A Primer on Nuclear Safety: 2.5 Defense in Depth

A Primer on Nuclear Safety:
2.5 Defense in Depth
The Pebble Bed Reactor Option

During the late 1940's research began in Oak Ridge on safe reactor designs.
Farrington Daniels was a pioneering advocate of the practical use of solar energy. Daniels had been, during World War II, assistant director of the University of Chicago Metallurgical Laboratory chemistry devision. The Metallurgical Laboratory was the great incubator of reactor designs. Daniels had done research on the concept of using a furnace filled with small balls or pebbles to fix nitrogen from air. Daniels developed the idea of building a reactor along somewhat similar lines to the pebble furnace, and in 1945 he applied for a patent for it.

There was enough interest in Daniels pile, that in 1946 design work intended to facilitate its development began in Oak Ridge at the Clinton Laboratory, later Oak Ridge National Laboratory. Oak Ridge was the primary inheritor of the Metallurgical Laboratory's tradition of reactor innovation. That pebble Bed research was set aside when the researchers were reassigned to help develop the light water reactor for the Navy. By early 1950's ORNL research had focused on an even more radically innovative reactor concept, the Molten Salt Reactor, thus the Daniels' pile, as it was called in Oak Ridge, was shelved.

Daniels Idea was embed uranium in small graphite balls or pebbles. The pebbles would be placed inside a chamber, and cooled with helium. The graphite would serve as a moderator, an given the presence of enough uranium inside the balls of moderating graphite, a chain reaction would commence.

After the death of Daniels project in Oak Ridge, the pebble bed idea lay dormant for a few years. then in 1956 a German physicist Rudolf Schulten picked it up and began to develop it. The British were developing gas cooled, graphite moderated reactors the time, and gas cooled reactors offered some attractive advantages over the rapidly emerging American Light Water Reactor. Schulten believed that a pebble bed reactor could be built that would be inexpensive to build and operate, and would be far safer than the American Light Water Reactor. In addition the Pebble Bed Reactor would operate at a far higher temperature, and thus would have greater thermal efficiency than the Light Water Reactor.

The Pebble Bed Reactor looked like a good match to the thorium fuel cycle and there were real concerns in the 1950's and 60's about how long the supply of uranium would last. So the original concept was to make the PBR a thorium breeder. This intention was defeated by the proliferation resistant nature of the PBR's pebbles.

The first German Pebble Bed Reactor, the AVR was conceived to be highly safe. The Pebbles themselves are a major source of PBR defense in depth. Each pebble contains thousands of tiny Uranium dioxide particles. The Uranium dioxide particles are surrounded by multiple layers of material including a carbon inner buffer, followed by an inner layer of pyrolytic carbon, a layer of ceramic silicon carbide, followed by a second outer layer of pyrolytic carbon. Thus each fuel particle contains a five layered defense in depth. In addition the particles were designed to withstand the stress, and high tempreture expected to be encountered in the PBR.

The German Pebble Bed Reactors had one remarkable feature that is repeated in reactor developed from the PBR concept. The pebbles were blown into the reaction chamber by helium gas, and suspended within the reaction chamber by the gas flow. Thus the pebbles had to be designed to withstand the mechanical stress of constantly bumping into each other in the reactor's chamber, as well as the high temperature encountered in the reactor core. The fuel particles were believed to be capable of withstanding the sort possible accident possible with a PBR, hence even without the other PBR fuel safety measures, they offered a high level of inherent safety. The Triso particles were are in turn embedded in graphite pebbles.

The Germens built two pebble bed reactors. The AVR was a successful experimental prototype operated between 11966 and 1988. The THTR-300 was a developmental reactor intended to prepare the way for commercial deployment of PBRs. During its brief operating history between 1983 and 1989 the THTR-300 suffered from the sort of teethings problems common with new technologies. It was by no means a failure, but at the time of the project shutdown there were clearly developmental issues remaining to be addressed. The THTR was originally intended to operate as a thorium fuel cycle reactor, but reprocessing the nuclear fuel proved to be complex and expensive, and the thorium cycle was dropped for a conventional once through Enriched uranium approach. The THTR used no less than 670,000 6cm fuel pebbles. The German Pebble Bed reactor research program was shut down in 1988-89 as a political consequence the Chernobyl accident. At The time of the project shut down, design work was proceeding on the HTR-500, which was intended to be the first commercial PBR.

The PBR was regarded as highly safe. It could be shutdown with cno core cooling without core damage. During AVR testing the reactor was actually brought to shut down with the cooling system turned off. No core damage occurred. This was a remarkable performance. Shutting down a LWR without cooling will lead inevitably to core meltdown due to the heat generated by the radioactive decay of fission products.

The safety features of the PBR include:

- The use of Graphite in the core structure and fuel pebbles.

- The fife layered defense in depth of each fuel particle contained within the fuel pebble

- The SiC coating layer on fuel particles intended to insures the retention of fission products

- Low radiation levels in the environment of the reactor - opperators received only 20% of the radiation experienced by LWR operators

- The use of Helium as a coolant

- Passive removal of decay heat

- Maximum core heating remained below the level that would damage core and fuel structures

- The use of very strong prestressed concrete in the reactor vessel

- The capacity of the outer reactor structure to withstand the impact of an aircraft

The NRC notes:

Because the PBMR is continuously refueled, the excess reactivity can be kept low. Also, the design has a more negative fuel temperature coefficient than LWRs, as the Doppler feedback is greater for the less-thermal neutron spectrum associated with a graphite moderator.* These features reduce the risk of reactivity accidents for most scenarios (but increases the risk for accidents involving core overcooling).

A major component of the PBMR safety basis is a low power density (an order of magnitude below that of an LWR) and large thermal capacity (as a result of the large mass of graphite in the core), together with the high-temperature resistance of the fuel. The maximum power rating of each module (265 MWth) and the high surface-to-volume ratio of the core were chosen so that in the event of a loss of coolant from the primary system, adequate cooling would be provided without the need for forced convection. PBMR designers claim that in the event of a total loss of primary coolant and no operator intervention, the core heatup rate would be slow and the maximum fuel temperature would not exceed 1600 C. Thus the design does not include conventional emergency core cooling systems, which are required for LWRs to provide emergency water sources in the event of a loss-of-coolant accident.

The German PBR project was subsequently regarded as an outstanding success. Not only wree over all project goals meet till the time of shut down but the expectation existed that the technology could be developed into a revolutionary commercial reactor that could be built at a lower cost than conventional light water reactors, yet would operate with at a higher temperature which in turn would lead to greater thermal efficiency. The PBR design has a high level of inherently safe.

Following the shut down the potential of the PBRM was recognized by commercial interests in South Africa, and by the Chinese. Projects to develop PBR technology for electrical generation and process heat have been undertaken in both countries. Both programs expect to build PBRs in factories with serial production beginning by 2020. Between 2020 and 2030 hundreds of PBRs may be built in Chinese and South African factories.

So far I have pointed to the numerous safety advantages of the PBR. However the NRC has questioned the safety adequacy of current PBR designs.

PBMR advocates are so confident in the safety of the reactor (some even call it "meltdown-proof") that they have proposed a drastic weakening of a number of safety requirements that apply to the current generation of U.S. nuclear plants. These proposals include (1) use of a filtered, vented confinement building instead of a robust containment capable of preventing a large release of radioactive materials in the event of severe core damage; (2) a reduction of the size of the emergency planning zone (EPZ) from 16 kilometers to 400 meters; (3) a reduction in the number of staff, including operators and security personnel; and (4) a reduction in the number of systems whose components must meet the most stringent quality assurance standards.

However, there is insufficient technical justification for these measures. The presence of a pressure-resistant, leak-tight containment and the maintenance of comprehensive emergency planning are both prudent "defense-in-depth" measures that could mitigate the impact of a severe accident with core damage. Defense-in-depth is the requirement that nuclear reactors should have multiple, independent barriers in place to prevent injuries to the public and damage to the environment. The presence of multiple barriers is a hedge against uncertainty and an acknowledgement that the understanding of the performance of any one barrier is incomplete.

PBMR promoters claim that a robust containment is unnecessary because the design-basis depressurization accident cannot cause damage to the PBMR fuel severe enough to result in a large radiological release. They argue further that such a containment would actually be detrimental to safety because it would inhibit heat transfer and interfere with the passive mechanism needed to cool the core in the event of a loss-of-coolant accident. However, a containment is needed not only to inhibit the relatively minor releases that would occur during the design-basis accident, but also to mitigate the consequences of a more severe accident. Containments can also help to protect the reactor core from a sabotage attack utilizing truck bombs or hand-held rocket launchers --- an ominous possibility that should not be discounted.

The NRC concerns seem speculative in that it involves the postulation of potential core damage that has not been demonstrated to be possible by simulation. The mention of truck bombs and hand held rocket launchers takes us clearly into the realm of fantasy because the use of such weapons against a PBR can be defeated by relatively low tech security measures already used to harden high risk targets. What sort of major accident did the the NRC have in mind?

Among the largest sources of uncertainty for the PBMR are the potential for and consequences of a graphite fire. The large mass of graphite in the PBMR core must be kept isolated from ingress of air or water. Graphite can oxidize at temperatures above 400 C, and the reaction becomes self-sustaining at 550 C (the maximum operating temperature of the fuel pebbles is 1250 C)[1]. Graphite also reacts when exposed to water vapor. These reactions could lead to generation of carbon monoxide and hydrogen, both highly combustible gases.

If a pipe break were to occur, leading to a depressurization of the primary system, it has been shown that flow stratification through the break can cause air inflow and the potential for graphite ignition[2]. While the PBMR designers claim that the geometry of the primary circuit will inhibit air inflow and hence limit oxidation, this has not yet been conclusively shown.

The consequences of an extensive graphite fire could be severe, undermining the argument that a conventional containment is not needed. Radiological releases from the Chernobyl accident were prolonged as a result of the burning of graphite, which continued long after other fires were extinguished[3]. Even though the temperature of a graphite fire might not be high enough to severely damage the fuel microspheres, the burning graphite itself would be radioactive as a result of neutron activation of impurities and contamination with "tramp" uranium released from defective microspheres. An even worse consequence would be combustion of carbon monoxide, which could damage and disperse the core while at the same time destroying the reactor building, which is not being designed to withstand high pressure. In contrast, the large-volume concrete containments utilized at most pressurized-water reactors can withstand explosive pressures of about 9 atmospheres.

Here we must raise a question since the risk of graphite fire seems greatly exaggerated. General Atomics, which has some experience with the operation of Graphite core and fuel reactors, states,

NUCLEAR-GRADE GRAPHITES ARE NONCOMBUSTIBLE BY CONVENTIONAL STANDARDS"

The General Atomics statement adds:

because graphite is so resistant to oxidation, it has been identified as a fire extinguishing material for highly reactive metals, including zirconium.

The oxidation resistance and heat capacity of graphite serves to mitigate, not exacerbate, the radiological consequences of a hypothetical severe accident that allowed air into the reactor vessel. Similar conclusions were reached after detailed assessments of the Windscale and Chernobyl events; graphite played little or no role in the progression or consequences of the accidents. The "red glow" observed during the Chernobyl accident was the expected color of luminescence for graphite at 700°C and not a large-scale graphite fire, as some have incorrectly assumed.

The NRC has a more realistic concern, howbeeit, one would not lead to a major PBR accident:

First, the fundamental fuel behavior must be sufficiently well understood that a complete set of technical specifications for the fuel can be derived. It appears that this is not yet the case. There are numerous instances in which TRISO microspheres manufactured to identical specifications and irradiated under identical conditions exhibited drastically different fission product release behavior that could not be attributed to observed physical defects like cracking of the SiC layer[6]. This indicates that there are technical factors affecting TRISO performance that have not yet been identified.

Second, when a complete set of technical specifications is finally at hand, the PBMR fuel manufacturing process will have to be reliable enough to ensure that the specifications are met. Because PBMR fuel is credited to a greater degree than LWR fuel for maintaining safety under accident conditions, and is less tolerant than LWR fuel to defects, PBMR fuel will have to be subjected to more stringent quality control. However, even if the requirements were no more stringent for PBMR fuel than for LWR fuel, inspecting the enormous microsphere flow with a high enough sampling rate to ensure an adequately low defect level would be a considerable challenge. The number of TRISO microspheres manufactured annually to support ten PBMR modules (1150 MWe total) would be on the order of ten billion, three orders of magnitude greater than the number of uranium fuel pellets needed to supply an LWR of the same capacity.

Finally, even if the above two criteria are satisfied, there must be assurance that the behavior of the fuel will not be significantly worse than expected if conditions in the core deviate from predictions --- that is, the fuel should "fail gracefully." It is on this count that the current TRISO fuel technology is clearly a loser. While past experiments have shown that the SiC layer of TRISO fuel limits the release of highly hazardous radionuclides like Cs-137 to below 0.01% of inventory up to 1600 C, the retention capability is rapidly lost as the temperature continues to increase. At 1800 C, releases of 10% of the Cs-137 inventory have been observed, which is on the order of the release expected during a LWR core-melt accident[7]. Without a leak-tight containment present, the release into the environment would be comparable to the release from the fuel.

Thus in order to justify the absence of a leak-tight containment, Exelon needs to demonstrate that the PBMR maximum fuel temperature will not exceed 1600 C during the design-basis depressurization accident, and that more severe accidents that could cause higher fuel temperatures are so improbable that they do not need to be considered. However, given the uncertainties discussed in the previous section --- like a discrepancy between calculated and measured maximum temperatures of at least 130 C --- there are serious grounds for skepticism.

There is a strong element of the "not invented here" syndrome in the NRC statement, and the reminder that since the repair of the American nuclear safety establishment was never made good after the havoc that Milton Shaw visited on it.

There are still problems with PBR safety. Rainer Moormann, a German researcher who studied the decontamination of the decommissioned AVR, found an unexpectedly high level or radioisotope contamination in the decommissioned AVR. He attributed the contamination to fuel breakdown at high temperature. While Moormann's findings ought to be taken seriously, radioactive contaminants in a decommissioned experimental reactor built during the 1960's ought not by themselves seen as evidence of a fatal flaw in the reactor design. The AVR used something like 20 separate pebble designs during its over 20 year history. Moormann believes that the problem stemmed from the over heating of fuel pebbles within the reactor. This is most likely a fixable problem, but fixing it requires resources.

Alvin Weinberg who certainly understood the advantage of nuclear safety, viewed the successful design of large scale technological objects like reactors and the product of big science. Nothing can substitute for the large scale deployment of technological resources in seeking technological objectives. Unfortunately the sort of large scale nuclear establishment which the United States possessed in the 1950's and 60's. I would expect the Chinese to deploy the major resources needed to insure Pebble Bed Reactor safety. The Chines need the PBR simply because they need a low cost nuclear technology to replace hundreds of coal burning steam plants. If the politicians do not disrupt it, a safety culture should emerge within the Chinese nuclear community which will provide china and the world with a highly safe PBR. For society, nuclear defense in depth includes a strong nuclear research community that has the curiosity and the resources to investigate nuclear safety concerns ands identify safe materials, designs, and safe production and operation standards without political interference.