Chapter 19. Reactor Safety and Security

It is well known that the accumulated fission products in a reactor that has been operating for some time constitute a potential source of radiation hazard. Assurance is needed that the integrity of the fuel is maintained throughout the operating cycle, with negligible release of radioactive materials. This implies limitations on power level and temperature and adequacy of cooling under all conditions. Fortunately, inherent safety is provided by physical features of the fission chain reaction. In addition, the choice of materials, their arrangement, and restrictions on modes of operation give a second level of protection. Devices and structures that minimize the chance of accident and the extent of radiation release in the event of accident are a third line of defense. Finally, nuclear plant location at a distance from centers of high population density results in further protection.

We will now describe the dependence of numbers of neutrons and reactor power on the multiplication factor, which is in turn affected by temperature and control rod absorbers. Then we will examine the precautions taken to prevent release of radioactive materials to the surroundings and discuss the philosophy of safety.

Thanks are due to Earl M. Page for suggestions on reactor safety and Robert M. Koehler on reactor design and operation.

19.1. Neutron Population Growth

The multiplication of neutrons in a reactor can be described by the effective multiplication factor k, as discussed in Chapter 11. The introduction of one neutron produces k neutrons; they in turn produce k², and so on. Such a behavior tends to be analogous to the increase in principal with compound interest or the exponential growth of the human population. The fact that k can be less than, equal to, or greater than 1 results in significant differences, however.

The total number of reactor neutrons is the sum of the geometric series 1 + k + k² + …. For k < 1 this is finite, equal to 1/(1 − k). For k > 1 the sum is infinite (i.e., neutrons multiply indefinitely). We thus see that knowledge of the effective multiplication factor of any arrangement of fuel and other material is needed to assure safety. Accidental criticality is prevented in a number of situations: (a) chemical processing of enriched uranium or plutonium, (b) storage of fuel in arrays of containers or of fuel assemblies, and (c) initial loading of fuel assemblies at time of startup of a reactor. A classic measurement involves the stepwise addition of small amounts of fuel with a neutron source present. The thermal neutron flux without fuel φ⁰ and with fuel φ is measured at each stage. Ideally, for a subcritical system with a nonfission source of neutrons in place, in a steady-state condition, the multiplication factor k appears in the relationAs k gets closer to 1, the critical condition, the flux increases greatly. On the other hand, the reciprocal ratiogoes to zero as k goes to 1. Plotting the measured flux ratio as it depends on the mass of uranium or the number of fuel assemblies allows increasingly accurate predictions of the point at which criticality occurs, as shown in Figure 19.1. Fuel additions are always intended to be less than the amount expected to bring the system to criticality.

Figure 19.1. Critical experiment.

Let us now examine the time-dependent response of a reactor to changes in multiplication. For each neutron, the gain in number during a cycle of time length ℓ is δk = k − 1. Thus for n neutrons in an infinitesimal time dt the gain dn = δk n dt/ℓ. This can be treated as a differential equation. For constant δk, the solution iswhere T is the period, the time for the population to increase by a factor e = 2.718…, given by T = ℓ/δk. When applied to people, the formula states that the population grows more rapidly the more frequently reproduction occurs and the more abundant the progeny.

A typical cycle time ℓ for neutrons in a thermal reactor is very short, approximately 10⁻⁵ s, so that a δk as small as 0.02 would give a very short period of 0.0005 s. The growth according to the formula would be exceedingly rapid, and, if sustained, would consume all of the atoms of fuel in a fraction of a second.

A peculiar and fortunate fact of nature provides an inherent reactor control for values of δk in the range 0 to approximately 0.0065. Recall that approximately 2.5 neutrons are released from fission. Of these, some 0.65% appear later as the result of radioactive decay of certain fission products and are thus called delayed neutrons. Quite a few different radionuclides contribute these, but usually six groups are identified by their different fractions and half-lives (see Exercise 19.12). The average half-life of the isotopes from which they come, taking account of their yields, is approximately 8.8 s. This corresponds to a mean life τ = t^H/0.693 = 12.7 s, as the average length of time required for a radioactive isotope to decay. Although there are very few delayed neutrons, their presence extends the cycle time greatly and slows the rate of growth of the neutron population. The effect of delayed neutrons on reactor transients has an analogy to the growth of principal in an investment, say at a bank. Imagine that the daily interest were mailed out to a client, who had to reinvest by sending the interest back. This “checks in the mail” process would cause principal to increase more slowly.

Then, to understand the mathematics of this effect, let β be the fraction of all neutrons that are delayed, a value 0.0065 for U-235; 1 − β is the fraction of those emitted instantly as “prompt neutrons.” They take only a very short time ℓ to appear, whereas the delayed neutrons take a time ℓ + τ. The average delay is thusNow because β = 0.0065 and τ = 12.7 s, the product is 0.083 s, greatly exceeding the multiplication cycle time, which is only 10⁻⁵ s. The delay time can thus be regarded as the effective generation time, . This approximation holds for values of δk much less than β. For example, let δk = 0.001, and use s in the exponential formula. In 1 second n/n⁰ = e^0.012 = 1.01, a very slight increase.

On the other hand, if δk is greater than β, we still find very rapid responses, even with delayed neutrons. If all neutrons were prompt, one neutron would give a gain of δk, but because the delayed neutrons actually appear much later, they cannot contribute to the immediate response. The apparent δk is then δk − β, and the cycle time is ℓ. We can summarize by listing the period T for the two regions.

Even though β is a small number, it is conventional to consider δk small only if it is less than 0.0065 but large if it is greater. Figure 19.2 shows the growth in reactor power for several different values of reactivity ρ, defined as δk/k. These curves were generated with the full set of delayed neutron emitters. Because k is close to 1, . We conclude that the rate of growth of the neutron population or reactor power is very much smaller than expected, so long as δk is kept well below the value β, but rapid growth will take place if δk is larger than β.

Figure 19.2. Effect of delayed neutrons.

We have used the value of β for U-235 for illustration but should note that its effective value depends on reactor size and type of fuel (e.g., β for Pu-239 is only 0.0021). Also, the value of the neutron cycle time depends on the energy of the predominant neutrons. The ℓ for a fast reactor is much shorter than that for a thermal reactor.

In the many hundreds of critical experiments and manipulations of nuclear fuel in processing plants, there have been serious criticality accidents, involving radiation exposure and several deaths. In the early days, fewer precautions were taken (see References for summary information). Even as late as 1999, an accident in Japan resulted from the addition of an excess of enriched uranium to a process vessel.

In Computer Exercises 19.A and 19.B we demonstrate the growth with time of the neutron population as it depends on reactivity. One equivalent delayed neutron group is used in 19.A; six groups are used in 19.B.

19.2. Assurance of Safety

The inherent nuclear control provided by delayed neutrons is aided by proper design of the reactor to favor certain negative feedback effects. These are reductions in the neutron multiplication factor resulting from increases in reactor power. With additional heat input the temperature increases, and the negative reactivity tends to shut the reactor down. Design choices include the size and spacing of fuel rods and the soluble boron content of the cooling water. One of the temperature effects is simple thermal expansion. The moderator heats up, it expands, the number density of atoms is reduced, and neutron mean free paths and leakage increase, whereas thermal absorption goes down. In early homogeneous aqueous reactors this was a dominant effect to provide shutdown safety. In heterogeneous reactors it tends to have the opposite effect in that reductions in boron concentration accompany reduction in water density. Thus there must be some other effect to override moderator expansion effects. The process of Doppler broadening of resonances provides the needed feedback. An increase in the temperature of the fuel causes greater motion of the uranium atoms, which effectively broadens the neutron resonance cross section curves for uranium shown in Figure 4.6. For fuel containing a high fraction of uranium-238 the multiplication decreases as the temperature increases. The Doppler effect is “prompt” in that it responds to the fuel temperature, whereas the moderator effect is “delayed” as heat is transferred from fuel to coolant. The use of the term “Doppler” comes from the analogy with frequency changes in sound or light when there is relative motion of the source and observer.

The amounts of these effects can be expressed by formulas such asin which the reactivity ρ is proportional to the temperature change ΔT, with a temperature coefficient α that is a negative number. For example, if the value of α is −10⁻⁵/ °C, a temperature rise of 20 °C would give a reactivity of −0.0002. Another relationship iswith a negative power coefficient a and fractional change in power ΔP/P. For example, in a pressurized water reactor (PWR) if a = −0.012, a 2% change in power would give a reactivity of −0.00024.

Temperature effects cause significant differences in the response of a reactor to disturbances. The effects were ignored in Figure 19.2, and the population grew exponentially, but if effects are included, as in Figure 19.3, the power flattens out and becomes constant.

Figure 19.3. Effect of temperture of power.

Even though a reactor is relatively insensitive to increases in multiplication in the region δk <β, and temperature rises provide stability, additional protection is provided in reactor design and operating practices. Part of the control of a reactor of the PWR type is provided by the boron solution (see Section 11.5). This “chemical shim” balances the excess fuel loading and is adjusted gradually as fuel is consumed during reactor life. In addition, reactors are provided with several groups of movable rods of neutron-absorbing material, as shown in Figure 19.4. The rods serve three main purposes: (a) to permit temporary increases in multiplication that brings the reactor up to the desired power level or to make adjustments in power; (b) to cause changes in the flux and power shape in the core, usually striving for uniformity; and (c) to shut down the reactor manually or automatically in the event of unusual behavior. To ensure effectiveness of the shutdown role, several groups of safety rods are kept withdrawn from the reactor at all times during operation. In the PWR they are supported by electromagnets that release the rods on interruption of current, whereas in the boiling water reactor (BWR) they are driven in from the bottom of the vessel by hydraulic means.

Figure 19.4. Reactor control.

The reactivity worth of control and safety rods as a function of depth of insertion into the core can be measured by a comparison technique. Suppose a control rod in a critical reactor is lifted slightly by a distance δz and a measurement is made of the resulting period T of the rise in neutron population. By use of the approximate formula from Section 19.1,we deduce the relation of δk to δk. The reactor is brought back to critical by an adjustment of the soluble boron concentration. Then the operation is repeated with an additional shift in rod position. The experiment serves to find both the reactivity worth of the rod as a function of position and, by summation, the total worth of the rod. Figure 19.5 shows the calibration curves of a control rod in an idealized case of a core without end reflectors. It is noted that the effect of a rod movement in a reactor depends strongly on the location of the tip. The basis for the S-shaped curves of Figure 19.5 is found in reactor theory, which tells us that the reactivity effect of an added absorber sample to a reactor is approximately dependent on the square of the thermal flux that is disturbed. Thus if a rod is fully inserted or fully removed, such that the tip moves in a region of low flux, the change in multiplication is practically zero. At the center of the reactor, movement makes a large effect. The slope of the curve of reactivity vs. rod position when the tip is near the center of the core is twice the average slope in this simple case.

Figure 19.5. Control rod worth as it depends on depth of insertion in an unreflected reactor core.

Estimates of total reactivity worth can also be made by the rod-drop technique. A control rod is allowed to fall from a position outside the core to a full-in position. The very rapid change of neutron flux from an initial value φ⁰ to a final value φ¹ is shown in Figure 19.6. Then the reactivity worth is calculated from the formula

Figure 19.6. Neutron flux variation with time in the rod-drop method of measuring reactivity.

The result somewhat depends on the location of the detector.

An instrumentation system is provided to detect an excessive neutron flux and thus power level to provide signals calling for a “trip” of the reactor. As sketched in Figure 19.4, independent detectors are located both inside the core and outside the reactor vessel. Data from core detectors are processed by a computer to determine whether or not power distributions are acceptable.

Because almost all of the radioactivity generated by a reactor appears in the fuel elements, great precautions are taken to ensure the integrity of the fuel. Care is taken in fuel fabrication plants to produce fuel pellets that are identical chemically, of the same size and shape, and of common U-235 concentration. If one or more pellets of unusually high fissile material content were used in a reactor, excessive local power production and temperature would result. The metal tubes that contain the fuel pellets are made sufficiently thick to stop the fission fragments, to provide the necessary mechanical strength to support the column of pellets, and to withstand erosion by water flow or corrosion by water at high temperatures. Also, the tube must sustain a variable pressure difference caused by moderator-coolant outside and fission product gases inside. The cladding material usually selected for low neutron absorption and for resistance to chemical action, melting, and radiation damage in thermal reactors is zircaloy, an alloy that is approximately 98% zirconium with small amounts of tin, iron, nickel, and chromium. The tube is formed by an extrusion process that eliminates seams, and special fabrication and inspection techniques are used to ensure that there are no defects such as deposits, scratches, holes, or cracks.

Each reactor has a set of specified limits on operating parameters to ensure protection against events that could cause hazard. Typical of these is the upper limit on total reactor power, which determines temperatures throughout the core. Another is the ratio of peak power to average power that is related to hot spots and fuel integrity. Protection is provided by limiting the allowed control rod position, reactor imbalance (the difference between power in the bottom half of the core and the top half), reactor tilt (departure from symmetry of power across the core), maximum reactor coolant temperature, minimum coolant flow, and maximum and minimum primary system pressure. Any deviation causes the safety rods to be inserted to trip the reactor. Maintenance of chemical purity of the coolant to minimize corrosion, limitation on allowed leakage rate from the primary cooling system, and continual observations on the level of radioactivity in the coolant serve as further precautions against release of radioactive materials.

Protection of fuel against failure that would release fission products into the coolant is thus an important constraint in the operation of a reactor. Correct choices must be made of the enrichment of U-235, the operating power level, the length of time between refuelings, and the arrangement of new and partially burned fuel, all with an eye on cost.

The term “burnup” is widely used. Take a typical cubic centimeter of fuel and let all fission be due to U-235. The macroscopic fission cross section is Σ^f, the fission rate in a neutron flux φ is f = φΣ^f, and the power density is p = fw, where w is the energy per fission. The energy produced in a time t is W = pt. Now the density of uranium is d = N^Um^U, where N^U and m^U are the number density and mass of a uranium atom, respectively. The burnup in watt-seconds per gram is then B = W/d. A numerical factor allows easy conversion to MWd/tonne. As shown in Exercise 19.13, B can be shown to depend on the enrichment in U-235, expressed as the ratio N²³⁵/N^U.

In Section 11.5 we examined the trends in fuel and control boron for a reactor visualized as a single region. Modern power reactor cores consist of several regions. At the start of an operating cycle, it will contain fresh and partially burned fuel; at the end, partially and fully burned fuel.

For a reactor core with n zones, let kⁱ be the multiplication constant of fuel in zone i and assume nearly equal power over the core. Then the average k is

It has been found that kⁱ varies with burnup according towhere B is the burnup in megawatt-days per metric ton (MWd/tonne), k⁰ is the initial multiplication constant, and a is a constant.

The amount of control absorber required to keep the reactor critical is a measure of the average k of the core. Figure 19.7 shows its variation with time for different numbers of zones. As noted, the larger is n, the smaller is the initial control absorber.

Figure 19.7. Reactor operation with different numbers of fuel zones. The initial control absorber varies inversely with the number of regions.

A little algebra shows us (see Exercise 19.14) that the discharge burnup of fuel depends on the number of zones. Letting B(1) be that for one zone, the burnup for n zones is

Thus B(2) = (4/3)B(1), B(3) = (3/2)B(1), etc. For very large n, corresponding to continuous refueling as in the Canadian reactors, the burnup turns out to be twice B(1).

In the foregoing paragraphs we have alluded to a few of the physical features and procedures used in the interests of safety. These have evolved from experience over a number of years, and much of the design and operating experience has been translated into widely used standards, which are descriptions of acceptable practice. Professional technical societies, industrial organizations, and the federal government cooperate in the development of these useful documents.

In addition, requirements related to safety have a legal status, because all safety aspects of nuclear systems are rigorously regulated by federal law and administered by the United States Nuclear Regulatory Commission (NRC). Before a prospective owner of a nuclear plant can receive a permit to start construction, he or she must submit a comprehensive preliminary safety analysis report (PSAR) and an environmental impact statement. On approval of these, a final safety analysis report (FSAR), technical specifications, and operating procedures must be developed in parallel with the manufacture and construction. An exhaustive testing program of components and systems is carried out at the plant. The documents and test results form the basis for an operating license.

Throughout the analysis, design, fabrication, construction, testing, and operation of a nuclear facility, adequate quality control (QC) is required. This consists of a careful documented inspection of all steps in the sequence. In addition, a quality assurance (QA) program that verifies that quality control is being exercised properly is imposed. Licensing by the NRC is possible only if the QA program has satisfactorily performed its function. During the life of the plant, periodic inspections of the operation are made by the NRC to ascertain whether or not the owner is in compliance with safety regulations, including commitments made in Technical Specifications and the FSAR.

19.3. Emergency Core Cooling and Containment

The design features and operating procedures for a reactor are such that under normal conditions a negligible amount of radioactivity will get into the coolant and find its way out of the primary loop. Knowing that abnormal conditions can exist, the worst possible event, called a design basis accident, is postulated. Backup protection equipment, called engineered safety features, is provided to render the effect of an accident negligible. A loss of coolant accident (LOCA) is the condition typically assumed, in which the main coolant piping somehow breaks and thus the pumps cannot circulate coolant through the core. Although in such a situation the reactor power would be reduced immediately by use of safety rods, there is a continuing supply of heat from the decaying fission products that would tend to increase temperatures above the melting point of the fuel and cladding. In a severe situation, the fuel tubes would be damaged and a considerable amount of fission products released. To prevent melting, an emergency core cooling system (ECCS) is provided in water-moderated reactors, consisting of auxiliary pumps that inject and circulate cooling water to keep temperatures down. Detailed analysis of heat generation and transfer is required in an application to the NRC for a license to operate a nuclear power plant (see References). The operation of a typical ECCS can be understood by study of some schematic diagrams.

The basic PWR system (Figure 19.8) includes the reactor vessel, the primary coolant pump, and the steam generator, all located within the containment building. The system actually may have more than one steam generator and pump—these are not shown for ease in visualization. We show in Figure 19.9 the auxiliary equipment that constitutes the engineered safety (ES) system. First is the high-pressure injection system, which goes into operation if the vessel pressure, expressed in pounds per square inch (psi), drops from a normal value of approximately 2250 psi to approximately 1500 psi as the result of a small leak. Water is taken from the borated water storage tank and introduced to the reactor through the inlet cooling line. Next is the core flooding tank, which delivers borated water to the reactor through separate nozzles in the event a large pipe break occurs. Such a rupture would cause a reduction in vessel pressure and an increase in building pressure. When the vessel pressure becomes approximately 600 psi, the water enters the core through nitrogen pressure in the tank. Then if the primary loop pressure falls to approximately 500 psi, the low-pressure injection pumps start to transfer water from the borated water storage tank to the reactor. When this tank is nearly empty, the pumps take spilled water from the building sump as a reservoir and continue the flow through coolers that remove the decay heat from fission products. Another feature, the building spray system, also goes into operation if the building pressure increases above approximately 4 psi. It takes water from the borated water storage tank or the sump and discharges it from a set of nozzles located above the reactor to provide a means for condensing steam. At the same time, the emergency cooling units of the reactor building are operated to reduce the temperature and pressure of any released vapor, and reactor building isolation valves are closed on unnecessary piping to prevent the spread of radioactive materials outside the building.

Figure 19.8. Reactor containment.

Figure 19.9. Emergency core cooling system. Pumps: HP, high pressure; LP, low pressure; RBS, reactor building spray.

We can estimate the magnitude of the problem of removing fission product heat. For a reactor fueled with U-235, operated for a long time at power P⁰ and then shut down, the power associated with the decay of accumulated fission products is P^f(t), given by an empirical formula such as

For times greater than 10 s after reactor shutdown, the decay is represented approximately by use of A = 0.066 and a = 0.2. We find that at 10 s the fission power is 4.2% of the reactor power. By the end of a day, it has dropped to 0.68%, which still corresponds to a sizable power, viz., 20 MW for a 3000-MWt reactor. The ECCS must be capable of limiting the surface temperature of the zircaloy cladding to specified values (e.g., 2200 °F), of preventing significant chemical reaction, and of maintaining cooling over the long term after the postulated accident.

The role of the steel-reinforced concrete reactor building is to provide containment of fission products that might be released from the reactor. It is designed to withstand internal pressures and to have a very small leak rate. The reactor building is located within a zone called an exclusion area, of radius of the order of half a kilometer, and the nuclear plant site is several kilometers from any population center.

A series of experiments called Loss of Flow Tests (LOFT) were done at Idaho Falls to check the adequacy of mathematical models and computer codes related to LOCA/ECCS. A double-ended coolant pipe break was introduced and the ability to inject water against flow reversal and water vapor determined. Tests showed that peak temperatures reached were lower than predicted, indicating conservatism in the calculation methods.

19.4. Probabilistic Risk Assessment

The results of an extensive investigation of reactor safety were published in 1975. The document is variously called “Reactor Safety Study,” “WASH-1400,” or “Rasmussen Report,” after its principal author. The study (see References) involved 60 scientists and cost several million dollars. The technique used was probabilistic risk analysis (PRA), a formal method of analyzing reactor systems. The objective is to find the chance of an undesired event such as core damage, breach of containment, or release of radioactivity, and to determine potential causes. The first step is to investigate all of the possible faults in the equipment or processes. Flow diagrams of fluid systems and circuit diagrams of electrical systems serve as reference. Event trees are logic diagrams relating an initiating event to either successful mitigation or failure. Figure 19.10 shows a simple event tree. Probabilities of success and failure at each branch are applied. The principal logic diagrams are the fault trees, which trace causes and effects mathematically by use of Boolean algebra, a form of set theory. Figure 19.11(A) shows a simple high-pressure injection system to which we can apply the concept for illustration. The failure of both pumps and/or the valve prevents cooling water to reach the reactor. In Figure 19.11(B) the fault tree diagram shows two types of “gate,” the AND that requires two or more events to result in failure, and the OR that requires only one event. We have attached symbols A, B, C, F, and T to the various events for use in the mathematical manipulation. Note that F occurs if both A and B occur, expressed in Boolean algebra asan intersection. Also, T occurs if either C or F occurs, expressed asa union. Theory (e.g., Lewis in References) tells us what the probability of T is in terms of C and F, viz.,

Figure 19.10. Simple event tree (After NUREG/CR-4350, Vol.1).

Figure 19.11. Simple example of PRA diagrams (after NUREG-0492).

Insert the formula for F and note that because A, B, and C are independent events, the probabilities and are simply products of the separate probabilities. Thus,

The virtue of Boolean algebra is seen by comparison of this formula with the statement in words that the probability of failure of the high-pressure injection system is the sum of the probabilities of individual failures of the valve and the pumps less the probability of failure of both valves and pumps, which was included already. To illustrate numerically, let event probabilities P(A) and P(B) be 10⁻³ and P(C) be 10⁻⁴. Inserting numbers,which shows that the top event is dominated by the possibility of valve failure. The product of three probabilities can be neglected assuming rare events. The numerical result illustrates two ideas—that fault trees can reveal potential vulnerabilities and that redundancy in safety equipment is beneficial. The figure calculated can be included in the simple event tree of Figure 19.10.

Several good books on fault trees are listed in References. Among important topics discussed in those references are: Venn diagrams, used to visualize relationships of intersections and unions; conditional probability, related to sequences of events; the Bayes theorem, a technique for updating failure probability data; and common cause failures, those where several components can fail from a single cause.

The ultimate objective of PRA is to calculate risks to people calculated by use of a principle most simply stated as

For reactors, frequency means the number of times per year of operation of a reactor that the incident is expected to occur, and consequences means the number of fatalities, either immediate or latent. The technique of PRA is used to determine which changes in equipment or operation are most important to ensure safety and also give guidance on emergency plans.

In recent years the regulation of nuclear activities including reactor operation and handling of radioisotopes has changed. Currently, regulations are risk-informed and performance-based, in contrast with previous prescriptive approaches. As discussed in an American Nuclear Society position statement (see References), risk-informed implies use of probability in prioritizing challenges to safety, and performance-based makes use of measurable safety parameters. Fuller explanations are found in a publication of the NRC (see References).

If an incident occurring at a nuclear plant has the potential of releasing radioactivity to the atmosphere, a chain of reactions to alert or warn the public is set in motion. The NRC and the Federal Emergency Management Agency (FEMA) cooperate in providing requirements and in monitoring tests of readiness. Each nuclear station and the state in which it is located are required to have emergency plans in place and to hold drills periodically, resembling action to be taken in a real accident situation. In such exercises, state and local officials are notified, and an emergency team made up of many organizations makes a coordinated response. Included are radiation protection staff, police and fire departments, highway patrol, public health officers, and medical response personnel. Command posts are set up; weather observations are correlated with radiation conditions to evaluate the possible radiation exposure of the public. Advisories are sent out by radio, sirens are sounded, and the public is advised to take shelter in homes or other buildings. In extreme cases people would be urged to evacuate the affected area.

In case of actual accident involving reactors or transportation of fuel or waste, members of the public who suffer a loss can be compensated. The Price-Anderson Act was passed by Congress in 1957 to provide rules about nuclear insurance that were favorable to the development of the nuclear industry. The Act was renewed in 2005 for 20 y. Nuclear plants are required to take out insurance from private companies in the amount of $300 million. In the event of an accident, all reactors would be assessed to bring the total liability to approximately $10 billion. The Act has been criticized as unfairly benefiting the nuclear industry because any excess cost would be borne by government and thus taxpayers.

19.5. The Three Mile Island Accident and Lessons Learned

On March 28, 1979, an accident occurred in the reactor Three Mile Island (TMI) Unit 2 near Harrisburg, Pennsylvania. A small amount of radioactivity was released, causing great alarm throughout the region. We briefly review with Figure 12.7 what happened at TMI and the resultant improvements in reactor safety.

The steam generator's feedwater system malfunctioned, causing the turbine generator to trip and control rods to go into the core to reduce power. Backup feedwater pumps failed to operate because a valve to the steam generator had been left closed by mistake. The steam generator dried causing the primary water coolant temperature and pressure to increase. This caused a relief valve on the pressurizer to open and stay stuck open. Core water escaped to a quench tank that in turn released radioactive water to the containment building and then to an auxiliary building. The ECCS actuated. Operators thought the pressurizer was full of water and shut off the ECCS and later the coolant pumps. The core heated up and became uncovered. Decay heat caused major damage to the fuel.

Radioactive gases were detected outside the containment building. The radiation dosage to anyone was estimated to be less than 100 mrem. This was based on assumed continuous exposure outdoors at the site boundary for 11 days. The average exposure to people within 50 miles was estimated to be only 11 mrems, noted to be less than that caused by a medical X-ray. As a result of a warning by the governor of Pennsylvania, many people, especially pregnant women, left the area for several days. Estimates published by the Department of Health, Education, and Welfare indicate that the exposure over the lifetimes of the 2 million people in the region there would be statistically only one additional cancer death (of 325,000 from other causes).

The TMI accident was due to a combination of (a) design deficiency—inadequate control of water and insufficient instrumentation, (b) equipment failure—the stuck pressurizer valve, and (c) operator error—especially turning off the ECCS and the pumps. Some would view the event as proof that reactors are unsafe; others would note that even with core damage little radioactivity was released. Before the TMI-2 accident, the movie “China Syndrome” had been released. It focused on a hypothetical accident in which the whole core is assumed to melt its way through the reactor vessel and go on in the earth toward China. No such scenario is valid, but public fears were aroused.

A recovery program for TMI was initiated. The interior of the reactor pressure vessel was examined by use of miniature TV cameras attached to the ends of long cables inserted from the top. The damage was greater than originally thought. The upper 5 feet of the core was missing, having slumped into the portion below, and solidified molten fuel was found in the lower part of the vessel. Special handling tools were devised to extract the damaged fuel. Care was taken by measurements and analysis to ensure that the debris would not go critical during recovery. The fuel was transferred to a series of always-safe canisters for storage and shipment.

President Jimmy Carter took a keen interest in the accident. He created The President's Commission on the Accident at Three Mile Island (called the Kemeny Commission after its chairman, John Kemeny, president of Dartmouth College). It was composed of qualified people without nuclear industry connections. A number of recommendations were made in its report, including the need for the nuclear industry to enhance operator and supervisor training, to set its own standards of excellence, and to conduct performance evaluations. Insights on the Kemeny Commission are found in References. In cooperation with utility leaders such as Duke Power's Bill Lee, many of the recommendations were implemented. One of the most significant outcomes of the TMI accident was the formation by the industry of the Institute of Nuclear Power Operations (INPO). This organization reviews all aspects of the performance of United States nuclear power plants and provides recommendations for improvements. Details of the function of INPO are found in Section 23.6. Shortly after the TMI-2 accident the NRC requested that utilities take a number of corrective actions to improve safety. In anticipation of NRC's expectations the industry conducted a study called Industry Degraded Core Rulemaking (IDCOR). Its purpose was to provide well-documented databases on reactor safety. It was concluded that fission product releases would be much lower than those predicted by the Safety Study (Section 19.4). This discrepancy prompted new studies of the “source term,” the radioactive release in case of accident.

A second study sponsored by NRC was described in report BMI-2104. New computer codes by Battelle Memorial Institute were applied to all processes, giving an improvement over the Safety Study. Risks were found to be dependent on containment design. Other studies were made by the American Nuclear Society and by the American Physical Society. The general conclusion was that source terms were lower because of particle retention at containment wall.

Figure 19.12 illustrates the improvement in going from WASH-1400 to BMI-2104 for one example reactor, the Surry Nuclear Station of Virginia Electric Power Company. The interpretation of the lower curve is as follows: the chance for as many as one early fatality is seen to be less than 10⁻⁶ per reactor year^[†]. If one selects a larger number of fatalities, for example 200, the chance drops by a factor of approximately 5000. However, the chance of latent cancer fatalities is quoted to be larger, 3.4 × 10⁻³ per reactor year. This still corresponds to a prediction of less than one death per year for the more than 100 United States reactors.

^† Many do not understand the terminology used by reactor safety analysts (e.g., “a 10⁻⁶ chance per year of harm”). Norman Rasmussen, after which the Report (Section 19.4) was named, remarks, “For most people, a rare event is one that occurs once in a lifetime, like Halley's comet, frequency 10⁻². Once in 100 lifetimes is 10⁻⁴, that's getting hard to believe.”

Figure 19.12. Distribution function for the Surry, Virginia, plant. The probabilities for various numbers of early fatalities are shown

(Adapted from NUREG-0956).

When the findings on source term are used in establishing emergency plans, evacuation of people from a large area surrounding a damaged plant would be an inappropriate action. Over the period 1985–2001 the NRC carried out a program called Individual Plant Examination (IPE) to seek out vulnerabilities and report them. PRA was the only way to accomplish that. No significant problems were uncovered.

19.6. The Chernobyl Accident

On April 26, 1986, a very serious reactor accident occurred at the Chernobyl^[‡] reactor near Kiev in the U.S.S.R. Ukraine. An explosion took place that blew a hole in the roof of the building housing the reactor, the graphite moderator caught fire, and a large amount of radioactive material from the damaged nuclear fuel was released into the atmosphere. The amount of radiation exposure to workers and the public is not precisely known, but the doses exceeded the fallout from earlier weapons tests. A number of workers were killed, nearby towns were contaminated, and it is estimated that the collective dose to the public increased the cancer risk. A number of people were evacuated from the town of Pripyat. Agriculture was disrupted in the Soviet Union, and a ban on food imports was imposed by several European countries.

^‡ Ukraine prefers the spelling “Chornobyl” but we will use the more familiar form.

The Chernobyl reactor Unit 3 was of the type labeled RBMK. The core was cylindrical, 7 m high, 12 m diameter. Moderator graphite blocks were pierced by vertical holes to hold pressure tubes. These contained slightly enriched UO² fuel rods and ordinary water coolant. Figure 19.13 shows the reactor and its building.

Figure 19.13. The Chernobyl reactor and building before the 1986 accident.

An experiment related to the electrical supply in case of emergency was being performed. A separate group had planned the experiment. Operators were under pressure to complete the test because the next available maintenance period was over a year away. The power was to be reduced from 3200 MWt to approximately 700 MWt, but the operators allowed it to drop to 30 MWt. There, the neutron flux was too low to burn out accumulated xenon-135. The buildup of absorber made it very difficult to raise the power, and only 200 MWt could be reached. In violation of rules, most of the control rods were pulled out. Coolant flow was reduced to a point where steam voids were created. The RBMK had a positive void coefficient of reactivity, in contrast with that of light water reactors (LWRs). The reactivity caused by steam caused the power to flash up to 30,000 MWt, 10 times the operating level. The power could not be reduced because the rods were too far out to have an effect.

The excess energy pulverized fuel, caused steam pressure to build, and ruptured coolant tubes. Chemical reactions involved steam, graphite, zirconium, and fuel, creating heat that vaporized fuel and set the graphite afire. The explosion blew off the roof of the building housing the reactor and released some 80 million curies of activity, including cesium-137, iodine-131, noble gases, and fission products. A radioactive cloud passed over several countries of Europe, but activity was detected worldwide. Food crops had to be discarded because of contamination.

A total of 203 operating personnel, firefighters, and emergency workers were hospitalized with radiation sickness, 31 of whom died. Their exposures ranged from 100 rems to as high as 1500 rems. Thousands of people were evacuated, many of whom were permanently relocated, with great cost and undoubtedly much distress. A total of 135,000 people were evacuated from a 30-km zone, including 45,000 from the town of Pripyat. Most of those in the evacuation zone received less than 25 rem. With the total estimated dose of 1.6 million person-rems, an increase of up to 2% in cancer deaths over the next 70 y would be predicted. The exposure outside the U.S.S.R. was considerably less, being only several times natural background radiation.

A structure called a sarcophagus was erected around the damaged reactor in an effort to prevent future releases of radioactivity. There is evidence of deterioration, with the possibility of in-leakage of rainwater.

Several implications of the accident were noted: (a) The RBMK reactor type is inherently unsafe and should be phased out. (b) Reactor safety philosophy and practice needs to be revised with greater attention to human factors and safety systems. (c) International cooperation and information exchange should be strengthened. (d) Reactor accidents have global significance. (e) Users of LWRs need to examine equipment and practices, even though the reactors are far safer with their negative power coefficients and strong containment buildings. (f) The consequences of the Chernobyl accident should continue to be monitored.

One consequence of the accident was the formation of a set of joint research projects between the United States and the Russian Federation. These emphasized databases, computer codes, and the development of a plan for Russian nuclear safety research.

At the tenth, fifteenth, and twentieth anniversaries of the Chernobyl accident, reviews were made to assess consequences. It was noted in 1999 that radioactivity persisted, with damage to plants and animals. People were seriously afflicted with anxiety. In 2001 a series of 20 lessons learned was presented, with emphasis on financial and social effects (see References). In 2006 note was made of the thousands of childhood thyroid cancers, with treatment generally successful. Total cancer mortality in the population was estimated to be a few percent. Decommissioning of Unit 4 was deemed of high priority (see References).

19.7. Philosophy of Safety

The subject of safety is a subtle combination of technical and psychological factors. Regardless of the precautions that are provided in the design, construction, and operation of any device or process, the question can be raised “Is it safe?” The answer cannot be a categorical “yes” or “no” but must be expressed in more ambiguous terms related to the chance of malfunction or accident, the nature of protective systems, and the consequences of failure. This leads to more philosophical questions such as “How safe is safe?” and “How safe do we want to be?”

In an attempt to answer such questions, the NRC adopted in 1986 what are called safety goals. These are intended to free neighbors of nuclear plants from worry. Regulations are “… to provide reasonable assurance …” that a severe core accident will not occur at a United States nuclear plant.” Design and operation are to be such that risks of death from a nuclear accident are no greater than a thousandth of known and accepted risks. The comparison is to be made with other common accidents for those people living within a mile of the plant and with cancer from all causes for those living within 10 miles.

Every human endeavor is accompanied by a certain risk of loss, damage, or hazard to individuals. In the act of driving an automobile on the highways, or in turning on an electrical appliance in the home, or even in the process of taking a bath, one is subject to a certain danger. Everybody agrees that the consumer deserves protection against hazard outside his personal control, but it is not at all clear as to what lengths it is necessary to go. In the absurd limit, for instance, a complete ban on all mechanical conveyances would ensure that no one would be killed in accidents involving cars, trains, airplanes, boats, or spacecraft. Few would accept the restrictions thus implied. It is easy to say that reasonable protection should be provided, but the word “reasonable” has different meanings among people. The concept that the benefit must outweigh the risk is appealing, except that it is very difficult to assess the risk of an innovation for which no experience or statistical data are available or for which the number of accidents is so low that many years would be required for adequate statistics to be accumulated. Nor can the benefit be clearly defined. A classic example is the use of a pesticide that ensures protection of the food supply for many, with finite danger to certain sensitive individuals. To the person affected adversely, the risk completely overshadows the benefit. The addition of safety measures is inevitably accompanied by increased cost of the device or product and the ability or willingness to pay for the increased protection varies widely among people.

It is thus clear that the subject of safety falls within the scope of the social-economic-political structure and processes and is intimately related to the fundamental conflict of individual freedoms and public protection by control measures. It is presumptuous to demand that every action possible should be taken to provide safety, just as it is negligent to contend that because of evident utility, no effort to improve safety is required. Between these extreme views, there remains an opportunity to arrive at satisfactory solutions, applying technical skill accompanied by responsibility to assess consequences. It is most important to provide understandable information on which the public and its representatives can base judgments and make wise decisions as to the proper level of investment of effort and funds.

19.8. Nuclear Security

Protection of nuclear facilities from adverse actions has always been regarded as important, but the terrorist attacks on the United States on September 11, 2001, prompted a need for significant enhancement of security.

The NRC defined the “design basis threat” (DBT), which involves the number of attackers, their weapons capability, and probable mode of action on the basis of intelligence gathered. A ground-based threat is assumed to be by a well-armed, well-trained, suicidal group that uses vehicles and explosives.

The nuclear industry spent well over a billion dollars to extend security at power plants. Included were improved training and arming of security guards, additional physical barriers, better intrusion surveillance and detection, stronger access controls, institution of protection of plant computer systems, and improved background checks of plant employees.

An innovation called “force-on-force” exercises was required by NRC. At a plant, the roles of attacker and responder are played, with reviews of performance. At nuclear plants in the United States some 8000 security officers are available to counter a ground threat. Physical barriers are erected between three zones labeled “owner controlled,” “protected,” and “vital.”

After 9/11, concern was expressed about the possibility of an aircraft attack on nuclear facilities. A report on the effects was prepared in 2002 by the Electric Power Research Institute (EPRI). The selected aircraft was the Boeing 767 with wing span 170 feet, larger than the diameter of a typical containment building of 140 feet. A low speed of 350 mph was assumed because of the difficulty in precision flying near the ground. The containment was composed of steel-reinforced concrete approximately 4 feet thick, designed to be impervious to natural disasters such as hurricanes, tornadoes, earthquakes, and floods. Its curved surface prevents a full impact of the airplane. Conservative assumptions were made to give the maximum force. The result of the analyses was that the containment was not breached, so no parts of the plane entered the building. The report also concluded that fuel storage pools, dry storage units, and shipping casks would be safe against air attack. The targets would be very near the ground, requiring a sharp dive of the airplane, with only a glancing blow.

The subject was addressed by the 9/11 Commission (National Commission of Terrorists Attacks Upon the United States). The July 2004 report concluded that there was adequate protection against airplanes.

19.9. Summary

Prevention of release of radioactive fission products and fuel isotopes is the ultimate purpose of safety features. Inherent reactor safety is provided by delayed neutrons and temperature effects. Control rods permit rapid shutdown, and reactor components are designed and constructed to minimize the chance of failure. Emergency core cooling equipment is installed to reduce the hazard in the event of an accident. Licensing is administered by the Nuclear Regulatory Commission, which expects plants to use probabilistic safety risk analysis (PRA).

An accident at Three Mile Island Unit 2 in 1979 resulted in considerable damage to the reactor core but little radioactive material was released. The event stimulated the nuclear industry to make many changes that enhance reactor safety.

A serious accident occurred in 1986 at Chernobyl, U.S.S.R. As a result of an unauthorized experiment, there was an explosion and fire, accompanied by the release of a great deal of radioactivity. Nearby cities were evacuated, a number of people were killed, and many received significant dosage.

Security at nuclear plants was greatly enhanced after 9/11. A study indicates that terrorist aircraft do not pose a problem.

19.10. Exercises

1. (a) If the total number of neutrons from fission by thermal neutrons absorbed in U-235 is 2.42, how many are delayed and how many are prompt? (b) A reactor is said to be “prompt critical” if it has a positive reactivity of β or more. Explain the meaning of the phrase. (c) What is the period for a reactor with neutron cycle time 5 × 10⁻⁶ s if the reactivity is 0.013? (d) What is the period if instead the reactivity is 0.0013?
2. A reactor is operating at a power level of 250 MWe. Control rods are removed to give a reactivity of 0.0005. Noting that this is much less than β, calculate the time required to go to a power of 300 MWe, neglecting any temperature feedback.
3. Measurements of the fast neutron cycle time ℓ were made on EBR-I, the first reactor to produce electricity. Calculate its value in two different ways: (a) With the ratio β/ℓ, called the Rossi-α, with a value of 1.74 × 10⁵/s and β of 0.0068; (b) With a rough formula ℓ = l/(υ Σ^a) with an average energy of 500 keV neutrons. At that energy, σ^c = 0.1 barn and σ^f = 0.62 barn. Note N^U = 0.054 (in units of 10²⁴), υ = 2200 m/s for E = 0.0253 eV.(Thanks are due Professor Robert Busch for this exercise and its answers.)
4. During a critical experiment in which fuel is initially loaded into a reactor, a fuel element of reactivity worth 0.0036 is suddenly dropped into a core that is already critical. If the temperature coefficient is −9 × 10⁻⁵/ °C, how high will the temperature of the system go above room temperature before the positive reactivity is canceled out?
5. How long will it take for a fully withdrawn control rod in a reactor of height 4 m to drop into a reactor core neglecting all friction and buoyancy effects? (Recall with g = 9.8 m/s².)
6. Calculate the ratio of fission product power to reactor power for four times after shutdown—1 day, 1 week, 1 month, and 1 year, with the approximation A = 0.066, a = 0.2.
7. A reactivity of −0.0025 caused by Doppler effect results when the thermal power goes from 2500 MW to 2800 MW. Estimate the contribution of this effect on the power coefficient for the reactor.
8. Assuming a probability of reactor core meltdown of 3 × 10⁻⁴ per reactor year, calculate the chance of one meltdown for 100 reactors in a period of 20 y.
9. Counting rates for several fuel addition steps in a critical experiment are listed below.

    

   Number of Fuel Assemblies	Counting Rate (Counts/min)
   0	200
   50	350
   100	800
   125	1,600
   140	6,600
   150	20,000

   At the end of each fuel addition, what is the estimated critical number of assemblies? Was the addition always less than the amount expected to make the array critical?
10. When a control rod is raised 4 cm from its position with tip at the center of a critical reactor, the power rises on a period of 200 s. With a value β = 0.008 and τ = 13 s, estimate the δk produced by the rod shift and the slope of the calibration curve Δk/Δz. Estimate the rod worth if the core height is 300 cm.
11. Measurements are made of the periods of power rise in a research reactor of height 24 inches for shifts in control rod position. From the periods, values are obtained for the slope of the reactivity Δρⁱ/Δzⁱ, with units percent per inch, as listed below:

     

    i	zi	Δρi /Δzi	i	zi	Δρi /Δzi
    1	0	0.02	10	12.5	1.03
    2	3	0.16	11	13	1.08
    3	5.5	0.38	12	14	1.02
    4	7.5	0.68	13	15	0.95
    5	9	0.83	14	16.5	0.77
    6	10	0.89	15	18.5	0.40
    7	11	0.96	16	21	0.11
    8	11.5	0.98	17	24
    9	12	1.02

    Plot the slope against average position . Pass a smooth curve through the points, then find the area under the curve as a function of z. Estimate the rod worth when the tip is 16 inches up from the bottom.
12. Commonly used fractions and half-lives of the nuclides that are delayed neutron emitters for thermal neutron fission in uranium-235 are as follows:

     

    Group I	Fraction βi	Half-life (tH)i
    1	0.000247	54.51
    2	0.001385	21.84
    3	0.001222	6.00
    4	0.002645	2.23
    5	0.000832	0.496
    6	0.000169	0.179

    Verify that the total fraction is 0.0065 and that the average half-life is approximately 8.8 s.
13. (a) Show that a megawatt per tonne is the same as a watt per gram. (b) Show that the burnup in MWd/tonne is given by the formulawhere the enrichment isand(c) Calculate B for a flux of 2 × 10¹³/cm²-s for three years with enrichment 0.03. Note m^U = 395 × 10⁻²⁴ grams, σ^f235 = 586 × 10⁻²⁴ cm², and w = 3.04 × 10⁻¹¹ W-s/fission.
14. To remain critical at the end of a cycle of operation, a power reactor must have an average multiplication factor k^F. For a one-zone core, this is related to the burnup B bywhere a is a constant, so that the discharge burnup isFor a two-zone core, we haveThe discharge burnup is 2B orContinue the analysis to find B(3) and B(4). Check the results against the formulas quoted in the text.

Computer Exercises

1. A simplified version of the analysis of neutron population growth is called the one-delayed-group model. The six emitters listed in Exercise 19.12 are replaced by a single emitter with mean life τ = 12.7 s, effective neutron lifetime , decay constant λ = 0.0785 s⁻¹, total fraction β = 0.0065. Differential equations for the neutron population n and the delayed emitter concentration c are written:To solve, the program OGRE (One Group Reactor Kinetics) is used.(a) Try various reactivity values such as 0.0001, 0.0005, and 0.001, with a time step of 0.01 s. (b) Plot the time responses of neutron population. (c) Change the time step for ρ = 0.001 from 0.01 s to 0.1 s. Explain the results and discuss actions required.
2. The program KINETICS solves the time-dependent equations for neutrons and delayed emitters, yielding the neutron population as a function of time. Six emitters are used, and feedback is neglected. (a) Run the program with the menus, observing symbols, equations, and input data. (b) Try various input reactivity values–positive, negative and zero; small and large with respect to β = 0.0065.
3. The effect of temperature feedback on the time response of a reactor can be estimated by use of the program RTF (Reactor Transient with Feedback). RTF solves simple differential equations that express the rates of change with time of power and temperature. There is a negative temperature coefficient of reactivity and power is extracted according to a temperature difference. (a) Load the program RTF and scan the tables to see how the power varies with time for the sample problem. (b) Draw a graph of power P versus time t. (c) Examine the effect of changing the reactor fuel from uranium to plutonium. Pu has an effective neutron lifetime of only 0.04 s compared with the value for U of 0.083 s. Let all other factors be the same as in (a) above.
4. A typical PWR core contains approximately 200 fuel assemblies, arranged to optimize production and safety. The computer program COREFUEL shows top views of cores with different fuel patterns, including that of Three Mile Island Unit 2 before its accident. Run the program to inspect the cores with the menus.
5. The power excursion without cooling in the Three Mile Island Unit 2 reactor (TMI-2) turned fuel assemblies into a mass of broken and melted material. Load and run the program RUBBLE, which sketches the cavity formed by the slumping of damaged fuel.
6. Features of the Chernobyl reactor before its accident are sketched in three computer programs: CIRCLE6, which shows the array of 19 fuel rods within an aluminum tube, forming their assembly; SQRCIR6, which shows the array of holes in the graphite core for insertion of fuel or rods; and CORODS, which illustrates the arrangement of control rods that led to the accident. Load and run the programs.

19.11. References

Knief, 1985 Ronald Allen Knief, Nuclear Criticality Safety: Theory and Practice 1985 American Nuclear Society La Grange Park, IL Methods of protection against inadvertent criticality, with an appendix on the Three Mile Island recovery program.

Koponen, 1999 Brian L. Koponen, Nuclear Criticality Safety Experiments, Calculations, and Analyses1958 to 1998: Compilation of Papers from the Transactions of the American Nuclear Society 1999 Golden Valley Publications Livermore, CA

Criticality Accidents Criticality Accidents

http://www.cddc.vt.edu/host/atomic/accident/critical.html http://www.cddc.vt.edu/host/atomic/accident/critical.html

Atomic Energy Commission Atomic Energy Commission, 1943–1970.

A Review of Criticality Accidents 2000 Revision A Review of Criticality Accidents 2000 Revision

http://www.orau.org/ptp/Library/accidents/la-13638.pdf http://www.orau.org/ptp/Library/accidents/la-13638.pdf

Original edition, 1967 Original edition 1967 by William R. Stratton. Includes Russian information and more recent Japanese accident

The Virtual Nuclear Tourist The Virtual Nuclear Tourist

http://www.nucleartourist.com http://www.nucleartourist.com

All about nuclear power All about nuclear power. By Joseph Gonyeau.

Lewis, 1977 E.E. Lewis, Nuclear Power Reactor Safety 1977 John Wiley & Sons New York

Farmer, 1977 F.R. Farmer, Nuclear Reactor Safety 1977 Academic Press New York

History of Nuclear Power Plant Safety History of Nuclear Power Plant Safety

http://www.nuclearsafetyhistory.org http://www.nuclearsafetyhistory.org

Select decade time line Select decade time line, 1940–2000.

ECCS Evaluation Models ECCS Evaluation Models

http://www.nrc.gov/reading-rm/doc-collections/cfr/part050 http://www.nrc.gov/reading-rm/doc-collections/cfr/part050

Select Appendix K for regulation on emergency core cooling system Select Appendix K for regulation on emergency core cooling system.

Wackerly et al., 1996 Dennis D. Wackerly, William Mendenhall III, Richard L. Scheaffer, Mathematical Statistics with Applications 5th Ed. 1996 Wadsworth Publishing Co Belmont, CA

A popular textbook on basic statistics A popular textbook on basic statistics.

Reactor Safety Study, 1975 Reactor Safety Study An Assessment of Accident Risks in U.S. Commercial Nuclear Power, WASH-1400 (NUREG-75/014) 1975 United States Nuclear Regulatory Commission Often called the Rasmussen Report after the director of the project, Norman Rasmussen. The first extensive use of probabilistic risk assessment in the nuclear field

PRA Procedures Guide, 1983 PRA Procedures Guide A Guide to the Performance of Probabilistic Risk Assessments for Nuclear Power Plants, NUREG/CR-2300 Vols. 1 and 2 January 1983 Nuclear Regulatory Commission A comprehensive 936-page report prepared by the American Nuclear Society and the Institute of Electrical and Electronic Engineers. Issued after the Three Mile Island accident, it serves as a primary source of training and practice.

McCormick, 1981 Norman J. McCormick, Reliability and Risk Analysis: Method and Nuclear Power Applications 1981 Academic Press New York

Roberts et al., 1981 N.H. Roberts, W.E. Vesely, D.F. Haasl, F.F. Goldberg, Fault Tree Handbook, NUREG-0492 1981 Nuclear Regulatory Commission Washington, DC

http://www.nrc.gov/reading-rm/doc-collections/nuregs/staff/sr0492 http://www.nrc.gov/reading-rm/doc-collections/nuregs/staff/sr0492

A frequently cited tutorial containing fundamentals and many sample analyses A frequently cited tutorial containing fundamentals and many sample analyses.

Fullwood and Hall, 1988 Ralph R. Fullwood, Robert E. Hall, Probabilistic Risk Assessment in the Nuclear Power Industry: Fundamentals and Applications 1988 Pergamon Press Oxford

Henley and Kumamoto, 1992 Ernest J. Henley, Hiromitsu Kumamoto, Probabilistic Risk Assessment 1992 IEEE Press New York

Lewis, 1996 E.E. Lewis, Introduction to Reliability Engineering 1996 John Wiley & Sons New York

Society for Risk Analysis Society for Risk Analysis

http://www.sra.org http://www.sra.org

Select Resources/Glossary Select Resources/Glossary.

Risk-Informed and Performance-Based Regulations for Nuclear Power Plants Risk-Informed and Performance-Based Regulations for Nuclear Power Plants

American Nuclear Society Position Statement American Nuclear Society Position Statement June 200446-

http://www.ans.org/pi/ps/docs/ps46.pdf http://www.ans.org/pi/ps/docs/ps46.pdf

Understanding Risk Analysis Understanding Risk Analysis: A Short Guide for Health, Safety, and Environmental Policy Making 1998 American Chemical Society and Resources For the Future Washington, DC

http://www.rff.org/rff/Publications/upload/14418_1.pdf http://www.rff.org/rff/Publications/upload/14418_1.pdf

The 39 pages can be downloaded The 39 pages can be downloaded. A good qualitative discussion of risk, including history, perceptions, methodology, and limitations.

Eytchison, March 2004 Ronald M. Eytchison, Memories of the Kemeny Commission Nuclear News March 200461-

Kemeny et al., 1979 John Kemeny, ... The Need for Change: The Legacy of TMI 1979 Pergamon Press Elmsford, NY Subtitle: Report of the President's Commission on the Accident at Three Mile Island

http://www.threemileisland.org http://www.threemileisland.org

Rogovin and Frampton, 1980 M. Rogovin, G.T. Frampton Jr., Three Mile Island: A Report to the Commissioners and the Public 1980 Nuclear Regulatory Commission NUREG/CR-1250, Vols. I and II, Parts 1-3

http://www.threemileisland.org http://www.threemileisland.org

Three Mile Island 2 Accident Three Mile Island 2 Accident

http://www.nrc.gov/reading-rm/doc-collections/fact-sheets/3mile-isle.html http://www.nrc.gov/reading-rm/doc-collections/fact-sheets/3mile-isle.html

Account of the accident with diagram Account of the accident with diagram, references, and glossary by NRC.

TMI-2 Recovery and Decontamination Collection TMI-2 Recovery and Decontamination Collection

http://www.libraries.psu.edu/tmi http://www.libraries.psu.edu/tmi

TMI-2 Cleanup Highlights Program (24-min QuickTime video) TMI-2 Cleanup Highlights Program (24-min QuickTime video).

Pennsylvania State University Library Pennsylvania State University Library.

Wood and Schultz, 1988 M. Sandra Wood, Suzanne M. Schultz, Three Mile Island: A Selectively Annotated Bibliography 1988 Greenwood Press New York

Walker, 2004 J. Samuel Walker, Three Mile Island: A Nuclear Crisis in Historical Perspective 2004 University of California Press Berkeley, CA The most authoritative book on the accident. A scholarly but gripping account, it details the accident, the crisis situation, the heroic role of Harold Denton, the aftermath, and the implications

IDCOR Nuclear Power Plant Response to Serious Accidents, November 1984 IDCOR Nuclear Power Plant Response to Serious Accidents November 1984 Technology for Energy Corp Knoxville, TN

Report on the Accident at the Chernobyl Nuclear Station, NUREG-1250, January 1987 Report on the Accident at the Chernobyl Nuclear Station, NUREG-1250 United States Nuclear Regulatory Commission January 1987 A compilation of information obtained by DOE, EPRI, EPA, FEMA, INPO, and NRC

Marples, 1986 David R. Marples, Chernobyl and Nuclear Power in the USSR 1986 St. Martin's Press New York A comprehensive examination of the nuclear power industry in the U.S.S.R., the Chernobyl accident, and the significance of the event in the U.S.S.R. and elsewhere, by a Canadian specialist in Ukraine studies

Consequences of the Chernobyl Accident Consequences of the Chernobyl Accident

http://www-ns.iaea.org/appraisals/chernobyl.htm http://www-ns.iaea.org/appraisals/chernobyl.htm

Select link to “Fifteen Years after the Chernobyl Accident.” Select link to “Fifteen Years after the Chernobyl Accident.”

Revisisting Chernobyl: 20 years later Revisisting Chernobyl: 20 years later

http://www.iaea.org/NewsCenter/Focus/Chernobyl http://www.iaea.org/NewsCenter/Focus/Chernobyl

Status and recommended actions Status and recommended actions.

IAEA Department of Safety and Security IAEA Department of Safety and Security

http://www-ns.iaea.org/publications/default.htm http://www-ns.iaea.org/publications/default.htm

Links to publications that can be downloaded Links to publications that can be downloaded.

Randerson, 1984 Darryl Randerson, Atmospheric Science and Power Production 1984 Department of Energy Third version of book on estimation of concentrations of radioactivity from accidental releases

WANO—World Association of Nuclear Operators WANO—World Association of Nuclear Operators

http://www.wano.org.uk http://www.wano.org.uk

“Security Effectiveness: Independent Studies and Drills” “Security Effectiveness: Independent Studies and Drills”

http://www.nei.org http://www.nei.org

Select safety and security. From Nuclear Energy Institute Select safety and security. From Nuclear Energy Institute.

“Nuclear plant damage from air attacks not likely,” “Nuclear plant damage from air attacks not likely,” Nuclear News August 200221-

“Aircraft Crash Impact Analyses Demonstrate Nuclear Power Plant's Structural Strength,” “Aircraft Crash Impact Analyses Demonstrate Nuclear Power Plant's Structural Strength,” EPRI December 2002

http://evacuationplans.org/epri-crash-study.pdf http://evacuationplans.org/epri-crash-study.pdf

Conclusion that fuel is protected Conclusion that fuel is protected.

Wolfson, 1993 Richard Wolfson, Nuclear Choices: A Citizen's Guide to Nuclear Technology 1993 MIT Press Cambridge Nuclear power and nuclear weapons, with comments on the accidents at TMI and Chernobyl

Golding et al., 1995 Dominic Golding, Jeanne X. Kasperson, Roger E. Kasperson, Preparing for Nuclear Power Plant Accidents 1995 Westview Press Boulder Critical of existing emergency plans, use of PRA, source term analysis, and warning systems. Sponsored by Three Mile Island Public Health Fund