Nuclear Engineering and Design/Fusion 1 (1984) 51-60 North-Holland, Amsterdam ON DESIGN CRITERIA FOR AFTERHEAT FUSION-FISSION POWER PLANTS W i l l i a m E. K A S T E N B E R G 51 AND DECAY HEAT REMOVAL IN FUSION AND * School of Engineering and Applied Science, University of California, Los Angeles, California 90024, USA Received May 1983 Afterheat and decay heat removal systems will be important safety features in fusion and fusion-fission hybrid power plants. Decay heat removal considerations for fission power reactors are reviewed and design criteria discussed. Aspects of fusion and fusion-fission afterheat and decay heat removal are also reviewed. It was found that afterheat thermal loads in fusion power reactors are a factor of 5 to 10 less than decay heat loads in fission power plants. However, they remain relatively constant over time periods of interest (out to a year in designs employing stainless steel), as compared to fission plants, whose decay heat loads drop an order of magnitude during the first day. Deterministic criteria for afterheat removal are presented. Although based upon fission reactor experience, they are modified to account for these differences. A probabilistic criterion was developed which is based on public health and economic considerations. A goal of 15 × 10 -6 per reactor year was established for afterheat removal in fusion. For fusion-fission hybrid reactors, a goal ranging between 6 x 10 -6 and 30 × 10 -6 per reactor year was established. The upper limit corresponds to the recent NRC safety goal quideline for core melt frequency (1 x 10-4/year), which has been suggested for the decay heat removal function in Pressurized Water Reactors. These goals are to be applied to a reliability analysis where major uncertainties can be quantified. 1. I n t r o d u c t i o n An important phenomenon of power plants using nuclear fuel is that they continue to produce energy at low levels after the nuclear reactions cease. Because of this phenomenon, systems a n d / o r features must be incorporated into the design of these plants to remove this continued production of energy, called decay heat in fission reactors and afterheat in fusion reactors. Although fission power reactors have been built and operated for over 25 years, the subject of decay heat removal is a very active design and regulatory issue . In a fission plant, decay heat is primarily generated by the radioactive decay of the fission products and secondarily by the decay of actinides and the induced activity in the structural material. In a fusion plant, afterheat is primarily generated by the induced activity in the blanket, e.g. the first wall, the magnet shields, reflectors and the other structural material. Induced radioactivity in either reactor is primarily due to neutron interaction with reactor components. The impor* Work performed while the author was a consultant to EPRI. tance of decay heat or afterheat removal following normal and off-normal operation of a plant is twofold: to protect the economic investment by insuring the structural integrity of the reactor, and to protect the health and safety of the public by preventing the release of radioactive material. The objectives of this paper are as follows: (1) to review the status of decay heat removal for fission power reactors, (2) to discuss the afterheat and decay heat removal question for fusion and fusion-fission hybrid power reactors, and (3) to develop some guidance and criteria for dealing with these issues for fusion and fusion-fission hybrid power reactors. Although general design criteria exist for fission reactors , the results of several studies show that improvements in decay heat removal capability can significantly reduce public risk [3-5]. Moreover, with the advent of quantitative safety goals for fission plants [6,7], there is also a desire to augment these deterministic criteria with probabilistic criteria [8-10]. For fusion and fusion-fission hybrid power plants, a number of conceptual design studies have been employed to explore the relative merits of candidate blan- 0 0 2 9 - 5 4 9 3 / 8 4 / $ 0 3 . 0 0 © E l s e v i e r S c i e n c e P u b l i s h e r s B.V. ( N o r t h - H o l l a n d Physics P u b l i s h i n g D i v i s i o n ) 52 W.E. Kastenberg / Design criteria for afterheat and decay heat removal ket materials with respect to induced activity, biological hazard potential and afterheat [11-15]. It is a goal of this paper to initiate further consideration of this essential issue as fusion and fusion-fission hybrids move from the conceptual stage to the engineering design and development stage. 2. Decay heat removal in fission reactors Under normal operation, the energy produced in a light water reactor (LWR) is removed as pressurized water or steam to produce electricity via the turbine generator. Following reactor shutdown, the reactor produces insufficient power to operate the turbine. Therefore other measures must be available to remove decay heat to ensure that high temperatures and pressures do not develop which could pose a threat to the reactor. These measures have as their functional requirements: (1) providing a means of transferring decay heat from the reactor coolant system to an ultimate heat sink and (2) maintaining sufficient water inventory inside the reactor to ensure that the reactor coolant adequately cools the reactor fuel. Pressurized water reactors (PWRs) generally have three means of removing decay heat: the auxiliary feedwater system, the residual heat removal system and the turbine bypass system. Reactor water inventory is maintained by the high pressure safety injection system or the chemical and volume control system . Boiling water reactors (BWRs) usually combine these two functions with the following systems: the residual heat removal system, the reactor core isolation cooling system (RCIC) and the turbine bypass system. The RCIC system operates as a high pressure system, and it is backed up by a high pressure core spray system. In a BWR, the residual heat removal system can operate in a number of different modes for both low pressure injection and decay heat removal . A recent study  describes many of the design variations that have evolved in the U.S. and abroad for PWR and BWR decay heat removal systems. In general, these variations involve the number of components or equipment trains employed to make up the decay heat removal systems. In the United States and abroad, the following deterministic design criteria are used for decay heat removal systems : (1) Ensure that fuel integrity and pressure boundaries are maintained. (2) Withstand fire, sabotage, natural phenomena, and other extreme conditions. (3) Operate under normal and emergency power conditions. (4) Provide manual backup control capability for automatic systems. (5) Monitor and maintain reactor coolant pressure boundary through inspection, leak detection, and isolation valving. (6) Function despite the single failure of an active component or the occurrence of small pipe breaks. (7) Prevent shared normal or emergency equipment from jeopardizing reliable safety operations. (8) Provide uninterrupted cooling for thirty days. Several non-U.S, countries have additional criteria: (9) Initiate and operate automatically for a period ranging from 10 minutes to 10 hours. (10) Function despite the single failure of an active or passive component in combination with a maintenance outage involving a redundant system. (11) Operate without on-site repair action for at least 12 hours and without offsite repair action for at least 48 hours. More detailed system information such as flow rates and decay heat levels, number of trains and power supplies are given in plant safety analysis reports (SARs). However, much of this information presents design descriptions rather than criteria for a design. The current regulatory interest in decay heat removal comes as a result of the Reactor Safety Study  which focused on the Surry PWR and Peachbottom BWR whose decay heat removal systems were designed in accordance with the general design criteria for U.S. plants listed above. As noted by Berry and Sanders , the following observations can be made for Surry (a PWR): (1) Transients and certain small loss of coolant accidents (LOCAs) pose the highest probability for core meltdown. (2) Of all transients and small LOCAs, those involving the failure of high pressure injection and auxiliary feedwater systems (for decay heat removal) pose the highest probability for core meltdown. Similarly the following observations can be made for Peachbottom (a BWR): (1) Transients, together with failure of the residual heat removal, system, or the reactor protection system, pose the highest probability for core meltdown. Recognizing the importance of decay heat removal in preventing core meltdown, Ebersole and Okrent  were the first to propose an alternative approach which included dedicated systems (the systems described above W.E. Kastenberg / Design criteria for afterheat and decay heat removal have other functional requirements as well as decay heat removal), dedicated rather than shared power supplies and was bunkered (i.e., especially protected from severe internal and external hazards such as a turbine blade missile, tornadoes, floods and sabotage). Quantitative estimates of potential risk reduction with improved decay heat removal has been the subject of investigation at Sandia National Laboratory [5,16]. Their work can be summarized as follows: (1) For the three-train Surry high pressure system and auxiliary feedwater systems, system reliability improvements of as much as a factor of ten will result in less than a factor of two decrease in overall core meltdown frequency. (2) For the two train Peachbottom residual heat removal system, improvements of as much as a factor of ten in the reliability of either the residual heat removal and high pressure service water systems, or the reactor protection system will result in only about a factor of two decrease in overall core meltdown frequency. (3) In PWR's having two installed decay heat removal trains, estimated reductions in coremelt probability of at least a factor of ten were attained with the addition of an auxiliary feedwater or high pressure injection train. (4) For BWRs, an add-on single train suppression pool cooling/low pressure injection system gains a factor of about six reduction in coremelt probability. .As noted in item 10 under design criteria, a philosophy has evolved in several European countries that requires safety systems to be able to sustain both a random failure of one train and a simultaneous maintainence outage of another train, and still retain 100% operational capacity. This philosophy was not adopted for improving decay heat removal reliability nor for reducing the probability of coremelt. Rather, it was adopted over a concern for special emergencies (e.g., airplane crash and explosive pressure waves, etc.), characterized by low frequency. Hence, effort has been placed on providing three, four and sometimes six trains for decay heat removal, even though the safety benefits tend to decrease in a probabilistic sense beyond three trains. It is important to recognize that the Reactor Safety Study, as well as the Sandia studies, are based upon probabilistically evaluated events which do not include special emergencies (e.g., plane crashes, severe floods, tornadoes, etc.). The occurrence frequency and significance of special emergencies are not easily predicted, and hence are difficult to quantify. On the other hand, recent Probabilistic Risk Assessments (PRAs) for the Zion  and Indian Point  power plants have 53 treated severe external events parametrically and deduced that while they do not dominate coremelt probability, they do contribute significantly to risk. Before turning to the question of afterheat in fusion and fusion/fission hybrid reactors, it is of interest to mention decay heat removal in liquid metal, fast breeder reactors (LMFBRs) and in gas cooled reactors (GCRs). The decay heat removal system for the Clinch River Breeder Reactor (CRBR) is typical of what one might expect with a low pressure system and liquid metal coolant. In addition to the normal decay heat removal path consisting of the balance of plant steam/feedwater system (turbine bypass system) there are three backup systems . The first are protected air-cooled condensers which cool the steam drums, on each of the three coolant loops. A second heat sink can be made available by opening the safety relief valve in the steam line between the steam drum and the turbine and venting steam to the atmosphere. A protected water storage tank is available for supplying make-up (auxiliary) water, while two of the auxiliary feedwater pumps are electrically driven and one is steam driven. Lastly, a completely separate "direct heat removal service" (DHRS), is provided to remove decay heat directly from the in-vessel, primary loop, and has as its heat sink, an air blast heat exchanger. The latter represents diversity from the water system in the steam loop. The decay heat removal systems using the primary and intermediate coolant loops depend on forced circulation by the main coolant pumps driven at approximately 10% speed by small pony motors which depend on a source of electric power. Similarly the DHRS air blast heat exchangers rely on electric power. Although CRBR is designed with redundant and diverse power supplies, the capability for decay heat removal by natural circulation is a desirable feature. With natural circulation, the inherent safety of the plant is enhanced since no electric power is required to provide adequate circulation in the heat transport or steam generator systems following shutdown. Although CRBR and several other LMFBRs (the German SNR-300 and the French Phrnix) are designed for natural convection cooling, and the transition from forced to natural circulation has been verified at the Fast Test Flux Facility , several questions must still be answered. These include demonstration under actual LMFBR normal and off-normal conditions, as well as the passivity of the ultimate heat sink (e.g., the air cooled condensers) . Gas cooled fast reactors (GCFRs) and high temperature gas cooled thermal reactors (HTGRs) have also 54 W.E. Kastenberg / Design criteriafor afterheat and decay heat removal been designed with alternate and diverse decay heat removal systems, For GCFRs, there are three separate systems : (1) Steam bypass to the condenser using the normal power conversion system, (2) Operation of three shutdown cooling system loops using the steam generators, and main helium circulators (pumps) driven by pony motors, and (3) Three Core Auxiliary Cooling System (CACS) loops. The CACS loops have their own independent auxiliary circulators and cooling water loops. An air-blast type heat exchanger provides the ultimate heat sink. The CACS is designed to provide core cooling following all design basis events, including the depressurization of the primary cooling system. It has also been argued that the heat transfer components within the CACS are located at sufficient elevation differences such that natural circulation will transfer decay heat from the core to the ultimate heat sink, provided the system is pressurized , although this was never verified. For HTGRs there are two main modes for removing decay heat: (1) The Main Loop Cooling System (MLCS), composed of the steam generators, the main helium circulators, the main loop isolation valves, and the associated ducting. (2) The Core Auxiliary Cooling System (CACS), composed of a core auxiliary heat exchanger, an auxiliary circulator, an auxiliary circulator service system, and a core auxiliary cooling water system. The CACS for an H T G R is an engineered safety feature for decay heat removal in the event the main loops are unavailable. A typical 1100 MW c H T G R design calls for six main loops and 3 auxiliary loops, each with its own circulators, heat exchangers and steam generators. A recent study by Washburn  indicated that the initiating events of greatest importance to coremelt frequency are, (a) loss of adequate a-c power, (b) loss of CACS shutdown heat-removal and (c) the loss of main loop shutdown heat removal. decay heat is primarily generated by the fission products, and although the relative yields change with neutron spectrum, the decay heat curve is somewhat universal. It is approximately 7% of operating power at shutdown, 2% at 1 hour, 1% at 5 hours, 0.5% at 1 day and 0.1% at 10 days. 3.1. Fusion systems Since afterheat in fusion power plant conceptual designs is due to neutron induced activity in the blanket, and primarily in the first wall, it is material dependent. Vogelsang et al.  examined afterheat as a function of both time after startup and time after shutdown for three structural materials making up the first 50 cm of the blanket, in the UWMAK-I design (5000 MWth ). After 10 weeks of operation, the three materials (type 316 stainless steel, vanadium-20% titanium and niobium-l% zirconium) approached an afterheat value of 22 MW at shutdown, or 0.4% of operating power. At ten years of operation the type 316 stainless-steel (316 SS) and the niobium-l% zirconium ( N b - l Z r ) afterheat reach 0.6% of operating power at shutdown. The vanadium-20% titanium (V-20 Ti) remained relatively constant between 10 weeks and 20 years at 0.4% power. Following shutdown (after 10 years of operation) the N b - l Z r structure afterheat remained fairly constant ( - 0.5% operating power) out to 10 days. Thereafter, it drops drastically (a factor of 10 reduction after 10 weeks). The Type 316 SS afterheat remains fairly constant beyond 1 day (at 0.4% operating power), drops to 0.2% operating power at 1 year, and to 0.06% (an order of magnitude) at 2 years. The V-20 Ti structure afterheat decayed the quickest; from 0.4% operating power to 0.1% in 1 hour, to about 0.05% in 1 day (an order of magnitude reduction). It appears then, that the 316 SS blanket structure maintains, on the average, a relatively constant afterheat value for several years after shutdown compared to other materials. In a further study of first wall/blanket materials, Conn et al.  compared induced activity and afterheat in five design studies as follows: 3. Afterheat considerations in fusion and fusion/fission systems Before attempting to postulate design criteria for fusion and fusion/fission hybrid reactors it is of interest to examine the nature of afterheat in these systems. Decay heat removal in fission power reactors is based upon a standard decay heat curve which gives the percent of operating power as a function of time. Since 1 2 3 4 5 Designer Material Afterheat as % power Shutdown 1 Week Wisconsin LLL ORNL BNL Princeton 316 SS 316 SS niobium SAP a PE-16 b 0.4 0.4 0.2 2.0 5.0 0.4 0.4 0.01 1.0 0.5 SAP = Sintered Aluminum Product (88~ AI, 12% Al203). b Pc-16 = 43% nickel, 39% iron, 18% chrome. W.E. Kastenberg / Design criteria for afterheat and decay heat removal A detail of the first 100 minutes (1½ hours) showed a fairly constant power rating for all cases but the niobium which dropped by a factor of 5 within the first six seconds and then remained constant. Blankets including the materials TZM (0.45% titanium, 0.1% zirconium, remainder molybedinum), and 2024 A1 (aluminum) were also compared in UWMAK-I by Vogelsang . The total afterheat, at shutdown following two years of operation for TZM and V-20 Ti was 1.4% and 1.5% of operating power respectively. The 2024 AI and 316 SS had afterheat on the order of 1% full power. Except for the V-20 Ti which dropped a factor of 5 in the first hour, the others remained fairly constant out to one day. In this study, the entire blanket was considered, rather than 50 cm. Recently, Youssef and Corm  have examined induced radioactivity and influence of materials selection in DD and DT fusion reactors. For the SATYR design using a deuterium-deuterium fuel cycle, a SAP blanket at shutdown has a power rating that is 13% of operating power. For a ferritic steel blanket (HT-9), the afterheat is 0.6% operating power. Within 1 hour, the SAP blanket is down to 1% afterheat, and down to ½% at one day. In the HT-9 blanket the afterheat is constant to 1-hour, and then drops an order of magnitude. Thereafter, it remains fairly constant (-0.02%) in the time frame of 1 day to 1 year; after which it drops drastically (an order of magnitude) due to the decay of the Fe 55. These reactors were compared with the WITAMIR-I design  using HT-9 and the STARFIRE design , using PCA (2% molybdenum, 16 nickel, remainder steel). The afterheat at shutdown in the two reactors are approximately 0.9% operating power, or about 30 and 40 MWth respectively. Both are fairly constant for several months. 55 3.2. Fusion-fission systems Afterheat in fusion-fission (hybrid) power plant designs is due to structural activation (first wall/blanket), fission product decay, and decay of actinide and transuranic elements. Hybrid systems have been proposed as power producers, fissile fuel producers and actinide burners. For a fast fission blanket, Kastenberg et al.  determined that the fission product inventory of a hybrid should not differ significantly from that of fission reactors. In this regard then, a hybrid reactor would posses both the afterheat requirements of pure fusion with respect to the first wall and structural materials and the decay heat removal requirements of a fission reactor. Recently there has been interest in fission suppressed blankets for producing fissile fuel [28-30]. Since the fission product decay heat would dominate a hybrid, the suppression of fission for breeding purposes, should also lower the decay heat removal requirements. This is shown in table 1, which is reproduced from ref. . Examination of table 1 shows several important trends. For fast fission blankets the decay heat power density produced in the fertile zone, approaches the afterheat produced in the first wall, in about a day. For the fission suppressed blanket, the first wall afterheat dominates within an hour of shutdown. 3.3. Remarks The brief survey presented here indicates that afterheat removal in fusion systems is materials dependent. However, a general trend seems to be present; afterheat thermal loads will be about a factor 5-10 less than fission decay heat thermal loads, but will remain Table 1 Total volumetric afterheat production rates a (W/cm3) at shutdown, and at 1 h and 6 h after shutdown Blanket concept a Hours after shutdown First wall Uranium fast-fission Thorium fast-fission Thorium fission suppressed Pure fusion a Based on 4000 MWth total power. Fertile zone 0 1 6 0 1 6 0.9 0.9 0.9 0.9 0.7 0.7 0.7 0.7 0.5 0.5 0.5 0.5 3.8 2.6 0.9 - 1.4 0.9 0.3 - 1.0 0.6 0.2 - 56 W.E. Kastenberg / Design criteria for afterheat and decay heat removal relatively constant over periods of interest (from shutdown to 1 day, for stainless steel out to one year). This latter attribute differs from fission decay heat which drops an order of magnitude within 1 day. For fusion-fission hybrids, the combined heat load (decay plus afterheat) is also sensitive to the blanket design. For the first day, fast fission blankets resemble fission reactor decay heat loads. For fission suppressed blankets, afterheat dominates after 1 hour. 4. Criteria for fusion and fusion/fission afterheat and decay heat removal systems It has been recognized that loss of afterheat and decay heat removal capability in fusion and fusion-fission hybrid power plants will be a major contributor to risk [29-31]. In this context, risk can be taken in the probabilistic sense: frequency times consequence. Furthermore, consequence includes both health effects and economic loss. A number of conceptual designs have been completed for various fusion and fusion-fission systems, but little attention has been paid to this safety question as a design issue. Balance of plant designs usually include systems and components for normal power operation (e.g., pumps, steam generators, loops, turbines, etc.), but not for afterheat and decay heat removal. From a safety viewpoint, calculations are performed for a variety of scenarios such as loss of flow and loss of coolant, and time-to-melt or time-to-structural failure are used as figures of merit. Although these considerations are important in determining the consequences of accidents, and in the initial choice of materials and coolants, they are of little use to the designer in laying out the balance of plant. In this section two types of criteria are proposed for design consideration. 4.1. Deterministic criteria In section 2, eleven general design criteria were given for decay heat removal systems in fission power plants. Before determining the applicability of these criteria a n d / o r modifying them, several points should be discussed. Afterheat generation in first wall/blanket materials represent a smaller percentage (on the order of 1~ or less operating power) than fission reactor decay heat (on the order of 7~) at shutdown. On the other hand, afterheat generation tends to be fairly constant for up to a year (for stainless steel) following shutdown, while decay heat generation drops an order of magnitude within a day. Hence, up to 50 MWth may have to be removed for periods of 1 week to 1 year in a fusion plant. With these comments in mind, the following criteria appear to be appropriate: 1. Ensure that blanket and fuel structural integrity, and pressure boundaries are maintained. 2. Withstand fire, sabotage, natural phenomena, and other extreme conditions. 3. Operate under normal and emergency power conditions. 4. Monitor and maintain coolant boundary through inspection, leak detection and isolation valving. 5. Prevent shared normal or emergency equipment from jeopardizing reliable safety operations. 6. Initiate and operate automatically for a period ranging from 1 hour to 1 day. 7. Provide manual backup control capability for automatic systems. 8. Provide uninterrupted cooling for up to two months. 9. Function despite the single failure of an active or passive component in combination with a maintainence outage involving a redundant system. 10. Operate without on-site repair action for at least 5 days and without off-site repair action for at least 1 month. The basic approach in formulating these criteria was to adopt fission reactor criteria as appropriate but account for the prolonged generation of afterheat. It should be pointed out that the varying time scales reflect the dependence of the afterheat load on the materials employed. A more conservative approach was taken to the single failure criterion (number 9) because of the potentially large economic loss should afterheat removal fail. 4.2. Probabilistic criteria Quantitative or probabilistic safety criteria to provide guidance to reactor designers have been used in the U K for several years and have been found to be a useful tool in the design process . With the increased emphasis on the use of a quantitative approach in the US, there is now an interest in developing quantitative criteria for the main safety functions of fission reactors, both for assessing the adequacy of the safety systems in existing plants and for providing guidance to the designers of new plants. Recently Cave et al.  developed a screening criteria for evaluation of decay heat removal in PWRs. The starting point is a set of safety goals for LWRs that was published by the NRC for public comment . The principal goals in this set are based on public health W.E. Kastenberg / Design criteria for afterheat and decay heat removal 57 Table 2 Risks for evaluation of afterheat removal Public health Onsite economic Offsite economic Early fatalities Cost of energy replacement Delayed fatalities Early illness Delayed illness Genetic effects Repair costs Clean up costs Decommissioningcosts Occupational health costs Capital investment loss Public damage (loss of gross national product due to interdiction) Lost wages Decontamination costs Public health costs Evacuation/rehousing costs Secondary costs (higher electricitycosts affect industrial production) risk, and there is a supporting goal relating to the acceptable probability of coremelt, i.e., 10 -4 per reactor year, median value. An allocation scheme was developed which appropriated 25 x 10 -6 per reactor year to the shutdown decay heat removal phase (scram to hot shutdown) and 5 × 10 -7 for the residual heat removal phase (hot shutdown to cold shutdown) for PWRs. Because fusion power plants will have very large capital costs, economic as well as public health risks should be included in developing criteria for afterheat removal. Examples of the risks that should be considered are shown in table 2. The work of Kazimi and Sawdye  is particularly useful in developing criteria for afterheat removal systems. Beginning with the premise that the potential radiological hazards associated with accidents in fusion reactors should be less than those of commercial light water reactors, Kazimi and Sawdye determined maximum tolerable frequencies for large accidents. These frequencies were defined so as to assure that releases of fusion reactor induced radioactivity (not tritium) do not imply a greater radiological hazard than in either the WASH 1400 PWR or BWR. Utilizing the UWMAK-I (316 SS blanket) and the UWMAK-III (TZM blanket) designs, it was determined that maximum tolerable release frequencies were 10 -5 and 4 x 10 -6 per reactor year, respectively. Noting that the radioactivity inventories used were among the highest possible in Tokamak reactors, and that no release mitigation factors were employed, it was concluded that these numbers represent lower bounds. From an economic viewpoint, the work of Stucker et al.  and Strip  are particularly useful. Stucker et al. focused on the costs of closing the Indian Point Nuclear Power Plants (two units) before their useful life was over. They estimated that the costs would be between $7.7 billion and $17.4 billion and was composed of the incremental generating costs (Indian Point pro- duces the cheapest electricity in the New York City area), one time costs and savings, business costs and secondary costs (net costs to the local economy). The major component was the replacement power cost, estimated at about $8 billion for the two units (approximately 2000 MWe). Strip estimated the financial risks of. nuclear power accidents as a function of accident severity and location for several power plant types. Included were onsite and offsite health costs, and onsite and offsite economic costs. Strip's results, although site dependent, indicate that onsite costs (including replacement power costs) dominate, with offsite costs a close second. Onsite costs varied between $1 and $10 billion, with clean-up costs contributing $1 and $2 billion. For the most severe accidents, offsite costs were as high as $10 billion. For less severe accidents, the replacement costs could be less, if the plant was repaired, and put back on-line. For the purposes of the analysis here, the following can be considered. A large accident at a fusion or fusion-fission power plant involving loss of the blanket and part of the primary coolant system due to a loss of afterheat or decay heat removal would involve loss of capital investment, replacement power costs and clean up costs. Nuclear power plants costs such as CRBR and Shoreham are approaching $3 billion. Fusion plants have been estimated to cost between $2 and $10 billion. Replacement power for a large fusion plant might be on the order of the two units at Indian Point ($8 billion) and clean-up costs might be similar to those estimated for Three Mile Island ($2 billion). Although it is recognized that the capital investment cost must account for depreciation, it can be assumed that loss of a fusion plant might approach 10 billion dollars. If the blanket wa repairable or replaceable, the loss might approach 5 billion dollars. Taking 10 -5 per year as an upper limit for loss of the blanket, and 10 billion dollars as the total potential 58 W.E. Kastenberg / Design criteria for afterheat and decay heat removal loss, the expected risk (loss) is l0 s dollars/year, ($100000/year). If the goal were relaxed to 10 -4 per year, the expected loss would be 106 dollars/year ($1 million/year). An expected loss of 106 dollars/year appears to be at the high end of acceptability. Since 10 -5 per year for a loss of the blanket may be conservative from a public health viewpoint, and 10 -4 per year intolerable from a financial viewpoint, a value between them of 5 × 10 -5 per year might appear appropriate. If this value is adopted, two other considerations must be dealt with: (a) The provision for adequate margin against the effects of uncertainties in the estimation of the risks, and (b) an appropriate allocation of the goal due to loss of afterheat removal and to other functions whose failure could lead to loss of the blanket structure, and release. Uncertainties can be divided into three categories: (1) Uncertainties due to variations in data and which can be quantified; (2) uncertainties due to describing extreme events such as severe earthquakes, floods, etc., and extreme phenomena (the so-called special emergency situations described in section 2), and (3) uncertainties due to human errors, design errors, and extreme human acts (sabotage). Category 1 uncertainties are those included in design. Category 2 and 3 uncertainties are unquantifiable at present, and can be treated as design margins. Following Cave et al. , adequate margin can be attained by assigning 40% of the goal to Category 1 uncertainties, with the remainder divided equally between Category 2 and 3. Hence for system design, the loss of blanket frequency goal would be 20 × 10 -6 per year. The allocation between the afterheat removal function and the others required to prevent loss of blanket integrity should be arrived at from a plant specific probabilistic risk assessment. Examination of the relative demand for these functions would optimize the suballocation. In PWRs, experience leads to a 75% allocation to decay heat removal function and 25% to others, such as large break loss of coolant accidents and other transients . The most effective mechanism for releasing radioactive blanket material is oxidation following a lithium fire in the U W M A K systems with lithium coolant following a loss of coolant . Plasma disruption may be a further cause for release, but appears to be localized in nature . For gas (helium) cooled systems, depressurization accidents have also been shown to be less of a contributor to risk than loss of decay heat removal capability . In summary, there is little evidence to believe that the split between the afterheat removal function and the other safety functions will be much different than that for fission reactors. Hence a 75/25 split is assumed, and will be varied below. This final allocation yields a reliability requirement of 15 × 10 -6 per year for afterheat removal in a fusion reactor. This value may not be too far from optimum for the following reasons. If the Category 2 and 3 uncertainties were reduced by a factor of five (12% allocation), the allocation for afterheat removal would double; i.e., it would be 33 × 10 -6 per reactor year. Similarly, if it were found that other safety functions were equal to afterheat removal; (as in BWRs) the goal becomes 10 × 10 -6 per reactor year. Hence the range 10 x 10 -6 to 33 x 10 -6 , with a goal of 15 x 10 -6 appears reasonable. This analysis is summarized in table 3. For fusion-fission hybrid reactors, the combined afterheat and decay heat removal functions must be considered. At one extreme, the blanket could be considered a fission reactor, and the N R C safety goal applied. Using the arguments above, (40% for Category 1 uncertainties, 75% for decay heat removal function) one arrives at an allocation of 30 × 10 -6 per reactor Table 3 Allocation of afterheat removal reliability goal Allocation Value Totals Base case Afterheat function Other functions 15 × 10- 6/year 5 × 10- 6/year 20 x 10- 6/year 15 × 10-6/year 15 x 10- 6/year Category 1 uncertainty (40%) Category 2 uncertainty (30~) Category 3 uncertainty (305g) 5 x 10- 5/year Reduced uncertainty Afterheat function Other functions 33x10 -6 l l x l 0 -s 44×10 -6 3×10 -6 3X10 -6 Category 1 uncertainty (88~) Category 2 uncertainty (6~) Category 3 uncertainty (6~) 5 x 10-5/year Reduced function Afterheat function Other functions Category I uncertainty 10×10 -6 lOxlO -6 20x10 -6 W.E. Kastenberg / Design criteriafor afterheat and decay heat removal 59 year as the design goal. This extreme represents public health. From an economic viewpoint, the loss of a hybrid also represents the loss of an assured fuel supply to a number of fission reactors. Hence some multiplier, in terms of expected loss must be used. Assuming that the monetary loss of a hybrid is a factor of 5 greater than the monetary loss of a pure fusion power reactor, or 50 billion dollars ($50 × 109), and that the upper limit on expected loss is 1 million dollars per year; the goal would become 20 × 10 -6 per reactor year. Allocating for uncertainty and function as before, the combined afterheat-decay heat function-goal would be 6 × 10 -6 per reactor year. Hence a range of 6 × 10 -6 to 30 × 10 -6 per reactor year may be appropriate for hybrids. and can be used in a variety of ways. They can be used to determine the number of loops, steam generators a n d / o r heat sinks required in the balance of plant. Or, on the subsystem level, they can determine the number of trains, pumps, valves, etc. needed to provide such things as auxilliary feedwater. It should be noted that one approach for insuring the decay heat removal function in liquid metal cooled systems is by natural circulation. Although some fusion systems are designed with lithium coolants, the geometries employed might preclude its use as a viable option. For fusion-fission hybrids, gas cooling appears to be the favored approach, which necessitates high pressure. Since depressurization is a design basis event, natural circulation might be precluded as well. 5. Summary and conclusions Acknowledgement Design criteria for afterheat and decay heat removal in fusion and fusion-fission power plants were proposed in this paper. Deterministic criteria were derived by reviewing the general design criteria for fission plants and modifying them to account for the different features of fusion and fusion-fission after- and decay heat. The fraction of full power for afterheat (fusion) tends to be an order of magnitude less than that for decay heat (fission) and it decays rather slowly by comparison. However, if fusion reactors produce high thermal power (5000 MWth) the total heat load will be comparable over the time of interest (1 day to 1 week). As a result, it is proposed that the general design criteria for fission plants be made more conservative for fusion reactors: in particular it is proposed that the afterheat removal system function despite both a single failure of an active or passive component in combination with a maintenance outage involving a redunant system. Moreover, the time for automatic operation, and on-site and off-site repair action are extended. Probabilistic criteria were developed from both an economic and a public health viewpoint. Using a lower limit for public health risk and an upper limit for financial loss, an allocation scheme was proposed to account for uncertainty and function. The following design criteria are proposed: This work was supported by the Electric Power Research Institute. The author wishes to thank Dr. Noel Amherd for his interest, support, and encouragement. Reactor Function Criterion Fusion Fusion-fission Afterheat removal Afterheat/ decay heat removal 15 × 10-6/year 6 × 10- 6 to 30 × 10-6/year These values are meant to be target values for design References  U.S. Nuclear Regulatory Commission, Plan for the resolution of generic safety, Issue A-45: Decay heat removal (November 1981).  Code of Federal Regulations, Title 10, Part 50, Licensing of production and utilization facilities,Appendix A, General design criteria for nuclear power plants.  J.C. Ebersole and D. Okrent, An integrated safe shutdown heat removal system for light water reactors, UCLAENG-7651 (May 1976).  U.S. Nuclear Regulatory Commission,Plan for research to improve the safety of light water nuclear power plants, A Report to the Congress of the United States of America, NUREG-0438 (April 12, 1978).  D.L. Berry and G.A. Sanders, A study of the value and impact of alternative decay heat removal concepts for light water reactors, NUREG/CR-2883, Sandia National Laboratory Report, SAND 82-1976 (February 1983).  U.S. Nuclear Regulatory Commission,Advisory Comittce on Reactor Safeguards, An approach to quantitative safety goals for nuclear power plants, NUREG-0739 (October 1980).  U.S. Nuclear Regulatory Commission, Proposed safety criteria for nuclear power plants, NUREG-0880 (October 1982).  U.S. Nuclear Regulatory Commission, Action plan to implement the Commission's proposed safety goal policy statement, Draft (June 1982).  U.S. Nuclear Regulatory Commission,Plan to evaluate the 60              W.E. Kastenberg / Design criteria for afterheat and decay heat removal Commission's safety goal policy statement, Draft (January 1983). L. Cave and W.E. Kastenberg, The development of Quantitative criteria for the decay heat revocal function of LWRs, Proceedings of the CSNI Specialist Meeting on Decay Heat Removal Systems, April 25-29, 1983. W.F. Vogelsang, G.L. Kulcinski, R.G. Lott and T.Y. Sung, Transmutations, radioactivity and afterheat in a deuterium-tritium tokamak fusion reactor, Nucl. Technol. 22 (June 1974) 379-391. R.W. Conn, T.Y. Sung and M.A. Abdou, Comparative study of radioactivity and afterheat in several fusion reactor blanket designs, Nucl. Technol. 26 (August 1975) 391-399. W.F. Vogelsang, Radioactivity and associated problems in thermonuclear reactors, University of Wisconsin Report, UWFDM-178 (September 1976). R.W. Conn, K. Okula and A.W. Johnson, Minimizing radioactivity and other features of elemental and isotopic tailoring of materials for fusion reactors, Nucl. Technol. 41 (December 1978) 389-400. M.Z. Youssef and R.W. Conn, Induced radioactivity and influence of materials selection in DD and DT fusion reactors, Nucl. Technol. Fusion 3 (1983) 361-384. D.L. Berry, Study of alternative decay heat removal concepts for LWRs--Current systems and proposed options, N U R E G / C R 1556 Sandia National Laboratory Report SAND 80-0929 (April 1981). U.S. Nuclear Regulatory Commission, Reactor safety study--An assessment of accident risks in U.S. commercial nuclear power plants, WASH-1400, NUREG 75/014 (October 1975). The Zion probabilistic risk assessment, Commonwealth Edison Company (1981). The Indian Point probabilistic risk assessment, Consolidated Edison Co. (1982). Clinch River Breeder Reactor Plant, Preliminary Safety Analysis Report, Project Management Corporation (1975). A.E. Waltar and A.B. Reynolds, Fast Breeder Reactors (Pergamon Press, New York, 1982). Summary report on the current assessment of the natural circulation capability with the heterogeneous core, CRBRP-ARD-0308, Westinghouse Electric Corporation (February 1982).  M. Croft, J.V. Del Bene and A. Torri, Natural convection effects in a GCFR subassembly during loss of flow with scram conditions, Proc. of the International Meeting on Fast Reactor Technology, Seattle, Washington 1979.  B.W. Washburn, Accident Delineation and evaluation of the high-temperature gas-cooled reactor system concepts, NUREG/CR-1200, LA-8179-MS, Los Alamos Scientific Report (December 1979).  B. Badger et al., WITAMIR-I, a tandem mirror reactor safety, UFWDM-400, Fusion Research Program, University of Wisconsin (December 1977).  STARFIRE, a commercial tokamak fusion power plant study, Argonne National Laboratory Report, ANL/FPP80-1, Vol. I-II (September 1980). [.27] W.E. Kastenberg, D. Okrent et al., On the safety of conceptual fusion-fission hybrid reactors, Nucl. Engrg. Des. 51 (February 1979) 311-359.  Hybrid Reactor Safety Study-Second Annual Report, General Atomic Company, GA-A 16185 (December 1980).  J.A. Maniscalco, D.H. Berwald et al., Laser fusion driven breeder design study, TRW Systems (December 1980), see also: Recent progress in fusion--fission reactor design studies, Nucl. Technol./Fusion 1 (Oct. 1981) 419.  J.D. Lee, R.W. Moir et al., Feasibility study of a fissionsuppressed tandem-mirror hybrid reactor, UCID-19327, Lawrence Livermore Laboratory (April 1982).  J.D. Lee and R.W. Moir, Fission-suppressed blankets for fissile fuel breeding fusion reactors, Lawrence Livermore Laboratory, UCRL-84104 (April 22, 1980).  L. Cave, S.R. Harrison, A.L. Marchese and J.N. Tweedy, The practical application of quantitative criteria for nuclear power plants, Proc. of ANS/ENS Topical Meeting on Probabilistic Risk Assessment, New York, September 1981.  M.S. Kazimi and R.W. Sawdye, Radiological aspects of fusion reactor safety: Risk constraints in severe accidents, J. of Fusion Energy 1 (1) (1981).  J.P. Stucker et al., Costs of Closing the Indian Point nuclear power plant, The Rand Corporation, R-2857-NYO (November 1981).  D.R. Strip, Estimates of the financial risks of nuclear power reactor accidents, NUREG/CR-2723 (May 1982).  D. Okrent et al., On the safety of tokamak-type, central station power reactors, Nuc. Engrg. Des. 39 (Oct. 1976) 215-238.