Home Energy Physics Nuclear Power Electricity Climate Change Lighting Control Contacts Links


XYLENE POWER LTD.

FNR SAFETY

By Charles Rhodes, P.Eng., Ph.D.

INTRODUCTION:
Elsewhere on this website Small Modular Fast Neutron Reactors (SM-FNRs) have been identified as the only sustainable, reliable and economic solution to meeting mankind's energy and power requirements. This web page focuses on SM-FNR design parameters that are necessary to achieve inherent safety. SM-FNRs must be designed so that they can be safely installed, operated and maintained at high density urban sites and in small towns where there is limited availability of skilled personnel.

In normal SM-FNR operation there is seldom any cause for maintenance personnel to enter the SM-FNR enclosure. The SM-FNRs operate automatically, can be remotely monitored and can be partially or entirely shut down via safety system control, local control or remote control.
 

ENGINEERED LIFE SAFETY SYSTEMS:
Engineered nuclear reactor safety shutdown systems operate on the principle that there are two fully redundant safety shutdown systems, either of which will cause a reactor shutdown. These two systems are backed up by physical barriers. In each safety shutdown system there are at least three independent life safety control devices. To cause a hazard to the public both safety systems and the physical barriers must simultaneously fail. For a safety system to fail all three safety control devices must fail simultaneously. To cause a hazard to service personnel maintaining or testing one safety system the other safety system must simultaneously fail.

Generally there is a requirement for service personnel to physically confirm the proper operation of each safety device at least once per year. Provided that these annual checks are performed and if necessary the safety devices are repaired or replaced, the probability of three simultaneous safety device failures is extremely remote and the probability of both safety systems failing simultaneously is microscopic.
 

CRITICAL FNR SAFETY SYSTEMS:
There are five conditions that must be maintained in FNRs for public safety in an urban environment:
a) Certain nuclear reaction shutdown;
b) Certain liquid sodium level maintenance;
c) Certain fission product decay heat removal;
d) Certain temperature setpoint constraint;
e) Certain avoidance of prompt neutron criticality.

The FNR described herein has three completely redundant methods of ensuring compliance with each of these five conditions.

In the case of (a) there are three independent means of stopping the nuclear reaction.

In the case of (b) there are three independent sodium containment barriers, any one of which can safely maintain the liquid sodium level.

In the case of (c) there are at least three independent passive heat removal systems any one of which can reliably and safely remove the fission product decay heat.

In the case of (d) for each safety shutdown system there are independent mechanical and electronic constraints on the temperature setpoint and its rate of change. There are also independent position, temperature and gamma ray sensors that via an independent control can over ride other setpoiint control signals to force a reactor cold shutdown.

In the case of (e) the fuel bundle geometry is mechanically stable. The working temperature of each active fuel bundle is kept sufficiently low that its geometry cannot become unstable via fuel melting due to the large temperature difference between the fuel operating temperature and the fuel melting temperature. The change in core zone reactivity with a change in temperature is negative which prevents the local reactivity growth into the zone of prompt neutron criticality. The insertion rate of each active fuel bundle control portion is both physically and electronically limited, again to prevent approach to prompt neutron criticality. Liquid sodium boiling in the core zone is prevented by the liquid sodium static head. Formation of sodium bubbles or other turbulence in an active fuel bundle chimney warns of severe local overheating in the core zone.

For public safety each of the above mentioned systems should be continuously monitored and periodically tested to ensure that it will function as designed if required. Complete functionality of the safety systems is an essential condition for safe unattended FNR operation.
 

NON-NUCLEAR MAINTENANCE:
On-site personnel are required to do periodic routine non-nuclear preventive maintenance on the steam generators, turbo-generators, condensers, cooling towers and related mechanical and electrical equipment and to make repairs as necessary. However, this equipment does not involve any radioactivity. There is sufficient redundancy in the equipment that some of the heat transport systems can be shut down for maintenance or repair while others remain in operation. Thus the only reasons for keeping staff on the reactor site 24/7 is compliance with steam power plant regulations and maintenance of site security.
 

FNR DESCRIPTION:
The term Fast Neutron Reactor (FNR) is generically quite broad. For the purpose of this web site the definition of an FNR is narrowed to be a fast neutron reactor with metallic fuel rods, sealed metal fuel tubes and liquid sodium primary and intermediate coolants. A 1000 MWt FNR has a core region 0.35 m high X 11.2 m diameter that is surrounded above, below and on the perimeter by a blanket region 1.2 m thick and a active fuel bundle cooling region 0.4 m thick.

The blanket region and cooling region are further surrounded by a 2.4 m thick layer of liquid sodium which absorbs any neutrons that escape from the blanket and cooling regions.

The central core region together with the top and bottom blanket regions involve 640 vertical active fuel bundles. Each fuel bundle is 0.4 m long X 0.4 m wide X 6.0 m high and is supported by 3 m high legs (corner girder extensions on the fuel bundle bottoms). Each active fuel bundle has a removeable 3 m tall chimney and a 7.5 m tall indicator tube. Each active fuel bundle has a vertically sliding central control portion and a fixed position surround portion. The central control portion is inserted into the surround portion from the bottom. Insertion distance is set using a liquid sodium hydraulic piston actuator. The indicator tube projects above the primary liquid sodium surface to indicate the actual vertical position of the fuel bundle central control portion. This vertical position is constantly monitored using an overhead device similar to a laser measuring tape.

The reactor core region is surrounded on its outer perimeter by a 1.2 m thick blanket formed from 3 rows of vertical passive fuel bundles.

There is an outer ring of spent fuel bundles in which natural decay of fission products occurs over a six year period before the fuel bundles are removed from the primary liquid sodium.

For a 1000 MWt FNR the active fuel bundles are centrally positioned in a 21 m diameter X 15.5 m deep liquid sodium pool. The region 2.8 m wide at the edge the liquid sodium pool is dedicated to intermediate heat exchange bundles and a service access corridor. The service access corridor also forms part of the sodium guard band.
 

NORMAL CHAIN REACTION CONTROL:
In normal FNR operation the chain reaction is controlled by thermal expansion of the liquid sodium and fuel bundles. The liquid sodium temperature in effect controls the fraction of fission neutrons that escape from the reactor core zone into the reactor blanket zone. As that fraction increases the reactor power decreases and vice versa.
 

COLD SHUTDOWN CONTROL:
There are two other completely redundant nuclear reaction shutdown systems. These systems operate by gravity withdrawal of every second active fuel bundle control portion in a chequer board pattern. Hence in total there are three independent nuclear reaction shutdown systems.
 

LIQUID SODIUM CONTAINMENT:
There is an inner steel enclosure, an outer steel enclosure and a concrete enclosure. As long as at least one of these enclosures maintains its physical integrity the liquid sodium will be sufficiently contained to maintain its minimum required level for safety and fission product decay heat removal following FNR shutdown.
 

FISSION PRODUCT DECAY HEAT REMOVAL:
Fission product decay can produce heat at a peak rate equivalent to about 10% of a nuclear reactor's full power rating, even after the nuclear chain reaction is off. Hence there must be certainty about passive removal of this heat. A FNR has multiple independent heat transport systems, proper operation of 10% of which is sufficient for safe fission product decay heat removal. In the event of loss of station power fission product decay heat removal should be achieved by natural sodium circulation with just half of the heat transport systems in service. During normal reactor operation no more than one quarter of the heat transport systems may be simultaneously taken out of service for maintenance or repair. In order to meet these requirements at least 20% of the intermediate heat exchange tube length must always be immersed in liquid sodium. This condition effectively imposes geometrical constraints on the FNR facility design.
 

SAFETY ADVANTAGES OF FNRs AS COMPARED TO WATER COOLED REACTORS:
Liquid sodium cooled FNRs inherently provide several major safety advantages as compared to water cooled reactors. At a pressure of one atmosphere water boils at 100 degrees C, a temperature far below the water cooled reactor maximum operating temperature of 320 degrees C. Sodium at a pressure of one atmosphere boils at 883 degrees C, a temperature far above the FNR maximum operating temperature of 450 degrees C. This difference in boiling point relative to reactor operating temperature has important implications.

1) If water is used as a reactor coolant any coolant leak will flash into radioactive steam. In an accident situation this steam cannot be safely vented to the atmosphere at an urban reactor site. Liquid sodium cooled FNRs avoid this problem by use of low pressure liquid sodium as the primary coolant. The primary liquid sodium is isolated from the turbo-generator working fluid steam by two separate heat exchangers. Thus there is no radiotoxicity hazard in venting turbo-generator steam to the atmosphere.

2) Water cooled reactors have a potentially dangerous condition known as transient void formation in which when the coolant pressure drops steam bubbles form in the reactor fuel tubes. These steam bubbles reduce the heat transfer capacity and reduce the reactor reactivity. To compensate for the reduced reactor reactivity the water cooled reactor power control system may automatically withdraw control rods to maintain the desired power setpoint. Then if the cooling feedwater temperature suddenly drops or the cooling water pressure is restored the steam voids can rapidly collapse leading to a reactor explosion due to prompt neutron criticality. The causes of void formation include coolant circulation failure or coolant pressure drop due to a pipe rupture, a pump failure or a loss of pump power. By contrast the contemplated FNRs rely on natural circulation of low pressure primary liquid sodium which has a boiling point about 430 degrees C above the maximum liquid sodium operating temperature. Hence in a liquid sodium cooled FNR there is no issue of transient void formation and there are no mechanically operated control rods and the related potential safety problems.

3) Water cooled reactors rely on a mechanical movement of control rods to control the reactor power. This control system has many possible failure modes. This control system must constantly operate because water cooled reactors are inherently unstable. Absent operation of the mechanical control system the reactor power would spontaneously rise or fall. By contrast in a FNR thermal expansion and contraction of the primary liquid sodium provides stable passive primary liquid sodium temperature control.

The FNR fuel geometry is chosen such that void formation in the liquid sodium will stop the nuclear chain reaction, regardless of the amount of insertion of the active fuel bundle control portion into its surround portion.

4) During severe accident conditions water cooled reactors vent radioactive gases to the atmosphere. By contrast in FNRs the only radioactive gases present remain locked inside sealed fuel tubes.

5) Most existing water cooled power reactors rely on mechanical pumps for primary coolant circulation. Loss of coolant or loss of coolant pumping are constant and potentially dangerous threats. By contrast the FNR designs contemplated herein use highly reliable natural sodium circulation for primary cooling.

6) Most existing water cooled power reactors rely on use of concrete casks for on-site dry storage of spent fuel bundles. By contrast on removal from the reactor spent fuel bundles from FNRs are placed in lead shipping containers and are transported to a central fuel reprocessing site.

7) Water cooled reactors generate large amounts of spent fuel containing highly radiotoxic transuranium actinides. By contrast FNRs fission transuranium actinides to dispose of them.

8) Existing water cooled reactors generate large amounts of sevice and decommissioniong waste. By contrast each FNR contemplated herein is fitted with a liquid sodium guard band that which eliminates production of service and decommissioning wastes. In the event of a fuel tube rupture the primary sodium filter system will collect fuel and fission product material that should be fed into the fuel reprocessing material stream.

9) Water cooled reactors rely on complex electro-mechanical control systems to keep the reactor fuel and fuel tube temperatures within design limits. By contrast in a FNR the fuel and fuel tube temperatures are constrained by simple thermal expansion of the liquid sodium. At full load the FNR fuel tube heat flux is limited by the maximum intermediate liquid sodium flow rate.
 

PHYSICAL STABILITY:
As in all nuclear reactors, during FNR operation physical stability of the reacting fuel geometry is essential. In all nuclear fission reactors a rapid increase in core reactivity can potentially lead to an explosive condition known as prompt neutron criticality. In the FNR design discussed herein gravitional forces and sodium voids tend to reduce reactor criticality. The fuel tube melting point is much greater than the temperature at which primary sodium voids can form. Formation of primary sodium voids causes a chain reaction shutdown. The reactor is designed so that rapid insertion of the FNR active fuel bundle control portions is both mechanically and electronically prevented because such a rapid insertion might in theory cause a transient increase in reactivity sufficient for prompt neutron criticality. However, rapid withdrawal of the active fuel bundle control portions is permitted for reactor cold shutdown.

To ensure control stability both the active fuel bundle control portion insertion rate and withdrawal rate are normally mechanical orifice limited. Active fuel bundle control portion insertion is not used for reactor power control. Reactor cold shutdowns use separate full port hydraulic valves to enable rapid active fuel bundle control portion withdrawal.

Each fuel bundle physically clips to its four nearest neighbour fuel bundles for top horizontal position stability. Outside the assembly of fuel bundles there is a steel frame with diagonal reinforcing elements that provides the fuel assembly structural stability while the reactor is in operation. The diagonal elements prevent the entire assembly of fuel bundles from leaning, especially during or after a severe earthquake. This steel frame must be partially disassembled to allow exchange of individual fuel bundles, at which time the reactor is in cold shut down.
 

FEW MOVING PARTS:
Much of the inherent safety of an FNR is due to absence of mechanical moving parts. The fuel bundles simply sit motionless in a pool of liquid sodium. Thermal expansion and contraction adjusts the reactor thermal power to maintain the desired liquid sodium temperature. Under thermal load the liquid sodium naturally circulates. When there is no thermal load the natural circulation stops which causes the fission chain reaction to stop. When the thermal load is restored natural circulation recommences and the fission chain reaction restarts. In normal reactor operation the control portions of the active fuel bundles remain in fixed positions. The only mechanical moving parts in the reactor enclosure are the primary liquid sodium filter pump impeller, the hydraulic liquid sodium pressure maintenance pump and occasionally the hydraulic actuator sodium flow control valves. These valves operate by gravity and by argon pressure. The argon pressure transducers are located outside the reactor enclosure. Loss of argon pressure causes a reactor shutdown.

The intermediate sodium receives a circulation assist from electric induction pumps that are located outside the reactor enclosure. If there is a loss of intermediate sodium level or intermediate sodium pressure in a particular heat transport system that entire heat transport sytem is automatically shut down.
 

ACTIVE FUEL BUNDLE CONTROL PORTION POSITIONING SYSTEM:
Each active fuel bundle contains an interior sliding control portion moved by a dedicated liquid sodium hydraulic piston actuator. Thus an actuator jam or an active fuel bundle control portion slide jam does not physically affect the adjacent fuel bundles except via a changed neutron flux in the horizontal plane.

The active fuel bundle control portion positioning actuators rely on a common liquid sodium hydraulic pressure pump that will run occasionally due to small leaks past the hydraulic actuator pistons. This pump is submerged to maintain suction head but its motor is above the primary sodium pool and is cooled with flowing argon. If this pump fails the active fuel bundle control portion actuators will gradually lose pressure causing the active fuel bundle control portions to withdraw due to gravity and thus cause a reactor shut down.
 

ACTIVE FUEL BUNDLE CONTROL PORTION INSERTION RATE:
The active fuel bundle control portion positioning system must be robust and extremely reliable and the rate of insertion of the control portions must be limited.

A situation that must be avoided is rapid insertion of an active fuel bundle control portion into its corresponding surround portion which could potentially lead to fuel bundle overheating, fuel melting, sodium void formation and possibly even prompt neutron criticality. Hence the rate of insertion of the active fuel bundle control portions must be limited by both hardware and software.

To avoid potential problems related to rapid control portion insertion orifices on the hydraulic actuator control valves limit the active fuel bundle control portion insertion rate. If the reactor monitoring system detects that an active fuel bundle control portion insertion is either too deep or too fast or if the gamma / neutron flux from a fuel bundle is too high or if the fuel bundle discharge temperature is too high the reactor safety system causes redundant full port drain valves to open causing rapid withdrawal of the relevant active fuel bundle control portion. Simultaneously the hydraulic liquid sodium flow to the relevant control portion positioning actuators is turned off.

As an additional safety measure if the position of an active fuel bundle control portion fails to respond to position control signals or if the emitted gamma flux is too high or if the active fuel bundle discharge temperature is too high then the reactor control computer automatically causes withdrawal of the surrounding nearest neighbor active fuel bundle control portions to force the non-responsive fuel bundle into a sub-critical state.
 

CONTROL SYSTEM DETAILS:
The active fuel bundle control portion insertion rate is limited to prevent the reactor going critical on prompt neutrons before thermal expansion of the liquid sodium temperature has had time to fully respond to the increased reactor power level. The active fuel bundle control portion must not be inserted so far into the corresponding surround portion that thermal expansion of the liquid sodium cannot stop the fission chain reaction at an acceptable fuel temperature.

The indicator tube height sensor must have good resolution with negligible hysterisis. The corresponding fuel bundle power is rapidly indicated by the strength of the gamma / neutron radiation propagating up that indicator tube. The fuel bundle discharge temperature should respond to a change in gamma /neutron flux with some time lag. If either a fuel bundle gamma / neutron signal or a fuel bundle discharge temperature is too large the active fuel bundle control portion insertion must be immediately reduced. Failure of the fuel bundle discharge temperature to track either the gamma / neutron signal or the indicator tube height indicates an equipment problem. That fuel bundle should be locked out of service until the cause of the problem is determined and rectified.

The normally used actuator valves for each fuel bundle control portion position have three states: add high pressure hydraulic sodium via a small orifice, close, and drain hydraulic sodium via a small orifice. Most of the time the actuator valves should be in the closed state. If the actuator valves spend too much time in the add sodium state it may indicate a control portion positioning actuator sliding seal leak or a drain valve seal failure. If the drain valve keeps reopenning it may indicate a seal problem with the actuator fill valve.

In addition to the two orifice restricted actuator position control valves for each active fuel bundle there is a full port shutdown valve which rapidly drains liquid sodium from the hydraulic actuator causing rapid withdrawal of the active fuel bundle control portion from the fixed surround portion. On loss of argon pressure this full port valve causes an immediate fuel bundle shutdown.
 

FUEL BUNDLE SAFETY ENGINEERING:
The FNR control system assumes that the core rods in a particular fuel bundle all behave the same way. Hence during fuel rod production it is important that 100% of the core rods come from the same alloy batch or be individually scanned to check that their alloy mix meets design specifications.

The FNR control system assumes that all the liquid sodium cooling channels in a fuel bundle are open. Hence it is essential that the liquid sodium be sufficiently filtered to eliminate particulate matter that over time might obstruct the liquid sodium cooling channels. Each fuel bundle has sufficient cross flow to tolerate a few isolated blocked liquid sodium cooling channels but the fuel bundle cannot tolerate a large cluster of blocked liquid sodium cooling channels. Of particular concern are carbon, boron, beryllium, oxygen and fluorine based particulate compounds that might potentially float or be nearly neutrally buoyant in liquid sodiuum. Denser particulate species will naturally settle to the bottom of the liquid sodium pool where they will be caught by the primary sodium pool filter.

For additional certainty each active fuel bundle has its own dedicated Vee liquid sodium entrance filters. Behind the filters is a cross channel that ensures proper fuel bundle operation even if half of a Vee filter is blocked.

In normal FNR operation the minimum temperature of the primary sodium is kept above 330 C to prevent formation of solid NaOH which might potentially deposit on heat exchange surfaces to reduce heat transfer or might obstruct the liquid sodium coolant flow.

The active fuel bundles are designed so that they rely on their nearest neighbors for operation. If the position of an active fuel bundle control portion fails to respond to control signals that fuel bundle can be shut down by shutting down its nearest neighbours. This reactor feature allows implementation of two completely redundant reactor emergency shutdown systems.
 

THERMAL POWER CONTROL:
Normal thermal power control in a FNR is achieved by thermal expansion of the liquid sodium and the active fuel bundles. The amount of insertion of a fuel bundle control portion into its surround portion determines the fuel bundle discharge temperature. As the fuel bundle liquid sodium inlet temperature drops below the discharge temperature setpoint the fuel bundle thermal power increases. However, care must be taken because under a heavy thermal load the fuel and fuel tube temperatures could potentially exceed their material ratings. On reactor turn-on the discharge temperature setpoint must be raised slowly over about a half hour time period so that the discharge temperature setpoint does not exceed the inlet temperature by more than 100 degrees C.

Once the reactor reaches normal operating conditions the reactor thermal power is controlled by varying the secondary sodium flow rate. Under these circumstances the role of thermal expansion of the primary liquid sodium is to keep the active fuel bundle discharge temperature in the range 440 degrees C to 450 degrees C.

The reactor thermal output power is sensed via the intermediate sodium temperature differential and intermediate sodium flow rate. It is important to keep the reactor thermal output power below its design maximum to prevent damage to the fuel tubes.
 

REACTOR SHUTDOWN:
Active fuel bundle control portions are withdrawn to achieve a reactor cold shutdown. On loss of control argon pressure all the active fuel bundle control portion full port actuator drain valves open and gravity causes the active fuel bundle control portions to withdraw from the fuel bundle surround portions. Under these circumstances the primary liquid sodium pool will gradually cool and argon in bladder tanks must be automatically fed into the reactor space to maintain one atmosphere of argon pressure in that space. Otherwise the integrity of the reactor enclosure may be threatened by the decrease in argon pressure as the primary sodium temperature decreases.
 

SAFETY MONITORING:
If the gamma flux for a particular fuel bundle exceeds specification, indicating potential fuel bundle over heating, that fuel bundle should be immediately shut down.

If a fuel bundle discharge temperature gets too high, indicating fuel bundle overheating, that fuel bundle should be immediately shut down.

If an indicator tube top rises too high, indicating a potential active fuel bundle control portion positioning system problem that fuel bundle should be immediately shut down.
 

REDUNDANT SHUTDOWN SYSTEMS:
For safety purposes each active fuel bundle must remain subcritical when its control portion is fully inserted but the four nearest neighbor active fuel bundle control portions are all withdrawn. This feature ensures an immediate safe reactor cold shutdown in the presence of a single active fuel bundle control portion jam or actuator failure. Note that under this criteria the thermal power output from the outer ring of active fuel bundles may be relatively small. For each member of this active fuel bundle outer ring at least one of the nearest neighbor active fuel bundles is already missing.

Reactor safety is further improved by requiring that the reactor will fully shut down even if two adjacent fuel bundle control portions jam in the full power position. The core portion of each fuel bundle can be regarded as cube 0.4 m to a side. In normal full power reactor operation neutrons are lost from 2 faces of this cube for centrally located fuel bundles and neutrons are lost from 3 or 4 faces of the cube for active fuel bundles that are members of the perimeter ring. To ensure reactor shutdown with two adjacent jammed active fuel bundle control portions a fuel bundle must shut down if neutrons are lost from either 6 or 5 cube faces. Hence the reactor should be fuelled such that when the active fuel bundle contol portions are inserted the the fuel bundle shutdown threshold is at neutron loss through 4 cube faces. In reality the fuel mix will change through the operating life of a fuel bundle, so to achieve a higher safety margin it is necessary to reduce the shutdown threshold for interior fuel bundles from 4 faces of neutron loss to 3 faces of neutron loss.

If an active fuel bundle control portion jams such that it will not withdraw due to gravity the overhead gantry crane can either push down the corresponding indicator tube to release the jammed control portion. If there is a jam in either the hydraulic actuator or the active fuel bundle control portion the fuel bundle should be shut down and the problem fuel bundle replaced at the next opportunity.

The individual fuel bundles are engineered such that when they are outside the reactor environment they remain sub-critical regardless of the insertion of the active fuel bundle control portion. When the fuel bundle assembly is formed with the active fuel bundle control portions withdrawn the reactor must always be sub-critical. When all of the active fuel bundle control portions are fully inserted the reactor should operate at or above its maximum rated power. As a fuel bundle reaches its design operating temperature thermal expansion of the primary liquid sodium and the fuel bundle materials should cause the fuel bundle reactivity to drop below criticality.

The fuel bundle discharge temperature distribution is monitored with an overhead scanner. In normal full power operation the discharge temperatures should be uniformly at 440 degrees C. As the reactors thermal load decreases the fuel bundle discharge temperature should rise to about 450 C at which point the reactor should become subcritical.

In normal operation the active fuel bundle control portion vertical position setpoint is adjusted so that at full rated reactor power the gamma / neutron outputs from every interior active fuel bundle are identical. This state corresponds to uniform thermal power loading of the active fuel bundles that are inside the outer ring of active fuel bundles.

The vertical position of an active fuel bundle control portion is indicated by the height of the top of its indicator tube. In normal reactor operation the vertical position setpoints of the indicator tubes should be nearly identical.

As the reactor thermal load varies the gamma flux varies for all the active fuel bundles.

The fuel bundles are engineered to allow sufficient lateral liquid sodium flow to provide the cooling required to prevent fuel and fuel tube damage if an isolated cooling channel becomes blocked.

A liquid sodium flow obstruction will cause a primary sodium flow decrease and hence a corresponding decrease in gamma / neutron flux as compared to neighboring fuel bundles. If a relative decrease in gamma/neutron flux is detected that fuel bundle's control portion should be withdrawn until the cause of the abnormally low gamma / neutron flux is identified and remedied and/or the faulty fuel bundle is replaced.

Unlike the EBR-2 the fuel tubes are in a square array instead of a hexagonal array. The square array is more tolerant of fuel tube swelling and allows use of fuel bundle cross rods to stabilize the positions of the individual fuel tubes.

The height of each indicator tube is sensed by a laser scanner. The fuel bundle gamma / neutron emission is sensed by an overhead thermally isolated and cooled radiation monitoring apparatus. The discharge temperature of each fuel bundle is derived from the indicator tube internal vapor pressure which is also monitored with a laser scanner.
 

TWO INDEPENDENT SAFETY SHUTDOWN SYSTEMS:
In plan view the active fuel bundles can be divided into two groups, a "red" group and a "black" group as on a checker board. Each "red" active fuel bundle has four surrounding "black" active fuel bundles. Each "black" active fuel bundle has four surrounding "red" fuel bundles. Neutrons in the core region flow in three dimensions. Hence shut down of either all the "red" active fuel bundles or all the "black" active fuel bundles shuts down the entire reactor. Hence there are two independent reactor shutdown systems, one of which shuts down all the "red" active fuel bundles and the other which shuts down all the "black" active fuel bundles. For reactor service both groups of active fuel bundles are shut down.

Reliable operation of these two independent shutdown systems may impose constraints on the FNR core rod fuel alloy mix and hence on the FNR core rod fuel reprocessing cycle time.

Reliable operation of the two independent safety shutdown systems may also require that the thermal power production by the outer ring of active fuel bundles be reduced.

The safety shutdown of each fuel bundle is accomplished by removing argon control pressure from a normally open full port actuator drain valve. When this argon pressure is removed the valve opens rapidly draining liquid sodium from the active fuel bundle control portion actuator.
 

REACTOR PRIMARY AND INTERMEDIATE COOLANTS:
The reactor primary and intermediate coolants are both pure liquid sodium. A Na-K mixture is specifically excluded. A Na-K mixture offers superficial advantages in terms of melting point. However, in a power reactor the presence of potassium in the primary sodium leads to formation of K-40 which has a half life of 1.26 X 10^9 years. If there are many such power reactors operating for many years K-40 will become an increasing environmental problem. The best solution to this problem is to not produce K-40 in the first place. Hence the primary coolant should be pure sodium.

The intermediate coolant circuits will operate until something fails, likely an intermediate heat exchange bundle or a steam generator tube. In an intermediate heat exchange bundle failure secondary coolant will mix with the primary coolant. Hence to keep potassium out of the primary coolant the secondary coolant must also be pure sodium.
 

REACTOR THERMAL POWER:
The reactor thermal output power is sensed via the secondary sodium temperature differential and secondary sodium flow rate. It is important to keep the reactor thermal output power below its design maximum to prevent damage to the active fuel tubes.
 

REACTOR FUEL:
The FNR core fuel rods are primarily metalic U-238 with Pu-239 and 10% zirconium alloyed with it. The purpose of the zirconium is to prevent formation of a fuel tube low melting point plutonium-iron eutectic. The purpose of the Pu-239 is to drive the nuclear reaction. The purpose of the U-238 is to capture neutrons to breed more Pu-239 The core rods are enclosed in HT-9 steel fuel tubes. The core rod diameter is intentionally only about 86% of the initial HT-9 steel tube ID to allow for core rod swelling due to internal formation of gaseous fission products. Inside the HT-9 steel tubes, along with the fuel rods is liquid sodium, which provides good thermal contact between the fuel rods and the fuel tubes and which chemically absorbs the potentially corrosive nuclear fission products fluorine, chlorine, bromine and iodine. The HT-9 steel tube plenum volume above the fuel and blanket rods contains sufficient extra sodium to compensate for eventual fuel tube swelling and provides sufficient empty volume to allow for volumetric expansion of the fuel rods and to allow for sealed containment of inert gaseous fission products at allowable pressures. Another important role of the long fuel tubes is to act as chimneys that enhance primary sodium natural circulation.
 

PRIMARY SODIUM THERMAL POWER CONTROL:
As the primary liquid sodium temperature increases its density decreases, taking the reactor core zone reactivity below its critical point. Then the only significant heat produced is fission product decay heat. Provided that there is adequate decay heat removal at a low thermal load the reactor temperature will stabilize at its maximum rated temperature of 450 degrees C. As heat in excess of fission product decay heat is removed from the primary liquid sodium the primary sodium pool temperature decreases increasing the primary sodium density. This density increase restores reactor criticality and raises reactor power. The reactor can be shut down and cooled off by withdrawal of its active fuel bundle control portions.
 

FISSION PRODUCT DECAY HEAT REMOVAL:
One of the most important aspects of fission reactor design is provision for fission product decay heat removal under extremely adverse circumstances. If some event occurs which causes a reactor shutdown the fission products will continue to produce decay heat at about 5% of the reactor's full power rating. It is essential to have a 100% reliable means of ensuring ongoing removal of the fission product decay heat under accident conditions such as shortly after a severe earthquake.

In the case of a liquid sodium cooled FNR all heat removal is via primary liquid sodium, so it is essential that:
1) Under no circumstances will the primary liquid sodium level ever fall to the point that the fuel rods are not fully immersed in liquid sodium or where thermal contact with the intermediate heat exchange bundles is lost.
2) The liquid sodium pool walls must be designed such that if the inner wall fails and the primary liquid sodium leaks into the space between the inner and outer pool walls, the leakage into the space between the two walls will not lower the primary liquid sodium level below the tops of the fuel rods or below the intermediate heat exchange bundle tubes. Ideally this condition should also be met if the outer steel wall also fails. This condition restricts the volume of the air space around the reactor. Viewed another way this condition sets a minimum on the reactor size if reasonable service access clearances are to be maintained and if double wall failures are required to be tolerated.
3) Even if the intermediate loop sodium pumps fail there must be enough secondary liquid sodium natural circulation to ensure safe removal of the fission product decay heat.
4) The secondary liquid sodium dumps its heat into steam generators. Hence on a reactor shutdown the pressure in the steam generators must be released so that the system that injects water into the steam generators does not face a pressure load.
5) There must be enough clean water in storage, above the elevation of the steam generators, such that the steam generators can be gravity fed and the fission product decay heat can be removed by evaporating that water and condensing the resulting steam in the cooling towers.
 

FUEL MELTDOWN:
An FNR designed for utility electric power production typically has 640 active fuel bundles. Sooner or later through accident, negligence or malevolent behavior there will be a defective active fuel bundle and/or a defective active fuel bundle control portion positioning apparatus. In these circumstances the major concern is fuel melting. In response to local overheating the control portions of the adjacent fuel bundles must be immediately withdrawn to ensure shutdown of the defective fuel bundle.

If fuel melting occurs fuel alloy droplets might collect on the primary liquid sodium pond floor under the fuel tube assembly. It is essential that these droplets do not accumulate together to form a critical mass. The primary liquid sodium pool floor must have a liner of a neutron absorbing material that is geometrically shaped to prevent molten fuel forming a critical mass. There should also be a practical means of selectively removing and replacing sections of the primary liquid sodium pool floor liner.
 

PRIMARY LIQUID SODIUM FLOW:
The hot liquid sodium will naturally circulate vertically up through the reactor between the active fuel tubes, up through the fuel bundle chimney, horizontally along the top of the primary liquid sodium pool, down between the vertical intermediate heat exchange tubes, down to the bottom of the primary sodium pool and then horizontally along the bottom of the primary liquid sodium pool back to below the reactor.
 

REACTOR SHUT DOWN CONTROL:
Each active fuel bundle control portion has associated with it an actuator that vertically positions the control portion based on the indicator tube vertical position with respect to its position setpoint. The actuator piston moves in response to liquid sodium hydraulic pressure. If a problem is detected the liquid sodium hydraulic pressure falls to zero and the fuel bundle control portion withdraws due to gravity causing a fuel bundle shutdown.
 

REACTOR MONITORING ELECTRONICS:
A FNR is controlled by several micro-computers. The main function of these computers is to safely maintain the desired fuel bundle discharge temperature setpoint and to trigger fuel bundle or entire reactor shutdowns if any significant out-of-normal condition is detected. The monitoring software must include hardware watchdogs that can detect any significant problems within the reactor monitoring system and the reactor fuel bundle discharge temperature control systems. If any such problems are detected the reactor control must either shift to a fully redundant electronic monitoring and control system or trigger a reactor shutdown.
 

SECONDARY LIQUID SODIUM FLOW:
The steam generators are located at an elevation higher than the reactor and on the return side of the intermediate sodium loop so that the intermediate sodium will natuarally circulate even if the intermediate sodium induction type circulation pump loses power. The equipment should be sized so that the natural circulation rate is sufficient to safely remove fission product decay heat after the reactor is shut down.
 

FUEL BUNDLE ASSEMBLY SUPPORT:
The individual active fuel bundle surround portions and the passive fuel bundles are supported and held in position by square vertical tubes that are attached to the steel frame located on the bottom of the primary sodium pool. The indicator tubes are attached to the top of the active fuel bundle control portions and are horizontally stabilized by the buoyancy of the indicator tubes and their surrounding steel floats. The fuel bundles mechanically clip to their nearest neighbours to provide assembly lateral stability.

The fuel bundles are repositioned and/or replaced from time to time using an overhead gantry crane and remote manipulation. Note that at the air locks the ceiling height must be sufficient to allow extraction and replacement of individual fuel bundles. During the removal process spent fuel bundles are lifted 3 m to clear the vertical square support tubes and then are then moved horizontally to the reactor perimeter zone of the primary sodium pool where the irradiated fuel bundles are stored until they lose most of their fission product decay heat before being removed from the primary sodium pool.
 

EARTHQUAKE PROTECTION:
The FNR is designed to safely withstand earthquake induced horizontal acceleration of up to 1.0 g. At a sustained 1.0 g horizontal acceleration the surface of the liquid sodium could adopt an angle that is 45 degrees to the horizontal. Under these circumstances the liquid sodium height on one edge of the pool could theoretically reach up to 10.5 m above the normal liquid sodium surface. FIX FROM HERE The gantry crane is located higher than this maximum liquid sodium height. The saw cut lava rock blocks forming the pool thermal insulation must have surrounding structural steel elements that firmly stabilize the lava rock blocks to the surrounding concrete walls and to upper level steel walls to prevent a structural failure in severe earthquake conditions. Hence the FNR fuel bundle can be thought of as being centrally located in a 12.5 m deep liquid sodium pool with a liquid sodium top surface which is 1 m below the pool deck.

The concrete walls surrounding the primary sodium pool are stabilized on the outside by earth/rock embankments with a one unit rise for each two horizontal units. These embankments should be drained at the bottom, should have grass growing on top with sets of concrete stairs. Rain should either run off the surface or should drain out via a sloped layer gravel near the bottom. Even if there is a violent earthquake causing a total pool rupture this embankment must contain the sodium and must prevent any rain or flood water reaching the sodium.
 

CHEMICAL THREAT:
The main chemical threat from a power FNR is the 4900 m^3 of liquid sodium contained in the primary sodium pool. If this liquid sodium contacts water there will be an explosive chemical reaction which liberates hydrogen that will spontaneously ignite in an air atmosphere. Hence one of the main issues in FNR design is choice of a reactor site where the sodium will NEVER be exposed to flood water.

The other main potential threat is a sodium fire. Quite apart from the release of Na2O and NaOH the big threat is melting of the fuel tubes leading to release of air borne plutonium and fission products. It is essential that the reactor be designed and sited such that a sodium fire cannot occur. In order to extinguish a sodium fire the oxygen concentration over the sodium must be minimized and heat must be extracted from the sodium. Under no circumstances can water be allowed anywhere near the sodium. Perhaps a high molecular weight inert gas such as radon, xenon, krypton could be used to extinguish a sodium fire. The key issue is to not have any fresh air flow that could blow the high molecular weight inert gas away.

The soil and bedrock around the liquid sodium pool must be sufficiently dry, dense and stable to safely contain the liquid sodium in the unlikely event that a major earthquake ruptures both the inner and outer stainless steel walls of the liquid sodium pool and crecks the enclosing concrete wall.

It is equally important that there be an effective non-water based fire suppression system. The local fire department must be trained that water should NEVER be used to fight a FNR fire. Inappropriate use of water carried by a fire truck could change a minor fire into a major disaster.

The other chemical threat is a spontaneous reaction between hot liquid sodium and air. To mitigate this threat the liquid sodium is covered by floating steel covers, an argon cover atmosphere, a gas tight suspended inner metal ceiling, and a gas tight suspended outer metal ceiling. In the event of air penetration into the argon cover gas the reactor should be immediately shut down and heat dumped from the primary liquid sodium pool to lower the primary liquid sodium temperatre below 200 degrees C, the threshold for spantaneous combustion of sodium in air. As this heat is dumped stored liquid argon must be evaporated to maintain the 1 atmosphere pressure in the argon cover gas.

Once the liquid sodium temperature is down to about 120 degrees C the surface of the liquid sodium can be flooded with a thin layer of low density oil to prevent the liquid sodium oxidizing during work such as roof repair or replacement of an intermediate heat exchange tube bundle.

Similarly if there is an enclosure roof failure the immediate objective is to extract heat from the sodium to reduce its temperature to the point where a mineral oil can be safely used to prevent sodium oxidation. Until the heat is removed from the sodium argon must be used to exclude oxygen from the sodium surface. That heat extraction might easily take half an hour, depending on the available cooling capacity. The fastest way to emergency cool the system is to directly vent steam from the steam generator discharges. It is important to have enough water in tank storage in or near the steam generator building to remove the fission product decay heat by latent heat of vaporization. Then the limiting factor is the maximum safe heat transfer capacity of the intermediate heat exchanger tube bundles and the steam generator tube bundles. If there is a FNR roof failure it is essential to prevent this steam condensing and falling onto the exposed liquid sodium surface. This issue highlights the importance of FNR enclosure ceiling integrity.
 

RELATIVE RISK:
Molten aluminum is far more dangerous than liquid sodium yet many millions of tons of aluminum are refined from bauxite every year with few accidents of note. The Hall-Heroult electrothermic reduction cells operate at around 830 C. If aluminum catches fire the last thing one dares put on it is water. Also, you dare not let water come in contact with molten aluminum for it will explode in your face. An molten aluminum fire has to be smothered with sand or similar.

The liquid sodium fearing people need to take a look at hazardous realities that are far more dangerous and are being handled safely on large scale in many countries around the globe. The fear of liquid sodium is like the fear of low doses of radiation. It is being amped up by people who should know better. To be fair, molten aluminum forms an oxide film that prevents it from catching fire readily in air while molten sodium will quickly ignite in air. Aluminum dust (fuel for solid propellant rockets) explosions are among the most devastating known but the plants get rebuilt anyway.
 

ENSURING NON-PROLIFERATION:
A significant public concern is that FNRs be engineered and operated in a manner that does not allow bad actors to obtain Pu-239 in a form suitable for making atomic bombs. The solution to this problem is to exchange FNR fuel bundles on a first-in first-out basis so that every fuel bundle, in addition to containing Pu-239 also contains a sufficient fraction of Pu-240 to prevent the contained Pu being used for bomb manufacture. Pu-240 cannot be chemically separated from Pu-239 and is extremely difficult to physically separate from Pu-239. In a bomb assembly Pu-240 causes pre-ignition, which prevents a large scale explosion. Ensuring first-in first-out exchange of FNR fuel bundles requires keeping a non-volatile record of the neutron flux exposure history of every FNR fuel bundle.
 

FNR SITE SELECTION:
The reactor must be sited at sufficient elevation above the maximum possible local flood level that the flood water level will never reach the liquid sodium level. However, sufficient cooling must be reliably available to provide certain removal of fission product decay heat. The soil, bedrock or embankment around the liquid sodium pool must be sufficiently dry, dense, thick and stable to safely contain the liquid sodium in the unlikely event that a major earthquake ruptures both the inner and outer stainless steel walls of the liquid sodium pool and crecks the enclosing concrete wall. Outside that containment there must be a dry embankment with a surface that ensures gravity drainage of water away from the sodium pool.

An ideal site for a FNR is a dense igneous rock plateau that drops off quickly to a lake or ocean with a high water mark over 20 m below the plateau grade. The lake or ocean provides water for emergency evaporative cooling. The lake or ocean bottom depth should be sufficient to prevent silt and/or sand being sucked into the cooling water makeup system. The sodium pool elevation above the water level must be sufficient that no natural geophysical event will ever lead to water threatening the stored sodium. Channels or tunnels can be cut into the bedrock surrounding the FNR to ensure positive gravity drainage. The plateau should provide sufficient area for a FNR, sodium storage, water storage, steam generators, turbogenerators, condensers, two dry cooling towers and transformer/switchyard facilities.

Note that the elevation of a FNR with respect to a nearby major water body is much higher than the elevation of a CANDU reactor that uses direct lake or sea water cooling. Thus Fukushima Daiichi like problems that might be caused by a tsunami or a comparable flood mechanism are avoided.
 

REACTOR ENCLOSURE:
The primary sodium pool must have a robust enclosure that reliably contains argon, contains gamma ray emissions, and excludes air and rain water, even under extreme storm conditions.

The space above the liquid sodium pool is filled with the inert gas argon which will not chemically react with either the liquid sodium or steel. This argon pressure is maintained at one atmosphere by an automatic feed system that does not rely on AC power. Fail safe argon space pressure control is essential for reactor enclosure structural integrity.

Floating on top of the liquid sodium are shallow draught square steel floats that reduce the exposed surface area of liquid sodium by about 99%. These floats have holes through them for the indicator tubes.

If at any time air leaks into the argon cover gas the immediate requirement is to lower the primary liquid sodium temperature below 200 C to prevent spontaneous sodium combustion.

If the reactor is to be shut down for an extended period the sodium surface should be covered with kerosene to prevent sodium oxidation. However, that kerosene still presents a fire hazard.
 

ROOF FUNCTIONS:
The primary function of the roof structure is to contain the argon cover gas and heat and to keep both rainwater and air away from the liquid sodium. The roof structure must allow fuel bundle and intermediate heat exchange bundle replacement using an external crane. The roof structure must be gas tight and must reliably exclude both air and rain water under the most adverse circumstances, including violent storms (tornados), long term corrosion and deliberate aerial attack. There should be an inner metal ceiling, 1 m of thermal insulation, an outer metal ceiling, at least 1 m of ventilation space and a girder supported outer roof.
 

POTENTIAL AERIAL ATTACK:
If an imminent threat to the FNR from an air born object is detected the FNR should be immediately cold shut down and sufficient heat should be extracted from the primary liquid sodium pool to ensure that there will be no spontaneous combustion of sodium with air if there is a major roof failure.
 

INNER AND OUTER CEILINGS:
The inner ceiling should be supported by hangers attached to the the outer ceiling and outer structural roof via thermal breaks. The inner ceiling is made from sheet stainless steel and normally operates at about 450 degrees C. On top of the inner ceiling is a 1 m thick layer of high temperature rated insulation so that the space between the outer metal ceiling and the structural roof is relatively cool. This space is normally cooled with forced air to enable service access to the ceiling mounted reactor monitoring system..
 

FNR ROOF:
Engineering a roof that can withstand a deliberate direct overhead air attack is one of the most difficult aspects of liquid sodium cooled FNR implementation. If such attacks become reality it may ultimately be necessary to locate FNRs deep underground to provide security against intentional overhead attack.

A reasonable compromise is to locate the liquid sodium pool for the new FNR such that in an emergency an argon gas cover can be maintained over the liquid sodium pool while a temporary new roof is applied. In such circumstances the liquid sodium pool must be cooled below 200 degrees C and then covered with a kerosene to prevent spontaneous sodium combustion with air. Circumstances that might lead to such a roof failure include a direct bomb, missle or meteorite strike.

There should be a sufficiently large supply of liquified argon on-site to prevent sodium combustion while the sodium temperature is being reduced following a sudden major roof failure.

A 300 MWe FNR has 32 fully independent heat removal systems. This level of independence provides protection in depth against loss of cooling failures.
 

RESERVE SODIUM STORAGE:
Sooner or later it will be necessary to do maintenance work on the primary sodium pool inner wall. To do such work it will be necessary to temporarily remove the primary liquid sodium from the primary sodium pool. Hence there must be nearby reserve sodium storage with sufficient capacity to hold the entire volume of the primary liquid sodium while the aforementioned maintenance work is being carried out. The reserve sodium storage must also accept hot fuel bundles transferred from the primary liquid sodium pool. A reserve storage pool can potentially be located underneath each dry cooling tower. When not required for storing sodium the reserve pool can be used for storing emergency cooling water or as underground parking space.
 

INTERMEDIATE HEAT EXCHANGE BUNDLES:
Heat is removed from the FNR via intermediate heat exchange bundles. The heat exchange tubes have low pressure radioactive primary liquid sodium on the outside and have high pressure non-radioactive secondary liquid sodium on the inside. The high pressure intermediate sodium exchanges heat to water in a steam generator. Thus, even if there is a heat exchanger or steam generator tube rupture there is no contact between radioactive sodium and the turbogenerator working fluid (clean water). There is further heat exchange isolation between the turbogenerator working fluid (clean water) and external cooling water.
 

COOLING TOWERS:
Normally most of the reactor waste heat output from electricity generation is dumped to a water based district heating system. The discharge temperature of this water ranges from 80 degrees C in the summer to 120 degrees C in the winter. If the district heating load is larger than can be met with waste heat from enabled electricity generation the electricity generators can be additionally loaded by electric boilers that further heat the district heating water. If the district heating load is smaller than the waste heat from electricity generation the surplus heat is rejected via roof top fan coil units installed at the remote load locations. These remote fan coil units are powered via dedicated circuits that run along side the district heating pipes from the reactor location. Thus the remote building owner is not responsible for the electricity load imposed by remote fan coil units that are operated for the benefit of the reactor owner rather than for the benefit of the building owner.

However, in the event of a loss of power at the reactor location this remote heat disposal methodology will cease operating because both the fans of the fan coil units and the circulation pumps of the district heating system will not operate. In these circumstances the reactor must be able to reject fission product decay heat at the reactor location using local natural draft cooling towers.

At the reactor site there must be at least two independent natural draft dry cooling towers. Each such cooling tower must be sized and piped to safely reject the fission product decay heat by natural circulation even if the other cooling tower is out of service. Assuming that both cooling towers remain in service the additional heat rejection capacity will enable system black start which will include energizing the district heating system circulating pumps and the remote fan coil units. Once there is remote heat rejection capacity the reactor power can be increased.

At the base of the local natural draft cooling towers are inward openning air admittance doors which are normally closed for energy conservation purposes but which are held closed by electromagnetic locks. On loss of electric power the electromagnetic locks release and the natural draft opens these doors allowing air flow through the cooling tower. When system power is restored maintenance personnel must manually close these doors to reduce the thermal load imposed by the cooling towers. The doors are fitted with closure sensing switches which trigger a maintenace alarm when the door opens.
 

This web page last updated March 18, 2019

Home Energy Physics Nuclear Power Electricity Climate Change Lighting Control Contacts Links