Boiling water reactor safety systems are nuclear safety systems constructed within boiling water reactors in order to prevent or mitigate environmental and health hazards in the event of accident or natural disaster.
Like the pressurized water reactor, the BWR reactor core continues to produce heat from radioactive decay after the fission reactions have stopped, making a core damage incident possible in the event that all safety systems have failed and the core does not receive coolant. Also like the pressurized water reactor, a boiling water reactor has a negative void coefficient, that is, the neutron (and the thermal) output of the reactor decreases as the proportion of steam to liquid water increases inside the reactor.
However, unlike a pressurized water reactor which contains no steam in the reactor core, a sudden increase in BWR steam pressure (caused, for example, by the actuation of the main steam isolation valve (MSIV) from the reactor) will result in a sudden decrease in the proportion of steam to liquid water inside the reactor. The increased ratio of water to steam will lead to increased neutron moderation, which in turn will cause an increase in the power output of the reactor. This type of event is referred to as a "pressure transient".
Safety systems The BWR is specifically designed to respond to pressure transients, having a "pressure suppression" type of design which vents overpressure using safety-relief valves to below the surface of a pool of liquid water within the containment, known as the "wetwell", "torus" or "suppression pool". All BWRs utilize a number of safety/relief valves for overpressure; up to 7 of these are a part of the Automatic Depressurization System (ADS) and 18 safety overpressure relief valves on ABWR models,Various GE promotional slideshows & ABWR Tier 2 Design Control Document, USNRC only a few of which have to function to stop the pressure rise of a transient. In addition, the reactor will already have rapidly shut down before the transient affects the RPV (as described in the Reactor Protection System section below.Youngborg, L.H.; "Retrofits to BWR safety and nonsafety systems using digital technology," Nuclear Science Symposium and Medical Imaging Conference, 1992., Conference Record of the 1992 IEEE, vol., no., pp. 724–726 vol. October 2, 25–31, 1992)
Because of this effect in BWRs, operating components and safety systems are designed with the intention that no credible scenario can cause a pressure and power increase that exceeds the systems' capability to quickly shut down the reactor before damage to the fuel or to components containing the reactor coolant can occur. In the limiting case of an ATWS () derangement, high neutron power levels (~ 200%) can occur for less than a second, after which actuation of SRVs will cause the pressure to rapidly drop off. Neutronic power will fall to far below nominal power (the range of 30% with the cessation of circulation, and thus, void clearance) even before ARI or SLCS actuation occurs. Thermal power will be barely affected.
In the event of a contingency that disables all of the safety systems, each reactor is surrounded by a containment building consisting of of steel-reinforced, pre-stressed concrete designed to seal off the reactor from the environment.
However, the containment building does not protect the fuel during the whole fuel cycle. Most importantly, the spent fuel resides long periods of time outside the primary containment. A typical spent fuel storage pool can hold roughly five times the fuel in the core. Since reloads typically discharge one third of a core, much of the spent fuel stored in the pool will have had considerable decay time. But if the pool were to be drained of water, the discharged fuel from the previous two refuelings would still be "fresh" enough to melt under decay heat. However, the zircaloy cladding of this fuel could be ignited during the heatup. The resulting fire would probably spread to most or all of the fuel in the pool. The heat of combustion, in combination with decay heat, would probably drive "borderline aged" fuel into a molten condition. Moreover, if the fire becomes oxygen-starved (quite probable for a fire located in the bottom of a pit such as this), the hot zirconium would rob oxygen from the uranium dioxide fuel, forming a liquid mixture of metallic uranium, zirconium, oxidized zirconium, and dissolved uranium dioxide. This would cause a release of fission products from the fuel matrix quite comparable to that of molten fuel. In addition, although confined, BWR spent fuel pools are almost always located outside of the primary containment. Generation of hydrogen during the process would probably result in an explosion, damaging the secondary containment building. Thus, release to the atmosphere is more likely than for comparable accidents involving the reactor core.
Reactor Protection System (RPS)
The Reactor Protection System (RPS) is a system, computerized in later BWR models, that is designed to automatically, rapidly, and completely shut down and make safe the Nuclear Steam Supply System (NSSS – the reactor pressure vessel, pumps, and water/steam piping within the containment) if some event occurs that could result in inadvertent criticality. The RPS also initiates trip when the reactor coolant pressure boundary, containment, or fuel are in rish. The RPS does not control Emergency Core Cooling Systems (ECCS). However, the RPS does control primary containment isolation functions. It does not require human intervention to operate. However, the reactor operators can override parts of the RPS if necessary. If an operator recognizes a deteriorating condition, and knows an automatic safety system will activate, they are trained to pre-emptively activate the safety system.
If the reactor is at power or ascending to power (i.e. if the reactor is supercritical; the control rods are withdrawn to the point where the reactor generates more neutrons than it absorbs), there are safety-related contingencies that may arise that necessitate a rapid shutdown of the reactor, or, in Western nuclear parlance, a "SCRAM". The SCRAM is a manually triggered or automatically triggered rapid insertion of all control rods into the reactor, which will take the reactor to decay heat power levels within tens of seconds. Since ≈ 0.6% of neutrons are emitted from fission products ("delayed" neutrons), which are born seconds or minutes after fission, all fission can not be terminated instantaneously, but the fuel soon returns to decay heat power levels. Manual SCRAMs may be initiated by the reactor operators, while automatic SCRAMs are initiated upon:
Turbine stop-valve or turbine control-valve closure. If turbine protection systems detect a significant anomaly, admission of steam is halted. Reactor rapid shutdown is in anticipation of a pressure transient that could increase reactivity. Generator load rejection will also cause closure of turbine valves and trip RPS. This trip is only active above approximately 1/3 reactor power. Below this amount, the bypass steam system is capable of controlling reactor pressure without causing a reactivity transient in the core. Loss of off-site power (LOOP) During normal operation, the reactor protection system (RPS) is powered by off-site power Loss of off-site power would open all relays in the RPS, causing all rapid shutdown signals to come in redundantly. would also cause MSIV to close since RPS is fail-safe; plant assumes a main steam break is coincident with loss of off-site power. Neutron monitor trips – the purpose of these trips is to ensure an even increase in neutron and thermal power during startup. Source-range monitor (SRM) or intermediate-range monitor (IRM) upscale: The SRM, used during instrument calibration, pre-critical, and early non-thermal criticality, and the IRM, used during ascension to power, middle/late non-thermal, and early or middle thermal stages, both have trips built in that prevent rapid decreases in reactor periodthat amount of time, normally in seconds, required for neutron flux (power) to change by a factor of e, or 2.718 when reactor is intensely reactive (e.g. when no voids exist, water is cold, and water is dense) without positive operator confirmation that such decreases in period are their intention. Prior to trips occurring, rod movement blocks will be activated to ensure operator vigilance if preset levels are marginally exceeded. Average power range monitor (APRM) upscale: Prevents reactor from exceeding pre-set neutron power level maxima during operation or relative maxima prior to positive operator confirmation of end of startup by transition of reactor state into "Run". Average power range monitor / coolant flow thermal trip: Prevents reactor from exceeding variable power levels without sufficient coolant flow for that level being present. Oscillation Power Range Monitor Prevents reactor power from rapidly oscillating during low flow high power conditions. Low reactor water level: Loss of coolant contingency (LOCA) Loss of proper feedwater (LOFW) Protects the turbine from excessive moisture carryover if water level is below the steam separator and steam dryer stack. High water level (in BWR6 plants) Prevents flooding of the main steam lines and protects turbine equipment. Limits the rate of cold water addition to the vessel, thus limiting reactor power increase during over-feed transients. High drywell (primary containment) pressure Indicative of potential loss of coolant contingency Also initiates ECCS systems to prepare for core injection once the injection permissives are cleared. Main steam isolation valve closure (MSIV) Protects from pressure transient in the core causing a reactivity transient Only triggers for each channel when the valve is greater than 10% closed Some combination of valves may be closed and will not initiate a reactor scram.. High RPV pressure: Indicative of MSIV closure. Decreases reactivity to compensate for boiling void collapse due to high pressure. Prevents pressure relief valves from opening. Serves as a backup for several other trips, like turbine trip. Low Main Steam Line Pressure: Indicative of a line break in the steam tunnel or other location which does not trigger high drywell pressure, or of a failing main turbine pressure controller. Closes the Main Steam Isolation Valves (MSIVs) to halt the depressurization. This action would automatically initiate a scram signal on MSIV closure. Bypassed when the reactor mode switch is not in run mode to allow normal depressurization and pressurization during startup. Seismic event Generally only plants in high seismic areas have this trip enabled. Scram Discharge Volume High In the event that the scram hydraulic discharge volume begins to fill up, this will scram the reactor prior to the volume filling. This prevents hydraulic lock, which could prevent the control rods from inserting. This is to prevent an ATWS (Anticipated Transient Without Scram). This trip was implemented due to the Browns Ferry ATWS.
Emergency core-cooling system (ECCS)
While the reactor protection system is designed to shut down the reactor, ECCS is designed to maintain adequate core cooling. The ECCS is a set of interrelated safety systems that are designed to protect the fuel within the reactor pressure vessel, which is referred to as the "reactor core", from overheating. The five criteria for ECCS are to prevent peak fuel cladding temperature from exceeding 2200 °F (1204 °C), prevent more than 17% oxidation of the fuel cladding, prevent more than 1% of the maximum theoretical hydrogen generation due the zircalloy metal-water reaction, maintain a coolable geometry, and allow for long-term cooling.
ECCS systems accomplish this by maintaining reactor pressure vessel (RPV) cooling water level, or if that is impossible, by directly flooding the core with coolant.