RIDGE

Containment problems in homogeneous reoctors are discussed, with particular emphasis given to the manner in which they have been solved for the HRT. Bases for rigid leakage specifications on reactor components are explained. The design of the reactor enclosure is reviewed with respect to allowable leakage, as well as protection against fragments and internal pressures resulting from a reactor catastrophe.

This paper discusses the containment philosophy, design bases, and protective devices which have been adopted as a solution to the problem of containment in a typical homogeneous reactor installation, the Homogeneous Reactor Test (see Fig. 1) at Oak Ridge, Tennessee.
The probability is high that the loss of coolant from any reactor will result in the release of large quantities of radioactive materials. In a homogeneous reactor system the probability is unity by virtue of the fact that the coolant and the fuel are fluid and are intimately mixed. Thus the leakage of solution from a liquid-fuel reactor is equivalent to the decomposition of fuel elements in a solid-fuel reactor.
With homogeneous solution activities in the range 25 to 100 curies/ml, the mere postulation that a leak might occur brings up a serious containment problem.

PHILOSOPHY OF CONTAINMENT
The philosophy of containment at the Oak Ridge National Laboratory has evolved as knowledge and experience with experimental reactors hove accumulated. It is based on the conclusion that the consequences of a major release of radioactivity are much too serious for any goal other than that of complete containment to be considered for the worst accident.
This philosophy has undoubtedly been influenced by the proximity of Oak Ridge experimental reactors to installations of great national importance, the conviction that a catastrophic reactor accident which contaminated a large area would severely prejudice the future of nuclear reactors, and the desire to protect equipment and humankind at the reactor site as well as beyond the scene of the accident. It does not include protection against sabotage, acts of God, or acts of war. Neither does it assume to protect against the result of more than two simultaneous failures. The assumption is made, however, that all reasonable measures will be taken, first, to prevent the accident and, second, to confine the accident, should it occur. In designing for the containment of homogeneous reactor systems, it is immediately obvious that extremely rigid leakage specifications must be set. It is also soon obvious that a single barrier is insufficient protection and that two barriers must be employed to prevent the leakage of radioactive liquid to the atmosphere.

UNCLASSIFIED
The first barrier is the reactor itself, that is, piping and vessel walls which are analogous to the cladding or cans on the fuel in heterogeneous reactors. The fuel and blanket solutions normally circulate through this equipment at pressures as high as 135 atm and at temperatures up to 300°C. The leakage specification for this barrier is based on the minimum leak which can be found with the available mass spectrometer leak-detection equipment, namely, 0.1 cc helium (STP) per day. Allowing for several such minimum leaks, the equivalent loss of liquid at 300°C and at 2000 psig could be as great as 5 cc/day, or a total leakage of approximately 250 curies/day. Of course, every effort would be made to reduce the leakage to a minimum.
The second barrier is the vessel or tank in which all the reactor parts are installed.
It must be essentially a gastight membrane, located either inside or outside the biological shield. Because of its volume and surface area and because of the difficulty in measuring small leakage from very large vessels, the leakage rate for the second barrier is in the range 0.01 to 1 liter/min. The problem of leakage from the first barrier, the reactor vessels and piping, can be cataloged according to the various mechanisms through which leakage might result, as follows: 1. excessive stresses, 2. defective materials or workmanship, 3. corrosion, 4. nuclear accidents, 5. hydrogen-oxygen explosions, 6. brittle fracture.
Each possibility will be examined in detail in the discussion which follows.
Excessive Stresses. -There are many possibilities for the development of excessive stresses in a system as complex as the HRT. In order to reduce the likelihood of failure as a result of excessive stress, a maximum allowable working stress of 12,000 psi was specified for the type 347 stainless steel with which the system was fabricated. This permits an additional factor of safety over the 15,000 psi allowed by the ASME Boiler Code. As required by the ASA code for pressure piping, the reactor piping arrangement was examined for maximum stresses due to pressure, as well as for hoop and bending stresses resulting from thermal expansion. Equipment was also studied for determining the magnitude of thermal stresses caused by radiation heating and temperature cycling. Therefore, in order to keep the combined thermal and pressure stresses below the maximum allowable working stress, the pressure vessel wall is approximately 2 in. thicker than would be required otherwise. Heating and cooling rates on the entire system have been limited to 100°F/hr, and the differential temperature across heavy metal walls is kept below 100°F.
Cyclic temperature stresses at questionable points in the reactor pressure vessel and steam generators were explored experimentally. Mockups were fabricated for the testing of the pressure vessel nozzle joints and the stainless steel-to-Zircaloy bolted joint inside the pressure vessel. In each test the temperature was cycled from approximately 250°F to approximately 600°F in '^ hr and cooled back to 250°F in !^ hr. After 100 cycles the joints were found to be sound. Several potential hazards associated with the reactor vessel are reported in detail in another paper presented at this Conference.
Other details have been presented previously.^••' The main steam generators were also cycled in similar tests. Several tube joints cracked open during the first 50 cycles.
They were repaired and the heat exchangers subjected to an additional 10 cycles before final acceptance.
Bolted joints ore used whenever equipment is to be removed at some time after the reactor becomes radioactive. In the HRT the joints are ring-joint flanges with oval-ring gaskets. The choice of these joints for the 2000-psig operating pressure of the HRT was based principally on previous experience with the HRE and with experimental loops.
The ring-joint flange is illustrated in Fig. 2, which also shows a method of detecting leakage past the gasket. The small (]^-in.-OD, 0.065-in. wall) tube connected to the bottom of the ring groove is filled with water and kept at a pressure several atmospheres above the reactor system pressure. Should the seal on either side of the ring gasket be faulty, water will leak past the sealing surface -either into the reactor or to the outside.
In either case the leak is detected by a reduction in the pressure within the small tube, and a repair is made before activity escapes. Wherever it has been necessary to use the flat gaskets, the joints have been seal-welded after bolting.
Defective Materials or Workmanship, -Defective materials and poor workmanship constitute another area which requires special attention to prevent failures. All materials for the HRT were procured to specifications considerably more rigid than those existing in commercial practice. Optional requirements such as chemical analyses, boiling nitric acid tests, and microetch tests were exercised in all materials specifications. An additional cost, averaging about 10%, was experienced in the purchase of materials under  the more rigid specifications. In some instances, for example, with the heat exchanger tubes, special ultrasonic and magnetic eddy-current flaw detectors were employed to eliminate defective parts. At least one tube, and possibly three, which would have failed in operation was eliminated. Dye-penetrant tests were applied to tubing bends and to all welds throughout the reactor to detect cracks and pinholes. None were discovered in tubing bends but many were found in welds, especially in the tube-to-tube sheet welds.
Special attention was given to the welding of stainless steel butt joints, of which there are approximately 2000 in the entire reactor. The inert-gas, nonconsumableelectrode method was used almost entirely. Welds were inspected to considerably higher standards than required by the ASME code. In addition to being subjected to dye-penetrant inspection, every weld was x rayed. In spite of the rigid inspection standards, only 3% of the welds were rejected, necessitating rewelding.
Corrosion. -Although corrosion is an ever present possibility for leakage, complicated by the effects of radiation, the designer can do much to reduce the likelihood of excessive attack.
For instance, he can specify that fluid velocities be below the critical velocity at which a protective film fails to form. It is often possible to choose temperature conditions which will reduce the rate of attack. Marginal areas can be reinforced with more resistant materials or heavier walls. In the HRT, velocities are kept below 20 fps, the temperature is in the range 250 to 300°C, and some surface areas are lined with titanium for additional resistance.
In every case of corrosion failure experienced thus far, leakage has been relatively small -the pinhole type of leak. Such a leak in the reactor would alarm the cell air monitor and dump the reactor.
Nuclear Accidents. -Nuclear accidents are less likely in homogeneous reactors than in most solid-fuel reactors because of the large negative temperature coefficient (0.1 to 0.2% 8k/°C) characteristic of the aqueous liquid-fuel reactors.* As an example, the worst accident considered in the HRT Summary Report to the Advisory Committee on Reactor Safeguards^ was one in which all the uranium suddenly collects in the reactor core and results in a reactivity increase of 2,5% k/sec.
For this rate, starting at a power of only 0.4 w, the maximum pressure in the pressure vessel would be approximately 3900 lb, and the pressure stress in the carbon steel shell would be less than 30,000 psi.
Hydrogen-Oxygen Explosions, -Since radiolytic gases (deuterium and oxygen) are produced continuously in aqueous homogeneous reactors, they are the source of an ever-present hazard. Explosions may be expected whenever the deuterium-oxygen-steam mixture is more than 10% gas. For detonations, the required gas fraction is greater.
The maximum increase in pressure from an adiabatic explosion of hydrogen and oxygen is only a factor of 3 to 8, whereas for a detonation, the factor might be 23 for an undiluted mixture. It is important to note that detonations can occur only in gas channels that are relatively long and straight.
In low-pressure areas of homogeneous reactors it is generally easy to dilute the gas with steam and keep it noncombustible. Furthermore, a pressure of 500 psi is the basis for design of low-pressure (atmospheric) equipment. Even for a detonation, the expected peak pressure would be less than the design pressure.
Although an explosion could be tolerated in the high-pressure areas (2000 psia) with little danger of vessel rupture, a detonation probably could not be. However, the only likelihood of a detonation in the presently designed homogeneous reactors is in the gas separator, where the gas channel is long and straight -the vortex by which the radiolytic gas is collected for removal to the low-pressure system. It is calculated^ that a detonation wave traveling longitudinally along the vortex would produce impact pressures of the order of 30/000 psi but that the damage would be limited to the directional vanes inside the separator. Attenuation of the forces by the solution would limit the pressure rise to that resulting from combustion of the gas -10/000 psia, which produces a tolerable wall fiber stress of 35/000 psi. Thus no serious damage is forseen from explosions or detonations.
Brittle Fracture. -It is generally known that ferritic steels are subject to the phenomenon of brittle fracture. It has been reported* that the bombardment of carbon steels by fast neutrons raises the temperature at which there is a transition from ductile to brittle fracture. Whether this effect makes a high-temperature vessel more likely to fail by brittle fracture must be studred further.
Although the likelihood of brittle fracture in the HRT pressure vessel was known to be small, an investigation was made^ in order to determine the consequences of such an accident as a result of the pressure rise and missile damage. psi inside the reactor shield. Although it is somewhat difficult to design a large (25/000 ft-') rectangular container such as the HRT container to withstand a 30-psig pressure/ it is even more difficult to design it to withstand heavy missiles.
The 3910 lb of D^O at 300°C contains energy in the amount of 3.5 x 10^ Btu which can be utilized for mechanical work. Since this energy is equivalent to 150 lb of TNT and since the fracture of the vessel was assumed to occur instantaneously, TNT explosion data were studied. Recorded steam boiler explosions were also investigated.
Both studies indicated that missile velocities of 50 to 150 fps could be expected. With a reactor vessel which weighs 16/000 lb, as does the HRT vessel, 1600-lb fragments might be expected. Such a mass at 100 fps would lift an unrestrained 5-ft-thick concrete shielding plug nearly 1 ft.
Considering the consequences of such an accident and the containment philosophy which had been adopted, protection was believed to be necessary in spite of the small possibility that such an accident would ever occur. The least expensive way to provide such protection appeared to be a blast net completely surrounding the pressure vessel.
The net was discarded later for a solid shell with small openings to permit the gradual escape of steam from the accident.
The blast shell was designed to withstand the 1250-psig pressure which would result from the 300°C liquid, as well as to absorb the energy of the expanding steam. A wall 1?' in. thick made of type 304 stainless steel was found to be capable of absorbing 2.85 X 10* ft-lb of energy with 2% elongation. The fragments from the pressure vessel  Rupture, ORNL CF-54-12-100 (Dec. 14, 1954).

P. M. Wood, A Study of the Possible Blast Effects from HRT Pressure Vessel
would accumulate this much energy in traveling across an annulus of 4.8 in. To provide an additional factor of safety, the blast shell was constructed to surround the pressure vessel with an annulus not greater than 2 in.
A similar shield made of carbon steel was installed on both fuel and blanket steam generators as a final precaution against an explosion which might damage other equipment and the vapor barrier sufficiently to cause a release of activity. The probability of failure of the steam generator shells would not be affected by the presence of radiation because the generators are located in a low flux region.
In addition to the design considerations mentioned above, the reactor will be subjected to both hydrostatic and helium leak tests prior to operation. A hydrostatic test with D-0 distilled from the reactor solutions will also be applied at 30-day intervals throughout the operating life of the reactor.

Confining the Accident
The various means by which the highly radioactive solutions could be lost from the reactor and the measures taken to prevent the loss have been discussed. It is now assumed that the worst has occurred and that all the reactor solutions have suddenly leaked out. The problem, then, is one of confining the solution and its activity within a secondary container so that there will be no significant damage to personnel or to the equipment outside the container.
The total quantity of fission products, Q curies, in a reactor operating atP megawatts can be calculated from Q = H x 10* P t~^'^, with t the time in seconds after shutdown.
However, only a fraction of these fission products are understood to be serious from the standpoint of ingestion or inhalation. For a reactor power level of 5 Mw, the isotopes which cause concern total about 4.4 x 10* curies. Exposure limits have been calcu-lated^ on the basis of approximately 33 isotopes selected for half life, fission yield, and potential biological damage. The maximum permissible intake is determined by limiting the internal dose to any organ to 3.9 rep in a 13-week period. On this basis a person could inhale no more than a total of 150 fic (this intake is only one-third the value for a maximum permissible exposure of 25 rep to any organ over the total time that the isotopes remain in the body).
It is assumed that a person located within the reactor building at the time of the accident could escape to the outside within 3 min. At a breathing rate of 30 liters/min, his total intake of contaminated air would be 90 liters. In order not to exceed the 150-/xc limit, the concentration of activity in the air should be less than 150 ^c/90,000 cc = 1.67x10-3 fic/cc.
The concentration in the reactor enclosure after the accident would be 6 x 10^ fic/cc; a dilution factor of approximately 10* would be necessary to prevent overexposure. This factor of dilution can be obtained if it is assumed that there is a distributed leakage totaling approximately 100 cc/min from all joints and penetrations in the container and that there is uniform dilution within the main bay of the building. The means by which the leakage from the vapor barrier is limited to 100 cc/min will be described.

CONSTRUCTION OF THE VAPOR-TIGHT CONTAINER
Although the description which follows is based on a particular reactor container, the considerations apply equally to other homogeneous reactors and to other container designs. In the case of the Homogeneous Reactor Test, the design of the container was based on the assumptions discussed above, namely, a maximum leakage of 100 cc/min for an internal pressure of 30 psig, which resulted from the "worst" accident. The dimensions and shape of the 5-to 10-Mw HRT container were dictated by the space available within an existing building. An all-welded rectangular steel tank (see Fig, 3) was chosen as a liner for the biological shield. After completion of construction (see Fig. 4) and before installation of the reactor parts, the container was given a hydrostatic test at an average pressure of 32 psig. It is noted that the usual test pressure of 1,5 times the design pressure was not applied to the HRT container. The container design assumed that local yielding would occur at the design pressure and permitted such high stresses on the bases that occurrence of the "worst" accident is of very small probability and is limited to only once in the history of the container. During this test the welded joints were examined and were found to be free of leaks. Since there is no air lock or bolted closure in the tank, it was necessary to remove the top of the tank to install the reactor (see Fig. 5). Therefore the joints in this portion must be rewelded and retested when the reactor is ready for operation.
Were it not for the service and accessory lines which penetrate the walls of the vapor container, the problem of preventing leakage from the container would be relatively easy.
In a typical homogeneous reactor it is necessary to provide heating steam, cooling water, air, refrigerant, electrical, and thermocouple lines, steam-removal pipes, connections to instruments, leak detectors, etc. The HRT requires more than 5(X) penetrations to provide these services, and several different methods of protection against leakage are employed.
Lines such as heating steam which feed from a closed system to jackets surrounding reactor pipes and which normally operate at a pressure above 30 psig are provided with check valves on the inlet side and with radiation detectors on the outlet end. The detectors automatically operate electric or air-powered valves if radiation is sensed.
Other lines such as those transmitting air are blocked individually at both entrance and exit by small piston-operated valves which close whenever activity or pressure increase is detected in the air inside the vapor barrier.
Electrical and thermocouple penetrations are sealed and insulated at the reactor end with metal-glass or powdered ceramic compression seals. At the control room end the conduits are filled with transformer sealing compound. Air pressure is applied to the space between the two seals.

I-X m
Pipes for the withdrawal of reactor-produced steam are monitored by a dual radiation detector which can close (2-sec response) a plug cock type of valve before activity can progress through a steam drum (3-sec holdup) and reach the valve.
All primary instrument-sensing elements are located in a separately shielded and sealed instrument cave, attached to the main reactor cell but with a separate entry.
Activity leaking into this space would be vented into the vapor container.
Before they are approved for operation, all the lines which penetrate the container walls are tested hydrostatically and with a helium leak detector. The tests consist in pressurizing the container with a helium gas mixture and surveying for leakage with a probe line attached to the mass spectrometer. In the HRT a total leakage considerably less than the permissible 100 cc/min is expected to be attainable.

SUMMARY
To summarize, the loss of fission-product activity is more likely to occur in aqueous homogeneous reactors than in solid-fuel reactors because the loss occurs whenever the reactor piping or vessels leak. It is possible, by particular attention to design details, to minimize the likelihood of leakage from the reactor itself. However, the consequences of leakage are too serious for any but complete containment to be considered, a goal which requires the design of a vapor container to enclose the reactor and to prevent leakage to the atmosphere even in the event of the maximum credible accident. In the HRT this aim is achieved with a completely welded enclosure in conjunction with special sealing and protective devices on the pipes and wires which penetrate the walls of the enclosure.