Home Energy Physics Nuclear Power Electricity Climate Change Lighting Control Contacts Links


XYLENE POWER LTD.

FNR SAFETY

By Charles Rhodes, P.Eng., Ph.D.

INTRODUCTION:
With liquid sodium cooled FNRs we are concerned about chemical safety, fire safety, radiation safety and power safety. There must be certainty regarding protection of both workers and the public from aggressive and toxic chemicals, sodium combustion, hydrogen formation, ionizing radiation and explosive thermal power releases.

The issue of safety in advanced reactors is broadly discussed in the 2012 report titled:
Overview of Generation IV (Gen IV) Reactor Designs //Safety and Radiological Protection Considerations.

In Canada nuclear safety matters are regulated by the Canadian Nuclear Safety Commission (CNSC). The main regulatory document is the Canadian Nuclear Safety and Control Act. The FNR discussed herein is intended to fall under the regulatory category of Small Modular Reactor (SMR) with an electricity output of less than 300 MWe.

Elsewhere on this website Fast Neutron Reactors (FNRs) have been identified as the only sustainable, reliable and economic solution to meeting mankind's future energy and power requirements. This web page focuses on FNR design parameters that are necessary to achieve inherent safety. FNRs must be designed so that they can be safely assembled, operated and economically maintained at both urban sites and in small remote communities where there is limited availability of skilled personnel.

Pool type FNRs are inherently much safer than thermal neutron reactors because:
a) In a pool type FNR there is no high pressure containment of neutron activated reactor coolant;
and
b) The maximum thermal power of a FNR is limited by passive average fuel temperature control, as compared to thermal neutron reactors which rely on mechanical reactivity control systems to limit the maximum reactor thermal power.

A pool type liquid sodium cooled FNR design involves multiple measures in depth to prevent a primary liquid sodium fire. These measures are mainly concerned with exclusion of both air and water from the primary sodium under all credible circumstances, certain continuous immersion of fuel tubes in the primary liquid sodium, certainty with repect to maintenance of fuel geometry and certainty with respect to heat removal.

The FNR design discussed herein has extraordinary tolerance to minor reactivity excursions into the condition of prompt neutron criticality. This feature ensures that the FNR is safe for autonomous operation at an urban site. However, the regulations relating to this matter have yet to be developed. This safety issue involves multiple proprietary matters and is presently a work in progress.
 

FNR ENCLOSURE:
A FNR usually operates with its liquid sodium pool and cover gas in the temperature range 450 degrees C to 500 degreees C. The sodium pool has three nested steel walls, any one of which can safely isolate the liquid sodium from the environment. The three nested sodium pool walls are separated from each other by 1 m thick layers of fire brick, which provide both thermal insulation and potential liquid sodium volume displacement.

The cover gas is contained by three nested sheet steel walls, any one of which can safely isolate the contained argon and sodium vapor from the environment. The three cover gas steel walls are separated from each other by 0.5 m thick layers of fiber ceramic insulation.

The heat transport systems each rely on three nested heat exchange barriers. A failure of any one of these barriers results in a heat transport system shutdown. A practical FNR has multiple independent heat transport systems, so that the facility can continue operating while some of the heat transport systems are shut down.

In normal operation the FNR relies on the innermost sodium and argon containment walls. In the event of an innermost containment wall failure the FNR must be shut down at the next opportunity, which is usually the end of the current winter.

In the event of both an inner and a middle containment wall failure the FNR must be shut down immediately, regardless of the cost consequences to district heating customers.
 

FNR ENCLOSURE ENTRY:
In normal FNR operation there is seldom any cause for maintenance personnel to enter the FNR primary sodium pool enclosure. The FNR relies on passive physics to maintain its temperature setpoint, can be remotely monitored and can be partially or entirely shut down via safety system control, local manual control or remote manual control.

If it is necessary to replace a heat exchange bundle typically the FNR must be shut down, the sodium pool temperature must be reduced to about 120 degrees C and the Na-24 in the sodium pool, which has a half life of about 15 hours, must be allowed to decay for about one week. Then robotic equipment can be used for heat exchange bundle replacement.

If for some reason robots cannot do the job then maintenace personnel need protective cooled suits with closed circut air systems, similar to space suits, to protect them from the 120 degree C argon atmosphere and hot surfaces and to allow them to breath. The practical difficulties of doing work in such conditions, such as disconnecting and then reconnecting intermediate heat exchanger flanged pipe joints, should not be under estimated.
 

FNR TEMPERATURE STABILITY:
In a FNR the nuclear chain reaction progresses through successive neutron generations very quickly, so the neutron concentration and hence the reactor thermal power can potentially grow or decay equally quickly. It is important to design a FNR such that its reactivity has a strong negative temperature coefficient so that at its operating point its reactivity always decreases as its average fuel temperature increases. Then the reactor will spontaneously seek an operating point where the reactivity is zero.

If there is a suitable negative temperature coefficient then for a particular fuel geometry and a partcular thermal load there is an average fuel temperature at which the number of free neutrons remains stable. A stable number of free neutrons corresponds to a stable thermal power output. A FNR should exhibit a declining reactivity with increasing temperature without any reliance on an external control system. Then varying the rate of heat removal from the reactor controls the reactor thermal power. Delayed neutrons in a FNR prevent rapid wide thermal power excursions when the fuel geometry, primary coolant temperature or primary coolant flow slowly change.

FNRs derive their safety by operating in circumstances where the reactor reactivity versus average fuel temperature characteristic has a strong negative slope. This safety characteristic is near optimal when about half of the fission neutrons formed in the core zone diffuse out of the core zone and are absorbed by the adjacent blanket zones. The design of a FNR fuel assembly should closely adhere to this safety principle.

FNRs should be always be operated in circumstances where coolant boiling cannot occur. Coolant boiling causes coolant voids which will increase reactor reactivity and reduce the fuel cooling rate, causing uncertainty with respect to the reactor operating parameters.

A FNR should have passive features that limit the rate of change of fuel geometry, the maximum deviation of the primary coolant temperature from the reactor setpoint and the maximum thermal load regardless of operator or power level programming error.
 

FNR POWER SURGE PROTECTION:
It is necessary to ensure that any credible coolant temperature or coolant flow will not cause a local reactor heat flux in excess of the fuel tube material rating.

Likewise it is necessary to ensure that a FNR will not have an uncontrolled thermal power surge due to an unplanned change in its fuel or coolant geometry caused by any credible earthquake, aircraft impact, overhead crane failure or structural failure.

A FNR should use fuel designed such that mild prompt neutron criticality causes instantaneous disassembly of the fuel within each fixed fuel bundle to suppress the prompt critical condition.
 

NON-NUCLEAR MAINTENANCE:
On-site personnel are required to do periodic routine non-nuclear preventive maintenance on the secondary sodium heat transport system, sodium-salt heat exchangers, salt circulation pumps, steam generators, injection pumps, turbo-generators, condensers, cooling towers and related mechanical and electrical equipment and to make repairs as necessary. However, this equipment should not involve any radioactivity. There is sufficient redundancy in the FNR support equipment that some of the heat transport systems can be shut down for maintenance or repair while others remain in operation. Thus the only reasons for keeping staff on the reactor site 24/7 is compliance with steam power plant regulations and maintenance of site security.
 

FNR POWER CONTROL:
For safe power control FNRs rely on thermal expansion of reactor fuel to reduce the FNR reactivity and hence reduce the thermal power output as the fuel temperature increases. The reactor core zone fuel geometry should be slowly adjusted to change fuel average temperature setpoint or to cause a cool or cold reactor shutdown.

One of the reactor design issues is prevention of sodium void instability. Formation of sodium voids would potentially increase the FNR reactivity. At all reactor operating states the decrease in reactivity due to an increase in fuel temperature must exceed the increase in reactivity due to structural and coolant expansion (void formation).

The tendency for void formation is related to the local sodium temperature, the sodium temperature distribution in the reactor and the sodium hydraulic head. The reactor must not rely on any mechanical pumping mechanism for preventing formation of sodium voids. Typically this condition is achieved by operating the sodium far below its boiling point. The sodium boiling point is raised by use of a significant liquid sodium head pressure in the reactor core zone. The reactor peak power must never be so large as to cause sodium void formation. Reactor power peaks tend to occur at times when there are changes in fuel geometry with the object of increasing the average fuel temperature.

One of the issues in FNR design is ensuring that no matter what adverse circumstances occur on loss of station power the reactor fails into a safe shutdown state.

Note that once the primary liquid sodium has significantly cooled the average fuel temperature setpoint must be slowly raised before re-establishing reactor operation. During that warming period the nitrate salt must also be melted.
 

ACCIDENT DESIGN BASIS:
From a licensing point of view the FNR design must meet all the severe accident events covered in the design basis for the site. Events that can occur together must also be considered.

For example if a FNR enclosure is hit by a large aircraft the resulting change in FNR fuel geometry must not cause a prompt critical condition. A FNR must also withstand earthquakes and tornados that cause electricity transmission poles to become missiles. The list of possible hazards also includes potential internal plant accidents like sodium fires, hydrogen fires, main steam line breaks and associated pipe whip and steam turbine disintegration, etc.

The Darlington safety report is likely available to the public at the CNSC library in Ottawa and should contain a list of all the design basis accidents.
 

FNR SAFETY CONDITIONS:
There are at least 15 safety related conditions that must be maintained at all times by liquid sodium cooled FNRs:
a) Certain water exclusion;
b) Certain air exclusion;
c) Certain primary liquid sodium containment and level maintenance;
d) Certain primary sodium temperature setpoint range constraint;
e) Certain primary sodium fire prevention and suppression;
f) Certain fuel geometry stability and avoidance of prompt neutron criticality;
g) Certain safe fuel disassembly in the event of prompt neutron criticality;
h) Certain nuclear reaction warm, cool and cold shutdowns via independent systems;
i) Certain fission product decay heat removal;
j) Certain tolerance of intermediate heat exchange bundle, sodium-salt heat exchanger and steam generator tube failures via gravity drain down;
k) Certain secondary sodium fire tolerance and suppression;
l) Certain earthquake tolerance;
m) Certain resistance to external missle attack;
n) Proliferation resistance;
o) Resistance to Murphy's Law.
p) Secondary sodium pressure and level maintenance
q) Nitrate salt level maintenance

The FNR described herein is designed to ensure compliance with each of these conditions.
 

WATER EXCLUSION:
Certain water exclusion is realized first by FNR siting at a sufficient elevation that the FNR can never be exposed to flood water. In addition there are four concentric barriers (the external concrete wall and three nested steel walls) that will exclude ground water and rain water from the primary liquid sodium. Furthermore no water or water pipes are permitted within the primary sodium pool enclosure or heat exchange gallery outside concrete walls. Secondary sodium drains down into dump tanks. Nitrate salt drains down into dump tanks. Steam generator water drains down into a pumped sump. Another sump pump expels water from the reactor enclosure foundation.
 

AIR EXCLUSION:
There are three concentric interior reactor roofs and side walls intended for ongoing sodium vapor inclusion, argon inclusion and air exclusion. The outside structural wall and roof protect the three interior gas barriers. When the liquid sodium is near ambient temperature its surface can be isolated from air by flooding the sodium surface with kerosene. The pipe paths between the argon filled spaces and the air filled spaces are isolated by bellows sealed pipe connections and by argon-vacuum-air locks. The argon pressure is maintained at one atmosphere via the use of large argon containment bladders located within adjacent silos. A dual on-site cryogenic facility provides on going argon-air separation.
 

PRIMARY LIQUID SODIUM CONTAINMENT AND LEVEL MAINTENANCE:
The primary liquid sodium is contained within three cylindrical nested open top steel cups. The innermost cup is 16 m high X 20 m diameter. The middle cup is 17 m high X 22 m diameter. The outer cup is 18 m high X 24 m diameter. The 1 m wide spaces between the cups are filled with fire brick. The fire brick is chosen such that if immersed in liquid sodium it will displace at least 50% of its own volume.

In the event that the inner two cups both fail liquid sodium will flow into the space occupied by all of the fire brick. If the fire brick displaces a volume of sodium equal to 50% of the fire brick volume the volume available for potential sodium occupancy up to 4 m below the normal sodium level is:
{Pi (12 m)^2 (13 m) - Pi (10 m)^2 (11 m)} (.50)
= Pi (1872 m^3 - 1100 m^3)(.50)
= 1212.65 m^3

The volume of liquid sodium available to fill this space while keeping the intermediate heat exchange tubes at least 2 m immersed in liquid sodium is:
Pi (10 m)^2 (4 m) = 1256.63 m^3

Hence as long as the outer most steel cup holds there is sufficient fire brick to prevent the sodium level in the innermost cup falling by more than 4 m. Thus:
6 m - 4 m = 2 m
of heat exchange tube remain immersed in the liquid sodium for decay heat removal.
 

NUCLEAR REACTION SHUTDOWN:
A key issue in fuel bundle design is that with half of the movable fuel bundles fully withdrawn from the matrix of fixed fuel bundles and the remainder of the movable fuel bundles in their normal operating position the reactor must shut down. This fuel bundle design constraint enables safe reactor assembly/disassembly and allows independent operation of the two fully independent FNR cold shutdown systems. In order to achieve reactor zone symmetry the fissile fuel concentration in the movable active fuel bundles may be higher than the fissile fuel concentration in the fixed active fuel bundles.

Engineered nuclear reactor safety shutdown systems operate on the principle that in addition to the normal control system which realizes a warm shutdown under no thermal load there should be two fully independent and redundant safety shutdown systems, either of which can cause a reactor shutdown.

For each of the two safety shutdown systems there are independent mechanical and electronic constraints on the temperature setpoint and its rate of change. There are also independent position, temperature and gamma ray sensors that can over ride other setpoiint control signals to force a reactor cold shutdown.

For public safety each of the aforementioned safety systems should be continuously monitored and periodically tested to ensure that it will reliably function if required.

These two safety systems are backed up by physical barriers. To cause a hazard to the public the fuel geometry adjustment system, both safety systems and the physical barriers must all simultaneously fail. To cause a potential hazard to service personnel maintaining or testing one safety system the other safety system must simultaneously fail.

Independent functionality of these safety systems is an essential condition for safe unattended FNR operation.

Generally there is a requirement for service personnel to periodically physically confirm the proper operation of each safety system. Provided that these scheduled checks are performed and if necessary any defective devices are promptly repaired or replaced, the probability of the multiple safety shutdown systems all failing simultaneously is less than microscopic.
 

SHUTDOWN DEFINITIONS:
1) WARM REACTOR SHUTDOWN = Nuclear power generation stops but the primary sodium temperature remains at the reactor setpoint, typically 460 degrees C.

2) COOL REACTOR SHUTDOWN = Nuclear power generation stops and will not restart until primary sodium coolant reaches a much lower temperature, typically 120 degrees C as required for fuel bundle repositioning and/or intermediate heat exchange bundle replacement.

3) COLD REACTOR SHUTDOWN = Nuclear power generation stops and will not restart even if the primary liquid sodium falls to room temperature. In practice a cold shutdown is seldom used because it triggers muiltiple reactor restart problems. The heat required to raise the primary sodium to above 100 degrees C must come from an external energy source.
 

REQUIRED FUEL BUNDLE NUCLEAR SHUTDOWN PERFORMANCE:
1) Reactor discharge temperature setpoint modulation is achieved by changing the insertion depth of the movable fuel bundles in the matrix of fixed fuel bundles.

2) A reactor coolant temperature rise above its setpoint must cause a warm reactor shutdown.

3) The movable fuel bundles are divided into two groups, A and B, in a pattern similar to the red and black squares on a checker board. Each interior member of group A has four group B members as nearest movable neighbours. Similarly each interior member of group B has four group A members as nearest movable neighbours.

4) The maximum possible reactor reactivity occurs when both groups A and B are fully inserted into the matrix of fixed fuel bundles.

5) In normal reactor operation both groups A and B are partially inserted.

6) Full withdrawal of either group A or group B from the matrix of fixed fuel bundles while the remainder of the movable fuel bundles remain in their normal operating position must cause a cool reactor shutdown. This reactivity design constraint enables operation of the two fully independent FNR shutdown systems and also enables safe reactor assembly / diassembly.

7) In order to achieve reactor zone symmetry when the movable fuel bundles are fully withdrawn the average fissile fuel concentration in the movable fuel bundles should be higher than the average fissile fuel concentration in the fixed fuel bundles.

8) If any single movable fuel bundle is accidentally moved toward being over inserted immediate full withdrawal of either the remaining group A movable fuel bundles or the remaining group B movable fuel bundles must cause a cool reactor shutdown.

9) If any two movable fuel bundles are accidentally moved toward being fully inserted full withdrawal of all of the remaining movable fuel bundles must immediately occur and must cause a cool reactor shutdown.
 

TEMPERATURE AND GAMMA OUTPUT LIMITING:
For each of the two safety shutdown system there are independent mechanical and electronic constraints on the fuel average temperature setpoint and its rate of change. There are also independent position, temperature and gamma ray sensors that via an independent control can over ride other setpoiint control signals to force a reactor cold shutdown.

The insertion rate of movable fuel bundles into the matrix of fixed fuel bundles is both physically and electronicly limited to prevent fuel over heating and to prevent approach to prompt neutron criticality.

The fuel bundle geometry in a FNR is mechanically stable. The working temperature of each fuel bundle is kept sufficiently low that the fuel bundle geometry cannot become unstable via fuel melting, structural melting or sodium boiling due to the large temperature differences between the material operating temperatures and their melting and boiling points.

At the primary liquid sodium surface sodium vapor bubbles will start to form if the liquid sodium surface temperature rises above 870 degrees C. However, under those circustances liquid sodium boiling in the core zone is prevented by the liquid sodium static head pressure in the core zone. Due to the liquid sodium static head pressure sodium vapor bubbles will not form in the reactor core zone until the temperature in the core zone reaches about 960 degrees C. The appearance of sodium vapor bubbles on surface of the primary sodium pool gives early warning of local overheating. The temperature of the sodium inside an indicator tube is a reliable but somewhat delayed indication of the liquid sodium temperature at the corresponding fuel bundle discharge.
 

PROMPT NEUTRON CRITICALITY:
For nuclear reactors at urban sites the single biggest risk to the public is a circumstance that might cause a major reactor explosion due to prompt neutron criticality. The best defense against prompt neutron criticality is to understand its causes, to be aware of the potential danger and to do all necessary to prevent it from occurring.

To obtain an explosion it is necessary to cause a reactor to become super critical on prompt neutrons. Delayed neutrons are too slow to sustain the rapid power rise needed for an explosion.

Fast neutrons are high energy neutrons (~ 20,000 km/s),
Prompt neutrons are fast neutrons that come directly from a fission reaction;
Delayed neutrons are fast neutrons emitted from the fission fragments that are emitted a few seconds after the corresponding nuclear fission. Delayed neutrons make it possible to design and safely control both thermal neutron and fast neutron power reactors.
Thermal neutrons are low energy neutrons (2 km / s) that have been slowed down by scattering by low atomic weight moderator materials.

Above the prompt-critical point reactor power rise can occur quickly with thermal neutrons and even faster with fast neutrons. Power rises with thermal neutrons are slow enough to give the reactor time to structurally disintegrate before reaching energy levels that are associated with nuclear explosions. Structural disintegration causes the reactor to become sub-critical which causes the power rise to stop.

A well known case of prompt thermal neutron criticality in a thermal neutron nuclear power reactor was in 1986 at:
Chernobyl

A good description of the safety measure failures that led to the accident at Chernobyl and the corresponding preventive safety measures used in CANDU reactors is contained in a report titled:
Chernobyl - A Canadian Perspective

The FNR known as EBR-2 was tested under full power with sudden loss of cooling and while the control rods were deliberately inactivated to prevent automated control feedback. The EGR-2 intrinsically adjusted power levels to zero within 5 minutes. This type of test was carried out almost 50 times with no apparent damage to the reactor nor to any component, with the reactor being powered up again the same day. However, part of the reason for this safe behavior might have been fuel disassembly.
 

FUEL DISASSEMBLY:
Core fuel thermal expansion and delayed neutrons are the primary safeguards against uncontrolled rapid power rise in a FNR. Hence it is crucial that the design of fast neutron reactors ensures that transients or accidents can not cause strong prompt neutron super-criticality.

A FNR is unique in that it can safely manage small prompt critical excursions. In a FNR a rapid power rise due to a small prompt critical excursion blows the core fuel apart longitudinally in less than 10^-4 s thus causing the reactor to become sub-critical before the power rise is sufficient to cause physical damage.

In prompt neutron criticality the rate of power rise is proportional to the degree of super-criticality and is inversely proportional to the neutron transit time T between successive fissions. This time T is given by:
T = 1 / [Vn Sigmafp Nfp]
where:
Vn = neutron velocity
Sigmafp = fast fission cross section of Pu-239 atoms
Nfp = average concentration of Pu-239 atoms in the reactor core

En = neutron kinetic energy
= 1.67 X 10^-27 kg X Vn^2 / 2
= 2 X 10^6 eV X 1.6 X 10^-19 J / eV
giving:
Vn = [(2 En) / (1.67 X 10^-27 kg)]^0.5
= [(6.4 X 10^-13 J) / (1.67 X 10^-27 kg)]^0.5
= 1.96 X 10^7 m / s

Sigmafp = 1.7 b
= 1.7 X 10^-28 m^2

From the web page titled: FNR CORE
Nfp = 1.616 X 10^27 Pu atoms / m^3
giving:
T = 1 / [Vn Sigmafp Nfp]
= 1 / [(1.96 X 10^7 m / s) (1.7 X 10^-28 m^2) (1.616 X 10^27 / m^3)]
= 1 s / [5.3845 X 10^6]
= 0.1857 us
= 185.7 ns.
 

At a prompt neutron growth rate of 1.001 / neutron cycle the number of cycles N required for the neutron flux to double is given by:
(1.001)^N = 2
or
N Ln(1.001) = Ln(2)
or
N = Ln(2) / Ln(1.001)
= 0.69314 / 9.995 X 10^-4
= 693.5

Thus at a neutron growth of 1.001 / cycle the fission power will double in:
693.5 X 185.7 ns
= 128,790 ns
= 128.8 us
= 0.129 ms
which is comparable to the time required for gun powder to burn in a gun.

Thus as long as the degree of prompt neutron supercriticality in a FNR is small the dynamics of the core fuel are comparable to the dynamics of a bullet in a gun. In the event of prompt neutron criticality the Cs and Na in or adjacent to the core fuel vaporizes blowing the core fuel of the fixed fuel bundles toward the fuel tube plenum. This fuel disassembly instantly reduces the reactor reactivity, suppressing the prompt neutron critical condition. On cooling gravity restores the core fuel geometry. Note that in the fixed fuel bundles it is essential that the upper blanket rods slide freely inside the fuel tubes so that they will not prevent rapid fuel disassembly. It is equally important to ensure that the internal pressure rating of the fuel tube walls is sufficient for rapid lifting of the stack of blanket fuel rods that is above each core fuel rod.
 

POTENTIAL CAUSES OF PROMPT NEUTRON CRITICALITY:
In a FNR there are several possible ways that prompt neutron criticality might occur.

1) Reactor power instability.

2) Too rapid changes in fuel geometry.

3) Insufficient enclosure structural integrity.

4) Sudden large drop in reactor core zone coolant inlet temperature. This issue can be mitigated via a sufficient thermal mass to ensure a gradual change in core zone local reactivity as a function of position.

5) Insufficient earthquake tolerance.

6) A direct attack by some form of armour penetrating bomb or missile.

7) Insufficient Murphy's Law tolerance. Generally reactors should be designed such that three independent systems must all simultaneously fail before a major accident can occur.
 

REACTOR POWER STABILITY:
If there is too much time and inappropriate negative feedback between a step increase in reactor power and the corresponding corrective decrease in FNR reactivity the reactor power might oscillate in a manner such that the oscillations grow to the point of exceeding the prompt neutron criticality threshold. The reactor physical parameters must be chosen to ensure that such thermal power oscillation cannot occur.

In this matter it is important to limit the length of the core fuel rods.

There is an inherent time delay between a step change in reactor power and the corresponding change in reactor reactivity. The reactor physical parameters must be chosen so that the reactor will not power oscillate regardless of the amount of movable fuel bundle insertion into the fixed fuel bundle matrix.

The change in local reactivity with temperature occurs as a result of thermal expansion of the fuel, iron, chromium and sodium. The thermal expansion of the fuel occurs almost instantly but it takes a finite time for an injected heat pulse to propagate from the fuel to the surrounding materials.

There is a further time delay related to the thermal response of the reactor blanket.

The FNR design presented on this web site uses solid fuel and fuel tubes with low friction suspention to maintain a fixed fuel geometry during an Earthquake.
 

TOO RAPID CHANGES IN FUEL GEOMETRY:
A too rapid change in fuel geometry could be caused by too rapid insertion of movable fuel bundles into the matrix of fixed fuel bundles. Too rapid movable fuel bundle insertion can be prevented by using appropriate mechanical speed limits. If the maximum safe movable fuel bundle insertion depth is exceeded redundant safety systems should use gravitational withdrawal of other movable fuel bundles to force an immediate reactor cool shut down.

There is a transition region between a reactor being critical with delayed plus prompt neutrons and being critical with just prompt neutrons. A FNR should normally remain in that transition region. A key issue is time. If the change in reactor fuel geometry is slow enough the heat released while under control by delayed neutrons should induce sufficient negative reactivity to prevent further approach to the prompt critical condition. In a FNR controlled by the fuel temperature this feedback is almost instantaneous. The danger lies in positive reactivity injections and in reactor reactivites that are outside the available temperature control range.

A key issue in this respect is fuel geometric stability. With Pu-239 fuel the time required for a 0.2% increase in reactivity due to a change in fuel geometry must be long compared to 3 seconds. Liquid fissile fuels are potentially very dangerous because liquids can develop cavitation, vorticies, or surface waves that can change the reactor reactivity by more than 0.2% in a time period which is short compared to 3 seconds. It is much safer to use physically stable solid fuel as contemplated for this FNR.
 

LOADING AND UNLOADING FUEL BUNDLES:
It is important to never let the fuel assembly accidentaly go critial. In loading fuel bundles into the primary sodium pool each movable bundle should be installed in the fully withdrawn position before installing its surrounding fixed fuel bundles. Similarly the fixed fuel bundles surrounding a movable bundle should be removed before extracting the corresponding movable fuel bundle. That strategy ensures that the fuel assembly will not accidently go critical due to pulling a movable fuel bundle right through a matrix of adjacent fixed fuel bundles.
 

CORE FUEL MELTING PROTECTION:
A relevant paper about a comparable liquid sodium cooled reactor with metallic fuel is S Prism Reactor Margin To Accidents
 

ENCLOSURE STRUCTURAL INTEGRITY:
A prompt critical condition might be caused by a reactor enclosure collapse which crushes the fixed active fuel bundles. For example, a falling crane or a large airplane impact which causes collapse of the reactor enclosure.

A FNR enclosure must be designed such that a structural collapse sufficient to cause crushing of the fixed fuel bundles is not a credible risk. The reactor enclosure outside walls should be protected against an external aircraft or missle impact by bed rock, gravel embankments or adjacent structures such as cooling towers. The reactor enclosure roof must be structurally sufficiently robust to safely absorb the impact of a diving aircraft or a falling crane. The reactor roof structure should contain impact absorbing material, such as steel cable woven analogous to the fiber in a bullet proof vest, to safely distribute over the roof area the impact force of any credible projectile. If the impact causes pieces to break off the outer roof the inner roofs must prevent the broken pieces falling on to and damaging the reactor. The outer roof structure should be comparable in strength to a highway or railway overpass.

The inner ceiling immediately above the reactor should be made of light weight materials that, if they fell on the reactor fuel assembly, are not sufficiently heavy to significantly change the geometry of the matrix of fixed fuel bundles. The impact of the material fall would be mitigated by the top 6 m of liquid sodium. The hydraulic pressure wave resulting from the impact would accelerate withdrawal of the movable fuel bundles. The fixed fuel bundle plenums would provide additional shock absorption.

The external enclosure must also protect the reactor from the large liquid hydrocarbon fuel fire that might accompany the crash of a large airplane.

An important issue in earthquake protection is bolting the fixed fuel bundles together to form a rigid matrix. The liquid sodium above the fuel assembly may slosh back and forth in an earthquake and we do not want surface waves in the liquid sodium to change the fuel assembly geometry and hence its reactivity.
 

LARGE DROP IN REACTOR CORE ZONE INLET TEMPERATURE:
In a FNR the reactivity increases with decreasing fuel temperature. Depending upon the fuel material distribution if the primary sodium temperature entering the reactor core zone drops too quickly the resulting increase in heat flux might melt the fuel on its cenerline, vaporize the internal liquid sodium or damage the fuel tubes. It is essential to have sufficient coolant thermal mass to prevent sudden major coolant temperature drops that might lead to fuel melting or prompt neutron criticality.

Since the change in reactor reactivity with a change in temperature is negative the reactivity cannot grow due to a coolant temperature rise.

A large FNR with a 1.7 m wide liquid sodium guard band contains a lot of heat stored in its primary liquid sodium pool. Hence it can load follow using some of that stored heat without any rapid change in the reactivity of its fuel assembly. The change in reactor thermal power output can take many minutes whereas the rate of heat transfer out of the primary sodium pool can change by a similar fraction in a few seconds.
 

CERTAIN FISSION PRODUCT DECAY HEAT REMOVAL:
For each FNR there are at least four independent passive heat removal systems any one of which can reliably and safely remove the fission product decay heat.

Under the circumstances of a double liquid sodium containment wall failure the heat transfer capacity of each heat transfer system might fall by a factor of three. However, we only need (1 / 12) of the entire heat transfer system capacity to remve fission product decay heat. Thus in order to reliably remove fission product decay heat it is essential that (1 / 4) of the total reactor heat transfer capacity must continue to function so that under the adverse condition of a double sodium containment wall failure the remaining certain heat transfer capacity is:
(1 / 3)(1 / 4) = (1 / 12)
of system full power heat removal capacity. Hence for maximum reliability there should be at least four independent passive heat removal systems, any one of which can reliably remove the fission product decay heat.
 

TOLERANCE OF HEAT EXCHANGE TUBE FAILURES:
A practical FNR involves many thousands of intermediate heat exchange tubes. Sooner or later one or more of these tubes will fail. Each secondary sodium system has the following features:
1) The secondary sodium loop components are all rated for a working presure of 6 MPa and are safety tested to 9 MPa;
2) There are sodium level sensors consisting of a long thin coils of nichrome waire suspended from an insulated feed through in an argon filled cushion tank head space. The electrical resistance of this coil to ground decreases as the sodium level increases.
3) There are sodium level sensors in the dump tanks.
4) The secondary sodium loop normally operates at about 0.5 MPa.
5) If there is a leak in the intermediate heat exchanger the secondary sodium level in the sodium cushion tank will decrease and the argon cushion tank pressure will decrease.
6) If there is a leak in a steam generator tube the nitrate salt level will increase and the salt will contain steam/water.
7) The trigger for venting and draining the tube side of the steam generator to the salt dump tank is a significant increase in salt pressure or a decrease insecondary sodium level or pressure.
8) If the secondary sodium pressure falls to 0.3 MPa salt drainage to its dump tank is tripped.
9) Meanwhile secondary sodium is flowing into the nitrate salt loop. The chemical reaction causes immediate nitrogen production which raises the pressure in the salt circuit. Nitrogen fills up the sodium-salt heat exchanger and then is vented to the atmosphere. The increase in salt pressure dischargs salt out the vent. 10) Sodium continues to flow through a tube ruptue int the salt. It will produce nitrogen. If there is any water in the salt it will also produce hydrogen. The water that initially flowed into the salt circuit continues to make hydrogen. The pressure in the salt circuit now rapidly rises and discharges more salt out the vent. 11) There is a sodium dump tank and a salt dump tank for each heat transport loop. Each dump tank has sufficient volume to accommodate all the sodium or salt in its circuit. If the argon pressure over a dump tank is released the salt will drain down into its dump tank.
12) The secondary sodium systems are vented to above the roof by vents fitted with rupture disks and gravity operated ball check valves. The vent must be sufficiently high that entrained sodium in the exhaust cannot start a roof fire.
13) The sodium dump tanks are normally filled with 0.5 MPa argon. Hence if there is a steam generator tube leak which causes the nitrate salt pressure to increase the nitrate salt will drain down into the nitrate salt dump tank.
14) If water enters the nitrate salt the steam generator shell side is vented to the atmosphere, the steam generator water injection is stopped and the steam generator is drained. The object is to minimize the mass of water that can leak into the salt circuit via the steam generator tube failure. As soon as there is some water in the secondary sodium circuit it will become steam which will increase the pressure in the salt circuit. This increase in pressure will slow further flow of water into the salt circuit. However, that action will stop when the vent rupture disk opens. Hence the initial pressure in the salt circuit and the volume of the expansion space are important because the time necessary for the salt pressure to rise provides time necessary for draining and venting the steam generator.
15) An important issue is to rapidly drain water out of the steam generator to prevent that water continuing to flow into the nitrate salt via the heat exchange tube break. Steam forming in the nitrate salt circuit will tend to increase the pressure in that circuit, which will tend to drive water back into the steam generator heat exchange tubes. However, once the vent ball check opens the salt pressure will fall and when that occurs it is essential that the steam generator be empty of water.
16) In order to service the secondary sodium loop the contents of the intermediate heat exchanger must be transferred to the sodium dump tank.
17) After repair the secondary sodium loop must be refilled by application of argon pressure to the sodium drain down tank. Sodium and argon are inserted via the dump tank. The intermediate heat exchange bundle has a thin drain tube connected to its bottom. Then an overhead argon pressure permits draining the liquid sodium from the heat exchange bundle.
18) In summary any significant change in either the sodium level or the secondary sodium loop pressure is indicative of a serious problem. The sodium level as a function of time in both the expansion tank and the dump tank should indicate the nature of the problem.
19) On a steam generator tube rupture initially water flows from the steam generator into the nitrate salt which almost instantly raises the pressure to 5 MPa. This transient high pressure should trip the steam generator steam pressure release valve and drain valves and turnoff the steam generator injection water pump. A continuing secondary sodium loop pressure increase will cause the rupture disk to open. Then sodium is expelled from the secondary loop via both the tube failure and via the open rupture disk.
20) A consequence of a steam generator tube failure may be NaOH accumulation in elbows at the bottom of the secondary sodium loop. There needs to be a filter system that gradually removes NaOH from the secondary loop. This filter should be installed across the induction pump. The NaOH can be periodically dissolved by raising the minimum loop temperature above 318 degrees C and then cooling it in the filter. There still may be a problem with liquid NaOH sinking to the bottom of the secondary loop.
 

SECONDARY SODIUM FIRE SUPPRESSION:
The secondary sodium loop normally operates at a pressure slightly above one atmosphere. There is a small tendency for secondary sodium to leak at mechanical joints. Such leaks are potentially dangerous to service personnel. Hot sodium will self ignite in air. One way to suppress these sodium fires is tocompletely surround the secondary sodium loop with an argon jacket. The jacket must be physically robust enough to reliably withstand squiring liquid sodium and must act as a thermal insulator.

Small sodium fires can be extinguished using NaCO3.
 

EARTHQUAKE TOLERANCE:
FNR Earthquake tolerance issues are detailed on the web page titled: FNR Earthquake Protection
 

PROLIFERATION RESISTANCE:
Implementation of Proliferation Resistance
 

MURPHY'S LAW
Murphy's Law states that if there is any way for humans to do something wrong sooner or later someone will discover it. FNRs must be engineered to be tolerant of possible human error. To the extent possible FNRs should be designed so that incompetent or irrational human activity cannot cause dangerous prompt neutron criticality.

FNRs rely on fairly complex crane manipulation of fuel bundles during fuel bundle installation and replacement. This crane manipulation is unlikely to be fully automated in the foreseeable future, so this portion of FNR work will likely be subject to potential human error.

In the event that during loading or unloading a fuel bundle is dropped and falls to the bottom of the primary liquid sodium pool the dropped fuel bundle must be immediately retrieved, not ignored or forgotten. The potential danger is a prompt critical condition arising from random overlap of the core fuel of the dropped fuel bundle with the core fuel of another dropped fuel bundle. To minimize such problems the gantry crane used for fuel loading and unloading should be fitted with a safety line to prevent such drops.

It should be assumed that sooner or later humans will make mistakes. A FNR must be designed to enable easy detection and remedy of mistakes. Any mistake that could potentially lead to reactor over heating or dangerous prompt neutron criticality must be obvious to several different individuals long before it can cause a disaster. Ideally any safety procedure that relies on human operator training or skill is open to being done wrong by someone sooner or later.
 

This web page last updated September 4, 2021

Home Energy Physics Nuclear Power Electricity Climate Change Lighting Control Contacts Links