Proposed AEC Licensing Procedure and Related Legislation

June – July 1971

Conclusions of the report of the advisory task force on power reactor emergency cooling (1967):

Current technology is sufficient to enable predicting with reasonable assurance the critical phenomena associated with the loss of coolant; for a quantitative understanding of the accident, the analysis of such an event requires that the core be maintained in place and essentially intact to preserve the heat transfer area and coolant-flow geometry. Fuel-element melting and core disassembly would be expected without preservation of the heat-transfer area and coolant-flow geometry. With the start of core disassembly, there would be a significant increase in the uncertainty of the prediction of core behavior, and the degeneration of the core to a meltdown situation could not be ruled out.

Although basic analytical techniques are available to predict the complex behavior characteristics of a loss-of-coolant adequately, further assurance of understanding the event would result from additional experimental and analytical information. Hence, experiments in geometries representative of reactor coolant systems should be conducted, and more precise analytical representations should also be developed.

The mechanical or structural response to the blowdown of key primary-system components must be such that the extent of deformations that could occur does not interfere with the effective cooling of the core, does not preclude reactor shutdown, and does not cause further consequential primary system damage. The structural integrity of emergency core-cooling systems must also be such that emergency core cooling can be accomplished.

As discussed in Conclusion 1, it is within the state of technology to predict, within conservative bounds, the hydraulic forces associated with blowdown. Methods are available for predicting the structural response to these forces, including prediction in the region of limited plastic deformation. The magnitude of these forces is within the range that can be handled with practicable engineering designs. Designs involving more extensive plastic deformation should not a priori be excluded, but the extent of deformation is currently difficult to predict.

The design requirements for the emergency core-cooling system must be:

  • First, to terminate in a loss-of-coolant accident core-temperature transients, which could otherwise result in the loss of a definable core heat-transfer and coolant-flow geometry
  • Then, to reduce the core to emergency core-coolant temperatures
  • Finally, maintain the body in this condition until full recovery from the loss-of-coolant accident is achieved.

It is essential to recognize that fulfillment of the first requirement necessitates preventing bulk melting of the clad. At present and in the context of present peaking factors, a conservative interpretation of this requirement would be that the emergency core-cooling system be designed to prevent clad melt. The accepted procedure for fulfilling the above requirement is to demonstrate analytically using a conservatively bounded evaluation that the core-cladding in its regular geometry does not melt. This procedure is considered to be sufficient. However, it must be emphasized that this interpretation of “no clad melt” is not a requirement in itself since it may be possible to demonstrate that temperature transients can still be terminated in the presence of some clad melting; and that, therefore, the overall objective for emergency core cooling would be satisfied.

Sufficient test data are available to indicate that the phenomena of spray cooling and flooding represent satisfactory approaches to emergency core cooling. The implementation of these phenomena as cooling techniques is amenable to experimental verification. While considerable effort has been expended in such experimental validation of core-cooling methods, further testing at higher temperatures, degenerated conditions, and general evaluations should be conducted.

The requirements for emergency core cooling are such that it is practical to design adequate emergency core-cooling systems within the current engineering technology.

Determining that the emergency core-cooling system used on a particular plant will be adequate requires detailed systems engineering evaluation. It is suggested that the elements of this evaluation be developed into a standardized procedure to ensure that the review is complete in all cases.

The concept of reliability analysis has proven a valuable and effective tool for systems evaluation in other industries. It is concluded that this concept can likewise be used to similar advantage in assessing emergency core-cooling systems. It would be of particular use in the relative comparison of methods. It would also serve to aid in the identification of areas within a system network that is critical to its reliability. Therefore, it is recommended that the necessary reliability discipline and techniques be established within the nuclear industry and placed on a formal basis to facilitate its implementation.

A central line of defense against the possibility of a core meltdown is the integrity of the primary system boundary. Much has been done to assure an acceptable level of integrity; however, the large number of plants now being constructed and planned for the future makes it prudent to provide even greater assurance. Accordingly, we recommend that improvements of the types suggested below be made both from a short-range and long-range standpoint.

Short Range

  • At a minimum, those parts of the primary system whose failure could lead to significant breaks should be designed, manufactured, and inspected to a high degree of reliability comparable to that presently used for reactor vessels and to the additional requirements enumerated below. The current efforts on preparation of nuclear piping and nuclear value and pump codes should be expedited, and these codes put into effect without delay to reflect these high standards. These standards should also be applied to those components critical to emergency core cooling. Thorough reviews of the design of each piece and subsystem making up the entire primary coolant system should be made by a qualified group separate from the one responsible for the procedure. This particular group could be within or without the same organization. These design reviews should also include systems and components other than the primary system which are critical to the problem of core cooling.
  • Adequate allowance should be made in designing and operating components and systems for the effects on materials from neutron irradiation, such as the shiur in nil ductility transition temperature. In addition, reactor vessel material, weldment, and heat-affected zone samples should be included in the reactor vessel for periodically monitoring changes in reactor-vessel-material and weldment properties during the vessel’s life. These considerations should be included in an appropriate standard or code. It should be noted that safety limits and conditions to assure that a plant is operated within approved design limits have to be specified in Plant Technical Specifications as required for obtaining AEC operating licenses.
  • Further emphasis should be placed on using overlapping inspection techniques, greater quality control, and training inspectors and test personnel. Areas suggested for consideration include:
    1. Apply more than one non destructive test method to increase the assurance of flaw detection where special considerations such as geometry, accessibility, or variation in test technique warrant. This inspection overlap could include, for example, the ultrasonic testing of weld joints and their radiography. In this connection, it is urged that standards and procedures be established to further use ultrasonic testing in inspecting primary components.
    2. Establish qualification standards for all nondestructive-test inspectors and test personnel. (It is understood that the ASME Boiler and Pressure Vessel Committee is presently working on establishing such standards.) Such personnel should be required to formally pass these standards before they can be used to inspect any primary coolant component or system. Further, the personnel should be re-exam periodically ally (every two years) to ensure they are fully knowledgeable and up-to-date with all the latest testing techniques and requirements.
    3. Have a formal quality-assurance plan prepared by the primary component manufacturer and approved by the organization responsible for the plant design, delineating the quality control used to manufacture the component.
    4. Establish a separate monitoring system to ensure that all phases of the quality-assurance program for the manufacture of each component are fully implemented.
  • Review and upgrading of Section III of the ASME Code, other appropriate codes, and inspection standards should be performed frequently to keep pace with improvements in technology, design techniques, inspection methods, and test equipment. All fabricators of primary coolant components and systems must use such codes and standards. (Ultrasonic testing of plates and forging is an example where the development of tighter inspection standards is underway.)
  • Prepare and keep accurate manufacturing and inspection records of primary system components signed by responsible company representatives on file.
  • Require a leak detection system (such as air-activity detectors) external to the primary system and not connected to it to provide early warning if a leak develops in the primary system. (Experience, as summarized in Appendix 32, indicates that leaks occurring in the primary methods are small, and any propagation would be very gradual.)

Long Range
In addition to the relatively short-range action outlined above, efforts should proceed toward developing reliable and repeatable in-service techniques and associated standards for detecting flaws in primary system components, especially reactor vessels, during plant shutdowns. It should be noted that effective utilization of such shutdown inspections will require a reference inspection before the element is placed in service. The periodic inspections aim to determine whether any change has occurred since the previous review. It is understood that a program on this subject is being initiated by the Pressure Vessel Research Committee, together with actual work on pressure vessel materials.


  • We consider it unnecessary to assume that large and rapid failures will occur in any component or system designed, manufactured, inspected, protected against missiles, and operated per the requirements in Conclusion 7 or their equivalent.
  • Because the record of conventional and nuclear plant performance indicates that small leaks from a pressurized system can occur, we consider it necessary backup-up means to be provided for introducing water into the primary method to ensure continued core cooling.
  • In addition to the first and second points, the emergency core-cooling system should also handle a significant and rapid failure of those components and techniques not designed, fabricated, inspected, protected against missiles, and operated by Conclusion 7 or its equivalent.
  • We expect that, as recommended herein, more and more elements of the primary system will be designed, manufactured, and inspected to the same degree of high standards as required by Section III of the ASME Code, its revisions in process, and additional requirements such as those recommended in this report, to give the same reliability as reactor vessels. This evolution, which will further assure primary system integrity, should make it possible to design emergency core-cooling systems for reduced brake sizes because large and rapid failures of components meeting the recommended standards will not have to be considered. Eventually, a minimum in the reduced break size would still have to be specified as a reasonable basis for designing emergency core-cooling systems. A prudent safety factor based on engineering experience and judgment should be used to establish such a minimum. Even with this safety factor, the minimum acceptable break size will eventually be considerably smaller than the current design basis.

The present concepts of containment, with their cooling systems, can provide an adequate barrier to releasing fission products to the environs when emergency core-cooling systems fulfill their design objectives. Both energy release and fission product release can be effectively contained.

Since the performance of the containment as a safeguard system is related to the performance of the other safeguard systems, we recommend that its design basis be chosen accordingly. Containment design should be based upon the energy released by the coolant, decay heat, and metal-water reactions consistent with the functioning of the emergency core-cooling system and a prudent safety margin.

Suppose emergency core-cooling systems do not function, and the meltdown of a substantial part of an irradiated core occurs. In that case, the current state of knowledge regarding the sequence of events and the consequences of the meltdown is insufficient to conclude with certainty that the integrity of containments of present designs, with their cooling systems, will be maintained.

Although containment integrity cannot be assured in the event of a postulated core meltdown, a significant period may elapse before breaching of the containment occurs. It may be possible to develop effective preventive measures during this period and reduce the hazards resulting from the subsequent failure of the containment. The desirability of utilizing such systems and the merits of requiring containments to be designed to assure such time availability should be evaluated after the effectiveness of these systems has been established through necessary development work. Such safeguards will depend on weighing their merits with those of other safety features to obtain the desired objectives in overall reactor safety.

Reliable and practical methods of handling large molten masses of fuel for long periods do not exist today. The desirability of seeking such practices to improve the independence of the containment as an engineered safeguard should be considered in light of primary system integrity and emergency core cooling effectiveness. It should be recognized that adequate means of holding the molten core are inadequate to prevent containment violations from overpressure.