Home Energy Nuclear Electricity Climate Change Lighting Control Contacts Links


XYLENE POWER LTD.

FNR SAFETY

By Charles Rhodes, P.Eng., Ph.D.

INTRODUCTION:
Elsewhere on this website Fast Neutron Reactors (FNRs) have been identified as a sustainable solution to mankind's energy problems. This web page focuses on FNR design parameters that are necessary to achieve inherent safety. The issue is that FNRs must be designed so that they can be safely installed, operated and maintained at both high density urban locations and in small towns where there is limited availability of skilled personnel. In normal FNR operation there is seldom any cause for maintenance personnel to enter the FNR building. The FNRs are designed to operate automatically, to be remotely monitored and if necessary to be partially or entirely shut down via safety system control, local control or remote control.

On-site personnel are required to do periodic routine preventive maintenance on the steam generator, turbo-generator, condenser, cooling tower and related equipment and to make repairs as necessary. However, this equipment does not involve any radioactivity. There is sufficient redundancy in the equipment that some of the heat transport systems can be shut down for maintenance or repair while others remain in operation. Thus the only reason for keeping skilled staff on the reactor site 24/7 is compliance with steam power plant safety regulations.
 

FNR DESCRIPTION:
The term Fast Neutron Reactor (FNR) is generically quite broad. For the purpose of this web site the definition of an FNR is narrowed to be a fast neutron reactor with metallic fuel rods and liquid sodium primary and secondary coolants. A 900 MWt FNR has a core region 0.35 m high X 10.4 m diameter that is surrounded above, below and on the perimeter by a blanket region 1.2 m thick.

In most power FNRs the blanket region is further surrounded by a 2.8 m thick layer of liquid sodium that absorbs all neutrons that escape from the blanket region.

The central core region together with the top and bottom blanket regions may have as few as 9 or as many as 532 vertical active fuel bundles. Each fuel bundle is 0.4 m long X 0.4 m wide X 6.0 m high. In addition there are 3 m corner girder extensions on the fuel bundle bottom and there is a removeable 4.5 m long indicator tube on the top. Each active fuel bundle consists of a vertically sliding central control portion and a fixed position surround portion. The central control portion is inserted into the surround portion from the bottom using a liquid sodium hydraulic piston type actuator. The indicator tube projects above the primary liquid sodium surface to indicate the vertical position of the fuel bundle control portion. This vertical position is constantly monitored using an overhead laser device similar to a laser measuring tape.

The reactor core region is surrounded on its outer perimeter by a 1.2 m thick blanket formed from 212 to 272 additional vertical passive fuel bundles.

For a 900 Mwt reactor the active fuel bundles are centrally positioned in a 25.4 m long X 18.4 m wide X 13.5 m deep liquid sodium pool. The region 3.0 m long X 18.4 m wide at each end of the liquid sodium pool is dedicated to intermediate heat exchange bundles and a central service access corridor. A 3.5 m long liquid sodium channel in front of the intermendiate heat exchange bundles allows easy movement and exchange of both fuel bundles and heat exchange bundles.
 

NORMAL CHAIN REACTION CONTROL:
In normal FNR operation the chain reaction is controlled by thermal expansion of the liquid sodium. The liquid sodium temperature in effect controls the fraction of fission neutrons that escape from the reactor core zone into the reactor blanket zone. As that fraction increases the reactor power decreases and vice versa.
 

SAFETY ADVANTAGES OF FNRs AS COMPARED TO WATER COOLED REACTORS:
Liquid sodium cooled FNRs inherently provide several major safety advantages as compared to water cooled reactors. Water at a pressure of one atmosphere boils at 100 degrees C, a temperature far below the water cooled reactor maximum operating temperature of 320 degrees C. Sodium at a pressure of one atmosphere boils at 883 degrees C, a temperature far above the FNR maximum operating temperature of 450 degrees C. This difference in boiling point relative to reactor operating temperature has important implications.

1) If heavy water is used as a reactor coolant any coolant leak will flash into radioactive steam. Hence in an accident situation this steam cannot be safely vented to the atmosphere at an urban reactor site. Liquid sodium cooled FNRs avoid this problem by use of low pressure liquid sodium as the primary coolant. The primary liquid sodium is isolated from the turbo-generator working fluid steam by two separate heat exchangers. Thus there is no radiotoxicity hazard in venting FNR turbo-generator steam to the atmosphere.

2) Water cooled reactors have a potentially dangerous condition known as transient void formation in which when the coolant pressure drops steam bubbles form in the reactor fuel tubes. These steam bubbles reduce the heat transfer capacity and reduce the reactor reactivity. To compensate for the reduced reactor reactivity the reactor power control system may automatically withdraw control rods to maintain the desired power setpoint. Then if the cooling feedwater temperature suddenly drops or the cooling water pressure is restored the steam voids can rapidly collapse leading to a reactor explosion due to prompt neutron criticality. The causes of void formation include coolant circulation failure or coolant pressure drop due to a pipe rupture, a pump failure or a loss of pump power. By contrast the contemplated FNRs rely on natural circulation of low pressure primary liquid sodium which has a boiling point about 430 degrees C above the maximum liquid sodium operating temperature. Hence in a liquid sodium cooled FNR there is generally no problem with transient void formation and its related potential safety problems.

3) Water cooled reactors rely on a mechanical movement of control rods to control the reactor power. This control system has many possible failure modes. This control system must constantly operate because water cooled reactors are inherently unstable. Absent operation of the mechanical control system the reactor power would spontaneously rise or fall. By contrast in a FNR thermal expansion and contraction of the primary liquid sodium provides stable passive primary liquid sodium temperature control.

4) During severe accident conditions water cooled reactors vent radioactive gases to the atmosphere. By contrast in FNRs the only radioactive gases present remain locked inside fuel tubes.

5) Most existing water cooled power reactors rely on mechanical pumps for primary coolant circulation. Loss of coolant or loss of coolant pumping are constant and potentially dangerous threats. By contrast new FNR designs use highly reliable natural sodium circulation for primary cooling.

6) Most existing water cooled power reactors rely on use of concrete casks for on-site dry storage of spent fuel bundles. By contrast spent fuel bundles from small modular FNRs are placed in lead shipping containers and are transported by conventional trucks to a central fuel reprocessing site.

7) Water cooled reactors generate large amounts of spent fuel containing highly radiotoxic transuranium actinides. By contrast FNRs dispose of spent fuel containing transuranium actinides.

8) Existing water cooled reactors generate large amounts of sevice and decommissioniong waste. By contrast FNRs fitted with a suitable liquid sodium guard band produce minimal service waste and no decommissioning waste.

9) Water cooled reactors rely on complex electro-mechanical control systems to keep the reactor fuel and fuel tube temperatures within design limits. By contrast in a FNR at no load the fuel and fuel tube temperatures are limited by simple thermal expansion of the liquid sodium. At full load the FNR fuel tube heat flux is limited by limiting the maximum secondary liquid sodium flow rate.
 

PHYSICAL STABILITY:
During FNR operation physical stability of the FNR fuel geometry is essential for reactor safety. In all nuclear fission reactors rapid changes in fuel geometry can potentially lead to an explosive condition where the reactor goes critical on prompt neutrons. Under no circumstances can the FNR active fuel bundle control portions be rapidly inserted into the active fuel bundle surround portions, as such rapid insertion could cause a transient increase in reactivity sufficient for prompt neutron criticality. However, rapid withdrawal of the active fuel bundle control portions is permitted to achieve rapid individual active fuel bundle or total reactor shutdown.

Each fuel bundle physically clips to its four nearest neighbour fuel bundles for top horizontal position stability. Outside the assembly of fuel bundles there should be a removeable structural steel frame with diagonal reinforcing elements to provide fuel bundle assembly structural rigidity while the reactor is in operation. The diagonal structural elements prevent the entire assembly of fuel bundles from leaning, especially during or after an earthquake. This structural steel frame must be partially disassembled to allow safe removal of individual hot fuel bundles. Such fuel bundle removal and exchange should only be done when the reactor is fully shut down.
 

FEW MOVING PARTS:
Much of the inherent safety of an FNR is due to few rigid moving parts. The fuel bundles simply sit in the pool of liquid sodium and maintain the pool temperature. Thermal expansion and contraction of the liquid sodium adjusts the reactor power to maintain the desired liquid sodium temperature. At maximum thermal load the primary sodium naturally circulates and the fuel bundle discharge temperature drops to about 440 degrees C. When there is no thermal load removing heat from the primary liquid sodium pool the natural circulation stops which causes the fission chain reaction to stop. When the thermal load is restored natural circulation recommences and the fission chain reaction restarts. In normal reactor operation the control portions of the active fuel bundles remain in fixed positions. The only rigid moving parts are the primary liquid sodium filter pump impeller, the hydraulic liquid sodium pressure pump impeller and occasionally the hydraulic actuator sodium flow control valves. These valves are actuated by gravity and by argon pressure. The argon pressure transducers are located outside the reactor building. Loss of argon pressure causes a reactor shutdown.

The secondary sodium is circulated by induction pumps that are located outside the reactor building.
 

ACTIVE FUEL BUNDLE CONTROL PORTION POSITIONING SYSTEM:
Each active fuel bundle contains an interior sliding control portion moved by a dedicated liquid sodium hydraulic piston actuator. Thus an actuator jam or an active fuel bundle control portion slide jam does not physically affect the adjacent fuel bundles except via a changed neutron flux in the horizontal plane.

The active fuel bundle control portion positioning actuators rely on a common liquid sodium hydraulic pressure pump that will run occasionally due to small leaks past the hydraulic actuator pistons. This pump is submerged to maintain suction head but its motor is above the primary sodium pool and is cooled with flowing argon. If this pump fails the active fuel bundle control portion actuators will gradually lose pressure causing the active fuel bundle control portions to withdraw due to gravity and thus cause a reactor shut down.
 

ACTIVE FUEL BUNDLE CONTROL PORTION INSERTION RATE:
The fuel bundle control portion positioning system must be robust and extremely reliable and the rate of insertion of the control portions must be limited.

A situation that must be avoided is rapid insertion of an active fuel bundle control portion into the corresponding surround portion which could potentially lead to fuel bundle overheating, fuel melting and possibly even prompt neutron criticality. Hence the rate of insertion of the active fuel bundle control portions must be both hardware and software limited.

To avoid potential problems related to rapid control portion insertion orifices on the hydraulic actuator control valves limit the active fuel bundle control portion insertion rate. If the reactor monitoring system detects that an active fuel bundle control portion insertion is either too deep or too fast or if the gamma / neutron flux from a fuel bundle is too high or if the fuel bundle discharge temperature is too high the reactor safety system causes redundant full port drain valves to open causing rapid withdrawal of the relevant active fuel bundle control portions. Simultaneously the hydraulic liquid sodium flow to the relevant control portion positioning actuators is turned off.

As an additional safety measure if the position of a fuel bundle control portion fails to respond to position control signals or if the emitted gamma flux is too high or if the active fuel bundle discharge temperature is too high then the reactor control computer automatically causes withdrawal of the surrounding nearest neighbor active fuel bundle control portions to force the non-responsive fuel bundle into a sub-critical state.
 

CONTROL SYSTEM DETAILS:
The active fuel bundle control portion insertion rate is limited to prevent the reactor going critical on prompt neutrons before the liquid sodium temperature has had time to respond to the increased reactor power level. The liquid sodium temperature can only respond as fast as heat conducts from the hot fuel rod into the surrounding bulk liquid sodium. The active fuel bundle control portion must not be inserted so far into the corresponding surround portion that thermal expansion of the liquid sodium cannot stop the fission chain reaction at an acceptable fuel temperature.

The indicator tube height sensor must have good resolution with no hysterisis. The corresponding fuel bundle power is indicated by the strength of the gamma / neutron radiation propagating up that indicator tube. The fuel bundle discharge temperature should respond to a change in gamma /neutron flux with a slight time lag. If either a fuel bundle gamma / neutron signal or a fuel bundle discharge temperature is too large the active fuel bundle control portion insertion must be immediately reduced. Failure of the fuel bundle discharge temperature to track either the gamma / neutron signal or the indicator tube height indicates an equipment problem. That fuel bundle should be locked out of service until the cause of the problem is determined and rectified.

The actuator valves for each fuel bundle control portion position have three states: add high pressure hydraulic sodium via a small orifice, close, and drain hydraulic sodium via a small orifice. Most of the time the actuator valves should be in the closed state. If the actuator valves spend too much time in the add sodium state it may indicate a control portion positioning actuator sliding seal leak or a drain valve seal failure. If the drain valve keeps reopenning it may indicate a seal problem with the actuator fill valve.

In addition to the two orifice restricted actuator position control valves for each active fuel bundle there is a full port actuator shutdown valve which rapidly drains liquid sodium from the hydraulic actuator causing rapid extraction of the active fuel bundle control portion from the fixed surround portion. On loss of argon pressure this full port valve causes an immediate fuel bundle shutdown.
 

FUEL BUNDLE SAFETY ENGINEERING:
The FNR control system assumes that the core rods in a particular fuel bundle all behave the same way. Hence during fuel rod production it is important that the core rods be individually scanned to check that their alloy mix meets design specifications.

The FNR control system assumes that all the liquid sodium cooling channels in a fuel bundle are open. Hence it is essential that the liquid sodium be sufficiently filtered to eliminate particulate matter that over time might obstruct the liquid sodium cooling channels. Each fuel bundle has sufficient cross flow to tolerate a few isolated blocked liquid sodium cooling channels but the fuel bundle cannot tolerate a large cluster of blocked liquid sodium cooling channels. Of particular concern are carbon, boron, beryllium, oxygen and fluorine based particulate compounds that might potentially float or be nearly neutrally buoyant in liquid sodiuum. Denser particulate species will naturally settle to the bottom of the liquid sodium pool where they will be caught by the primary sodium pool filter.

For additional certainty each active fuel bundle has its own dedicated inverted Vee liquid sodium entrance filters. Behind the filters is a cross channel that ensures proper fuel bundle operation even if half of an inverted Vee filter is blocked.

In normal FNR operation the minimum temperature of the primary sodium is kept above 330 C to prevent formation of solid NaOH which might potentially obstruct the liquid sodium coolant flow.

The fuel bundles are designed so that they rely on their nearest neighbors for operation. If the position of the fuel bundle control portion fails to respond to control signals that fuel bundle can be shut down by shutting down its nearest neighbours. This reactor feature slightly reduces the reactor thermal power rating but allows implementation of two completely redundant emergency shutdown systems.
 

THERMAL POWER CONTROL:
Normal thermal power control in a FNR is achieved by thermal expansion of the liquid sodium and the active fuel bundles. The amount of insertion of a fuel bundle control portion into its surround portion determines the fuel bundle discharge temperature setpoint. As the fuel bundle liquid sodium discharge temperature drops below its setpoint the fuel bundle thermal power increases. However, care must be taken because under a heavy thermal load the fuel and fuel tube temperatures could potentially exceed their material ratings.

Once the reactor reaches normal operating conditions the reactor thermal power is controlled by varying the secondary sodium flow rate. Under these circumstances the role of thermal expansion of the primary liquid sodium is to keep the active fuel bundle discharge temperature in the range 440 degrees C to 450 degrees C.

The reactor thermal output power is sensed via the secondary sodium temperature differential and secondary sodium flow rate. It is important to keep the reactor thermal output power below its design maximum to prevent damage to the active fuel tubes.
 

REACTOR SHUTDOWN:
Active fuel bundle control portions are withdrawn to achieve a reactor cold shutdown. On loss of control argon pressure all the active fuel bundle control portion full port actuator drain valves open and gravity causes the active fuel bundle control portions to withdraw from the fuel bundle surround portions. Under these circumstances the primary liquid sodium pool will gradually cool and liquid argon in storage must be automatically fed into the reactor space to maintain one atmosphere of argon pressure. Otherwise the integrity of the reactor enclosure may be threatened by the decrease in argon pressure as the primary sodium temperature decreases.
 

SAFETY MONITORING:
If the gamma flux for a particular fuel bundle exceeds specification, indicating potential fuel bundle over heating, that fuel bundle should be immediately shut down.

If a fuel bundle discharge temperature gets too high, indicating fuel bundle overheating, that fuel bundle should be immediately shut down.

If an indicator tube top rises too high, indicating a potential active fuel bundle control portion positioning system problem that fuel bundle should be immediately shut down.
 

REDUNDANT SHUTDOWN SYSTEMS:
For safety purposes each active fuel bundle must remain subcritical when its control portion is fully inserted but the four nearest neighbor active fuel bundle control portions are all withdrawn. This feature ensures an immediate safe reactor cold shutdown in the presence of a single active fuel bundle control portion jam or actuator failure. Note that under this criteria the thermal power output from the outer ring of active fuel bundles may be relatively small. For each member of this active fuel bundle outer ring at least one of the nearest neighbor active fuel bundles is already missing.

Reactor safety is further improved by requiring that the reactor will fully shut down even if two adjacent fuel bundle control portions jam in the full power position. The core portion of each fuel bundle can be regarded as cube 15 inches to a side. In normal full power reactor operation neutrons are lost from 2 faces of this cube for centrally located fuel bundles and neutrons are lost from 3 or 4 faces of the cube for active fuel bundles that are members of the perimeter ring. To ensure reactor shutdown with two adjacent jammed active fuel bundle control portions a fuel bundle must shut down if neutrons are lost from either 6 or 5 cube faces. Hence the reactor should be fuelled such that when the active fuel bundle contol portions are inserted the the fuel bundle shutdown threshold is at neutron loss through 4 cube faces. In reality the fuel mix will change through the operating life of a fuel bundle, so to achieve a higher safety margin it is necessary to reduce the shutdown threshold from 4 faces of neutron loss to 3 faces of neutron loss. Under these circumstances the perimeter ring of the active fuel bundles will generate little or no thermal power.

If a control portion jams such that it will not withdraw due to gravity an overhead gantry crane can either lift or push down the corresponding indicator tube to release the jammed control portion. If there is a jam in either the hydraulic actuator or the active fuel bundle control portion the reactor should be shut down and the problem fuel bundle replaced.

The individual fuel bundles are engineered such that when they are outside the reactor environment they remain sub-critical regardless of the insertion of the active fuel bundle control portion. When the fuel bundle assembly is formed with the active fuel bundle control portions withdrawn the reactor must be sub-critical. When all of the active fuel bundle control portions are fully inserted the reactor should operate at or above its maximum rated power. As a fuel bundle reaches its design operating temperature thermal expansion of the primary liquid sodium and the fuel bundle materials should cause the fuel bundle reactivity to drop below criticality.

The fuel bundle discharge temperature distribution is monitored with an overhead scanner. In normal full power operation the discharge temperatures should be uniformly at 440 degrees C. As the reactors thermal load decreases the fuel bundle discharge temperature should rise to about 450 C at which point the reactor should become subcritical.

In normal operation the active fuel bundle control portion vertical position setpoint is adjusted so that at full rated reactor power the gamma / neutron outputs by every active fuel bundle inside the perimeter ring of active fuel bundles are identical. This state corresponds to uniform thermal power loading of the active fuel bundles that are inside the outer ring of active fuel bundles.

The vertical position of an active fuel bundle control portion vertical is indicated by the height of the top of its indicator tube. In normal operation the vertical position setpoints of the indicator tubes should be nearly identical.

As the reactor thermal load varies the gamma flux varies for all the active fuel bundles.

The fuel bundles are engineered to allow sufficient lateral liquid sodium flow to provide sufficient cooling to prevent fuel and fuel tube damage if an isolated cooling channel becomes blocked.

A liquid sodium flow obstruction will cause a small fuel bundle discharge temperature increase and hence a corresponding decrease in gamma / neutron flux as compared to neighboring fuel bundles. If a relative decrease in gamma/neutron flux is detected that fuel bundle's control portion should be withdrawn until the cause of the abnormally low gamma / neutron flux is identified and remedied and/or the faulty fuel bundle is replaced.

Unlike the EBR-2 the fuel tubes are in a square array instead of a hexagonal array. The square array is more tolerant of fuel tube swelling and allows use of fuel bundle cross rods to stabilize the positions of the individual fuel tubes.

The height of each indicator tube is sensed by a laser scanner. The fuel bundle gamma / neutron emission is sensed by an overhead thermally isolated and cooled radiation monitoring apparatus. The discharge temperature of each fuel bundle is derived from the indicator tube internal vapor pressure which is also monitored with a laser scanner.
 

TWO INDEPENDENT SAFETY SHUTDOWN SYSTEMS:
In plan view the active fuel bundles can be divided into two groups, a "red" group and a "black" group as on a checker board. Each "red" active fuel bundle has four surrounding "black" active fuel bundles. Each "black" active fuel bundle has four surrounding "red" fuel bundles. Neutrons in the core region flow in three dimensions. Hence shut down of either all the "red" active fuel bundles or all the "black" active fuel bundles shuts down the entire reactor. Hence there are two independent reactor shutdown systems, one of which shuts down all the "red" active fuel bundles and the other which shuts down all the "black" active fuel bundles. For reactor service both groups of active fuel bundles are shut down.

Reliable operation of these two independent shutdown systems may impose constraints on the FNR core rod fuel alloy mix and hence on the FNR core rod fuel reprocessing cycle time.

Reliable operation of the two independent safety shutdown systems also requires that thermal power production by the outer ring of active fuel bundles be reduced.

The safety shutdown of each fuel bundle is accomplished by removing argon control pressure from a normally open full port actuator drain valve. When this argon pressure is removed the valve opens rapidly draining liquid sodium from the active fuel bundle control portion actuator.
 

REACTOR PRIMARY AND SECONDARY COOLANTS:
The reactor primary and secondary coolants are both pure liquid sodium. A Na-K mixture is specifically excluded. A Na-K mixture offers superficial advantages in terms of melting point. However, in a power reactor the presence of potassium in the primary sodium leads to formation of K-40 which has a half life of 1.26 X 10^9 years. If there are many such power reactors operating for many years K-40 will become an increasing environmental problem. The best solution to this problem is to not produce K-40 in the first place. Hence the primary coolant should be pure sodium.

The secondary coolant circuits will operate until something fails, likely an intermediate heat exchange bundle or a steam generator tube. In an intermediate heat exchange bundle failure secondary coolant will mix with the primary coolant. Hence to keep potassium out of the primary coolant the secondary coolant must also be pure sodium.
 

REACTOR THERMAL POWER:
The reactor thermal output power is sensed via the secondary sodium temperature differential and secondary sodium flow rate. It is important to keep the reactor thermal output power below its design maximum to prevent damage to the active fuel tubes.
 

REACTOR FUEL:
The FNR core fuel rods are primarily metalic U-238 with Pu-239 and 10% zirconium alloyed with it. The purpose of the zirconium is to prevent formation of a fuel tube low melting point plutonium-iron eutectic. The purpose of the Pu-239 is to drive the nuclear reaction. The purpose of the U-238 is to capture neutrons to breed more Pu-239 The core rods are enclosed in HT-9 steel fuel tubes. The core rod diameter is intentionally only about 86% of the initial HT-9 steel tube ID to allow for core rod swelling due to internal formation of gaseous fission products. Inside the HT-9 steel tubes, along with the fuel rods is liquid sodium, which provides good thermal contact between the fuel rods and the fuel tubes and which chemically absorbs the potentially corrosive nuclear fission products fluorine, chlorine, bromine and iodine. The HT-9 steel tube plenum volume above the fuel and blanket rods contains sufficient extra sodium to compensate for eventual fuel tube swelling and provides sufficient empty volume to allow for volumetric expansion of the fuel rods and liquid sodium and to allow for sealed containment of inert gaseous fission products at allowable pressures. Another important role of the long fuel tubes is to provide chimneys that enhance natural primary sodium circulation.
 

PRIMARY SODIUM THERMAL POWER CONTROL:
As the primary liquid sodium temperature increases its density decreases, taking the reactor core zone reactivity below its critical point. Then the only significant heat produced is fission product decay heat. Provided that there is adequate decay heat removal at a low thermal load the reactor temperature will stabilize at its maximum rated temperature of 450 degrees C. As heat in excess of fission product decay heat is removed from the primary liquid sodium the primary sodium pool temperature decreases increasing the primary sodium density. This density increase restores reactor criticality and raises reactor power. The reactor can be shut down and cooled off by withdrawal of its active fuel bundle control portions.
 

FISSION PRODUCT DECAY HEAT REMOVAL:
One of the most important aspects of fission reactor design is provision for fission product decay heat removal under extremely adverse circumstances. If some event occurs which causes a reactor shutdown the fission products will continue to produce decay heat at about 5% of the reactor's full power rating. It is essential to have a 100% reliable means of ensuring ongoing removal of the fission product decay heat under accident conditions such as shortly after a severe earthquake.

In the case of a liquid sodium cooled FNR all heat removal is via primary liquid sodium, so it is essential that:
1) Under no circumstances will the primary liquid sodium level ever fall to the point that the fuel rods are not fully immersed in liquid sodium or where thermal contact with the intermediate heat exchangers is lost.
2) The liquid sodium pool walls must be designed such that if the inner wall fails and the primary liquid sodium leaks into the space between the inner and outer pool walls, the leakage into the space between the two walls will not lower the primary liquid sodium level below the tops of the fuel rods or below the intermediate heat exchange bundle tubes.
3) Even if the intermediate loop sodium pumps fail there must be enough secondary liquid sodium natural circulation to ensure safe removal of the fission product decay heat.
4) The secondary liquid sodium dumps its heat into steam generators. Hence on a reactor shutdown the pressure in the steam generators must be released so that the system that injects water into the steam generators does not face a pressure load.
5) There must be enough clean water in storage, above the elevation of the steam generators, such that the steam generators can be gravity fed and the fission product decay heat can be removed by evaporating that water and condensing the resulting steam in the cooling towers.
 

FUEL MELTDOWN:
An FNR designed for utility electric power production typically has 532 active fuel bundles. Sooner or later through accident, negligence or malevolent behavior there will be a defective active fuel bundle and/or a defective active fuel bundle control portion positioning apparatus. In these circumstances the major concern is fuel melting. In response to local overheating the control portions of the adjacent fuel bundles must be immediately withdrawn to ensure shutdown of the defective fuel bundle.

If fuel melting occurs fuel alloy droplets might collect on the primary liquid sodium pond floor under the fuel tube assembly. It is essential that these droplets do not accumulate together to form a critical mass. The primary liquid sodium pool floor must have a liner of a neutron absorbing material that is geometrically shaped to prevent molten fuel forming a critical mass. There should also be a practical means of selectively removing and replacing sections of the primary liquid sodium pool floor liner.
 

PRIMARY LIQUID SODIUM FLOW:
The hot liquid sodium will naturally circulate vertically up through the reactor between the active fuel tubes, horizontally along the top of the primary liquid sodium pool, down between the vertical intermediate heat exchange tubes and then horizontally along the bottom of the primary liquid sodium pool back to below the reactor.
 

REACTOR SHUT DOWN CONTROL:
Each active fuel bundle control portion has associated with it an actuator that vertically positions the control portion based on the indicator tube vertical position with respect to its position setpoint. The actuator piston moves in response to liquid sodium hydraulic pressure. If a problem is detected the liquid sodium hydraulic pressure falls to zero and the fuel bundle control portion withdraws due to gravity causing a fuel bundle shutdown.
 

REACTOR MONITORING ELECTRONICS:
A FNR is controlled by several micro-computers. The main function of these computers is to safely maintain the desired fuel bundle discharge temperature setpoint and to trigger fuel bundle or entire reactor shutdowns if any significant out-of-normal condition is detected. The monitoring software must include hardware watchdogs that can detect any significant problems within the reactor monitoring system and the reactor fuel bundle discharge temperature control systems. If any such problems are detected the reactor control must either shift to a fully redundant electronic monitoring and control system or trigger a reactor shutdown.
 

SECONDARY LIQUID SODIUM FLOW:
The steam generators are located at an elevation higher than the reactor and on the return side of the intermediate sodium loop so that the intermediate sodium will natuarally circulate even if the intermediate sodium induction type circulation pump loses power. The equipment should be sized so that the natural circulation rate is sufficient to safely remove reactor decay heat after the reactor is shut down.
 

FUEL BUNDLE ASSEMBLY SUPPORT:
The individual active fuel bundle surround portions and the passive fuel bundles are supported and held in position by square vertical tubes that are attached to the steel frame located on the bottom of the primary sodium pool. The indicator tubes are attached to the top of the active fuel bundle control portions and are horizontally stabilized by the buoyancy of the indicator tubes and their surrounding steel floats. The fuel bundles mechanically clip to their nearest neighbours to provide assembly lateral stability.

The fuel bundles are repositioned and/or replaced from time to time using an overhead gantry crane and remote manipulation. Note that the ceiling height over the liquid sodium pond must be high enough to allow extraction and replacement of individual fuel bundles. Spent fuel bundles are lifted 3 m to clear the vertical square support tubes and are then moved horizontally to the reactor perimeter zone of the primary sodium pool where the irradiated fuel bundles are stored until they lose most of their fission product decay heat before being removed from the primary sodium pool.
 

EARTHQUAKE PROTECTION:
The FNR is designed to safely withstand earthquake induced horizontal acceleration of up to 1.0 g. At a sustained 1.0 g horizontal acceleration the surface of the liquid sodium could adopt an angle that is 45 degrees to the horizontal. Under these circumstances the liquid sodium height on one end of the pool could theoretically reach up to 25 m above the liquid sodium pool floor or 12.5 m above the normal liquid sodium surface. The gantry crane is located higher than this maximum liquid sodium height. The saw cut lava rock blocks forming the pool thermal insulation must have surrounding structural steel elements that firmly stabilize the lava rock blocks to the surrounding concrete walls and to upper level steel walls to prevent a structural failure in severe earthquake conditions. Hence the FNR fuel bundle can be thought of as being centrally located in a 12.5 m deep liquid sodium pool with a liquid sodium top surface which is 1 m below the pool deck.

The concrete walls surrounding the primary sodium pool are stabilized on the outside by earth/rock embankments with a one unit rise for each two horizontal units. These embankments should be drained at the bottom, should have grass growing on top with sets of concrete stairs. Rain should either run off the surface or should drain out via a sloped layer gravel near the bottom. Even if there is a violent earthquake causing a total pool rupture this embankment must contain the sodium and must prevent any rain or flood water reaching the sodium.
 

CHEMICAL THREAT:
The main chemical threat from a power FNR is the 5608 m^3 of liquid sodium contained in the primary sodium pool. If this liquid sodium contacts water there will be an explosive chemical reaction which liberates hydrogen that will spontaneously ignite in an air atmosphere. Hence one of the main issues in FNR design is choice of a reactor site where the sodium will NEVER be exposed to flood water.

The other main potential threat is a sodium fire. Quite apart from the release of Na2O and NaOH the big threat is melting of the fuel tubes leading to release of air borne plutonium and fission products. It is essential that the reactor be designed and sited such that a sodium fire cannot occur. In order to extinguish a sodium fire the oxygen concentration over the sodium must be minimized and heat must be extracted from the sodium. Under no circumstances can water be allowed anywhere near the sodium. Perhaps a high molecular weight inert gas such as radon, xenon, krypton could be used to extinguish a sodium fire. The key issue is to not have any fresh air flow that could blow the high molecular weight inert gas away.

The soil and bedrock around the liquid sodium pool must be sufficiently dry, dense and stable to safely contain the liquid sodium in the unlikely event that a major earthquake ruptures both the inner and outer stainless steel walls of the liquid sodium pool and crecks the enclosing concrete wall.

It is equally important that there be an effective non-water based fire suppression system. The local fire department must be trained that water should NEVER be used to fight a FNR fire. Inappropriate use of water carried by a fire truck could change a minor fire into a major disaster.

The other chemical threat is a spontaneous reaction between hot liquid sodium and air. To mitigate this threat the liquid sodium is covered by floating steel covers, an argon cover atmosphere, a gas tight suspended inner metal ceiling, and a gas tight suspended outer metal ceiling. In the event of air penetration into the argon cover gas the reactor should be immediately shut down and heat dumped from the primary liquid sodium pool to lower the primary liquid sodium temperatre below 200 degrees C, the threshold for spantaneous combustion of sodium in air. As this heat is dumped stored liquid argon must be evaporated to maintain the 1 atmosphere pressure in the argon cover gas.

Once the liquid sodium temperature is down to about 120 degrees C the surface of the liquid sodium can be flooded with a thin layer of low density oil to prevent the liquid sodium oxidizing during work such as roof repair or replacement of an intermediate heat exchange tube bundle.

Similarly if there is an enclosure roof failure the immediate objective is to extract heat from the sodium to reduce its temperature to the point where a mineral oil can be safely used to prevent sodium oxidation. Until the heat is removed from the sodium argon must be used to exclude oxygen from the sodium surface. That heat extraction might easily take half an hour, depending on the available cooling capacity. The fastest way to emergency cool the system is to directly vent steam from the steam generator discharges. It is important to have enough water in tank storage in or near the steam generator building to remove the fission product decay heat by latent heat of vaporization. Then the limiting factor is the maximum safe heat transfer capacity of the intermediate heat exchanger tube bundles and the steam generator tube bundles. If there is a FNR roof failure it is essential to prevent this steam condensing and falling onto the exposed liquid sodium surface. This issue highlights the importance of FNR enclosure ceiling integrity.
 

FNR SITE SELECTION:
The reactor must be sited at sufficient elevation above the maximum possible local flood level that the flood water level will never reach the liquid sodium level. However, sufficient cooling must be reliably available to provide certain removal of fission product decay heat. The soil, bedrock or embankment around the liquid sodium pool must be sufficiently dry, dense, thick and stable to safely contain the liquid sodium in the unlikely event that a major earthquake ruptures both the inner and outer stainless steel walls of the liquid sodium pool and crecks the enclosing concrete wall. Outside that containment there must be a dry embankment with a surface that ensures gravity drainage of water away from the sodium pool.

An ideal site for a FNR is a dense igneous rock plateau that drops off quickly to a lake or ocean with a high water mark over 20 m below the plateau grade. The lake or ocean provides the required water for emergency evaporative cooling. The lake or ocean bottom depth should be sufficient to prevent silt and/or sand being sucked into the cooling water makeup system. The sodium pool elevation above the water level must be sufficient that no natural geophysical event will ever lead to water threatening the stored sodium. Channels or tunnels can be cut into the bedrock surrounding the FNR to ensure positive gravity drainage. The plateau should provide sufficient area for a FNR, sodium storage, water storage, steam generators, turbogenerators, condensers, two dry cooling towers and transformer/switchyard facilities.

Note that the elevation of a FNR with respect to a nearby major water body is much higher than the elevation of a CANDU reactor that uses direct lake or sea water cooling. Thus Fukushima Daiichi like problems that might be caused by a tsunami or a comparable flood mechanism are avoided.
 

REACTOR ENCLOSURE:
The primary sodium pool must have a robust enclosure that reliably contains argon, contains gamma ray emissions, and excludes air and rain water, even under extreme storm conditions.

The space above the liquid sodium pool is filled with the inert gas argon which will not chemically react with either the liquid sodium or steel. This argon pressure is maintained at one atmosphere by an automatic feed system that does not rely on AC power. Fail safe argon space pressure control is essential for reactor enclosure structural integrity.

Floating on top of the liquid sodium are shallow draught square steel floats that reduce the exposed surface area of liquid sodium by about 99%. These floats have holes through them for the indicator tubes.

If at any time air leaks into the argon cover gas the immediate requirement is to lower the primary liquid sodium temperature below 200 C to prevent spontaneous sodium combustion.

If the reactor is to be shut down for an extended period the sodium surface should be covered with a light oil to prevent sodium oxidation. However, that oil still presents a fire hazard.
 

ROOF FUNCTIONS:
The primary function of the roof structure is to contain the argon cover gas and heat and to keep both rainwater and air away from the liquid sodium. The roof structure must be high enough above the liquid sodium pool to allow individual fuel bundle and intermediate heat exchange bundle replacement using a gantry crane. The roof structure must be gas tight and must reliably exclude both air and rain water under the most adverse circumstances, including violent storms (tornados), long term corrosion and deliberate aerial attack. There should be an inner metal ceiling, 1 m of thermal insulation, an outer metal ceiling, 1 m of ventilation space and an arched or A frame outer roof.
 

POTENTIAL AERIAL ATTACK:
If an imminent threat to the FNR from an air born object is detected the FNR should be immediately shut down and sufficient heat should be extracted from the primary liquid sodium pool to ensure that there will be no spontaneous combustion of sodium with air if there is a major roof failure.
 

INNER AND OUTER CEILINGS:
The inner ceiling is normally partially supported by the internal argon pressure, but should that support mechanism fail then the inner ceiling should be supported by hangers attached to the the outer ceiling and outer structural roof via thermal breaks. The inner ceiling is made from sheet stainless steel and normally operates at about 450 degrees C. On top of the inner ceiling is a 1 m thick layer of high temperature rated insulation so that the space between the outer metal ceiling and the structural roof is relatively cool. This space is normally cooled with forced air to enable service access to the ceiling mounted reactor monitoring system..
 

CONCRETE ROOF:
An arched concrete roof can be fabricated from precast arch shaped pieces. It must have sufficient strength to withstand an overhead tornado and to support the inner two metal ceilings. The upper surface of the concrete roof should have a protective membrane. It might be further sod covered so that the exact reactor position is difficult to visually pinpoint from an overhead aircraft.

Engineering a roof that can withstand a deliberate direct overhead air attack is one of the most difficult aspects of liquid sodium cooled FNR implementation. If such attacks become reality it may ultimately be necessary to locate FNRs deep underground to provide security against intentional overhead attack.

A reasonable compromise is to locate the liquid sodium pool for the new FNR such that in an emergency an argon gas cover can be maintained over the liquid sodium pool while a temporary roof is applied. In such circumstances the liquid sodium pool must be cooled below 200 degrees C and then covered with a low density oil to prevent spontaneous sodium combustion with air. Circumstances that might lead to such a roof failure include a direct bomb, missle or meteorite strike.

There should be a sufficiently large supply of liquified argon on-site to prevent sodium combustion while the sodium temperature is being reduced following a sudden major roof failure.

A 300 MWe FNR has 32 fully redundant heat removal systems. This level of redundancy provides protection in depth against loss of cooling failures.
 

RESERVE SODIUM POOL:
Sooner or later it will be necessary to do maintenance work on the primary sodium pool inner wall. To do such work it will be necessary to temporarily remove the primary liquid sodium from the primary sodium pool. Hence there must be nearby reserve sodium storage with sufficient capacity to hold the entire volume of the primary liquid sodium while the aforementioned maintenance work is being carried out. The reserve sodium storage must also accept hot fuel bundles transferred from the primary liquid sodium pool. A reserve pool can be located underneath each dry cooling tower. When not required for storing sodium the reserve pool can be used for storing emergency cooling water or as underground parking space.
 

INTERMEDIATE HEAT EXCHANGE BUNDLES:
Heat is removed from the FNR via intermediate heat exchange bundles. The heat exchange tubes have low pressure radioactive primary liquid sodium on the outside and have high pressure non-radioactive secondary liquid sodium on the inside. The high pressure secondary sodium exchanges heat to water in a steam generator. Thus, even if there is a heat exchanger or steam generator tube rupture there is no contact between radioactive sodium and the turbogenerator working fluid (clean water). There is further heat exchange isolation between the turbogenerator working fluid (clean water) and external cooling water.
 

COOLING TOWERS:
Normallly most of the reactor waste heat output from electricity generation is dumped to a water based district heating system. The discharge temperature of this water ranges from 80 degrees C in the summer to 120 degrees C in the winter. If the district heating load is larger than can be met with waste heat from enabled electricity generation the electricity generators can be additionally loaded by electric boilers that further heat the district heating water. If the district heating load is smaller than the waste heat from electricity generation the surplus heat is rejected via roof top fan coil units installed at the remote load locations. These remote fan coil units are powered via dedicated circuits that run along side the district heating pipes from the reactor location. Thus the remote building owner does not see the electricity load imposed by remote fan coil units that are operated for the benefit of the reactor owner rather than for the benefit of the building owner.

However, in the event of a loss of power at the reactor location this remote heat disposal methodology will cease operating because both the fans of the fan coil units and the circulation pumps of the district heating system will not operate. In these circumstances the reactor must be able to reject fission product decay heat at the reactor location using local natural draft cooling towers.

At the reactor site there must be at least two independent natural draft dry cooling towers. Each such cooling tower must be sized and piped to safely reject the fission product decay heat by natural circulation even if the other cooling tower is completely out of service. Assuming that both cooling towers remain in service the additional heat rejection capacity will enable system black start which will include energizing the district heating system circulating pumps and the remote fan coil units. Once there is remote heat rejection capacity the reactor power can be increased.

At the base of the local natural draft cooling towers are inward openning air admittance doors which are normally closed for energy conservation purposes but which are held closed by electromagnetic locks. On loss of electric power the electromagnetic locks release and the natural draft opens these doors allowing air flow through the cooling tower. When system power is restored maintenance personnel must manually close these doors to reduce the thermal load imposed by the cooling towers. The doors are fitted with closure sensing switches which trigger a maintenace alarm when the door opens.
 

This web page last updated March 30, 2018

Home Energy Nuclear Electricity Climate Change Lighting Control Contacts Links