 Good morning. In the earlier lecture, I had given you a glimpse of how we validated the dynamic code which was used to analyze the parametric variations in case of events like a pump trip or a power failure, how the different temperatures vary. Finally, we have to see that the temperatures of the clad do not cross the limits. The temperature of any part in the plant does not cross its limit. And also, these variations are an input for the mechanical design of the plant or the different components. So, we also saw how it was validated based on literature, based on tests on similar reactors, based on tests in our own reactors, then integral tests on the plant. So, that way we found that there was a good match between what was predicted and what was actually observed on the plant. In this lecture, I would like to take you to the analysis of some more events in the different reactors which are important, no doubt. Let us take a pressurized water reactor. Just to recapitulate, in the pressurized water reactor, you have this is the reactor vessel, this is the core and these are the control rods. Water is pumped by a pump, it is light water. It picks up heat and in order that it does not boil, we keep a high pressure and this is a pressurizer. After taking up the heat, it gives heat to the steam generator where another light water picks up, goes through to the turbine, runs the turbine and comes back. Now, what does this pressurizer do? It basically maintains the pressure of the system by two methods. One is there is a heater and there is a water spray. When it heats up, water boils and the steam space gets steam and get pressurizes the water. In case I have to reduce the pressure, I spray water into the steam area which quenches the steam and the pressure, steam volume comes down and the pressure comes down. Now, in the pressurizers, there is a safety valve at the outlet and whenever there is a power failure and the pressurizer safety valve has opened, then let us look at a scenario that plant was operating at full power and this pressure is a safety valve open because of the pressure, but it did not close. This event is exactly similar to the three-mile island reactor. Then, of course, the reactor would have been stripped and other things happened. Now, how this thing went through, the parameters went through, let us see. This is to give you a more clear picture of the pressurizer. You see the electrical heaters, quite a good number, 36 numbers, may be a megawatt power. Then, you have the spray nozzle. Then, you have a nozzle for the safety valve. Then, you have got the instrumentation nozzles which measure the temperatures and the size of this pressurizer is about 8 feet. So, let us see what, how the thing goes. So, the pressurizer valve has safety valve has opened, but has not closed. So, when the safety valve has not closed, what is going to happen? System is getting relieved, so the pressure would come down. Now, in the case of a pressurized water reactor, when the pressure comes down to a level, let us say about 10.93 megapascals, the reactor is shut down automatically. That is how the safety logic is built in. So, but the normal pressure is normally around 15.82 megapascals. So, once it comes to 10.93, we are tripping the reactor. Now, we are losing coolant, primary coolant is being getting lost through the pressurizer valve which is open, safety valve which is open. So, we need to put the coolant. So, at this pressure of 10.93 megapascals, safety injection water starts. Here we have got two high pressure safety injection pumps, but we assume that only one pump operates. This again to remind you, we always consider a single failure in the whole safety chain besides the initiating event. For example, here the initiating event was the non-closing of a pressurizer valve. Next step, reactor should trip. It tripped and here in order that reactor should trip, we do have multiple signals. Here we are giving the indication of a pressure signal and these are not one single channel. There are many channels of pressure measurement. So, we are sure that the pressure has come down to 10.93 and we need to trip the reactor. And in the chain, that high pressure injection, we assume one coolant pump has, one injection pump has failed. So, we are doing a conservative analysis and the flow, injection flow initially will be less because the pressure is high, but as the pressure is going down, down and down, the flow increases something like 20 to 45 kg per second and the pressure comes down to about 5 MPa. Now, so we, you know these pumps, they cannot eternally operate. They require a minimum suction head to push flow that is called as a net positive suction head. If that is not there, these pumps would cavitate. So, the high pressure injection pumps cannot continue beyond 5 MPa down. So, if we just operate, they may not, flow will not happen, they will cavitate and damage the pumps. So, what we do? We then bring in the safety accumulators which pump in from the low pressure injection pumps which are designed for a lower pressure. So, there was a high pressure injection. Now, we go to the low pressure injection. What happens in the, in this state? Earlier, because flow was not available, there was a bit of a nucleate boiling in the core, but now by the time this low pressure injection starts, it has come down. They are just, they don't go to the nucleate boiling level and the maximum clad temperature is about 570 degree centigrade, whereas under the limit is about 1204 degree centigrade. Now, you might wonder, okay, we say everything is okay, the temperatures did not fail, but then why the hell in 3-mail island it failed? Remember, the safety injection was shut off by the operator. Why? He found that the pressure, level in the pressure riser is rising. He never realized that the level in the pressure riser is rising because of the steam in the core and that is pushing the water up, whereas the core itself is devoid of water. Unfortunately, because of the lack of proper instrumentation, this happened. Otherwise, 3-mail island incident would not have happened. So, this is what is an event of a pressure riser valve, stuck open. Another scenario, there is an instantaneous power loss to all the primary pumps. So, what happens? The primary pumps getting no power, they do have some inertia in their drive system. It slows down, but it slows down and the power has gone. You know that the power is missing. So, it is an unsafe situation to run the reactor. So, we trip the reactor. So, less than 2 seconds, it comes down. Then, also the flow reduction also would give a signal. They may also have the pump speed or lack of voltage or the loss of voltage at the pump. So, many signals would surely ensure a shutdown of the reactor. So, here what happens? The temperature of the primary water rises because the scram effect takes some time for the reactivity. So, first initially, your temperature rises. So, does the pressure, but the moment your reactor has been scrammed or reactor has been tripped, the control rods have come down, the power generation is stopped. So, then the temperature starts coming down. Then, what happens on the secondary side of the steam generators? You have atmospheric steam relief valve by which we open this atmospheric steam relief valve and we can relieve the steam pressure. And as the steam pressure is relieved, there is a flow happening in the steam generator and that in turn removes the heat from the reactor core. So, basically heat removal in this through the steam generator as the first one. There are other parts also available. You have got a bypass across the turbine by which you can directly send the steam to the condenser. And from the condenser, you would have a relief valve in case the pressure goes high. Now, but if there is a total loss of electric power means your condenser is not available. So, if the condenser is not available, you have to wait, use only the safety and the dump valves which I mentioned. The safety valve will automatically open and in order to aid, we have a relief valve also which acts on the pressure. Normally, in all systems, we have a safety valve plus a pressure operated relief valve. We do not want the safety valve which is operating on a spring to move up and close very frequently. It is like an ultimate defense in depth. So, sensing the pressure, we open this control valve and relieve it. So, in case this fails, this comes into picture. So, again this comes, this is able to relieve the pressure. So, the, how the flows come down? This is how the flow comes down. And the flow coming down is again a function of the inertia. Normally, we provide a mechanical inertia flywheel on the pump drive system which gives a slow course down thereby avoiding any boiling in the initial stages. So, as I mentioned, power failure is detected by a low voltage on the station bus. The diesel generators start automatically. So, the emergency loads which are important for the safety are given power and we assume that within after about half an hour, operators should be in a position to take over the plant control. What I want to emphasize here, in this half an hour after the incident, we do not take any credit for any manual action. Operator may be able to act, but we do not take credit in the safety analysis. So, this is a very important point which is done in all nuclear. It is not unique to India. Every country follows that. So, once the operator has taken over, he would be, you know, in a position to take, already the plant is in a safe state, he has to maintain that safe state. Now, let us come to the precise heavy water reactor which are quite a good number, about 20 number of precise heavy water reactors we have in India. And the precise heavy water reactor to recapitulate, this is the reactor core. It is horizontal, not vertical. And there are fuel channels here. The coolant goes through, the pump pumps it through the core, comes out, goes to the steam generator, exchanges heat to light water. This is heavy water, the primes are primary heat transport. Again pump, again back into the other opposite direction, another channel, another steam generator. This is actually called as figure of heat loop, unique to the heavy water reactors. And the purpose of having a horizontal configuration is because we do on-load fueling. We change the fuel on-load and that is possible only in a horizontal setup. We also have the moderator separately unlike the pressurized water reactors, they are outside in the vessel which is called as the calendria. And they have a moderator system also because moderator moderates the neutrons. That means some energy is given to the moderator. And if you just leave the moderators stagnant, the moderator temperature will increase. So you need to cool the moderator. So moderator is taken out, cooled through pumps and then pushed back. So the moderator is continuously recirculated. And this analysis is done for the Kaiga atomic power station. There are about 306 channels like this, 153 in one direction, another 153 in the other direction. Now all these channels are connected at the inlet side and at the outlet side by the headers called as the reactor inlet header and the reactor outlet header. And through that header, the feeder pipes are joining each channel to that. And each of these channels contain 12 fuel bundles. And these are all within the pressure tubes. And each pressure tube is surrounded by a calendria tube. And the calendria tube is surrounded by the moderator. And the annulus between the pressure tube and the calendria tube is filled with carbon dioxide. You might ask why? See the heat, the coolant is picking up the heat and the calendria tube is facing the moderator which is at a lower temperature. So if you do not insulate, the heat will go to the moderator. So carbon dioxide acts like an insulation. Then the steam generators are U-tube steam generators as we saw, inverted U-tube steam generators. So the Hawaii water is flowing inside the tubes and the light water is flowing outside the tubes. Then the pressure in the system in this reactor apparently is maintained by a feed and bleed system wherein we have a place where we at the primary pump inlet where we push in heavy water and bleed heavy water from another point and maintain the pressure. But in the later reactors we have used a pressurizer as in the PWRs, the pressurized water reactors. Now loss of coolant accident is an important one in which there is a, let us say there is a header failure and your coolant is expelled out of the primary heat throughout system. With the loss of coolant there is depressurizing, the system is getting depressurized and the core could be without coolant and when the core is without coolant we know that there could be high temperatures and if the wide loss of coolant happens in a place where there could be a positive reactivity effect, there could be a slight power increase and then that also could add to the higher temperature. But major thing is the loss of flow that is which is causing the loss of coolant, that is coolant loss is what is going to cause the increase in temperature in those channels. Now the flow rate is going to be dependent very much on the place where there is a break of the pipe. If it is a small pipe your flow out will be less, if it is a large pipe it will be more, if it is a crack it will be less, if it is a guillotine rupture something like just into 2 pieces then water can come from both sides. So we take into consideration that as if there is a guillotine rupture worst case so that we have a good very conservative prediction of what is going to happen in the plant. So it is basically conservatism is required so that we are in a safe situation as far as the reactor is concerned. Now since you are losing coolant there needs to be an injection just as we saw in the case of the pressurized water reactor. So we have an emergency core cooling system however this cooling system is with heavy water whereas there it was light water because there light water was coolant primary coolant here heavy water is a coolant. No doubt we also have a light water accumulator the later stages should the heavy water accumulator ECCS supplies be not sufficient or should it require we will then go for light water. Then these tanks which heavy water and light water are kept pressurized with nitrogen. Now the system consists of pumps, heat exchangers and then at the end of the removing heat they go to a suppression pool where the heat is given off. So how do you detect a loka of course here the pressure measurement we have got pressure indicators and transmitters to the different headers of the plant because we cannot say at one place we put the leak might happen in another header. So all headers do have pressure transmitters and once the pressure transmitter fails to something like reading comes to about 5.5 megapascals it is taken as a loka plus of coolant accident signal to actuate automatically the emergency core cooling phase 1. Phase 1 is hay water injection. Then what is phase 2? Once the pressure falls to 3.2 megapascals phase 2 starts wherein we inject light water and then what we call as a phase 3 at about 3.2 megapascals we take the suppression pool water and push it back to the core. So these are the 3 phases. So how the scenario looks based on the analysis taking to all the uncertainties into account the power of the reactor initially due to the positive void coefficient in the channel we always consider the worst case it has gone to about 110% it can trip the reactor also the log rate the rate of power rise is also measured. Then high pressure which will anyway going to happen then low pressure also in case it goes below also we have a trip then these are other trips which can come but may not be for this event then low flow of the primary less than 45% also could cause trip. But you have enough number of signals which can trip the reactor. Now the turbine trip once the reactor trips plus it takes some time for the valves to close and also the once the turbine is tripped the dump valves open safety dump valves open on steam high pressure the main pressure pump trip may be after about sometime then the pump itself the pressurizing pump tripping at low level once the low level goes in the storage time then the other pump also the high pressure injection pump also will trip. So how the injection logic goes high water injection is initiated as I said when any of the inlet header pressures goes less than 56 kg per centimeter squared or 5.6 megapascals and once it comes down to less than 3.3 it isolates because this pump cannot pump in it will cavitate. Then the takes light water takes over light water injection and this starts when it is less than 3.3 megapascals and once the pressure has come down to 1.1 this also is isolated because these pumps won't be able to operate. Then we have the recirculation pumps which can operate at still lower pressure and these try to operate in fact they operate when the inlet header pressure comes down to less than 5.6 and because both are light water we have no difficulty so we do use both but even if this alone is there it is able to cool the react and keep the temperature within limits. This is how the analysis goes for the reactor what is the void reactivity the total reactivity how the power increases like 3 and then comes back and this analysis is presented from a paper on this reactor which was presented the ICON 7 conference in Tokyo you can see this for more details. This is a clad surface temperature we look at the broken channel and the unbroken channel both we look at how the temperature changes same thing on the clad surface temperature on the broken hot channel how the temperatures go on the other channels how the changes you see broken channel the clad temperatures are increasing. So what is the finding of this conclusion of course this is accident after this has happened you are not going to operate the reactor at this stage our thing is to see that we have to mitigate the consequences no reactivity should come about it is a quite a tough accident. So what we find the transient reactor power is about 2.8 times the normal power and what is the maximum break flow reached and the maximum clad temperature is this. So our assurance that the clad temperature and fuel temperature clad temperature has gone but still they are within the limits at least as far as the calculations go one thing I can tell you you might find no measured temperatures here because we cannot make an accident and get the temperatures. So but we do have enough conservative margins in all and these margins are such that our predictions are reasonably good and as I mentioned again we still have the containment should something fail still the containment is there to protect us which was there in the case of a PWR the three mile island which had a containment and in the case of Chernobyl because containment was not there there was a release outside. So mind you we are safe under the present designs of all nuclear reactors see I mentioned about diversity in all diversity in signals redundancy also we talked redundancy of course is there but the earlier reactors for example our fast speed test reactor we have only one shutdown system which is the control six control rods which will drop into the core. So and loss of offset power loss of power is one common event one advantage of this reactor is it is a small reactor all the temperature coefficients are negative. So if temperature increases power will come down there is no worry at all but then main thing remains is how to remove the decay heat. Nevertheless we have many reactors abroad also which are small reactors with negative reactivity and we have the rhapsody reactor which is similar to a BTR only difference is rhapsody reactor does not have the steam generator they have a sodium to air cooler which takes out the heat and pushes it out to the atmosphere. Then we had the experimental breeder reactor 2 plant in USA there also it is similar we have a steam generator we in fact we have a double wall steam generator there is tube in tube and then they did tests of having a loss of offset power and not allowing the control rods to trip it was a planned event. So that they want to see whether whatever we are feeling things are safe whether it will happen once you are a planned event you can anything something grows beyond you can always manually trip the reactor believe it or not that it was found that the plant came down to a low temperature level and after about half an hour the operator could take over and it could maintain that there was nothing no anxiety even though the control rods did not trip basically decay heat removal was okay so it showed it gave confidence that the system designs are good and again I repeat it applies for a small reactor same thing would not apply for a large reactor because some of the reactivity coefficients tend to be positive. So there need to be a diverse shutdown system so for PFBR we have two diverse two systems a main control and safety rod drive mechanism and a diverse safety rod drive mechanism. Now in the case of ABTR we thought since we have a model already developed which I talked to you in the previous lecture why not we try to see what sort of temperatures and parameters we get I will before I should not forget to mention the rhapsody reactor also did tested 50% power whereas the EBR2 did at 100% power there was a difference and both reactor tests showed that so once we have some available data and rhapsody being quite a close similar to FBTR we thought why not we do one analysis so here normally when you have a loss of off side power diesel should come up and mind you we have two diesel generators if one doesn't come online other will come online even if the single failure other thing will come in case those two don't don't come we have a battery backup for the primary pumps which can run them for about half an hour to one hour at a low flow all this but the assumption made in this study is diesels are not coming batteries are not taking over and reactor has not tripped so the only way as I mentioned to you of decay heat removal was the opening of the trap doors and mind you we had already checked up what is the heat removal capability of this with sodium at 500 when we did the commissioning test so FBTR then we thought now let us see how the temperatures are varying the temperatures will come down there is no control rod provided the overall reactivity is negative. Now let us look at the power has failed the sodium flow is secondary sodium flow is coming down the primary flow is coming down but the trap doors of the steam generators they are open manually and if it is a manual action we can't take credit for it for half an hour so there is another for half an hour there is no heat removal through the steam generator what happens you see the secondary sodium flow rate comes down slower than the primary flow so in the intermediate heat exchanger if you look up this flow would be more this flow would be less so apparently this inlet temperature which goes to a reactor comes down and that is what you see the reactor inlet temperature going down of course the reactor outlet temperature would go up because of the fact that the flow is coming down in the primary and of course after some time it goes like this now this going down and at the inlet you have got the grid plate which supports so the grid plate which is higher temperature is coming down so there is a effect of the structures higher the temperature it expands when the temperature comes down it contracts so the grid plate contracts means the subassemblies coming somewhat closer that is actually means a positive reactivity but after some time the effect of this higher temperature the reactor outlet is felt at the inlet as you can see here so this positive reactivity is only for a short duration and then it comes down that means the grid plate is expanding due to high temperature inlet temperature and negative reactivity is bringing down all the other effects are negative so the total feedback reactivity if you see here this is of course the control dot expansion also we take which is very small so the total feedback reactivity is negative and more control by this so what happens the power comes down once the power comes down your fuel temperature comes down your clad temperature comes down but mind you initially the clad temperature goes up because coolant flow is not there and there is a slight increase in the temperatures and then this temperature falls down as the power has come down we saw that the reactivity overall reactivity is negative after some time so the power even though power has come down because of the putting the control rods into the even it has come down just based on the temperatures alone because there is a negative reactivity however the hotspot clad temperature does show a rise because the coolant flow to the assemblies are reduced then nevertheless after some time as the power is coming down the clad temperature also comes down the fuel temperature is also coming down to a low level which is a safe level it is and now you look at here 30 minutes I said only we opened the trap doors so the air cooling starts after 30 minutes immediately it picks up to a good level of over 4.5 kg per second here what you see even though it is opened after half an hour and this is happening the decay heat has come down because the power generation itself has come down so this is a unique feature of small reactors and that is one reason why some of the proponents of fast reactors are talking about small modular reactors which can be built in large numbers instead of large fast reactors this is a point to me look kept in mind and thus to compare with the Rhapsody reactor test you see how the temperature went up how the power came down and then what are how the mean core outlet temperature change and here you see all our things it is on a different scale so more or less increasing and coming down those things are reflected only thing the Rhapsody results were done for 10 minutes the test but whereas we wanted to see a long-term evolution we really ran up to about 150 minutes and we found that things are still stable. So this has no doubt given us a good feedback on fast reactor safety basically small reactors under even under a loss of off-site power why off-site power loss of off-site power loss of on-site power loss of batteries even then we our reactor is able to shut down by itself in summary in this lecture I had given you some flavor into the safety analysis of PWR we looked at what happens when a pressure is a relief valve opens and does not close then we looked at a PHWR how a loss of coolant accident in a pressure heavy water reactor goes then the third one we looked at the fast reactors some sort of a you can look at this called as a passive safety feature that without any intervention on the reactor the reactor is shutting down by itself that is we are invoking in the design the features and now how this features have been brought about by engineering in fact it depends on how the temperatures are increasing if the flow had come down very fast the temperatures would have increased very high. So what we have done in the case of our fast reactor a BTR we have provided enough inertia on the flywheel inertia on the drives so that it would come slowly the temperatures would increase slowly the negative reactivity effects will come also slowly everything happens slowly but steadily then we are assured of a shutdown. So engineering a safety of fast reactors is possible yes if you ask me for a 1200 megawatt electrical fast reactor super Phoenix they did a study to find out what should be the inertia should be provided so that the reactor is safe for a again this similar event of loss of power they found that it requires a really high energy because a large reactor and the flywheel itself is something like a 2 meter diameter flywheel and believe it or not they do have it in the reactor they built it into the reactor so it is possible that we could engineer the safety in such a way that we can have safe fast reactors this is a uniqueness again I repeat of fast reactors. So it is very important that we do all these analysis and we have the capability to do these analysis which gives us confidence that our reactors are safe and under no circumstance we release radioactivity into the environment not only to the environment to the people who are working on the site who are the occupational workers everybody should be safe we need nuclear power we need electricity so we need nuclear power we have to make nuclear power safe that is the reason thank you.