Safety of HMS Tireless
This report attempts to address some nuclear safety issues related to the proposal that the nuclear submarine HMS Tireless be repaired in Gibraltar. These factors are particularly pertinent if, as is likely, it is proposed to carry out Power Range Testing of the reactor in Gibraltar.
1. Containment System
The safety case for nuclear submarines depends on the integrity of four boundaries which are designed to prevent the release of radioactive material into the atmosphere:
The first boundary is the cladding of the fuel rods;
the second boundary is the pressure vessel and primary coolant circuit;
the third boundary is containment provided by the reactor compartment;
the fourth boundary is incomplete and comprises the rest of the submarine.
The Navy's claims that a release of radiation from HMS Tireless in Gibraltar is a very remote possibility depends on all of these barriers being proven to be sound. Because of the accident which happened in May the integrity of each of the first three boundaries is questionable. In addition it will not be possible in Gibraltar to conduct adequate inspections of these barriers.
1.1 First Boundary - Fuel Core Cladding
The reactor is fuelled by highly enriched uranium which is mixed with zirconium. The fuel rods are clad in a zirconium alloy. This cladding prevents the spread of radioactive products into the coolant and beyond.
The loss of coolant from HMS Tireless on 12th May may have had an impact on the integrity of the cladding of the fuel rods in the submarine's reactor. The exact events which took place within the first few seconds of the accident on HMS Tireless have not been made public and may not be fully understood by the Navy. Coolant will have started to escape rapidly from the primary circuit. It is possible that the reactor operator was able to bring the situation under control by closing valves and isolating the leaking part of the circuit. Nevertheless there may well have been a rapid change in temperature within reactor. This could have damaged the zirconium cladding on the fuel rods. In a more serious accident Navy manuals describe how the cladding can fail.
It will not be possible to thoroughly examine the state of all the cladding on the fuel rods in Gibraltar.
1.2 Second Boundary - Primary Coolant Circuit
By its nature the reactor on HMS Tireless is a pressurised water reactor. The primary coolant circuit contains water under very high pressure, around 170 bar (2460 psi). The circuit is complex with two loops each running from the pressure vessel through a steam generator. There are several coolant pumps on each of these loops. There are also pressurise, ion exchanger and emergency cooling loops and valves on most key sections. As a result there are a large number of welds in the primary circuit.
HMS Tireless was commissioned in 1985. After 11 years in service the submarine was in refit at Devonport dockyard from April 1996 to June 1999. During the refit the reactor was refuelled. There will also have been a substantial amount of work carried out on the primary circuit including a number of welds.
During the refit the primary circuit will have been inspected. This will have included the examination of welds using ultrasound and other methods. This system of inspecting for weaknesses in the coolant circuit is an essential part of the safety case for nuclear submarines. It is clear that in this case the inspection process did not detect a weakness which resulted in a crack several millimetres across appearing only 11 months after the end of the refit. It is not known whether the failure was in the conduct of the inspection itself or in the analysis of the large volume of data produced during a refit.
This inspection failure has implications for the safety of all British nuclear powered submarines, but it has particular effect with regard to HMS Tireless. If the system failed with regard to one weld during this refit, there must be a higher than average chance that the inspection process will have failed with regard to other welds within the coolant circuit on HMS Tireless.
The situation is further complicated by the fact that the Navy themselves do not know what caused the crack in the weld and may not know for many months. The Chair of the Nuclear Regulatory Panel, Captain Hurford has said in Gibraltar that they did not know the cause.
In January 1990 hairline fractures in the coolant circuit of one submarine resulted in all British nuclear submarines being kept in port, except the Polaris submarine on nuclear patrol. Over a year later the MoD's adviser Reg Farmer was interviewed about the problem and it was clear that the Navy were still speculating about exactly what the cause of the hairline fractures was. The water chemistry of the coolant and particularly its pH was given as the most likely explanation. The scrapping of five hunter killer submarines was related to this defect. At least three of the four Polaris submarines were also affected.
There are two issues with regard to reactor circuits which make cracks more likely. One is that radiation makes the pipework and pressure vessel more brittle and so more liable to cracking. Secondly different alloys are used in various parts of the circuit. The problem discovered in 1990 was in a weld joining two different alloys. Reg Farmer said in 1991 that the defect was where the coolant circuit enters the steam generator.
A detailed inspection of the state of the primary circuit on HMS Tireless's reactor could only be carried out during a major refit in a dockyard.
1.3 Third Boundary - Reactor Compartment Containment
Comparison with land based reactors
HMS Tireless is powered by a pressurised water reactor which is situated within the space available in the submarine, as a result the containment system is not as effective as on land based reactors. If there is a leak of coolant from the reactor then there will be a sudden jump in the pressure within the reactor compartment. On land based reactors this pressure surge can be contained by having a large space around the reactor. This is not possible within the dimensions of a submarine hull.
John Harrhy was formerly involved in nuclear submarine work, particularly in the safety case for secondary containment. In March 1992 he argued that nuclear powered submarines should not be allowed to visit New Zealand on safety grounds. Mr Harrhy said:
"I worked alongside structural engineers from the UKAEA Safety and Reliability Directorate who were auditing the safety of the RN's Dounreay reactor establishment following penetration of the secondary containment structure which was necessary for the refuelling of the reactor. I learnt that the philosophy behind these domes was that the containment volume was large to reduce the rise in pressure caused by failure of the primary system. It is possible for all coolant to vaporise and spread contaminating material. The design of the dome prevented a pressure rise greater than one atmosphere. The regular nature of the dome also permits simple structural analysis to predict stress levels in the structure which are kept by design to be low. The lower the stress levels the more tolerant is the structure against imperfections in materials or construction methods.
"Quite frankly the UKAEA engineers were out of their depth with warship structures. Firstly the pressure rise due to a failure of the primary circuit is extremely high because of the small secondary containment volume. The pressures experienced by the structure is between twenty and thirty atmospheres.
"The structures whether for a surface ship or submarine are complex in comparison with a spherical dome ... For example an acceptable imperfection in the shell of a dome of a land based reactor may be an interlaminar zone measuring 100 mm square, or a void in a weld 50 mm long and 3 mm diameter. Each type of imperfection is relatively straightforward to detect, particularly as the structural materials are thin. However in a warship structure the acceptable imperfection will be an interlaminar zone 8 mm square or a weld void of 6 mm long and 2 mm diameter.
"Finding the needle in the haystack is therefore much more difficult for the containment structure of a warship than a land based reactor ..."
Reactor Compartment Containment on HMS Tireless
On the 12th May 2000 the primary coolant circuit in the reactor on HMS Tireless was probably at a pressure of around 170 bar ( 2,460 psi). When the crack several millimetres across developed there would be a rapid rise in pressure within the reactor compartment. This rise in pressure may have damaged weakpoints in the bulkheads and the hull itself.
A Navy training manual says that " the bulkheads are penetrated in a number of places (steam pipes, electrical supplies etc) and small leaks are likely. At start of life the compartment is pressure tested and the leak rates should not be more than 1 per cent per day."
Given the existing weaknesses and the pressure surge at the time of the accident there is a risk that the bulkheads and hull cannot provide the degree of containment which is assumed in the Navy's safety case. Furthermore Mr Harrhy indicates that it could be very difficult to thoroughly examine the state of these bulkheads and the hull itself, because even minute cracks could undermine the safety case. While a full inspection might be done during a refit in a dockyard it could not be done properly in Gibraltar.
2. Emergency Core Cooling System
The reactor design includes a passive Emergency Core Cooling system which is a loop which can be cooled by sea water. During the 1990 problems Scottish CND was given anonymous information about the fractures in the cooling circuit which was later proved to be accurate. Along with this we were also told that the Emergency Core Cooling System did not work and that this was a fundamental problem. If this cooling system only works in particular circumstances then this is a further weakness in the nuclear submarine safety case.
3. General Accident Response Issues
Short Sermon nuclear submarine accident exercises have illustrated that current safety schemes are based on the assumption that the emergency planning system will be aware that there is a problem several hours before there is a release of radiation to the atmosphere. While this is a possible scenario it is not the only one. A release of radiation at the outset of an incident, or a failure to recognise the early stages of an incident, could significantly shorten the time available to prepare a response.
Safety schemes play down the potential for using evacuation as a main countermeasure. However it can be questioned whether this adequately takes account of likely hotspots of radiation or the effectiveness and timing of monitoring.
Safety schemes are prepared on the basis of the likelihood of a Loss of Coolant Accident and do not take into account the possibility of a containment failure accident.
4 Issues Specific to Gibraltar
4.1 550 metre automatic countermeasures zone
Everyone who lives or works within 550 metres of where the submarine is moored should be given a booklet which details what they should do in the event of a nuclear accident. In the case of Gibraltar the Queensway Quay Marina which has berths for 121 vessels falls within this area.
The 550 figure is based primarily on an estimate of possible gamma radiation hazard. The extent of this hazard just beyond 550 metres may be underestimated. In Gibraltar there are very popular areas which are only slightly further than 550 metres from the berth.
4.2 Detailed plans for those within 2 kilometres (Gibraltar)
Within 2 kilometres of the berth there should be a pre-planned countermeasures zone. The Navy considers that the measures which might have to be applied in the event of an accident are primarily the rapid distribution of Potassium Iodate Tablets (PITs) and issuing advice to take shelter. After the Chernobyl accident large numbers of children in Belarus and the Ukraine have developed thyroid problems. This can be prevented if PITs are issued. They have to be taken within the first hour or two, and the sooner they are taken the more effective they are. The risk of thyroid cancer and the effectiveness of PITs are both greater for the youngest members of the population.
Almost all of the occupied areas of Gibraltar and the main tourist attractions are within 2 kms of the submarine berth. It is very hard to imagine how any plan could be drawn up for the distribution of tablets to all those within 2 kms downwind immediately after an accident. There would also be language and practical difficulties involved in trying to effectively advise everyone to take shelter.
There should also be outline contingency plans for evacuating those within 2 kms downwind of the submarine in the event of an accident. The geography of Gibraltar would make it very difficult to carry out an evacuation, particularly if the one land exit to the North was within the contaminated area.
Almost all the tourist attractions in Gibraltar would fall within the 2 km zone. The Grand Parade and Cable Car station are 800 metres from the submarine. Many of the tourist attractions in the centre of the town are less than 1000 metres from HMS Tireless. The nature reserve is 1,500 metres from the berth. The cruise liner terminal is 1.5 kms from the submarine. Last year 140 cruise ships visited with 85,000 passengers.
In 1996 there were 6 million tourists who visited Gibraltar, most of them day visitors. This is a significant complication in any safety scheme.
The total land area is 6.5 square kilometres. The local population in July 1999 was 29,165 of whom 5,878 are under 14 years of age.
4.3 10 Km Extendibility Zone
With regard to nuclear submarine berths on the Clyde the Ministry of Defence "advises local planners to consider the production of outline contingency plans .. to provide the basis for the further extension of countermeasures". The measures referred to include the distribution of Potassium Iodate Tablets and giving advice to take shelter. For the Clyde berths this zone extends out to 10 kms.
Within 10 kms there are substantial towns in Spain. La Linea de la Concepcion has a population of 59,879 and is only 3 kms from the nuclear submarine berth. Algeciras is 7 kms across the bay and has a population of 102,058. San Roque is around 7 kms away and has a population of 22,435.
4.4 Conduct of the repair
There should be some mechanism for local government involvement in authorising the nuclear waste discharges and transport in Gibraltar.
There is local concern that the repair work could result in radioactive contamination of the local water supply. The input to the desalination plant for the water supply is within the harbour area, 1,800 metres from the submarine berth. The Navy have already admitted that coolant was discharged into the Mediterranean earlier in this incident, so there is a real danger that this could happen again. In addition to the real risks of radioactive contamination to the water supply, even minimal contamination would be catastrophic for the tourist industry.
Diagrams and Maps
Reactor diagram (24 kb)
Reactor plan (16 kb)
Reactor diagram colour (73 kb)
Submarine containment diagram (5 kb)
Map of 550 m and 2 km zones Gibraltar (15 kb)
Map showing towns in 10 km zone (7 kb)
Notes
In the Navy's standard Loss of Coolant Accident (LOCA) scenario there is a sudden loss of coolant from a breach in the primary coolant circuit. The remaining coolant is then flashed off into steam. Even though it is assumed that the reactor has shut down the fuel core would still be damaged. Navy manuals say: "By this time the reactor will have been shut down, but because of the disappearance of coolant, the large amounts of decay heat being generated in the core will raise fuel temperatures rapidly. When fuel temperature reaches 900 C a chemical reaction takes place, the zirconium oxidising, taking oxygen from the surrounding steam and releasing large quantities of heat in the process."
While it does not appear that this happened on HMS Tireless, they were only a few steps away from it.
John Harrhy who is quoted is a professional naval architect who works in New Zealand. In the past he worked for the Polaris Technical Director in the MoD. He was responsible for the structural analysis of secondary containment systems. He was employed by the UK Cabinet Committee on nuclear weapons safety to evaluate the effect of a fire on a nuclear armed submarine. He was project manager for the design and specification of simulators for four classes of nuclear submarine. He was the initial contact between the French and British governments on nuclear submarine safety.
Updates on the situation in Gibraltar are available at:
www.iberianews.com and www.panorama.gi
John Ainslie
Scottish CND
14 August 2000
