Phenomenology of Graphite Burning in Air Ingress Accidents of HTRs

Air ingress with graphite burning belongs to the accident scenarios in HTRs with potentially severe consequences. This paper gives an overview of basic phenomena of graphite burning like ignition conditions and moving reaction fronts. The pioneering graphite burning experiments of Don Schweitzer are successfully reevaluated. Ignition conditions are examined, and it is underlined that burning depends not only on graphite properties but also on the heat balance in the whole graphite arrangement. In graphitemoderated reactors, ignition occurs at about 650◦C for small air flow rates: this means that normal operation temperatures in HTRs always allow for ignition. Fuel behaviour in air ingress, as determined in the KORA facility, is discussed: up to about 1300◦C modern TRISO fuel is stable in air, but from 1500◦C a complete, fast destruction is observed. Exemplary calculations on massive air ingress by chimney draught performed with REACT/THERMIX are outlined. For a hot bottom reflector there is a substantial time span before fuel is attacked. Because severe air ingress in well-designed HTRs belongs to beyond design basis accidents, the knowledge is fairly good. Concerning protecting measures, a more detailed examination of thick SiC layers is proposed.


Introduction
Small HTR concepts are designed in a manner that the risk dominating accident in conventional reactors, failure of forced cooling followed by a core meltdown, can virtually be excluded as catastrophic source term contributor [1].However, there are accident scenarios with severe consequences in HTRs, not existing for conventional reactors [2]: one weak point of HTRs is the small oxidation stability of graphite, the main component in the core, at high temperatures.It leads to potentially severe accidents in case of accidental air or steam ingress into the coolant circuit.This requires special attention also because most PBRs like the recently cancelled South African PBMR concept or the Chinese HTR-PM are for cost reasons not equipped with a pressure-retaining containment.This paper concentrates on air ingress events in HTRs, whose main consequences are (i) fuel element damage by corrosion (matrix graphite and in later accident stages fuel particles) or by temperature increase due to the reaction enthalpy of the oxidation process, (ii) corrosive attack on the graphitic core support structure until its failure, (iii) formation of burnable gas mixtures (CO) by air/ graphite interaction and damages by their explosions, (iv) formation of graphite aerosols by the corrosive attack being vehicles for fission product transport.
Also, two effects of air ingress should be mentioned, which are not directly coupled to graphite oxidation respectively burning: (i) mobilization of fission products plated out on primary circuit components [3,4], (ii) mobilization of fission products enclosed in fuel particles with defective coatings by fuel oxidation (preferably important at low temperatures, when graphite oxidation is slow and oxygen reaches fuel particles easily by in-pore diffusion).
All these effects may increase the fission product release into the environment and, accordingly, are highly safety relevant.Source terms of severe air ingress accidents were not fully considered in former traditional risk studies because corresponding event analyses revealed that-within the usual scope of such system analyses-no credible failure mechanism within a well-designed plant itself exists, that leads to air ingress with graphite burning.This is because (i) massive graphite oxidation may occur only by longterm air ingress with substantial ingress rates: 1 m 3 of air (STP) may gasify 0.1-0.2kg of graphite, depending on the reaction product formed, CO 2 or CO.The total amount of graphite in a typical HTR-core is >100 metric tons; (ii) substantial air ingress rates are expected only for a chimney draught by leaks in the top and in the bottom of the pressure vessel or by a double break of the coaxial duct between core vessel and adjacent facilities (steam generator or gas turbine), which was found to have a low probability if caused by a plant internal failure.
However, at first because external impact not considered in former safety analyses (like sabotage and war, or earthquake and airplane crash heavier than assumed in safety considerations) may initiate severe air ingress, at second because damage probabilities of the primary circuit enclosure cannot be neglected any longer as consequence of strengthened safety requirement, at third because of its potentially very severe consequences, and at last because of the often claimed inherent safety of small HTRs, considerable theoretical and experimental work concerning its accident progress and its source terms have to be performed for PBRs, but also for prismatic fuel type HTRs.In detail, this work covers (i) development, application, and validation of computer codes, describing core burning phenomena [5][6][7][8], (ii) determination of chemical kinetic data of relevant chemical reactions [9,10], (iii) experimental examinations on HTR fuel behaviour during air ingress [3], (iv) large-scale experiments for simulation of thermodynamics and chemistry in a burning core (BNL-facility [11], SUPERNOVA, NACOK [12]), (v) experimental and theoretical examinations on gas exchange at a primary circuit leak [13][14][15] and on flow dynamics at accident initiation [14,[16][17][18].
Graphite burning by air occurred two times in graphitemoderated reactors, which were however of different design in comparison with modern HTRs: Windscale 1957 and Chernobyl 1986.The military Windscale reactor (Pu-, Po-, and H-3-production) contained graphitic moderator blocks (2000 metric tons), which were directly cooled by air.It was operated far below the ignition temperature of graphite.An overheating of the core led to fuel element (Mg-alloy) and graphite burning, which was enhanced at the beginning by release of Wigner-energy (stored during irradiation in cold graphite) [19].The burning was extinguished by flooding with water after about 30 h; about 740 TBq of iodine (I-131) was released into the environment, as 8 TBq of Po-210 and 22 TBq of Cs-137 [20].As a consequence of the Windscale fire, first detailed examinations on graphite burning in air were performed [11].The Chernobyl reactor also contained graphite moderator blocks, but was cooled by water in pressurized pipes.Due to the fact that a severe reactivity transient core and reactor vessel were destroyed and graphite burning started about 1 day after the explosion by the ingressed air, the activity release was 3 orders of magnitude larger for I-131 than in the Windscale reactor fire.Because of the core burning, the released radioactive inventory was transported to large heights and-as a consequence of thatdispersed over wide areas.The fire was extinguished after 6 days by boronated sand and other high melting minerals.
In both accidents, the graphite fire was a significant factor in accident progress.In the Chernobyl case, about 85% of the radioactive release into the environment occurred during the burning phase, but 15% during the initiating explosions.Long-term burning was possible in these accidents due to the absence of a gas tight containment.This paper gives a theoretical description on graphite burning; graphite burning experiments on nuclear graphite arrangements are discussed, too.An overview on the behaviour of HTR fuel elements in case of burning is also presented.A description on theory of graphite oxidation kinetics is discussed elsewhere [9].Further on, this paper gives examples of parameter calculations on air ingress events within small HTR concepts in order to find out the most sensitive parameters concerning progress of an air ingress event.Finally protecting measures are discussed.Main focus of this paper is HTRs of PBR type, but most conclusions drawn are valid for prismatic HTRs, too.

Theory of Burning
The most important chemical reactions occurring during air ingress into the HTR core with graphite burning are listed in Table 1 together with their reaction enthalpies ΔH R .Whereas the heterogeneous primary burning reactions (1a) and (1b) and the homogeneous CO burning reaction (3) are exothermic, the Boudouard reaction (2) proceeds endothermic.
It should be noted that graphite oxidation belongs to reactions with solely gaseous products, which proceed to some extent different to reactions with solid products, where the latter may hinder the oxidation process.
Concerning burning phenomena in HTR systems, there are occasionally some misunderstandings and misleading interpretations: lack of success to burn large graphite blocks even led to the opinion that high-purity nuclear graphite cannot burn [21].Thus, the whole background shall be outlined: burning of carbonaceous materials was probably the first chemical reaction, which mankind learned to handle (as wood and charcoal fires for heating and cooking), but a complete theory of burning was not developed earlier than about 1930, which is later than, for example, quantum theory.Main contributions to a theory of burning phenomena came from Russian scientists, Frank-Kamenetzkii and Semenov [22].However, it was already qualitatively recognized by Traffanel and Le Flock in 1913 that heat release by a reacting mass and heat transfer to the surroundings, are both important in determining the course of a combustion process; an exothermically reacting mixture has an ignition temperature assigned to it, and whether or not the reacting mixture will ignite cannot depend solely on what the mixture is made up of but also on the amount of heat that is exchanged to and from its surroundings.
Following Frank-Kamenetzkii, the progress of burning may be dominated by thermal effects, as is the case in burning of solids or-as often found in gases-may propagate by chain branching.We will concentrate here on thermal ignitions, because the main reactions of graphite burning presented above belong to heterogeneous solid-gas reactions.The principle features that are required for thermal ignition to be made possible can be summarised in the following points [22]: (i) exothermic reaction with a significant activation energy; (ii) only simple kinetics are required; (iii) an internal temperature rise occurs; (iv) only in adiabatic conditions is ignition an inevitability; (v) for non-adiabatic conditions ignition limits exist; (vi) ignition limits are governed by an interplay between heat release rate and heat loss rate; (vii) the ambient temperature and the size or shape of the reactant system are important.
Accordingly, the term "burning" means here "selfsustained burning," which characterizes thermohydraulic and chemical conditions, where substantial heat production occurs, which is mainly due to chemical reactions and this heat production is larger than or in equilibrium with heat removal by convection, conduction and radiation.This means that critical conditions for burning (which, following above given rules, always exist in C/O 2 systems, except for completely adiabatic arrangement) depend on many parameters as there are, for example, chemical reactivities, flow rates, gas composition, temperatures, system dimensions, or surface to volume ratio.
Having that in mind, it seems reasonable to follow the suggestion of Tetenbaum et al. [23] that the numerous definitions of ignition (ignition = initiation of burning) could perhaps be distilled into the statement that "Ignition can take place when the rate of heat production by a selfsustaining chemical reaction exceeds the rate of heat lost to the surroundings."The ignition temperature is not an intrinsic property of a substance inasmuch as it depends upon such factors as size, amount, and shape of material, nature of contamination, conditions of heating, and so forth.
In order to demonstrate the background of burning phenomena, a simplified C/O 2 system will be examined here, considering reactions (1a) and (1b) of Table 1 only.This system consists of a small piece of carbon in an air stream of constant temperature; the initial temperature of the piece of carbon is taken as variable.Figure 1 contains for this potentially burning system the heat removal and the heat formation curves depending on the graphite temperature.
Convection is assumed here to dominate heat removal, which is therefore a linear function of the temperature difference between gas and solid (except in the upper temperature range where radiation may become relevant).In-contrast, heat formation by oxidation follows an Arrhenius like temperature dependence at low temperatures, which leads to a steeply increasing heat formation curve, whereas at high temperatures mass transfer control causes an almost negligible temperature dependence of chemical heat formation.Altogether, an S-shaped heat formation curve results from that.Comparing heat removal and heat formation curves, the following conclusions have to be drawn: At point I of Figure 1, there is a metastable equilibrium of heat balance.At initial graphite temperatures higher than those of point I, ignition occurs, which means that chemical heat production heats up the carbon, which leads to an increase of chemical reaction rates and vice versa, until flattening heat production and increase of heat removal curve lead to a stable equilibrium at point II (burning).For temperatures smaller than those of point I, the opposite occurs, which means, that carbon cools down until at point III heat balance comes into its lower equilibrium by flattening of the heat production curve.At point III (T Gas ∼ T Graphite ), oxidation reactions take place only slowly and the term burning cannot be not used for these conditions.At temperatures greater than those of point II, a fast oxidation/burning takes place, which is no longer self-accelerating, but cooling down to II occurs.
At next, we examine a larger piece of graphite in an air flow (air entering the system at low temperature); the graphite piece is assumed to have a temperature gradient (increasing temperatures in direction of gas flow): in zones with temperatures smaller than those of point I of Figure 1, the system will start to cool down.In areas with higher temperatures, however, the graphite heats up due to chemical reactions and heat transfer by convection; further on, due to heat conduction (and to some extent due to heat transfer by radiation), the adjacent up-flow colder graphite areas are heated up, too, which means that point I and the reaction front move against flow, until stable conditions concerning heat production/removal are achieved.These stable conditions are characterized by large temperature gradients and narrow reaction fronts.
Figure 2 demonstrates schematically these reaction fronts; the moving reaction fronts occur very pronounced at high flow rates (forced decay heat removal flow) as is demonstrated in [5].The phenomenon of moving of reaction zones is well known from chemical reactors: the pebble bed reactor core has to be modelled for severe air ingress scenarios like a chemical fixed-bed reactor, whereas prismatic HTRs, as the reflector areas in PBRs, may be modelled as reacting tubes.Reaction zones moving against flow direction are typical for burning systems.If the whole graphite is at the beginning at temperatures below those of point I of Figure 1, some oxidation occurs, but the reaction zone is moving in direction of flow out of the system, which means that the oxidation is blown out.The term "burning" should not be used for this oxidation process.In reality, the oxidation process of graphite proceeds in a more complex manner due to the pronounced dependence of oxidation rates on burnoff [10], which may significantly influence the local heat balances.
In case of graphite-moderated nuclear reactors, the use of the term "burning" is still more complicated, because an additional time-and space-dependent heat, source, the decay heat may contribute significantly to the overall heat balance within the graphite: this is indicated in Figure 1 schematically by the dotted heat formation curve, containing the (temperature-independent) decay heat.Typical upper limits of chemical heat formation by reaction (1b) are, depending on flow conditions, in the range of 10-100 kW/m 2 carbon surface in air, whereas decay heat power in HTRs is in the range of 1-4 kW/m 2 carbon surface and values of up to 10 kW/m 2 carbon surface have only to be expected for a small fraction of fuel elements just after reactor shut down [5].Accordingly, as long as pure air is the reacting agent, the effect of decay heat may be taken locally as a second-order factor changing the actual temperature conditions of points I, II, and III of Figure 1, without however changing the behaviour of the system with respect to ignition in general (see the dotted line of Figure 1).However, one should bear in mind that chemical heat formation occurs during burning only in small parts of the core (in the reaction zone), whereas the nuclear decay heat is found in the whole active core.Approximate information about possibility of ignition respectively direction of migration of the reaction zone in an HTR can be estimated by an overall heat power balance for the whole core vessel: Heat removal is performed by convection H Conv , whose estimation requires knowledge of gas entrance and exit temperatures and gas composition, and by heat transfer from the core vessel surface to the environment (vessel cooling system or air), H Cond .Heat production occurs by chemical reactions (the CO/CO 2 relation at core exit has to be known) H Chem and by nuclear decay H Decay .If overall heat removal overcompensates heat production, the system will be finally blown out.An example for rough estimation of heat balances is presented in [5, chapter 2.2.1] for an air ingress case with forced convection by decay heat removal systems.An HTR can be blown out in this case if the content of air in the cooling gas entering the reactor core does not exceed 15-25 vol-% (depending on flow rate), as exemplary examinations for the THTR-300 indicated [5].In case of (pure) air ingress by natural convection without recirculation of the gas flow, an HTR cannot be blown out (except for cases with core temperatures lower than ignition temperatures at air ingress start), because heat production always overcompensates heat consumption.For small air ingress rates and natural convection heat removal is dominated by H Cond and heat formation by H Decay : in that case the decay heat will sustain chemical reactions and thus self-sustained burning does not occur, but substantial graphite corrosion takes nevertheless place (see also case A of Figure 13).

Experiments on Graphite Burning in Nuclear Systems
Shortly after the Windscale reactor fire, several experiments were performed on the problem of burning initiation in nuclear systems.The most complete and successful experiments were executed at BNL by Schweitzer et al. [11].Although these experiments were performed mainly in order to understand the potential burning in the graphitemoderated and air-cooled BNL reactor, they are still very valuable for the understanding of the whole graphite burning problem and for that will be discussed here.Figure 3 contains an image of Don Schweitzer's furnace, in which graphite channels (shown in Figure 3, too) are heated to a certain temperature.When a stable temperature profile was achieved, an air flow at initial temperatures between 300 and 350 • C entered the inner hole of the channel, and the temperature development within the channel was recorded.About 50 experiments were performed, under laminar and under turbulent flow conditions for 2 different kinds of nuclear graphites.
Figure 4 contains position-dependent graphite and gas temperatures for different times after air inflow start, for initial graphite temperatures of 700 and 650 • C at Re = 1300.It becomes obvious that ignition occurs only in case (a) with initial temperatures of 700 • C, and starts there at a distance of about 1 m from air inlet point, as seen by a temperature increase of the graphite channel.For case (b) (650 • C), a complete cooldown happened.A movement of the reaction front was not observed within the relatively short experimental time.The burning initiation depends here also on the length of the graphite channel; that is, ignition would not have happened for a channel length 1 m.This is demonstrated by Figure 5, which shows in a summarizing manner some BNL results for the maximum length of a channel at an initial graphite temperature of 705 • C that can still be cooled without ignition, depending on the flow rate.The coolable length substantially decreases with decreasing flow rate: a channel of about 0.2 m will start to burn at very low flow rates, but is easily cooled down under turbulent flow conditions.A more detailed explanation of this behaviour is given in the next chapter.There is some discrepancy between the coolable lengths in Figures 4(a) and 5, which cannot be resolved from the original literature, but may be due to different graphites or due to differences in parameters not given there.
The strong dependence of heating/cooling on flow rate is demonstrated by Figure 6, where the rates of temperature change of a short channel with small diameter is plotted against flow rate: a substantial increase of temperature rise rate with flow occurs at low flow rate, but at Re = 650 there is a sudden drop of temperature rise rate to cooling: at this drop, the maximum coolable length is equal to the channel length.Such phenomena are suitable for validation of graphite burning codes.
There is also some dependence of the ignition temperature on the graphite reactivity against oxygen, as was demonstrated by Schweitzer using graphite with reactivity differences of about a factor of 8.However, even this large difference changed the burning initiation temperature by a few ten degrees only.
Altogether, also Schweitzer's results underline that graphite burning is dependent not only on graphite properties, mainly the graphite reactivity, but also to a large extent on the heat balance, which depends on graphite geometry, flow rates, and so forth.For that, a critical temperature for burning initiation in graphite can only be given for a certain arrangement, but not for a graphite grade only.Ignition temperatures are always exceeded in normal operation of planned PBRs (HTR-PM, PBMR), whose maximum graphite temperatures are >850 • C.
Schweitzer never observed ignition at temperatures much below 650 • C even at low flow rates, at least within an experimental time of a few hours.Looking however on the results in detail and on the interpretations of the next chapter, this ignition temperature limit has to be restricted to a channel length of about 2-3 m, but a larger channel length will lead to a lower temperature limit.For generalization of this result, the (graphite) surface to (gas) volume ratio F/V has to be considered, too.The before-mentioned data were already used for validation of codes like GRAPHOX [6] and REACT/THERMIX.[7].In general, these codes allow the description of oxidation phenomena with adequate accuracy, as long as fluid dynamics and heat transfer conditions are sufficiently known and oxidation-induced geometrical changes remain small.A similar experiment as that of Schweitzer was performed later  on a channel of more modern H451 block reactor graphite [24], indicating that ignition occurs at 700 • C, but not at 500 • C. Unpublished experiments in the NACOK facility of FZJ for the former South African pebble bed reactor project PBMR indicated an ignition for initial graphite temperatures of 600-650 • C. Probably because of the small flow rates due to the substantial flow resistance of pebble beds, the  ignition occurs already at slightly lower temperatures than in Schweitzer's experiments.
Figure 7 shows the experimental arrangement and the progress of a burning test on HTR fuel spheres in kerosene, in order to determine the behaviour of spent fuel elements during an airplane crash accident: a pyramidal arrangement of cold fuel spheres was taken into a tub with kerosene, sufficient for 15 min of burning.The temperatures during the burning period of kerosene were measured by thermocouples in the pebbles.The heat input by kerosene burning in 15 min was not sufficient for initiation of graphite burning; the weight loss of fuel spheres remained very small.This experiment was successfully postevaluated using the code REACT/THERMIX.
Burning experiments in the former facility SUPERNOVA on burning pebble beds revealed that the oxidation occurred very inhomogeneously, as shown in Figure 8.
This effect is explained by mass transfer, which is very different around the pebble surface.SUPERNOVA experiments demonstrated that up to at least 1100 • C the standard mass transfer rules are applicable for the graphite/oxygen reaction [25].This is not the case for higher temperatures when the Boudouard reaction becomes relevant [13].

Estimations on Ignition Conditions in Schweitzer's Experiments
For a graphite arrangement, being in thermal equilibrium with its environment at air ingress start and being also in other items similar to that of Schweitzer's experiments, coarse balances for determination of ignition conditions are relatively simple and are performed here for demonstration reasons; more sophisticated ignition calculations were also performed with air ingress computer codes as GRAPHOX for prismatic fuel [7,9] and REACT/THERMIX mainly for pebble beds [8].
Heat removal happens in this system in the initial stage of air inflow, that is, as long as graphite temperatures have not changed, mainly by convection.Assuming CO 2 formation only, which is reasonable for temperatures <800 • C, in-and outlet molar flows remain the same.Further on, as, for example, demonstrated in Figure 4, the gas exit temperature is for large arrangements or low flow rates identical to the graphite temperature, which is taken into account here.Also, it is assumed that the specific heat of the gas at entrance and at exit is the same (c p = 30 [J/(mol•K)]): with this simplifications, the heat removal term becomes Using the standard reaction enthalpy of reaction (1b) of Table 1, the chemical heat production is with x e = mol fraction of oxygen at channel exit.
Comparing ( 2) and ( 3), for ignition conditions (chemical heat production greater than convective heat removal) holds With x 0 of air (0.21) and considering a gas temperature increase ΔT of 400 K, as is typical for Schweitzer's experiments, ( 4) indicates that at least about 15% of the oxygen Science and Technology of Nuclear Installations content has to be converted to CO 2 for burning initiation.This value can be used in the subsequent equation ( 5) for a rough estimation of an ignition temperature, as it will be done in the next step.
For the chemical heat production, a first-order chemical reaction is assumed for simplification; this means that the oxidation rate is proportional to the oxygen partial pressure.For matrix graphite, some deviations from reaction order of 1 were found, but for German standard nuclear graphites an order of 1 was measured [10].Provided the flow rate is constant, the oxygen consumption along the flow length in the graphite arrangement is then given by with: x l = mol fraction of oxygen at position l, F/V = ratio of graphite surface to gas volume We assume here conditions as in a typical channel of Schweitzer of 2.5 cm in diameter and 2 m in length with an air velocity of 0.05 m/s (laminar flow) and take surfacerelated graphite oxidation rates r F as measured for German nuclear graphites at low burn-off into account [10]: with The requested rate constant is calculated via k F = r F /c O2 .It has to be noted that k F for the in-pore-diffusion-controlled oxidation regime as occurring here shows a smaller temperature dependence than the chemical reactivity represented by the volume-related rate constant of the chemical-controlled graphite oxidation regime at low temperatures [9,10].With these parameters, an ignition temperature of 913 K = 640 • C results from (5), which is in good agreement with Schweitzer's experimental data and the later NACOK one.An increase of the flow rate by a factor of 2 (or, which is equivalent, an increase of the channel diameter by the same factor or a decrease of the channel length by a factor of 2) leads to an ignition temperature of 951 K = 678 • C. A reduction of the flow rate by a factor of 2 decreases the ignition temperature to 878 K = 605 • C.
Interestingly, the F/V ratio of typical HTR pebble beds (pebble diameter 0.06 m, porosity 39%) is equivalent to that of a channel diameter of about 2.5 cm: thus, the example above is also valid for pebble beds.
Oxidation rates increase with burn-off [9], which may lead to slight decrease of the ignition temperature during the oxidation progress.This, among other simplifications, underlines the approximate character of these estimations.
Nevertheless, in spite of this approximate character, it seems to be validated that ignition conditions can easily be calculated with sufficient accuracy, provided the heat removal conditions and the oxidation rates of the graphite are known.On the other hand, the progress of burning, covering phenomena like moving burning zones combined with pronounced local temperature increase, can only be calculated by sophisticated codes.Postcalculations of respective burning experiments by such codes are often not really satisfying, particularly, because the heat flux out of the furnace in radial direction, adjacent to the burning zone, is not known for these experiments with a sufficient accuracy and has to be treated as a parameter.If respective experimental burning facilities are required in future, their design should take into account this problem.

Fuel Behaviour during Air Ingress
The behaviour of HTR fuel elements in air was studied experimentally and theoretically: for former BISO fuel, it is well known that fuel particles are destroyed already at temperatures of 800 • C during burning in air and that all volatile fission products including cesium are released.Modern TRISO fuel has a better resistance against air due to the formation of a protecting SiO 2 layer on the surface of the SiC coating of the fuel particles.However, the diffusion coefficient of O 2 in glass like viscous SiO 2 becomes significant at 1200-1300 • C, and in addition at low O 2 pressures and temperatures >1500 • C destruction of SiO 2 by formation of volatile SiO may occur.For that, the fuel element stability is in air much smaller than in He, where coated particle failures remained limited for short-term heat-up of medium burnup fuel up to about 1600 • C.
In order to examine the HTR fuel behaviour in oxidizing gases up to temperatures of 1650 • C the facility KORA was operated in FZJ until 1996.A schema of KORA is shown in Figure 9. Figure 10 contains all results obtained in KORA for air ingress conditions (1300 to 1600 • C).Measurements were done on spent fuel spheres from the AVR reactor and on batches containing 10 coated particles each, disintegrated from AVR fuel elements.The burn-up was 5-10% FIMA.It becomes obvious that remarkable fuel damage starts at about 1400 • C; at 1600 • C, particles are destroyed immediately in air.The graphite, surrounding the coated particles in a fuel element, protects the fuel particles to some extent from attack by air, until it is gasified.Based on KORA results [3], Figure 11 compares fuel damage in air and in He, depending on temperature.Stability limits in air are about 400-600 K lower than in He: a fast complete failure of coated particles as observed in air at 1600 • C is expected in He at ≥2200 • C. The burn-up dependence of particle failures in air attack is not sufficiently known.
Other results obtained with KORA cover the enhanced release of volatile fission products from defective coated particles in steam at 800 • C [3].Similar examinations in air, which are relevant for air ingress accidents at fuel temperatures <600 • C (penetration of air deep into the fuel elements), are not yet available.
Fuel elements in air ingress accidents show a carbon/ oxygen reaction zone at 800-900 • C; the Boudouard reaction is calculated to temperatures about 300 K higher, as seen in Figure 13.At these temperatures, the SiC coating of the fuel particles, if intact, is expected to protect particle from oxidation.This means that coated particles will fall down after gasification of the surrounding graphite; by accumulation of particles, temperatures of >1300 • C may be reached due to the high decay power density [26], which may induce coating destruction in case of sufficient air supply.Experience on HTR fuel reprocessing hints to a smaller mechanical stability of irradiated SiC layers compared to unirradiated ones [27].Thus, stress-induced damage of bare particles in air ingress may occur, too.

Examples on Accident Estimations for Massive Air Ingress
A short overview of air ingress calculations performed for small-sized HTR in case of chimney draught is presented, assuming that the overall reactor geometry stays intact, but the reactor building does not limit the air ingress rate.This is particularly relevant for current HTR concepts not equipped with a forced emergency cooling system.Unlimited air access represents a worst-case scenario.Analyses on former concepts for forced convection combined with air ingress via a leak in the primary enclosure are documented in [5].The code REACT/THERMIX [8] is used here, which is based on a 2D finite difference solver for fluid flow.More modern CFD methods were found to have excessive computational times when coupled with chemical modules and were thus not yet applicable.The chemical module REACT is sufficiently sophisticated and covers all relevant reactions in air and steam ingress accidents.REACT/THERMIX was widely used, for example, for the emergency planning of THTR-300 and AVR, for the HTR-Modul200 [10] and for the ANTARES reactor with prismatic fuel elements [28].There are some indications that current graphite oxidation models are not generally conservative and have to be improved [9,29].
Here, results for severe, beyond design basis air ingress accidents by chimney draught (one leak on top, another on bottom of the vessel) into the HTR-Modul-200 (200 MWth PBR concept, coolant exit temperature 700 • C, see schema in Figure 13(a)) and into the AVR (46 MWth PBR, coolant exit temperature up to 950 • C, scheme see Figure 12(a)) will be compared: because the flow direction in normal operation is opposite for both reactors and for that temperature profiles are different, which significantly influences the progress of air ingress accidents.In any case, it is assumed that the fast depressurization, which proceeds before schema in the air ingress, does not change the core geometry.
Calculations for the AVR reactor were performed in preparation of a emergency planning, assuming, that-as consequence of an airplane crash on the AVR-a chimney draught of air occurs (Figure 12(a)); mass flows was taken as parameter within 0.1-1.0kg/s.Calculations based on experiments indicate that friction in pebble beds limits the air flow rate in AVR to ≤1.0 kg/s.Smaller air flow rates occur in case of leak diameters much smaller than the diameter of the core.Figure 12 contains the calculation results for air flow of 0.1-0.5 kg/s, which correspond to more probable leak diameters.AVR is in normal operation at accident start, a maximum fuel element temperature of 1000 • C was assumed.This was too low by far, as new results indicated [22]; the accident behaviour in general is however not expected to be influenced by that.Because the bottom reflector is at cold gas temperature (300 • C), the air can enter the active core and is completely consumed there (Figure 12(d) indicates that virtually no oxidation takes place outside of the pebble bed).Here, the reaction front moves against flow, until it stabilizes after 3-4 h, which leads to a sharp increase of maximum temperatures (Figure 12(b)) and of maximum oxidation degree of fuel elements (Figure 12(c)).First particles are attacked by air after about 4 h for a flow rate of 0.5 kg/s.For this case, about 1% of the total content of fuel element graphite is gasified per hour.For an air flow of 1 kg/s the maximum temperatures calculated exceed even 2100 • C after about 4 h.
The accident behaviour of the HTR module is different, because its bottom reflector is at hot gas temperature (>650 • C) in normal operation and because the flow resistance of the undisturbed 9 m high pebble bed does not allow air inflow >0.6 kg/s, as chimney draught calculations based on experiments indicate.Figure 13 contains besides a reactor schema results on temperatures and on burn-off for air flow between 0.02 and 0.6 kg/s, 20 h after accident start.The air is consumed in the hot bottom reflector, as temperature peaks in Figure 13(b) and burn-off peaks in Figure 13(c) indicate; for a mass flow of 0.02 kg/s the chemical heat production is not sufficient for retaining the reaction front in the bottom reflector, so it moves into the pebble bed.However, also for the higher air flow rates, there is some fuel element oxidation by the Boudouard reaction, which proceeds endothermic, and accordingly, cools the active core (see Figure 13(b)).Having in mind that a burn-off of 2500 mol/m 2 corresponds to a weight loss of 50% of the bottom reflector, its mechanical strength is strongly decreased by oxidation for flow rates ≥0.3 kg/s after some 10 h.Thus, its failure has to be expected.There is no knowledge about the influence of the geometrical change resulting from a bottom reflector collapse onto the accident progress, for example, on air flow rates through the active core.Massive fuel element oxidation is not expected within 20 h, although, for the air flow of 0.6 kg/s, some particles will be attacked in the bottom layer of the pebble bed.
Altogether, due to the predominant air consumption in the bottom reflector, fuel damage may occur far later than in the AVR case discussed before; however, if the accident initiation occurs during reactor shutdown or startup, a similar behaviour as in the AVR case is calculated.
The results presented here are qualitatively in line with those of Kroeger [30], who performed air ingress calculations for an HTR with prismatic fuel elements assuming air ingress rates dropping within 2 days from 0.2 to 0.06 kg/s.

Protective and Mitigating Measures
Since several decades, SiC coatings have been discussed for protection of fuel elements from air attack.A dense, virtually crack-free layer, for example, of SiC has to be developed, which seems to be easier for block than for pebble fuel because of the deviating thermal expansion coefficients of pebble matrix graphite and because of the strong mechanical forces in pebble beds.Past experience on thin SiC coatings on pebbles does not look promising, but recent work on thick SiC layers may become more successful [31].In any case.very substantial development work is still required.Because the protecting behaviour of SiC is due to the glasslike (nonporous) status of SiO 2 , other potentially protecting layers like ZrC are not suitable for HTRs: ZrO 2 formed  in case of air attack has a much higher melting point than SiO 2 but does not form a dense, oxygen impenetrable layer at HTR accident temperatures.Fuel elements having an intact outer protecting SiC layer will start to oxidize at temperatures ≥1300 • C.This means that protecting layers will-also depending on the layer thickness-at least prolong the grace time to be used for countermeasures; however, as long as temperatures with significant SiC damage rates are reached by core heat-up (1600 • C for typical small HTRs without forced emergency cooling), fuel damage by continuing air ingress cannot yet be excluded.For PBR systems with forced emergency cooling as discussed by Knoche and Esch [32], where temperatures >1200 • C are not reached, thick protecting layers may be advantageous without this restriction.
Another proposed passive safety system consists of a helium-filled tank inside of the pressure vessel connected via a small hole to the primary circuit.In case of a leak in the primary circuit, the slowly escaping helium from inner tank protects from immediate air ingress, except for strong natural convection flow [33].A diving bell principle [14,18,19] as protection from air ingress was found not to be sufficiently efficient for all accident conditions.
Active measures under discussion are injection of inert gases, foam, or sand.Because of the potential strong contamination of the surrounding as consequence of a primary circuit depressurization [34], active measures may not be easy to perform.Besides, the assumption of the structural integrity of the system after a fast depressurization taken in most countermeasure planning studies is questionable.

Concluding Remarks
Most relevant phenomena of massive air ingress with graphite burning in HTRs are comparatively well understood: concerning burning, it is important to bear in mind that not only the graphite specific properties, but also the overall heat balance of the system determine the burning processes.
Compared to fuel coke, nuclear graphite shows a substantially smaller oxidation rate in air.However, because of the exponential dependence of the oxidation rate on temperature this means that ignition will happen in nuclear graphite at higher temperatures than in coke, but not that nuclear graphite cannot burn.Because HTR fuel elements require large surfaces for cooling, the geometrical conditions are also suitable for burning.
Provided data as chemical kinetics are available, a sufficient modeling of HTR burning processes is possible for the initial accident stage.This holds, until first coated particles are set free and oxidation-induced changes of graphitic components take place, with possible consequences as bottom reflector breakdown and so forth; this initial stage lasts some hours up to some ten hours.The fate of set free particles and their oxidation-induced activity release cannot be accurately modeled, but conservatively their failure has to be assumed; this is because coated particle accumulation, followed by a temperature rise to their failure temperature, cannot be excluded.Altogether, the absence of reliable models for later air ingress accident forces here a conservative treatment.The same holds for the unstable flow and gas exchange conditions in case of a double-ended break of a coaxial duct.Taking into account that massive air ingress is beyond the standard design range and, accordingly, requirements on accuracy in safety assessments are smaller than for design basis accidents, the knowledge is nevertheless satisfying.This is not true for the development of protecting measures as the promising thick SiC layers on graphite surfaces.

Figure 1 :
Figure 1: Heat balances in an exemplary graphite burning system.

Figure 2 :
Figure 2: Schematics of a moving reaction front in course of graphite burning.

FurnaceFigure 3 :
Figure 3: BNL furnace for burning experiments on graphite channels and channel segments used.

Figure 7 :
Figure 7: (a) Fuel element arrangement for a kerosene burning experiment.(b) Kerosene burning around the fuel element arrangement of (a).
with ΔT = gas temperature difference entrance exit [K], v = total molar flow rate [mol/s], c p = molar specific heat of the gas [J/(mol K)].
[1/m], k F = surface related oxidation rate constant [m/s], w = gas flow rate in free volume [m/s].

TFigure 9 :Figure 10 :
Figure 9: Schema of KORA facility for examination of HTR fuel in oxidizing gases.

Figure 11 :
Figure 11: Comparison of SiC layer stability (failure fraction) in air and in an inert gas.The data range takes into account fuel burn-up and oxidation/heating time.

Figure 12 :Figure 13 :
Figure 12: (a) Schema of AVR with flow pattern in air ingress.(b) Calculated maximum temperatures in AVR air ingress at different air flow.(c) Calculated maximum oxidation degree (burn-off) of fuel elements in AVR air ingress for different air flow.(d) Calculated total and pebble bed burn-off in AVR air ingress for different air flow.

Table 1 :
Chemical reactions relevant in graphite burning.