A Primer on Nuclear Safety: 2.6 Defense in Depth

A Primer on Nuclear Safety:
2.6 Defense in Depth
Molten Salt Reactors, Moir-Teller Defenses

Introduction
The term Molten Salt Reactor if generic. All reactors that use liquid salts as both coolant and fuel carrier are Molten Salt Reactors. Reactors that use Liquid Fluoride salts, and operate on a thorium rather than a uranium fuel cycle are Liquid Fluoride Thorium Reactors. Most discussions about Molten Salt Reactor safety are primarily directed to LFTR safety, but many of the safety features of the the LFTR will also be present in other MSRs.

Many of the safety features of the LWR are not required for the MSR. For example the massive steel pressure vessel can be dispensed with since MSRs operate under atmospheric pressure. There is always a risk of steam explosion with the LWR but of course no risk with the MSR. If the pressure vessel is removed from our reactor design, we loose one of the physical barriers present in the LWR defense in depth system. A way should be found to compensate for that loss.

The rigid, hidebound, intellectually stunted, stubbornly prejudiced, and inflexible bureaucracy of the NRC simply sees the absence of pressure vessels as a safety issue. The NRC leadership is too narrow-minded to look at the the possibility that the MSR and the PBR require a different intellectual approach to reactor safety.

A second feature of MSRs, one that it does not share with the PBR is the potential to remove radioactive isotopes from the carrier salts. These would include fission products, transuranium elements, and tritium that is produced by neutron radiation of lithium in the carrier salt. This opens a route to an alternative containment system, one which removes, processes, seperates and concentrates and then diverts to useful purposes. This approach, incidentally, eliminates the problem of nuclear waste, represents both a safety feature, and a potential means of producing valuable byproducts during the nuclear process.

Thus the ability to process fuel while the reactors is operating constitutes a type of defense that will not entirely preventing the release of radioactive materials during a worst case MSR accident, certainly would partially mitigate that release.

In order to understand the containment issue we have to understand what problems lead to the necessity of defenses in depth. In the case of light water reactors it is the vulnerability of the water based coolant systems to disruption. We have seen from the ESBWR design that it is possible to build in powerful protections against coolant failure. For LWRs coolant failure is a hazard because it leads to core meltdown. Since the core of the MSR is already molten, from the viewpoint of the NRC the MSR violates profoundly important safety rules. We have seen that much of the LWR's defense in depth system is devoted to to prevention of core melt down, a molten core would represent a partial failure of the reactor defense system for those who view the ESBWR type Light Water Reactor as the non plus ultra of nuclear safety.

Not only has the core of the MSR melted down by design, but it lacks the containment defense of a pressure vessel. There is no guarantee that the MSR will never leak. I for one am a pessimist about reactor leaks. Anything fluid is want to leak, and will leak sooner or later. Advocates of sodium cooled fast breeders should always remember that. Even with continuous fuel processing the core fluid of a MSR is very hot and radioactive. It is just plain nasty wicked stuff. Thus MSR defenses in depth must assume core excursions of molten reactor fuel and fission products.

Not only that, but a standard safety feature of the MSR is the ability to dump core fluids into tanks, in the event of a failure of the cooling system after shutdown. This are far from the only controlled fuel core excursion with the MSR design. MSR fuel is forced out of the core as it heats, because liquid salt expands with greater heat. Core salt is channeled out of the core in order to transfer heat from the the reactor to the generating system or in order to provide shutdown or emergency core cooling. Core salts are also withdrawn from the core in order to process them. Each controlled core excursion represents a breach of containment, and therefore a a serious safety issue.

It must be obvious then that defense in depth for a MSR must operate in a quite different fashion than for a LWR or a PBR.

Reactor defenses are the most reliable if they depend on the automatic operation of laws of nature, rather than human intervention. Thus if a reactor defenses depend on an ironclad natural law than cannot be violated, there is no need for redundancy or further defenses. We do not tie iron bars down to keep them from floating away. Defense in depth in necessitated with undesirable events a unlikely but not impossible. Defense in depth thus is about defense against the unlikely. The purpose of defense in depth is to make the unlikely even more unlikely, if not impossible. More defense in depths in depth are not needed if undesirable consequences cease to be matters of practical concern, or when they stop being theoretically impossible.

MSR Defense in Depth: The Moir-Teller View

The levels of MSR defenses in this view are:

- the negative coefficient of reactivity - increased temperature slows down and eventually stops the nuclear reaction

- the low fuel burn up margin and fast burnup rate - failure to add new fuel slows and then stops the chain reaction process

- the continuous removal of radioactive gasses

- The addition primary core containment structure, piping, drain tanks and other fuel holding and processing structures

- the reactor system chamber

- An outer containment vessel

- An underground location requiring escaping radioactive materials to counteract the forces of gravity before any obove surface excursion.

Other potential barriers exist. In two fluid MSRs, the blanket containment structure constitutes another safety barrier. Core salts breaching core containment must mix with blankert salts and then breach the blanket.

All out of core controlled excursion structures can be protected by secondary barriers. Thus pips supplied with sleeves designed to drain any escaping salts directly into a holding tank if the primary pipe ruptures. Holding tanks can be double walled. Fuel processing equipment can be encased in an air tight structure. Thus the primary barriers can in every case be doubled.

The fluoride salt mixture also constitutes a significant barrier. Some radioactive material are chemically bonded to the salt. Other materials, including nobel gases and metals are disolved in the salt liquid but can escape during a salt excursion. Thus the processing of fuel should always involve the removal of radioactive gases as part of the first line of MSR defenses. High priority should also be given to the removal of nobel metals, whose presence inside the reactor is likely to cause problems. Thus to the extent possible, radioactive materials likely to escape from the fuel mixture during an uncontrolled out of reactor excursion, out to be removed before the excursion occurs. Thus under the best circumstances if an out of primary and secondary containment breach occurs, fuel either drains into catch tanks, or it freezes. In either case the further excursions of radioisotopes is contained. Of course, there will be a messy clean up problem with frozen fuel.

Core containment breaches with conventional reactors carries with them concerns about the release of radioactive gases. In the case of the MSR, that concern, while not disappearing, diminishes. Offsetting the decrease of radioactive gas release on occasions of uncontrolled core excursion is the increased likelihood of core excursions.

Since the MSR does not have a containment vessel, from the viewpoint of the NRC is has as serious safety defect. But is it in fact defective from the view point of human safety? First, only a limited a mouth of radioactive gas is going to escape all containment as the direct result of a core breach. Much of the escaping gas is biologically inactive, and will not bond chemically with living tissue. The Three Mile Island accident demonstrated that the escape of nobel gases from a nuclear accident poses little danger to the public. The other potentially troubling gas to escape would be tritium. 

Tritium should, like nobel gases be captured during reactor operations If left in the reactor core it will eventually diffuse out of MSR anyway, thus tritium containment is almost entirely dependent on its ongoing capture.  However, although tritium is biologically active, it is quickly diluted by the atmosphere. Research in the area surrounding the Savannah River Reactors, that saw repeated and massive tritium releases during their operation, has not indicated the rise of tritium exposure health complaints. CANDU reactors also produce and release relatively large amounts of tritium. There is no evidence of tritium related health complaints in connection with CANDU reactor operation. Indeed,

The mass of tritium (from CANDU reactors) added to the lake each year by Ontario Hydro’s PNGS and DNGSreactors is about 8% of the inventory of tritium currently in (Lake Erie)

Tritium from CANDU reactors appears to be uniformly diluted in the Great Lakes.  Although the data to has not established the presence of tritium related health problems, and Lord knows that Greenpeace would look for evidence, quite obviously more research is needed.  It should also be kept in mine that no effort to capture tritium is made in CANDU reactors, while tritium capture is expected to be routine in MSRs like the LFTR.   No credible evidence thus exists that a tritium release in  MSR accident would pose a threat to public health.  The most likely outcome of a tritium release in a MSR accident is that the tritium would quickly be diluted to background levels in the atmosphere.    

Finally it should be noted that we are not talking about an enormous amount of Tritium here. Five large Savannah River reactors produced tritium for the United States Government during the cold war.  There combined tritium output from 1954 to 1998 was something like 25 kgs.  A tritium release from a MSR accident would be many orders of magnitude smaller.   Population research concerning adverse public health consequences of Savannah River tritium manufacture has so far been negative.

It would appear then that the release of radioactive gases from a MSR core breach poses no significant public health hazard, and is an acceptable risk.

Frozen fluoride salts from resulting from containment failures ought to be cleaned up quickly, and salts that flow to emergency dump tanks ought to be recovered, processed and returned to reactor use.  

Normally a MSR would seldom be shut down.  In the event of a planned prolonged shutdown the core would be drained, core salts processed, and then stored in heated temperature controlled tanks until the reactor is ready to resume operations.  In the event of emergency 

shutdown the cooling of core salts should be maintained through the regular cooling system, or in its absence through backup cooling systems.  At least one passive cooling system would be required for core salts.  

A complete MSR shutdown is accomplished by a core dump into holding tanks.  The core holding tanks, which may also serve as leak drain tanks would require a passive cooling system. 

The drain and holding tanks system would thus form a level of reactor containment.    

In the Moir-Teller safety system, the reactor system with its holding/drain tank system, would be housed in an underground structure.  The inner housing structure would serve as a containment barrier.  A further containment barrier would be provided by an outer containment bubble that surrounds the outer containment structure.  

In addition the outer containment barrier could be made air tight. There are both advantages and disadvantages of doing this, and an air tight barrier would not prevent the escape of tritium into the soil if the reactor were located underground. This might not be undesirable if as a consequence the tritium is fixed in place for a few hundred years. An air tight chamber would contain other radioactive gases.

A final containment barrier, in the Moir-Teller program would be the laws of gravity.  Gravity would prevent the flow of solid fission products to the surface.  

The only possible way fission products could escape the forces of gravity would be through fission product decay heating of reactor salts in the reactor core or holding tanks. Sufficient heat from radioactive decay of fission products would cause MSR core salts to boil. It is not clear if the hot salt vapors could escape containment or if all containment were breached, if vaporized salts would remain in air long enough to escape the confines of the immediate reactor site. Core salt vapors would not escape an air tight outer containment barrier. The function of a passive core and holding tank emergency cooling would be to prevent core salt boiling.

Would a underground MSR be vulnerable from terrorist attacks. Granted typical reactor security, the answer is no. First vehicular security barriers would prevent truck bombs from approaching the above surface location of the reactor. Secondly, attacking aircraft would have no visible target. Even if terrorists controlling a large aircraft crashed it directly above the reactor, the impact crater would not penetrate deeply enough to effect the reactor. Finally, human access to the reactor could be through easily defended corridors, with a bank vault type entry into the reactor's protective chambers. Other, very sophisticated security measure would be available to defeat attempted terrorist attacks. In short the Moir-Teller underground siting approach coupled with modern and appropriate security measures would make an underground sited MSR a very heard target for terrorist attacks. Terrorist attacks through truck bombs and aircraft attacks would stand on chance
of inflicting significant damage on an underground reactor, while security measures would defeat any threat from terrorist attempting to penetrate the physical structure of the reactor on foot.

My conclusion then is that the Moir-Teller scheme of defense in depth for MSRs would create a reactor that would probabilisticly safe for practical purposes. Even in the face of core breach, an underground MSR would not present an even slight danger to public safety. It would appear that the Moir-Teller system actually contains redundancies which are not required from the viewpoint of public safety, and further research my actually lead to dispensing with them. The Moir-Teller system coupled with modern security systems, would present a very hard and indeed invisible target, that would defeat terrorist threats. Thus implementation of the Moir-Teller MSR safety system would be practically safe and would never become so unsafe as to become a danger to public well being.