All About Meltdowns

Excerpts from the

Reactor Safety Study (WASH-1400)

(commonly known as the Rasmussen Report)

published by the
US Nuclear Regulatory Commission
1974



Table of Contents


0.  Introductory Note: Rasmussen and the CANDU Reactor


I.  Excerpts from the Executive Summary (WASH-1400)

II.  Excerpts from the Main Report
III.  Excerpts from Appendix VIII
IV.  Excerpts from Appendices VII and VI V.   Steam Explosions: Molten Materials Contacting Water


0. Introductory Note:
Rasmussen and the CANDU Reactor

Both AECL and Ontario Hydro, in submissions to the Ontario Royal Commission on Electric Power Planning (the "Porter Commission"), cited the Rasmussen Report (WASH-1400) as an essential part of their argument that risks associated with Canadian CANDU reactors are acceptable. Porter Commission, Exhibit 158, pp.14-15; Exhibit 2, pp.43-44.

G.A. Pon, Vice President of AECL Power Projects, said of WASH-1400:

"Although the study was prepared in the U.S. assessing the risks associated with their light water nuclear power plants, the findings should not be significantly different for the CANDU reactor."  Porter Commission, Exhibit 28, p.5

In sworn testimony before the Cluff Lake Board of Inquiry into Uranium Mining in Saskatchewan, Dr. Norman Rasmussen -- the principal author of WASH-1400 -- commented about CANDU meltdown possibilities:
"although the Canadian design philosophy differs in some of its approaches . . . it achieves, in my judgment, about the same safety level as far as I can tell."

So what is the bottom line as described in the Rasmussen Report?


WORST CASE CONSEQUENCES REPORTED IN WASH-1400:

  • 45,000 cases of radiation sickness (requiring hospitalization)

  • 3,300 prompt deaths (from acute radiation sickness)

  • 45,000 fatal cancers (over 50 years)

  • 250,000 non-fatal cancers (over 50 years)

  • 190 defective children born (per year)

  • $14 billion in property damage (in 1974 dollars; not insurable)
    Nor are these the worst consequences that can be imagined.

    Although the Rasmussen Report is flawed in many respects, and in many ways tends to understate the dangers from nuclear reactors, nevertheless there is much in the report that is illuminating and important. The excerpts given here were cited by Dr. Gordon Edwards following the Three Mile Island Accident, when testifying to the Select Committee on Ontario Hydro Affairs on the subject of potentially catastrophic accidents in CANDU nuclear plants.

                                       above commentary by Dr. Gordon Edwards

    • I. Excerpts from the Executive Summary (pp. 6-7)


    2.6.   HOW CAN RADIOACTIVITY BE RELEASED?

    The only way that potentially large amounts of radioactivity could be released is by melting of the fuel in the reactor core.

    The fuel that is removed from a reactor after use and stored at the plant site also contains considerable amounts of radioactivity. However, accidental releases from such used fuel were found to be quite unlikely and small compared to potential releases of radioactivity from the fuel in the reactor core.

    The study has examined a very large number of potential paths by which potential radioactive releases might occur and has identified those that determine the risks. This involved defining the ways in which the core could melt and the ways in which systems to control the release of radioactivity could fail.


    2.7.   HOW MIGHT A CORE MELT ACCIDENT OCCUR?

    It is significant that in some 200 reactor-years of commercial operation of reactors of the type considered in the report there have been no fuel melting accidents. To melt the fuel requires a failure in the cooling system or the occurrence of a heat imbalance that would allow the fuel to heat up to its melting point, about 5000 o F [2800 o C] .

    To those unfamiliar with the characteristics of reactors, it might seem that all that is required to prevent fuel from overheating is to promptly stop, or shut down, the fission process at the first sign of trouble. Although reactors have such [fast shutdown] systems, they alone are not enough since the radioactive decay of fission fragments in the fuel continues to generate heat (called decay heat) that must be removed even after the fission process stops. Thus, redundant decay heat removal systems are also provided in reactors. In addition, emergency core cooling systems (ECCS) are provided to cope with a series of potential but unlikely accidents, caused by ruptures in, and loss of coolant from, the normal cooling system.

    The Reactor Safety Study has defined two broad types of situations that might potentially lead to a melting of the reactor core: the loss-of-coolant accident (LOCA) and transients.

    In the event of a potential loss of coolant, the normal cooling water would be lost from the cooling systems and core melting would be prevented by the use of the emergency core cooling systems (ECCS). However, melting could occur in a loss of coolant if the ECCS were to fail to operate.

    The term "transient" refers to any one of a number of conditions which could occur in a plant and would require the reactor to be shut down. Following shutdown, the decay heat removal systems would operate to keep the core from overheating. Certain failures in either the shutdown or the decay heat removal systems also have the potential to cause melting of the core.


    2.8   WHAT FEATURES ARE PROVIDED IN REACTORS TO COPE
           WITH A CORE MELT ACCIDENT?

    An essentially leaktight containment building is provided to prevent the initial dispersion of the airborne radioactivity into the environment. Although the containment would fail in time if the core were to melt, until that time, the radioactivity released from the fuel would be deposited by natural processes on the surfaces inside the containment. In addition, plants are provided with systems to contain and trap the radioactivity released within the containment building.

    Even though the containment building would be expected to remain intact for some time following a core melt, eventually the molten mass would be expected to eat its way through the concrete floor into the ground below. Following this, much of the radioactive material would be trapped in the soil; however, a small amount would escape to the surface and be released. Almost all of the non-gaseous radioactivity would be trapped in the soil.

    It is possible to postulate core melt accidents in which the containment building would fail by overpressurization or by missiles created by the accident. Such accidents are less likely but could release a larger amount of airborne radioactivity and have more serious consequences.


    2.9   HOW MIGHT THE LOSS-OF-COOLANT ACCIDENT
           LEAD TO A CORE MELT?

    Loss of coolant accidents are postulated to result from failures in the normal reactor cooling water system, and plants are designed to cope with such failures. The water in the reactor cooling systems is at a very high pressure (between 50 to 100 times the pressure in a car tire) and if a rupture were to occur in the pipes, pumps, valves, or vessels that contain it, then a "blowout" would happen. In this case some of the water would flash to steam and blow out of the hole. This could be serious since the fuel could melt if additional cooling were not supplied in a rather short time.

    The study has examined a large number of potential sequences of events following LOCAs [loss-of-coolant accidents] of various sizes. In almost all of the cases, the LOCA must be followed by failures in the emergency core cooling system for the core to melt.


    2.10   HOW MIGHT A REACTOR TRANSIENT LEAD TO A CORE MELT?

    The term "reactor transient" refers to a number of events that require the reactor to be shut down. These range from normal shutdown for such things as refuelling to such unplanned but expected events as loss of power to the plant from the utility transmission lines.

    The reactor is designed to cope with unplanned transients by automatically shutting down. Following shutdown, cooling systems would be operated to remove the heat produced by the radioactivity in the fuel. There are several different cooling systems capable of removing this heat, but if they all should fail, the heat being produced would be sufficient to eventually boil away all the cooling water and melt the core.

    In addition to the above pathway to core melt, it is also possible to postulate core melt resulting from the failure of the reactor shutdown systems following a transient event. In this case it would be possible for the amounts of heat generated to be such that the available cooling systems might not cope with it and core melt could result.


    2.11   HOW LIKELY IS A CORE MELT ACCIDENT?

    The Reactor Safety Study carefully examined the various paths leading to core melt. Using methods developed in recent years for estimating the likelihood of such accidents, a probability of occurrence was determined for each core melt accident identified. These probabilities were combined to obtain the total probability of melting the core.

    The value obtained was about one in 20,000 per reactor per year. With 100 reactors operating, as is anticipated for the U.S. by about 1980, this means that the chance for one such accident is one in 200 per year [or about 1 in 10 over a period of 20 years].

    II. Excerpts from the Main Report (WASH-1400)
    re Fuel Melting (pp. 25-29)


    The identification of all significant sources of radioactivity, the fact that a gross release of radioactivity can occur only if fuel melts, knowledge of the factors that affect heat balances in the fuel, and the fact that mechanisms that could lead to heat imbalances have been scrutinized for many years, all provide a high degree of confidence that those accidents of significance to risk have been identified.


    3.3   LOSS OF COOLANT ACCIDENTS

    A LOCA [loss-of-coolant accident] would result whenever the reactor coolant system (RCS) experiences a break or opening large enough so that the coolant inventory in the system could not be maintained by the normally operating makeup system. Nuclear plants include many engineered safety features (ESFs) that are provided to mitigate the consequences of such an event.

    The specific LOCA initiating events analyzed in this study are:

    a.  Large pipe breaks
        (6 inches to approximately 3 feet equivalent diameter).

    b.  Small to intermediate pipe breaks
        (2 inches to 6 inches equivalent diameters).

    c.  Small pipe breaks
        (1/2 inch to 2 inches equivalent diameter).

    d.  Large disruptive reactor vessel ruptures.

    e.  Gross steam generator ruptures.

    f.  Ruptures between systems that interface with the
        RCS [reactor coolant system].

    The basic purpose of the ESFs [engineered safety features] is the same for both PWR [pressurized-water reactors] and BWR [boiling-water reactor] plants. However, the nature and functions of ESFs differ somewhat between PWRs and BWRs because of the differences in the plant designs.

    A number of the ESFs [engineered safety features] are included in a group termed the emergency core cooling system (ECCS) whose function is to provide adequate cooling of the reactor core in the event of a LOCA [loss-of-coolant accident]. Other ESFs provide rapid reactor shutdown and reduce the containment radioactivity and pressure levels that result from escape of the reactor coolant from the RCS [reactor coolant system].

    In early power reactors the power level was about one tenth that of today's large reactors. It was thought that core melting in those low power reactors would not lead to melt-through of the containment. Further, since the decay heat was low enough to be readily transferred through the steel containment walls to the outside atmosphere, it could not overpressurize and fail [i.e. cause a failure in] the containment. Thus, if a LOCA [loss-of-coolant accident] were to occur, and even if the core were to melt, the low leakage containments that were provided would have permitted the release of only a small amount of radioactivity.

    However, as reactors grew larger, several new considerations became apparent.

    The decay heat levels were now so high that the heat could not be dissipated through the containment walls. Further, in the event of accidents, concrete shielding was required around the outside of the containment to prevent over-exposure of persons in the vicinity of the plant. Finally, it became likely that a molten core could melt through the thick concrete containment base into the ground. Thus, new sets of requirements came into being.

    • Emergency core cooling systems were needed to prevent core melting which could, in turn, cause failure of all barriers to the release of radioactivity.

    • Systems were needed to transfer the core decay heat from the containment to the outside environment in order to prevent the heat from producing internal pressures high enough to rupture the containment.

    • Finally, systems were needed to remove radioactivity from the containment atmosphere in order to reduce the amount that could leak from the containment into the environment.

    The major goal behind these changes were to attempt to provide ESFs [engineered safety features] designed so that the failure of any single barrier would not be likely to cause the failure of any of the other barriers. For example, if the RCS [reactor coolant system] were to rupture, ECC [emergency core cooling] systems were installed to prevent the fuel from melting and thereby protect the integrity of the containment.

    Other features were added to aid this positive objective. For example, additional piping restraints and protective shields were required to lessen the likelihood of ESF [emergency safety features] damage that could result from pipe whip following a large break in the RCS [reactor coolant system].

    Knowledge that large natural forces such as earthquakes and tornadoes could cause multiple failures led to design requirements that attempted to reduce the likelihood of dependent failures from such causes. Appendix IX provides more detailed descriptions of the above and many more of the safety features in current nuclear plants.


    MORE ABOUT FUEL MELTING

    Prior studies have indicated that a core meltdown in a large reactor would likely lead to failure of the containment (Ref. 1,2). Thus, a commonly held opinion regarding core melting is that such an event would result in a very serious accident with large public consequences. This is evidently one of the reasons that major safety efforts have been devoted to the prevention of core meltdown and little attention has been directed toward the examination of the potential relationships between core melting and containment integrity.

    At two key stages in the course of a potential core meltdown there would be conditions which would have the potential to result in a steam explosion that could rupture the reactor vessel and/or the containment. These conditions may occur

    • when molten fuel would fall from the core region into water at the bottom of the reactor vessel, or

    • when it would melt through the bottom of the reactor vessel and fall into water in the bottom of the containment.

    It is predicted (see Appendix VIII) that if such an explosion were to occur in the reactor vessel, it may be energetic enough to change the course of the accident.

    For reactors enclosed in relatively large volume containments, it is considered improbable that a steam explosion outside the reactor vessel would rupture the containment. If a steam explosion were to occur within the reactor vessel, it is considered possible that both large and small containments could be penetrated by a large missile. Such occurrences might release substantial amounts of radioactivity to the environment.

    However, these modes of containment failure are predicted to have low probabilities of occurrence.


    3.5   ACCIDENTS INVOLVING THE SPENT FUEL STORAGE POOL

    In section 3.2 the spent fuel storage pool (SFSP) is identified as having a significant radioactivity inventory, second in amount to the reactor core. Further, the decay heat levels in freshly unloaded fuel assemblies that may be stored in the pool may be sufficiently high to cause fuel melting if the water is completely drained from the SFSP [spent fuel storage pool].

    Because the maximum amount of fuel stored in the pool immediately after refuelling is smaller than that in the core and because it has had time (72 hours minimum) for radioactive decay, it is a less intense heat source than a reactor core (about one-sixth) and therefore melt-through of the bottom structure of the pool would occur at a much lower rate and, in fact, may not occur at all.

    On the average, fuel in the pool will have undergone about 125 days of decay, and it is questionable that such fuel would melt. However, to assure that the risk would not be underestimated, it has been assumed that even this fuel would melt.

    Although the pool is not within a containment building, filters in the SFSP building ventilation system and natural deposition of radioactivity within the building both aid in reducing the amount of radioactivity that might be released to the environment in the event of a spent fuel accident.

    The analyses of accidents that could potentially lead to loss of fuel cooling in the SFSP [spent fuel storage pool] are discussed in section 5 of Appendix I. The most probable ways in which such accidents could occur have been determined to be the loss of the pool cooling system or the perforation of the bottom of the pool. The latter could occur, for example, by dropping a shipping cask in the pool or on the top edge of the pool. Both this type of accident and the loss of cooling capability, are of low likelihood.

    "Right after shutdown the heating rate of the reactor is about seven percent of the full power rate, and then as the radioactivity decays away it [the decay heat] decreases; in a few hours it's less than one percent, and it keeps going down . . .

    "Even one percent [of full power] is a lot of heat, and if you don't remove that heat it's surely enough to overheat the fuel and melt it, and therein lies the problem that the reactor safety analyst must face -- to assure himself that the heat produced by these decaying fission products is reduced, is removed for periods of weeks or months . . .

    "Every core melt in our study is assumed to melt its way through the bottom of the reactor."

    Norman Rasmussen testimony, Cluff Lake Board of Inquiry, transcript p.8686.

    III. Excerpts from Appendix VIII of WASH-1400
    on Core Meltdowns


    A1.  1.2.3.1   CORE-MELTDOWN BEHAVIOR

    The behavior of a core during a meltdown accident is uncertain. No cores have been melted. Experiments involving more than a cupful of molten UO2 [uranium oxide fuel] are still in the planning stages.

    Some properties of molten UO2 [uranium oxide fuel] are known: melting point, boiling point, and heat of fusion. However, little is known about the viscosity, internal thermal convection, surface tension, or the metallurgical effects of various diluents. Nevertheless, considerable insight has been developed by people working in the field about the possible course of core meltdown.

    Because the core power tends to peak (about 2.5 times average) at the center of the core, and because the cladding-steam reaction increases the heatup rate of the hotter regions, core melting starts at the center of the core.

    Because of the power peaking and the presence of water in the bottom of the core, the core temperatures a foot away from the melted region are frequently calculated to be more than 1000 o F below the melting point of the fuel. In these relatively cool regions, the UO2 would remain solid although the cladding could be melted.

    Because the fuel rods in the core are relatively closely packed, there is not room for solid fuel pellets to fall out of the core nor for gross distortion of the solid portions of the core. In this situation, it is believed a region of solid rubble would form under the molten fuel, and the molten fuel would tend to be retained in the core.

    However, since the rubble continues to generate heat, it will eventually melt, and the increasingly larger molten region will move downward. If the pool moves downward fast enough, it will intercept the water that is boiling out of the bottom of the core. When this happens either

    1. steam explosions will occur, or

    2. the boiloff rate and, therefore, the cladding-steam reaction rate will increase.

    When the molten regions grows to include 50 to 80 percent of the core, it becomes questionable whether or not the molten region can be retained inside the core. At this time, the molten pool will be 3 to 4 feet thick, and will presumably be held up by a layer of rubble.

    When large fractions of the core are molten, the core-support plates and shrouds are also exposed to high thermal loadings. Failure of these major structural members would release the molten pool and either

    1. the rest of the water boils out of the pressure vessel, or

    2. a steam explosion results.


    CONTAINMENT VESSEL MELTTHROUGH

    The processes by which the molten core interacts with the concrete floor of the containment building are very complex and not fully understood. In the absence of definitive experimental information it is only possible to estimate approximately the time required for penetration of the containment floor by the molten core.

    When the molten fuel (together with molten zirconium, zirconium oxide, steel, iron oxide, etc.) falls onto the concrete, vaporization of free water below the surface will cause spalling of the concrete and result in a very rapid penetration rate of the melt into the concrete.

    Based on the vaporization of the free water, initial spalling rates are calculated to be 15 to 30 feet per hour. As the concrete heats up it will give up its water of hydration at about 900 o F; then, at 1400 o F to 1600 o F, the limestone will decompose into CO2 [carbon dioxide] and CaO [calcium oxide]. It is expected that the water vapor and carbon dioxide would escape from the melt.

    As the products of concrete decomposition are absorbed and/or dissolved by the melt, the melt temperature will decrease until constituents of the mixture begin to precipitate. It is estimated that by the time the melt has penetrated through 1 1/2 feet of concrete, UO2 [uranium oxide] would begin to precipitate from the multicomponent mixture.

    From this point on the progress of the melt through the concrete is controlled by the rate of decay-heat generation; i.e., the quantity of concrete penetrated is directly proportional to the energy available to decompose the concrete and raise the temperature of the products [of such decomposition] to the temperature of the melt.

    After the initial rapid penetration of concrete by spalling, the melt is expected to remain relatively viscous, decomposing and dissolving concrete at a rate compatible with decay-heat generation. Because the silica and calcia that are introduced at the lower surface are less dense than the body of the melt, convection currents that should be established will [by effectively "stirring" the melt] prevent the center of the melt from reaching very high temperatures. Also, the carbon dioxide and water vapor released by the concrete, and/or their further decomposition products, will provide additional agitation as they rise [as bubbles] through the melt.

    The upper surface of the melt is likely to be covered with a solid crust and to be radiating heat to the remains of the pressure vessel and to the walls of the reactor cavity. If there is water in the cavity it will be vaporized by the melt, but even the continued addition of water would not avert containment meltthrough since the geometry of the molten mass is not favorable for effective cooling. If the structures above the melt reach elevated temperatures, they could fall into the melt.

    That at least part of the mass of fuel, structural, and other material remain molten is required by heat-transfer considerations.

    If this mass should solidify at some point during the accident, then the only mechanism for dissipating decay heat would be conduction. For conduction to transfer the decay heat out of the largely low conductivity mass of material involved, temperatures at the center of the mass would have to exceed boiling points of some and melting points of all the constituents.

    Hence the conclusion that at least some of the mass will remain in a fluid state for considerable time, with convection within the melt tending to maintain the melt temperature near the effective melting point of the mixture. It is recognized that as the size of the melt increases and the heat-generation rate per unit volume decreases due to dilution, solidification must eventually occur. Solidification is not, however, expected to take place prior to the penetration of the containment foundation mat.

    In estimating the time required to penetrate the 10-foot-thick foundation mat, three different configurations were considered for the quantity of concrete decomposed by the molten core:

    1. a 15-foot-diameter, 10-foot-high cylinder;

    2. a 10-foot-radius hemisphere; and

    3. a 32-foot-diameter, 10-foot-high cylinder.

    The first case assumed that the melt progressed downward through the concrete faster than it did horizontally. The second case assumed equal rates of progress of the melt downward and horizontally. The third case assumed that the molten core materials spread within the confines of the reactor cavity and then attacked the concrete at equal rates in the downward and horizontal directions.

    Because the carbon dioxide and water vapor produced by the decomposition of the concrete would tend to sparge the melt of fission products, the decay heat utilized for this analysis corresponded to 60 percent of that at the time of LOCA [the original loss-of-coolant accident]. This implies complete loss of the volatile fission products and fractional removal of some of the less volatile [radioactive] species from the melt [and into the reactor containment area].

    Assuming all the decay heat goes into the concrete, the times required to penetrate the concrete and bring the entire melt to 4000 o F will be 7, 9, and 36 hours for the three cases considered. These times are based on contact of the concrete by the molten core at 2 to 3 hours after the start of the accident. Making an allowance for heat losses from the upper surface of the melt, the best estimate for the time required to penetrate the containment foundation mat is 18 hours.

    More rapid meltthrough of the concrete than calculated could occur if the spalled pieces of concrete were floated to the surface of the melt without undergoing dissolution and being elevated to the temperature of the melt.

    [ from p.VIII-66 . . . ]

    After the molten material has penetrated the concrete floor, the melt front will proceed into the underlying gravel and possibly into the earth.

    The ultimate extent to which the molten zone can grow depends upon the heat removal processes at the upper and lower surfaces and the chemical and physical processes within the melt. Estimates have been made of the ultimate extent of the growth of this region. Assuming that heat removal at the surface is limited to conduction, the maximum radius of molten sphere has been calculated to be 30 feet and 50 feet for growth into media of limestone and dry sand, respectively (Ref 14).

    The analyses of Jansen and Stepnewski (Ref. 12) for basaltic concrete indicated a maximum radius of 38 feet for a molten hemisphere. Since the ground underneath containment is well below the level of the water table, conduction heat transfer at the surface of the melt should be augmented by steam generation and convection.

    It is therefore likely that the melt will not proceed more than 10 to 50 feet below the bottom of the containment building. Greater depths could only be achieved if the core material were able to melt through the underlying material without mixing and being diluted by the products of decomposition.

    Although it has been predicted that small pellets of solid UO2 could travel some distance before being dissolved into the molten products of the medium being penetrated (Ref. 14), good mixing should occur between molten UO2 and the products of decomposition of concrete or soil in the configurations expected in the meltdown accident.


    NONCONDENSABLE GASES

    Inside the building housing a reactor which is undergoing a major nuclear accident, internal steam pressure can be greatly reduced by using a dousing system to condense the steam. All CANDU reactors are provided with such a dousing system. It is much more difficult to reduce the pressure from non-condensable gases which are formed in great quantities during meltdown. The following passage is from page VIII-117.         commentary by Dr. Gordon Edwards.
    There are two major sources of noncondensable-gas generation in a reactor accident in which core meltdown occurs. Metal-water reactions in the pressure vessel will produce hydrogen gas (H2) shortly before and during the meltdown process. Later in the accident, carbon dioxide (CO2) will be generated as the molten core material causes thermal decomposition of limestone aggregate in the concrete base mat of the containment structure.

    The production of these gases presents two potential threats to containment integrity. Both gases will cause a buildup in internal gas pressure in the system. Hydrogen generation can also lead to combustible mixtures with the oxygen already present in the containment atmosphere. Ignition of the hydrogen-oxygen mixtures can produce an exothermic [heat-producing] chemical reaction which, depending upon conditions, might develop into a detonation. The introduction of additional thermal energy into the containment atmosphere will cause a rise in pressure, perhaps coupled with a shock-wave loading on the containment walls if the detonation occurs.

    The important question in all of these situations is whether, or under what conditions, would they likely result in containment failure by overpressurization. The hydrogen-generation problem is examined first for each type of water-reactor system; an analysis of the carbon dioxide generation problem follows. [However, these analyses are not included in this text . . . ]

    IV. Excerpts from Appendix VII and VI

    1.2   MELTDOWN RELEASE COMPONENT (Appendix VII, pp. 6 & 7)

    The conditions pertaining to this release period begin with rapid boiloff of the water coolant which uncovers the reactor core.

    Steam, flowing up through the heating core, initiates Zr - H2O [zirconium-steam] reactions and this accelerates the rate of temperature rise. The cladding [made of zirconium metal] begins to melt within one minute and in a few more minutes fuel-melting temperatures are approached in the hotter regions.

    The process spreads throughout the core and within 30 minutes to 2 hours (Ref. 1) nearly the whole core is molten at temperatures ranging from roughly 2000 o C to 3000 o C.

    During the later stages of this process molten core material can run through or melt through the grid plate and fall into the bottom of the pressure vessel. If a steam explosion does not occur when residual water is contacted in the lower portion of the pressure vessel, partial quenching and temporary solidification of portions of the molten mass can take place. However, the internal heat generation causes remelting and the inevitable downward migration continues until the pressure vessel fails, probably by meltthrough.

    Pressure vessel failure is expected to require about 1 hour after most of the core has melted (Ref. 1). Prior to this the high internal temperatures have caused melting of some of the pressure vessel steel and interior structural components. The molten iron is not miscible with the core material (oxide phase) although partial conversion to iron oxides could produce some dissolution in and dilution of the core material. Nevertheless some fission products (i.e., the noble metals) would tend to distribute [i.e. migrate] to the metallic iron phase.

    Initial fuel melting is expected to occur in only the center regions of the rods on almost a pellet by pellet scale. Thus the melting fuel will offer a relatively high surface area for release of fission products.

    As the melting front moves outward, the melting of the individual pellets may continue, but it is also conceivable that larger sections of fuel may collapse into the molten mass. If this fuel melts within the mass rather than at the edge, then fission product release could be inhibited by the time required for transport [of the fission products] to a free surface. On the other hand, gaseous fission products, present as bubbles in the UO2 [molten uranium oxide fuel], could rise quickly to the surface of the molten mass and escape.

    It appears that most of the fission product release that does occur will take place early in the melting period at each core location. Then as the melted fuel mixes with the rest of the molten mass and the mass increases in size, fission product release rates will become much slower.

    The melting of structural steel in the pressure vessel during this later period is expected to produce a layer of molten iron above the molten core material which would offer a further barrier to fission product release. Other factors which can inhibit release during meltdown in the pressure vessel include the possibility of crust formation at the melt surface and partial quenching when melt runs or falls into water that may be left in the bottom of the vessel.

    The atmosphere in the core region and pressure vessel during meltdown is expected to be a steam-hydrogen mixture with small concentrations of fission-product and core-material vapors and aerosols. This may be classified a nonoxidizing atmosphere for most fission products, and it, of course, results from partial consumption of steam by metal-water reactions, yielding H2 [hydrogen gas] in the core region.

    Although the metal-water reaction that does occur is steam-supply limited, some steam flow passes through cooler portions of the core region without complete reaction. It is estimated that during the meltdown phases only about half the Zircaloy is reacted and other metal-water reaction produces only about 50 percent more H2 [hydrogen gas]. Thus total metal-water reaction is only the equivalent of 75 percent of [the theoretically possible] Zr-H2O reaction.

    Thermal analyses of core meltdown provide only generalized data on core temperature profiles, geometry changes, and melt behavior versus time. This, combined with the uncertainties which exist in fission product properties at very high temperatures, argue against construction of a highly mechanistic model to calculate fission product release during the meltdown phase. Therefore, in this work, fission product release is treated as being simply proportional to the fraction of core melted.

    Fuel melting accidents release more than 200 different radioactive substances, of which the following 54 are among the most dangerous. CANDU safety analyses routinely restrict themselves to only a small handful of these: iodine, the inert gases krypton and xenon, and, in some cases, cesium -- all released before melting actually begins. The table is adapted from Appendix VI of WASH-1400; only the manner of expression for units of radioactivity and time has been altered; the information is otherwise identical.    [commentary by Dr. Gordon Edwards]
    TABLE VI 3-1

    INITIAL ACTIVITY OF RADIONUCLIDES
    IN THE NUCLEAR REACTOR CORE
    AT THE TIME OF THE HYPOTHETICAL ACCIDENT

                         Radioactive Inventory
No.  Radionuclide   (Source Term in curies)    Half  Life
==   ============   ========================   ==========
 1   Cobalt-58                 780 thousand    10.1 weeks
 2   Cobalt-60                 290 thousand    5.25 years
 3   Krypton-85                560 thousand    10.8 years
 4   Krypton-85m                24  million    4.4  hours
 5   Krypton-87                 47  million    1.25 hours
 6   Krypton-88                 68  million    2.8  hours
 7   Rubidium-86                26 thousand    2.67 weeks
 8   Strontium-89               94  million    7.4  weeks
 9   Strontium-90    3 million 700 thousand    30.2 years
10   Strontium-91              110  million    9.7  hours
11   Yttrium-90                390 thousand    2.67  days
12   Yttrium-91                120  million    8.4  weeks
13   Zirconium-95              150  million    9.3  weeks
14   Zirconium-97              150  million    17.0 hours
15   Niobium-95                150  million    5.0  weeks
16   Molybdenum-99             160  million    2.8   days
17   Technetium-99m            140  million    6.0  hours
18   Ruthenium-103             110  million    5.64 weeks
19   Ruthenium-105              72  million    4.44 hours
20   Ruthenium-106              25  million    1.0  years
21   Rhodium-105                49  million    1.50  days
22   Tellurium-127   5 million 900 thousand    9.38 hours
23   Tellurium-127m  1 million 100 thousand    15.6 weeks
24   Tellurium-129              31  million    1.15 hours
25   Tellurium-129m  5 million 300 thousand    8.16 hours
26   Tellurium-131m             13  million    1.25  days
27   Tellurium-132             120  million    3.25  days
28   Antimony-127    6 million 100 thousand    3.88  days
29   Antimony-129               33  million    4.30 hours
30   Iodine-131                 85  million    8.05  days
31   Iodine-132                120  million    2.30 hours
32   Iodine-133                170  million    21.0 hours
33   Iodine-134                190  million    53 minutes
34   Iodine-135                150  million    6.72 hours
35   Xenon-133                 170  million    5.28  days
36   Xenon-135                  34  million    9.2  hours
37   Cesium-134      7 million 500 thousand    2.05 years
38   Cesium-136                  3  million    13.0  days
39   Cesium-137      4 million 700 thousand    30.1 years
40   Barium-140                160  million    12.8  days
41   Lanthanum-14 0            160  million    1.67  days
42   Cerium-141                150  million    4.6  weeks
43   Cerium-143                130  million    1.38  days
44   Cerium-144                 85  million    40.6 weeks
45   Praseodymium-143          130  million    13.7  days
46   Neodymium-147              60  million    11.1  days
47   Neptunium-239   1 billion 640  million    2.35  days
48   Plutonium-238              57 thousand    89.0 years
49   Plutonium-239              21 thousand  24,000 years
50   Plutonium-240              21 thousand   6,571 years
51   Plutonium-241   3 million 400 thousand    14.6 years
52   Americium-241   1 thousand  7 hundred    410.7 years
53   Curium-242                500 thousand    23.3 weeks
54   Curium-244                 23 thousand    18.1 years

    The kind of meltdown accidents envisaged in WASH-1400 require a much more extensive evacuation plan than any that is currently envisaged in Canada, as indicated in this very brief excerpt from Appendix VI of WASH-1400.      [ comentary by Dr. Gordon Edwards]

    Figure VI.11-2: Evacuation area used for cost calculations.

    In the evacuation model incorporated into the consequence calculations, the evacuation area is postulated to be shaped like a keyhole centered on the prevailing wind direction at the time of the release.

    The dimensions of the area are chosen to be 5 and 25 miles and 45 o (see Fig. VI 11-2) for the following reasons.

    • The evacuation would be carried out to mitigate the early exposure to individuals; the early exposure from the passing cloud would contribute little to the population dose.

    • Since the resources of the local authorities -- all that would be available immediately after the accident -- are limited, it would be desirable to minimize the evacuation area and the number of evacuees.

    • On the other hand, the goal would be to evacuate anyone who might receive a significant dose. The values 25 miles and 45 o represent a compromise.

    • In addition to this sector, it was judged prudent to evacuate all people within a 5-mile radius of the reactor.
    The evacuation costs are calculated on the basis of the number of people living in this evacuation area.

    In order to calculate doses to individuals within the evacuation area, people are postulated to move radially away from the reactor at a specified effective evacuation speed until the cloud reaches them, and then to move in a circumferential direction. For example, if an effective evacuation speed of 1 mph [mile per hour] is assumed, people located between 2 to 3 miles from the reactor are assumed to be 7 to 8 miles away from the reactor 5 hours after the warning.

    V. Physical Explosions Resulting from
    Contact of Molten Materials and Water


    During a major nuclear accident involving significant fuel melting, tremendous pressures can be generated which will test the integrity of the containment systems.

    This is particularly true in the event of violent steam explosions or hydrogen detonations, such as those which occurred during the 1952 accident at the small NRX reactor located in Chalk River. The explosions inside the NRX reactor were sufficient to hurl a four-ton gasholder dome four feet through the air, where it lodged in the superstructure.

    The following excerpts from Appendix VIII-B of the Rasmussen Report (pages VIII-77 to VIII-79) describe briefly what is known about the kind of steam explosions which occur when molten metal comes into sudden contact with water.     [commentary by Dr. Gordon Edwards]

    B.   REVIEW OF LITERATURE

    B1.1   INTRODUCTION

    When molten metal comes into contact with a quenching fluid, a violent explosion can occur. This so-called "vapor or physical explosion" [commonly called a "steam explosion"] is a well-known, but little understood, phenomenon.

    A vapor explosion is usually characterized by an initiating event that leads to fragmentation, and by the sudden conversion of thermal energy to mechanical energy due to very rapid heat transfer accompanied by a subsequent pressure wave. The violence depends upon the quantity and rate of energy release.

    Numerous incidents have been reported in the literature (Refs. 1-12). Such explosions have occurred in the steel (Refs. 1-4), aluminum (Refs. 5,6), copper smelting (Ref. 5), paper (Refs. 7, 8), and nuclear industries (Refs. 9, 10).

    The mechanism that triggers or initiates the explosion is not known; however, two basic facts have been established:

    1. the causative mechanism is not due to chemical reaction (Ref. 13), and

    2. fragmentation of the sample material is usually involved.

    Both experimental results and analyses (Ref. 14) have shown that the heat-transfer rates required to release the observed energy from a smooth metal sample are several orders of magnitude higher than the maximum rates that can be obtained in laboratory studies. Thus it has been concluded by numerous investigators that fragmentation of the metal to generate large surface areas is required to obtain the observed explosion violence.


    B1.2   REPRESENTATIVE INCIDENTS INVOLVING STEAM EXPLOSIONS

    Explosive incidents periodically occurring in the paper and metal industries have been reported. Several such incidents have been summarized (Ref. 11) and are cited to demonstrate the magnitude of the destructive forces present and the physical circumstances leading to the incidents.


    B1.2.1   METAL INDUSTRY

    Explosive accidents are infrequent in the metal industry but when they do occur, the destruction is severe.


    B1.2.1.1   Mallory-Sharon Incident (Ref. 35).

    In 1954, a titanium arc-melting furnace, which was water-cooled, exploded at a plant in Ohio. Nine injuries included four fatalities and property damage was $30,000. The explosion was believed to result from water entering the melting crucible.


    B1.2.1.2   Reynolds Aluminum Incident (Ref. 35).

    In 1958, an aluminum-water explosion occurred in Illinois involving some 46 injuries, 6 fatalities and approximately $1,000,000 in property damage. The explosion "rocked a 25 mile" area. Wet scrap metal was being loaded into a furnace when the explosion was triggered.


    B1.2.1.3   Quebec Foundry Incident (Ref. 4).

    The accident occurred in a foundry building approximately 18 million cubic-foot volume.

    One hundred pounds of molten steel fell into a shallow trough containing about 78 gallons of water. The resulting explosion injured mill personnel (one fatally) and caused $150,000 damage to the foundry building including cracking a 20-inch concrete floor, breaking 6000 panes of glass, and structural damage to the walls and ceilings. Damage was also incurred [i.e. experienced] by another structure separated some 75 yards from the foundry building.

    This accident is one of the better documented incidents.


    B1.2.1.4   Western Foundries Incident (Ref. 36).

    In 1966, while 3000 pounds of molten steel was being poured from an electric furnace into a tile-lined dropped into a water filled pit. The result was a violent explosion that injured three workers and tore a 600-square-foot hole in the roof of a building of some 12,000-square-foot floor area. The explosion was heard some 3 miles from the foundry.

    B1.2.1.5   Armco Steel Incident (Refs. 37, 38).

    In 1967, an explosion occurred when molten steel fell on "damp" ground. A ladle containing some 30 tons of molten steel had been elevated some 40 feet when the ladle fell. Injuries sustained by some 30 workers included 6 fatalities. Evidently, sufficient moisture was present in the porous ground to trigger small-scale explosions that showered molten steel over a wide area.

    Although the injuries were attributed primarily to burns, an explosion accompanied the incident.


    B1.2.1.6   East German Slag Incident (Ref. 2).

    Appearing in 1959, an East German article discusses a number of slag-water explosions that have occurred in German open-hearth steel mills.

    Two accidents were discussed in which explosions resulted from spraying water on molten slag in open slag pits. One of the explosions resulted in a fatality and a number of other injuries. Severe structural damage was also noted. The second explosion was less severe. Both explosions were attributed to excess water in the slag passing down into the cracks to the hot molten material below.

    A third instance resulting in an explosion occurred when a slag pot was placed on a slag bed that had been previously sprayed with water. An explosion occurred, killing one man. The explosion was attributed to the heavy slag pot causing cracks in the surface of the hot slag bed and excess water on the surface getting into these cracks.

    Other explosions briefly described include rainwater leaking through an unsealed roof over a slag bed, resulting in an explosion, and two instances of explosions resulting when molten slag was poured into dump cars that had small amounts of water in the bottom.


    B1.2.1.7   British Slag Incident (Ref. 3).

    In 1964, an explosion occurred in a British steel mill when a ladle being used to tap a blast furnace was sprayed with lime water and returned to service. When it was next used, the ladle exploded when it was about three-fourths full of slag (12 to 14 tons). Damage to the structure and injuries to personnel were reported.


    B1.2.2   PAPER INDUSTRY

    The paper industry experiences explosions similar to those in the metal industry more frequently but they are less destructive. Explosions occur when paper smelt (mostly fused sodium carbonate with a few percent of sodium sulfide, sodium chloride, and minor ingredients) is quenched in large containers of "green liquor" (Refs. 7, 8).

    Also, explosions frequently occur when boiler tubes in waste-heat boilers fueled by "black liquor" fail, and water is injected into hot molten smelt and black liquor. These explosions occur with considerable destruction to the furnace and plant facilities.


    B1.2.3   NUCLEAR REACTOR INDUSTRY

    Explosive vapor formation when hot, molten core materials have come in contact with water have also been observed in nuclear reactors.

    B1.2.3.1   Canadian NRX Reactor (Ref. 35).

    In 1952, at Chalk River, Ontario, during a low-power experiment, a nuclear excursion was experienced. Although the duration of the incident was less than 62 seconds, the damage was sufficient to result in contamination of the facility. The [explosive] reaction between [molten]uranium and steam (or water) was the principal cause of damage.


    B1.2.3.2 Borax I Reactor (Ref. 35).

    In 1954, at the National Reactor Testing station in Idaho, the Borax I reactor was deliberately subjected to a potentially damaging power excursion in reactor safety studies: A power excursion lasting approximately 30 milliseconds produced a peak power of 19,000 megawatt-seconds.

    The power excursion melted most of the fuel elements. The reactor tank (1/2 inch steel) was ruptured by the pressure (probably in excess of 10,000 psi [pounds per square inch]) resulting from the reaction between the molten metal and the water.

    The sound of the explosion at the control station (1/2 mile away) was comparable to that from 1 to 2 pounds of 40 percent dynamite.


    B1.2.3.3   SPERT 1-D Reactor

    During the final test of the destructive test program with the SPERT 1-D core, damaging pressure generation was observed. Pressure transducers recorded the generation of a pressure pulse larger than 3000 psi which caused the destruction of the core.

    The pressure pulse occurred some 15 milliseconds after initiation of the power excursion. The power excursion rapidly overheated the fuel plates; the increased temperature melted the metal and the cladding of the fuel plates.

    After the transient, much of the fuel that had been molten was found dispersed in the coolant.


    B1.2.3.4   SL-1 Reactor

    In January, 1961, a nuclear excursion occurred in the SL-1 reactor in Idaho. The total energy released in the excursion was approximately 130 Mw-sec (Ref. 51). Of this, 50 Mw-sec was produced in the outer fuel elements in the core. This portion of the energy was slowly transferred to the water coolant over 2 sec period, and no melting (uranium-aluminum alloy) of the outer fuel elements occurred.

    About 50 to 60 megawatt-seconds of the total energy release was promptly released by 12 heavily damaged inner fuel elements to the water coolant in less than 30 milliseconds [a millisecond is 1 one thousandth of a second]. This prompt energy release resulted in rapid steam formation in the core which accelerated the water above the core and produced a water hammer that hit the pressure vessel lid. The vessel, weighing about 30,000 lbs with its internals, sheared its connecting piping and was lifted approximately 9 feet into the air by the momentum transferred from the water hammer.

    Calculations of the mechanical deformation of the vessel indicate that about 12 percent of the prompt energy release or 4.7 percent of the total nuclear release was converted into mechanical energy (Ref. 52).


    In each instance, under differing circumstances, a hot molten material fell, dropped, or spewed into a mass of cooler liquid and destructive pressure generation resulted. The complex mechanisms triggering this type of reaction are not completely understood.

    [ Accident Possibilities at Gentilly-2 ]

    [ Findings on CANDU Safety ]

    [ Reactor Accidents Sub-Directory ] [ COMPLETE DIRECTORY ]

    ccnr@web.net
    Since March 27th 1996, there have been over
    100,000 outside visits to the CCNR web site, plus

    (counter reset June 3rd 1998 at midnight)