XYLENE POWER LTD.

FNR SAFETY

By Charles Rhodes, P.Eng., Ph.D.

INTRODUCTION:
Elsewhere on this website liquid sodium cooled Fast Neutron Reactors (FNRs) are identified as being the only presently available fuel sustainable, dependable and economic technology for meeting mankind's clean power requirements for fully displacing fossil fuels.. Until such time as the material problems related to molten salt fast neutron breeder reactors (particularly isotopically pure molybdenum fuel tubes) and/or hydrogen isotope fusion systems have been solved mankind must live with the constraints related to liquid sodium cooled FNRs.

This web page identifies the major FNR related public safety issues. Some of these issues are shared with thermal neutron reactors. Other issues, such as sodium fire suppression, are unique to sodium cooled reactors.

To effectively reduce CO2 emissions, FNRs must be designed so that they can be economically and safely assembled, operated and maintained at urban sites.
 

MURPHY'S LAW
Murphy's Law states that if there is a way for something to go wrong, sooner or later someone will discover it. From the public safety perspective, FNRs must be designed and built to be tolerant of human error.

A FNR must be designed and built such there is no credible circumstance that results in a catastrophe. Today high rise buildings often have central boiler rooms. Each boiler is protected by multiple redundant safety devices that detect problems such as flame failure, high temperature, high pressure, etc. such that boiler explosions are extremely rare. However, to provide an additional level of public safety boiler rooms are made sufficiently robust that they will safely contain a boiler explosion. In those circumstances equipment may be damaged and a tradesman might be injured or killed but the public remains safe. The same safety philosophy must apply to a urban sited FNR. It is fundamentally protected by multiple redundant safety devices, but if all else fails and the FNR blows itself apart, its enclosure is sufficiently robust to prevent injury to the public.
 

INHERENT SAFETY
Much of the inherent safety of a liquid sodium cooled reactor lies in the relatively low potential energy content of its coolant. The coolant of a pressurized water reactor (PWR) operates at a lower temperature than the coolant of a FNR, but the PWR's cooling water contains both latent heat of vaporization and energy of compression, which total a lot of potential energy per unit volume. If the PWR's coolant containment pressure is reduced its cooling water will flash to steam, causing violent explosion.

By comparison, in a sodium cooled FNR the worst that can happen is a prompt neutron critical event that will stop as soon as the fuel rods become a few percent longer than nominal. In this circumstance the fuel rods will separate lengthwise, causing the nuclear reaction to stop.

While the initial core fuel rod length extension caused by a prompt neutron critical event might be rapid, it occurs more than 6 m deep in a sodium pool and is further contained by the steel fuel tubes.

It was found during WW-II that triggering a prompt neutron critical explosion with fissile plutonium (Pu-239) requires a very fast explosive compression and carefully shaped fissile fuel, neither of which is present in a FNR.

The dream is to have a network of FNRs in a municipality, spaced on a 4 km to 6 km hexagonal grid, that provides electricity and district heating everywhere on the grid, as well as high grade steam near the FNRs.

From a public safety perspective, FNRs must be safe against all credible events, such as human failures, tornados and moderate earthquakes. However, like large hydroelectric dams, it is impossible to guarantee public safety if the reactor is subject to an engineered military attack or to the direct impact by a large meteorite. In those circumstances all that can be done is to mitigate potential damage.
 

THE SAFETY CHALLENGE:
For safety, in all credible circumstances:
1)Any increase in FNR temperature must instantly cause a sustained decrease in reactor reactivity. If the FNR does not comply with this condition, when it goes prompt critical with respect to fast neutrons, it will self destruct. This condition should be mathematically proven over the entire range of possible fuel geometry and fuel mixtures;

2)There must be two independent means of coursely adjusting the reactor reactivity. These means are used to set the reactor operating temperature and to implement reactor shutdowns. In an emergency either one must cause a fission shutdown;

3)The course adjustments of reactivity must be stable;

4)Any sudden large increase in reactor fuel temperature must instantly trigger a large decrease in reactivity;

5)The sodium and NaK must be safely isolated from both air and water;

6)At least 8% of the reactor's rated heat removal capacity must always be functional;

7)The reactor enclosure must ensure reliable operation of all of the aforementioned safety functions.

8)An enclosure breach must trigger fission shutdown while maintaining heat removal capacity:

9) The reactor mechanical and operating design must prevent too large a temperature difference between the inlet coolant and the reactor temperature setpoint.
 

NIGHTMARE SCENARIOS THAT MUST BE PREVENTED:
Nightmare #1 is a poorly controlled depleted fuel mix, coolant flow blockage or coolant sodium void that might lead to:
dR / dT > 0
which would allow the local reactor fuel temperature to climb until stopped by a high temperature safety. Hence it is essential to have a redundant reliable fast acting high temperature safety mechanism.

Nightmare #2: With this type of reactor it is essential to be vigilant regarding the chemical properties of sodium. Beware of a small enclosure leak and/or a small sodium pool leak that leads to reactor sodium contacting rain or ground water, slowly producing hydrogen gas. If that hydrogen gas collects in the inside roof space, it could potentially explode causing a major enclosure breach, which in turn could enable a major sodium fire.

Nightmare #3 is a significant enclosure breach from any cause, including a tornado, earrthquake, aircraft impact or physical attack that enables a reactor sodium fire. This fire emits airborne Na2O, where a fraction of the Na is Na-24 that has a half life of about 15 hours. Also potentially emitted are fission products with half lives of up to 30 years. The fire would be aggravated by any rainfall that interacts with the sodium and Na2O producing hydrogen gas and airborne radioactive NaOH. The hydrogen burns violently and the Na2O and NaOH require fire fighters to wear chemical resistant thermal suits with air packs. Fire fighters must be conscious of cumulative gamma radiation exposure. The high temperatures might cause fuel tubes to rupture leading to airborne fission products. The fission products can potentially cause ground radioactivity that lasts for centuries.

It is essential that the reactor design includes a mechanism for suppressing and extinguishing sodium fires. During and after such a fire the reactor cooling system must remove sensible heat, heat liberated by sodium combustion and fission product decay heat.

Neither nightmare #2 nor nightmare #3 can occur if the reactor containment remains complete. Hence much of the effort relating to FNR safety is aimed at providing and preserving redundant nested radioisotope containment barriers. In this respect three nested barriers are used to confine and/or exclude gases and four nested barriers are used to confine and/or exclude liquids. For liquids a fourth barrier is necessary because even if there is a breach in the gas enclosure, heat extraction from the sodium pool must continue. In every case the outer barrier is a robust 1 m thick reinforced concrete wall with a matching dome roof structure.

Nightmare #4 is a beyond design basis event such as an engineered military attack, an impact by a large meteorite or a huge earthquake that causes a major containment breach. The the case of a military attack the damage might be amplified by a transient condition of prompt neutron positive reactivity. In this case the primary objective is public impact mitigation, with emphysis on rapid suppression of the sodium fire and containment of airborne radio isotopes, irrespective of damage to the NPP.
 

ACCIDENT DESIGN BASIS:
From a licensing point of view the FNR design must meet all the severe accident events covered in the design basis for the site. Events that can occur together must be considered.

A nightmare example is a Na microleak and a water microleak that combine to form a hydrogen accumulation that then explodes causing a major enclosure beach during a rain storm. Then rain water entering the sodium pool triggers a sodium/hydrogen fire that triggers fuel tube failure that causes fission products to mix with the burning sodium, resulting in airborne Na2O containing radioactive Na-24 and airborne fission products

For example if there is an enclosure breach the movable fuel bundles must be withdrawn, the resulting sodium fire and/or NaK fire must be extinguished, the roof must be repaired and the cooling that is required for both fission product decay heat removal and net cooling must continue to operate.

A FNR must withstand earthquakes and severe tornados that potentially cause electricity transmission poles to become missiles. The list of possible hazards also includes potential steam plant accidents like main steam line breaks and associated pipe whip as well as steam turbine disintegration.

From the perspective of reactor financing it is essential that once the design of a particular NPP is approved there must be no further design changes for safety reasons. The issue is that further design changes forced by regulators in the name of marginal improvements in public safety have the practical effect of making the entire project unprofitable. This issue is particularly important with respect to protecting the reactor from a determined military attack. The level of protection provided to resist a determined military attack is very much a judgement call. Changing the public safety protection measures after the reactor design has been approved is extremely expensive. Funding the costs triggered by such design changes is not a risk that FNR NPP investors can reasonably accept.
 

NESTED BARRIERS
The safety system includes three gas tight nested barriers for gases and four nested barriers for liquids.

Gas Barriers:
Surrounding the sodium pool space is the innermost barrier, referred to as the hot wall, which operates at about 480 degrees C.
Outside the hot wall is a 1 m thickness of compresible ceramic fiber thermal insulation. Then there is a barrier known as the cool wall that operates at about 25 degrees C. These two barriers together with the insulation form the thermal wall.

Outside the thermal wall is a service acccess space from 1 m to 3 m wide followed by the third barrier which is the reinforced concrete inner structural wall, about 1 m thick.This barrier has a port which is normally open for long term pressure balancing but that can be closed if there is a leakage of airborne radio isotopes into the access space between the cool wall and the inner structural wall.

Outside the inner structurl wall are the heat exchange galleries which are partially protected by the outer structural wall and which are vented to the ouside.

Liquid Barriers:
The innermost barrier is the pool inner wall. It is surrounded by 1 m of compressible sand/brick. Next is the pool middle wall. Then there is another 1 m thickness of sand/brick. Then there is the pool outer wall. Then there is an access space about 3 m wide. Then there is the 1 m thick inner structural wall.
 

SAFE OPERATION:
In normal operation both the sodium liquid and sodium vapor are fully confined by the innermost barrier. In these circumstances the liquid, vapor and wall are all in the temperature range 460 C to 500 C, electricity is being generated and buildings are being heated.

If there is a breach failure of the enclosure the reactor setpoint temperature is reduced to 120 degrees C. Electricity is no longer generated but district heating continues. To the extent possible FNR service is done from the access space.

The inner structural wall and roof are designed to reliably resist natural events such as earthquakes, tornados, and ice storms. The sodium pool outer wall will prevent seepage water accumulations contacting the sodium. This arrangement is critical to prevent hydrogen formation. With even a trickle of water contacting sodium, hydrogen could potentially accumulate and cause an explosion that could dammage one or more of the gas barriers.

The FNR must have fail safe fission shutdown and ongoing decay heat removal.

The sodium pool temperature must not be allowed to increase to the point that the sodium vapor pressure can potentially damage either a gas barrier or the argon storage bladder system.
 

FNR DESCRIPTION:
Each FNR Nuclear Power Plant (NPP) consists of a nuclear island that is connected via radial steam and condensate pipes to up to eight nearby steam turbogenerators. At all times at least 8% of the total heat transport capacity must be available on demand to ensure sufficient heat transport capacity for rejection of FNR fission product decay heat. The minimum electricity generation should always be sufficient to power the induction and injection pumps.

The FNR fuel assembly is an array of fissile and fertile fuel rods within vertical fuel tubes that are held in position by fuel bundles mounted on a steel frame. The extent of the insertion of movable fuel bundles into the matrix of fixed fuel bundles is adjusted using FNR actuators so that the reactivity is zero at the desired setpoint temperature. Thereafter the FNR uses thermal expansion-contraction of its components to adjust the reactivity and hence regulate the FNR's operating temperature.

NORMAL FNR OPERATION
The indicator tubes show, for each movable fuel bundle, the depth of insertion into the matrix of fixed fuel bundles, the local sodium temperature and the fission power, as indicated by fission sourced gamma radiation that propagates up the inside of the indicator tube. This data is acquired by an array of ceiling mounted gamma sensors.
 

NORMAL FNR TEMPERATURE CONTROL:
If the FNR fuel becomes too hot the fuel assembly should thermally expand in three dimensions, reducing its reactivity. Similarly, if the FNR fuel becomes too cold the fuel assembly should thermally contract, increasing its reactivity. When under constant thermal load a FNR operates at a reactivity of:
R = 0.

FNR safety relies on the reactivity R of the fuel assembly decreasing with increasing average fuel temperature. There are two contributions to this effect, the bulk reactivity and the shape dependent reactivity.
 

TEMPERATURE DEPENDANCE OF BULK REACTIVITY
Determining the temperature dependence of the bulk rectivity is a lengthy but crucially important calculation that should be done before FNR financing is contemplated. Many paper reactor designs lack this essential calculation. Some paper reactor designs will not work because use of fissile uranium instead of fissile plutonium is contemplated. Plutonium has a much larger TCE than uranium, suggesting that to ensure a:
dR / dT < 0
with fissionable uranium the sodium cooling channels must be very narrow.
 

DEPENDANCE OF REACTIVITY ON CORE ZONE SHAPE:
Assume that the reactor core zone has a pancake shape.
The reactor core zone dimensions are:
L = pancake radius
H = pancake height

The reactor core zone volume is:
Pi L^2 H

The reactor core zone surface area is:
2 Pi L^2 + 2 Pi L H

The ratio of surface area to volume is:
[(2 Pi L^2 + 2 Pi L H) / (Pi L^2 H)]
= [(2 / H) + (2 / L)]

The change in the ratio of surface area to volume is:
[- (2 dH / H^2) - (2 dL / L^2)]

However:
(dH / H) = (dL / L) = 10^-5 / degree C.

Hence the change in the ratio of surface area to volume is:
- 2 X 10^-5 / deg C)[(1 / H) + (1 / L)]
= - 2 X 10^-5 / deg C)[1 / H][1 + (H / L)]

For a pancake shaped core zone:
(H / L) << 1

Hence the change in the ratio of surface area to volume is:
= - 2 X 10^-5 / deg C)[1 / H]
which corresponds to decreasing reactivity with increasing temperature.

Typically the linear Thermal Coefficient of Expanion (TCE) of the fuel bundle steel is about:
10 X 10^-6 / deg C.
Hence a 100 degree C temperature rise causes a linear change in fuel assembly dimensions of about 0.1%. Typically there is about a 100 degree C safety margin between the maximum fuel working temperature and a temperature so high that fuel damage will occur. Hence the fuel assembly must be protected against external forces that might potentially compress a fuel assembly's linear dimension by more than 0.1%.

A FNR should have a negative slope thermal power versus reactivity characteristic that limits its maximum average fuel operating temperature to about 480 degrees C, at which temperature the reactivity should be zero. The maximum FNR thermal power is constrained by the maximum fuel rod centerline temperature, the maximum sodium temperature and the maximum fuel and fuel tube heat transport capacity. In the event of circumstances that cause an unplanned rapid increase in fuel temperature there is an automatic mechanism that causes a decrease in fuel assembly reactivity and hence a reactor fission shutdown.
 

FISSION PRODUCT DECAY HEAT REMOVAL:
Natural circulation of NaK coolant in the heat transport sytem should be sufficient to reliably remove fission product decay heat, even when there is no electricity available for the NaK induction pumps. On loss of house power gravity causes the actuators to withdraw movable fuel bundles which shuts down the fission reactions. Then the steam generators vent to the atmosphere and are filled with liquid water which lowers their temperature to about 100 degrees C. Then circulation of the NaK removes reactor heat by evaporating water at 100 degrees C. The NaK return temperature falls to about 110 degrees C which should eventually cool the sodium pool to about 120 degrees C.
 

SUPPRESSION OF PROMPT NEUTRON CRITICALITY:
A serious situation can potentially arise from a combination of Pu depletion with time and sodium void instability. The issue is that for stability a FNR relies on maintenace of:
(dR / dT ) < 0.

However, as the coolant sodium temperature increases the sodium density decreases, injecting positive reactivity into the fuel assembly. Also, as time passes, the Pu fraction in the fuel decreases, which due to its high TCE, also injects further positive reactivity into the fuel assembly. Eventually the fuel assembly may reach the condition where:
(dR / dT) = 0.

At this condition even a slight temperature increase will cause the sodium to inject further positive reactivity. In response the neutron population will grow which further increases the fuel temperature, which further increases the sodium temperature and hence the reactivity. This positive feedback process, known as prompt neutron criticality, will almost instantly melt the fuel unless another process intervenes that injects sufficient negative reactivity to stop this positive feedback.

In the FNR contmplated herein any rapid increase in fuel temperature causes increased pressure at the core fuel which tends to push fixed fuel bundle core fuel rods toward their fuel tube plenums. That core fuel rod displacement reduces the fuel assembly reactivity.

This protective process happens in less than 1 mS, which should be sufficiently fast to protect the fuel. After some time gravity will return the fixed fuel bundle core fuel rods to their initial position.

this process should be sustainble provided that on the occurence of a gamma burst the depth of movable fuel bundle projection into the matrix of fixed fuel bundles is immediately reduced.

TOO RAPID OR TO DEEP MOVABLE FUEL BUNDLE INSERTION:
In a FNR too rapid inserion of movable fuel bundles into a matrix of fixed fuel bundles can cause brief prompt neutron criticality that heats the fuel, causing the average fuel temperature to almost instantaneously track the fixed and movable fuel bundle relative positions. The fuel is easily damaged by too rapid a change in relative fuel rod positionor too deep an insertion.

If the sodium temperature adjacent to the fuel bundles is too low with respect to the reactor setpoint temperature fuel rod centerline melting will occur. If the reactor setpoint temperature is too high then fuel rod melting can occur, even at low thermal power.

During reactor turn-on the rate of rise of the fuel and sodium temperatures must be limited, again to prevent fuel rod centerline melting.
 

REFERENCE:
Overview of Generation IV Reactor Safety Maters
 

*********************************************

HEAT TRANSPORT LOOP REDUNDANCY FOR HIGH CAPACITY FACTOR:
The objective is to have a NPP where total system shutdowns are very few and far between. As a result of the Na-24 15 hour half life, it must be both practical and safe to service some of the radial heat transport loops while other radial heat transport loops are operating at full power.

The FNR facility consists of a common naturally circulated sodium pool heat source, 48 NaK heat transport loops and 8 independent steam turbogenerator systems. The reject heat from thermal electricity generation supplies heat to four independent district heating loops. Each of the independent district heating loops has one local wet/dry cooling tower on the FNR site and three remote wet/dry cooling towers. In order to provide maximum electricity output in the summer all of the cooling towers must be fully functional in their wet mode. At all times at least one turbogenerator and its associated cooling tower and heat transport loops should be fully functional to ensure capacity for removal of FNR fission product decay heat.

The cooling towers operate wet in the summer and dry in the winter.

Apart from the sodium pool,which is common, the facility consists of four independent power stations. Each power station has two 40 MWe steam turbogenerators. In order to continuously remove fission product decay heat at least one of the four indpendent power stations must be at least 50% functional.

There are 48 independent heat transport loops each of which contains three separate radiation isolation barriers. A failure of any one of these barriers results in an individual heat transport loop shutdown. Due to the multiplicity and physical isolation of the independent heat transport loops, the facility can continue operating while some of the heat transport loops are out of service.
 

******************

PUBLIC SAFETY MATTERS THAT MUST BE ADDRESSED IN A SODIUM COOLED FNR DESIGN:
A) Walk-away safety;

B) Sufficient sodium pool elevation and isolation to ensure that water never contacts the sodium coolant.

C) The sodium pool must have triple nested walls filled with sufficient brick and sand to ensure continuing partial immersion of the intermediate heat exchange bundles in liquid sodium in spite of an inner or middle nested steel wall leak.

D) Two nested sodium pool enclosures with three nested gas tight faces. The inner enclosure consists of a 1 m thick thermal insulating wall with gas tight inner and outer surfaces.

E)Between the inner and outer enclosure is a 1 m wide service access space.

F)The outer enclosure is a 1 m thick reinforced concrete structural wall with a gas tight inner surface that can prevent leakage of gamma radiation.

G) There is another 1 m thick structural wall outside the outer enclosure wall. These two outer walls are connected by 1 m thick reinforced concrete sheer walls. The space enclosed by these walls contains the heat exchange galleries. These two outer walls together protect the FNR from low angle aircraft impacts and airborne projectiles. The structure enclosed bythe outer wall is known as the nuclear island.

H) The outer enclosure and the outer wall have external coatings and roofing to exclude precipitation.

I) The FNR sodium fire protection system relies on the inner structural wall being able to withstand the most severe storm that nature can produce. The FNR outer structure must be sufficiently robust to withstand direct interactions with major tornados and hurricanes that can potentially rapidly lower the atmospheric pressure outside the outer enclosure by as much as:
3 psi = 20 kPa.

J) Each FNR must have a normal temperature control mechanism (thermal expansion) and two independent cold shutdown safety systems:
-linear fuel disassembly;
-movable fuel bundle withdrawl.

K) A significant failure of either the structural encosure wall or the inner enclosure wall must automatically trigger a reactor cold shutdown. Such a failure is detected by sensing Ar leaking into the service space or by air leaking into the sodium pool space.

L) A breach of containment causing a sodium fire must trigger the automatic sodium fire suppression system as detailed on the web page titled: FNR Fire Suppression.

M) A NaK leak or NaK fire must trigger automatic NaK drain down to a NaK dump tank dedicated to the particular heat transfer loop. Note that the remaining NaK heat transport loops must continue operating after a sodium fire suppression system trip to remove fission product decayheat and lower the sodium pool temperature.

N) Each heat exchange gallery must have reliable automatic NaK fire detection and fire suppresion with Na2CO3.

O) The thermal wall and the ceiling over the sodium pool:
i) Must continuously contain an argon gas and sodium vapor mix at 460 deg C to 500 deg C on the sodium poolside.;
ii) Must be interior metal sheathed and seal welded to prevent sodium vapor penetration of the wall insulation;
iii) Must maintain a positive argon pressure inside the wall insulation to keep sodium vapor and air out;
iv) Must be exterior metal sheathed and seal welded to prevent argon gas (and possible radiosodium vapor) leakage into the service access space.

P) There must be sufficient on-site cool argon gas storage in bladder type reservoirs to allow safe sodium pool space transition from 500 degrees C to 20 degrees C without admitting air into the sodium pool space. These bladders are located in the service spaces underneath the NaK dump tanks.

Q) The inside surface of the inner structural wall must have an airtight coating and pipe seals so as to reliably contain any airborne radio isotopes that leak into the service access space.

R) There must be an air conditioning apparatus mounted inside the dome roof service access space that rejects to the outside heat that leaks from the sodium pool space through the thermal wall and into the surrounding service access space. This a/C unit prevents release to the outside of air borne radio isotopes contained in the service access space.

S) The nuclear island must withstand earthquakes as discussed on the web page titled: FNR Earthquake Protection

T) The liquid sodium coolant depth above the FNR fuel assembly (5.5 m) must be sufficient to protect the FNR fuel assembly from shear forces due to translational earthquake movement. The earthquake induced kinetic energy must be dissipated by liquid sodium surface wave motion.

U) The nuclear power plant must provide paths for rejection of fission product decay heat via either turbogenerators, condensers and cooling towers/district heating or via atmospheric pressure evaporation from the steam generators of locally stored water.

V) The movable fuel bundle actuators must be stable such that after initial positioning of fuel bundles the fuel assembly remains dimensionally stable except for thermal expansion and contraction.

W) The FNR fuel assembly reactivity must decrease with increasing temperature over the temperature range from 20 deg C to 800 deg C.

X) The fuel assembly reactivity must rapidly decrease if a heavy overhead object falls onto the indicator tubes projecting upwards from the movable fuel bundles.

y) To prevent FNR core fuel centerline melting the FNR heat transport system must be designed such that in normal reactor operation the return Na temperature to the fuel bundles always remains above the minimum safe fuel assembly inlet temperaure. Note that about half of the sodium flowing through the fuel assembly recirculates without contacting an intermediate heat exchange bundle. Beware of the large TCE of sodium causing thermal stratification in the sodium pool that in accident circumstances might lead to a sudden drop in the fuel assembly sodium inlet temperature.

Z) If the fissile fuel rapidly gets too hot axial fuel disassembly should occur forcing a reduction in fuel assembly reactivity.

AA) To prevent accidental fuel criticality movable fuel bundles must always be inserted before insertion of the adjacent fixed fuel bundles. Similarly, fixed fuel bundles must always be removed before removal of the adjacent movable fuel bundles.
 

SAFETY MECHANISMS:
The reactivity of a FNR is a strong function of the FNR's fuel geometry. In normal operation a liquid sodium pool type FNR, as discussed herein, is inherently safe because:
a) The fuel geometry is stable;
b) Major adjustments in the core fuel geometry are made using rate limited hydraulic actuators;
c) The fuel assembly has a negative temperature coefficient of reactivity;
d) The reactivity is kept close to zero at the operating temperature setpoint by passive thermal expansion and contraction;
e) Any rapid rise in fissile fuel temperature causes vapor pressure driven axial fuel disassembly which causes a temporary large injection of negative reactivity. This mechanism will over ride potential problems due to void formation in the liquid sodium coolant.
f) Any sudden large increase in reactor temperature setpoint causes sodium and cesium vaporization inside the fixed fuel bundle tubes which reduces the reactivity by driving the core fuel rods of fixed fuel bundles upwards toward the plenum space;
g) The fuel tubes remain deeply immersed in liquid sodium, even in a severe earthquake, so there is no danger of liquid sodium wave action triggering sodium void instability;
h) Air and water exclusion by the argon filled thermal wall prevents a sodium fire;
i) There is a wide temperature difference (> 400 degrees C) between the maximum fuel tube outside surface temperature and the sodium coolant boiling point, which prevents sodium void instability;
j) The liquid sodium pool has a large thermal mass that can safely absorb thermal power transients;
k) The large liquid sodium thermal mass prevents slugs of low temperature sodium reaching the active fuel;
l) In normal operation the steady state thermal power output is proportional to the NaK coolant circulation rate. The minimum thermal power output is the flux of fission product decay heat;
m) There is reliable reactor cold shutdown and heat removal under all credible threat circumstances;
n) Any external event causing a physical shock large enough to significantly change the fuel geometry also triggers at least one independent reactor cold shutdown system;
o) Radio isotopes, except Na-24 and neutron excited impurities within the liquid sodium, are contained in sealed fuel tubes;
p) In the event of a fuel tube leak most radio isotopes are chemically bound by the liquid Na coolant and sink to the bottom of the sodium pool;
q) Any leaking inert gas radio isotopes and Cs-137 are confined by the inner enclosure sheet stainless steel wall covering;(We might need a Cs-137 vapor trap).
r) In the event of an accident involving fuel tube melting, but not a structural wall breach, the double wall thermal enclosure will protect the public by fully containing airborne radio isotopes.
s) The dome has a movable patch to temporarily cover a localized hole in the dome resulting from a missile attack;
t) There are eight independent turbogenerator halls;
u) Each steam system contains 6 independant NaK heat transport loops;
v) At all times at least (1 / 12) of the total heat transport capacity must be kept fully operational to ensure continuing removal of fission product decay heat.
 

EXCLUSION OF WATER BY SITE SELECTION:
a) The FNR must be sited on a hill of sufficient height with respect to the surrounding land and water table that the FNR's sodium pool cannot be flooded by water. This is a non-negotiable site selection requirement;
b) No pressurized city water pipes are permitted within the inner structural wall;
c) The FNR enclosure should have two redundant sump pumps in addition to having its gravity drain which must be above the local water table.
 

ENCLOSURE DESCRIPTION:
The inner structural enclosure consists of an upright concrete cylinder with 1 m thick walls, 32 m in outside diameter that stabilizes an interior light weight cylindrical gas tight ceramic fiber insulated cylindrical wall, 26 m ID, 28 m OD. Within the enclosed inner space is a 20 m ID, 24 m OD sodium pool.

The enclosure contains four concentric barriers (the external concrete wall and three nested steel walls) that exclude ground water and rain water from the sodium.
The external dome over the FNR must be watertight and must be constructed to naturally shed water, snow and ice;
The dome's water tight membrane must be rugged and easy to maintain.

The inner concrete cylindrical wall is stabilized by 12 X 1 m thick 8 m long radial concrete shear walls. The shear walls are connected together by the 1 m thick external concrete structural wall that provides additional protection against ground level attack.

The exterior walls are further stabilized by four corner basement stair wells which effectively convert the nuclear island below grade footprint into a 50 m X 50 m square.

The top of the enclosure is a steel and concrete dome roof, about 34 m in diameter, that at its middle is about 8.5 m higher than at its edges. This dome supports a gas tight ceiling that is about 10.0 m above the pool deck. Above this ceiling is 1 m of ceramic fibre insulation

Between the outer surface of the thermal wall and the inner surface of the inner concrete structural wall is a 1 m wide space for pipe and seal service access.

The argon cover gas and the sodium vapor are contained by two nested sheet steel wall coverings on the inside and outside of the thermal wall, either of which can safely isolate the contained argon and sodium vapor from the service access space. The sheet steel wall coverings are separated from each other by a 1.0 m thick layer of argon filled ceramic fiber insulation. This argon filling is kept at a slight positive pressure to prevent Na vapor entering the wall space and degrading its ceramic fiber content.

In normal operation the FNR relies on sodium vapor and argon containment by the hot inner thermal wall covering. In the event of an hot containment wall covering failure the FNR should be shut down at the next opportunity. A failure of the cool containment wall covering indicates that the reactor must be shut down immediately, regardless of financial consequences. Note that even if there is such a failure airborne radio isotopes cannot escape due to the impermiable wall covering on the inner face of the enclosure's inner structural concrete wall.
 

ENCLOSURE STRUCTURAL INTEGRITY:
In theory a prompt critical condition might be caused by a reactor enclosure collapse which crushes the core zone of the FNR's assembly of active fuel bundles. For example, a large airplane impact which causes physical collapse otothe reactor enclosure.

A FNR enclosure should be designed such that a structural collapse sufficient to cause crushing of the fuel assembly is not a credible risk. The reactor enclosure thermal wall is protected against an external aircraft or missle impact by 1.0 m of reinforced concrete and by adjacent structures such as turbo generator halls and cooling towers.

The reactor dome must be structurally sufficiently robust to safely absorb the impact of a low angle diving aircraft and safely resist a tornado. The polar gantry crane should have sufficient perimeter rail support to ensure that gantry crane transverse beam can never fall into the sodium pool.

The reactor roof structure should contain impact absorbing material, such as reservoirs of NaCl granules and polyester bands to safely distribute over the roof area the impact force of any credible projectile. If the impact causes large concrete pieces to break off the dome, the inner ceiling, NaCl reservoirs and and polyester bands must prevent the such broken pieces falling on to and crushing the reactor fuel asembly. The dome should be comparable in strength to a highway or railway overpass.

Note that the gantry cross beam is sufficiently long with respect to the 20 m inner pool diameter that even if one end support fails and that end of the cross beam falls 8 m, the beam would hang up on the pool deck rather than its end falling into the sodium pool. Note that:
(25 m)^2 - (8 m)^2 = 625 - 64 = 561 m^2
(23 m)^2 = 460 + 69 = 529 m^2
Hence the cross beam cannot fall into the sodium pool unless it breaks into shorter lengths.

The dome and the external enclosure must also protect the reactor from the large liquid hydrocarbon fuel fire that might accompany the crash of a large airplane. In this respect the sheet metal floor covering over the horizontal ceiling members should be slightly sloped toward fire tolerant drains.

The inner ceiling immediately above the reactor should be made of light weight materials such that, if they fell on the reactor fuel assembly, are not sufficiently heavy to significantly change the geometry of the assembly of fuel bundles. The impact of the material fall should be mitigated by the indicator tubes, possible spherical floats and the top 6 m of liquid sodium. The fixed fuel bundle plenums should provide additional shock absorption.

An important issue in earthquake protection is bolting the fixed fuel bundles together at their upper corners to form a rigid matrix. The liquid sodium above the fuel assembly can safely slosh back and forth in an earthquake provided that the surface waves do not change the relative geometry of the fixed and movable fuel bundles.
 

ENCLOSURE STRUCTURAL INTEGRITY:
A prompt critical condition might be caused by a reactor enclosure collapse which crushes the core zone of the assembly of active fuel bundles. For example, a large airplane impact which causes physical collapse of the reactor enclosure dome.

A FNR enclosure must be designed such that a structural collapse sufficient to cause crushing of the fuel assembly core zone is not a credible risk. The reactor enclosure thermal walls are protected against an external aircraft or missle impact by 1 m of reinforced concrete and adjacent structures such as turbo generator halls and cooling towers. The reactor dome must be structurally sufficiently robust to safely absorb the impact of a diving aircraft.

The reactor roof structure should contain impact absorbing material, such as reservoirs of NaCl granules and polyester bags of expanded polystyrene to safely distribute over the roof area the impact force of any credible projectile. If the impact causes large pieces to break off the dome the inner roof, NaCl reservoirs and and polystyrene filled polyester bags must prevent the large broken pieces falling on to and crushing the reactor fuel asembly. The dome should be comparable in strength to a highway or railway overpass.

The inner ceiling immediately above the reactor should be made of light weight materials that, if they fell on the reactor fuel assembly, are not sufficiently heavy to significantly change the geometry of the assembly of fuel bundles. The impact of the material fall should be mitigated by the indicator tubes, spherical floats and the top 6 m of liquid sodium. The fixed fuel bundle plenums should provide additional shock absorption.

The dome and the external enclosure must also protect the reactor from the large liquid hydrocarbon fuel fire that might accompany the crash of a large airplane. In this respect the floor coverings over the horizontal dome menbers should be slightly sloped to a drain.

The enclosure contains three nested barriers (the inner structural concrete wall and two nested steel walls) that exclude rain water from the sodium.
The sodium in the pool is isolated frm ground water by four nested barriers.
The external dome over the FNR must be watertight and must be constructed to naturally shed water, snow and ice;
The dome's water tight membrane must be robust and easy to maintain.
 

GAS ISOLATION:
There are three concentric sheet stainless steel gas barriers located on the inside face of the thermal wall, on the outside face of the thermal wall and on the inside face of the inner structural wall.

Normally the sodium pool is covered by argon and sodium vapor at a pressure of one atmosphere. This pressure slowly tracks the outside air pressure. The temperature in this space is about 480 degrees C.

Normally the thermal wall is filled with slightly over pressure argon. The temperature of this argon varies from 480 C at the inside down to about 30 C at the outside.

Normally the service space contains closed circuit air at 20 C to 30 C. The pressure in this space slowly tracks the outside air pressure;

Normally the heat exchange galleries contain open circuit outside air.

The outside structural wall and the dome physically protect the three interior gas tight barriers.

When the reactor is fully shut down and the the sodium is near ambient temperature its exposed upper surface can be isolated from air by flooding the sodium surface with kerosene.

The pipe paths between the argon filled spaces and the air filled spaces are sealed by bellows type pipe feedthroughs.

Physical access to the sodium pool space is via four argon-vacuum-air locks.

The argon pressure in the pool space is maintained at one atmosphere via the use of large argon storage bladders located within the concrete protected service access spaces underneath the NaK dump tanks.

Argon flows from the sodium pool space into the bladders via gas coolers.

A dual on-site cryogenic facility provides on going extraction and storage of argon from the outside air.

************************************************************

ENCLOSURE EARTHQUAKE, TORNADO AND HURRICANE TOLERANCE:
a) A steel dome roof backed up by reservoirs of sealed NaCl/MgCO3 pellets and supported by the 1 m thick inner concrete structural wall that is stabilized by radial shear walls is an extremely robust way of externally protecting the primary sodium pool from external physical events;
b) In the event of a severe earthquake or tornado the dome must remain in place preventing discharge of radio isotopes to the surrounding environment.
c) In the event of detection of a potential physical threat to a FNR an automated system should trigger a reactor shutdown.

FNR Earthquake tolerance issues are further detailed on the web page titled: FNR Earthquake Protection
 

ENCLOSURE RADIATION CONTAINMENT:
a) The mass of the steel/concrete dome and its contained NaCl/MgCO3 must be sufficient to prevent upward emission of gamma radiation;
b) In any credible accident the steel dome, NaCl/MgCO3, thermal wall and inner structural wall must safely prevent emission of airborne radio isotopes.
 

ENCLOSURE MINOR MISSILE RESISTANCE:
An issue that must be faced is the remote possibility of a direct overhead attack by either a diving airplane or an anti-tank missle. Assume that by some means the overhead dome is penetrated. The single most important immediate step is to shut down the reactor, to exclude air from the sodium and to extract heat from the sodium pool as quickly as possible. The issue is that as long as the sodium temperature is high it will heat the gas above it causing that gas to expand. When that gas is lighter than the surrounding ambient air it will tend to rise potentially sucking in further oxygen and moisture laden air into the reactor space via any open aperture. It is essential to prevent the liquid sodium surface being exposed to a continuous supply of fresh air.

ENCLOSURE Protection Against Overhead Object Collapse:
Redundant support measures are used to prevent heavy overhead objects such as dome armor tiles or gantry crane components falling onto the fuel assembly.

ENCLOSURE FAILURE
Potential Causes:
-ice accumulation
-corrosion
-tornado
-earthquake
- natural missile (air borne utility pole in a tornado)
-rocket propelled grenade (anti-tank missle
- jhadi suicide aircraft attack
- military missile
TOLERATED RISKS - extreme wind (low external pressure over roof due to hurricane and tornado wind speeds)
- extreme earthquake
- extreme ice and snow accumulation
- sodium vapor pressure
- argon or air pressure regulation failure
- corrosion and UV induced deterioration

Potential Consequences:
-loss of argon cover gas
-admission of air and precipitation
- Na Fire
- airborne radioisotopes

Remedy:
- Quantified distributed dome and support wall strength
- Quantified dome resistance to point impact
- Quantified earthquake tolerance
- Quantified dome weight
- Constant radius dome patch
- Roof membrane
- Roof membrane protection
- Quantified interior ceiling and wall argon leakage
- Interior ceiling and dome differential pressure sensing
- Two independent emergency shutdown systems;
- Reserve argon
- Na cooling by HTF
- Kerosene anti-oxidation agent
 

The cover gas is contained by two nested sheet steel wall coverings, either of which can safely isolate the contained argon and sodium vapor from the service access space. The sheet steel walls are separated from each other by a 1.0 m thick layer of argon filled ceramic fiber insulation. This argon filling is kept at a slight positive pressure to prevent Na vapor entering the wall space and degrading its ceramic fiber content.
 

FNR Na POOL SPACE AIRLOCKS:
In normal FNR operation there is seldom any need for maintenance personnel to enter the FNR primary sodium pool enclosure. The FNR relies on passive physics to maintain its fuel temperature setpoint, and the nuclear reaction will passively shut down if the reactor thermal load is removed.

The reactor setpoint temperature can be externally adjusted.

If it is necessary to replace a heat exchange bundle or to exchange a fuel bundle the FNR temperature must be reduced to about 120 degrees C and the Na-24 component of the sodium pool, which has a half life of about 15 hours, must be allowed to decay for about one week. Then robotic equipment can be used for fuel bundle exchange or for heat exchange bundle replacement.

If for some reason robots cannot do the job then maintenance personnel need protective suits with closed circuit air systems and cooling systems, similar to space suits, to protect personnel from the 120 degree C argon atmosphere and hot surfaces in the primary sodium pool space. The practical difficulties of doing work, such as disconnecting and then reconnecting intermediate heat exchange bundle flanged pipe joints, in such working conditions, should not be under estimated.
 

A method of suppressing the primary Na fire following a failure of the FNR dome has been developed, but that method uses NaCl which may damage the FNR's steel components.

Na FIRE SUPPRESSION:
Assume that there is a missile strike which makes a hole in the reactor dome that penetrates into the sodium pool space. In this event the priorities are:
a) Immediate nuclear reaction shutdown to stop formation of further nuclear heat;
b) Rapid extraction of heat from the sodium;
c) Sodium fire reduction using buoyant steel balls;
d) Sodium fire extinguishing using NaCl b) Rapid extraction of heat from the sodium;

The immediate response to a Na fire is to cover the Na surface with several layers of 20 cm diameter buoyant steel balls that minimize the exposed Na surface area.
Then sprinkle NaCl/MgCO3 powder over the floating steel balls. The NaCl will form a non-combustible crust supported by the floating stainless steel balls which will isolate the sodium surface from air. The CO2 will add to the crust buoyancy and will establish a positive CO2 flow out through the hole in the enclosure thus temporarily preventing inward air flow.

Then heat must be extracted from the sodium as fast as possible to lower the Na temperature to less than 120 degrees C.

This is a very serious step because the NaCl will likely damage the stainless steel pool liner, the intermediate heat exchange bundles, the fuel bundles and the stainless steel floats.

The NaCl is held in place in storage by normally closed plugs that in an emergency are lifted by strong electromagnets. The NaCl flows downward onto spinning heads that distributes it in a manner similar to a spinning lawn sprinkler. For certainty there should be eight independent spinning NaCl discharge heads.

After the sodium has cooled its exposed surface should be flooded with kerosene to prevent further oxidation.

A reference with respect to sodium carbonation reactions is: Carbonation of the EBR-II Reactor"

A reference with respect to major primary sodium fire suppression is:
Na Fires French Report

Another reference with respect to major primary sodium fire suppression is: Survey of Suppression of Sodium Fires
 

**************************************************************

NaK FIRE SUPPRESSION:
The NaK loop normally operates at a pressure of < 0.1 MPa. There is a small tendency for air to leak inward at gasketed mechanical joints.

Hot NaK will self ignite in air. These are small fires usually triggered by a NaK gasket leak or a weld failue in a heat exchange gallery. The main method of NaK fire suppression is NaK drain down to dump tanks.

Extinguish a small NaK fire by dump tank argon asphixiation and then use Na2CO3 extinguishers to protect stainless steel surfaces. One way to suppress these NaK micro fires is to completely surround the NaK loop with an argon jacket. The jacket must act as a thermal insulator.

Small NaK fires can be extinguished using Na2CO3.
Reference: Handling and Treatment of NaK
 

************************************************************

9) Sodium Level Maintenance:
It is essential to maintain the sodium level to ensure continued capacity to remove fission , fission product decay heat and combustion heat to prevent an uncontrolled reactivity increase due to sodium void formation within the reactor core zone.
a) In normal circumstances the sodium level is maintained by the sodium pool walls that involve three nested steel cups;
b) The nested steel cup geometery and insulating filler between the cups are chosen to prevent the sodium level falling more than 4 m after both inner amd middle cup failures.
c) Hence there remain a 2 m height of intermediate heat exchange bundle immersion in sodium to permit ongoing heat removal.

7) LOSS OF Na POOL LEVEL;
Potential causes:
- Na pool failure due to extreme earthquake:

Potential consequence:
-Inability to transport heat in normal operation
- Inability to remove fission product decay heat
- Increase in reactivity due to sodium void instability
- Fuel melt down

Remedy:
-Triple wall sodium pool with 50% between wall filler occupancy
- Two independent emergency shutdown systems;
 

Na LEVEL:
A FNR normally operates with its sodium pool surface and cover gas in the temperature range 450 degrees C to 470 degreees C. The primary sodium pool consists of three nested steel cups, any one of which can safely contain the liquid sodium and isolate it from the environment. The nested primary sodium pool walls are separated from each other by 1 m thick layers of silica sand and fire brick, which provide both thermal insulation and potential liquid sodium volume displacement.

LIQUID SODIUM LEVEL:
The primary liquid sodium is contained within three cylindrical nested open top stainless steel cups. The innermost cup is 16 m high X 20 m diameter. The middle cup is 17 m high X 22 m diameter. The outer cup is 18 m high X 24 m diameter. The 1 m wide spaces between the cups are filled with sand or fire brick. The fire brick is chosen such that if immersed in liquid sodium it will displace at least 50% of its own volume.

In the event that the inner two cups both fail liquid sodium will flow into the space occupied by all of the sand and fire brick. If the fire brick displaces a volume of sodium equal to 50% of the fire brick volume, the volume available for potential sodium occupancy up to 4 m below the normal sodium level is:
{Pi (12 m)^2 (13 m) - Pi (10 m)^2 (11 m)} (.50)
= Pi (1872 m^3 - 1100 m^3)(.50)
= 1212.65 m^3

The volume of liquid sodium available to fill this space while keeping the intermediate heat exchange tubes at least 2 m immersed in liquid sodium is:
Pi (10 m)^2 (4 m) = 1256.63 m^3

Hence as long as the outer most steel cup holds there is sufficient fire brick to prevent the sodium level in the innermost cup falling by more than 4 m. Thus:
6 m - 4 m = 2 m
of heat exchange tube remain immersed in the liquid sodium for decay heat removal.
 

*********************************************************

8) Pressure Safety:
a) The sodium pool, the nitrate salt lops and the HTF loops all operate at atmospheric pressure;
b) The NaK circuits normally operate in the range 0.2 MPa to 0.8 MPa which pressure is sufficient to ensure that in the event of a NaK loop leak that the NaK will always flow out of the loop, not vice versa;
c) In the event of a steam generator leak the water/steam will always flow into the nitrate salt loop or the HTF loop which loops are vented to the atmosphere;
d) Multiple small steam generators are used to minimize the amount of energy that is locally stored in high pressure steam.

There are 48 independent NaK heat transport circuits each of which contains three separate heat exchange isolation barriers. A failure in any one of these barriers results in an individual heat transport circuit shutdown. Due to the multiplicity of independent heat transport circuits, the facility can continue operating while some of the heat transport circuits are out of service.

CERTAIN REMOVAL OF FISSION PRODUCT DECAY HEAT:
a) In a cold shutdown condition the heat emitting nuclear fission reactions must totally stop.
b) An emergency cold shutdown condition must be attainable via two independent mechanisms.
c) Removal of heat from a FNR occurs primarily via circulation of liquid NaK.
d) There must be a sufficient number of independent heat transport circuits that no credible accident will render all of these heat transport circuits non-functionalfor natural convection.
e) The reactor must have a negative reactivity coefficient through its entire accessible temperature range. This coefficient will limit the reactor maximum operating temperature.
f) The sodium pool level must always be sufficient for the natural circulation heat removal system to reliably operate;
g)The water injection systems into the steam generators must be configured to reliably operate in all credible emergencies.

For each FNR there are 48 independent passive heat removal circuits any four of which can reliably and safely remove the fission product decay heat.

Under the circumstances of a double nested liquid sodium pool wall failure the heat transfer capacity of each heat transfer system might fall by a factor of three. However, we only need (1 / 12) of the entire heat transfer system capacity to remove fission product decay heat. Thus in order to reliably remove fission product decay heat it is essential that (1 / 4) of the total reactor heat transfer capacity must continue to function so that under the adverse condition of a double sodium containment wall failure the remaining certain heat transfer capacity is:
(1 / 3)(1 / 4) = (1 / 12)
of system full power heat removal capacity. Hence for maximum reliability there should be at least twelve independent heat removal circuits functioning.
 

FISSION PRODUCT DECAY HEAT REJECTION:
The safety concept is that there must always be enough cooling water stored on the reactor site to safely remove fission product decay heat by evaporation with minimal reliance on electic power. For example, one heat to electricity conversion system can be used to provide station power, which is independent of problems on the external electricity grid.
 

NaK drains down into dump tanks. Steam generator condensate drains down into a pumped sump. Other sump pumps expel leakage water from the reactor enclosure foundation.
 

10)Reserve Argon Supply Maintenance:
a) Reserve argon is stored in eight atmospheric pressure bladders;
b) The bladders are individually piped so that a failure of one bladder has little or no effect on the other bladders.
c) The bladders are physically protected by 1 m thick concrete walls.
d) Gas flow into the bladders is cooled to protect the bladder material from both heat and sodium vapor.
 

********************************************************************************************

8) LACK OF EMERGENCY POWER
Potential Cause:
Insufficient redundant emergency power generation
 

9) LOSS OF HEAT SINK CAPACITY
Potential Cause:
Major earthquake
Major hurricane
Major tornado

Potential Consequence:
Inability to cool Na pool
Inability to reject fission product decay heat
Sodium boiling
Enclosure failure due to internal sodium vapor pressure

Remedy:
Two independent emergency shutdown systems;
Twelve fold heat transport loop redundancy;
Four fold heat sink redundancy;
On-site water storage for cooling by evaporation and direct steam release;
Quantified capacity for rejection of fission product decay heat by low pressure steam release from steam generators;
 

The FNR described herein is designed to ensure compliance with all of the aforementioned safety conditions.

Each of the aforementioned major safety concerns is addressed by a normal protective measure. Failure of the normal protective measure usually triggers either a zone or a total FNR shutdown. The safety system must remain continuously powered by either the external electricity grid, on-site turbogenerators or local standby power generation.
 

OTHER SAFETY CONCERNS:
10) There are other safety concerns relating to: chemical safety, fire safety, radiation safety, thermal power safety, credible physical threats and potential control system failures. There must be certainty regarding protection of both workers and the public from aggressive and toxic chemicals, sodium and potassium combustion, ionizing radiation and explosive thermal energy releases.

11) Quantified tolerance to intermediate heat exchange bundle and steam generator tube failures;
12) Quantified proliferation resistance;
 

NON-NUCLEAR MAINTENANCE:
On-site personnel are required to do periodic routine non-nuclear preventive maintenance on the NaK heat transport system, induction pumps, steam generators, injection pumps, turbo-generators, condensers, cooling towers and related mechanical and electrical equipment and to make repairs as necessary. However, this equipment should not involve any radioactivity. There is sufficient redundancy in the FNR support equipment that some of the heat transport circuits can be shut down for maintenance or repair while the others remain in operation. Thus, the only reasons for keeping staff on the reactor site 24/7 is compliance with steam power plant regulations and maintenance of site security.
 

FNR POWER CONTROL:
For normal safe thermal power control FNRs rely on thermal expansion of reactor fuel to reduce the FNR reactivity and hence reduce the thermal power output as the fuel temperature increases. The reactor core zone fuel geometry should be slowly adjusted to change the fuel average temperature setpoint or to cause a cool or cold reactor shutdown.

Thermal power production is controlled via the NaK induction pump flow rate settings.

FUEL SHUFFLING AND REFUELING:
FNRs rely on remote crane manipulation of highly radioactive fuel bundles during fuel bundle installation, shuffling and replacement. This crane manipulation is unlikely to be fully automated in the near future, so this portion of FNR work will likely be more prone to human error.

In the event that during loading or unloading a fuel bundle is dropped and falls to the bottom of the liquid sodium pool the dropped fuel bundle must be immediately retrieved, not ignored or forgotten. The potential danger is a prompt critical condition arising from random overlap between the core fuel of the dropped fuel bundle and the core fuel of yet another dropped fuel bundle. To minimize such problems the polar gantry crane used for fuel loading and unloading should be fitted with a safety line to prevent accidental load drops.
 

LOADING AND UNLOADING FUEL BUNDLES:
During fuel shuffling it is important to never let the fuel assembly accidentally go critial. In loading fuel bundles into the sodium pool each movable bundle should be installed in the fully withdrawn position before installing the adjacent fixed fuel bundles. Similarly the fixed fuel bundles adjacent to a movable bundle should be removed before extracting the movable fuel bundle. That strategy ensures that the fuel assembly will not accidently go critical due to pulling a movable fuel bundle through the matrix of adjacent fixed fuel bundles.

FNRs rely on fairly complex crane manipulation of fuel bundles during fuel bundle installation and replacement. This crane manipulation is unlikely to be fully automated in the near future, so this portion of FNR work will likely be subject to potential human error.

In the event that during loading or unloading a fuel bundle is dropped and falls to the bottom of the primary liquid sodium pool the dropped fuel bundle must be immediately retrieved, not ignored or forgotten. The potential danger is a prompt critical condition arising from random overlap of the core fuel of the dropped fuel bundle with the core fuel of another dropped fuel bundle. To minimize such problems the gantry crane used for fuel loading and unloading should be fitted with a safety line to prevent such drops.
 

CORE FUEL MELTING PROTECTION:
A relevant paper about a comparable liquid sodium cooled reactor with metallic fuel is S Prism Reactor Margin To Accidents
 

TOLERANCE OF HEAT EXCHANGE TUBE FAILURES:
A practical FNR involves many thousands of intermediate heat exchange tubes. Sooner or later one or more of these tubes will fail. Each NaK loop has the following features:
1) The NaK loop components normally operate at ~ 0.1 MPa but are rated for a working presure of 1.8 MPa and are safety tested to 2.7 MPa;
2) There are NaK level sensors consisting of a long thin coils of nichrome wire suspended from an insulated feed through in vacuum filled head space. The electrical resistance of this coil to ground decreases as the NaK level increases.
3) There are NaK level sensors in the dump tanks.
5) If there is a leak in an intermediate heat exchanger the NaK will absorb Na-24 and become radioactive.
6) If there is a leak in a steam generator tube the NaK level and pressure will increase and the NaK will contain steam/water /hydrogen which will vent.
7) The NaK flows down through the steam generator tubes.

STEAM GENERATOR TUBE FAILURE:
8) On a steam generator tube rupture initially water/steam jets from the steam generator into the NaK which almost instantly raises the NaK loop pressure blowing NaK, up and out the vents with ball checks. This transient high pressure should trip the steam generator steam pressure release valve and drain valves and turn off the steam generator injection water pump and induction pump.

9) The trigger for draining the tube side of the steam generator to the NaK dump tank is formation of steam in the NaK loop or an increase in the NaK level.

10) It is essential to immediately isolate and drain the steam generator shell side to prevent the NaK loop from being filled with water via the leak in a steam generator heat exchange tube. Since the steam generators serving a single turbine are connected in parallel it may be necessary to trip off the entire steam generator group on detection of water in a NaK loop. By stopping the injection water pumps we stop any possible back flow of water.

11) Draining the shell side of the steam generator stops heat transfer through this NaK loop but potentially allows the NaK induction pump temperature to rise up to 460 degrees C. The NaK cannot be drained to its dump tank until there is certainty that the steam generator shell side is completely drained. Otherwise there is a possibility of a major accident resulting from water continuing to enter the NaK loop via the tube rupture in the steam generator and then entering the NaK dump tank.

12) As long as water/steam is present in the steam generator water continues to flow through the steam generator tube rupture into the NaK where it will produce steam and hydrogen. The pressure in the NaK loop now rapidly rises and discharges steam/hydrogen out the NaK loop vent via a ball check.

14) There is a NaK dump tank for each heat transport circuit. Each dump tank has sufficient volume to accommodate all the NaK in its circuit. If the argon pressure over a NaK dump tank is released the NaK will drain down into its dump tank.

15) The NaK loops are vented to above the roof by vents fitted with rupture disks and gravity operated ball check valves. The vents must be sufficiently high and protected such that NaK entrained in the exhaust cannot start a roof fire.

16) In order to service the NaK loop the NaK in the intermediate heat exchange bundle should be transferred to the NaK dump tank.

17) After repair the NaK loop must be refilled by application of overhead argon pressure to the NaK dump tank and overhead loop evacuation. The intermediate heat exchange bundle has a thin drain tube connected to its bottom inlet elbow. Then an overhead argon pressure permits complete draining of the liquid NaK from the heat exchange bundle.

18) In summary any significant change in either the NaK level or the NaK loop pressure is indicative of a serious problem with that heat transfer loop. The NaK level as a function of time in both the overhead vacuum tank and the dump tank and its radioactivity should indicate the nature of the problem.

19) Assume that there is a steam generator tube failure and that the NaK loop is not fully drained. Then NaK is expelled from the NaK loop via both the tube failure and via the open rupture disk

20) A consequence of a steam generator tube failure might be NaOH accumulation in elbows at the bottom of the NaK loop. A filter system should be provided that gradually removes NaOH from the NaK loop. This filter should be installed across the induction pump. The NaOH can be periodically dissolved by raising the minimum loop temperature above 318 degrees C and then cooling it in the filter. There still may be a problem with liquid NaOH sinking to the bottom of the NaK loop. It should be expelled via the intermediate heat exchange bundle clean out tube.
 

PROLIFERATION RESISTANCE:
Implementation of Proliferation Resistance
 

******************************************************************************************

THE WALK AWAY SAFETY CONCEPT:
The concept of walk away safety is that if the appropriate operating and/or maintenance personnel are not present when an out of specification condition occurs, the FNR should always default to a safe condition, including on loss of grid power.
 

On a simple grid power failure the sodium temperature should remain at its setpoint. The generation should continue running to maintain both station power and to provide reduced district heating.

If there is a containment problem the reactor setpoint drops from 470 C to 120 C so that the reactor can continue to supply low grade heat while not generating electricity.

When the reactor can no longer generate its own station power it switches to backup power to ensure continuing fission product decay heat removal.

Note that on recovery from a station power failure, if the liquid sodium has significantly cooled the average fuel temperature setpoint must be reset downwards and then very slowly raised before re-establishing reactor operation.
 

FNR CONTROL SYSTEMS:
The FNR facility has multiple independent control systems:
1) Sodium Pool:
The sodium pool control system operates almost independent of the heat to electricity conversion systems. The sodium pool features:
a) Normal temperature control;
b) Shutdown system #1;
c) Shutdown system #2;
d) Gamma ray based thermal power surge detection

2) There are 8 independent heat to electricity conversion systems, each with six dedicated heat transfer circuits and one turbogenerator.

There are four on-site cooling towers, each which serves two adjacent turbo generator halls.
 

***************************************************************

EMERGENCY SODIUM POOL COOLING:
Events triggering emergency sodium pool cooling include:
a) A sodium pool temperature high above its setpoint.
b) An imminent or existing sodium fire.
 

LOSS OF DISTRICT HEATING WATER
If there is loss of water from one district heating loop the connected condensers will not work which implies that the affected generators will not work which implies to loss of two of the eight station power systems.
 

LOSS OF CITY WATER:
The main reactor does not rely on a continuous supply of city water. However, city water pressure may be required for support services such as flushing toilets, refilling emergency water tanks, etc. so loss of city water pressure is a condition that requires ongoing manual supervision until the condition is fixed.
 

FNR SHUTDOWN STRATEGY:
At a planned and/or scheduled reactor shutdown the best strategy is to withdraw the movable fuel bundles but maintain a thermal load on the reactor that balances the fission product decay heat so that the reactor maintians its operating temperature for as long as possible. Hence electricity generation is maintained for feeding house power circuits. Only when the fission product decay heat is no longer sufficient to operate one turbogenerator are the reactor cooling pumps shifted to a source of external or backup power.
 

***********************************************************************

FORCED COLD SHUTDOWN:
On a forced cold shutdown the FNR no longer maintains temperature. The movable fuel bundles all fully withdraw. Fission product decay heat is removed from the reactor by the NaK. Natural circulation of the NaK transfers heat from the sodium pool to NaK and then water in the steam generators which heat is vented as steam.
 

LOSS OF THE EXTERNAL AC GRID:
On loss of the external AC grid the NPP disconnects from the grid and the turbogenerators revert to local frequency control. That local frequency can be phase locked to either the grid or a local time base. Everything continues to operate as normal but only one generator can meet the station parasitic load. All the pumps continue operating as before.

Loss of Grid AC power means that the remote cooling tower and remote building water cooling pumps will no longer operate. It is necessary to power the local cooling towers from the station power bus so that these local cooling towers continue to function when there is no grid AC power.

Typically each cooling tower has two of everything so that half of the cooling tower equipment is powered by one generator parasitic power circuit and the other half is powered by the other generator parasitic power circuit.

Thus on loss of AC grid power the FNR continues normal operation at reduced power.
 

*************************************************************************

LOSS OF GRID POWER:
In normal opertion the station power circuits continue operation after loss of AC grid power.

If there is loss of station power the related cooling tower water pump, NaK pumps and nitrate salt pumps will immediately stop and the nitrate salt will drain to its dump tank. Hence that system can no longer remove fission product decay heat.

Thus, if possible we do not want an AC grid failure to precipitate a station power failure. It is necesary to continue heat removal.
 

*************************************************************************************

LOSS OF SODIUM POOL CONTROL POWER:
In normal ongoing operation the sodium pool monitoring system consumes very little power and is easily battery backed for a long period of time. Hence the sodium pool monitoring system does not lose power until long after all eight station power systems have failed. On loss of sodium pool control power the movable fuel bundles gradually withdraw.

The sodium pool has a filter pump which can be powered from the station power circuit. This filter pump can be off for a long period of time with little negative effect.

However, if the batteries for the sodium pool electronics become depleted the reactor must fail to a cool shutdown with continuing fission product heat removal. These batteries should be charged from the station power bus.

If the sodium pool temperature becomes too high it is likely indicative of net sodium heating by fission product decay heat, which indicates a requirement for more cooling.

In a forced cold shutdown NaK is used to remove fission product decay heat from the Na. There must be reliable sources of argon pressure sufficient to transfer NaK from its dump tanks to the top of the steam generators.

Note that if the FNR has been operating for a significant length of time producing just station power the potential thermal power of the fission products will be low. However, care needs to be taken that emergency cooling water is not wasted.

Reconnection of a station power circuit to the AC grid requires resynchronization. Most such reconnections should be manually supervised.

Recovery from a forced cold shutdown requires manual intervention.
 

POWER SYSTEM MAINTENANCE:
If only one heat transport circuit is involved:
Drain down the relevant NaK loop;

If only one generator is involved:
Take generator to minimum power;
Disconnect generator from AC grid;
Turn off makeup water to its steam generators;
Drain down the six associated nitrate salt loops;
Drain down the six associated NaK loops;
Drain down the six associated HTF loops.

If one cooling tower is involved:
Turn off the associated generators, as necessary for safe work.
 

******************************************************************

FUEL ASSEMBLY ISSUES
The fuel assembly of a FNR consists of an array vertical fuel rods, enclosed by fuel tubes lined with iquid sodium that are held in position by a steel framework. the fuel asembly is immersed in a liquid sodium pool. Corresponding to each fuel geometry is an average core fuel temperature To.

For gross control of temperature To movable fuel bundles are pushed up into the matrix of fixed fuel bundles by hydraulic actuators. Each movable fuel bundle has attached to it a vertical indicator tube that projects above the liquid sodium top surface. The hydraulic actuator of each movable fuel bundle maintains the elevation of the top of the correspondiong indicator tube at a programmed value. Loss of hydraulic pressure causes movable fuel bundle withdrawal.

The vertical indicator tubes can transfer top downward force onto the movable fuel bundles. That force will increase the hydraulic pressure in the actuators. Sufficient hydraulic pressure in an actuator is relieved by a rupture disc failure.

In a FNR the average fuel temperature To responds almost instantly to a change in relatie fuel assembly geomatry.

In normal FNR operation the change in relative core fuel geometry is due to thermal expansion/contration.

In normal operation the maximum linear change in fuEl assembly dimension is about:
400 deg C x 10 ppm / deg C = 4000 ppm = 0.4%

A main safety isSue with FNRs is that unplanned fuel assembly linear dimensional changes greater than about 0.4% can potentially cause sudden fuel heating, fuel melting, sodium boiling or fuel vaporization. A sudden change in fuel state from a solid or liquid to a gas can cause an explosive transient pressure. Circumstances that lead to such transient pressures should be prevented if they occur the resulting equipment damage should be contained. A key to pressure transient suppression is using the transient pressure to blow the fuel assembly apart to rapidly reduce the fuel assembly reactivity..

The purpose of this section is to identify potential causes of these events and appropriate preventive and/or safe dissipation measures.
 

POTENTIAL CAUSES:
External force due to pool wall collapse onto fuel assembly;
External force due to a roof or crane failure causing a heavy object to fall onto the fuel assembly;
Too rapid insertion of fuel movable fuel bundles;
Over-insertion of movable fuel bundles;
Too cold a coolant inlet temperture;
Too large a coolant flow;
Misshandling fuel bundle during fueling;
Time lag in establishing natural sodium circulation

RELIEF MEASURES
Gravity safe fuel assembly with movable fuel bundles that fall out the bottom;
Robust fixed fuel bundle supports that will not fail under vertical load;
Robust sodium pool with 2 m sodium guardband that will prevent wall or heat exchange bundle colllapse onto fuel assembly;
Hydraulic movable fuel bundle actuators with no movement hysterisis;
Rupture disc in each movable fuel bundle to cause instant shutdown on application of a large vertical load;
Inert gas expansion to cause partial fuel dissassembly on a rapid increase in solid fuel temperature;
A pancake core zone shape to safely reduce reactivity on fuel vaporization;
A 400 degree C temperature margin between sodium operating temperature and sodium boiling point;
 

DETAILS OF PREVENTIVE MEASURES:

ROBUST SODIUM POOL
Sodium pool has a 2 m thick wall containing 2.5 inches of steel and 2 m of sand. There is a 2 m wide liquid sodium guard band. there is a 3.0 m air gap between the outside of the sodium pool wall the surrounding concrete wall. Hence no credible earthquake can trnsmit deforming horizontal force to the fuel assembly.

OVERHEAD PRTECTION
If a heavy ceiling section faklls onto the sodium pool it is stopped by the indicator tubes. The indicator tubes transfer force onto the movable fuel bundles and then onto the hydraulic actuator. If this force is sufficient the rupture disc fails and the movable fuel bundle is withdrawan.
 

TOO RAPID MOVABLE FUEL BUNDLE INSERTION
At the times of intended reactor start up or shutdown there are large changes in fuel geometry caused by FNR actuators changing the depth of insertion of movable fuel bundles into the matrix of fixed fuel bundles.

In the event that the core fuel temperature rapidly rises (as in a prompt neutron critical event), a portion of the core fuel is blomn toward the penum, while the nuclear rea.

In the event that a heavy object falls on top of a FNR, rupture disks break, causing the movable fuel bundles to be driven out of the marix of fixed fuel bundles. Then the drop in reactivity will stop the fission reaction.
 

*********************************************************************

REACTIVITY<

Certainty of Reactivity Decrease With Increasing Temperature:
a) The ratios of sodium, steel and specific core fuel in the core zone must meet certain constraints;
b) The core zone geometry must meet certain constraints that control neutron emission from the core zone to the blanket zone.

NORMAL FNR OPERATION:
A FNR normally operates on a fixed negative slope reactivity versus average fuel temperature curve, which curve is selected by adjustment of the insertion of movable fuel bundles into a matrix of fixed fue bundles using FNR actuators.

During normal operation the core fuel forms gaseous fission products. During the first few months of operation the gaseous fission products cause the solid core fuel to swell due to internaly trapped gas. When the core fuel linear sweling reaches about 15% the pores connect and the trapped gas leaks out the core rod surface leaving porous fuel behind. The pores contain Fission product inert gases. Normally the pressure of these gases equals the plenum pressure plus the pressure due to the sodium column beside the upper blanket fuel stack.
 

PROMPT NEUTRON CRITICALITY
The FNR is intended to operate by fission of plutonium rather than uranium. Plutonium has a smaller fraction of delayed neutrons than uranium. The fuel temperature will almost instantly track the reactor setpoint defined by the fuel geometry. However, the temperature of the coolant sodium takes a few seconds to respond. The FNR is designed to operate with about a 10 degree C temperture difference across its fuel tube wall. However, if the sodium temperature is too low with respect to the reactor setpoint the required heat flux will be too high, forcing the fuel temperature up past its center line meltingpoint.

A characteristic of fast neutron fission is that for every fuel geometry there is an average fuel temperature setpoint at which the fuel assembly reactivity is zero. The response time of this characteristic to a change in fuel geometry is essentially instantaneous.

With flowing sodium It is normal for the fuel temperature at the bottom of the core zone to be below the fuel temperature setpoint and for the fuel temperature at the top of the core zone to be above the fuel temperature setpoint.

If the fuel is in adiabatic conditions the fuel temperature will attempt to remain at the fuel temperature setpoint.

In non-adiabatic conditions if the surrounding coolant temperature is below the fuel temperature setpoint the average fuel temperture will remain at the fuel temperature setpoint and the fuel will establish an internal temperature distribution that is consistent with both the average fuel temperature and its cooling environment. Hence, if the fuel temperature is below its setpoint on the outside it will be above its setpoint on the inside. Hence the fuel alloy normally experiences thermal stress due to being hotter on the inside than on the outside,

If the difference between the fuel temperature set point and the coolant temperature is too large fuel centerline melting will occur. Centerline melting will cause further fuel expansion which will permanently change the shape of the fuel. Prolonged centerline melting will lead to radial redistribution of fuel alloy elements.

If the temperature difference between the fuel temperature setpoint and its coolant is large some of the fuel components will vaporize causing major damage to the fuel tubes and fuel assembly. Thus, during reactor warmup care must be taken to ensure that the fuel temperature setpoint is not increased so fast as to cause a major difference between the coolant temperature and the fuel temperature setpoint. If the fuel temperature setpoint is raised slowly and there is no external thermal load the fuel will output enough heat to keep the coolant temperature close to the fuel temperature setpoint.

If during otherwise normal FNR operation the bottom end centerline temperature of the core fuel rods is too low the top end centerline temperature of the fuel rods will be too high and fuel rod centerline melting will occur atthe top of the fuel rods. Hence care must be taken to not thermally overload the reactor to prevent this condition occurring. Also care must be taken to ensure good coolant mixing prior to the coolant arriving at thefuel assembly intake port.

FIND MAXIMUM WARM UP RATE:
Assume that during warmup the FNR's externl therml load is negligibly small. The amount of time required to heat the reactor from 100 degrees C to 400 degrees C is:
{4000 tonne X 1000 kg / tonne X 1000 g / kg X 400 deg C X 1.23 J / g deg C]/ 10^9 J / s
= 1968 seconds
= 32.8 minutes

Thus the temperature has to be ramped up very slowly to prevent development of a prompt neutron critical condition.

A potential serious threat toa FNR is a sudden unplanned increase in fuel temperature setpoint due to a sudden unplanned change in relative fuel geometry. Such a change in relative fuel geometry might be caused by an external force that mechanically acts on the fuel assembly.

The fuel assembly is mechanically protected on its sides and bottom by a very robust sodium pool. It is protected on top by the enclosure dome and by the thermal enclosure ceiling. A heavy weight, such as a large chuk of concrete, falling onto the top of the fuelassembly will rupture a part in the movable fuel bundles, causing the movable fuel bundles to free fall which immediately reduces the fuel assembly temperature set point to below room temperture.

Normally the reactivity is zero. However, if an external agency causes compression of the fuel assembly the reactivity will briefy increase and the fuel temperature will almost instantly rise until fuel thermal expansion is enough to return the reactivity to zero. The potential danger is that the rise in fuel temperature can potentially cause fuel melting or fuel vaporization. A relatively small unplanned change in fuel assembly dimensions is sufficient to cause this problem.

The fuel assembly is protected against promt criticality triggered by heavy objects falling on it by devices in the movable fuel bundles that cause movale fuel bundle total withdrawal if a heavy object falls either onto the movable fuel bundle or onto the vertical tube projecting from it.
 

NORMAL CONTROL

Normal FNR temperature control is achieved by thermal expansion-contraction of the fuel assembly. For most materials the linear TCE is about;
10 X 10^-6 / deg C.
Hence if the operating range is 50 deg C the normal linear expansion is about:
500 X 10^-6. In a practical reactor with a core zone diameter of 10 m the change in diameter over a 50 degree C temperature difference is:
500 X 10^-6 X 10^4 mm = 5 mm
Hence the fuel assembly must be mechanically stable to within a fraction of 1 mm. Hence the fuel assembly must be mechanically stable and must be protected against unplanned external forces such as earthquakes or enclosure collapse.

A prompt critical condition might be caused by incorrect insertion of movable fuel bundles into the fuel assembly or might be caused by an event which has the effect of compressing the fuel assembly.
 

PROMPT CRITICAL FUEL DISASSEMBLY:
If a prompt neutron critical condition occurs the core fuel temperature will almost instantly rise causing the trapped gas in the core fuel pores to rapidly expand. That expanding high pressure gas will drive adjacent liquid Na upwards against the bead at the top end of fixed fuel bundle core fuel rods. The fixed fuel bundle core fuel rods and the blanket rod stacks above them will be lifted up, reducing the reactivity and hence causing a temporary reactor shut down.

After some time the high pressure inert gas will leak past the beads at the top of the core fuel rods. As this occurs the core fuel rods will gradually fall back to their original positions. During this temporary reactor shut down it is essential to withdraw moveable fuel bundles.
 

CORE FUEL DISASSEMBLY CALCULATION:
Assume that the active length of a core fuel rod is 30 cm. Assume that the inside cross sectional area of a fuel tube is A.
Then the volume of the trapped inert gas is:
0.3 X A X 30 cm.

Assume tht the fuel temperature suddenly rises from 520 C to 620 C. The fractional increase in trapped inert gas volume at a constant pressure is:
100 C / (273 C + 520 C ) = 100/ 793 = 0.126
Hence if there was no blanket rod stack the core fuel would rise by:
0.3 X A X 30 cm X 0.126 / A = 1.134 cm

This rise will be reduced by the weight of the blanket rod stack. However, linear thermal expanion of the blanket rod might be:
30 cm X 20 X 10^-6 / deg C X 100 C = 0.06 cm

Hence linear fuel disassembly provides some degree of protection against fuel melting caused by accidental transient prompt neutron criticality.

Note that the plenum pressure and fuel presure are essentially the same.
 

REACTOR OVERLOADING:
Na has a large thermal coefficient of expansion. If the return sodium is too cold there is a potential threat to the reactor and its enclosure due to prompt neutron criticality. A possible danger in an an earthquake or other event which causes an accumulation of cold sodium to enter the intake port of a fuel bundle causing a large surge in reactor power. It is important to ensure good mixing of recirculated hot and cool sodium before the mixed return sodium reaches the fuel bundle intake port.
 

SUPPRESSION OF PROMPT NEUTRON CRITICALITY
A prompt critical condition might be caused by a reactor enclosure partial collapse which crushes the core zone of the assembly of active fuel bundles. For example, a falling crane or a large airplane impact which causes physical collapse of part of the reactor dome.

In the event of a sudden rapid increase in fuel temperature there is fuel disassembly that temporarily injects negative reactivity in order to rapidly reduce reactor thermal power. This temporary rapid reduction in thermal power provides sufficient time for the movable fuel bundle actuators to lower the thermal power versus return sodium temparature curve.
 

2) POTENTIAL CAUSES OF FUEL MELTING:;
Potential Causes:
-sodium coolant void instability
-sudden fuel geometry change due to missile attack
-sudden fuel geometry change due to earthquake
-too rapid insetion of movable fuel bundles into matrix of fixed fuel bundles
-unstable fuel geometry
- fuel assembly structural failure
-displacement of bonding sodium by cesium vapor
Control system problem
Movable fuel bundle actuator problem
Thermal expansion of the fuel assembly provides only a small range of reactivity control that can easily be overwhelmed by a fuel geomety change. Maintenance shutdown and long term compensation for fuel aging both require mechanical adjustment of the fuel geometry. Neutron absorbing control rods are unsuitable for reactivity adjustment because they waste breeding neutrons.

Potential Consequences:
- Fuel melting
- Sodium void instability
- Reactor coolant explosion
- Fuel meltdown
- Enclosure failure
- Poor fuel utilization
- Airborne radioisotopes

Remedy:
- Robust fuel assembly
- Axial fuel disassembly on approach to prompt neutron criticality;
- Two independent emergency shutdown systems;
- Limit on movable fuel bundle insertion rate
- Ball bearing fuel assembly isolation
- Distributed reactor controls
- Stable hysterisis free actuators for movable fuel bundles
- Control system limits the rate of change of fuel geometry;
- Temperature and gamma radiation scanning are used to fine adjust the movable fuel bundle actuator position settings
 

NORMAL AUTONOMOUS OPERATION:
In the normal autonomous operation mode the entire FNR facility operates automatically. Absent an alarm there is nothing for anyone to do. The output power level is set by remote dispatch of the induction pump flow rates. The cooling towers act to regulate the district heating water temperature.
 

NORMAL OPERATION:
During normal opertion the FNR design discussed herein relies on a negative temperature coefficient of reactivity to maintain the Na pool surface temperature at its setpoint, where the reactivity is zero.

In normal operation there is about a 500 degree C difference between the reactor temperature setpoint (460 C) and the deep sodium coolant boilin‌g point (960 C).

The fuel assembly must have a means of gross reactivity adjustment to enable reactor setpoint adjustment.
 

***************************************************************

SODIUM VOID FORMATION:
One of the reactor design issues is prevention of sodium void instability. Formation of sodium voids would potentially increase the local reactivity. At all reactor operating states the decrease in reactivity due to an increase in fuel temperature must safely exceed the increase in reactivity due to structural and liquid sodium coolant thermal expansion. In this respect the large thermal coefficient of expansion of Pu plays an important role. The reactor temperature must be sufficiently low and the liquid sodium head pressure sufficiently high that coolant voids never form.

The tendency for sodium voids to form is related to the local sodium temperature, the local sodium flow rate, the sodium temperature distribution in the reactor and the sodium hydraulic head. The high sodium thermal conductivity resists sodium void formation.

The reactor must not rely on any mechanical pumping mechanism for preventing formation of sodium voids. Typically this void free operation is achieved by operating the fuel far below the sodium boiling point. The sodium boiling point is further raised by use of a significant liquid sodium head pressure in the reactor core zone. The fuel temperature shouldnever be so large as to potentially enable sodium void formation. Reactor power peaks tend to occur at times when there are changes in fuel geometry with the object of increasing the average fuel temperature.

SUPPRESION OF PROMPT NEUTRON CRITICALITY:
The main nuclear risk with a FNR is an unplanned event that causes a rapid large increase in fuel assembly reactivity that cannot be safely managed via a simple increase in fuel temperature. The fuel assemblies described herein have a special protective mechanism known as linear fuel disassembly that, on a sudden increase in core fuel temperature, will temporarily reduce the fuel assembly reactivity. During the period of that temporary reactivity reduction it is essential that the movable fuel bundles be withdrawn sufficiently to ensure a fission reaction shutdown.
 

To obtain an explosion it is necessary to cause a reactor to suddenly become neutron prompt critical. Delayed neutrons are too slow to sustain the rapid power rise needed for an explosion.

Fast neutrons are high energy neutrons (~ 20,000 km/s),
Prompt neutrons are fast neutrons that come directly from a fission reaction;
Delayed neutrons are fast neutrons that are emitted from the fission fragments a few seconds after the corresponding nuclear fission. Delayed neutrons make it possible to design and safely control both thermal neutron and fast neutron power reactors.
Note that with Pu-239 fissile fuel the ratio of delayed neutrons to prompt neutrons is smaller than with U-235.
Thermal neutrons are low energy neutrons (V = 2 km / s) that have been slowed down by scattering by low atomic weight moderator materials.

Above the prompt-critical point reactor power rise can occur quickly with thermal neutrons and much faster with fast neutrons. The power rise with prompt neutrons will quickly cause the reactor to structurally disintegrate. Structural disintegration will cause the reactor to become sub-critical which should stop the nuclear reaction.

Axial fuel disassembly acts to shutdown the nuclear reaction before fuel or other damage can occur. Axial disassembly acts in asub millisecond time frame.

A well known case of a reactor explosion resulting from prompt thermal neutron criticality was in 1986 at:
Chernobyl

A good description of the safety measure failures that led to the accident at Chernobyl and the corresponding preventive safety measures used in CANDU reactors is contained in a report titled:
Chernobyl - A Canadian Perspective
 

FUEL SAFETY:
A major safety concern relating to a power FNR is an external event such as a military attack that might rapidly inject large amounts of positive reactivity into the FNR. In these circumstances within about 1 ms a linear fuel disassembly mechanism must inject a large amount of negative reactivity into the FNR to suppress prompt neutron criticality while the reactor is being shut down by withdrawal of movable fuel bundles.
 

AXIAL DISASSEMBLY:
Axial core fuel disassembly provides short term protection against prompt neutron criticality.

Recall that in each active fuel tube there is a fuel stack consisting of blanket fuel rods on the bottom, then a core fuel rod, then more blanket rods, then the empty plenum on top. The fuel rod stack is surrounded by a layer of liqud sodium.

When the fuel is brand new the core rod is solid. However, once the reactor starts to operate the active portion of the core rod becomes spongy. The sponge pores are small gas pockets. The gas is a mix of inert and non-inert gases and at low plenumpressures cesium vapor. The pores also contain cesium metal. This gas pressure soon becomes sufficient that it leaks out the side walls of the core fuel rod and into the surrounding liquid sodium. There is little gas leakage out the fuel rod cool ends due to both inactivity and the axial force exerted by the weight of the overhead blanket rod stack.

The leaking non-inert gases almost instantly chemically combine with the adjacent liquid sodium. At the core fuel rod walls the normal inert gas pressure is given by:
(plenum pressure) + (pressure due to height of liquid sodium column)

Now suppose that there is a sudden rise in the core fuel temperature due to onset of fast neutron criticality. There will be a proportional rise in the absolute pressure of the inert gas trapped inthe core fuelo pores. This pressure will relieve itself down to the plenum pressure plus the liquid sodium head by displacing adjacent liquid sodium. Moveble fuel bundles have a sufficient sodium gap inside the fuel tubes that sodium easily flows upwards past the hot end of the core fuel and past the upper blanket fuel stack to the plenum.

However, for fixed fuel bundles initially sodium movement due to the internal gas pressure is resisted by a cool end bead on the core fuel rod and the weight of the overhead blanket rod stack.

However, if there is a snug fitting ring at the top end of the fixed fuel bundle core fuel rod the sodium pressure underneath the ring will increase until it is sufficient to lift both the upper blanket rod stack and its surrounding sodium. This lifting action should instantly reduce the fuel assembly reactivity.

The initial lifting force is due to thermal expansion of trapped inert gases. However, as the core fuel temperature rises the cesium vapor pressure provides an increasing lifting force component. It may be important to ensure that at least some of the fuel initially contains some cesium.

Note that as the plenum pressure increases over time this reactivity reduction mechanism will incresingly rely on thermal expansion of inert gases trapped in the pores of the fixed core fuel rods. Thus early in the fuel life when the plenum pressure is low we rely on cesium but once the plenum pressure exceeds the equivalent pressure of the upper blanket rod stack we rely on expansion of inert gas.

AXIAL DISASSEMBLY TEST:
The FNR known as EBR-2 was tested under full power with sudden loss of cooling and while the control rods were deliberately inactivated to prevent automated control feedback. The EBR-2 used axial fuel dissassembly which intrinsically drove FNR power levels to zero within 5 minutes. This type of test was carried out almost 50 times with no apparent damage to the reactor nor to any component, with the reactor being powered up again the same day. The reason for this safe behavior was likely axial fuel disassembly within the fuel tubes assisted by vaporization of cesium..
 

******************************************************************************************

FUEL ASSEMBLY STRUCTURAL STABILITY:
The fuel assembly must be sufficiently robust that the fuel relative geometry remains physically stable during all manner of credible natural external events such as earthquakes, tornados, hurricanes, tsunami, mountain slides and natural missile impacts.
 

REACTOR FUEL GEOMETRY STABILITY:
A small step change in reactor fuel geometry causes an instantaneous change in reactor reactivity. That change in reactivity is immediately followed by a change in reactor fuel temperature sufficient to reduce the reactivity to zero.

On insertion of movable fuel bundles into the matrix of fixed fuel bundles to raise the reactor setpoint temperature extreme care must be taken to ensure that the resulting increase in fuel temperature caused by the difference between the new reactor setpoint temperature and the actual coolant temperature is not so great as to melt the fuel.

Similarly if due to reactor thermal overload the coolant temperature at the bottom of the active fuel rods becomes too low with respect to the reactor setpoint temperature the fuel will melt.

Fuel melting during fuel bundle insertion can be avoided by:
a) Inserting the movable fuel bundles very slowly so that the reactor setpoint temperature is never far above the actual coolant temperature;
b) Disconnecting the thermal load while fuel bundle insertion is taking place;
c) Keeping the reactor at its design operating temperature at all normal times except during reactor shutdowns for fuel changes or intermediate heat exchange bundle service.

The potential for fuel melting due to simple thermal overload is eliminated by designing the heat transport system so that the maximum possible heat removal rate does not exceed the reactor fuel design limit.

There is a complicating issue that the reactor reactivity is also weakly dependent on the coolant and steel temperatures. When the coolant temperature is below the reactor setpoint temperature the coolant decreases the reactor reactivity. To compensate the reactor fuel temperature decreases sufficiently to bring the net reactor reactivity to zero. This issue will cause a decrease in the sodium discharge temperature.

Similarly, when the coolant temperature is above the reactor setpoint temperature the coolant increases the reactor reactivity. To compensate the reactor fuel temperature increases in order to bring the net reactor reactivity to zero. This issue will cause an increase in the sodium discharge temperature.

In summary, in response to a step increase in thermal load the sodium discharge temperature decreases and in response to a step decrease in thermal load the sodium discharge temperature increases.

After a step increase in reactor setpoint temperature it may take many minutes for the sodium pool temperature to rise. As the sodium pool temperature approaches the reactor temperature setpoint the fission reaction rate will decrease as indicated by reduced gamma flux.

Similarly, a step decrease in reactor setpoint temperature will cut off the chain reactions. It may take many minutes for the primary sodium pool temperature to fall and the chain reaction rate, as indicated by the gamma flux, to rise to its former level.

An important issue in earthquake protection is bolting the fixed fuel bundles together to form a rigid matrix. The liquid sodium above the fuel assembly can safely slosh back and forth in an earthquake provided that the surface waves do not change the fuel assembly relative geometry and hence its reactivity.
 

TOO RAPID CHANGES IN FUEL GEOMETRY:
A too rapid change in fuel geometry could be caused by too rapid insertion of movable fuel bundles into the matrix of fixed fuel bundles. Too rapid movable fuel bundle insertion can be prevented by using appropriate mechanical speed limits on the FNR actuators.

There is a transition region between a reactor being critical with delayed plus prompt neutrons and being critical with just prompt neutrons. A FNR should normally remain in that transition region. A key issue is time. If the change in reactor fuel geometry is slow enough the heat released while under control by delayed neutrons should induce sufficient negative reactivity to prevent further approach to the prompt critical condition. In a FNR controlled by the fuel temperature this feedback is almost instantaneous. The danger lies in delayed positive reactivity injections from sodium and steel that exceed the safe available negative reactivity injection available from thermal expansion of the reactor fuel.

A key issue in this respect is fuel geometric stability. With Pu-239 fuel the time required for a 0.2% _______increase in reactivity due to a change in fuel geometry must be long compared to 3 seconds.

Unlike solid fuels, liquid fissile fuels are potentially very dangerous because liquids can develop cavitation, vorticies, or surface waves that can change the reactor reactivity by more than 0.2% in a time period which is short compared to 3 seconds. It is much safer to use physically stable solid fuel as in this FNR.
 

****************************************************************************

LARGE DROP IN REACTOR CORE ZONE INLET TEMPERATURE:
In a FNR the reactivity increases with decreasing fuel temperature. Depending upon the fuel material distribution if the primary sodium temperature entering the reactor core zone drops too quickly the resulting increase in heat flux might melt the fuel on its cenerline, vaporize the internal liquid sodium or damage the fuel tubes. It is essential to have sufficient coolant thermal mass to prevent a sudden major coolant core zone temperature drop that might lead to fuel melting or prompt neutron criticality.

Since the change in reactor reactivity with a change in temperature is negative the reactivity cannot grow due to a coolant temperature rise.

A large FNR with a 1.7 m wide liquid sodium guard band contains a lot of heat stored in its primary liquid sodium pool. Hence it can load follow using some of that stored heat without any rapid change in the reactivity of its fuel assembly. The change in reactor thermal power output can take many minutes whereas the rate of heat transfer out of the primary sodium pool can change by a similar fraction in a few seconds.
 

********************************************************************

PREVENTION OF PROMPT NEUTRON CRITICALITY:
Prompt neutron criticality is prevented by:
a) Proper fuel assembly design;
b) Primary sodium level maintenance;
c) Negative reactivity injection on minor prompt neutron criticality;
d) Two independent active shutdown systems, each with reactor off as a power failure default;
e) Instant reactor shutdown on occurence of a shock or pressure wave sufficient to significantly affect the FNR fuel geometry;
f) Proper control system design.
g) Ongoing monitoring to detect off-normal reactor conditions.
 

POTENTIAL CAUSES OF PROMPT NEUTRON CRITICALITY:
In a FNR there are several possible ways that prompt neutron criticality might occur.

1) Reactor power instability.

2) Too rapid changes in fuel geometry.

3) Loss of surrounding sodium.

4) Sudden large drop in reactor core zone coolant inlet temperature. This issue can be mitigated via a sufficient primary sodium thermal mass to ensure a gradual change in core zone local reactivity as a function of position.

5) Insufficient earthquake tolerance.

6) A direct attack by some form of dome penetrating bomb or missile.

7) Insufficient Murphy's Law tolerance. Generally reactors should be designed such that three independent reactivity control systems must all simultaneously fail before a major accident can occur.
 

PROMPT NEUTRON CRITICALITY DAMAGE MECHANISM:
A nuclear power plant can potentially destroy itself if its reactor is forced into a condition known as prompt neutron criticality. Usually this condition is associated with sodium void instability and is mitigated by the proprietary negative reactivity injection mechanism. In the prompt neutron critical condition there is a sudden rapid release of nuclear thermal energy potentially sufficient to melt and/or vaporize the reactor fuel and vaporize the adjacent liquid reactor coolant. Rapid coolant vapor formation will cause such a large increase in cooling fluid pressure that the reactor will literally blow itself apart. A prompt critical reactor explosion stops when the physical expansion of the fuel is sufficient to stop the nuclear reaction. The reactor explosion at Chernoblyl in 1986 was the result of rapid cooling water vaporization due to prompt neutron criticality.

A lesson here is that a determined military attack which causes prompt neutron criticality will likely seriously damage any nuclear power reactor.

One way of addressing the prompt neutron criticality issue is to design the reactor and fuel such that any credible prompt neutron critical condition will self extinguish before the resulting energy release is sufficient to be a threat to either the reactor or the surrounding public. In a FNR described herein the strategy is to inject negative reactivity in any circumstance that causes a rapid tise in fissile fuel temperature.

In a FNR this protective mechanism must operate on a time scale of the order of 10^-4 seconds, comparable to the time scale of firing a bullet from a hand gun..

One way of preventing a determined military attack from causing a prompt neutron criticality explosion is to mount tne movable fuel bundle actuator nuts in their surrounding tubes with small radial screws. If the load on these radial screws becomes much larger than the weight of a movable fuel bundles these screws will fail in shear and the movable fuel bundle will fall to its fully retracted position. In normal reactor operation these screws are protected from twisting torque by outside vertical slots in the actuator nuts that slide into matching protrusions from the inside wall of the surrounding tubes.
 

FNR PROMPT CRITICAL RISK:
When nuclei fission over 99% of the free neutrons that are emitted are prompt neutrons and less than 1% are delayed neutrons. Both the prompt and delayed neutrons have initial kinetic energies of the order of 2 MeV.

There are two classes of fission type nuclear power reactors, Fast Neutron Reactors (FNRs) and thermal neutron reactors. Most existing power reactors use water as the primary reactor coolant and neutron moderator. In these reactors the hydrogen component of the cooling and moderating water rapidly absorbs kinetic energy from high energy fission neutrons, so most of the scattered neutron flux consists of slow or "thermal" neutrons. However, if the primary coolant is a liquid metal, such as sodium which has 23X the atomic weight of hydrogen, most of the scattered neutron flux consists of higher energy or "fast" neutrons. In spite of a lower fission capture cross section the fast neutrons trigger many more fissions per unit time than do thermal neutrons. Hence if the reactor reactivity is positive with respect to prompt neutrons the rate of free neutron population growth and hence thermal power growth in a FNR is much greater than in a water cooled reactor. Hence a FNR must incorporate passive measures that instantly reduce the reactor reactivity with rising fuel temperture.

Power reactors normally operate at an equilibrium point where the reactor reactivity is slightly negative with respect to prompt neutrons and is zero with the addition of delayed neutrons. At this operating point the reactor is stable and fine power control is achieved via variation of the delayed neutron flux.

However, a sudden large change in fuel geometry, coolant geometry or temperature can cause the reactor reactivity to swing positive on prompt neutrons which causes an almost instataneous increase in reactor fuel temperature and fuel thermal power output. It is essential to immediately suppress this positive reactivity before the fuel or worse the fuel tube melts.

In a thermal neutron reactor the reactivity is controlled by mechanical adjustment of the position of control rods. In a thermal neutron reactor when the reactivity swings slightly positive the rate of neutron population growth is sufficiently slow that mechanical control rod insertion can be used for safe reactor power control, even if the reactor reactivity slightly increases with increasing fuel and coolant temperature. A practical issue with such mechanical control systems is that near reactor power equilibrium the control rod insertion control mechanism tends to slowly hunt.

In a fast neutron reactor, when the reactivity swings positive on prompt neutrons the rate of neutron population growth and hence reactor thermal power output is so fast that safe reactor power control relies on the reactor reactivity decreasing with increasing fuel temperature. Via fuel linear thermal expansion a fast neutron reactor should immediately converge to a new safe stable power state without relying on any mechanically driven change to the fuel assembly geometry. There is also an issue of a slightly delayed positive reactivity injection due to thermal expansion of the sodium coolant. Hence, to achieve the required performance a FNR is subject to design constraints that are not applicable to water cooled reactors.
 

AXIAL FUEL DISASSEMBLY:
A major safety concern relating to a power FNR is an external event such as a military attack that might rapidly inject large amounts of positive reactivity into the FNR. In these circumstances within less than 1 ms a proprietary mechanism injects a large amount of negative reactivity into the FNR to suppress prompt neutron criticality while the reactor is being shut down by withdrawal of movable fuel bundles.
 

CORE FUEL MELTING PROTECTION:
A relevant paper about a comparable liquid sodium cooled reactor with metallic fuel is S Prism Reactor Margin To Accidents
 

PROTECTION AGAINST SUDDEN DROPS IN NaK RETURN TEMPERATURE:
- Temperature moderated by large thermal mass
- Thermal mass temperature moderated by induction pump flow.
 

TOLERANCE TO OVERHEAD ROOF OR CRANE COLLAPSE:
The FNR design presented herein has an additional emergency shutdown mechanism triggered by downward force on the indicator tubes caused by an event such as an overhead crane or roof collapse. However, tripping of this emergency shutdown mechanism will leave the reactor inoperative until the affected fuel bundles are replaced.
 

***************************************************************

TWO INDEPENDENT SHUTDOWN SYSTEMS:
The FNR design discussed herein has two independent active shutdown systems that are also used for reactor temperature setpoint control and to enable reactor maintenance and refuelling. These systems have a response time of the order of one second. These systems are described at Two Independent Shutdown Systems
 

***********************************************************

FISSION PRODUCT DECAY HEAT REMOVAL:
A safety concern applicable to all fission reactors is removal of of fission product decay heat after reactor shutdown. The issue is that even after the chain reaction stops fission product decay continues to produce heat at about 8% of the reactor's full thermal power capacity. This fission product decay heat output declines over time, but it is high for about one day and is significant for many weeks. Without a reliable means of fission product decay heat removal the reactor could potentially over heat causing an enclosur failure and all its consequences. The reactor must have a 100% reliable means of sustained fission product decay heat removal.

In this FNR reliable fission product decay heat removal is via 48 redundant pumped heat transport systems, of which at least four must be operational at all times.
 

CERTAIN FISSION PRODUCT DECAY HEAT REMOVAL:
For each FNR there are 48 independent passive heat removal circuits any four of which can reliably and safely remove the fission product decay heat.

Under the circumstances of a double liquid sodium containment wall failure the heat transfer capacity of each heat transfer system might fall by a factor of three. However, we only need (1 / 12) of the entire heat transfer system capacity to remove fission product decay heat. Thus in order to reliably remove fission product decay heat it is essential that (1 / 4) of the total reactor heat transfer capacity must continue to function so that under the adverse condition of a double sodium containment wall failure the remaining certain heat transfer capacity is:
(1 / 3)(1 / 4) = (1 / 12)
of system full power heat removal capacity. Hence for maximum reliability there should be at least twelve independent heat removal circuits functioning.
 

There are 48 independent NaK heat transport circuits each of which contains three separate heat exchange isolation barriers. A failure in any one of these barriers results in an individual heat transport circuit shutdown. Due to the multiplicity of independent heat transport circuits, the facility can continue operating while some of the heat transport circuits are out of service.

***************************************************************

FNR TEMPERATURE STABILITY:
In a FNR the nuclear chain reaction progresses through successive neutron generations very quickly, so the neutron concentration and hence the reactor thermal power can potentially grow or decay equally quickly. It is important to design a FNR such that its reactivity always has a strong negative temperature coefficient so that at its operating point its reactivity always quickly decreases as its average fuel temperature increases. Then the reactor will spontaneously seek an operating point where the reactivity is zero.

This safety characteristic is near optimal when about half of the fission neutrons formed in the core zone diffuse out of the core zone and are absorbed by the adjacent blanket zones. The design of a FNR fuel assembly should closely adhere to this safety principle.

If there is a suitable negative temperature coefficient then for a particular fuel geometry and a partcular thermal load there is an average fuel temperature at which the number of free neutrons remains stable. A stable number of free neutrons corresponds to a stable thermal power output. A FNR should exhibit a declining reactivity with increasing temperature without any reliance on an external physical control system. Then varying the rate of heat removal from the reactor controls the reactor thermal power. Delayed neutrons and a large thermal mass in a FNR primary sodium pool prevent rapid wide thermal power excursions when the fuel geometry, primary coolant temperature or primary coolant flow slowly change.

FNRs should be always be operated in circumstances where coolant boiling cannot occur. Coolant boiling causes coolant voids which will increase reactor reactivity and may reduce the fuel cooling rate, causing severe uncertainty with respect to the reactor operating parameters.

A FNR should have safety features that physically limit the maximum rate of change of fuel geometry, the maximum deviation of the reactor setpoint temperature from the primary sodium temperature and the maximum thermal load, regardless of operator error.
 

FNR THERMAL POWER SURGE PROTECTION:
It is necessary to ensure that any credible change in coolant temperature, coolant flow, fuel aging or fuel bundle distortion will not cause:
(dR / dT) > 0,
leading to a local fuel temperature in excess of the fuel or fuel tube material rating.

Likewise it is necessary to ensure that a FNR will not have an uncontrolled thermal power surge due to a sudden change in its fuel or coolant geometry caused by any credible earthquake, aircraft impact, gantry crane failure or structural failure.

A FNR should use fuel designed such that any significant excursion into prompt neutron criticality causes instantaneous linear disassembly of the fuel to suppress the prompt neutron critical condition. This disassembly occurs because prompt neutron criticality will cause instantaneous boiling of cesium and sodium that is in direct contact with the active portion of the core fuel rods. The resulting high pressure sodium and cesium vapor will blow fixed fuel bundle core fuel rods toward the fuel tube plenums, reducingthe reactor reactivity.

In the event that linear disassembly of the fuel does not sufficiently suppress the prompt neutron criticality the fuel will vaporize and burst the fuel tubes to stop the nuclear reaction. In this respect it is important that when the fuel particles settle to the bottom of the sodium pool the pool bottom contour and material be such that the fuel will not again become critical. For example, the region under the fuel assembly can contain a layer of neutron absorbing gravel that will prevent a nuclear reaction close to the pool bottom.
 

NON-NUCLEAR MAINTENANCE:
On-site personnel are required to do periodic routine non-nuclear preventive maintenance on the NaK heat transport pipes, induction pumps, steam generators, injection pumps, turbo-generators, condensers, cooling towers and related mechanical and electrical equipment and to make repairs as necessary. However, this equipment should not involve any radioactivity. Most of it is isolated by three gas tight barriers. There is sufficient redundancy in the FNR support equipment that some of the heat transport circuits can be shut down for maintenance or repair while the others remain in operation. Thus, the only reasons for keeping staff on the reactor site 24/7 is compliance with steam power plant regulations and maintenance of site security.
 

FNR POWER CONTROL:
For normal safe thermal power control FNRs rely on thermal expansion of reactor fuel to reduce the FNR reactivity and hence reduce the thermal power output as the fuel temperature increases. The reactor core zone fuel geometry should be slowly adjusted to change the fuel average temperature setpoint or to cause a cool or cold reactor shutdown.

Power is controlled via the NaK induction pumps.
 

FNR CONTROL SYSTEMS:
The FNR facility has multiple independent control systems:
1) Primary sodium Pool:
The primary sodium pool control system operates almost independent of the heat to electricity conversion systems. The primary sodium pool features:
a) Normal temperature control;
b) Shutdown system #1;
c) Shutdown system #2;
d) Emergency sodium pool cooling.

2) There are 8 independent heat to electricity conversion systems, each with six dedicated heat transfer circuits and one turbogenerator. There are four on-site cooling towers, each which serves two adjacent turbo generator halls.
 

AVOIDING SODIUM VOID INSTABILITY:
At the sodium coolant boiling point the fuel assembly reactivity could potentially suddenly increase causing fuel melting. Worse yet, the value of:
(dR / dT) might exceed zero, causing a prompt neutron critical explosion.

A proprietary mechanism that causes temporary axial fuel disassembly is used to avoid this problem.

One of the reactor design issues is prevention of sodium void instability. Formation of sodium voids would potentially increase the FNR reactivity. At all reactor operating states the decrease in reactivity due to an increase in fuel temperature must safely exceed the increase in reactivity due to structural metal and liquid sodium coolant thermal expansion. In this respect the large thermal coefficient of expansion of Pu plays an important role. The reactor temperature must be sufficiently low and the liquid sodium head pressure sufficiently high that coolant voids never form.

The tendency for sodium void formation is related to the local sodium temperature, the local sodium flow rate, the sodium temperature distribution in the reactor and the sodium hydraulic head. For safety the reactor must not rely on any mechanical pumping mechanism for preventing sodium void formation. Typically this void free operation is achieved by operating the sodium far below its boiling point. The sodium boiling point is further raised by use of a significant liquid sodium head pressure in the reactor core zone. The reactor peak power must never be so large as to cause sodium void formation. Reactor power peaks tend to occur at times when there are changes in fuel geometry with the object of increasing the average fuel temperature.

One of the issues in FNR design is ensuring that no matter what adverse circumstances occur on loss of station power the reactor fails into a safe shutdown state.

Note that on recovery from a station power failure, if the liquid sodium has significantly cooled the average fuel temperature setpoint must be very slowly raised before re-establishing reactor operation.
 

***************************************************************

PROCEDURE FOR LOADING AND UNLOADING FUEL BUNDLES:
It is important to never let the fuel assembly accidentally go critial. In loading fuel bundles into the sodium pool each movable bundle should be installed in the fully withdrawn position before installing the adjacent fixed fuel bundles. Similarly the fixed fuel bundles adjacent to a movable bundle should be removed before extracting the movable fuel bundle. That strategy ensures that the fuel assembly will not accidently go critical due to pulling a movable fuel bundle through the hole defined by the adjacent fixed fuel bundles.
 

*************************************

CORE FUEL MELTING PROTECTION:
A relevant paper about a comparable liquid sodium cooled reactor with metallic fuel is S Prism Reactor Margin To Accidents
 

******************************************************************

PROLIFERATION RESISTANCE:
Implementation of Proliferation Resistance
 

***************************************************************

Event triggering minumum power operation:
Loss of AC grid power

***********************************

LOSS OF DISTRICT HEATING WATER
If there is loss of water from the district heating system the connected condensers will not work which implies that the affected generators will not work which leads to loss of two of the eight station power systems.
 

LOSS OF CITY WATER:
The main reactor does not rely on a continuous supply of city water. However, city water pressure may be required for support services such as flushing toilets, refilling emergency water tanks, etc. so loss of city water pressure is a condition that requires ongoing manual supervision until the condition is fixed.
 

FNR SHUTDOWN STRATEGY:
At a planned and/or scheduled reactor shutdown the best strategy is to withdraw the movable fuel bundles but maintain a thermal load on the reator that balances the fission product decay heat so that the reactor maintians its operating temperature for as long as possible. Hence electricity generation is maintained for feeding house power circuits. This strategy maintains the NaK temperature in some of the heat transport loops and hence maintains house power electricity generation capacity. Only when the fission product decay heat is no longer sufficient to operate one turbogenerator are the reactor cooling pumps shifted to an external source of power.
 

***********************************************************************

EMERGENCY SODIUM POOL COOLING:
Events triggering emergency sodium pool cooling include:
a) A primary sodium pool temperature high above its setpoint.
b) An imminent fire threat to the sodium pool.
 

FORCED COLD SHUTDOWN:
On a forced cold shutdown the FNR no longer maintains temperature. The movable fuel bundles all fully withdraw. Fission product decay heat is removed from the reactor by the NaK. Heat flows from the sodium pool to NaK and then to water in the steam generators which heat is vented as steam.
 *************************************************************************

OCCURRENCES
Occurances are events that do not cause a reactor shutdown. In this category are minor earthquakes, violent storms, and minor NaK fires that can be extinguished by NaK draindown.
 

LOW PROBABILITY EVENTS
Low probability events are events which are severe enough to trigger an automatic reactor safety shutdown. In this situation the main design objectives are instant fission reaction shutdown and rapid extinguishing of any sodium or NaK fire in a manner that prevents the FNR emitting airborne corrosive and/or radioactive species and that protects the equipment from damage.

An important issue in earthquake protection is bolting the fixed fuel bundles together to form a rigid matrix so that in spite of coolant sodium movement, the relative positions of the fuel rods remains contant. The liquid sodium above the fuel assembly can safely slosh back and forth in an earthquake provided that the surface waves are not deep enougn to change the fuel assembly reactivity.

The equipment remains shutdown until after detailed equipment inspection, testing and repair. In this category are moderate earthquakes, minor missile damage, minor prompt neutron criticality excursions, reactor safety trips, any fire which causes discharge of NaCl based fire suppression material, or damage to heat transport equipment.
 

EXISTENTIAL RISK ALTERNATIVES:
A reality that people must face is that FNRs provide the only fuel sustainable means of fully displacing fossil fuels. If extinction by global warming is to be avoided mankind must accept risks associated with widespread deployment of FNRs. Safety regulations that have the effect of preventing widespread deployment of FNRs will prevent sustainable displacement of fossil fuels, which will eventually lead to extinction of humans by CO2 toxicity or global warming.

People must choose between the extremely low risk of a major FNR related accident, possibly caused by an extreme earthquake, a large meteorite or irrational military attack, and the certainty of thermal extinction by global warming due to failure to deploy a sufficient fleet of FNRs.

There is no such thing as perfect public safety. Consider extremely low probability events such as a severe earthquake, a direct impact by a large meteorite or a determined military attack. In such a situation the priorities are instant fission shutdown, rapid heat removal and rapid suppression of the likely sodium fire in a manner that minimizes or prevents the emission of airborne toxic, corrosive and radioactive species.

The public safety risk of living close to a FNR is comparable to the risk of living downstream from a large hydroelectric dam, which could also be damaged by comparable events.

An issue that arose during the 2022 Russian invasion of Ukraine is what happens if a FNR is subject to a determined military attack, such as by a large missile or a laser guided armour penetrating bomb dropped from a high altitude. As was shown in WWII through the use of large armour penetrating bombs with tungsten carbide tips (Tall Boys) to attack German U-boat pens which had 5 m thick concrete roofs and to sink the heavily armoured battle ship Tirpitz, it is simply not practical to build FNR enclosures that can reliably resist determined attacks by large precision guided armour penetrating munitions. If a determined military attack is a credible risk to a FNR, either the reactor should be cold shut down with the movable fuel bundles fully withdrawn or some other means of preventing a determined military attack, such as surface-to-air missiles (Patriot Battery) should be implemented.

That does not mean that we do not build large hydroelectric dams and nuclear power plants. What it means is that we try to mitigate risks by locating large hydroelectric dams and nuclear power plants at sites which pose minimum risks from natural causes such as earthquakes, tsunamis, etc. and we try to maintain sufficient social order that there are no determined military attacks. We are not always successful. For example, in June 2023 Russia destroyed the Nova Kakhova hydroelectric dam in Ukraine.
 

**********************************************************************

SAFETY OVERVIEW:
The aforementioned features, including sophisticated automatic fire suppression, ensure that the FNR is safe for autonomous operation at an urban site. However, safety standards relating to this matter have yet to be developed.
 

*********************************************

The issue of safety in advanced reactors is broadly discussed in the 2012 report titled:
Overview of Generation 0IV (Gen IV) Reactor Designs //Safety and Radiological Protection Considerations.

In Canada nuclear safety matters are regulated by the Canadian Nuclear Safety Commission (CNSC). The main regulatory document is the Canadian Nuclear Safety and Control Act. The FNR discussed herein is intended to fall under the regulatory category of Small Modular Reactor (SMR) with an electricity output of less than 300 MWe.
 

The Darlington NPP safety report is likely available to the public at the CNSC library in Ottawa and should contain a list of all the design basis accidents. The Darlington NPP has a 2 m thick south facing reinforced concrete wall intended to safely absorb jihadi attacks using passenger airplanes.
 

This web page last updated December 28, 2025