SL-1: Background and Major Lessons Learned
Background
SL-1 Design Purpose
In the early to mid-1950s, the United States (US) Army tasked Argonne National Laboratories (ANL) with designing a small reactor that would be capable of powering remote military bases, specifically in the Artic area of operation. The reactor needed to have an operational timeline of three years, with limited water requirements and the ability to transport the reactor by air [1]. ANL then set out and designed a direct cycle, natural circulation boiling water reactor fueled with ninety-one percent enriched uranium fuel [2]. This reactor was prototyped and built in a remote location near Idaho Falls, Idaho. This prototype was referred to as Stationary Low-Power Plant Number One, or SL-1. An overview of the core design is shown in Figure 1. Of note, the reactor was designed to have nine control rods, five of which were a cruciform shape, the remaining four were T-shaped. However, SL-1 only operated with five cruciform style control rods. Unique to the design, the reactor could be brought critical solely by withdrawing the central cruciform control rod: rod nine.
Figure 1: SL-1 Core Design [2]
SL-1 Operational and Accident Timeline
SL-1 was an experimental reactor, designed to be operated by US Army personnel. These personnel received a few months of operational training; however, very little theoretical understanding of nuclear physics was required. There were no formal criteria for the selection of operators, they merely chose service members who were of good standing with the military. SL-1 originally went critical on 9/11/1958, then in early 1959, oversight of SL-1 was transferred from ANL to Combustion Engineering (CE). During the initial operation period, control rod sticking was observed on several occasions. Rods failed to drop smoothly into the core under gravity, or sticking was experienced during rod withdraw. This was mainly contributed to excess crud build up on reactor plant materials. The initial operational period ended in the summer of 1959, at which point the Atomic Energy Commission (AEC) conducted an inspection and requested CE make several changes. Of which, the AEC specifically requested a new SL-1 core designed to have adequate shutdown margin with any one control rod at the top of the core and a general redesign of the control rod mechanisms [1]. Despite CE acknowledging these requests, no immediate changes were made to the operation of SL-1. In addition to the issues with the control rods, SL-1 also saw consistent degradation of their boron strips in the core. Due to suspected corrosion of the strips, it was estimated that about eighteen percent of the total strips were lost. During the AEC inspection, it was noted that “the rate of loss of boron has been constant over the past 300MWd of operation. Indications are that this shutdown margin will continue to decrease, thus requiring remedial action” [1]. Again, this request was acknowledged, but no immediate actions were taken to correct the shrinking shutdown margin or the root cause contributing to the degradation of the boron strips.
Despite the seemingly glaring issues regarding control rod operation, no issues were formally reported to the AEC. The crew became complacent operating with these deficiencies. Additionally, during the formal inspections of SL-1, no nuclear or reactor engineers were included on the inspection teams. These audits were also often performed by groups directly associated with operating the reactor and were not external to the organization [2]. Nonetheless, the issues with control rod sticking continued, totaling thirty-three separate instances of sluggish or sticking control rods in the November and December operating logs [1].
As SL-1 operation continued, the crew prepared for a planned maintenance shutdown in December of 1960. The specific maintenance required removal of the control rod shield plugs in order to access the area between the fuel assemblies. The maintenance was performed satisfactorily, and in order to bring the reactor critical again, a crew of three personnel oversaw starting up the reactor on 1/3/1961. The procedure for starting up the reactor involved pulling out the control rods manually and then attaching them to the control rod drive mechanism. After attaching the control rods manually, the remainder of the startup procedure could be performed from the control room. At 2101 that night, the nearby fire stations received an automatic heat detection alarm from the SL-1 building. When the fire crew arrived, they found radiation levels varying from 250 millirem per hour to 500 rem per hour at the doorway of the reactor operating level. At 2145, two CE personnel entered the reactor operating level and saw two individuals on the floor, one of whom was still alive. That individual was later removed from the facility at 2250 and pronounced dead at 2314. A four-man team entered the reactor level again and found the third member lodged in the ceiling above the reactor vessel by what was later found to be the number seven control rod shield plug. The impaled service member was in a field of 1000 rem per hour. The next day, crews gathered to remove the second victim and due to the extreme radiation fields and complex nature of the third service member, they were not removed until January 8th [1].
Nuclear Physics of SL-1 Accident
Approximately twenty percent of the SL-1 core was damaged. Figure 2 shows the SL-1 core following the accident.
Figure 2: Overhead view of SL-1 core post-accident [2]
While attempting to attach the central control rod to the control rod drive mechanism, the central control rod was withdrawn too far. Calculations estimate the central control rod was withdrawn to about 50.80 cm, whereas 10.16 cm was the maximum withdrawal allowed per operating procedure during the startup [1]. This caused SL-1 to achieve prompt supercriticality, resulting in a drastic increase in fuel plate temperature near the melting point of the fuel. This heat was transferred to the moderator which subsequently flashed to steam. The large steam void that was generated in the core expanded and generated pressures on the magnitude of five-hundred pounds per square inch (psi) [2]. The extreme pressure generated by the steam drove a slug of water upward from the lower central region of the core. As the slug of water rapidly shot upward, it was abruptly stopped by the reactor vessel head, creating an extreme water hammer effect, causing the reactor vessel to completely shear all steam nozzle and water lines connected to the vessel and it rose about three meters in the air [2]. In addition to launching the reactor vessel in the air, the control rod shield plugs that were loose were ejected at about 93.3 km/hr [1]. This water hammer exerted immense stress on the reactor vessel, causing bulging near the top of the vessel, as shown in Figure 3.
Figure 3: Reactor vessel bulging of SL-1 caused by water hammer [2]
Since SL-1 utilized highly enriched uranium, the effects of Doppler reactivity feedback were minimal. As a result, the negative temperature coefficient of reactivity and the change in core geometry were the only mechanisms for curtailing the power excursion [3]. As the moderator temperature increased, causing the liquid to flash to steam, the steam voids inserted negative reactivity as well, helping to cease the nuclear reaction.
Cleanup Efforts
Cleanup of SL-1 required about thirteen months of intense labor and two and a half million dollars of funding [4]. Cleanup efforts were broken up into three phases. Phase one was focused on recovering the three casualties and verifying the reactor was shut down. Phase two assessed the current nuclear status of the reactor and attempted to investigate the possibility of a future nuclear excursion of the damaged reactor core. Phase three looked to determine the root cause of the accident, remove the core from the reactor building and decontaminate the surrounding area [5].
The three service members were so highly irradiated that their bodies were taken to a nearby chemical plant to be stored in an ice and alcohol bath to allow the radiation to decay [4]. In order to perform the autopsy, custom tools were required to be made. These tools consisted of long poles with the traditional scalpels and tweezers attached to the end. This allowed the doctors to perform the autopsy at a distance which minimized significant exposure to the medical personnel.
When attempting to determine the nuclear status of SL-1, the crews utilized mock-ups of the reactor building and vessel head assembly to practice their techniques that would be implemented. These included the use of photographic and television equipment to garner a look inside the reactor vessel and determine the scope of the damage. Additionally, there was considerable concern regarding the presence of water in the core. If there was still moderator within the reactor, this may allow a nuclear reaction to progress if there was any sort of change in core geometry. A chemical probe was utilized to detect the presence of water, of which none was able to be detected, implying the reactor was in a safe and stable condition [2].
Phase three saw large cranes utilized to remove the core and other reactor internals and deconstruct and decontaminate the reactor building. Figure 4 shows the reactor vessel being lifted from the reactor building. The pressure vessel was loaded into a concrete cask and transported to a hot cell for disassembly about forty miles north of SL-1 [2].
Figure 4: Reactor vessel removal from SL-1 reactor building [2]
A 4.6 acre burial ground was established near the SL-1 site where all the deconstructed building materials were disposed of. From 1961-1962, approximately six hundred Curies of activity were disposed of in the burial grounds [5]. Even after the building was torn down, the whole body dose in the area read from five to twenty milliroentgen per hour. As a result, three to six inches of soil had to be removed from the general area and replaced with a concrete pad in an attempt to stabilize the area. The topsoil had to be disposed of in the SL-1 burial site. After initially being deemed safe for future projects in 1962, the SL-1 area was reevaluated in 1985 and the findings indicated fixed low level contamination present in the soil and nearby building materials. To remedy this fixed low level contamination, the recommendation by the evaluation team was to dismantle all remaining buildings and fill the area with topsoil to reduce the prevalence of the low-level radioactive particulates [5]. Despite the SL-1 accident only resulting in approximately five percent fission product release, the cleanup efforts were extremely involved and the contamination levels exhibited in the nearby area were significant, with serious consequences being observed over the course of the next twenty to thirty years.
One of the unique—albeit extremely dangerous—aspects of the SL-1 design was the ability for the reactor to achieve criticality with only the central control rod withdrawn. Central control rods often have the largest rod worth due to their positioning in the center of the core, where neutron flux is at a maximum. This was true in the case of SL-1 and is equally true in modern reactor design, however, there are more stringent reactivity requirements in modern design that was not present during the design of SL-1. In particular, criterion 20-29 of 10 CFR Part 50 Appendix A specifies different reactivity limits as designated by the Nuclear Regulatory Committee (NRC). These are the protection and reactivity control systems criterion which describe various accident scenarios that the protection systems should be able to show protection against even with control rod failures [6]. The one-stuck rod criterion states that the reactor should be designed such that the control rods can insert enough negative reactivity to shutdown the reactor even at the most reactive time in life, coldest moderator temperature, and the most reactive rod stuck at the top of the core. This specific requirement can be attributed to the accident experienced at SL-1.
Improvement of Operating Procedures
In Mosey’s overview of SL-1, they noted the simplicity of the SL-1 operating procedures. The procedure that covered the specific operation of withdrawing the control rod to reattach to the rod drive mechanism made no mention of any specific limits of withdraw for the operators to be mindful of. Nor did the procedure even provide any caution statements regarding the potential consequences of withdrawing this control rod too far [1]. SL-1 highlighted the need for much more descriptive and all-encompassing procedures. Modern operators can thank SL-1 for the improvement in procedure writing.
Any operator understands that procedures are not foolproof. There may be certain scenarios that the designers did not anticipate while writing the procedure. The operator must have a high level of knowledge of the system they are operating to understand the implications of procedural steps on the system. As a result, any modern operator likely has completed a rigorous training pipeline that involved concepts such as nuclear physics and reactor kinetics to ensure the operator is able to understand how an evolution will affect the reactor. In addition to initial qualifications, these operators are likely required to perform continuing training, in which they must attend training to stay proficient in theoretical and operational concepts. This modern reality was not the case for the SL-1 trainees. Although they attended a six-month training program, it was not as robust as modern operator training. The SL-1 operators also did not have any sort of technical background. Instead, they were simply chosen based on “good military standing” which may not be adequate for safe reactor operation [1].
Impact of SL-1 on Emergency Response
In the early days of nuclear power, the exact biological and environmental effects of nuclear work were not entirely understood. SL-1 served as a learning opportunity and provided organizations with the ability to put theory-to-practice with the application of their emergency response principles. SL-1 saw the utilization of various equipment such as a chemical probe which was inserted into the core to determine the presence of moderator [2]. The cleanup crews also implemented a common modern tactic of utilizing a mockup of the reactor building and core to practice their cleanup actions in order to minimize worker exposure. The SL-1 accident saw the implementation of a three-phase disaster plan which proved to be a useful framework for modern reactor accident emergency response priorities. The major milestones which this three-phase plan implemented are commonly seen in modern severe accident management guidelines (SAMGs) [5].
Importance of Frequent Audits of Nuclear Programs
After the initial test run, SL-1 was shut down and the AEC conducted a formal audit. Based on their findings they gave several comments to CE. The AEC did not see aluminum as a satisfactory core material and saw stainless steel as a more suitable option. Additionally, they expressed the desire for a new SL-1 core design that would be unable to achieve criticality with any one control rod removed. For their last comment, the AEC stated the control rod drive mechanism should be redesigned [1]. Although these comments were taken on board, there was no formal documentation regarding the time to complete the recommended tasks.
Prior to the reactor accident, many other teams conducted audits on the operation at Idaho Falls. However, no nuclear engineers were included on these audit teams. As a result, reactor safety may not have been properly analyzed during the audits. Additionally, these audit teams were mainly composed of members directly associated with reactor operations [2]. This limited the audit team’s ability to conduct an unbiased review of SL-1 operations.
Following the SL-1 accident, one of the major root causes was identified to be the lack of clear responsibility for reactor design and safety. SL-1 was designed by ANL as contracted by the US Army. ANL then turned over operations for CE who worked with select US Army members for the daily reactor operation [1]. It is evident this large number of organizations involved in SL-1 caused the lines of responsibility to be skewed. Therefore, when a regulatory agency like the AEC conducts an audit and points out clear deficiencies in SL-1 design requiring immediate adjudication, there is no sole organization that can take corrective action. Additionally, safety reviews should be carried out by a single competent group external to the operating organization [1]. The audit groups should be independent of the operations group to provide unbiased feedback on the areas requiring improvement.
Conclusion
SL-1, albeit a brutal accident that resulted in the death of three young service members, taught the nuclear industry several valuable lessons that should not be soon forgotten. These lessons include the importance of operating procedures that properly highlight the potential dangers of various evolutions. Operating procedures have become much more thorough to allow for complete evaluation of the effects of the procedure on the system and integrated plant. This incident aided in the development of the one-stuck-rod criterion and its incorporation into the 10 CFR Part 50 Appendix A reactivity control system design criteria. Specifically, criterion 20-29 states the reactor design must be capable of shutting down the reaction in various scenarios, even with the most reactive rod stuck at the top of the core [6]. Development was seen in emergency response priorities due to the implementation of the three phases disaster plan. This helped to form the framework of modern day SAMGs. Most importantly, SL-1 demonstrated the necessity for frequent audits and evaluation of reactor operation and maintenance by a highly qualified team external to the operation organization. These audits serve as an opportunity to provide action items that the operating organization can implement to allow for better design, day-to-day operations, or operator proficiency.
All nuclear accidents serve as a valuable opportunity to perform root cause analysis and gather the major lessons to be learned. These lessons can then be transferred to other organizations in hope of precluding similar incidents. Due to the potential severity of nuclear accidents, it is extremely important to promulgate all information that is gathered from the review of nuclear accidents. This can be seen with the lessons from SL-1, each of which were used to improve the current industry’s practices and designs.
References
[1] Mosey, David. “Reactor Accidents.” (1990).
[2] Tardiff, A. Nelson. Some Aspects of the WTR and SL-1 Accidents. Vol. 19308. US Atomic Energy Commission, Division of Reactor Development, 1962.
[3] Francisco, A. D., and E. T. Tomlinson. Analysis of the SL-1 Accident Using RELAPS5-3D. No. BT—3710. Bettis Atomic Power Lab., 2007.
[4] Bradley, Darren. “Forgotten Fallout: The Missing Impact of the SL-1 Disaster.” The Thetean: A Student Journal for Scholarly Historical Writing 51.1 (2022): 5.
[5] Perry, E. F. Stationary Low Power Reactor No. 1 (SL-1) Accident Site Decontamination & Dismantlement Project. No. INEL-95/00229; CONF-950868-29. EG and G Idaho, Inc., Idaho Falls, ID (United States), 1995.
[6] “Appendix A to Part 50-General Design Criteria for Nuclear Power Plants.” NRC, U.S. Nuclear Regulatory Commission, 24 Mar. 2021, www.nrc.gov/reading-rm/doc-collections/cfr/part050/part050-appa.html.