Safety Aspects of Accelerator Driven Systems

When a new nuclear system, such as the Accelerator Driven System, is proposed, the early investigation of potential severe accidents is important in order to point out the areas in which the design could be improved or whether passive devices could be introduced which would stop conceivable accident sequences.

For a heavy liquid metal cooled ADS, it was early recognized that a complete Loss-Of-Flow (LOF) would lead to problems if the accelerator was not switched off. Therefore, a first conceptual design [118] was based on natural circulation cooling and therefore required a rather tall vessel. A subsequent and more detailed design with a shorter vessel introduced the enhanced natural circulation cooling by gas bubble injection above the core [122]. This design still allows the

removal of the nominal power by pure natural circulation for a certain time. However, this would still require a complete heat removal by the secondary loops.

In a Loss-Of-Heat-Sink (LOHS) Accident, the core would slowly heat up (by about 200ºC in 1000 seconds). Switching off the accelerator would get the power rapidly down to decay heat level. In case this shutting off is not done, one can rely on a simple passive means of interrupting the proton beam by using a melt-rupture disk at the side of the vacuum pipe through which the protons are streaming into the subcritical core [118], [123]. When this melt rupture disk is pushed inside the pipe by the coolant pressure, the pipe will be unconditionally filled up by the liquid metal coolant that will block off the proton beam.

An important initiator for Loss-Of-Flow and Loss-Of-Heat-Sink accidents is a station blackout.

However, in an ADS this would also lead to the shutting off of the accelerator and the decrease of the power to decay heat level. The remaining problem would be the passive decay heat removal that can be achieved by natural air circulation cooling.

Loss-Of-Coolant (LOCA) Accidents, which are a concern in LWR safety, should pose no significant problem. First, a lead-bismuth (Pb-Bi) cooled system is at a low pressure; second, a pool design has been proposed in which all the primary coolant is in one vessel and there is no primary piping which might develop leaks; and third, a guard vessel surrounds the main vessel in case the latter would leak. Another important safety aspect of a lead-bismuth or lead coolant is that it is chemically rather inert and does not react strongly with air or water. This is an advantage relative to sodium-cooled fast systems.

Beam Power Accidents. Since the proton beam intensity can be increased to compensate for burn-up, one can also imagine that the beam power is increased accidentally. Figure 5.13 shows the power increase with an assumed beam power increase by a factor 2 in one second [118], [124].

According to accelerator specialists, this large increase is not credible. It can be seen that the power does not increase too much and levels off at about 1.5 times nominal. The elevated power leads to some pin failures after about 16.5 seconds. This would not have happened if the beam power was shut off actively or passively.

Figure 5.13: Assumed Beam Power Increase by a Factor of 2 in One Second.

Reactivity Accidents: It has also been realised that fast reactivity insertions do not lead to rapid power increases due to the subcriticality of an ADS which acts as a large delayed neutron group [124]. Figure 5.14 shows the power and reactivity histories due to a reactivity insertion of 170$/s,

for 15 ms (milli seconds), corresponding to a total insertion of 2.55$¹¹, in a lead-cooled ADS with an assumed subcriticality of -4$. The subcriticality is conservatively assumed to be relatively small and the ramp rate and total insertion to be rather high, particularly since an ADS will most probably have no reactivity control rods but only safety rods.

Figure 5.14: Power Excursion in a Lead-cooled Energy Amplifier (with k = 0.99) for a Slow Reactivity Ramp Insertion.

(The reactivity increases at a rate of 170 $/s for a period of 15 ms (this corresponds to a control rod withdrawal speed of 0.55 cm/ms in the case of a reactor). The accelerator is not shut-off [118].

In the case of the Energy Amplifier operated at k = 0.99, the power increases by a factor 2.5 after 15 ms, and after 20 ms the power decreases almost proportionally with the neutron source strength. If on the other hand the neutron source is maintained (the accelerator is not shut-off), the power remains almost constant in this time range. The average temperature of the fuel rises gradually, but at a much lower rate. Note that in this case the Doppler reactivity feedback is almost negligible and very much delayed (appears only after 23 ms). The long time constant of the response implies that the heat loss from the fuel cannot be neglected anymore. In fact, there is sufficient time (of the order of a few seconds, as estimated by the convection studies described in [118]) for the natural convection mechanism to safely adapt itself to the new operating conditions without any fuel damage occurring.

The same reactivity accident was also calculated for the corresponding unscrammed critical sodium-cooled fast reactor [118], [124]. This led to a power pulse of more than 1000 times nominal and nearly complete core destruction. Two aspects explain the difference. First, the subcriticality of the ADS and second, the positive void coefficient that came into play in the accident in the critical reactor, but not in the ADS case. In the proposed ADS design, lead-bismuth is used which has a negative void coefficient.

To conclude, a lead or lead-bismuth cooled ADS with a good natural coolant circulation capability and a passive emergency decay heat removal system is very attractive to prevent or mitigate severe accidents. The critical Loss-Of-Flow and Loss-Of-Heat-Sink accidents in such a system will

11One dollar (1$) is the reactivity insertion that will make a reactor prompt critical. It is equal to the effective delayed neutron fraction (β ), and therefore depends on the fuel.

result in a slow coolant heat-up. This should normally lead to a manual shutdown. Fast and rather large reactivity insertions (which are of very low probability in a system without control rods) lead only to a limited power increase. This is due to the subcriticality of these systems. To stop such a limited overpower condition, a beam shut-off or the insertion of safety rods is necessary. The switching off of an accelerator is principally simpler than the insertion of safety rods.