Month

For two generations Argonne National Laboratory has obsessively pursued the development of the liquid sodium breeder reactor. Although Argonne claims they have solved all safety issues related to the liquid sodium breeder, in fact significant safety issues remain, and indeed lists of remaining research tasks related to the liquid sodium breeder reactors indicate a lack of assurance about safety claims being made about the LMFBR. In addition to safety concerns, there are cost questions. Sodium cooled reactor carry a significant cost penalty over conventional LWRs.

Both Eugene Wigner and Enrico Fermi were brilliant scientists. Both made enormous contributions to the theoretical and practical development of atomic energy. Their educational background was different, and for this reason their thinking about long-range reactor design diverged. Fermi was a classic physicist. Fermi thought of reactors first in terms of physics experiments. The CP-1–the ancestor of almost all solid fuel reactors–was first of all a physics experiment. Physicists depend on other people to deliver to them the materials they need to conduct their experiments. Once the materials are present, they are assembled, and the physicist then runs his experiment. Byproducts from the experiment may be carted off or turned over to other people for reprocessing. The experiment is never designed with easy disposition of byproducts in mind.
Eugene Wigner was trained as a chemical engineer. The orientation of chemical engineers is quite different from that of theoretical physicists. First theoretical physicists usually think in terms of very large scale entities and events, or in terms of very small scale entities or events. Chemical engineers think of intermediate, human scale objects and events. The difference in scale and purpose of the events is makes a major difference in the professional outlook of chemical engineers. Chemical engineers expect to work for profit-making enterprises. For that reason the cost of inputs must be minimized, and the sale of outputs maximized. The chemical engineer thinks of waste as a potential new profit sources rather than something to be disposed of. It was, after all an engineer, Herbert Hoover, who introduced the United States to its first war on waste. The word “Hooverizing” signifies a parsimonious use of resources in order to cut down on waste. Wigner, who had worked as a a chemical engineer at his father’s Tannery, would undoubtedly understood the “Hooverizing” impulse.

Another important aspect of chemical engineering is process and flow. Chemical engineers seek to produce materials and objects through the transformation of materials through complex chemical processes that involve the flow of chemicals in liquid or gaseous form.

Wigner was a great deal more that a chemical engineer. He made notable contributions to both chemistry and physics. Wigner was probably the greatest of all reactor designers. And eventually the chemical engineer came to the fore in Wigner. The fluid core reactor actually predates Fermi’s CP-1. Fermi was interested enough in the early Cavendish reactor experiment to develop a fluid core reactor at Los Alamos during World War II. For Fermi the experiment was a dead end, but Wigner realized that the fluid core reactor concept had promise.

The great flaw of the Fermi reactor was that it used fuel that required expensive and technically difficult chemical processes. Indeed the fuel required chemical and mechanical processing both before it entered the reactor and after it left the reactor if the fuel was to be reprocessed. The Fermi solid core reactor concept is at the heart of the so-called problem of nuclear waste.

Wigner, the trained chemical engineer, saw the potential of Fermi’s fluid core reactor and along with associates Alvin Weinberg, Gale Young and Harold Urey developed the concept of a fluid core reactor with a thorium blanket, that could produce electricity at a price that was competitive with the price of coal. The development of the molten salt reactor concept represented a major advance over Wigner’s initial heavy-water fluid reactor, but it did not significant departure from the concept.

Fermi was also interested in nuclear breeding, but, unlike Wigner, Fermi saw the problem as a pure physicist, not as a chemical engineer. Fermi had the poor judgement to pick liquid sodium as his cooling fluid and the uranium breeding cycle. Fermi’s rationale was that liquid sodium was a poor moderator, thus a sodium-cooled reactor would be a reactor would produce fast neutrons. Plutonium functions best as a nuclear fuel in a fast neutron environment. The down side to a fast neutron reactor is that it takes a lot of fissionable materials to get a chain reaction going inside one of them. A more significant disadvantage was the difficulty of working with sodium. Fermi’s Lab, Argonne National Laboratory managed to solve, or at least believes that it solved, the sodium problem, but others were unimpressed with the Argonne solution, and billion of dollars of have been wasted on unsuccessful sodium cooled reactor projects.

Fermi chose the sodium cooled fast breeder approach as a physicist, primarily because of its neutron economy. The downside of the LMFBR is that it uses solid fuel that must be processed at a separate and very expensive chemical reprocessing plant, in an expensive and messy chemical process. The power produced by the LMFBR would never compete in price with the price of coal. No doubt the chemical engineers at Argonne do what they are told by the physicists, and don’t talk back.

It is an utter illusion to think that the LMFBR could ever produce electricity at as low a price as the LFTR could. Nor will the LMFBR ever be as safe. There is no more reason to assume core breach in a LFTR as in a LMFBR, yet I have demonstrated that a number of safety features could prevent a core breach of a LFTR from ever turning into a disaster. Not so with the LMFBR. If there is ever a LMFBR core breech, there would be hell to pay. The notion that Sodium cooled reactors like the Integral Fast Reactor are inherently safe are illusions as long as they use a fluid sodium coolant.

Liquid metal fast breeders will never hope to compete on construction or electrical production cost with LFTRs , as Eugene Wigner and Alvin Weinberg understood. And Liquid Fluoride salts would never, never, never catch fire.

Many years ago, Alvin Weinberg pointed out the issue of LMFBR safety:

We have no real estimates of accident probabilities for liquid metal fast breeder reactors (LMFBR’s). The Rasmussen estimate (one in 20,000 per reactor year with an uncertainty of five either way) 6 would lead to a meltdown every 3 years. This is probably an unacceptable rate; an accident rate at least ten times lower, and possibly 100 times lower may be needed if the system is to be acceptable.

Weinberg pointed to another, very significant problem with the LMFBR, the issue of nuclear waste:

Each 5,000 MW LMFBR produces about 75 cubic feet of high-level solidified waste per year, contained in about 50 steel cans. According to present plans, these would occupy about 1.5 acres of burial space. Thus the entire syst
em of 7,000 reactors would require about 15 square miles of burial space per year. After 1,000 years, 15,000 square miles level wastes will have decayed sufficiently to allow fresh wastes to be will have been used up; by that time, the radioactivity in the high layered over the older wastes. Thus the 15,000 square miles devoted to high-level wastes might be usable for much longer than 1,000 years.
To summarize, although we cannot identify physical limits that make a world of 7,000 large LMFBR’s impossible, one would have to concede that the demands on the technology would be formidable. Two issues appear to me to predominate: first, the acceptable accident rate will probably have to be much lower than the Rasmussen report suggests. If one uncontained core meltdown per 100 years is acceptable (and we have no way of knowing what an acceptable rate really is), then the probability of such an accident will have to be reduced to about one in 1 million per reactor per year. This is the design goal for the LMFBR project in the United States. Second, a nuclear world such as we envisage will have long since had to make peace with plutonium. Ten tons of plutonium per day is mind-boggling. It is hard to conceive of the enterprise being conducted except in well-defined, permanent sites, and under the supervision of a special cadre -perhaps a kind of nuclear United Nations.

I for one do not morn the passing of the Integral Fast Reactor. Sodium cooled reactors are bad ideas as Weinberg subtly suggested. It would be most unfortunate if a single cent more is wasted on Fermi’s folly. Let’s nail the coffin of the sodium-cooled fast breeder shut once and for all.

A Primer on Nuclear Safety:
2.6 Defense in Depth
Molten Salt Reactors, Moir-Teller Defenses

Introduction
The term Molten Salt Reactor is generic. All reactors that use liquid salts as both coolant and fuel carrier are Molten Salt Reactors. Reactors that use Liquid Fluoride salts, and operate on a thorium rather than a uranium fuel cycle are Liquid Fluoride Thorium Reactors. Most discussions about Molten Salt Reactor safety are primarily directed to LFTR safety, but many of the safety features of the the LFTR will also be present in other MSRs.

Many of the safety features of the LWR are not required for the MSR. For example the massive steel pressure vessel can be dispensed with since MSRs operate under atmospheric pressure. There is always a risk of steam explosion with the LWR but of course no risk with the MSR. If the pressure vessel is removed from our reactor design, we lose one of the physical barriers present in the LWR defense-in-depth system. A way should be found to compensate for that loss.

The rigid, hidebound, intellectually stunted, stubbornly prejudiced, and inflexible bureaucracy of the NRC simply sees the absence of pressure vessels as a safety issue. The NRC leadership is too narrow-minded to look at the the possibility that the MSR and the PBR require a different intellectual approach to reactor safety.

A second feature of MSRs, one that it does not share with the PBR is the potential to remove radioactive isotopes from the carrier salts. These would include fission products, transuranium isotopes, and tritium that is produced by neutron radiation of lithium in the carrier salt. This opens a route to an alternative containment system, one which removes, processes, separates and concentrates and then diverts to useful purposes. This approach, incidentally, eliminates the problem of nuclear waste, represents both a safety feature, and a potential means of producing valuable byproducts during the nuclear process.

Thus the ability to process fuel while the reactors is operating constitutes a type of defense that will not entirely preventing the release of radioactive materials during a worst case MSR accident, certainly would partially mitigate that release.

In order to understand the containment issue we have to understand what problems lead to the necessity of defenses-in-depth. In the case of light water reactors it is the vulnerability of the water-based coolant systems to disruption. We have seen from the ESBWR design that it is possible to build in powerful protections against coolant failure. For LWRs coolant failure is a hazard because it leads to core meltdown. Since the core of the MSR is already molten, from the viewpoint of the NRC the MSR violates profoundly important safety rules. We have seen that much of the LWR’s defense in depth system is devoted to to prevention of core melt down, a molten core would represent a partial failure of the reactor defense system for those who view the ESBWR type Light Water Reactor as the non plus ultra of nuclear safety.

Not only has the core of the MSR melted down by design, but it lacks the containment defense of a pressure vessel. There is no guarantee that the MSR will never leak. I for one am a pessimist about reactor leaks. Anything fluid is want to leak, and will leak sooner or later. Advocates of sodium-cooled fast breeders should always remember that. Even with continuous fuel processing the core fluid of a MSR is very hot and radioactive. Thus MSR defenses-in-depth must assume core excursions of molten reactor fuel and fission products.

Not only that, but a standard safety feature of the MSR is the ability to dump core fluids into tanks in the event of a failure of the cooling system after shutdown. These are far from the only controlled fuel core excursion with the MSR design. MSR fuel is forced out of the core as it heats, because liquid salt expands with greater heat. Core salt is channeled out of the core in order to transfer heat from the the reactor to the generating system or in order to provide shutdown or emergency core cooling. Core salts are also withdrawn from the core in order to process them. Each controlled core excursion represents a breach of containment, and therefore a a serious safety issue.

It must be obvious then that defense in depth for a MSR must operate in a quite different fashion than for a LWR or a PBR.

Reactor defenses are the most reliable if they depend on the automatic operation of laws of nature, rather than human intervention. Thus if a reactor defenses depend on an ironclad natural law than cannot be violated, there is no need for redundancy or further defenses. We do not tie iron bars down to keep them from floating away. Defense-in-depth is necessitated with undesirable events that are unlikely but not impossible. Defense-in-depth thus is about defense against the unlikely. The purpose of defense-in-depth is to make the unlikely even more unlikely, if not impossible. More defense-in-depths-in-depth are not needed if undesirable consequences cease to be matters of practical concern, or when they stop being theoretically impossible.

MSR Defense in Depth: The Moir-Teller View

The levels of MSR defenses in this view are:

- the negative coefficient of reactivity – increased temperature slows down and eventually stops the nuclear reaction

- the low fuel burn up margin and fast burnup rate – failure to add new fuel slows and then stops the chain reaction process

- the continuous removal of radioactive gases

- The addition primary core containment structure, piping, drain tanks and other fuel holding and processing structures

- the reactor system chamber

- An outer containment vessel

- An underground location requiring escaping radioactive materials to counteract the forces of gravity before any above surface excursion.

Other potential barriers exist. In two-fluid MSRs, the blanket containment structure constitutes another safety barrier. Core salts breaching core containment must mix with blanket salts and then breach the blanket.

All out of core controlled excursion structures can be protected by secondary barriers. Thus pipes supplied with sleeves designed to drain any escaping salts directly into a holding tank if the primary pipe ruptures. Holding tanks can be double walled. Fuel processing equipment can be encased in an air tight structure. Thus the primary barriers can in every case be doubled.

The fluoride salt mixture also constitutes a significant barrier. Some radioactive materials are chemically bonded to the salt. Other materials, including noble gases and metals are dissolved in the salt liquid but can escape during a salt excursion. Thus the processing of fuel should always involve the removal of radioactive gases as part of the first line of MSR defenses. High priority should also be given to the removal of noble metals, whose presence inside the reactor is likely to cause problems. Thus to the extent possible, radioactive materials likely to escape from the fuel mixture during an uncontrolled out of reactor excursion, out to be removed before the excursion occurs. Thus under the best circumstances if an out of primary and secondary containment breach occurs, fuel either drains into catch tanks, or it freezes. In either case the further excursions of radioisotopes is contained. Of course, there will be a messy clean up problem with frozen fuel.

Core containment breaches with conventional reactors carries with them concerns about the release of radioactive gases. In the case of the MSR, that concern, while not disappearing, diminishes. Offsetting the decrease of radioactive gas release on occasions of uncontrolle
d core excursion is the increased likelihood of core excursions.

A Primer on Nuclear Safety:
2.5 Defense in Depth
The Pebble Bed Reactor Option

A Primer on Nuclear Safety:
2.4 Defense in Depth
A Brief Note on ESBWR Safety

How Safe is the ESBWR? Given a probabilistic approach to nuclear safety, we first note that the ESBWR designers at General Electric have estimated that a likelihood of core meltdown every 29 million years. But a core meltdown is far from a release of a large amount of radiation from the reactor into the environment. Thus we must look at the likelihood of a failure of not only the pressure vessel, but of the core catcher, a system designed to trap and contain molten material from the core and to prevent its movement outside the reactor containment system. The core catcher is a passive safety system that uses the force of gravity to move molten core materials into a series of dead- end underground passages. Finally, our large amount of radioactive material must escape the massive outer containment dome of the reactor. Let us assume that each of these containment structures works as intended. We know, for example, that the pressure vessel will contain a core meltdown, because the core of the Three Mile Island reactor was contained by its pressure vessel. Thus it is very unlikely that the pressure vessel of a ESBWR would fail if its core did melt down. Let us consider that the likelihood of that the average time to pressure vessel breach by a molten core is average time to core meltdown multiplied by a factor of 10. That would give us a figure of 290,000,000 years to pressure vessel breach.

Now the failure of the core catcher is far more unlikely than the breach of the pressure vessel because the core catcher relies on natural forces to capture and hold the molten core. Let us assume for the sake of argument that the likelihood of a core catcher failure is the average time to pressure vessel failure multiplied by a factor of 10. That would give us a period of time of about 2,900,000,000 years before core catcher failure.

Once the core catcher fails there are still the massive outer containment walls of the reactor to prevent a large scale release of radioactive materials. Again we will assume that this structure will increase the likelihood of containment by a factor of 10. This would give us a catastrophic release of radioisotopes into the environment once every 29 billion years. That figure happens to be over twice the age of the Universe, and several times the expected lifespan of the earth.

Given a probabilistic world, many natural catastrophic events are far more likely than containment failure including the eruption of the Yellowstone super-volcano and event which could kill millions of people, and which is likely to occur sometime within the next 160,000 years.

Of course if more ESBWRs are built, our probability of catastrophic containment failure will increase. With a set of 1000 ESBWRs, we end up a gain with the figure of once every 29,000,000 million years between containment failures. To put this figure into some perspective collisions between the Earth and asteroids of at least 5 km in diameter occur once every 10 million years. The impact of such an asteroid with the earth would cause enormous damage to human society. Such events are three times as likely to occur as the catastrophic failure of containment in a ESBWR in a thousand-reactor system. The worst possible consequences of reactor core containment failure would be very small compared to the consequences of a once every 10 million year asteroid impact event.

It is my contention then that the dangers posed to the population of the world by a massive 1000-reactor system of ESBWRs is insignificant when compared with far more likely natural disasters. However, as safe as the ESBWR is, it is not the ultimately safe reactor. I will turn next to an exploration of how to make reactors even safer than the ESBWR is.

A Primer on Nuclear Safety:
2.3 Defense in Depth
Light Water Reactors – Water and other safety features

The most important aspect of safety in Light Water Reactors is the cooling system. The coioling system also serves te purpose of moderating the nuclear reaction in Light water reactors. As we have noted, a loss of coolant in Light Water Reactors will stop the chain reaction, but will lead to core overheating because of the continued core heating caused by the radioactive decay of fission products. For that reason it is vital to maintain the presence of cooling water in the reactor core. There is one major variation in the LWR cooling system. Pressurized Water Reactors use secondary coolant systems. The secondary coolant system, in the PWR is responsible for stem generation. Water at high temperature and under heavy pressure leaves the reactor core and flows through pips to a steam generator. In the steam generator the water from the reactor passes through a heat exchange where is passes heat to the secondary coolant water. The primary coolant water then pumped back into the reactor, where it begins the cycle again. The secondary coolant water, once it has entered the heat exchange begins to rapidly boil. The steam is then routed to steam turbines where power is produced. Upon exiting the turbine the steam is cooled and condensed, and returned to the secondary coolant system.

The Boiling Water Reactor only has a primary coolant system. Water, under somewhat lower pressure in a BWR turns to steam in a BWR. the steam then flows to the turbines, the spent steam is cooled and condensed, and the cooled water is returned to the reactor where the cycle begins again. The coolant system of the BWR is simpler, and simplicity often enhances safety. Hence the BWR is potentially very safe, but at a price of somewhat lower efficiency.

Coolant systems usually rely on pumps to move water around, and like any other mechanical objct pumps do break down. They have to be periodically serviced, and in addition have been known to fai lin the course of reactor operations. There is a work around for pump servicing and pump failure, and that is back up coolant systems, that can be either automatically brought into operation in the event of pump failure, or when the pump of the primary coolant system is being serviced. One of the major contributing factors to the Three Mile Island Accident was the failure of the secondary coolant system, due to the tripping of a water pump. The backup pumps had been accidentally locked off line, so the essentially the primary coolant system lost its ability to dump heat from the reactor core. The reactor shut down, and other systems to maintain core safety automatically came into play. At that point the accident would have been over, had not an operator not shut down the emergency coolant system.

Thus the Three Mile Island accident illustrates the successful function of the defense in depth philosophy. Because even though secondary coolant system failed, and its backup was off line, and the the emergency coolant system was turned off, and the reactor core suffered partial meltdown, defense against a major release of radioactive material held. The cost of the coolant system failures was however, major damage to the reactor core.

Since the Three Mile Island accident illustrated the vulnerability of LWRs to coolant system failure, much attention has been paid both by reactor manufacturers and the Nuclear Regulatory commission of the United States to the improvement of the safety and reliability of Light Water Reactor coolant systems. One major approach for improvement has been the replacement of pumps with thermal syphons. Thermal syphoning is not exactly high tecnology. The principle was sucessfully used to circulate engine coolant in the Model T Ford! A thermal syphon takes advantage of the natural tendency of heated liquid to rise in a liquid column, while cooled fluid falls. In a closed system where the liquid is both heated – for example in the engine of a Model T Ford – and cooled – in the radiator of the Model T Ford – the coolant may achieve natural circulation without mechanical pumps. Remarkably, the same thermal syphon principle which works with antique cars, also works for the latest models of very large reactors. One notable example of this is the Evolutionary Simplified Boiling Water Reactor (ESBWR), which has is the Latest Word in Generation III + reactor safety. Because the ESBWR dispenses with cool water pumps, it also eliminates the very possibility of pump related accidents. A second feature which the ESBWR has in common with other Generation III+ reactors is the use of gravity feed emergency water systems. These systems place large tanks of emergency cooling water above the reactor core. In the event of a loss of coolant accident, water from the emergency coolant tank will automatically flood the reactor core. The ESBWR emergency coolant system does not rely on pumps. Rather gravity feeds the energency coolant water into the reactor core.

The sophisticated features of the ESBWR greatly enhances its safety compared to other Light Water Reactors. The ESBWR is calculated to be in danger of core melt down once every 29 million years. One would expect that with the extreme unlikelihood of core meltdown with the ESBWR, and the success of core containment by the reactor pressure vessel in the Three Mile Island that no provision for the containment of a molten reactor core would be made in the case of pressure vessel failure. Such is the safety of the ESBWR design that provision is made for the almost infinitely slight probability of that a molten core would escape its pressure vessel. In that case a core drainage and capture system has been been included in the ESBWR reactor design.

In a probabilistic world it is impossible to completely dismiss the possibility that a ESBWR Will ultimately fail in a catastrophic accident that will cost human lives, but the sun will also fail costing the life of everyone left on earth, and in a somewhat similar time frame. Thus the advanced safety features of the ESBWR coolant system, coupled with standard reactor defenses in depth against radiation releases, and a very advanced molten core capturing system, render concerns about ESBWR safety irrational.

A Primer on Nuclear Safety:
2.2 Defense in Depth
Controlling Nuclear Reactions in Light Water Reactors

Enrico Fermi was the first nuclear scientist to find a solution for controlling chain reactions in a nuclear reactor. Fermi said that his Chicago Pile was “a crude pile of black bricks and wooden timbers.” Of course natural uranium fuel was added. There was, Fermi realized, something else needed in order to make his reactor safe. That was a means of soaking up the neutrons created by the chain reaction in order to control it. The way Fermi chose to control the Chicago Pile was to insert a number of cadmium-coated control rods into the reactor. Inserting the rods would slow the chain reaction and eventually stop it. In fact history reports that the chain reaction in Fermi’s first pile was initiated by lifting control rods that were initially embedded in the pile.

Fermi and his associates were none too confident in the mechanical reliability of the control rods. Thus a back up system was devised for an emergency shut down of the reactor in case the control rods failed to operated properly during a shut down. A history of the Chicago Pile experiment states:

Since this demonstration was new and different from anything ever done before, complete reliance was not placed on mechanically operated control rods. Therefore, a “liquid-control squad,” composed of Harold Lichtenberger, W. Nyer, and A. C. Graves, stood on a platform above the pile. They were prepared to flood the pile with cadmium-salt solution in case of mechanical failure of the control rods.

In many respects the Fermi’s CP-1 was the evolutionary ancestor of the Light Water Reactor, and the control scheme for Light Water Reactors is basically the same as for the CP-1 although a few twists have been added. The control rods now use Hafnium rather than cadmium for neutron absorption. And rather than flooding the core with a Cadmium salt solution, boron in the form of boric acid is injected directly into the cooling water. Because the dilution of the boric acid in the cooling water can be easily altered, the use of boron is by no means limited to reactor shutdown. By altering the boric acid content of cooling water reactor operators can actually control the chain reaction, thus providing a simple but effective throttle for a chain reaction.

It is possible to completely shut down a LWR by increasing the boron content of the coolant water, or by a high concentration of boric acid in the emergency coolant water. However reactor shut downs and start ups are normally controlled by the control rods. Control rods can also be used to control chain reactions in parts of the reactor, and the play a major role in counteracting Xenon poisoning.

Xenon-135 is a noble gas that is produced in the fission process. It is highly radioactive, but in addition it has a very powerful neutron absorbing property. Because of this property, even a relatively small amount of Xenon-135 produced during a chain reaction has the capacity to slow down and even stop the chain reaction. Hence reactor controls must posses a means of balancing reactor power output as the amount of Xenon-135 in the reactor increases due to Xenon-135 production by nuclear fission.

Controlling reactor power in the face of Xenon poisoning is not simple. Xenon builds up with the fission process, and decreases as it undergoes nuclear decay. There can be a lag between the positioning of a control rod and its effect on the power level and heat generation of a reactor. Running a light water reactor at low power increases difficulties related to Xenon poisoning. Xenon may not be evenly spread through the core. Thus hot and cool spots may develop in the core since coolant flow is based on average power output, coolant flow to reactor hot spots may not be sufficient, and as fuel pellets begin to overheat, and their cladding begin to overheat, their integrity may begin to break down.

Control rods played a far more critical role in the Chernobyl accident than would be possible in a light water reactor accident. In the Chernobyl RBMK reactors the control rods were divided into three segments. The upper and lower segments were made of graphite, a nuclear moderator, while the middle segment was made of a of a material that served as a neutron poison. As the control rod is lifted coolant water fills the bottom of the control rod channel. Under normal operations the control rod is lifted to the position in which its lower graphite segment fills the channel inside the reactor core. But because a highly dangerous test was being conducted on the Chernobyl reactor, the lower graphite segments of control rods were also partially withdrawn from the reactor. Thus more water entered the reactor core through the control rods channels. As I have already observed coolant water served as a brake on the chain reaction within the Chernobyl reactor. As we observed poor management of the Chernobyl reactor during a test lead to the boiling of the coolant water inside the reactor and the voids created by the steam bubbles began to removed the break placed on the chain reaction by the presence of coolant water in the core. As the overly withdrawn control rods began to descend into the core of the Chernobyl reactor they first displaced water that had served as a brake on the chain reaction, and replace it with graphite, a moderator that greatly increased the chain reaction.

The insertion of the graphite tips of the control rods into the core of the Chernobyl RBMK was sort of like attempting to hit the brakes of car that is running out of control, and hitting the accelerator instead. The power level of the Chernobyl reactor went off the charts, and as reactor heat increased dramatically the remaining coolant water in the reactor core flashed to steam. There was a large steam explosion, which as we have seen destroyed the top of the reactor and the surrounding radiation shield.

A similar accident could not occur in a light water reactor because (a) water in the control rod channels increases rather than slows the nuclear reaction, (b) the water in the control rod channels is immediately displaced by a neutron poisoning material in the control rod, and (c) voids created by heat related bubbles in the reactor coolant work in concert with the control rods rather than against them.

Control rod insertion during an accident can be accomplished by gravity rather than mechanical means. Control rods can be attached to the lifting mechanism by electro-magnets. The termination of power output during an accident would automatically produce control rod insertion and shut down. The shutdown can also be triggered by operator control.

There are redundancies in the control rod system and of course reactor operators always have the options of shutting the reactor down by adding more boric acid to the coolant water. The loss of reactor coolant does cause a termination of the chain reaction, because the water serves as a moderator for the chain reaction in Light Water Reactors. At the same time the loss of coolant water is highly undesirable, because coolant water is required to remove the residual heat from fission product decay from the reactor core.

The control system of Light Water Reactors thus provides for operational redundancies and safety backups. Emergency shutdowns can be accomplished by passive safety features that use the law of nature to insure that a chain reaction stops as soon as
the reactor ceases to produce electrical power. Different control systems insure that operators have more than one emergency shutdown system available. Finally automatically operating passive shut down systems, insure that the reactor will automatically shut down before serious safety problems emerge, thus interrupting chains of events that could lead to serious reactor accidents.

A Primer on Nuclear Safety:
2.1.1 Defense in Depth
Light Water Reactors – Physical Barriers

The Defense in Depth philosophy is applied to the release of radioactive materials from inside the core of light water reactors. Helen Caldicott, the ceaseless critic of nuclear power notes

Nuclear power creates massive quantities of radioactive isotopes, which are classified as nuclear waste. Among these materials are strontium 90, . . cesium 137 . . . plutonium, . . . plutonium has a radioactive life of half a million years. It enters the body through the lung, where it is known to cause cancer. It mimics iron in the body. Hence it migrates to the bone, where it can induce bone cancer or leukemia, or to the liver, causing liver cancer; and it crosses the placenta into the embryo, where, like the drug thalidomide, it can cause gross birth deformities. Finally, it has a predilection for the testicles, thus inducing genetic mutations in humans and other animals that are passed from generation to generation for the rest of time. Meanwhile, the plutonium itself lives on to enter testicle after testicle, lung after lung, liver after liver for the rest of time as well. Children are 10 to 20 times more susceptible to the carcinogenic effects of radiation than are adults.

That it is possible for such radioactive materials to escape in massive amounts from some reactors is certain given the Chernobyl accident. Even though massive amounts of radioactive materials that escaped during the Chernobyl incident did not lead to the sort of human disaster Dr. Caldicott imagined large scale releases of bioactive radioactive materials from reactors is highly undesirable.

Even though the politically inspired attack on nuclear safety research was never completely rectified by the American political establishment, enough progress had been made to allow for great improvements in Light Water Reactor safety.

Physical Barriers increase Light Water Reactor safety

Defense in Depth against the release of radioisotopes required a series of physical barriers that inhibited the movement of radioisotopes from the nuclear fuel pellets into the environment. In order to illustrate the defense in depth of civilian light water reactors, a brief comparison to the Soviet RBMK reactor is in order. The failure of the safety features of one of the RBMK at Chernobyl lead to the release of large amounts of radioisotopes from the reactor core. The RBMK reactor like Western Light Water Reactors featured ceramic uranium fuel elements made of uranium dioxide baked at high heat. In Western reactors the fuel pellets are clad with Zirconium, a sturdy metal that resists the reactors heat and radiation.
The Uranium Oxide fuel is itself the first barrier in the defense in depth, and it is a one of the strongest barriers in the whole defense. Fission products are basically locked in to the rock like fuel pellet. As George Parker and my father were to observe that the release of fission products from Light Water Reactor fuel was caused by a variety of mechanisms that were all triggered by overheating. Thus the first barrier could be breached by reactor over heating.

The Zirconium cladding adds protection against fission product escape. Zirconium has a high melting temperature, although not as high as uranium oxide. Like uranium oxide, zirconium and zirconium alloys are dependent on reactor cooling to prevent to maintain integrity as a barrier to fission product escape. A further consequence of the failure of Zirconium cladding would be that it would subject uranium oxide fuel to mechanisms that promote fission product loss.

A Zirconium tube in which the fuel pellets rest in the reactor core constitute a third barrier to fission product release, however in practice if reactor core heat is sufficiently high to cause the failure of Zirconium cladding, it will also cause the failure of zirconium tubes. The outer structure of the reactor provides a further barrier to fission product release. In LWRs the pressure vessel is a major barrier to solid fission product release, although radioactive gases can work their way around the barrier in major reactor accidents. The RBMK does not have a pressure vessel, which is perhaps the most significant reason for the massive release of radioisotopes in the Chernobyl accident. The Chernobyl RBMK appears to have included an outer structure designed to maintain the RBMK core in a helium environment in order to prevent graphite burning. This containment structure failed during the Chernobyl incident, and the resulting graphite fire contributed greatly to the fission product release during the Chernobyl incident.

The next barrier to fission product release is the reactor outer radiation shield. Although this shield is seldom mentioned in discussions of defenses in depth, it does provide a barrier to the release of solid and molten fission particles whose movement is limited by the forces of gravity. Thus in the event of a core melt down which penetrated the pressure vessel, the radiation shield would offer considerable containment of the molten fission particles. Because of its massive nature, the radiation barrier would also mitigate a steam explosion powerful enough to rupture the wall of the pressure vessel. The sideways and downward pressure of the steam explosion would be baffled by the massive radiation shield while gravity would contribute to containing the movement of non-gaseous fission products within the outer containment structure. The Chernobyl reactor was surrounded by a radiation containment structure which failed because the of a powerful steam explosion. The cause of the blast was a combination of design flaws that caused a dramatic rise power levels in the reactor when an operator attempted to shut the reactor down.

The destruction of the radiation shield of the Chernobyl reactor removed the last level of containment for that reactor, while another level of containment, re
presented by the outer containment dome, would have still survived a Chernobyl like explosion. The failure of the Chernobyl radiation shield and the subsequent graphite fire lead the the massive release of radioisotopes from the burning Chernobyl reactor. Thus the critical features that lead to the radioisotope release from the Chernobyl radiation release were not present and two outer barriers to the release of solid radioactive materials, the massive 8″ thick steel pressure vessel, and the even more massive outer dome of the reactor were not features of the Chernobyl reactor design. Other unique features of the RBMK reactor design including the use of a graphite moderator, and numerous design flaws that created safety problems contributed to the accident.
Anti-nuclear critics of nuclear safety often point to the Chernobyl accident as evidence of the fundamental safety flaws of all reactors, without noting the significant differences in safety features between RBMK reactors and LWRs. In fact during the Three Mile Island accident the outer safety barriers, the pressure vessel, the radiation shield, and the containment dome all remained intact. There were no verified cases of radiation related health problems as a result of the Three Mile Island accident, and subsequent research failed to identify any increase in the number of cancer cases that could be associated with the accident. Thus the defense in depth deployed at the Three Mile Island Reactor was successful.

A Note on Radioactive Gases

The radioactive material released as a consequence of the Three Mile Accident were primarily noble gases. The noble gases and other radioactive gases are fission byproducts that are present in the uranium oxide fuel pellets. Normally they would remained trapped in the uranium oxide pellets, but if the reactor core heats enough to melt down, the zirconium cladding will rupture or melt, and the melting of the uranium oxide pellets will release the noble gases. The gases escape from the reactor core through the cooling system. The gases are quickly dispersed by the atmosphere. While nuclear critics raise the issue of radioactive gases as an issue in justifying their opposition to nuclear power, nuclear critics often display a strange inconsistency. Radon, a radioactive gas, is also released by coal burning coal fired power plants. In addition natural gas contains radon. More radioactive gas is released into the environment by the use of fossil than by nuclear power plants, yet nuclear critics rarely raise their voices in concern about radioactive gases released by the use of fossil fuels. In fact, many supposedly pro-environmental, anti-nuclear organizations, accept funds from foundations with ties to fossil fuel produces, sometimes with stipulations that the funds will be used to promote fossil fuel use. Needless to say, these organizations never raise talk about the association of radon gas with fossil fuel use.

I will in a later post discuss a methods of preventing or at least limiting the release of radioactive gases associated with the development of the LFTR.

A Primer on Nuclear Safety:
2.0 Defense in Depth

In 1964, Ralph Nader had no reason to question that nuclear power was a clean, safe, cost-efficient technology. Then he attended a conference at the Oak Ridge National Laboratory. Over lunch, Nader began asking nuclear engineers some penetrating questions. “They couldn’t answer them, or the answers weren’t satisfactory,” Nader recalls. “‘What could happen if a system goes wrong?’ I asked. They avoided any such descriptions or said, ‘we’ve got defense in depth’ — and other jargon.”

– David Bollier (Citizen Action and Other Big Ideas)

The concept of defense in depth is fundamental to nuclear safety. The defense in depth approach applies not only to reactor design but also to safety management. Defense in Depth assumes that human judgment is flawed, designs are imperfect, constructors can fail to follow plans, and that things can go wrong in numerous ways. Thus a defense in depth approach assumes that things can go wrong in with reactor, and there must be back up systems if things go wrong. But things can go wrong with the back up system, and they must also have back up plans.

Defense in depth assumes that the potential causes of nuclear accidents are in many instances controllable. One object of nuclear safety research would be the identification of potential causes of accidents, and the design systems to control those causes. The most fundamental causes of nuclear accidents are hidden in reactor design. Western reactor scientists knew immediately the cause of the Chernobyl accident. It was a fundamental design flaw in the RBMK reactor design. The existence of the problem, was what is called a large positive void coefficient, which lead to positive reactor feedback to increased heat.

What does this mean? It means that the cooling water in the RBMK reactor acts as a brake on the chain reaction. If the cooling water is removed from the reactor, the chain reaction will start to run away. Furthermore water can be removed from the reactor by heat. If the cooling water inside the reactor gets hot enough, it starts to boil. As the cooling water boils, the steam forces water outside the reactor, thus removing the nuclear break, increasing reactor heat, which in turn boils more water, etc. So the basic design of the RBMK is flawed and dangerous. Alvin Weinberg, who was an expert on reactor safety noted that when reactors that were similar to the RBMK were designed in the United States during World War II, American scientists were aware of their safety flaw.

Therefore it must be understood that nuclear safety must begin with the recognition that not all reactor designs are equally safe. Some reactor designs are much safer than others, and some reactor designs are inherently safer and perhaps can be even made inherently safe. Other reactors have potentially unsafe design features that can be worked around.

Thus reactor safety is the primary level of nuclear safety, and the defenses against accidents in a reactor may feature both redundancy and a many leveled safety defense system. The current generation of Light Water Reactors have high levels of safety built in to their designs. Nuclear safety engineers have calculated that the General Electric Evolutionary Simple Boiling Water Reactor is so safe that it would experience a core meltdown once every 29 million years. In contrast the Yellowstone Super volcano, which is capable of killing millions of people with an eruption, erupts every 600,000 to 800,000 years. It has been 640,000 years since the last eruption of the Yellowstone super volcano. The likelihood of a major reactor accident and its consequences, ought to be placed in the context of far more likely natural disasters.

Steps that can be taken to prevent reactor accidents include:

A. good design based on an up to date understanding of reactor safety,
B. An exhaustive follow through of all safety related reactor features in the procurement of manufacturing materials and replacement parts, The actual manufacture and maintenance of the reactor, and reactor operations
C. systematic faults detected in procurement, manufacture and operation, with a prompt and complete follow up.
D. Redundant or fall back systems in the event of the failure of a reactor system.
E. Automatic system response that relies on the laws of nature, rather than operator intervention.
F. Reactor siting consistent with reactor safety issues. Experimental reactors placed in remote locations.
G. Reactor staff should be both well trained and highly motivated to follow all safety guidelines.
unit placed in safe state by well-trained staff using approved procedures

The second level of nuclear safety is accident mitigation. These would include those elements of reactor design that would tend to diminish the effects of a nuclear accident on the public. Mitigation would include both internal reactor design features, and design features of the reactor facility that would tend to mitigate the effects of a major nuclear accident. Mitigation defenses can be in depth. Hence in the event of a core meltdown in a light water reactor, the reactor pressure vessel would pose a significant defense against the escape of solid fission products. The reactor containment dome would form another layer of defense against fission product release, while the isolation of the reactor would lead to the dissipation of radioactive gases, and the precipitation of solid radioactive particles escaping the reactor containment facility prior to contacts with human communities.

Accident mitigation would include, the automatic shutdown of a reactor after a partial system failure, the automatic initiation of back up cooling and/or emergency cooling in the event of a primary cooling system failure. The design of reactor monitoring panels and system alerts to give clear and concise information about what is happening without creating an overwhelming flow of information. Staff training in accident management. Well defined accident response procedures to be included in staff training. The management of initial recovery after accident related shut down, Well defined accident cleanup and recovery procedures.

A third level of defense would be the management of public consequences after a nuclear accident. These would include the notification of the NRC, as well as Federal, State and Local officials. Steps which might be taken to manage the consequences of a serious accident include evacuations, bans on the use of potentially contaminated food and/or water. Provisions for safe sheltering of at risk populations, and the distribution of KI pills, as well as other pre-planned interventions by the federal, state and local governments.

Normal accounts of nuclear safety defense in depth stop at this point. There are however other levels of nuclear safety, A fourth level would be a well informed public. Nuclear safety is a genuine matter for public concern. The public should demand the safest nuclear technology possible, and both support nuclear safety research and for monitoring of observance of safety rules and procedures by demanding that reactor operators comply with them, and that the NRC vigorously enforce them.

One of the great flaws of the anti-nuclear movement has been to dis-empower the public on nuclear safety issues. Figures like Ralph Nader failed to avail themselves of opportunities to learn more about nuclear safety. Had Ralph Nader really wanted to understand the safety concerns that Alvin Weinberg discussed with Claire Nader and with Ralph himself, had Ralph Nader tried to understand what the ORNL nuclear safety engineer was telling him about defense in depth, the history of the first nuclear era might have ended differently. Had there have b
een a public outcry for nuclear safety in the 1970′s rather than an anti-nuclear movement, the owners of the Three Mile Island reactor, would not have been allowed to get away with the safety errors they committed. Had there been a public outcry for safety research, staff safety training, and safe design of reactor control panels, there would have been no Three Mile Island accident. By convincing the public of the ill intentions of safety advocates within the nuclear community, and by convincing the public that nuclear safety was impossible, and therefore it had no stake in the development of nuclear safety improvements, the anti nuclear movement, dis-empowered the public on nuclear safety issues. It is up to the public to take its power back from the anti-nuclear movement, and assert its right to demand the highest levels of nuclear safety possible. Such a public demand would be a fourth level of nuclear safety defense.

The fifth level of of nuclear safety defense is nuclear safety research, and safe reactor design coupled with the actual replacement with reactors designed to current safety standards by reactors designed with even higher levels of safety. Nuclear safety is something that happens in time. Nuclear safety has a history. It has evolved during its history, and can be expected to continue to do so. It is perhaps unfortunate that the Light Water Reactor emerged early on as the predominant power reactor type. Light Water Reactors have inherent safety flaws. Those flaws can be largely worked around, by engineering reactor modifications, but those modifications are expensive. Too much of the history of nuclear safety has been the history of increasingly expensive safety developments for the light water reactor.

Reactor scientists have known since the 1940′s that it is possible to eliminate the very possibility of the most serious of reactor accidents, the core meltdown. Reactors designs developed over 50 years ago posses inherent safety feature that far surpass those of light water reactors. Furthermore one of those two advanced reactor designs, the Liquid Fluoride Thorium Reactor, relies on an abundant nuclear fuel, Thorium, which it uses so efficiently that it will provide sustainable nuclear power for millions of years to come. Because of its efficient use of the Thorium fuel cycle, the LFTR also virtually eliminates the long term nuclear waste. Developing and implementing the LFTR reactor designs would not be inordinately expensive, or require an extensive period of time. The development cost for either reactor design would cost less than the cost of two light water reactors, or less than the cost of the imported oil the United States consumes in one week. The manufacturing cost for the LFTR would also be lower that the current cost of building Light Water Reactors. Thus at a relatively small cost the United States could acquire a fifth level of nuclear defense, one which would make the most serious reactor accident impossible, and solve other problems related to the use of nuclear energy in the generation of electrical power.

The following legislation has been introduced in the US Senate today by Senator Orrin Hatch and Senator Harry Reid:

110TH CONGRESS
2D SESSION

To amend the Atomic Energy Act of 1954 to provide for thorium fuel cycle nuclear power generation.

IN THE SENATE OF THE UNITED STATES

introduced the following bill; which was read twice
and referred to the Committee on

A BILL
To amend the Atomic Energy Act of 1954 to provide for thorium fuel cycle nuclear power generation.

Be it enacted by the Senate and House of Representatives of the United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

This Act may be cited as the “Thorium Energy Independence and Security Act of 2008″.

SEC. 2. FINDINGS.

Congress finds that—
(1) the United States and foreign countries will require massive and increasing quantities of energy during the 20-year period beginning on the date of enactment of this Act to support economic growth;

(2) nuclear power provides energy without generating unacceptable quantities of greenhouse gasses;

(3) the generation of nuclear power in the United States and many foreign countries has been discouraged by concerns regarding—(A) the proliferation of weapons-useable material; and (B) the proper disposal of spent nuclear fuel;

(4) nuclear power plants operating on an advanced thorium fuel cycle to generate nuclear energy—(A) could potentially produce fewer weapons-useable materials than uranium-fueled plants; and (B) would produce less long-term waste as compared to other nuclear power plants;

(5)(A) thorium is more abundant than uranium; and (B) the United States possesses significant domestic quantities of thorium to ensure energy independence;

(6)(A) thorium fuel cycle technology was originally developed in the United States; and (B) cutting-edge research relating to thorium fuel cycle technology continues to be carried out by entities in the United States; and

(7) it is in the national security and foreign policy interest of the United States that foreign countries seeking to establish or expand generation and use of nuclear power should be provided—(A) access to advanced thorium fuel cycle technology; and (B) incentives to reduce the risk of nuclear proliferation.

SEC. 3. THORIUM FUEL CYCLE NUCLEAR POWER GENERATION.

Chapter 19 of title I of the Atomic Energy Act of 1954 (42 U.S.C. 2015 et seq.) is amended by inserting after section 244 the following:

“SEC. 251. THORIUM FUEL CYCLE NUCLEAR POWER GENERATION.
“(a) DEFINITIONS.—In this section:
“(1) CHAIRMAN.—The term “Chairman” means the Chairman of the Nuclear Regulatory Commission.
“(2) OFFICE.—The term “Office” means an office established under subsection (b)(1).
“(3) SECRETARY.—The term “Secretary” means the Secretary of Energy.

“(b) OFFICES FOR REGULATION OF THORIUM FUEL CYCLE NUCLEAR POWER GENERATION.—
“(1) ESTABLISHMENT.—The Secretary, in consultation with the Chairman, shall establish, and provide funds to, an office for the regulation of thorium fuel cycle nuclear power generation in each of—
“(A) the Office of Nuclear Energy, Science and Technology of the Department of Energy; and
“(B) the Nuclear Regulatory Commission.
“(2) REGULATIONS.—Not later than December 31, 2012, the Chairman, in cooperation with the
18 heads of the Offices, shall promulgate regulations for facilities and materials used in thorium fuel cycle nuclear power generation.
“(3) DEMONSTRATION PROJECTS.—The heads of the Offices, in cooperation with the head of the Idaho National Engineering Laboratory, shall carry out demonstration projects for thorium fuel cycle nuclear power generation at the Idaho National Engineering Laboratory.
“(4) INTERNATIONAL PARTNERSHIPS AND INCENTIVES.—The heads of the Offices shall provide recommendations to the Secretary with respect to methods of—
“(A) strengthening international partnerships to advance nuclear nonproliferation through the design and deployment of thorium fuel cycle nuclear power generation; and
“(B) providing incentives to nuclear reactor operators in the United States and foreign
countries to use proliferation-resistant, low waste thorium fuels in lieu of other fuels.

“(c) REPORT.—Not later than 1 year after the date of enactment of the Thorium Energy Independence and Security Act of 2008, and annually thereafter, the Secretary shall submit to Congress a report describing, with respect to the preceding calendar year—
“(1) progress made in implementing this section; and
“(2) activities carried out by the Offices pursuant to this section.

“(d) AUTHORIZATION OF APPROPRIATIONS.—There are authorized to be appropriated to the Secretary to carry out this section $250,000,000 for the period of fiscal years 2009 through 2013.’’.

For immediate release
Contact: Mark Eddington, (202) 224-5251
Heather Barney, (801)524-4380

Oct. 1, 2008

Sens. Orrin Hatch and Harry Reid Push for Thorium Nuclear Fuel Cycle

WASHINGTON – Sen. Orrin G. Hatch (R-Utah) and Harry Reid (D-Nev.) today introduced legislation that would pave the way for thorium nuclear-fuel reactors in the United States.

The Thorium Energy Independence and Security Act of 2008 would establish offices at the Nuclear Regulatory Commission and the Department of Energy to regulate domestic thorium nuclear power generation and oversee possible demonstrations of thorium nuclear fuel assemblies.

Using thorium for nuclear power has a number of potential benefits over conventional uranium. As a resource, thorium is abundant in the U.S. and throughout the world. A thorium fuel rod would remain in the reactor about three times as long as conventional nuclear fuel, cutting the volume of spent nuclear fuel by as much as two-thirds. Also, thorium nuclear fuel would significantly reduce the possibility that weapons-grade material would result from the process. Finally, a thorium fuel cycle could be used to dispose of existing plutonium stockpiles, which is the national security goal.

“Our nation has focused mostly on mixed oxide nuclear fuel cycles, and our regulatory structure reflects that,” Hatch said. “With the growing interest in thorium nuclear power in the world and in the U.S., it’s time we made sure our government has a regulatory infrastructure in place to accommodate this new generation of nuclear power.”

Speaking about the bill, Bruce Blair, president of the World Security Institute said, “This legislation reflects an enlightened grasp of the importance of supporting nuclear power while suppressing nuclear proliferation.”’

Seth Grae, president and CEO of Thorium Power said that the bill “represents a major milestone toward the recognition that the nuclear renaissance can best be achieved by encouraging new and innovative fuels designs. Senators Hatch and Reid have acted today to strengthen American technology and American business to compete in the global marketplace.”

“This bill is a giant step for the United States toward the development of a safe, secure and independent energy future,” said Jack Lifton, business development and corporate communications director of Thorium Energy.

Thorium Energy owns property in Lemhi Pass, Idaho, where it is generally believed that the largest veins of thorium-rich minerals in the world are located. Analysis of the deposits shows them to be either the highest grade or in the top tier of the highest grade known anywhere on Earth.

Here’s a link to the discussion of this topic on the Thorium-Forum…