As the world's first commercial, non-stationary type of nuclear power plant, the SAVANNAH'S design and construction had to result in a vessel with an unprecedented degree of safety. Basically, the safety considerations concerned two separate, but closely inter-related, factors:
(1) The hull and interior structure had to surpass the highest standards of safety, both in the conventional marine sense, and in light of the additional potential hazards created by the installation of a nuclear propulsion plant; and
(2) The nuclear propulsion system must create no more hazard to the crew and passengers, and other ships in any busy port, than the most modern conventional steam propulsion system -- actually, in the light of public acceptance, it must be even safer than a steam-powered vessel that burns coal or oil.
The basic difference in the safety problem between a nuclear powered ship and a conventionally-powered ship is that provision must be made to control, under all foreseeable conditions, the radioactivity which results from the fission process. This control is accomplished through the design and operational features described below.
HULL AND INTERIOR STRUCTURE
In general, the following safety requirements were established for the SAVANNAH'S architects, George G. Sharp, Inc.:
(1) The ship shall be as safe as, or safer than, any other vessel of its class with regard to the usual "Hazards of the sea"; and
(2) In no credible accident shall there be any hazardous release of radioactivity to the environment.
The SAVANNAH is designed to a two compartment standard of subdivision (i.e., the ship will remain afloat with two main compartments totally flooded) at a draft of 29 feet, 6 inches with margin line 3 inches below "B" deck which is in excess of the subdivision requirements of the U. S. Coast Guard and Senate Report 184. The ship will comply with all of the applicable laws of the United States and requirements of the various bodies
and rules in force at the time of delivery.
Structurally, the SAVANNAH differs from normal passenger-cargo ships only in that the reactor and containment foundations are comparatively much heavier than the foundations for normal ship's machinery. The heavy longitudinal members are carried well beyond the reactor and machinery space transverse bulkheads to tie with a smooth transition into the double-bottom structure.
The SAVANNAH would not be penalized in a situation (such as grounding on a ledge) in which discontinuities would prejudice longitudinal strength.
Stability equivalent to that of a normal passenger-cargo ship with fuel oil tanks full has been obtained in the SAVANNAH. In addition, because there is no fuel oil to be consumed in passage, there is less variation in GM (the measure of stability) during the course of a long voyage.
From the standpoint of ship safety, provision of sufficient power to maintain steerage and maneuverability is the principal requirement of the propulsion plant. To this end, duplication of machinery components and power sources on the SAVANNAH has been carried to such a degree that the only vital units without backup of some form are the rudder, propeller, and shafting.
An electric take-home motor is installed for emergency operation. Developing 750 hp (nominal), it is coupled to one of the high
speed pinions in the reduction gear. A quick connect coupling permits engagement in less than two minutes. In addition, a temporary supplementary startup steam plant will be installed in No. 7
hold until the reactor plant has reached a condition of relatively trouble-free operation. This plant is capable of developing 2,000 shp ahead and about 1,750 shp astern, using the main propulsion unit, in emergencies it may be used in lieu of the take-home motor. Using forced circulation boilers, it can, like the take-home motor, be brought on the line in about two
minutes. In case of a reactor plant failure, the stored heat in the reactor system will be available for a short period, so that at
no time will SAVANNAH be without power to the shaft.
From the standpoint of conventional ship operation, the SAVANNAH has been designed to an almost unprecedented degree of operational safety.
Reactor safety is ensured by the heavy steel containment shell surrounding the reactor system. This shell is designed to withstand the pressure surge from the "maximum credible accident", which, in this case, is defined as a rupture of a
main coolant pipe. Thus, any internal reactor accident will be
contained within the reactor containment shell and no hazardous amount of radioactivity can escape to the environment.
Protection of the containment complex from ship accidents has been studied in detail in connection with establishing the SAVANNAH'S design criteria. In particular, ship collisions were carefully reviewed and methods developed to predict structural damage to vessels struck in collision as a function of speed and displacement of the vessels involved. On the basis of the data obtained from these studies, the SAVANNAH was designed to
withstand, without damage to the nuclear reactor compartment, any collision with all but less than two percent of the world's merchant fleet.
The probability of collision with a ship of this remaining group is extremely low. Considering that the SAVANNAH, as the first nuclear-powered merchant ship, will be handled with extreme
care, the probability of a dangerous release of radioactivity through collision is considered negligible. In particular, because large ships proceed at relatively low speeds in harbors, no collision of sufficient severity to damage the reactor compartment can take place in a harbor.
Surrounding the reactor compartment are heavier-than-normal structural members. The inner-bottom, below the reactor space, is "egg crated" with transverse floors at every frame; and a deep vertical keel with more than the usual number of keelsons in the fore and aft direction add to this strengthening. Outboard of
the reactor compartment there are two heavy longitudinal collision bulkheads, and outboard of these bulkheads there is heavier-than normal plating continuously welded to the beams. Inboard of the collision bulkheads are collision mats made up of alternate layers on one-inch steel and three-inch redwood lumber for a total thickness of 24 inches.
In the event of a collision broadside to the reactor compartment, the ramming ship would have to penetrate 17 feet of stiffened ship structure and the reactor containment vessel, before actually reaching the reactor plant.
Other accidents, such as grounding, fire and explosion, and sinking were also considered during the design studies. Grounding is very similar to collision in its effects, except that the damage is ordinarily more localized. The heavy reactor and containment foundations in the inner-bottom offer more than adequate protection to the reactor system.
Since the SAVANNAH, as a passenger ship, is prohibited by regulation to carry dangerous and explosive cargo in quantity, the ship's fire protection and fire-fighting systems are fully adequate to prevent damage to the reactor. In case of sinking, provision has been made to allow for automatic flooding of the containment shell to prevent its collapse in deep waters. The flooding valves are designed to close upon pressure equalization
so that containment integrity will be maintained even after sinking. Salvage connections have been installed to allow containment purging or filling with concrete in case of sinking in shallow water where recovery or immobilization of the reactor plant seems advisable.
Besides the very latest in navigation and communication equipment, including radar, the ship is equipped with anti-roll stabilizers. The stabilizer, located outside the hull amidships, are operated hydraulically by a gyro system capable of sensing sea conditions and providing counter-measures for reduction of
the roll. Each fin has a lift of approximately 70 tons at 20 knots speed.
One of the most important features of the SAVANNAH is her radiation shielding. The main sources of radiation during operation of the SAVANNAH'S power plant are the reactor itself, and the primary coolant loop lines. The primary coolant which passes through the reactor core is irradiated, and itself becomes a source of radiation. Both the reactor and the coolant emit neutrons
and gamma rays. There are also radiation sources of lesser magnitude
Including process piping, hold-up tanks, pumps and demineralizers.
The objective of the irradiation shield on the SAVANNAH is twofold: First, to limit the radiation dose outside the containment to prescribed safe levels, and second, to reduce the activation of structure by reactor core neutrons. The latter consideration is necessary in order that the reactor plant be accessible for maintenance within 30 minutes after shutdown. In order to accomplish these functions, the shielding is divided into a primary shield, which surrounds the reactor itself, and a secondary shield, which surrounds the entire primary loop.
The unique features of this shielding are due primarily to the introduction of the containment vessel, the shield must be very large, very heavy and of extremely awkward shape. Previously, naval applications had investigated slab and cylindrical shields but nothing of the hemispherical shape.
This shielding design, primary and secondary, is estimated to reduce radiation exposure to passengers and crew areas to a maximum of 500 mrem per year for passengers and 5 rem per year for crew members, if each respectively remains for a full year at the point of highest radiation within their designated areas. Taking advantage of the fact that the reactor will operate at about 50 MW or 66% of full power routinely --- factors of safety
of 3-4 for passengers and of 10 for crew is predicted - i.e., passengers might receive on the order of 150-200 mrem and the crew, 500 mrem or 0.5 rem.
This constitutes the first line of resistance and consists of a 17-foot high lead-covered steel tank that surrounds the reactor vessel with an annular water space 33 inches across. The tank extends from a point well below the active core area to a point well above it. The active core height within the reactor is only 66 inches. Constructed of high strength carbon steel, the primary shield tank is covered with a layer of lead varying in thickness from 4 inches where radiation is greatest, down to 2 inches where radiation is less. When the tank is filled with water, the dose rate outside the primary shielding from core gamma sources and activated nuclei will not exceed 200 mr per hour 30 minutes after shutdown. This is sufficiently low to permit entry into the containment vessel for inspection or maintenance.
The containment vessel completely surrounds the primary (reactor) system, and serves principally to confine spread of radioactivity in the event of a rupture of the system.
The vessel is cylindrical in shape, 35 feet in diameter by 50.5 feet long, and is centrally located on the ship's bottom.
The containment vessel is sealed at all times during plant operation. Entry to the vessel will be made only after the reactor has been shut down, the vessel purged with air, and the radiation level has dropped below 200 mr per hour.
The shielding around the containment vessel is primarily a biological shield. The bottom half of the vessel rests in a cradle of steel surrounded by a 48 inch thick wall of reinforced concrete. Directly below the concrete are water tanks, which minimize streaming.
The top half of the containment vessel is covered by a 6-inch layer of lead plus a 6-inch layer of polyethylene. During normal power operation, this reduces the radiation level to less than 0.8 mr per hour at the nearest point of access by the crew.
The purpose of the radiation monitoring system is to keep a constant check on the radiation intensity at various paints within the reactor system as well as areas remote from the power plant. This system is divided into two areas for this description. They are power plant monitoring and health physics monitoring. The latter is covered under its own heading.
POWER PLANT MONITORING
By keeping track of the radiation level at various points in the reactor system, many abnormalities in operation can be quickly detected and corrected.
A leak in the heat exchangers, for example, would show up on a radiation monitor located in the blowdown line from each of the heat exchangers.
The intermediate cooling system, which includes cooling water from the primary pumps, shield water cooler, containment air cooler, and other components not directly in the primary loop, is monitored at five locations. Leakage of primary loop water into the secondary water is possible only from the pumps and letdown coolers, due to differences in pressure. Consequently, radiation monitors are located downstream from the letdown coolers and in each of the
return lines from the pump cooling coils.
The demineralizers are also monitored. When the resin bed is functioning, the flow downstream (effluent) will have negligible radioactivity. Consequently, a monitor signal at this point will indicate when to switch to a new demineralizer. The monitor in the influent (water entering the demineralizer) measures the activity level in the primary loop.
The gross fission monitor keeps track of relative fission product activity in the primary (reactor) system. The monitor consists of a cation and anion column, an amplifier, and an indicating system. This monitor is located in the primary coolant flow system.
Power plant liquid wastes are collected in tanks for disposal into specially designed barges in port.
(While the SAVANNAH is equipped to dispose of wastes at sea, this will not be done until international agreement has been reached on the radioactivity level limit for sea disposition. The liquid waste collection tanks are monitored. Gaseous wastes will normally be disposed of at sea by filtered discharge through the radio mast, which contains two detectors for monitoring purposes. They are an air particle monitor and a radio-gas monitor, and operate at all times that gas is vented to the atmosphere. If
radioactivity rises above specified tolerance limits, the gas will be diverted and diluted to below the tolerance limit before being discharged to atmosphere.
The above monitor stations are the principal ones involved in reactor system operation. The monitors operate through a system of channels, with each channel responsible for a certain range of activity. All detectors relay their readings to the main control panel in the control room, where automatic recording and visual observation instruments are located.
Portable monitoring equipment, similar to conventional health physics survey equipment, is provided for access, survey and maintenance monitoring.
REACTOR CONTROL AND SAFETY SYSTEMS
The design of the control system is such that a malfunction which leads to an abnormal withdrawal rate of the rods will not result in a fast period. Studies indicate that the minimum reactor period resulting from maximum withdrawal of the rods is not less than 30 seconds.
The control system is designed to maintain the net reactivity insertion always less than the delayed neutron fraction.
The entire reactor system is protected by the safety system. This system causes the reactor to terminate power production if
a dangerous operating condition exists. The safety system also contains interlocks which prevents certain actions which would jeopardize the reactor system.
The control and safety systems will be capable of protecting the reactor system from damage due to any credible accident except a major leak in the primary loop.
The reactor is designed to scram (shutdown) automatically from any of seven causes: (1) shorter than a safe reactor period, (2) excessive power, (3) excessive rise or fall in pressure, (4) excessive outlet pressure, (5) loss of flow, (6) loss of power
to safety circuits, and (7) loss of power to control rod drives. In addition, the reactor may also be scrammed manually.
The nuclear instrumentation system is designed to provide maximum reliability and safety, yet minimize erroneous readings or signals from the monitoring channels. This is done by using two or more measuring channels in each operating range, and then interlocking the circuits so that at least two of them must give
the same signal of abnormal operating conditions before initiating a reactor scram.
Increased reliability is obtained by using "solid state" instruments or magnetic amplifier units rather than electron tubes and relays.
REACTOR SAFETY SYSTEM
This system constantly monitors signals from the nuclear and non-nuclear instrumentation, and when necessary takes corrective action. Corrective action will be either in the form
of "fast insertion" of the control rods, or in the form of reactor "scram". Fast insertion takes place at a rate of 15 inches per minute, while a scram is achieved in 1.6 seconds.
Fast insertion consists of moving all control rods to the full down position at the fastest rate possible through the electromechanical drives. For reactor scram, all rods are driven to full down position under the force of a net hydraulic pressure of 1,250 psi.
SHORTER THAN A SAFE PERIOD
The reactor period is a measure of the rate of reactor power increase; the shorter the period the faster the rise. Ten neutron-measuring channels, covering the full range from source level
to 150 percent of maximum power, measure neutron intensity (flux level) and its rate of change. This data is continuously transmitted to the reactor operator and the automatic control and safety system. Too fast a rate of change, or shorter than a safe period, will automatically scram the reactor.
The amount of power produced is a function of the neutron flux and its resultant heat generation in the primary loop.
The temperature selected to produce automatic scram is 540 degrees F. This temperature scram circuit provides an independent backup to the neutron flux scram.
EXCESSIVE RISE OR FALL IN PRESSURE
Too low a pressure could result in boiling of the primary coolant, while too high a pressure could result in poor heat transfer as well as placing unnecessary stresses on the reactor's fuel element core structure. There are a number of causes for either condition, all of which would relay a scram signal to the operator and to the automatic safety system.
EXCESSIVE OUTLET PRESSURE
In addition to protection against rapid rate of change in pressure, a scram circuit is provided to prevent any steady excessive outlet pressure that could result in damage to the core and related equipment.
LOSS OF FLOW
This condition would result from a mechanical failure in the primary loop pumps, piping, etc., or by accidentally stopping the pumps when the reactor is at power, or by loss of power to the pumps. When a single pump fails to operate for any reason, an alarm is sounded to warn the operator. If all four pumps should fail to operate for any reason, a signal is sent to the reactor safety system to scram the reactor.
LOSS OF POWER TO SAFETY CIRCUITS
The hydraulic drives that operate the scram mechanism require reserve pressure to keep them in the ready for scram condition
and are an integral part of the safety circuitry. A power failure in the safety circuits would automatically put the hydraulic drives into operation to scram the reactor.
LOSS OF POWER TO CONTROL ROD DRIVES
Each of the 21 control rods has its own drive mounted vertically on the upper reactor head. Of these, 9 are servo controlled and 12 are of the open loop, or non-servo type. The 9 servo rods have variable speed drives and operate in two groups in a synchronous manner, according to demand signals from the reactor system. The 12 rod group can be operated manually or in
groups according to predetermined conditions. All of these operate at a speed determined by their gearing
The safety considerations are as follows:
1. Each servo loop contains a monitor that will sound an alarm and initiate a fast insertion if the rod fails follow its command signal.
2.Another circuit monitors all nine servo monitors,
and should any of the servo monitors malfunction, an alarm will sound and appropriate corrective action will be taken through the automatic safety system.
3. Scram action starts in the safety system and is independent of operator control, Once started, a scram action cannot be stopped.
4. For conditions that do not warrant scram action, a fast insertion serves to reduce power and permit the operator to correct the condition without a complete shutdown. A manual fast insertion can be done by the operator.
The electrical circuits controlling the reactor control rods are monitored, and an electrical failure in one or more circuits will result in a fast insertion or scram action. Should electrical power to the control rod drives fail completely, the hydraulic drives will be actuated.
WASTE STORAGE AND HANDLING
The purpose of this system is to drain and collect, until safe for removal, all drainage from the reactor system that might be radioactive. Drainage may result from a failure, or be part of the normal drainage accumulation during initial fill and testing, normal startup, operation and shutdown, and
decontamination. Should any drainage collect on the floor inside the containment vessel, it can be pumped to the waste storage tanks.
The drainage and, storage system consists of two pumps, valves, piping, containment drain tank, and four waste storage tanks. The total capacity of the tanks is 1,350 cubic feet.
This is approximately 80 percent more than the maximum operational leakage and drainage for a 100 day period. Provisions are made
to take samples from any of the five tanks at any time.
After sampling indicates sufficiently low level of activity, the fluid may be pumped to special dock facilities. A special 129 foot barge will service the Savannah's reactor and handle the radioactive wastes.
Most of the potentially radioactive gases are collected in the component vent manifold. Here they are monitored, diluted
by fan and discharged up the radio mast. All gases released through the radio mast are filtered to remove particulate matter. During normal operation, the manifold is vented continuously. However,
if the radiation monitor indicates activity levels too high for dilution below tolerance, the flow can be reduced.
The region between the containment vessel and the secondary shielding is ventilated with a 4,000 cfm fan which discharges near the top of the radio mast. This gas should not be radioactive but as an added precaution it is monitored to determine if radioactivity is present.
The containment vessel air is purged periodically at sea and prior to entry to remove particulate and gaseous activity.
During normal operation the only radioactive gas in the vessel is Argon-41. The only potential sources of activity in the containment
air above tolerance levels would be fission products and these are not present during normal operation. However, prior to purging, air samples will be analyzed to ascertain the activity levels.
HEALTH PHYSICS - FIXED MONITORING SYSTEM
The purpose of this system is to provide continuous radiation measurement in crew and passenger areas through constant monitoring for any abnormalities in radiation that might exist. This is accomplished through a system of 12 radiation detectors in the following locations: A-deck, outside doctor's office; B-deck, aft passageway; B-deck, port passageway; C-deck, port passageway; C-deck, aft passageway; D-deck, starboard passageway; D-deck, both fore and aft bulkheads and at tanktop level, the port, starboard, fore and aft passageways.
These twelve monitors feed their readings into two channels, with six monitors on each channel according to pre-determined sequence. A manually-operated detector permits switching to any one monitor to allow observation and study of that station for as long as desired.
The detectors are calibrated and maintained periodically by operating personnel using a standardized cobalt-60 source.
By means of a recorder on each channel, a permanent record of the 12 monitoring stations can be obtained.
Ionization chambers located at the points of entry into the containment vessel will determine when it is safe to enter the vessel. In addition, anyone entering the vessel will carry a portable monitor to determine the dose rate at the point he will be working.
In addition to the installed detectors, there is a full complement of portable equipment to make any specific investigations required. The equipment is used to check decontamination results and to monitor contaminated spaces during maintenance. Health physics personnel, equipped with portable equipment, accompany all groups working any area that might contain radioactivity.
The health physics laboratory is outfitted for all the tests required during the operation of the reactor plant.
Sampling System This system provides a means for removing liquid samples from the primary loop to determine the effectiveness of the purification system. Samples will be taken from both the inlet and outlet flow of the primary demineralizers.
Intermediate Cooling System The primary function is to
provide clean cooling water to the various reactor system components. A secondary function is to provide a water barrier around the
The system consists of two separate flow circuits: a sea water circuit and a fresh water circuit. Each of these circuits contains two pumps and two coolers, plus other necessary items. The pumps and coolers are arranged in parallel, permitting either pump to supply water to either cooler.
In the sea water circuit, entering temperature is 85 degrees F and exiting temperature is 106 degrees F. The fresh water enters its coolers at 143 degrees F and leaves at 9 degrees F.
Components outside and inside of the containment vessel are cooled by one or the other of these intermediate cooling circuits.
The primary function of the containment vessel is to surround the primary system and provide complete containment of any radioactive matter that might escape from the system. The design
pressure of the vessel was determined by postulating the instantaneous release and expansion of the entire contents of the primary system. This approach is highly conservative due to the improbability of
a large rupture in the primary system.
A study has been made concerning the penetration of the vessel wall by a piece of debris in an event of this type. An analysis
of the penetrating power of high speed components indicated that
the vessel would contain the largest missile that could be expected.
CONTAINMENT VESSEL AIR CONDITIONING
This system maintains a constant maximum ambient temperature of 140 degrees F and a maximum relative humidity of 72 percent inside the containment vessel. The system operates in conjunction with the intermediate cooling water system, using 95 degree F water.
During normal operation, the containment vessel is sealed and no outside air will enter or leave the vessel. Ambient conditions will be maintained by regulating the cooling water flow as required according to instrument readings on the control panel.
This system supplies power to the reactor system and its auxiliaries and is designed to operate with a high degree of reliability to assure reactor safety during all phases of operation and shutdown.
It includes all load control and protective devices, containment wiring, metering, interlocking and alarms associated with electrical loads for the reactor system. Power for the system normally is supplied by two turbine-generators, each rated at 1,500 kw, 0.8 pf, 450-volts, 3 phase and 60 cycles. For increased reliability, a double bus type arrangement is used. In the event of a bus fault, an automatic transfer of all vital loads to the other bus will occur. During normal operation, a circuit breaker ties the two bNSes together.
In addition, two auxiliary 750 kw diesel generator sets are on standby to provide the following (1) Power to the main bus for operating those loads needed to supply cooling for decay-heat removal after a scram or shutdown, (2) Emergency "take-home" power should the nuclear power plant become inoperative, (3) Power for reactor startup, and (4) Spare generating capacity
for normal operation should a turbine generator become inoperative.
In the event of a reactor scram, these generators will automatically start and synchronize on the main bus bar to supply and distribute power to the components used for reactor cooling.
A 300 kw emergency diesel generator is also available to supply power to the 450 volt emergency switchboard. This source will operate in case both the main turbine generators and auxiliary diesel generators do not. Loads connected to the emergency switchboard include lighting, low speed windings of the primary coolant pumps and the emergency cooling system.
A battery protected source will also provide power to those loads that require an especially dependable-power source with no interruption due to loss or switching of auxiliary power.
TAKE HOME POWER
As mentioned above in the electrical system, there are two 750 kw diesel generator sets installed in the engine room. If any emergency "take-home" power is required, either diesel-generator can be used to operate a 750 hp wound rotor motor, which is connected to the ship's propeller, through the reduction
Each diesel generator is sized to furnish adequate power for reactor decay heat removal, lighting and necessary ship service.
In August 1958, an environmental monitoring program was established within the New York Shipbuilding Corporation's shipyard at Camden, New Jersey. This survey includes air and precipitation samples, surface water and surface activity smears. Beginning
six months prior to achieving criticality in the reactor early
in 1960 the program will be expanded. During this time additional environmental monitoring equipment will be placed in operation
at representative locations within the shipyard. It is planned that this program will be extended for a period of at least two months beyond the time that the SAVANNAH leaves the Camden area.
Environmental studies of this type have also been conducted in the communities surrounding construction site and bordering the Delaware bay since 1958.
Public health, water pollution control, conservation and other agencies in the tri-state area are currently conducting various independent sampling and measuring programs unrelated to radiation monitoring; i.e., pollution surveys, etc. Collection of off-site samples for radiation monitoring is coordinated with these organizations. Analyses are performed by a central laboratory.
During initial dockside tests and operation additional
sampling will be performed to determine and identify either positive or negative effects of the SAVANNAH operation on the environment.
THE NUCLEAR SHIP SAVANNAH WAS DESIGNED
AND BUILT TO THESE REQUIREMENTS
APPLICABLE CODES OF:
1. U. S. COAST GUARD
2. AMERICAN BUREAU OF SHIPPING
3. MARITIME ADMINISTRATION
4. U.S. PUBLIC HEALTH SERVICE
5. AIEE MARINE CODE
6. U.S. ATOMIC ENERGY COMMISSION
SAFETY REVIEW BY:
1. A.E.C. ADVISORY COMMITTEE ON REACTOR SAFEGUARDS
DESIGN REVIEW BY:
1. U.S. COAST GUARD
2. MARITIME ADMINISTRATION