THE SAFETY CONCEPT OF THE FRM-II

A. Axmann and K. BoeningTechnische Universitat Munchen, Germany

AbstractThis paper gives a brief report on the technical data and the construction of thenew research reactor FRM-II. The safety concept is described and discussed inconnection with licensing aspects of inpile experimental installations.

1 THE DESIGN OF THE FRM-II

The new research reactor FRM-II will replace the old FRM (Forschungsreaktor Munchen) of the Tech-nical University of Munich on its campus at Garching. In what follows a short description will be givenwith the help of several illustrations. Figure 1 shows the FRM-II facility which has been erected closeto the old FRM (on the left). The reactor building (on the right) is 32 m high and has the cross sectionof a square of 42x42 m

�

. The thickness of the walls of the building is 1.8 m. Theses walls consist ofreinforced concrete, are airtight and withstand the crash of a military jet. The new neutron guide hall canbe seen in the middle of the photography and the air cooling tower in the foreground.

Fig. 1: Overview of the new research reactor FRM-II at Garching

Table 1 gives a listing of the main design features of the reactor.

26

The new High-Flux Research Reactor FRM-IIof the Technical University of Munich at Garching

Thermal Power (P): 20 MWThermal Neutron Flux (

�): ��������� ������� � ��� (unperturbed, outside of the core)

Flux Ratio (�

/P): highest of the worldFuel Element (FE): only one, compact, cylindrical

24 cm diam. (active zone 70 cm high)Uranium Loading: 8.1 kg U, highly enriched (93 � ), high U density

(graded, 3.0 and 1.5 gU/cm � ), in 113 involute fuel platesReactor Cycle: 52 full power days, with 5 cycles per yearLight Water Circuit (H � O): primary cooling circuit (for FE), virtually

closed, also acting as in-core moderatorHeavy water Tank (D � O): external moderator and reflector, cylindrical

(both 250 cm diameter and height)Experimental Utilization: with beam tubes, irradiation channels, etc., in D � O tank1 Control Rod: central, Hf absorber with Be follower, also acting

as independent shutdown system5 Shutdown Rods: independent shutdown system, 5 rods in

D � O tank, fully withdrawn during operation

Table 1: Main design features of the FRM-II

Figure 2 shows a view of the fuel element during the fabrication process. The 113 plates areinvolutely curved so that the coolant channels between them have a constant width of 2.2 mm; they arewelded to the inner and outer core tubes.

Fig. 2: View of the fuel element (consisting of 113 involutely curved plates) during fabrication.

Figure 3 shows a view of the experimental hall (ground floor level) with the reactor block in thecenter.

27

Fig. 3: View of the experimental hall of the FRM-II with the central reactor block

Figure 4 shows a vertical cross section through the reactor pool, storage pool and primary cell(from left to right).

Fig. 4: Vertical cross section through the reactor pool, storage pool, and primary cell (from left to right). The reactor operation

hall in the upper part of the building is separated from the experimental hall in the lower part by an airtight ceiling.

28

The reactor operation hall in the upper part of the building is separated from the experimental hallin the lower part by an airtight ceiling. The H � O pool water is kept under all accident conditions - even inthe case of an airplane crash. This aim is met by connecting the two ceilings of the building to the reactorblock via flexible joints in order to keep shock waves away from it. For the same reason the reactor blockis separated from the outer walls of the reactor building by a gap (left side of Fig. 4). Further, the reactorblock is made out of watertight reinforced concrete and a steel liner. The air flow of the ventilation systemis directed from the experimental hall to the reactor hall by a small pressure difference. The ventilationsystem of the reactor hall is designed to filter and control the air release through the stack particularlyin the case of accidents. The H � O primary circuit is is totally placed inside of the reactor block. Thefour primary pumps and the two heat exchangers to the secondary circuit are mounted in the primarycell which is part of the watertight reactor block. In Fig. 4 one can also identify the first fast shutdownsystem which consists of five shutdown rods in the D � O moderator which are totally withdrawn duringoperation. The second fast shutdown system consists of the central control rod which is coupled to theactuator by a magnetic clutch so that it can be released immediately. Figure 5 shows a view of the reactorpool. On top of the D � O moderator tank the actuators of the control rod and of the five shutdown rodsare mounted. The inlet of the primary circuit, which is virtualy closed, into the central channel tube ofthe moderator tank, where the single fuel element is placed, consists of the horizontal tube coming fromthe upper right corner of the picture. Three emergency pumps feed cooling water from the pool into thistube after shutdown of the four primary pumps. Three hours later the emergency pumps can be switchedoff, too, whence two redundant flaps in the horizontal part of the primary circuit inlet tube open just bygravity so that the residual decay heat can be removed by natural convection.

Fig. 5: View of the reactor pool. On top of the D � O moderator tank the actuators of the control rod and of the five shutdown

rods are mounted.

Figure 6 shows a horizontal cross section through the reactor pool in the experimental plane. One

29

sees the cylindrical reactor core in the central channel tube of the moderator tank, surrounded by thefive shutdown rods (in their shutdown position) and the experimental facilities as horizontal beam tubesetc.. One beam tube is a through tube allowing access from both sides. The beam tubes provide severalbarriers to prevent loss of H � O pool water or loss of D � O moderator. The first barrier is the beamtube itself (with respect to D � O) and the compensator tube (with respect to H � O) which is water tightconnected to the liner of the pool. This tube further penetrates the concrete shielding and so connects theliner with the outer heavy cover plate of the beam tube. In the region of the concrete pool wall a heavyshutter is placed which allows to open and close the neutron beam channels. On the outer cover platetwo redundant neutron beam windows are mounted.

Fig. 6: Horizontal cross section through the reactor pool in the experimental plane. One sees the cylindrical reactor core in

the central channel tube of the moderator tank, surrounded by the five shutdown rods (in their shutdown position) and the

experimental facilities as horizontal beam tubes etc..

30

2 THE SAFETY CONCEPT OF THE FRM-II

2.1 Inherent safety features

Due to its small core the FRM-II provides some essential inherent safety features. The reactor wouldbecome subcritical if the D � O in the moderator tank would be replaced by H � O or if a substantial fractionof H � O would be mixed into the D � O. If the H � O in the fuel element would be replaced by D � O or if theH � O would be removed from the core (for example due to boiling) the reactor would become subcritical.The essential safety feature concerning handling of the fuel element is that it is highly subcritical in pureH � O without any additional absorber.

2.2 General aspects of the safety concept

A large number of guidelines and regulations concerning design, construction and operation of nuclearpower plants have to be followed also for a research reactor. The methodology of the safety analysis ofthe FRM-II, see Table 2, distinguishes between operational events and incidents, design basis accidentsand beyond design basis accidents. The safety analysis of operational events and incidents and of thedesign basis accidents has to be purely deterministic. The arguments to be given for beyond design basisaccidents must be plausible.

operation design basis accidents beyond design basis accidentssafe operation reactivity, criticality accidents aircraft crashes design features:operational events, incidents core cooling accidents blast waves conditionsstorm radioactivity accidents loss of core cooling initiating eventslightning internal and external fires, (decay heat removal)

explosions and floodings loss of both shutdown syst.earthquakeshuman errors

���������� /a probabilitydeterministic analysis, high reliability and solidity of safety plausible demonstrations safety approach,relevant systems and components, single failure criteria building and pool integrity principlesconservativity, quality assurance mitigation measures to re- measures

duce radiolog. consequ.failure of equipment does not automatic reactor shutdown or disaster controlrequire plant shutdown obligation of manual shutdown0.3 mSv/a by air- or water path max. 50 mSv � 100 mSv radiolog. limits

Table 2: Safety concept of the FRM-II

Operational events and incidents - for example failure of components - need not require plantshutdown. Design basis accidents are incidents with the potential of higher radiological consequences(see bottom line of Table 2). At occurence of such incidents the reactor will be shut down automatically.The design of the reactor must make sure that such incidents do not have radiological consequences orare not expected to occur during plant lifetime. Systematically, three types of design basis accidents haveto be distinguished (first three lines of column 2). Some internal and external hazards are constraints ofthe analysis (see also column 2).

Beyond design basis accidents must have occurrence probabilities which are small against 10 �/a.

Mitigation measures must reduce radiological consequences below limits which would demand the con-sideration of public evacuation (column 3). For the FRM-II this demand is fulfilled by maintaining theintegrity of building and pool even in the case of aircraft crashes and blast waves from industrial facil-ities. Radiological limits for the environment which are set by the Radiation Protection Ordinance aregiven in the bottom line of Table 2. Other limits are set especially at normal operation for the personneland for individuals of the public.

31

2.3 Strategy of the reactor protection

The strategy of the reactor protection of the FRM-II is explained in Table 3. Three barriers protect theenvironment against a release of radioactivity from the reactor (column 1). These barriers are defendedby a number of safety functions and technical measures. Core cooling must be guaranteed under allcircumstances. A catastrophic breakdown of the primary circuit is excluded by special requirementsconcerning the solidity and reliability of the materials used. At shutdown of the reactor three redundantemergency pumps are started to remove the decay heat. After three hours the pumps can be switched offand two redundant flaps open so that the residual decay heat can be removed by natural convection. Theprimary circuit is open to the pool by a sieve in the low pressure part of the circuit so that the 700 m � ofpool water can guarantee the core cooling for long time without active elements.

The pool water plays an important role not only for core cooling but also for filtering radioactivereleases from the core. During normal operation these releases are due to contaminations of the plates ofthe fuel element with fissile materials. As a result of a beyond design basis accident radioactivity couldbe released due to fuel melting. The pool water therefore must be kept under all accident conditions.This aim is met by the watertight reactor block, two walls and three barriers of pool wall penetrationsand siphon breakers in all circuits going out of the pool. The last barrier against radioactive release is theconfinement of the building and the ventilation system (last line of Table 3).

barriers safety functions technical measurescore cooling:

fuel matrix - during operation 4 primary pumpsand cladding exclusion of primary circuit

breakdown- after shutdown of fly wheelsprimary pumps 3 emergency pumps

- long time decay 2 naturalheat removal convection flaps

700 m � of pool waterreactor shutdown 1 control rod

5 shutdown rodspool water covering of core by water massive, tight reactor block

with reactor pool, storagepool and primary cellbeam tubes with2 walls and3 barrierssiphon breakers

confinement of control and filtering integrity of building, smallradioactive substances of radioactive release leakage

closure flaps ofventilation systemhierarchic pressuresystemair circulation system

Table 3: Reactor Protection Strategy

32

2.4 Reactor safety control system

The instrumentation of the reactor and the reactor protection system control the safety criteria of thereactor and trigger the safety actions if limits are reached. Table 4 shows the criteria for reactor protectionactions for a number of design basis accidents. Each accident has to be monitored by at least twocriteria which are diverse (as one can see from column 2) with the measurement circuits being redundant.Only one design basis accident - the hypothetical melt-down of 15 plates of the fuel element - hasradiological consequences for the environment. The maximum dose of 1.68 mSv in the environment islow in comparison with the limits set by the Radiation Protection Ordinance. This hypothetical accidentis the basis for the layout of the ventilation system.

accident criteria for reactor radiologicalprotection action consequences

reactor power reactor period: no radiologicalexcursion: consequences- withdrawal of - start up rangecontrol rod duringstart up or

- at power operation - power middle ranged(nflux) -N16)

neutron flux � 114 �failure of 1 mass flow no radiologicalprimary pump pressure drop consequencesfailure of all mass flow no radiologicalprimary pumps pressure drop consequences

coolant temperatureleakage of primary mass flow no radiologicalcoolant circuit pressure drop consequences( � 25 cm

�

)hypothetical melt- � -dose rate dose in thedown of 15 fuel - primary circuit environmentplates - on pool top(ventilation system 1.68 mSvlayout)

Table 4: Design basis accidents - envelope -

Table 5 shows three actions of the reactor protection system:

reactor shutdown by two independent fast systemsstartup of three emergency pumpsclosure of ventilation system air outlets in case of arelease of radioactivity

Table 5: Reactor protection system actions

33

3 LICENSING ASPECTS FOR IN-PILE EXPERIMENTS

According to the German Atomic Law a license is necessary for new installations close to the reactor coreand for all types of facilities involving nuclear fissions. The application for the license must include ademonstration of long-term waste handling and disposal (state of the art is direct storage in transportationand storage containers). Such a licence can be granted by the authority without presentation of the safetyreport to the public if the requirements are fulfilled.

Table 6 summarizes these safety requirements for ’inpile experiments’, i.e. for permanent exper-imental installations in the D � O moderator tank such as a cold source, hot source, fission converter andirradiation facilities.

the accident control of the reactor must not be affected:- no change of the spectrum of reactor accidents- no change of the radiological consequences of reactor accidents- the load on components of the reactor accident control systemmust not be increased

- the reliability of such components must not be reducedthe integrity of barriers between inpile experiments and the reactor poolor moderator tank must be guaranteed during all experimental internalincidents and external hazardsthe radioactive release of experiments must be covered by the limits set bythe reactor licensereactor shutdown to avoid damage to the experiments is possible

Table 6: Safety requirements for inpile experiments

ACKNOWLEDGEMENT

The safety concept of the FRM-II has been developed by Interatom GmbH and Siemens-KWU in coop-eration with the Technical University of Munich.

34