The design requirements for the emergency core-cooling system must be:

a. First, to terminate in a loss-of-coolant accident core-temperature tran-sients which could otherwise result in the loss of a definable core heat-transfer and coolant-flow geometry;
b. Then, to reduce the core to emergency core-coolant temperatures; and,
c. Finally, to maintain the core in this condition until full recovery from the loss-of-coolant accident is achieved.

It is important to recognize that fulfillment of the first requirement ne-cessitates the prevention of bulk melting of the clad. At the present time and in the context of present peaking factors, a conservative interpretation of this requirement would be that the emergency core-cooling system be designed to prevent clad melt. Currently, the accepted procedure for fulfillment of the above requirement is to analytically demonstrate by means of a conservatively bounded evaluation that the core cladding in its normal geometry does not melt. This procedure is considered to be sufficient. However, it must be emphasized that this interpretation of “no clad melt” is not a requirement in itself since it may be possible to demonstrate that temperature transients can still be terminated in the presence of some clad melting; and that therefore, the overall objective for emergency core cooling would be satisfied.

Sufficient test data are available to indicate that the phenomena of spray cooling and flooding represent satisfactory approaches to emergency core cooling. The implementation of these phenomena as cooling techniques is amenable to experimental verification. While there has been considerable effort expended in such experimental verification of core-cooling techniques, further testing at higher temperatures and degenerated conditions as well as general evaluations should be conducted.

The requirements for emergency core cooling are such that it is practical to design adequate emergency core-cooling systems within the current engineering technology.

The determination that the emergency core-cooling system used on a particular plant will be adequate requires detailed systems engineering evaluation. It is suggested that the elements of this evaluation be developed into a standardized procedure to insure that the evaluation is complete in all cases.

The concept of reliability analysis has proven a useful and effective tool for systems evaluation in other industries. It is concluded that this concept can likewise be used to similar advantage in the assessment of emergency core-cooling systems. It would be of particular use in the relative comparison of systems and would also serve to aid in the identification of areas within a system network which are critical to its reliability. It is, therefore, recommended that the necessary reliability discipline and techniques be established within the nuclear industry and that this be placed on a formal basis to facilitate its implementation.

A main line of defense against the possibility of a core meltdown is the integrity of the primary system boundary. Much has been done already to assure an acceptable level of integrity; however, the large number of plants now being constructed and planned for the future makes it prudent that even greater assurance be provided henceforth. Accordingly, we recommend that improvements, of the types suggested below, be made both from a short-range and long-range standpoint.

Short Range
a. As a minimum, those parts of the primary system whose failure could lead to large breaks should be designed, manufactured, and inspected to the high degree of reliability comparable to that presently used for reactor vessels, and to the additional requirements enumerated below. The present efforts on preparation of nuclear piping and nuclear value and pump codes should be expedited and these codes put into effect without delay to reflect these high standards. These standards should also be applied to those components critical to emergency core cooling. Thorough reviews of the design of each component and subsystem making up the entire primary coolant system should be made by a qualified group separate from the one that has responsibility for the design. This separate group could be within or without the same organization. These design reviews should also include systems and components other than the primary system which are critical to the problem of core cooling.

b. Adequate allowance should be made in the design and operation of components and systems for the effects on materials resulting from neutron irradiation, such as the shifts which occur in the nilductility transition temperature. In addition, reactor vessel material, weldment, and heat-affected zone samples, should be included in the reactor vessel for periodically moni-toring changes in reactor-vessel-material and weldment properties during the life of the vessel. These considerations should be included in an appropriate standard or code. It should be noted that safety limits and conditions to assure that a plant is operated within approved design limits have to be specified in Plant Technical Specifications as required for obtaining AEC operating licenses.

c. Further emphasis should be placed on using overlapping inspection techniques, on greater quality control, and on the training of inspectors, and test personnel. Areas suggested for consideration include:

(1) Apply more than one nondestructive-test method in order to increase the assurance of flaw detection where special considerations such as geometry, accessibility, or variation in test technique warrant. This overlapping in inspection could include, for example, the ultrasonic testing of weld joints as well as their radiography. In this connection it is urged that standards and procedures be established to further the use of ultrasonic testing in the inspection of primary components.

(2) Establish qualification standards for all nondestructive-test inspectors and test personnel. (It is understood that the ASME Boiler and Pressure Vessel Committee is presently working on establishing such standards.) Such personnel should be required to formally pass these standards before they can be used to inspect any primary coolant component or system. Further, the personnel should be re-examined peri-odically (every two years) to assure that they are fully knowledgeable and up-to-date with all latest testing techniques and requirements.

(3) Have a formal quality-assurance plan, prepared by the primary component manufacturer and approved by the organization responsible for the plant design, which delineates the quality control that will be used in the manufacture of the component.

(4) Establish a separate monitoring system to assure that all phases of the quality-assurance program for the manufacture of each component are fully implemented.

d. Review and upgrading of Section III of the ASME Code, other appropriate codes, and inspection standards should be performed frequently to keep pace with improvements in technology, design techniques, inspection methods, and test equipment. Require that such codes and standards be used by all fabricators of primary coolant components and systems. (Ultra-sonic testing of plates and forging is an example where the development of tighter inspection standards is underway.)

e. Prepare and keep on file accurate manufacturing and inspection records of primary system components signed by responsible company representatives.

f. Require a leak detection system (such as air-activity detectors) external to the primary system and not connected to it so as to provide early warning if a leak develops in the primary system. (Experience as summarized in Appendix 32 indicates that leaks occurring in the primary systems are small and any propagation would be very gradual.)

Long Range
In addition to the relatively short-range action outlined above, effort should proceed toward the development of reliable and repeatable in-service techniques and associated standards for detecting flaws in primary system components, especially reactor vessels, during plant shutdowns. It should be noted that effective utilization of such shutdown inspections will require a reference inspection before the component is placed in service. The purpose of the periodic inspections is to determine whether any change has occurred since the previous inspection. It is understood that a program on this subject is being initiated by the Pressure Vessel Research Committee together with fundamental work on pressure vessel materials.

a. We consider it unnecessary to assume that large and rapid failures will occur in any component or system which is designed, manufactured, inspected, protected against missiles, and operated in accordance with the requirements given in Conclusion 7 or their equivalent.

b. Because the record of conventional as well as nuclear plant performance to date clearly indicates that small leaks from a pressurized system can occur, we consider it necessary that back-up means be provided for introducing water into the primary system to assure continued core cooling.

c. In addition to a. and b., the emergency core-cooling system should also be capable of handling a large and rapid failure of those components and systems which are not designed, fabricated, inspected, protected against missiles, and operated in accordance with Conclusion 7 or its equivalent.

d. We expect that, as recommended herein, more and more elements of the primary system will be designed, manufactured, and inspected to the same degree of high standards as required by Section III of the ASME Code, its revisions in process, and additional requirements such as those recommended in this report, to give the same reliability as reactor vessels. This evolution, which will further assure primary system integrity, should make it possible to design emergency core-cooling systems for reduced break sizes, because large and rapid failure of components meeting the recommended standards will not have to be considered. Eventually, a minimum in the reduced break size would still have to be specified as an acceptable basis for designing emergency core-cooling systems. In establishing such a minimum, a prudent safety factor based on engineering experience and judgment should be used. We consider that even with this safety factor the minimum acceptable break size eventually will be considerably smaller than the current design basis.

The present concepts of containment, with their cooling systems, can provide an adequate barrier to the release of fission products to the environs when emergency core-cooling systems fulfill their design objectives. Both energy release and fission product release can be effectively contained.

Since the performance of the containment as a safeguard system is related to the performance of the other safeguard systems, we recommend that its design basis be chosen accordingly. Containment design should be based upon the energy released by the coolant, decay heat, and metal-water reactions consistent with functioning of emergency core-cooling system and a prudent safety margin.

If emergency core-cooling systems do not function and meltdown of a substantial part of an irradiated core occurs, the current state of knowledge regarding the sequence of events and the consequences of the meltdown is insufficient to conclude with certainty that integrity of containments of present designs, with their cooling systems, will be maintained.

Although containment integrity cannot be assured in the event of a postulated core meltdown, a significant period of time may elapse before breachment of the containment occurs. It may be possible to develop preventive measures which are effective during this period and which could reduce the hazards resulting from subsequent failure of the containment. The desirability of utilizing such systems and the merits of requiring containments to be designed to assure such time availability should be evaluated after the effectiveness of these systems has been established through necessary development work. The use of such safeguards will depend on weighing their merits with those of other safety features to obtain the desired objectives in overall reactor safety.

Reliable and practical methods of handling large molten masses of fuel for long periods of time do not exist today. The desirability of seeking such methods in order to improve the independence of the containment as an engineered safeguard should be considered in the light of primary system integrity and emergency core cooling effectiveness. It should be recognized that effective means of holding the molten core are not in themselves adequate to prevent containment violation from overpressure.

end quote.