation ofour nation’s nuclear power plants. ■

24

*See “Keeping Reactors Safe from Sabotage” in this issue.

LOS ALAMOS SCIENCE


AUTHORS

Further Reading

Michael G. Stevenson is Deputy Leader of the Laboratory’s EnergyDivision, whose activities center on reactor safety, nuclear safeguards,

reactor safety. He received a Bachelor of Engineering Science and, in1968, a Ph.D. in mechanical engineering from the University of Texasat Austin. In his 13 years of experience in fission reactor safetyresearch at Babcock & Wilcox, Argonne National Laboratory, and,since 1974, at Los Alamos, he has worked on light-water-reactors,gas-cooled reactors, and liquid-metal fast breeder reactors. He isinterested in all aspects of the nuclear fuel cycle, and during 1978 and1979 was the United States representative to the International NuclearFuel Cycle Evaluation as a member of its subgroup on environmental,safeguards, and management aspects of fast breeders.

James F. Jackson is internationally recognized in the area of nuclearreactor safety analysis. He earned his Ph.D. in engineering from theUniversity of California at Los Angeles in 1969, a Master of Science innuclear engineering in 1962 from the Massachusetts Institute ofTechnology, and a Bachelor of Science in mechanical engineering fromthe University of Utah in 1961. As a senior research engineer atAtomics International, he worked on the design and safety evaluationof the SNAP-10A reactor that was successfully tested in orbital flight.He then moved to Argonne National Laboratory and became deeplyinvolved in advanced computer methods for safety analysis of liq-uid-metal fast breeder reactors. After spending two years teachingnuclear engineering at Brigham Young University and consulting in thearea of reactor safety, he joined the Los Alamos staff in 1976. Heserved the Energy Division in various positions of leadership and in1980 was appointed the Deputy Associate Director for NuclearRegulatory Commission Programs. In March 1981 he assumed hiscurrent position, Leader of the Energy Division. He is a member of theAmerican Nuclear Society and has served on the Executive Committeeof its Nuclear Reactor Safety Division. This spring he was the recipientof a Distinguished Performance Award from the Laboratory for hiscontributions to its reactor safety research effort.

Kenneth C. Lish, Nuclear Power Plant Systems and Equipment (IndustrialPress Inc., New York, 1972).

Alexander Sesonske; “Nuclear Power Plant Design Analysis,” TechnicalInformation Center report TID-26241 (November 1973).

John R. Lamarsh, Introduction to Nuclear Engineering (Addison-WesleyPublishing Co., Reading, Massachusetts, 1975).

James J. Duderstadt and Louis J. Hamilton, Nuclear Reactor Analysis (JohnWiley & Sons, New York, 1976).

Anthony V. Nero, Jr., A Guidebook to Nuclear Reactors (University ofCalifornia Press, Berkeley, California, 1979).

Harold W. Lewis, “The Safety of Fission Reactors,” Scientific American242, No. 3,53-65 (1980).

David W. Fischer, “Planning for Large-Scale Accidents: Learning from theThree Mile Island Accident,” Energy—The International Journal 6,93-108No. 1 (1981).

Thomas H. Pigford, “The management of nuclear safety: A review of TMIafter two years,” Nuclear News 24, No. 3,41-48 (198 1).

E. E. Lewis, Nuclear Power Reactor Safety (John Wiley & Sons, New York,1977).


by Michael G. Stevenson and James F. Jackson

Documents

Transcript of by Michael G. Stevenson and James F. Jackson