Home Energy Physics Nuclear Power Electricity Climate Change Lighting Control Contacts Links



By Charles Rhodes, P.Eng., Ph.D.

Elsewhere on this website Small Modular Fast Neutron Reactors (SM-FNRs) have been identified as the only sustainable, reliable and economic solution to meeting mankind's energy and power requirements. This web page focuses on SM-FNR design parameters that are necessary to achieve inherent safety. SM-FNRs must be designed so that they can be safely installed, operated and maintained at high density urban sites and in small towns where there is limited availability of skilled personnel.

In normal SM-FNR operation there is seldom any cause for maintenance personnel to enter the SM-FNR enclosure. The SM-FNRs operate automatically, can be remotely monitored and can be partially or entirely shut down via safety system control, local control or remote control.

Engineered nuclear reactor safety shutdown systems operate on the principle that there should be two fully redundant safety shutdown systems, either of which will cause a reactor shutdown. These two systems are backed up by physical barriers. In each safety shutdown system there are at least two independent life safety control devices in addition to the normal control device. To cause a hazard to the public both safety systems and the physical barriers must simultaneously fail. For a safety system to fail both safety devices and the normal control device must fail simultaneously. To cause a hazard to service personnel maintaining or testing one safety system the other safety system must simultaneously fail.

Generally there is a requirement for service personnel to physically confirm the proper operation of each normal control device and each safety device at least once per year. Provided that these annual checks are performed and if necessary the devices are repaired or replaced, the probability of three simultaneous device failures is extremely remote and the probability of both safety systems failing simultaneously is less than microscopic.

There are seven conditions that must be maintained in FNRs for public safety in an urban environment:
a) Certain water exclusion;
b) Certain air exclusion;
c) Certain nuclear reaction shutdown;
d) Certain liquid sodium level maintenance;
e) Certain fission product decay heat removal;
f) Certain temperature setpoint constraint;
g) Certain avoidance of prompt neutron criticality;

The FNR described herein has multiple redundant methods of ensuring compliance with each of these seven conditions.

In the case of (a) certain water exclusion is realized first by suitable FNR siting and then by the four rings of concentric walls that contain the primary liquid sodium. These walls are also equally effective at excluding water.

In the case of (b)

In the case of (a) there are three independent means of stopping the nuclear reaction.

In the case of (b) there are three independent sodium containment barriers, any one of which should safely maintain the liquid sodium level.

In the case of (c) there are at least three independent passive heat removal systems any one of which can reliably and safely remove the fission product decay heat.

In the case of (d) for each safety shutdown system there are independent mechanical and electronic constraints on the temperature setpoint and its rate of change. There are also independent position, temperature and gamma ray sensors that via an independent control can over ride other setpoiint control signals to force a reactor cold shutdown.

In the case of (e) the fuel bundle geometry in a FNR is mechanically stable. The working temperature of each active fuel bundle is kept sufficiently low that the fuel bundle geometry cannot become unstable via fuel melting or sodium boiling due to the large temperature difference between the sodium and fuel operating temperatures and the sodium boiling point and fuel melting temperature.

The change in core zone reactivity with a change in temperature is negative which prevents the local reactivity growth into the zone of prompt neutron criticality. The insertion rate of each active fuel bundle control portion is both physically and electronicly limited, again to prevent approach to prompt neutron criticality. Liquid sodium boiling in the core zone is prevented by the liquid sodium static head. Formation of sodium bubbles or other turbulence in the lower head pressure of an active fuel bundle chimney warns of local overheating in the core zone.

At the primary liquid sodium surface vapor bubbles will start to form at a surface temperature of about 870 degrees C. Due to the liquid sodium head pressure vapor bubbles will not form in the reactor core zone until the sodium temperature in the core zone reaches about 960 degrees C. Increasing sodium temperature in the core zone reduces the reactor reactivity. We must check the FNR design to ensure that an increase in sodium temperature reduces rather than increases the control portion insertion into the surround portion.

The insertion rate of the active fuel bundle control portion must be sufficiently slow to prevent reactivity overshoot as the active fuel bundle control portion is inserted.

For public safety each of the above mentioned safety systems should be continuously monitored and periodically tested to ensure that it will function as designed if required. Complete functionality of the safety systems is an essential condition for safe unattended FNR operation.

To get a nuclear explosion it is necessary to create an ultra-fast power ascension by sustaining a super-critical condition (above the prompt critical point). Delayed neutrons and thermal neutrons found in power reactors are too slow to sustain the ultra-fast power ascension needed for a nuclear explosion.

There are four categories of neutrons in a nuclear power reactor:
- fast neutrons are high energy neutrons (>20,000 km/s),
- thermal neutrons are neutrons (2 km / s) that are slowed down by moderator materials
- delayed neutrons are neutrons emitted from the fission fragments and are typically fast.
- prompt neutrons are the fast neutrons that come directly from the fission reaction.

Delayed neutrons arrive at various times after the initial fission reaction. Their average arrival time is about 3 seconds after the fission reaction. Delayed neutrons make it possible to design and control power reactors - both thermal and fast reactors. When a reactor is above the prompt critical point the reactor can sustain a power ascension without the need for delayed neutrons to maintain the power ascension. The rate of power ascension is proportional to the degree of super-criticality and inversely proportional to the time delay of the neutrons involved in the fissioning process.

Above the prompt-critical point the power ascension can proceed at very fast rates using thermal neutrons or at ultra-fast rates using fast neutrons. Power ascensions with thermal neutrons are slow enough to give the reactor time to structurally disintegrate well before reaching energy levels that are associated with nuclear explosions. Structural disintegration causes the reactor to become sub-critical and the power ascension to stop.

Fast neutron reactors do not use thermal neutrons, therefore, the delayed neutrons are the only safeguard against ultra-fast power ascensions following a severe transient or accident. It is crucial that the design of fast neutron reactors ensure that transients or accidents can not create a positive reactivity injection that exceeds the reactivity margin between the reactor’s normal operating point and the prompt critical point.

A well known case of prompt neutron criticality in a nuclear power reactor was in 1986 at:

A better description of the safety measure failures that led to the accident at Chernobyl and the corresponding preventive safety measures used in CANDU reactors is contained in a report titled:
Chernobyl - A Canadian Perspective

Murphy's Law states that anything that can go wrong sooner or later will go wrong. To the extent possible FNRs should be designed so that they physically cannot become prompt critical.

There is a transition region between being critical with delayed plus prompt neutrons and being prompt critical. A FNR should be fabricated such that it physically cannot cross that transition region. A key issue is time. If the change in reactor fuel geometry is slow enough the heat released while under control by delayed neutrons should induce sufficient negative reactivity to prevent further approach to the prompt critical condition.

A key issue is fuel geometric stability. The maximum rate of increase in reactivity due to a progressive change in fuel geometry must be very slow compared to 3 seconds. Liquid fuels cannot be safely used because liquids can develop vorticies and surface waves that can change the local reactivity on a time scale which is small compared to 3 seconds.

A FNR contains a lot of heat stored in its primary liquid sodium pool. Hence it can load follow using that heat without significant change in reactivity of the fuel bundle. The change in reactor thermal power output can take many minutes whereas the heat transfer out of the sodium pool can be changed in seconds.

An issue that needs further study is the inherent stability of a FNR. Does a FNR actually run at a constant gamma ray output or does the gamma output actually oscillate? If it oscillates then at what frequency? If it oscillates what physical parameters control that frequency? This issue should have been part of the original EBR-2 design but there is no obvious mention of it. The FNR physical parameters should be chosen such that any such oscillations are well damped. On an intentional increase in reactivity there should be negligible overshoot. That might have been an undocumented issue in the original EBR-2 design. Similarly the issue of ensuring no approach to prompt neutron criticality was likely studied in the past. However, today it may be necessary to re-derive it.

From a licensing point of view the FNR design needs to also meet all the severe accident events covered in the design basis for the site. Events that can occur together also have to be analyzed separately and together.

For example a power reactor should safely shut down if it is directly hit by a large passenger aircraft, a tornado along with transmission poles launched by a tornado, earthquakes, etc. The list of hazards also includes potential internal plant accidents like hydrogen fires in the power-house, main steam line breaks and associated pipe whip and environmental conditions, steam turbine disintegration, etc.

The Darlington safety report is likely available to the public at the CNSC library in Ottawa and should contain a list of all the design basis accidents.

On-site personnel are required to do periodic routine non-nuclear preventive maintenance on the steam generators, turbo-generators, condensers, cooling towers and related mechanical and electrical equipment and to make repairs as necessary. However, this equipment does not involve any radioactivity. There is sufficient redundancy in the FNR support equipment that some of the heat transport systems can be shut down for maintenance or repair while others remain in operation. Thus the only reasons for keeping staff on the reactor site 24/7 is compliance with steam power plant regulations and maintenance of site security.

The term Fast Neutron Reactor (FNR) is generically quite broad. For the purpose of this web site the definition of an FNR is narrowed to be a fast neutron reactor with metallic fuel rods, sealed metal fuel tubes and liquid sodium primary and intermediate coolants. A 1000 MWt FNR has a core region 0.35 m high X 11.2 m diameter that is surrounded above, below and on the perimeter by a blanket region 1.2 m thick and a active fuel bundle cooling region 0.4 m thick.

The blanket region and cooling region are further surrounded by a 2.4 m thick layer of liquid sodium which absorbs any neutrons that escape from the blanket and cooling regions.

The central core region together with the top and bottom blanket regions involve 640 vertical active fuel bundles. Each fuel bundle is 0.4 m long X 0.4 m wide X 6.0 m high and is supported by 3 m high legs (corner girder extensions on the fuel bundle bottoms). Each active fuel bundle has a removeable 3 m tall chimney and a 7.5 m tall indicator tube.

Each active fuel bundle has a vertically sliding central control portion and a fixed position surround portion. The central control portion is inserted into the surround portion from the bottom. Insertion distance is set using a liquid sodium hydraulic piston actuator. The indicator tube projects above the primary liquid sodium surface to indicate the actual vertical position of the fuel bundle central control portion. This vertical position is constantly monitored using an overhead device similar to a laser measuring tape.

The reactor core region is surrounded on its outer perimeter by a 1.2 m thick blanket formed from 3 rows of vertical passive fuel bundles.

There is an outer ring of spent fuel bundles in which natural decay of fission products occurs over a six year period before the fuel bundles are removed from the primary liquid sodium.

For a 1000 MWt FNR the active fuel bundles are centrally positioned in a 21 m diameter X 15.5 m deep liquid sodium pool. The region 2.8 m wide at the edge the liquid sodium pool is dedicated to intermediate heat exchange bundles and a service access corridor. The service access corridor also forms part of the sodium guard band.

In normal FNR operation the chain reaction is controlled by thermal expansion of the liquid sodium and fuel bundles. The liquid sodium temperature in effect controls the fraction of fission neutrons that escape from the reactor core zone into the reactor blanket zone. As that fraction increases the reactor power decreases and vice versa.

There are two other completely redundant nuclear reaction shutdown systems. These systems operate by gravity withdrawal of every second active fuel bundle control portion in a chequer board pattern. Hence in total there are three independent nuclear reaction shutdown systems.

There is an inner steel primary sodium enclosure, an outer steel primary sodium enclosure and a concrete enclosure with a sheet metal liner. As long as at least one of these enclosures maintains its physical integrity the liquid sodium will be sufficiently contained to maintain its minimum required level for safety and fission product decay heat removal following FNR shutdown.

Fission product decay can produce heat at a peak rate equivalent to about 10% of a nuclear reactor's full power rating, even after the nuclear chain reaction is off. Hence there must be certainty about passive removal of this heat. A FNR has multiple independent heat transport systems, proper operation of 10% of which is sufficient for safe fission product decay heat removal. In the event of loss of station power fission product decay heat removal should be achieved by natural sodium circulation with just half of the heat transport systems in service. During normal reactor operation no more than one quarter of the heat transport systems may be simultaneously taken out of service for maintenance or repair. In order to meet these requirements at least 20% of the intermediate heat exchange tube length must always be immersed in liquid sodium. This condition effectively imposes geometrical constraints on the FNR facility design.

Liquid sodium cooled FNRs inherently provide several major safety advantages as compared to water cooled reactors. At a pressure of one atmosphere water boils at 100 degrees C, a temperature far below the water cooled reactor maximum operating temperature of 320 degrees C. Sodium at a pressure of one atmosphere boils at 883 degrees C, a temperature far above the FNR maximum operating temperature of 450 degrees C. This difference in boiling point relative to reactor operating temperature has important implications.

1) If water is used as a reactor coolant any coolant leak will flash into radioactive steam. In an accident situation this radioactive steam cannot be safely vented to the atmosphere at an urban reactor site. Liquid sodium cooled FNRs avoid this problem by use of low pressure liquid sodium as the primary coolant. The primary liquid sodium is isolated from the turbo-generator working fluid steam by two separate heat exchangers. Thus there is no radiotoxicity hazard in venting turbo-generator steam to the atmosphere.

2) Water cooled reactors have a potentially dangerous condition known as transient void formation in which when the coolant pressure drops steam bubbles form in the reactor fuel tubes. These steam bubbles reduce the heat transfer capacity and reduce the reactor reactivity. To compensate for the reduced reactor reactivity the water cooled reactor power control system may automatically withdraw control rods to maintain the desired power setpoint. Then if the cooling feedwater temperature suddenly drops or the cooling water pressure is restored the steam voids can rapidly collapse leading to a reactor explosion due to prompt neutron criticality. The causes of void formation include coolant circulation failure or coolant pressure drop due to a pipe rupture, a pump failure or a loss of pump power. By contrast the contemplated FNRs rely on natural circulation of low pressure primary liquid sodium which has a boiling point about 430 degrees C above the maximum liquid sodium operating temperature. Hence in a liquid sodium cooled FNR there is no issue of transient void formation and there are no mechanically operated control rods and the related potential safety problems.

3) Water cooled reactors rely on ongoing mechanical movement of control rods to control the reactor power. This control system has many possible failure modes. This control system must constantly operate because water cooled reactors are inherently unstable. Absent operation of the mechanical control system the reactor power would spontaneously rise or fall. By contrast in a FNR thermal expansion and contraction of the primary liquid sodium provides stable passive primary liquid sodium temperature control.

The FNR fuel geometry is chosen such that void formation in the liquid sodium will stop the nuclear chain reaction, regardless of the amount of insertion of the active fuel bundle control portion into its surround portion. Unlike in a water cooled reactor there is no automatic change in fuel geometry to compensate for void formation. Any void detected triggers a reactor cold shutdown.

4) During severe accident conditions water cooled reactors vent radioactive gases to the atmosphere. By contrast in FNRs the only radioactive gases present remain locked inside sealed fuel tubes.

5) Most existing water cooled power reactors rely on mechanical pumps for primary coolant circulation. Loss of coolant or loss of coolant pumping are constant and potentially dangerous threats. By contrast the FNR design contemplated herein uses highly reliable natural sodium circulation for primary cooling.

6) Most existing water cooled power reactors rely on use of concrete casks for on-site dry storage of spent fuel bundles. By contrast on removal from the reactor spent fuel bundles from FNRs are placed in lead shipping containers and are transported to a central fuel reprocessing site.

7) Water cooled reactors generate large amounts of spent fuel containing highly radiotoxic transuranium actinides. By contrast FNRs fission transuranium actinides to dispose of them.

8) Existing water cooled reactors generate large amounts of sevice and decommissioniong waste. By contrast each FNR contemplated herein is fitted with a liquid sodium guard band which eliminates production of service and decommissioning wastes. In the event of a fuel tube rupture the primary sodium filter system will collect fuel and fission product material that should be fed into the fuel reprocessing material stream.

9) Water cooled reactors rely on complex electro-mechanical control systems to keep the reactor fuel and fuel tube temperatures within design limits. By contrast in a FNR the fuel and fuel tube temperatures are constrained by the sodium temperature and the FNR fuel tube heat flux which in turn is limited by the maximum intermediate liquid sodium flow rate.

As in all nuclear reactors, during FNR operation geometric stability of the reacting fuel is essential. In all nuclear fission reactors a rapid increase in core reactivity can potentially lead to an explosive condition known as prompt neutron criticality. In the FNR design discussed herein gravitional forces and sodium voids tend to reduce reactor criticality. The fuel tube melting point is much greater than the temperature at which primary sodium voids can form. Formation of primary sodium voids causes a chain reaction shutdown. The reactor is designed so that rapid insertion of the FNR active fuel bundle control portions is both mechanically and electronically prevented because such a rapid insertion might in theory cause a transient increase in reactivity sufficient for prompt neutron criticality. However, rapid withdrawal of the active fuel bundle control portions is permitted for reactor cold shutdown.

To ensure control stability both the active fuel bundle control portion insertion rate and withdrawal rate are normally mechanical orifice limited. Active fuel bundle control portion insertion is not used for reactor power control. Reactor cold shutdowns use separate full port hydraulic valves to enable rapid active fuel bundle control portion withdrawal.

Each fuel bundle physically clips to its four nearest neighbour fuel bundles for top horizontal position stability. Outside the assembly of fuel bundles there is a steel frame with diagonal reinforcing elements that provides the fuel assembly structural stability while the reactor is in operation. The diagonal elements prevent the entire assembly of fuel bundles from leaning, especially during or after a severe earthquake. This steel frame must be partially disassembled to allow exchange of individual fuel bundles, at which time the reactor is in cold shut down.

Much of the inherent safety of an FNR is due to absence of mechanical moving parts. The fuel bundles simply sit motionless in a pool of liquid sodium. Thermal expansion and contraction adjusts the reactor thermal power to maintain the desired liquid sodium temperature. Under thermal load the liquid sodium naturally circulates. When there is no thermal load the natural circulation stops which causes the fission chain reaction to stop. When the thermal load is restored natural circulation recommences and the fission chain reaction restarts. In normal reactor operation the control portions of the active fuel bundles remain in fixed positions. The only mechanical moving parts in the reactor enclosure are the primary liquid sodium filter pump impeller, the hydraulic liquid sodium pressure maintenance pump and occasionally the hydraulic actuator sodium flow control valves. These valves operate by gravity and by argon pressure. The argon pressure transducers are located outside the reactor enclosure. Loss of argon pressure causes a reactor shutdown.

The intermediate sodium receives a circulation assist from electric induction pumps that are located outside the reactor enclosure. If there is a loss of intermediate sodium level or intermediate sodium pressure in a particular heat transport system that entire heat transport sytem is automatically shut down.

Each active fuel bundle contains an interior sliding control portion moved by a dedicated liquid sodium hydraulic piston actuator. Thus an actuator jam or an active fuel bundle control portion slide jam does not physically affect the adjacent fuel bundles except via a changed neutron flux in the horizontal plane.

The active fuel bundle control portion positioning actuators rely on a common liquid sodium hydraulic pressure pump that will run occasionally due to small leaks past the hydraulic actuator pistons. This pump is submerged to maintain suction head but its motor is above the primary sodium pool and is cooled with flowing argon. If this pump fails the active fuel bundle control portion actuators will gradually lose pressure causing the active fuel bundle control portions to withdraw due to gravity and thus cause a reactor shut down.

The active fuel bundle control portion positioning system must be robust and extremely reliable and the rate of insertion of the control portions must be limited.

A situation that must be avoided is rapid insertion of an active fuel bundle control portion into its corresponding surround portion which could potentially lead to fuel bundle overheating, fuel melting, sodium void formation and possibly even prompt neutron criticality. Hence the rate of insertion of the active fuel bundle control portions must be limited by both hardware and software.

To avoid potential problems related to rapid control portion insertion orifices on the hydraulic actuator control valves limit the active fuel bundle control portion insertion rate. If the reactor monitoring system detects that an active fuel bundle control portion insertion is either too deep or too fast or if the gamma / neutron flux from a fuel bundle is too high or if the fuel bundle discharge temperature is too high the reactor safety system causes redundant full port drain valves to open causing rapid withdrawal of the relevant active fuel bundle control portion. Simultaneously the hydraulic liquid sodium flow to the relevant control portion positioning actuators is turned off.

As an additional safety measure if the position of an active fuel bundle control portion fails to respond to position control signals or if the emitted gamma flux is too high or if the active fuel bundle discharge temperature is too high then the reactor control computer automatically causes withdrawal of the surrounding nearest neighbor active fuel bundle control portions to force the non-responsive fuel bundle into a sub-critical state.

The active fuel bundle control portion insertion rate is limited to prevent the reactor going critical on prompt neutrons before thermal expansion of the liquid sodium temperature has had time to fully respond to the increased reactor power level. The active fuel bundle control portion must not be inserted so far into the corresponding surround portion that thermal expansion of the liquid sodium cannot stop the fission chain reaction at an acceptable fuel temperature.

The indicator tube height sensor must have good resolution with negligible hysterisis. The corresponding fuel bundle power is rapidly indicated by the strength of the gamma / neutron radiation propagating up that indicator tube. The fuel bundle discharge temperature should respond to a change in gamma /neutron flux with some time lag. If either a fuel bundle gamma / neutron signal or a fuel bundle discharge temperature is too large the active fuel bundle control portion insertion must be immediately reduced. Failure of the fuel bundle discharge temperature to track either the gamma / neutron signal or the indicator tube height indicates an equipment problem. That fuel bundle should be locked out of service until the cause of the problem is determined and rectified.

The normally used actuator valves for each fuel bundle control portion position have three states: add high pressure hydraulic sodium via a small orifice, close, and drain hydraulic sodium via a small orifice. Most of the time the actuator valves should be in the closed state. If the actuator valves spend too much time in the add sodium state it may indicate a control portion positioning actuator sliding seal leak or a drain valve seal failure. If the drain valve keeps reopenning it may indicate a seal problem with the actuator fill valve.

In addition to the two orifice restricted actuator position control valves for each active fuel bundle there is a full port shutdown valve which rapidly drains liquid sodium from the hydraulic actuator causing rapid withdrawal of the active fuel bundle control portion from the fixed surround portion. On loss of argon pressure this full port valve causes an immediate fuel bundle shutdown.

The FNR control system assumes that the core rods in a particular fuel bundle all behave the same way. Hence during fuel rod production it is important that 100% of the core rods come from the same alloy batch or be individually scanned to check that their alloy mix meets design specifications.

The FNR control system assumes that all the liquid sodium cooling channels in a fuel bundle are open. Hence it is essential that the liquid sodium be sufficiently filtered to eliminate particulate matter that over time might obstruct the liquid sodium cooling channels. Each fuel bundle has sufficient cross flow to tolerate a few isolated blocked liquid sodium cooling channels but the fuel bundle cannot tolerate a large cluster of blocked liquid sodium cooling channels. Of particular concern are carbon, boron, beryllium, oxygen and fluorine based particulate compounds that might potentially float or be nearly neutrally buoyant in liquid sodiuum. Denser particulate species will naturally settle to the bottom of the liquid sodium pool where they will be caught by the primary sodium pool filter.

For additional certainty each active fuel bundle has its own dedicated Vee liquid sodium entrance filters. Behind the filters is a cross channel that ensures proper fuel bundle operation even if half of a Vee filter is blocked.

In normal FNR operation the minimum temperature of the primary sodium is kept above 330 C to prevent formation of solid NaOH which might potentially deposit on heat exchange surfaces to reduce heat transfer or might obstruct the liquid sodium coolant flow.

The active fuel bundles are designed so that they rely on their nearest neighbors for operation. If the position of an active fuel bundle control portion fails to respond to control signals that fuel bundle can be shut down by shutting down its nearest neighbours. This reactor feature allows implementation of two completely redundant reactor emergency shutdown systems.

Normal thermal power control in a FNR is achieved by thermal expansion of the liquid sodium and the active fuel bundles. The amount of insertion of a fuel bundle control portion into its surround portion determines the fuel bundle discharge temperature. As the fuel bundle liquid sodium inlet temperature drops below the discharge temperature setpoint the fuel bundle thermal power increases. However, care must be taken because under a heavy thermal load the fuel and fuel tube temperatures could potentially exceed their material ratings. On reactor turn-on the discharge temperature setpoint must be raised slowly over about a half hour time period so that the discharge temperature setpoint does not exceed the inlet temperature by more than 100 degrees C.

Once the reactor reaches normal operating conditions the reactor thermal power is controlled by varying the secondary sodium flow rate. Under these circumstances the role of thermal expansion of the primary liquid sodium is to keep the active fuel bundle discharge temperature in the range 440 degrees C to 450 degrees C.

The reactor thermal output power is sensed via the intermediate sodium temperature differential and intermediate sodium flow rate. It is important to keep the reactor thermal output power below its design maximum to prevent damage to the fuel tubes.

Active fuel bundle control portions are withdrawn to achieve a reactor cold shutdown. On loss of control argon pressure all the active fuel bundle control portion full port actuator drain valves open and gravity causes the active fuel bundle control portions to withdraw from the fuel bundle surround portions. Under these circumstances the primary liquid sodium pool will gradually cool and argon in bladder tanks must be automatically fed into the reactor space to maintain one atmosphere of argon pressure in that space. Otherwise the integrity of the reactor enclosure may be threatened by the decrease in argon pressure as the primary sodium temperature decreases.

If the gamma flux for a particular fuel bundle exceeds specification, indicating potential fuel bundle over heating, that fuel bundle should be immediately shut down.

If a fuel bundle discharge temperature gets too high, indicating fuel bundle overheating, that fuel bundle should be immediately shut down.

If an indicator tube top rises too high, indicating a potential active fuel bundle control portion positioning system problem that fuel bundle should be immediately shut down.

For safety purposes each active fuel bundle must remain subcritical when its control portion is fully inserted but the four nearest neighbor active fuel bundle control portions are all withdrawn. This feature ensures an immediate safe reactor cold shutdown in the presence of a single active fuel bundle control portion jam or actuator failure. Note that under this criteria the thermal power output from the outer ring of active fuel bundles may be relatively small. For each member of this active fuel bundle outer ring at least one of the nearest neighbor active fuel bundles is already missing.

Reactor safety is further improved by requiring that the reactor will fully shut down even if two adjacent fuel bundle control portions jam in the full power position. The core portion of each fuel bundle can be regarded as cube 0.4 m to a side. In normal full power reactor operation neutrons are lost from 2 faces of this cube for centrally located fuel bundles and neutrons are lost from 3 or 4 faces of the cube for active fuel bundles that are members of the perimeter ring. To ensure reactor shutdown with two adjacent jammed active fuel bundle control portions a fuel bundle must shut down if neutrons are lost from either 6 or 5 cube faces. Hence the reactor should be fuelled such that when the active fuel bundle contol portions are inserted the the fuel bundle shutdown threshold is at neutron loss through 4 cube faces. In reality the fuel mix will change through the operating life of a fuel bundle, so to achieve a higher safety margin it is necessary to reduce the shutdown threshold for interior fuel bundles from 4 faces of neutron loss to 3 faces of neutron loss.

If an active fuel bundle control portion jams such that it will not withdraw due to gravity the overhead gantry crane can either push down the corresponding indicator tube to release the jammed control portion. If there is a jam in either the hydraulic actuator or the active fuel bundle control portion the fuel bundle should be shut down and the problem fuel bundle replaced at the next opportunity.

The individual fuel bundles are engineered such that when they are outside the reactor environment they remain sub-critical regardless of the insertion of the active fuel bundle control portion. When the fuel bundle assembly is formed with the active fuel bundle control portions withdrawn the reactor must always be sub-critical. When all of the active fuel bundle control portions are fully inserted the reactor should operate at or above its maximum rated power. As a fuel bundle reaches its design operating temperature thermal expansion of the primary liquid sodium and the fuel bundle materials should cause the fuel bundle reactivity to drop below criticality.

The fuel bundle discharge temperature distribution is monitored with an overhead scanner. In normal full power operation the discharge temperatures should be uniformly at 440 degrees C. As the reactors thermal load decreases the fuel bundle discharge temperature should rise to about 450 C at which point the reactor should become subcritical.

In normal operation the active fuel bundle control portion vertical position setpoint is adjusted so that at full rated reactor power the gamma / neutron outputs from every interior active fuel bundle are identical. This state corresponds to uniform thermal power loading of the active fuel bundles that are inside the outer ring of active fuel bundles.

The vertical position of an active fuel bundle control portion is indicated by the height of the top of its indicator tube. In normal reactor operation the vertical position setpoints of the indicator tubes should be nearly identical.

As the reactor thermal load varies the gamma flux varies for all the active fuel bundles.

The fuel bundles are engineered to allow sufficient lateral liquid sodium flow to provide the cooling required to prevent fuel and fuel tube damage if an isolated cooling channel becomes blocked.

A liquid sodium flow obstruction will cause a primary sodium flow decrease and hence a corresponding decrease in gamma / neutron flux as compared to neighboring fuel bundles. If a relative decrease in gamma/neutron flux is detected that fuel bundle's control portion should be withdrawn until the cause of the abnormally low gamma / neutron flux is identified and remedied and/or the faulty fuel bundle is replaced.

Unlike the EBR-2 the fuel tubes are in a square array instead of a hexagonal array. The square array is more tolerant of fuel tube swelling and allows use of fuel bundle cross rods to stabilize the positions of the individual fuel tubes.

The height of each indicator tube is sensed by a laser scanner. The fuel bundle gamma / neutron emission is sensed by an overhead thermally isolated and cooled radiation monitoring apparatus. The discharge temperature of each fuel bundle is derived from the indicator tube internal vapor pressure which is also monitored with a laser scanner.

In plan view the active fuel bundles can be divided into two groups, a "red" group and a "black" group as on a checker board. Each "red" active fuel bundle has four surrounding "black" active fuel bundles. Each "black" active fuel bundle has four surrounding "red" fuel bundles. Neutrons in the core region flow in three dimensions. Hence shut down of either all the "red" active fuel bundles or all the "black" active fuel bundles shuts down the entire reactor. Hence there are two independent reactor shutdown systems, one of which shuts down all the "red" active fuel bundles and the other which shuts down all the "black" active fuel bundles. For reactor service both groups of active fuel bundles are shut down.

Reliable operation of these two independent shutdown systems may impose constraints on the FNR core rod fuel alloy mix and hence on the FNR core rod fuel reprocessing cycle time.

Reliable operation of the two independent safety shutdown systems may also require that the thermal power production by the outer ring of active fuel bundles be reduced.

The safety shutdown of each fuel bundle is accomplished by removing argon control pressure from a normally open full port actuator drain valve. When this argon pressure is removed the valve opens rapidly draining liquid sodium from the active fuel bundle control portion actuator.

The reactor primary and intermediate coolants are both pure liquid sodium. A Na-K mixture is specifically excluded. A Na-K mixture offers superficial advantages in terms of melting point. However, in a power reactor the presence of potassium in the primary sodium leads to formation of K-40 which has a half life of 1.26 X 10^9 years. If there are many such power reactors operating for many years K-40 will become an increasing environmental problem. The best solution to this problem is to not produce K-40 in the first place. Hence the primary coolant should be pure sodium.

The intermediate coolant circuits will operate until something fails, likely an intermediate heat exchange bundle or a steam generator tube. In an intermediate heat exchange bundle failure secondary coolant will mix with the primary coolant. Hence to keep potassium out of the primary coolant the secondary coolant must also be pure sodium.

The reactor thermal output power is sensed via the secondary sodium temperature differential and secondary sodium flow rate. It is important to keep the reactor thermal output power below its design maximum to prevent damage to the active fuel tubes.

The FNR core fuel rods are primarily metalic U-238 with Pu-239 and 10% zirconium alloyed with it. The purpose of the zirconium is to prevent formation of a fuel tube low melting point plutonium-iron eutectic. The purpose of the Pu-239 is to drive the nuclear reaction. The purpose of the U-238 is to capture neutrons to breed more Pu-239 The core rods are enclosed in HT-9 steel fuel tubes. The core rod diameter is intentionally only about 86% of the initial HT-9 steel tube ID to allow for core rod swelling due to internal formation of gaseous fission products. Inside the HT-9 steel tubes, along with the fuel rods is liquid sodium, which provides good thermal contact between the fuel rods and the fuel tubes and which chemically absorbs the potentially corrosive nuclear fission products fluorine, chlorine, bromine and iodine. The HT-9 steel tube plenum volume above the fuel and blanket rods contains sufficient extra sodium to compensate for eventual fuel tube swelling and provides sufficient empty volume to allow for volumetric expansion of the fuel rods and to allow for sealed containment of inert gaseous fission products at allowable pressures. Another important role of the long fuel tubes is to act as chimneys that enhance primary sodium natural circulation.

As the primary liquid sodium temperature increases its density decreases, taking the reactor core zone reactivity below its critical point. Then the only significant heat produced is fission product decay heat. Provided that there is adequate decay heat removal at a low thermal load the reactor temperature will stabilize at its maximum rated temperature of 450 degrees C. As heat in excess of fission product decay heat is removed from the primary liquid sodium the primary sodium pool temperature decreases increasing the primary sodium density. This density increase restores reactor criticality and raises reactor power. The reactor can be shut down and cooled off by withdrawal of its active fuel bundle control portions.

One of the most important aspects of fission reactor design is provision for fission product decay heat removal under extremely adverse circumstances. If some event occurs which causes a reactor shutdown the fission products will continue to produce decay heat at about 5% of the reactor's full power rating. It is essential to have a 100% reliable means of ensuring ongoing removal of the fission product decay heat under accident conditions such as shortly after a severe earthquake.

In the case of a liquid sodium cooled FNR all heat removal is via primary liquid sodium, so it is essential that:
1) Under no circumstances will the primary liquid sodium level ever fall to the point that the fuel rods are not fully immersed in liquid sodium or where thermal contact with the intermediate heat exchange bundles is lost.
2) The liquid sodium pool walls must be designed such that if the inner wall fails and the primary liquid sodium leaks into the space between the inner and outer pool walls, the leakage into the space between the two walls will not lower the primary liquid sodium level below the tops of the fuel rods or below the intermediate heat exchange bundle tubes. Ideally this condition should also be met if the outer steel wall also fails. This condition restricts the volume of the air space around the reactor. Viewed another way this condition sets a minimum on the reactor size if reasonable service access clearances are to be maintained and if double wall failures are required to be tolerated.
3) Even if the intermediate loop sodium pumps fail there must be enough secondary liquid sodium natural circulation to ensure safe removal of the fission product decay heat.
4) The secondary liquid sodium dumps its heat into steam generators. Hence on a reactor shutdown the pressure in the steam generators must be released so that the system that injects water into the steam generators does not face a pressure load.
5) There must be enough clean water in storage, above the elevation of the steam generators, such that the steam generators can be gravity fed and the fission product decay heat can be removed by evaporating that water and condensing the resulting steam in the cooling towers.

An FNR designed for utility electric power production typically has 640 active fuel bundles. Sooner or later through accident, negligence or malevolent behavior there will be a defective active fuel bundle and/or a defective active fuel bundle control portion positioning apparatus. In these circumstances the major concern is fuel melting. In response to local overheating the control portions of the adjacent fuel bundles must be immediately withdrawn to ensure shutdown of the defective fuel bundle.

If fuel melting occurs fuel alloy droplets might collect on the primary liquid sodium pond floor under the fuel tube assembly. It is essential that these droplets do not accumulate together to form a critical mass. The primary liquid sodium pool floor must have a liner of a neutron absorbing material that is geometrically shaped to prevent molten fuel forming a critical mass. There should also be a practical means of selectively removing and replacing sections of the primary liquid sodium pool floor liner.

The hot liquid sodium will naturally circulate vertically up through the reactor between the active fuel tubes, up through the fuel bundle chimney, horizontally along the top of the primary liquid sodium pool, down between the vertical intermediate heat exchange tubes, down to the bottom of the primary sodium pool and then horizontally along the bottom of the primary liquid sodium pool back to below the reactor.

Each active fuel bundle control portion has associated with it an actuator that vertically positions the control portion based on the indicator tube vertical position with respect to its position setpoint. The actuator piston moves in response to liquid sodium hydraulic pressure. If a problem is detected the liquid sodium hydraulic pressure falls to zero and the fuel bundle control portion withdraws due to gravity causing a fuel bundle shutdown.

A FNR is controlled by several micro-computers. The main function of these computers is to safely maintain the desired fuel bundle discharge temperature setpoint and to trigger fuel bundle or entire reactor shutdowns if any significant out-of-normal condition is detected. The monitoring software must include hardware watchdogs that can detect any significant problems within the reactor monitoring system and the reactor fuel bundle discharge temperature control systems. If any such problems are detected the reactor control must either shift to a fully redundant electronic monitoring and control system or trigger a reactor shutdown.

The steam generators are located at an elevation higher than the reactor and on the return side of the intermediate sodium loop so that the intermediate sodium will natuarally circulate even if the intermediate sodium induction type circulation pump loses power. The equipment should be sized so that the natural circulation rate is sufficient to safely remove fission product decay heat after the reactor is shut down.

The individual active fuel bundle surround portions and the passive fuel bundles are supported and held in position by square vertical tubes that are attached to the steel frame located on the bottom of the primary sodium pool. The indicator tubes are attached to the top of the active fuel bundle control portions and are horizontally stabilized by the buoyancy of the indicator tubes and their surrounding steel floats. The fuel bundles mechanically clip to their nearest neighbours to provide assembly lateral stability.

The fuel bundles are repositioned and/or replaced from time to time using an overhead gantry crane and remote manipulation. Note that at the air locks the ceiling height must be sufficient to allow extraction and replacement of individual fuel bundles. During the removal process spent fuel bundles are lifted 3 m to clear the vertical square support tubes and then are then moved horizontally to the reactor perimeter zone of the primary sodium pool where the irradiated fuel bundles are stored until they lose most of their fission product decay heat before being removed from the primary sodium pool.

The FNR is designed to safely withstand earthquake induced horizontal acceleration of up to 0.38 g. At a sustained 0.38 g horizontal acceleration the surface of the liquid sodium could adopt an angle that is 0.36 radians to the horizontal. Under these circumstances the liquid sodium height on one edge of the pool could theoretically reach up to 4.0 m above the normal liquid sodium surface.

The gantry crane is located at this maximum liquid sodium height. The bricks forming the pool thermal insulation must have surrounding structural steel elements that firmly stabilize the brick wall to the surrounding concrete walls and to upper level steel walls to prevent a structural failure in severe earthquake conditions. Hence the FNR fuel bundle can be thought of as being centrally located in a 15.5 m deep liquid sodium pool with a liquid sodium top surface which is 1 m below the pool deck.

The concrete walls surrounding the primary sodium pool are stabilized on the outside by earth/rock embankments with a one unit rise for each two horizontal units. These embankments should be drained at the bottom, should have grass growing on top with sets of concrete stairs. Rain should either run off the surface or should drain out via a sloped drains near the bottom. Even if there is a violent earthquake causing a total pool rupture this embankment must contain the sodium and must prevent any rain or flood water reaching the sodium.

The main chemical threat from a power FNR is the 4900 m^3 of liquid sodium contained in the primary sodium pool. If this liquid sodium contacts water there will be an explosive chemical reaction which liberates hydrogen that will spontaneously ignite in an air atmosphere. Hence one of the main issues in FNR design is choice of a reactor site where the sodium will NEVER be exposed to flood water.

The other main potential threat is a sodium fire. Quite apart from the release of Na2O and NaOH the big threat is melting of the fuel tubes leading to release of air borne plutonium and fission products. It is essential that the reactor be designed and sited such that a sodium fire cannot occur. In order to extinguish a sodium fire the oxygen concentration over the sodium must be minimized and heat must be extracted from the sodium. Under no circumstances can water be allowed anywhere near the sodium. Perhaps a high molecular weight inert gas such as radon, xenon, krypton could be used to extinguish a sodium fire. The key issue is to not have any makeup fresh air flow that could blow the high molecular weight inert gas away.

The soil and bedrock around the liquid sodium pool must be sufficiently dry, dense and stable to safely contain the liquid sodium in the unlikely event that a major earthquake ruptures both the inner and outer stainless steel walls of the liquid sodium pool and crecks the enclosing concrete wall.

It is equally important that there be an effective non-water based fire suppression system. The local fire department must be trained that water should NEVER be used to fight a FNR fire. Inappropriate use of water carried by a fire truck could change a minor fire into a major disaster.

The other chemical threat is a spontaneous reaction between hot liquid sodium and air. To mitigate this threat the liquid sodium is covered by floating steel covers, an argon cover atmosphere, a gas tight suspended inner metal ceiling, and a gas tight suspended outer metal ceiling. In the event of air penetration into the argon cover gas the reactor should be immediately shut down and heat dumped from the primary liquid sodium pool to lower the primary liquid sodium temperatre below 200 degrees C, the threshold for spantaneous combustion of sodium in air. As this heat is dumped stored argon molecules from bladders in storage silos must be added to the cover gas to maintain the 1 atmosphere pressure in the argon cover gas.

Once the liquid sodium temperature is down to about 120 degrees C the surface of the liquid sodium can be flooded with a thin layer of low density oil such as kerosene to prevent the liquid sodium oxidizing during work such as roof repair or replacement of an intermediate heat exchange tube bundle.

Similarly if there is an enclosure roof failure the immediate objective is to extract heat from the sodium to reduce its temperature to the point where kerosene can be safely used to prevent sodium oxidation. Until the heat is removed from the sodium argon must be used to exclude oxygen from the sodium surface. That heat extraction might easily take half an hour, depending on the available cooling capacity. The fastest way to emergency cool the system is to directly vent steam from the steam generator discharges. It is important to have enough water in tank storage in or near the steam generator building to remove the fission product decay heat by latent heat of vaporization. Then the limiting factor is the maximum safe heat transfer capacity of the intermediate heat exchanger tube bundles and the steam generator tube bundles. If there is a FNR roof failure it is essential to prevent this steam condensing and falling onto the exposed liquid sodium surface. This issue highlights the importance of FNR enclosure ceiling integrity.

Molten aluminum is far more dangerous than liquid sodium yet many millions of tons of aluminum are refined from bauxite every year with few accidents of note. The Hall-Heroult electrothermic reduction cells operate at around 830 C. If aluminum catches fire the last thing one dares put on it is water. Also, you dare not let water come in contact with molten aluminum for it will explode in your face. An molten aluminum fire has to be smothered with sand or similar.

The liquid sodium fearing people need to take a look at hazardous realities that are far more dangerous and are being handled safely on large scale in many countries around the globe. The fear of liquid sodium is like the fear of low doses of radiation. It is being amped up by people who should know better. To be fair, molten aluminum forms an oxide film that prevents it from catching fire readily in air while molten sodium will quickly ignite in air. Aluminum dust (fuel for solid propellant rockets) explosions are among the most devastating known but the plants get rebuilt anyway.

A significant public concern is that FNRs be engineered and operated in a manner that does not allow bad actors to obtain Pu-239 in a form suitable for making atomic bombs. The solution to this problem is to exchange FNR fuel bundles on a first-in first-out basis so that every fuel bundle, in addition to containing Pu-239 also contains a sufficient fraction of Pu-240 to prevent the contained Pu being used for bomb manufacture. Pu-240 cannot be chemically separated from Pu-239 and is extremely difficult to physically separate from Pu-239. In a bomb assembly Pu-240 causes pre-ignition, which prevents a large scale explosion. Ensuring first-in first-out exchange of FNR fuel bundles requires keeping a non-volatile record of the neutron flux exposure history of every FNR fuel bundle.

Heat is removed from the FNR via intermediate heat exchange bundles. The heat exchange tubes have low pressure radioactive primary liquid sodium on the outside and have high pressure non-radioactive secondary liquid sodium on the inside. The high pressure intermediate sodium exchanges heat to water in a steam generator. Thus, even if there is a heat exchanger or steam generator tube rupture there is no contact between radioactive sodium and the turbogenerator working fluid (clean water). There is further heat exchange isolation between the turbogenerator working fluid (clean water) and external cooling water.

This web page last updated March 24, 2019

Home Energy Physics Nuclear Power Electricity Climate Change Lighting Control Contacts Links