The Risks of Nuclear Energy Technology

This chapter lists the capacity of commercial nuclear power plants built and operated in different countries of the world in 2013. About 80 % of all operating nuclear power plants are Light Water Reactors (LWRs), predominantly Pressurized Water Reactors (PWRs) and Boiling Water Reactors (BWRs). An additional 11 % are Heavy Water Reactors (HWRs) and 4 % are advanced gas cooled, graphite moderated nuclear power reactors (AGRs). Only about 3.4 % are Russian retrofitted RBMK1000 reactors still operating in Russia. One prototype Fast Breeder Reactor (FBR) was operating in Russia, one became operational in India and one experimental FBR was operated in Japan.

The resources of natural uranium were assessed in 2007 by IAEA and OECD/NEA to be 5.47 million tons (reasonably assured and inferred). An additional 7.77 million tons of speculative and about 4.2 million tons in the Chattanooga Shales in the USA are listed.

These uranium resources are then contrasted with the uranium consumption of each nuclear power reactor which is 171 tons per GW(e) and year for LWRs. If plutonium recycling in a closed fuel cycle is applied this uranium consumption is reduced by a factor of 1.55. FBRs would consume only 1.7 tons of U-238 per GW(e) and year which would extend the time period for nuclear energy application (uranium and thorium resources) to thousands of years.

For LWRs and other commercial nuclear reactors the natural uranium must be enriched. This is done predominantly by the gaseous diffusion and the gas centrifuge process. The laser enrichment process (SILEX) is still under deployment in the USA. Commercial spent fuel reprocessing facilities were built and are operated in France, Great Britain, Russia and Japan. This reprocessing capacity in the world can reprocess the spent fuel of about half of the presently operating LWR capacities. The majority of nuclear power plants built and operated in the world today is used for electricity generation. Such nuclear power reactors are built in unit sizes of about 1 and 1.6 GW(e) and operated for economical reasons mainly in the so-called base load regime.

Chapter 2 describes some facts about neutron and reactor physics needed for the understanding of Chaps. 3–10. It starts with the radioactive decay and the definitions of the decay constant and the half-life. It continues with the explanation of the fission process for fissile nuclear isotopes, e.g. U-233, U-235, or Pu-239 and the fission energy release by creation of fission fragments (products), prompt fission neutrons and delayed neutrons and radiation (β-particles, γ-rays and antineutrinos). This is followed by the definition of reaction rates of neutrons with other atomic nuclei, the presentation of measured microscopic cross sections for absorption, capture and fission as well as the definition of the macroscopic cross section and the neutron flux.

In LWR cores the fuel is arranged heterogeneously in lattice cells together with a moderator (water) in order to slow down the fission neutrons with high kinetic energy to kinetic energies in the range of 0.025 eV (thermal energy). This is most effective if the enriched uranium fuel is put in cylindrical rods which are arranged in e.g. a square grid. The optimization of the geometrical distance between the fuel rods leads to important safety characteristics of LWR cores: the negative fuel Doppler coefficient and the negative coolant (moderator) coefficient.

The definition of the criticality factor or effective multiplication factor, k_eff, allows a characterization whether the reactor core is operated in steady state condition or whether it is subcritical or even supercritical. The criticality or effective multiplication factor, k_eff, can be changed by moving or by insertion or withdrawing of absorber material (boron, cadmium, gadolinium, indium, silver, hafnium, erbium) in the core. This allows control of the reactor. The reactor core is controlled always in a k_eff range where the delayed neutrons are dominating. The delayed neutrons are therefore of highest importance for the control of the reactor.

During reactor operation over months and years the initially loaded U-235 in the low enriched uranium fuel will be consumed, neutron absorbing fission products will build up or other heavy nuclei with masses above U-235 and Pu-239 will be created. This decreases the criticality of the effective multiplication factor k_eff. This burnup effect on the criticality factor k_eff is accounted for by the design of the reactor core. The enrichment of the initially loaded fuel is increased such that k_eff becomes slightly >1. This is balanced by absorber materials (moveable absorber rods, burnable neutron poisons, e.g. gadolinium or boric acid) which keep the reactor core always at k_eff ≥ 1.

After shutdown of the reactor the gradually decaying fission products and the radioactive decay of higher actinides creates afterheat in the reactor core. This afterheat (decay heat) must be transferred by the coolant water to outside coolant towers or to river or sea water.

This chapter describes the designs and safety concepts of presently operating and more recently developed (future) LWRs. The chapter concentrates on LWR plants (PWRs and BWRs) with 1,300–1,700 MW(e) power output manufactured in Europe, the USA and Japan. As a presently operating PWR the standard PWR of 1,300 MW(e) of KWU (Germany) is chosen. As more recent (future) PWR designs the Advanced Pressurized Water Reactor AP1000 and the US-APWR (1,700 MW(e)) developed by Westinghouse (USA) and Mitsubishi (Japan) are described. In addition the European Pressurized Water Reactor (EPR) with 1,600 MW(e) power output of AREVA (France) is presented too.

The fuel elements, the control elements, the core design, the pressure vessel, the design characteristics of the primary system, the steam generators and steam conditions for the turbine-generator system are all very similar for all these PWRs. Most of the PWRs with 1,300 MW(e) and more power output have four redundant coolant circuits. Their emergency core and afterheat cooling systems are also fourfold redundant. An exception is AP1000 with only two redundant coolant circuits and two redundant emergency core and afterheat cooling systems. All PWRs provide emergency core cooling at three different pressure levels (high pressure (core make up tanks), medium pressure (accumulator) and low pressure). Whereas in the older KWU PWR-1,300 design the primary system can be depressurized manually by the operator, this is realized automatically by the automatic depressurization system (ADS) in the more recent designs of AP1000, US-APWR and EPR. Emergency cooling water is taken from the building sump in case of the KWU PWR-1,300, whereas the more recent designs AP1000, US-APWR and EPR are equipped with a large water volume in-containment refueling water storage tank (IRWST). The afterheat can be removed in case of a severe core melt accident either passively through the inner steel containment wall (AP1000) or by using sprinkler systems in connection with containment heat removal systems (EPR and US-APWR). In case of a core melt accident water of the IRWST can be drained into the reactor cavity (AP1000). This water cools the reactor pressure vessel from the outside and prevents the core melt from penetrating through the pressure vessel wall. In case of EPR a molten core spreading and cooling device (core catcher) provides long term cooling of the molten core. The outer containment of PWRs protects the inner components in the inner containment against external events (earthquakes, hurricanes etc.).

As presently operating standard BWR the BWR-1,300 of KWU (Germany) and the ABWR built by General Electric (USA), TOSHIBA and HITACHI (Japan) are described. In addition the more recently designed (future) SWR-1,000 (KERENA) of AREVA (France) and the ABWR-II of General Electric (USA), TOSHIBA and HITACHI (Japan) will be presented. The fuel elements, the control elements, the core design etc. of the BWR-1,300, ABWR and SWR-1,000 (KERENA) designs are very similar. The pressure suppression system with suppression pool, drywell and the containment system of the BWR-1,300 and the ABWR are again very similar. The threefold emergency core cooling and afterheat removal systems of BWR-1,300 and ABWR show only little differences. In case of the SWR-1,000 (KERENA) with fourfold cooling and emergency cooling systems more passive safety systems are installed. At depressurization the steam is discharged into four interconnected core flooding pools. These core flooding pools serve as a passive heat sink. The heat is transferred through four containment emergency condensers to an upper shielding/storage pool. Additional passive heat transfer systems are the emergency condensers within the four core flooding pools. The drywell with reactor pressure vessel is flooded passively in case of drastic losses of coolant and danger of core melt.

The ABWR-II design of General Electric (USA), TOSHIBA and HITACHI (Japan) evolved from the ABWR. It has a larger fuel element, modified emergency core cooling systems and passive core cooling as well as passive containment cooling systems. In case of core melt through the bottom of the pressure vessel the core melt can be cooled on a steel plated cavity underneath the pressure vessel.

This chapter lists the different main radioactive isotopes produced in the fuel of nuclear plants which are released in very small amounts into the environment. It then explains the different pathways leading to radioactive exposure of the human body. Several containment barriers in a nuclear power plant lead to extremely low leak rates of radioactive substances. This is followed by the definition of the radiation dose, the radiation weighting factors, the tissue weighting factors, the equivalent radiation dose and the natural background radiation dose. Radiation exposure from man-made sources is strictly controlled by governmental agencies. Permissible radiation dose limits were set by governments for radioactive releases from nuclear installations for the population and for employees who might receive enhanced radiation during their occupation. This also holds for rescue operation teams after a severe nuclear accident. Finally the radioactive effluents of LWRs and the effective doses to the public for airborne and liquid effluents of LWRs are presented. This is compared with the release of radioactive nuclides from coal fired plants.

This chapter starts with the goals of protection for LWR plants. These are: safe shutdown of the LWR plant, assurance of core cooling and safe and intact containment structures. The safety concept of LWRs is based on multiple containment structures and engineered safeguard components. The staggered in depth safety concept relies on accident prevention, accident limitation or accident mitigation and severe accident management. LWR plants must be designed and built on the design basis concept. Sequences of events exceeding the design basis must be counteracted by beyond design accident management measures. Probabilistic safety analyses supplements these guidelines and assures frequencies of occurrences per year for a severe accident with core melt of 10^–5 to 10^–7 per year. Most countries issued an Atomic Energy Act establishing the legal frame for the peaceful utilization of nuclear power. The chapter continues by describing thermodynamic and neutron physics design of a LWR core as well as the stable behavior of PWRs when controlled by movement of control elements or of BWRs when controlled by the speed of the recirculation pumps, and moving control elements. The mechanical design of the pressure vessel is of high importance. It follows the guidelines of the ASME Boiler and Pressure Vessel Code. This is accompanied by quality assurance and in-service inspections. Also the mechanical design of the reactor containment follows similar guidelines. The chapter ends by discussing the different design basis accidents which must be analyzed prior to licensing of the LWR plant.

The first comprehensive study to determine the risk of LWRs by probabilistic methods was the US Reactor Safety Study WASH-1400 in 1975. Similar studies in other countries, e.g. Germany, followed. The methodology starts with the event tree analysis followed by the probabilistic analysis. This is continued by an analysis of the radioactivity release for the different accident sequences. Subsequently meteorological data and models for atmospheric diffusion and aerosol deposition are used to determine the radioactivity concentration and radiation dose to individuals in the areas around the plant. Countermeasures can be taken, e.g. evacuation or relocation, to lower the radioactive exposure of the population. Finally the results of event tree and fault tree analysis for different PWRs and BWRs (presently operating and more recent (future) designs) are presented. In addition, the results of reactor risk studies in the USA (WASH-1400) and in Germany are reported and discussed.

LWRs must be designed against earthquakes, air plane crashes, chemical explosions, flooding, tsunamis and tornados. The design of LWRs against earthquakes must meet certain guidelines required by regulatory authorities. These distinguish between the design basis earthquake and the safe shut down earthquake. The design basis earthquake is the highest intensity earthquake which can occur according to scientific findings at the site of the nuclear power plant. In a safe shut down earthquake the fundamental safety functions of the LWR must remain fulfilled. The mechanical loads and stresses acting on nuclear power plants in an earthquake are determined by horizontal and vertical displacements and accelerations as well as the associated frequencies of vibration and the duration of the earthquake. Besides the rules recommended by regulatory authorities also two- and three-dimensional finite-element codes are employed on the mechanical analysis of the plant. Where horizontal or vertical displacements and the resultant stresses are too high, pipings and components may be supported by means of damping elements. Also the entire nuclear plant may be built on thousands of damping elements located in the foundation bottom concrete slab of the reactor building. LWR plants are designed against air plane (military or commercial) crashes into the plant. Impulse models and experiments form the basis for a shock load versus time curve which has to be applied for the design of the plant.

LWRs must also be designed against a given pressure wave resulting from chemical explosions in the vicinity of the plant.

The risk of flooding by a maximum-level flood must be taken into account on the basis of scientific findings about floods for the past 10,000 years. Similar requirements exist for tsunamis and for tornados.

Chapter 8 compares the risk of LWRs as determined in the US-risk study WASH-1400 with the risk of other technical systems, e.g. air plane crashes, fires, dam failures, explosions and chlorine releases in chemical industry. It is shown that the risk, e.g. of 100 nuclear power plants in the USA is smaller than the risk of these other technical systems. Natural disasters, e.g. hurricanes, floods including tsunamis, earthquakes, avalanches and landslides or volcanic eruptions have a higher frequency of occurrence per year and a much higher number of casualties i.e. their risk—the product of frequencies and casualties—is much higher than that of technical systems including nuclear power plants.

Three major severe accidents with core meltdown/core disruption occurred at Three Mile Island (USA) in 1979, Chernobyl (Ukraine) in 1986 and Fukushima (Japan) in 2011.

The LWR of Three Mile Island was a two loop PWR with 880 MW(e) output. The accident started with technical problem in the feedwater loop for the steam generators. As the steam generators were not able to remove the heat, the pressure in the primary system increased and the safety valve of the pressurizer opened thereby releasing steam. The reactor was shut down because of too high pressure. When the pressure in the primary system dropped the safety valve did not shut again and remained open. The operators were given the opposite information by the instruments in the control room. The high pressure emergency core cooling systems started to feed water in the reactor pressure vessel. But the water in the pressure vessel rose too high and the operators throttled the emergency cooling systems. As the primary pumps started to vibrate the operators also shut down both primary pumps. As a consequence the cooling water in the pressure vessel started to boil. The zirconium claddings started to chemically react with water: hydrogen was formed. The reactor core began to melt down. The silver-indium-cadmium control rods did melt. Part of the molten core collected at the bottom of the pressure vessel. A hydrogen explosion occurred in the reactor building. Only the radioactive noble gases and a small part of the fission products iodine and cesium were able to penetrate the filters of the reactor building. The radioactive exposure of the population was therefore very small. Cost for decontamination of the plant and disposal of the destroyed core were very high. The Three Mile Island accident was classified a level 5 accident on the International Nuclear Event Scale (INES).

The Chernobyl accident occurred in one of four RBMK1000 reactors at the Chernobyl site 100 miles north of Kiev. The operators were preparing an experiment in which the energy of rotation of the turbine during shut down should produce emergency electrical power for the support of the diesel generators. Unexpectedly the experiment had to be interrupted for some time to comply with electricity supply which led to the buildup of the fission product Xe-135 (neutron poison). When the experiment could be continued the power level dropped to about 30 MW(th) because of operator error. This led to additional buildup of Xe-135 (neutron poison). As a consequence the operators had to withdraw the control rods manually to their upper limits after they had shut off the automatic control system. The RBMK1000 was known to have a positive coolant temperature coefficient. This gave rise to instabilities in power production, coolant flow and temperatures in the low power range.

Then the experiment began at the power level of 200 MW(th). Steam to the turbine was shut off. The diesel generators started and picked up loads. The primary coolant pumps also run down. However this led to increased steam formation as the coolant temperature was close to its boiling temperature. With its positive coolant temperature coefficient the RBMK1000 reactor now was on its way to power runaway. When the SCRAM button was pushed the control elements started to run down into the reactor core. However, due to a wrong design of the lower part of the control elements (graphite sections) the displacement of the water by graphite led to an increase of criticality. A steep power increase occurred, the core overheated causing the fuel rods to burst, leading to a large scale steam explosion and hydrogen formation. The reactor core was destroyed and the top shield cover and the fuel refueling machine were lifted up. Fuel elements and graphite blocks were dispersed outside the reactor core. The reactor core was now open to the atmosphere. Fission products and fuel aerosols were distributed over the Ukraine, Belarus, Russia and Europe. Very high radiation doses were received by fire fighters, operators, helicopter pilots and members of the emergency team. Approximately 800,000 military people were involved in rescue teams receiving various levels of high radiation doses. About 135,000 people were evacuated rather late. In total about 3,000 km² of land were contaminated with more than 1,500 Bq/m², roughly 7,200 km² with 600–1,500 Bq/m² and about 103,000 km² with 40–200 Bq/m² of Cs-137. The Chernobyl accident was classified a level 7 accident on the International Nuclear Event Scale (INES).

The severe reactor accidents at Fukushima occurred in 2011 after a severe earthquake with intensity 9 (Richter scale) close to the northeastern coast of Japan. The earthquake was followed by a tsunami wave which hit the six BWRs of the Fukushima-Daiichi plant with a water level up to 14 m. Unfortunately the Fukushima-Daiichi plant was only protected up to a tsunami wave level of 5.7 m. Only three BWRs of the six BWRs of the Fukushima-Daiichi plant were in operation when the earthquake and the tsunami wave hit the reactor site. All BWRs were duly shut down by the seismic instrumentation and changed into the residual heat removal mode. However, the tsunami wave flooded the two diesel generators of each of the three reactor units 1–3, located in the lowest part of the turbine building. The diesel generators and the battery systems failed. The external grid power and heat exchangers transferring afterheat to the ocean water had already been destroyed by the earthquake. In unit 1 due to the lack of electrical power the high pressure coolant injection system did not work. The steam driven isolation condenser system worked only partly in time and failed. The primary coolant system could not be depressurized due to lack of electrical power and pressurized nitrogen. Low pressure emergency pumps, therefore, could not feed water in the primary coolant system. The primary coolant system heated up and exceeded its design pressure. The core became uncovered, the zirconium claddings of the coolant system chemically reacted with water and formed hydrogen. The core melted down. The pressure in the pressure vessel was relieved into the primary containment because core melt penetrated the lower bottom wall. The pressure in the primary containment led to release of hydrogen and fission product gases into the upper reactor building, where a hydrogen explosion occurred destroying the upper building structures.

In units 2 and 3 the accident developed in a similar pattern, though with a larger shift in time. However a hydrogen explosion only occurred in unit 3 (BWR) not in unit 2 (BWR). However, a hydrogen explosion also occurred in unit 4 (BWR) due to a backflow through the common gas treating system. The hydrogen explosion destroyed the upper structures of the reactor building. The spent fuel pools of unit 1, 3 and 4 had to be cooled part time by concrete pumping trucks, water cannons or helicopters dropping water, but no damage occurred to the fuel in the spent fuel pools. After detailed measurements of the radioactivity released into the environment the Japanese government evacuated about 200,000 people. Four persons of the operating crew were killed by the earthquake and the tsunami wave. Some 20 staff members were injured by the hydrogen explosions. Out of the about 23,000 emergency workers 12 received effective radiation doses up to 700 mSv and 75 workers received <200 mSv. The radiation dose of all others was <10 mSv. The contamination of land was measured. About 2,200 persons would not be allowed to return to a no-entry zone because of too high radiation exposure. The Fukushima severe reactor accident was classified level 7 on the International Nuclear Event Scale (INES).

In Chaps. 7 and 9 the results of the risk studies for LWRs and the facts and consequences of the severe nuclear accidents of Chernobyl and Fukushima were assessed. The severe nuclear accidents of Chernobyl and Fukushima resulted in contamination of large areas and in the evacuation of the population of large areas.

It is concluded that LWRs in Europe are built and operated in densely populated areas with cities of several 100,000 inhabitants. It is impossible to evacuate cities of that size in due time and their contamination is beyond anybody’s imagination. Therefore, the KHE safety concept was proposed around 1990 to build future LWRs such that the main accident path of the risk studies leading to the high number of deaths and to the large contamination of land should be eliminated by the safety design concept of the plant. The probabilistic safety studies leading to low frequencies of core melt in the range of 10⁻⁶ per year should be retained. However, the present risk concept should not be applicable any more to LWR plants built in future in Europe. It was concluded that the consequences of the most severe accidents in risk studies should be managed by the inner and outer containment of the reactor plant. A severe accident research program of the Research Center Karlsruhe, Germany, lasting for about two decades showed that it is possible to fulfill the requirements of the KHE concept. The KHE concept was essentially accepted by the German and French Safety Commissions and also incorporated in the German Atomic Law in 1994.

The main findings of the Karlsruhe research program for severe accidents were as follows:

In summary all most severe accident consequences found in the WASH-1400 or the German risk study can be either controlled or eliminated or managed in future LWRs by appropriate design measures. Examples for such designs are EPR and KERENA (SWR-1000). Concluding remarks compare the KHE safety concept with the safety concept of presently operating reactors and more recent designs for LWRs.

The safety of German nuclear power plants in the event of a postulated aircraft impact is addressed. The related requirements increased during the last decades and led to adequate constructive design measures.

The possible actions on nuclear power plants caused by different aircraft crash scenarios are described. To reduce the remaining risks of a possible crash on the safety-relevant buildings special requirements have to be taken into account during the design. Three groups of German nuclear power plants can be distinguished with respect to their resistance against the external event of an airplane crash according to the corresponding start of construction. The development of the structural design is described, from the first generation up to the current design.

The possible impact scenarios are considered from accidental aircraft impacts to deliberate forced impacts. The different relevant aircraft models and crash scenarios are discussed, including possible approach speed and angle.

As basis for the analysis and verification of building and mechanical components adequate load approaches for aircraft impacts have to be developed. Different approaches and mathematical models to derive load-time-functions for the contact force between airplane and hit structure are presented. Finally the shown impact load-time functions of the different types of aircraft are compiled for comparison.

The structural behaviour in the event of an airplane impact has to be analysed. The local resistance as well as the global stability has to be verified. The integrity and functional reliability of all safety related structures and components has to be guaranteed, including the effects of induced vibrations.

Special cases like engine impacts, the effects of flying wreckage or small aircraft and debris have to be considered in the design. Jet fuel fire may also cause damage and must be regarded.

The security status of German and foreign nuclear facilities is discussed. For the actual operating German reactors of type convoy it is not expected that an impacting aircraft—even under the assumption of a large commercial aircraft—would penetrate the shell of the building or that a significant amount of kerosene would enter the interior of the building.

The presented contribution deals with the design of nuclear power plants in Germany in the case of a postulated aircraft impact. Both the accidental crash of a fast flying military aircraft and the deliberate forced crash of a large commercial aircraft are considered. Requirements, effect types and crash scenarios are discussed. Using examples the development of load approaches are explained. Subsequently the basic procedure for the verification of the structural integrity of the building as well as the determination of induced vibrations is shown. Also briefly discussed are special considerations such as the effect of debris and jet fuel fires. An opinion is delivered to what extent the containments of German nuclear power plants are able to withstand a terrorist attack using a commercial aircraft.

The introduction outlines the field of application and the historical evolution of decision support systems for use in nuclear or radiological emergencies.

The chapter summarizes relevant radiological phenomena, the fundamentals of radiological emergency management, and the modeling of the radiological situation in computer programs. Topics as the data requirements of the models and the actual availability of data in the different phases of an accident and the respective uncertainties are also addressed. The chapter is mainly intended for readers without deeper familiarity with the respective scientific field.

The chapter begins with an outline of the historical development from the first UNIX-based RODOS system until the most recent Java-based version JRodos. This is followed by an overview of the models contained in RODOS, and a description of the RODOS Center in Germany, where RODOS operates since 2005 at a central location for use by the federal government and the federal states.

The chapter describes the contribution of the JRodos Accident Consequence Group of the Institute of Nuclear Technology and Energy Technology (IKET) as part of the activities of the Karlsruhe Institute of Technology (KIT), Germany, in frame of the Fukushima reactor accident.

The chapter outlines the Developments in Nuclear and Radiological Emergency Management from the 4th to the present 7th European Framework Program of the European Union.