Objective:

To develop a set of design basis accidents for the reactor specified below along with the
explanation for each event. To provide design solutions if any design basis accidents are
inconsistent with an urban location.

Given:
A small reactor for urban district heating as shown below:

It is intended to be located in urban areas in buildings such as hospitals or universities.

Analysis Methodology:
1. In order to develop a set of design basis accidents (DBA) for this reactor, more than one
technique is utilized as follows:
a. Top-Down Approach
b. Bottom-up Approach
Probabilistic safety analysis (PSA) could also be used to obtain a list of accidents and their
frequency (event trees); and DBA can be selected from this list if those DBAs are not
covered by the above mentioned two techniques (a & b). However, for the solution of this
problem, only two techniques (a & b) have been used.
2. It is given that the fuel temperature is low, so there are not free fission products in the
fuel. However, during the analysis, it is assumed that fuel temperature can reach to higher
temperature (assumption no 4).
3. As the hydrogen atoms in water coolants are bombarded with neutrons, some absorb a
neutron to become deuterium (D), and then some become radioactive tritium (T). During
the analysis, presence of radioactive elements are considered in the primary coolant
circuit (water pool) and DBA are identified considering leakage of primary coolant into
another circuits / systems via primary heat exchanger located in the pool.

Assumptions:
1. Top-Down and Bottom-Up approaches cover all the DBA identified by probabilistic safety
analysis.
2. Secondary circuit pump is located outside the double-wall pool beside secondary heat
exchanger.
3. Fuel refill / maintenance hole is provided on the lid.
4. The reactor has inherent negative reactivity feedback which does not allow fuel to reach
to very high temperature. However, unidentified / unaccountable parameters (or human
errors) at designing stage have been assumed which prevent the negative reactivity
feedback leading to higher fuel temperature.
5. There are three safety shutdown features in the reactor; 1) negative reactivity feedback,
2) passive shutdown system (rods operated by a signal) & 3) fully passive system
(thermally activated rods). It is assumed that probability / frequency of failing all these
three systems together is very very low.

Top-Down Approach:
Top-Down approach (figure-1) is used to identify direct and indirect causes which lead to the
selected undesired outcome.
In this scenario, undesired outcome is Unwanted movement of radioactive material
 Unwanted movement of
radioactive material

From the pool Outside the pool

Leak in secondary piping Leak in secondary pump Through purification

system

Improper
connection / fittings Physical Damage Seal Leakage

Pump seal Spent Ion Leakage through

Physical Damage
leakage Exchange Resins pipe fittings

Higher Fuel From Pool wall

Temperature Moderator physical damage

Higher Tritium % Operator falling into Moderator overflow from

the pool from lid hole pool during makeup

Leve Instrument
Loss of Loss of malfunction
Coolant Flow Heat sink

Loss of natural Loss of coolant in Loss of coolant in

circulation secondary circuit tertiary circuit

A B C D
 A B C D

High depth of the Not enough density

pool (12 m) difference

Pump failure H/E tube leakage Pipe leakage Loss of Electricity

H/E tube Unavailability Loss of Electricity

Pump failure Pipe leakage
rupture of heat-load

Earthquake Increase of inside pressure Damage during refueling

Blockage in venting

[Figure 1] Top-Down Approach

Detailed explanation on how these causes are identified are listed out below:
1. For the top-down approach, identified undesired outcome is Unwanted movement of
radioactive material as this is the primary safety requirement for any nuclear reactor,
especially for Slowpoke system which is intended to be located in urban buildings such as
hospitals or universities.
2. The water in the pool acts as neutron moderator, cooling agent as well as radiation shield. To
develop a set of design basis accidents for this reactor, unwanted movement of radioactive
material is identified from two different sources, 1) from the pool & 2) outside the pool.
3. The reactor has inherent negative reactivity feedback which does not allow fuel to reach to
very high temperature. However, supposing unidentified / unaccountable parameters at
 designing stage which prevents the negative reactivity feedback. So, higher fuel higher
temperature may possible due to loss of coolant flow or loss of heat sink.
4. Loss of coolant flow may happen due to following reasons:
Loss of natural circulation:
The depth of the pool is 12 meters; and the pressure is maintained at atmospheric
pressure. The distance between the bottom of core (cooling water entrance to core) and
the primary heat exchanger is apx 9.8 m. This distance might not be sufficient for the
natural recirculation to sustain considering pressure drops across the heat exchanger
tubing and reactor core.
The natural circulation occurs due to density difference. If the difference is not sufficient
then the circulation would not be as per the requirement.
5. Loss of heat sink may happen due to following reasons:
Loss of coolant in secondary circuit:
The loss of secondary coolant may happen due to coolant pump failure, pipe fitting
leakage, heat exchanger tube rupture as well as loss of electricity.
Loss of coolant in tertiary circuits:
The loss of secondary coolant may happen due to coolant pump failure, pipe fitting
leakage, heat exchanger tube rupture, unavailability of heat-load as well as loss of
electricity.
6. As the hydrogen atoms in water coolants are bombarded with neutrons, some absorb a
neutron to become deuterium (D), and then some become radioactive tritium (T). The
moderator in the pool contains some % of tritium. There might be possibility of emitting
radiation out of the pool from tritium (T) if tritium % is higher.
7. An operator may fall into the pool if the fuel refill or maintenance hole is kept open after
usage; which may expose the operator to the higher amount of radiation as well as nearby
people after he / she is evacuated from the pool.
8. Water level in the pool should vary based on the heat generation (higher heat generation
from the fuel requires higher water level for radiation shield). If the water filling operation in
the pool is automatically controlled by level instrument then there is a possibility of
moderator overflow via venting or fueling hole of lid if the level instrument malfunctions.
9. Radioactive elements can leak in case physical damage to the walls of the pool, which may
happen due to earthquake, damage during refueling. The pool is covered by top lid, which
may have tight seal (not enough data available in problem), and if there is a blockage in
venting device then there is a possibility of increase in pool inside pressure built up over a
period of time.
10. For the leakage outside the pool, it is considered that radioactive elements (i.e. tritium)
transgressed into the secondary coolant circuit via leakage in the primary heat exchanger.
The radioactive elements can leak out via secondary piping fittings or sealing of the secondary
pumps.
11. The purification system is location outside the pool wall. Pool water can leak out from the
pump seal as well as pipe fittings of the purification system.
12. Ion-exchange resins are used for the purification of the moderator, which are to be stored or
disposed after their useful life (meaning their regeneration ability is significantly reduced).
These spent resins might be having some traces of radioactive elements and hence, it exhibits
risk of unwanted movement of radioactive element if resins are not properly stored or
disposed.

Bottom-up Approach:
Bottom-up approach (figure-2) is used to identify impact of failure of each component of the
system.

Secondary cooling water

circuit failure

Improper Pump Seal

connection / fittings Physical Damage Leakage H/E tube failure Pump failure

Loss of electricity

Tertiary cooling water

circuit failure

Improper Unavailability
connection / fittings Physical Damage H/E tube failure
of heat load

Purification unit
failure

Improper Pump Seal Unavailability of

connection / fittings Physical Damage Leakage Pump failure
resin regeneration
capability

Loss of electricity
 Failure in control rod
operating system

Rod actuation
Loss of electricity device failure

Failure in primary core

cooling system

Higher depth of Blockage in H/E tube

the pool reactor tubing blockage

Failure in shutdown
systems

Failure in Failure in fully

passive system shutdown system

No melting of
Signal malfunction Rod chocked up absorber material

[Figure 2] Bottom-UP Approach

For the Slowpoke energy system, following major system failure is considered for the analysis:
1. Secondary cooling water circuit failure:
This system can fail in a number of ways: water leakage due to improper connections /
fittings, or physical damage, or leakage through pump seal, or heat exchanger tube failure,
or pump failure. In case of such failures, emergency coolant supply system may be
provided until the core heat generation is reduced due to negative reactivity feedback or
 control rods. The additional emergency coolant supply system may also avoid prompt
activation of two shutdown systems during some transient temperature increase due to
above reasons.
2. Tertiary cooling water circuit failure:
This system can fail in a number of ways: water leakage due to improper connections /
fittings, or physical damage, or heat exchanger tube failure, or unavailability of heat load.
In case of such failures, emergency coolant supply system may be provided until the core
heat generation is reduced due to negative reactivity feedback or control rods. The
additional emergency coolant supply system may also avoid prompt activation of two
shutdown systems during some transient temperature increase due to above reasons.
3. Purification unit failure:
This system can fail in a number of ways: water leakage due to improper connections /
fittings, or physical damage, or pump failure, or pump seal leakage, or loss of electricity,
or unavailability of resin regeneration capability. As failure of this system does not impact
the core processes immediately, the system can be maintained while the reactor
functions normally. However, spent resins management should be in place to store or
dispose the spent resins in safe manner.
4. Failure in control rod operating system:
This system can fail in a number of ways: loss of electricity, or rod actuation device failure.
In the above scenario, two shutdown systems can shut the system down.
5. Failure in primary core cooling system:
This system can fail in a number of ways: higher depth of the pool, or blockage in reactor
reactor tubing, or primary heat exchange tube blockage. In such scenarios, provision of
additional auxiliary primary circulating pump as well as redundant primary heat
exchanger should be provided that may protect against these failures.
6. Failure in shutdown systems:
There are two shutdowns systems, one passive system and one fully passive system. The
first passive system can fail if signal malfunctions or the rods chocked up. The second fully
passive system can fail if there no melting of absorber material. These two shutdown
systems are in addition to the negative reactivity feedback phenomena of the reactor.
Considering these safety features, probability / frequency of failing all these three
systems together is very very low (assumption-5).

Design basis accidents:

During the above approaches, many design basis accidents are identified. Some of the accidents
seems inconsistent with the urban location. These accidents can be made impossible by installing
additional safety features or design modifications.
Below is the list of those accidents along with the suggested solutions to make them impossible:

Sl. No. Design Basis Accident Suggested Solution

1 Leakage in secondary Presence of radioactive element in the secondary circuit
piping suggests that there is leakage in the primary heat
2 Leak in secondary pump exchanger. Hence, a redundant heat exchanger can be
connection / fittings provided (and isolating leaking heat exchanger from the
3 Secondary pump seal service in case of the leaking event) and utilized in the
leak event of radioactive element detection in the secondary
4 Purification system pipe circuit.
fitting leakage
The secondary piping and secondary heat exchangers are
5 Purification system
outside the double walled structure. There is a
pump seal leakage
confinement boundary (not shown in the problem)
6 Physical damage covering the pool top. If these equipment are inside the
confinement boundary then it might be consistent with an
urban location.
7 High depth of the pool Depth of the pool (height difference between the cooling
water entrance in core and primary heat exchanger) is on
higher side, which may not support natural recirculation.
Hence, it should be reduced.

The height can be calculated by factoring the natural

recirculation requirement, flow requirement to carry out
heat from the core as well as radiation shielding height
requirement above the core.

If the depth cannot be reduced after considering above

aspects than auxiliary primary circulating pump can be
considered to be installed to augment the circulation of
the water through the core.
8 Not enough density Natural circulation is driven by the density difference
difference between the liquid particles. If by some reasons, enough
density difference is not available then the cooling water
circulation can be maintained by auxiliary primary
circulating pump.
9 Loss of coolant in Emergency coolant supply system should be provided
secondary circuit which takes away heat from primary circuit until the core
heat generation is reduced using control rods.
10 Loss of coolant in Emergency coolant supply system should be provided
tertiary circuit which takes away heat from secondary circuit until the
core heat generation is reduced using control rods.
11 Earthquake The conventional building in which the reactor installed
should be earthquake resistant.
 Moreover, the Slowpoke energy system should be
installed on ground floor or below ground.
12 Blockage in venting Lid on top of the pool should be removed in order to avoid
any possibility of pressurization due to blockage in venting
or lid jamming.
When the lid is removed following changes can be done:
1. Additional light water shielding layer to make up for
the removed lid shielding. This light water would not
pass though the core for cooling purpose.
2. Grill can be installed instead of the lid to avoid falling
of any operator inside the pool.
13 Loss of electricity Provision of auxiliary diesel generator dedicated
specifically to the reactor system (independent to the
backup power supply of building (hospital or university))
14 Tube blockage in Provision of a redundant heat exchanger
primary heat exchanger
15 Moderator overflow Provision of redundant level instruments
from pool during
makeup
16 Leakage from spent ion- Spent resin management system should be in place to
exchange resins store or dispose spent resins safely

[Table-1] Design Basis Accidents with suggested solutions

Conclusion:
By using two approaches (Top-Down & Bottom-Up), design basis accidents have been identified,
and some solutions have been suggested in Table-1 in order to make them impossible to happen.