Lessons from Dai-ichi

Last Saturday, I began to form the opinion that one or more of the Dai-ichi reactor cores had experienced a partial melt down. I was by no means sure of this view because it assumed that the explosion had been a hydrogen explosion. My study of reports concerning the Three Mile Island accident had led me to speculate, that if the explosion had been a hydrogen explosion, the most likely source of the hydrogen was a chemical reaction between coolant water, and overheated core materials. I assumed that some core water might have boiled off, uncovered, uncovering the upper part of the core, which then overheated to the extent that it would begin to melt.

When Japanese technicians injected water into the reactor, it came in contact with the partially melted core, and a chemical reaction between Zirconium in the reactor fuel cladding and the oxygen in water molecules, had released hydrogen in the core. The Japanese technicians had vented the hydrogen from the core, and it vented along with hot steam, and then exploded when it recombined with oxygen in the air. This assumption indicated that the Dai-ichi crisis was at least as bad as Three Mile Island, if not worse. The Japanese, given my speculation, would have sacrificed parts of the reactor building, in order to protect the steel containment vessel from rupture caused by excessive gas pressure.

The reality of at least a partial core meltdown in Dai-ichi 1, 2, and 3 could explained by the release of radioactive gases from fuel pellets. When the core was subsequently vented, the release of the radioactive fission product gasses would explain why many spikes of radiation during the Dai-ichi event have occurred. The radioactive gasses, likely to be encountered during a core meltdown are not very dangerous in practice. They are noble gases, very radioactive but chemically inactive. They are dispersed by natural process in air, and very quickly become so diluted, that they pose no danger to human beings. Since noble gases do not form chemical bonds, they do not linger in the human body, thus do not pose health risks. When scientist looked at the human health consequences of the Three Mile Island accident, the realized that the radiation level of air down wind from Three Mile Island was simply not high enough to cause cancer and other radiation related illnesses.

In addition to radioactive gases, some easily vaporized radioisotopes were released by the Three Mile Island accident. Of these Iodine-131 is the most dangerous. Unlike the noble gases, Iodine-131 does form chemical bonds, is solid rather than gaseous at ordinary temperatures, and likely to enter the human body from the food chain. Iodine-131 forms volatile chemical compounds, that vaporize at high temperatures. Iodine-131 does stick around, but only for a short while. It has a half life of a little more than 8 days. Thus if people can be kept out of contact with Iodine-131 for a couple of months it ceases to be dangerous. In addition potassium iodine tablets offer some protection against iodine-131 forming chemical bonds with body tissues.

Three other potentially dangerous radioisotope are in danger of escaping a reactor core during a reactor accident. They are:

Sr-90
Cs-137
Cs-134

We ar talking about some very nasty stuff here, the stuff that keeps people out of the Chernobyl exclusion zones for nearly 25 years. Fortunately not much of these undesirables escaped during the Three Mile Island accident, so the good citizens of Pennsylvania were able to return to their homes. The difference between TMI and Chernobyl was that inChernobyl the core exploded, destroying all containment, and then caught on fire, and quickly began discharging copious amounts of volatile fission products

What the Japanese tecnicians appear to be doing at Dai-ichi is struggling to prevent the sort of fire that would release large amounts of volatile fission products. There has bee some release. How do we know this? Because when an NBC news man came back from Dai-ichi, he had radioactive material on his shoes. Not a lot, but too much to be tracking around.

The same story suggests that maybe not a lot of volatile fission products have escaped yet, just enough to be picked up on the shoes, by newspeople walking on soil that has been lightly dusted with radio-iodine and other nasties., but not at a level yet to be really dangerous.

It is now fairly clear that that some level of meltdown has happened, but that we are not yet at the China Syndrome by any means, but yesterday Nuclear Regulatory Commission Chairman Gregory Jaczko said,

We believe that secondary containment has been destroyed and there is no water in the spent fuel pool and we believe that radiation levels are extremely high which could possibly impact the ability to take corrective measures.

Is not clear that all of the water in the spent fuel pool is gone, but Jaczko's fears may not be entirely unjustified.

The New York Times has quoted a spokesman for Japan’s Nuclear and Industrial Safety Agency, Yoshitaka Nagayama, as saying,

Because we have been unable to go the scene, we cannot confirm whether there is water left or not in the spent fuel pool at Reactor No. 4.

If the Japanese don't know, how can Jaczko? The answer might be computer accident simulation. I don't know if such a simulation exists, but if Jaczko was not being irresponsible, he needed to be able to point to some back up to his assessment.

There are still dangers here, the crisis is my no means over, but the decay of fission products is already begin to slow down, and with it both the radiation and the heat that that decay produces. While it is too soon to imagine that the crisis is over, the fact that the first week of the crisis has passed is a signal that the hope that a disaster will be prevented is fully justified. We cannot be sure that the worst is over, but the odds are beginning to move in that direction.

Nuclear power will survive the events in Dai-ichi. This accident will be studied for some time to come for lessons about nuclear safety. The first lesson, and this is obvious, is to assume that the worst earthquake or tsunami ever recorded for an area is possible again, and build accordingly. The Dai-ichi reactor complex was not designed to withstand a 10 meter plus tsunami, while it probably should have been built to withstand at least a 10 meter tsunami. Earlem College Geologist Wesley Nutter found evidence in 2009 that 10 meter (or even higher) waves had repeatedly pounded the coast of northern Japan over the last 3000 years. The geological record suggests that the tsunami of 2011 was a once in every 500 year event. For most people, once in every 500 years is never. Americans have built the cities of Memphis and St. Louis in a zone in which evidence suggests episodes of multiple great earthquakes - up to magnitude 8 - occure every five hundred years or so. Should people live, let alone build reactors in such a dangerous area? Should people live, let alone build reactors in Japan, California, or anywhere eles along the 24,000 mile Pacific ring of fire?

The second lesson has to do with reactor design. Some new reactors, most particularly the the Westinghouse AP-1000, and the GE ESBWR feature gravity powered emgency water tanks above the reactor core. In the future, reactors designs may be subject to the Dai-ichi test. Could the reactor design survive the Dai-ichi event without core melt down. In the case of the AP-1000 the answer is possibly yes, while in the case of the ESBWR he answer is very likely yes. The ESBWR design sets the new bar for reactor safety, and that bar his high.

A third lesson is that the Dai-ichi demonstrated an impressive seismic performance. They survive an earthquake of a far greater magnitude than they were designed too. No doubt this seismic performance will be the subject of further research.

A fourth lesson is that reactor safety design, should include a method of mitigating any China syndrome incident, in the event of a emergency coolant failure. Devices such as steam explosion proof core catchers will be researched,and perhaps modifications to existing reactor designs considered.

A fifth set of lessons, as of yet largely undefined, will come about as the result of studying what actually happened inside the cores of Dai-ichi reactors.

Finally, I would argue, that the day of the Light Water Reactor is drawing to a close. Several Generation IV reactor technologies would have survived the Dai-ichi incident without a serious incident. These include Pebble Bed Modular Reactors, and Molten Salt Reactors. In the case of Molten Salt Reactor Technology, the safety technology appears to be consistent with lowering nuclear costs. The PBMR can be shudown without core melting, while if a MSR begins to overheat, a plug will automatically melt and the reactor core will drain into a series of tanks that uses a well understood simple and natural technology, the chimny effect, to keep the fuel cool.

I have, in Nuclear Green, repeatedly pointed to the issue of nuclear safety, and the need to develop radical high safety nuclear technology. It is not that reactors are unsafe, but rather that safer reactors are possible without increasing nuclear costs, and we ought to build the safest reactors possible, within our financial limits. Not only are safer reactors possible, but they will be superior to Light Water Reactors in many other respects, including the long term sustainability of their fuel sources, and their scalability. If the Dai-ichi crisis fails to teach us the importance of moving forward on the implementation of a more advanced and safer nuclear technology, it would be a tragedy.

A Primer on Nuclear Safety: 2.4 Defense in Depth

A Primer on Nuclear Safety:
2.4 Defense in Depth
A Brief Note on ESBWR Safety

How Safe is the ESBWR? Given a probabalistic approach to nuclear safety, we first note that the ESBWR designers GE has estimated that a likelihood of core meltdown every 29 million years. But a core meltdown is far from a release of a large amount of radiation from the reactor into the environment. Thus we must look at the likelihood of a failure of not only the presser vessel, but of the core catcher, a system designed to trap and contain molten material from the core and to prevent its movement out side the reactor containment system. The core catcher is a passive safety system that uses the force of gravity,to move molten core materials into a series of dead end underground passages. Finally, our large amount of radioactive material must escape the massive outer containment dome of the reactor. Let us assume that each of these containment structures works as intended. We know, for example, that the pressure vessel will contain a core meltdown, because the core of the Three Mile Island reactor was contained by its pressure vessel. Thus it is very unlikely that the pressure vessel of a ESBWR would fail if its core did melt down. Let us consider that the likelihood of that the average time to pressure vessel breach by a molten core is average time to core meltdown multiplied by a factor of 10. That would give us a figure of 290,000,000 years to pressure vessel breach.

Now the failure of the core catcher is far more unlikely than the breach of the pressure vessel because the core catcher relies on natural forces to capture and hold the molten core. Let us assume for the sake of argument that the likelihood of a core catcher failure is the average time to pressure vessel failure multiplied by a factor of 10. That would give us a period of time of about 2,900,000,000 years before core catcher failure.

Once the core catcher fails there are still the massive outer containment walls of the reactor to prevent a large scale release of radioactive materials. Again we will assume that this structure will increase the likelihood of containment by a factor of 10. This would give us a catastrophic release of radioisotopes into the environment once every 29 billion years. That figure happens to be over twice the age of the Universe, and several times the expected lifespan of the earth.

Given a probabalistic world, many natural catastrophic events are far more likely than containment failure including the eruption of the Yellowstone super-volcano and event which could kill millions of people, and which is likely to occur sometime within the next 160,000 years.

Of course if more ESBWRs are built, our probability of catastrophic containment failure will increase. With a set of 1000 ESBWRs, we end up a gain with the figure of once every 29,000,000 million years between containment failures. To put this figure into some perspective collisions between the Earth and astroids of at least 5 km in diameter occur once every 10 million years. The impact of such an astroid with the earth would cause enormous damage to human society. Such events are three times as likely to occur as the catastrophic failure of containment in a ESBWR in a thousand reactor system. The worst possible consequences of reactor core containment failure would be very small compared to the consequences of a once every 10 million year astroid impact event.

It is my contention then that the dangers posed to the population of the world by a massive 1000 reactor system of ESBWRs is insignificant when compared with far more likely natural disasters.  However, as safe as the ESBWR is, it is not the ultimately safe reactor.  I will turn next to an exploration of how to make reactors even safer than the ESBWR is.

A Primer on Nuclear Safety: 2.3 Defense in Depth

A Primer on Nuclear Safety:
2.3 Defense in Depth
Light Water Reactors - Water and other safety features

The most important aspect of safety in Light Water Reactors is the cooling system. The coioling system also serves te purpose of moderating the nuclear reaction in Light water reactors. As we have noted, a loss of coolant in Light Water Reactors will stop the chain reaction, but will lead to core overheating because of the continued core heating caused by the radioactive decay of fission products. For that reason it is vital to maintain the presence of cooling water in the reactor core. There is one major variation in the LWR cooling system. Pressurized Water Reactors use secondary coolant systems. The secondary coolant system, in the PWR is responsible for stem generation. Water at high temperature and under heavy pressure leaves the reactor core and flows through pips to a steam generator. In the steam generator the water from the reactor passes through a heat exchange where is passes heat to the secondary coolant water. The primary coolant water then pumped back into the reactor, where it begins the cycle again. The secondary coolant water, once it has entered the heat exchange begins to rapidly boil. The steam is then routed to steam turbines where power is produced. Upon exiting the turbine the steam is cooled and condensed, and returned to the secondary coolant system.

The Boiling Water Reactor only has a primary coolant system. Water, under somewhat lower pressure in a BWR turns to steam in a BWR. the steam then flows to the turbines, the spent steam is cooled and condensed, and the cooled water is returned to the reactor where the cycle begins again. The coolant system of the BWR is simpler, and simplicity often enhances safety. Hence the BWR is potentially very safe, but at a price of somewhat lower efficiency.

Coolant systems usually rely on pumps to move water around, and like any other mechanical objct pumps do break down. They have to be periodically serviced, and in addition have been known to fai lin the course of reactor operations. There is a work around for pump servicing and pump failure, and that is back up coolant systems, that can be either automatically brought into operation in the event of pump failure, or when the pump of the primary coolant system is being serviced. One of the major contributing factors to the Three Mile Island Accident was the failure of the secondary coolant system, due to the tripping of a water pump. The backup pumps had been accidentally locked off line, so the essentially the primary coolant system lost its ability to dump heat from the reactor core. The reactor shut down, and other systems to maintain core safety automatically came into play. At that point the accident would have been over, had not an operator not shut down the emergency coolant system.

Thus the Three Mile Island accident illustrates the successful function of the defense in depth philosophy. Because even though secondary coolant system failed, and its backup was off line, and the the emergency coolant system was turned off, and the reactor core suffered partial meltdown, defense against a major release of radioactive material held. The cost of the coolant system failures was however, major damage to the reactor core.

Since the Three Mile Island accident illustrated the vulnerability of LWRs to coolant system failure, much attention has been paid both by reactor manufacturers and the Nuclear Regulatory commission of the United States to the improvement of the safety and reliability of Light Water Reactor coolant systems. One major approach for improvement has been the replacement of pumps with thermal syphons. Thermal syphoning is not exactly high tecnology. The principle was sucessfully used to circulate engine coolant in the Model T Ford! A thermal syphon takes advantage of the natural tendency of heated liquid to rise in a liquid column, while cooled fluid falls. In a closed system where the liquid is both heated - for example in the engine of a Model T Ford - and cooled - in the radiator of the Model T Ford - the coolant may achieve natural circulation without mechanical pumps. Remarkably, the same thermal syphon principle which works with antique cars, also works for the latest models of very large reactors. One notable example of this is the Evolutionary Simplified Boiling Water Reactor (ESBWR), which has is the Latest Word in Generation III + reactor safety. Because the ESBWR dispenses with cool water pumps, it also eliminates the very possibility of pump related accidents. A second feature which the ESBWR has in common with other Generation III+ reactors is the use of gravity feed emergency water systems. These systems place large tanks of emergency cooling water above the reactor core. In the event of a loss of coolant accident, water from the emergency coolant tank will automatically flood the reactor core. The ESBWR emergency coolant system does not rely on pumps. Rather gravity feeds the energency coolant water into the reactor core.

The sophisticated features of the ESBWR greatly enhances its safety compared to other Light Water Reactors. The ESBWR is calculated to be in danger of core melt down once every 29 million years. One would expect that with the extreme unlikelihood of core meltdown with the ESBWR, and the success of core containment by the reactor pressure vessel in the Three Mile Island that no provision for the containment of a molten reactor core would be made in the case of pressure vessel failure. Such is the safety of the ESBWR design that provision is made for the almost infinitely slight probability of that a molten core would escape its pressure vessel. In that case a core drainage and capture system has been been included in the ESBWR reactor design.

In a probabilistic world it is impossible to completely dismiss the possibility that a ESBWR Will ultimately fail in a catastrophic accident that will cost human lives, but the sun will also fail costing the life of everyone left on earth, and in a somewhat similar time frame. Thus the advanced safety features of the ESBWR coolant system, coupled with standard reactor defenses in depth against radiation releases, and a very advanced molten core capturing system, render concerns about ESBWR safety irrational.