Annu. Rev. Energy. 1990. 15:133-52

ADVANCED REACTORS, PASSIVE SAFETY, AND ACCEPTANCE OF NUCLEAR ENERGY!

C. W. Forsberg

Chemical Technology Divison, Oak Ridge National Laboratory, Oak Ridge, Tennes­see 37831

A. M. Weinberg

Oak Ridge Associated Universities, Oak Ridge, Tennessee 37831

KEY WORDS; inherently safe reactors, PIUS, modular HTGR, PRISM.

INTRODUCTION

Fifty years after the discovery of fission, the first nuclear era has drawn to a close in most of the world. To be sure, 16% of the world's electricity was generated in 1988 from 421 nuclear reactors (1). Yet, outside the Eastern Bloc, reactors are still being ordered in only four countries: Japan, Taiwan, South Korea, and France. Even in the Soviet Union, which for most of these 50 years has been pursuing nuclear energy aggressively, the enterprise has faltered. The Chernobyl accident has cast a chilling damper on nuclear energy in both the East and West.

The traditional arguments favoring a revival of nuclear energy-that nucle­ar saves fossil fuel, particularly oil; and that in some places nuclear is an economical source of electricity-remain valid. But in the past few years the most powerful arguments for a resurgence of nuclear energy have come from environmental considerations-acid rain and greenhouse warming, particular­ly the latter. Though the possible role of nuclear in helping to stave off the greenhouse effect was first stressed more than 20 years ago (2a), only recently

IThis chapter was written by a contractor of the US Government under contract no. DE-AC05-840R21400. Accordingly, the US Government is entitled to a nonexclusive, royalty-free license to publish or reproduce this chapter, or allow others to do so, for US Government purposes.

133

Ann

u. R

ev. E

nerg

y. 1

990.

15:1

33-1

52. D

ownl

oade

d fr

om w

ww

.ann

ualr

evie

ws.

org

by L

omon

osov

Mos

cow

Sta

te U

nive

rsity

on

01/2

9/14

. For

per

sona

l use

onl

y.

134 FORSBERG & WEINBERG

has this role been recognized in political circles. To be sure, some environ­mentalists deny that nuclear can play a cost-effective role in reducing CO2 (conservation is always a better bargain); this view is strongly disputed by the nuclear establishment. In any case, several bills have been introduced in Congress for considering nuclear energy among the options for mitigating the greenhouse effect. While no action is likely in the near term, the subject is now on the national agenda.

If nuclear power is to make a serious impact on CO2 emission, the industry will have to be very large. A 1000-MWe coal-fired power plant releases about

1.4 X 10-3 gigatons of carbon per year (GTCfyr) in the form of CO2. The total of 6 GTC/yr of carbon released by human use of 300 quads/yr of energy worldwide then corresponds to the equivalent of about 4000 one-gigawatt power plants. By the middle of the next century, the world's energy demand might grow to about 500 quads/yr. One might halve the implied 10 GTC/yr by deploying 3500 1000-megawatt large reactors. Now the median core melt probability (eMP) of today's fleet of reactors is according to Rasmussen 5 X 10-5 per reactor year (RY), which corresponds to a core melt frequency in such a large nuclear system of O.18/yr--one accident equivalent to that at Three Mile Island Unit 2 (TMI-2) every six years. This is almost surely

unacceptable. Thus one concludes that a necessary condition for deployment of nuclear reactors on a scale sufficient to contribute significantly to mitiga­tion of the greenhouse effect is reduction of the core melt probability con­siderably below Rasmussen's fiducial figure.

The foregoing rationale for development of safer reactors is perhaps too speculative-after all, the reality of the greenhouse effect itself still evokes argument. In any case, apart from the reasons one may adduce for reinvigorat­ing nuclear energy, the practical reality is that nuclear power, following the Chemobyl accident, no longer commands a public consensus. Until it com­mands such a consensus, it simply will not be used on any scale.

Readers of Annual Review of Energy may recall that five years ago, in Volume 10, one possible avenue to a rebirth of nuclear energy-the develop­

ment of so-called inherently safe reactors-was reviewed (2b). In the present review we summarize developments, both institutional and technical, since 1985 in the development of safer, if not inherently safe, reactors. The relevant literature before 1985 was reviewed in Ref. 2b, to which reader is referred for

pre-1985 developments.

INHERENTLY SAFE REACTORS-PRE-CHERNOBYL

Before the accident at Chemobyl, the nuclear establishment generally consid­ered reactors to be "safe enough." Only in Sweden, faced with a phase-out of nuclear energy, was serious attention given to design of an Inherently Safe

Ann

u. R

ev. E

nerg

y. 1

990.

15:1

33-1

52. D

ownl

oade

d fr

om w

ww

.ann

ualr

evie

ws.

org

by L

omon

osov

Mos

cow

Sta

te U

nive

rsity

on

01/2

9/14

. For

per

sona

l use

onl

y.

ADVANCED REACTORS 135

Reactor-the so-called PIUS or Secure-P®. Although other ideas for in­herently safe reactors were put forward from time to time-for example, modular high-temperature gas-cooled reactors (MHTGR) and Power Reactor Inherently Safe Modules (PRISM®) (reviewed in Ref. 2b)-the efforts hardly represented the main line of thinking among the dominant institutions of nuclear energy, such as the US Department of Energy (US DOE), the United Kingdom Atomic Energy Authority (UK AEA) , and the Electric Power Research Institute (EPRI), as well as the reactor vendors.

To be sure, the establishment was giving attention to newer design con­cepts-advanced pressurized-water reactors (APWR), advanced boiling­water reactors (ABWR), Sizewell-B (Ref. 2b)--that were standardized, possibly modular, simplified (and therefore cheaper), and easier to license. That these designs also were safer as judged by probabilistic risk assessment (PRA), however, seemed often to be regarded as a rather incidental advan­tage. The argument seemed to be that insisting on improved safety as a design criterion might jeopardize the public's confidence in the safety of the existing fleet of reactors. Thus the design criteria established by EPRI for its advanced light-water reactor (AL WR) never mentions passive, let alone inherent, safety. Before the accident at Chernobyl, the call for inherent safety was regarded by the dominant institutions of nuclear power-government agen­cies, nuclear utilities and utility consortia, and reactor vendors-as a rather farfetched notion promulgated by academics. Thus, to quote from the Atomic Industrial Forum's 1984 "Nuclear Power in America's Future" (Ref. 2b):

Increasing discussion in recent months, presumably as a result of the accident at Three Mile Island, has been directed at the rhetorical (sic) question of whether renewed utilization of the nuclear options should not be based on some system other than the light-water reactor (LWR). The discussions, however, have failed to acknowlege the extensive research, development, and demonstration effort that went into alternative systems in the late 50s and early 60s. They have failed to recall the deliberative reasoning that went into the selection of the L WR, not only in the U . S. but subsequently in Europe and the Far East. They have failed to recognize the improvements that have been incorporated into the L WR as a result of 25 years of design and operating experience, including the improvements made since the accident at Three Mile Island. And finally, they have failed to specify how they consider the L WR system to be flawed or why alternative systems could be expected to perform any better.

INHERENTLY SAFE REACTORS-AFTER CHERNOBYL

The accident at Chernobyl on April 28, 1986 conferred respectability on the idea of inherently safe reactors. If nuclear power was to survive, let alone

Ann

u. R

ev. E

nerg

y. 1

990.

15:1

33-1

52. D

ownl

oade

d fr

om w

ww

.ann

ualr

evie

ws.

org

by L

omon

osov

Mos

cow

Sta

te U

nive

rsity

on

01/2

9/14

. For

per

sona

l use

onl

y.

136 FORSBERG & WEINBERG

contribute seriously to amelioration of the greenhouse effect, something new and different, something that would overcome the public's distaste for nuclear power was needed. Inherent safety was grasped by many politicians as the sought-for talisman. Thus in 1986, Secretary Gorbachev in a letter to the Secretary-General of the International Atomic Energy Agency (IAEA), Hans Blix, urged an international program to develop a new class of safer reactors (3). The IAEA responded by establishing a special working group to in­vestigate these possibilities (4). During the 1988 US Presidential campaign, the Democratic candidate, Michael Dukakis, announced his opposition to nuclear power unless a new generation of safer reactors were developed. The Italian Parliament, after voting to shut down all three of Italy's power reactors, enacted a law that calls for a five-year program to develop a safer reactor. And in the United States, the Department of Energy, which had been rather tentative in its approach to inherent safety, has sponsored a design competition to develop a modular inherently safer reactor.

The activity has not been confined to paper studies. Two major projects to build versions of modular HTGRs have been announced: a Russian-German project (a VWU-HTR GmbH project to be built in Dimitrovgrad, USSR), and a US project to build a cluster of such reactors as dual-purpose producers of power and tritium. Whether these reactors will actually be built remains to be seen.

INHERENT VERSUS PASSIVE SAFETY

The words "inherent safety" have evoked much dissent from many prominent members of the nuclear industry. Inherent safety is sometimes taken to mean absolute safety, which implies zero release of radiation under any and all circumstances. This is impossible-ergo, "inherently safe" ought to be banished from our vocabulary.

The IAEA established a committee (5) to establish a more consistent vocabulary to be used in referring to the new generation of safer reactors. This committee has drafted a glossary of safety terms but has not yet published them. According to this glossary, inherent safety is achieved through elimina­tion or avoidance of hazards. Nuclear reactors contain fission products and thus can never be inherently safe, but particular designs can be made in­herently safe against particular types of accidents. Inherent safety implies no need for a safety system. Active and passive safety describe how engineered safety systems, components, and structures operate; they are distinguished from each other by whether or not they rely on external mechanical and/or electrical power, signals, or forces. Examples of fire protection systems can clarify these definitions. A concrete building full of glass bottles to be recycled is inherently safe against fire. A fire cannot occur. A tank-fed water

Ann

u. R

ev. E

nerg

y. 1

990.

15:1

33-1

52. D

ownl

oade

d fr

om w

ww

.ann

ualr

evie

ws.

org

by L

omon

osov

Mos

cow

Sta

te U

nive

rsity

on

01/2

9/14

. For

per

sona

l use

onl

y.

ADVANCED REACTORS 137

sprinkler system is a passive safety system. An active safety system uses fire detectors, pump units, and firemen. Altogether, the IAEA draft glossary contained 1 1 safety-related terms.

John Taylor (6) of EPRI has proposed the term "passively stable" instead of "inherently safe." In a passively stable reactor, entirely passive systems ensure that the reactor's power, temperature, and emission of radioactivity never exceed acceptable levels, and that its structural integrity is always maintained.

One must not lose sight of the motivation for development of these passive­ly stable systems: to restore the public's confidence in nuclear energy. Some observers have suggested therefore that to achieve this end the passive stability must be "transparent"; that is, it must be understandable if not to the public, then to the skeptical elites who greatly influence the public's percep­tion of risk. In the remainder of this article, we use the phrase "passively stable," or possibly "transparently passively stable," as well as the term inherently safe.

RECENT PROGRESS IN DEVELOPING PASSIVEL Y

STABLE REACTORS

The new generation of reactors may be divided into three classes when defined by the goals of the designers: evolutionary light-water reactors, breeder (liquid-metal) reactors, and PRIME reactors. PRIME is an acronym for Passive, Resilient, Inherent, Malevolent resistant, Extended safety. While different designers have different specific goals, most new designs have a common theme: a widespread emphasis on passive and inherent safety. This represents a major change in the nuclear community's thinking that has occurred in the last five years.

Experience has taught us that active safety systems are expensive to build and operate; thus economics and safety are beginning to push designers in similar directions. Economic analyses of both advanced light-water reactors and advanced liquid-metal reactors show that many passive and inherent safety systems reduce costs compared to conventional safety systems. Although there is an ongoing debate about how far toward passive safety the designer should go, no longer do designers assume automatically that active safety systems are required for economics. In the remainder of this article, we review developments in these categories of reactors that have occurred since the appearance of Ref. 2b.

Evolutionary Reactors Evolutionary reactor designs, primarily light water reactor designs but includ­ing several designs for heavy water reactors (not discussed), can be broken into two categories (Table 1): evolutionary plant LWRs and evolutionary

Ann

u. R

ev. E

nerg

y. 1

990.

15:1

33-1

52. D

ownl

oade

d fr

om w

ww

.ann

ualr

evie

ws.

org

by L

omon

osov

Mos

cow

Sta

te U

nive

rsity

on

01/2

9/14

. For

per

sona

l use

onl

y.

Table 1 Advanced reactors

Name Type Size/(MWe) Countries Lead organizations Status Refs.

Evolutionary Reactors-

Evolutionary Plant Designs

N4 PWR 1400 France Framatome Construction 23 Sizewell B PWR 1250 Great Britain Central Electric Construction 23

Generating Board Advanced Boiling-Water Reactor BWR 1356 Japan/US Hitachi 1 Toshiba /GeneraJ Design/construction 7, 23,24

Electric Advanced Pressurized-Water Reactor PWR 1350 Japan/US Mitsubishi 1 Westinghouse Design 23 Advanced BWR 90 BWR 1050 Sweden IS witzerland ASEA Brown Boveri Design 23 Combustion 80Plus PWR 1280 US Combustion Design 23 VVER 88/92 PWR -1000 USSR Design CANDU 8 HWR" 900 Canada Atomic Energy of Design 25

Canada, Ltd. CANDU 3 HWR 450 Canada Atomic Energy of Design 25

Canada, Ltd.

Evolutionary Technology Designs

Simplified Boiling-Water Reactor BWR 600 US General Electric Development 7,23,26

Safe Integral Reactor PWR 300 USIGreat Britain CombustionlRolls Royce Development 27 Advanced Passive-600 PWR 600 US Westinghouse Development 28 Hitachi Simplified Boiling-Water Reactor BWR 600 Japan Hitachi Development 29

Toshiba 900 BWR 310 Japan Toshiba Development Simplified Pressurized Water-Reactor PWR 350 Japan JAERlb Development 30 A

nnu.

Rev

. Ene

rgy.

199

0.15

:133

-152

. Dow

nloa

ded

from

ww

w.a

nnua

lrev

iew

s.or

gby

Lom

onos

ov M

osco

w S

tate

Uni

vers

ity o

n 01

/29/

14. F

or p

erso

nal u

se o

nly.

Breeder Reactors

PRISM

European Fast Reactor

PRIM E Reactors

Water Cooled

PIUS (Secure P®)

ISER

PIUS/BWR

Advanced CANDU Project

LMR

LMR

PWR

PWR

BWR HWR

Modul ar High-Temperature Gas-Cooled Reactor

MHTGR/US HTGR

MHTGR/W. German HTGR

MHTGRlGas Turbine

Molten Salt Reactor

MSR

• HWR = Heavy water reactor. b JAERI = Japan Atomic Energy Research Institute

HTGR

MSR

155

640

210

750

US General Electric France/Great Britain!

W. Germany

Sweden !Italy, ASEA Brown Boveri

S. Korea/US

Japan U .ofTokyo US Oak Ridge Natl. Lab. Canada Atomic Energy of C anada,

Ltd.

US General Atomics

W. Germany Siemens I ASEA Brown

Boveri

US MIT

USSR/US

Development

Development

Development

Research

Research Research

Development

Research

Research

Preliminary research

9, to

8

17, 23, 31

12, 23

13, 23

32

32, 33

34

..... W \0

Ann

u. R

ev. E

nerg

y. 1

990.

15:1

33-1

52. D

ownl

oade

d fr

om w

ww

.ann

ualr

evie

ws.

org

by L

omon

osov

Mos

cow

Sta

te U

nive

rsity

on

01/2

9/14

. For

per

sona

l use

onl

y.

140 FORSBERG & WEINBERG

technology L WRs. The evolutionary plant designs exemplified by the nine

reactors listed in Table 1 are similar in overall plant design to existing L WRs or Canadian deuterium-uranium reactors (CANDUs), but with refinements and modernization of the designs. Their safety, like that of their predecessors ,

depends on a variety of active safety systems with power supplied by diesel

generators or equivalent power sources. In the event of an accident, the safety

systems must start up and continue to operate to prevent reactor core damage. LWRs have been built with various types of pumps, valves, motors, control rod drives, containments, and other components/systems. There is now suf­ficient operating experience to judge which variations in design work the best. These designs reflect this rapidly increasing experience base, and are the nuclear plant equivalents to evolutionary designs in cars and aircraft. The best of these designs have estimated core melt probabilities approaching 1O- 6/year

for expected design events (7). Evolutionary technology LWRs (Table 1) are proposed advanced light­

water reactors that use the technology of current light-water reactors (com­ponents and systems) but with significant changes in plant design, particularly the safety systems. The major, government-supported light-water reactor

development programs in the United States today are the evolutionary tech­nology LWR programs at General Electric and Westinghouse. Most of the proposed safety systems for these reactors require power to initiate operations (such as to open a valve), but do not require power for continued operation. Safety system operation after initiation is passive. This is a key distinction between these designs and the evolutionary plant designs and is a significant advance in safety technology. These changes in design reflect two experi­ences. First, all of these designs were initiated after the Three Mile Island accident and reflect the technical lessons learned. Second, the new designs reflect the operating experiences of current plants that have shown which features of the plant design result in a plant that is difficult to operate or expensive. These proposed reactors have the following common features:

1. All water required for heat removal in the primary system drains by gravity to the reactor core, which is located at the lowest elevation in the plant. In the TMI accident, the plant layout did not permit the water in the steam generators to flow by gravity to the reactor core. Such water flow would have cooled the reactor core by boil off and prevented damage to the reactor core.

2. Large ac power sources (diesel generators) to run emergency equipment have been eliminated. In current plants, emergency equipment consuming high amounts of electric power and associated power supplies have proven expensive to build, maintain. and operate. Furthermore, the complexity of the equipment increases the probability of operator error in an emergency.

Ann

u. R

ev. E

nerg

y. 1

990.

15:1

33-1

52. D

ownl

oade

d fr

om w

ww

.ann

ualr

evie

ws.

org

by L

omon

osov

Mos

cow

Sta

te U

nive

rsity

on

01/2

9/14

. For

per

sona

l use

onl

y.

ADVANCED REACTORS 141

The elimination of emergency diesel generators has necessitated major changes in those emergency systems that consumed electric power-the emergency core cooling systems and the containment cooling systems. The evolutionary technology L WRs do require battery power in an

emergency to operate valves and instruments. .

3. For emergency core cooling in the event of a major pipe break or other accident, existing and proposed evolutionary plant nuclear power plants pump cooling water into the reactor core. This requires large pumps and, hence, diesel generators to provide power. The proposed evolutionary technology LWRs use a different approach. In all these designs, large volumes of water are stored above the reactor core. In an accident, first the reactor is depressurized by opening valves, and second, water flows by gravity from overhead tanks into the reactor vessel. Typically, there is sufficient water to flood the reactor containment and reactor system above the level of any pipe failure in the primary system.

4. More passive systems are used to cool the reactor containment in the event of a core melt accident. All the proposed evolutionary technology L WRs have larger quantities of cold water in containment, which can absorb heat after an accident. One or more of the following concepts is used to cool the containment passively: air-cooled steel containment, heat pipe or modified heat pipe, or boiloff of clean water outside of containment by transfer of containment heat through containment cooling walls.

5. Reactor power densities have been reduced. This both increases the mar­gin of safety and widens the operating window for reactor operations, which reduces the sensitivity of the reactor to operator error.

6. Last, a major effort has been made to simplify the design. The complexity of existing plants implies high cost and the possibility of operator! maintenance error. Plant simplification is possible because the designs are new and not just modifications of existing plant designs.

Breeder Reactors

Breeder reactors, of which the dominant type is the Liquid-Metal Fast Breeder Reactor, convert cheap fertile nonfuel materials such as 238U into valuable fissile fuels such as 239PU. With increasing estimates of the world's resources of uranium, the time when a breeder may be needed for fissile fuel production has receded further into the future. These changing general conditions, mod­ified by local needs, have resulted in national liquid-metal reactor (LMR) programs going in new directions.

In Europe, the emphasis has been on integrating the various national programs into a coordinated European effort (8). This reflects both the general economic integration of western European nations into a single economic

Ann

u. R

ev. E

nerg

y. 1

990.

15:1

33-1

52. D

ownl

oade

d fr

om w

ww

.ann

ualr

evie

ws.

org

by L

omon

osov

Mos

cow

Sta

te U

nive

rsity

on

01/2

9/14

. For

per

sona

l use

onl

y.

142 FORSBERG & WEINBERG

block and the viewpoint that the need for LMRs is further in the future than had originally been thought. The technical aspects of European programs have remained relatively constant.

In the United States, the LMR program has undergone major changes in direction (9, 10), with an emphasis on shop-fabricated, modular reactors with metal fuel and various passive safety systems. The major development pro­gram led by General Electric is for the Power Reactor Inherently Safe Module (PRISM®). Each module produces only 155 MWe; nine modules would be arranged in three identical 465 MWe power blocks for an overall plant net

electrical rating of l395 MWe. Argonne National Laboratory is developing the associated metal fuel and pyrochemical fuel cycle. This includes develop­ment of technologies to recycle all actinides (neptunium, plutonium, amer­icium, and curium) in LMRs to reduce the quantities of long-lived radionuc­lides in the waste. This is to create the option of using LMRs as power reactors and waste management tools.

In contrast to earlier LMR prototype plants and designs, PRISM depends primarily on passive safety systems. These various systems depend upon three characteristics of PRISM: (a) its relatively small size, (b) the large tempera­ture difference between normal operating temperatures (�900°F) and the boiling point of sodium (�1800°F) , and (c) the characteristics of the metal fuel. The ultimate decay heat removal system is the Reactor Vessel Auxiliary Cooling System (RV ACS). If normal cooling systems fail, the sodium heats up to � 1100oP, heat radiates from the reactor vessel to the containment vessel, and the containment vessel is cooled by the natural circulation of air that bathes the containment vessel. This passive decay heat cooling system eliminates the need for active decay heat removal systems but requires that no thermal insulation is placed around the reactor pressure vessel. This results in a nominal heat loss of about 0.2% of the rated power during normal op­erations to the environment via decay heat removal systems that cannot be turned off.

The second development in passive safety systems for LMRs has been the design of relatively small metal fuel reactor cores where total power levels are limited below levels that cause core damage by the strong, inherent negative reactivity feedback of the reactor core. Inherent protection against many types of reactor overpower accidents was demonstrated in a series of experiments at the Experimental Breeder Reactor-II (EBR-II) in 1986 (11). These de­velopments have not eliminated all types of overpower accidents that could theoretically occur in LMRs, but have reduced the number of potential accidents.

PRIME Reactors

The third class of reactors under development are PRIME reactors, where the goals of the designers are radical improvements in safety and public accep-

Ann

u. R

ev. E

nerg

y. 1

990.

15:1

33-1

52. D

ownl

oade

d fr

om w

ww

.ann

ualr

evie

ws.

org

by L

omon

osov

Mos

cow

Sta

te U

nive

rsity

on

01/2

9/14

. For

per

sona

l use

onl

y.

ADVANCED REACTORS 143

tance with the potential for major improvements in economics. Because the goals are aggressive, new technologies are required for these reactor designs. Various advocates state requirements differently, but the term PRIME pro­vides a reasonable description of these goals.

PRIME is an acronym for Passive safety, Resilient operation, Inherent safety, Malevolence resistance, and Extended safety. Passive and inherent are defined as above with the goal of no active safety systems in the plant. This goal includes no requirement to activate safety systems (such as opening valves), in contrast to proposed evolutionary technology LWRs (see above). Resilient operation refers to safety systems that do not interfere with the normal maintenance and operation of the plant. Given sufficient incentives and time, safety systems can be bypassed. For very high levels of safety, it is important to eliminate incentives to operators and maintenance staff to bypass or alter safety systems. Malevolence resistance is the capability to withstand malevolent acts of man (internal sabotage, short-term plant takeover, or external assault with off-the-shelf munitions) without significant release of radioactivity to the environment. Plant security against malevolence, to en­sure safety, should depend on passive devices rather than active techniques (use of guards, security checks). Safety systems with malevolence (sabotage) resistance protect against all types of operator error and inaction. One conse­quence of this requirement is that safety systems can have no shutdown mechanisms. It is noteworthy that at both Chemobyl and TMI safety systems were shut down for what were thought to be good reasons at the time. Last, extended safety refers to walkaway safety in the event of an accident or walkaway safety for one week in the event of malevolent acts of man.

There are fundamentally only two requirements to ensure reactor core integrity and, hence, reactor safety. The first requirement is to prevent excessive core power levels. The Chemobyl accident resulted from such a power excursion. The second is the ability to remove reactor heat under all circumstances including reactor shutdown. When a reactor is shut down, the decay heat, although only a small fraction of full power, can destroy the reactor (such as occurred at TMI) if it is not removed. Based on the means for dealing with decay heat, three categories of PRIME reactors can be identified.

1. Decay heat can be removed from the reactor core by absorbing the heat in the reactor vessel and its contents. This is the basis for the Process Inherent Ultimate Safety (PIUS) L WRs where the reactor vessel has a large volume of water and decay heat is removed from the reactor by boiloff of this inventory of water.

2. Decay heat can be removed from the reactor core by conduction of heat out of the walls of the reactor, reactor vessel, and structures to the ground and air. This is the approach used for the Modular High-Temperature Gas­Cooled Reactor.

Ann

u. R

ev. E

nerg

y. 1

990.

15:1

33-1

52. D

ownl

oade

d fr

om w

ww

.ann

ualr

evie

ws.

org

by L

omon

osov

Mos

cow

Sta

te U

nive

rsity

on

01/2

9/14

. For

per

sona

l use

onl

y.

144 FORSBERG & WEINBERG

3. Decay heat can be removed from the reactor core by use of a liquid or gaseous reactor core and continuous processing of the fuel so there are only small quantities of heat-producing fission products in the reactor core at any one time. Modified versions of the Molten Salt Breeder Reactor (MSBR) and various aqueous fueled reactors are examples.

THE PIUS REACTOR In view of the Swedish moratorium on nuclear power, ASEA Brown Boveri-Atom (ABB-Atom) decided in 1979 to design a light­water reactor that would be incontestably safe to operate. Their criteria included not only safety from the standpoint of any conceivable accidents caused by equipment or operator failures, but also safety from external events such as earthquakes and from sabotage or terrorist attack. This protection is to be gained without calling into action any active safety equipment and without any human actions. The intrinsic protection should last a week or more to provide time for preparation of further protective action; moreover, the plant should be operable after such an outage. Many experts have examined this new concept critically and have been unable to find any series of events, including sabotage and terrorist actions, that appear to have an appreciable probability of causing severe damage to the reactor core. Thus the system is perhaps unique and deserves special attention.

The PIUS system is shown schematically in Figure 1. A large, prestressed, concrete reactor pressure vessel (PCRV) with a cavity diameter of 13 m and a cavity height of about 35 m encloses the entire primary circuit of a PWR. The reactor vessel is filled nearly to the top with borated water so that virtually all of the primary circuit is immersed in a pool. The essential point of PIUS is a clever passive means, both of flooding the reactor with borated water if the core is in danger of losing coolant or operating at excessive power levels, and of keeping the borated water out of the reactor during normal operation. Both the primary circuit and the pool are maintained at a pressure of approximately 90 atm by the pressurizer of the primary circuit, which is located in a steam region at the top of the cavity in the reactor vessel. Inasmuch as the pressure drop in the primary circuit is just a few atmospheres, the envelope of the primary circuit separating it from the pool is required to carry only a small pressure differential. However, the hot primary circuit (which runs at -270°C) must be covered with a layer of thermal insulation to reduce the heat losses to the pool water (which runs at -50°C).

As can be seen in Figure 1, the system provides natural thermal convection, since the reactor core is at the base of a hot water column about 30 m high. The density difference between the hot water in the riser above the core and the cold water in the pool is sufficient to give a pressure differential of about half an atmosphere. A large opening is provided between the primary system

Ann

u. R

ev. E

nerg

y. 1

990.

15:1

33-1

52. D

ownl

oade

d fr

om w

ww

.ann

ualr

evie

ws.

org

by L

omon

osov

Mos

cow

Sta

te U

nive

rsity

on

01/2

9/14

. For

per

sona

l use

onl

y.

HOT AIR

AIR-COOLED

HA TURAl -CIRCUlA liON DECAY

HEAT REMOVAL SYSTEM

COLDAIR �-

HOT REACTOR WATER

TO STEAM GENERATORS ·.1 ))a

STEAM TO TURBINE

FEEDWATER

DOUBLE STEEL LINER

PRESTRESSED-CONCRETE

REACTOR VESSEL

NNUlAR DOWNCOMER

TO CORE

STEAM GENERATOR

LONG-TERM

BORA TED-WA TER SUPPLY

MAIN RECIRCULATION PUMP

REACTOR CORE

CONT AINMENT

SUPPRESSION POOL

t <

� o � � � til

..-

Fi"", J ASEA B","O B<>reri-Atom 640 MWB PRJS ""'''''' (pro""", ""i",). RoprodOCOO "i<' th' ","","'00 of ABB-A�m. t

Ann

u. R

ev. E

nerg

y. 1

990.

15:1

33-1

52. D

ownl

oade

d fr

om w

ww

.ann

ualr

evie

ws.

org

by L

omon

osov

Mos

cow

Sta

te U

nive

rsity

on

01/2

9/14

. For

per

sona

l use

onl

y.

146 FORSBERG & WEINBERG

and the pool water at both the top and the bottom of the core-riser column.

Honeycombs are provided in these open regions to inhibit convection cur­rents, while the difference in density between the hot and cold water, as well as the dynamic head generated by the main recirculation pumps, serves to stabilize the hot-cold liquid interface in each honeycomb and prevent circula­tion of water between reactor water and the cold borated water under normal operating conditions.

The current designs also include air coolers, which provide core cooling essentially forever. The air cooling systems cool the borated water zone, which in tum cools the core. Air cooling systems are sensitive to sabotage; thus, the large volume of water in the vessel is maintained to ensure core cooling under all circumstances for a minimum of one week.

The initial concerns expressed by those who have reviewed the PIUS concept have been with respect to the stability and control of the interfaces between cool pool water and the hot primary circuit (particularly under transient conditions), the capital cost of the large prestressed concrete reactor vessel, and the difficulties of maintenance through the deep pool water. The water interface stability problem is not one of safety but rather whether the reactor will be a reliable power producer. In the last five years, large-scale, high-pressure, high-temperature thermal hydraulics tests have confirmed the workability of the concept. Simultaneously, more detailed economic analyses have been favorable for PIUS compared to other LWR concepts. This reflects the radical simplification of safety systems compared to other reactors.

The commercial application of PIUS would require a staged development program to prove its feasibility and to demonstrate its licensability and operability. Since PIUS is a modified PWR, much technology already in commercial use could be applied. However, even under favorable circum­stances it would take eight to nine years to put a demonstration plant into operation.

The technical advances in PIUS and its improving economic perspectives have precipitated a variety of other activities:

1. Coordinated activities to develop PIUS have been or are under way between ABB and companies in Italy, South Korea, China, and the United States.

2. Several variants on the PIUS concept are being investigated in Japan ( 12). 3. University, national laboratory, and other organizations have examined

PIUS to identify strengths and weaknesses. This has increased understand­ing of the concept and identified possible improvements. For example, early studies suggested that the reactor size be limited to 700 MWe. More recent work suggests technical improvements that may eliminate all size restrictions for this type of reactor.

Ann

u. R

ev. E

nerg

y. 1

990.

15:1

33-1

52. D

ownl

oade

d fr

om w

ww

.ann

ualr

evie

ws.

org

by L

omon

osov

Mos

cow

Sta

te U

nive

rsity

on

01/2

9/14

. For

per

sona

l use

onl

y.

ADVANCED REACTORS 147

4. New "PIUS-type" reactors have been invented such as a PIUS/BWR ( 13). The fundamental importance of these inventions is that their existence demonstrates that families of such advanced reactors exist; i.e. we have only begun to understand the technical options that exist for passively safe LWRs.

THE MODULAR HTGR Both HTR GmbH in West Germany and General Atomics in the United States have proposed modular designs. As discussed earlier, major projects to build these machines have been announced. The General Atomics unit is a 350 MWth, 135 MWe unit that could be employed in groups, i.e. four would give a 1400 MWth, 540 MWe plant. The size of the reactor is the maximum for which decay heat from the reactor can be conducted out of the walls of the reactor to the soil while maintaining central reactor core below temperatures at which fuel failure occurs. In principle, this type of decay heat cooling can be used for any reactor; however, for most reactor types the reactor size is so small as to make it uneconomical. The MHTGR can be built to a reasonably large size because the fuel temperatures can exceed 1600°C before fuel failure. With such high temperature capabili­ties, reasonably sized reactors can be built.

Figure 2 shows a cross section of the current US design. This design includes air cooling of the pressure vessel. Air cooling is to protect the reactor vessel against damage in an accident (investment protection) but is not required for safety.

One advantage of the small size of the modular design is that a unit could be shop-fabricated and shipped to the site. Shop fabrication should lead to major reductions in cost and construction time as well as yield a higher-quality product. These advantages of the modular design from the cost and construc­tion standpoints may be offset by the increase in the amount of instrumenta­tion and control equipment needed, because each of the modular units would require a full set of such equipment, and some additional equipment would be needed to operate a multiplicity of units in parallel.

In view of the fail-safe nature of the modular plant, the German licensing authorities have ruled that the associated balance-of-plant equipment can be commercial grade as opposed to reactor grade. This approach to licensing should improve the overall economics.

The major advance in MHTGR technology in the last five years was the experimental demonstration at the AVR (an MHTGR test reactor in West Germany) that an MHTGR can withstand loss-of-coolant flow and loss of coolant without damage to the reactor core ( 14). Furthermore, calculations indicate the ability to withstand severe reactivity accidents. Like most reac­tors, the A VR has a negative temperature coefficient. In most reactors other

Ann

u. R

ev. E

nerg

y. 1

990.

15:1

33-1

52. D

ownl

oade

d fr

om w

ww

.ann

ualr

evie

ws.

org

by L

omon

osov

Mos

cow

Sta

te U

nive

rsity

on

01/2

9/14

. For

per

sona

l use

onl

y.

148 FORSBERG & WEINBERG

ANNULAR REACTOR CORE

SHUTDOWN HEAT EXCHANGER

CONTROL ROO DRIVEl REFUELING PENETRATIONS

-----MAIN CIRCULATOR

Figure 2 General Atomics 135 MWe Modular High-Temperature Gas-Cooled Reactor. Repro­duced with the permission of GA.

than the MHTGR, removal of all control rods would result in excessive power and temperature. For MHTGRs, the very high temperature capabilities of the core and the negative temperature coefficient make it possible to ensure reactor shutdown before serious damage occurs; in effect control rods are an operating system, not a safety system.

THE MOLTEN SALT BREEDER REACTOR The third set of options for PRIME reactors are liquid or gaseous fueled reactors where the fuel is continuously processed so there is never a significant inventory of fission products in the

Ann

u. R

ev. E

nerg

y. 1

990.

15:1

33-1

52. D

ownl

oade

d fr

om w

ww

.ann

ualr

evie

ws.

org

by L

omon

osov

Mos

cow

Sta

te U

nive

rsity

on

01/2

9/14

. For

per

sona

l use

onl

y.

ADVANCED REACTORS 149

reactor core. To reduce risks, the fuel processing plant must quickly solidify the fission products as waste in containers that can be passively cooled in vaults. If the fission products are not rapidly solidified, the accident risks from the fission products are simply transferred from reactor to processing plant. These reactor concepts also eliminate concerns about reactivity acci­dents since the reactor has only enough fuel in it at any time to operate at its normal full power rate. It is unclear whether practical fuel processing systems can be developed that meet these requirements. There has been only limited work on these concepts (15, 16).

OTHER DEVELOPMENTS IN PASSIVE REACTOR

SAFETY

For safer reactors, the major thrust of reactor designers has been accident prevention, since this protects the public and utility investment. A few investigators (e.g. G. Petrangeli, seminar at ORNL, November 2, 1989) have asked whether it is possible to build a containment (a box) around the reactor to ensure public protection against any accident or external threat. Current reactors have containments, and their value was proven in the Three Mile Island accident. The technical question is: can containments be built that provide total assurance of no significant release of radioactivity? The in­stitutional issue is whether it is an acceptable solution to prevent damage from accidents but not necessarily eliminate those accidents.

Reactor development programs receive the most public attention, yet reac­tors are composed of various structures, systems, and components (SSCs): building blocks. The development of new ideas for passive safety building blocks for future reactors provides the pieces-the foundation-for advanced reactor concepts. As with power plant designs, the last several years have seen a corresponding growth in ideas for passive SSCs. A recent report ( 17) identified more than 70 classes of passive and inherent SSCs for light-water. reactors. New approaches to passive safety have become a growth industry. It is premature to assess the impacts of these advances, but it is clear that we are only now beginning to understand the potential for technical advances in passive safety.

THE RESPONSE OF REGULATORS TO THE NEW

GENERATION OF REACTORS

E. S. Beckjord, Director, Office of Nuclear Regulatory Research, US Nuclear Regulatory Commission (NRC) has recently summarized NRC's response to the development of the new generation of reactors ( 18). NRC's actions fall into three categories:

Ann

u. R

ev. E

nerg

y. 1

990.

15:1

33-1

52. D

ownl

oade

d fr

om w

ww

.ann

ualr

evie

ws.

org

by L

omon

osov

Mos

cow

Sta

te U

nive

rsity

on

01/2

9/14

. For

per

sona

l use

onl

y.

150 FORSBERG & WEINBERG

1. Issuance of severe accident and advanced reactor policy statements. 2. Publication of a new rule that establishes requirements for certification of

standardized reactor designs ( 10 CFR 52).

3. Initiation of future design criteria, including preliminary guidance to conceptual designers regarding acceptability of their designs.

Though no advanced reactor has reached the licensing stage, apparently certain general criteria will have to be met if the design is to receive NRC approval. Of these criteria, defense-in-depth seems to be paramount-Leo appropriate attention must be paid to accident prevention, accident termina­tion, accident mitigation, and emergency planning. Though the NRC, accord­ing to Beckjord, will allow some flexibility in application of defense­in-depth, it will not allow elimination of any one of these four major components. Presumably this might mean, for example, that a passively stable reactor will always require a containment as well as an emergency plan;

however, if the physically possible transients are very slow, some credit might be given in planning for emergencies.

As for an acceptable safety level, NRC staff has proposed, though NRC has not officially adopted in its Severe Accident & Safety Policy, a core damaging frequency no greater than 1O-5/RY, and a large release frequency no greater than 1O-6/RY. Presumably these goals can be reached by all of the reactors discussed in the previous section; and can be very much exceeded by all of the passively stable reactors.

Beckjord lists five issues that NRC will particularly examine as it proceeds to the actual licensing of the new generation of reactors.

1. Which is more important, reducing core-melt frequency or mitigating the consequences of a core-melt?

2. To what extent can the principle of defense-in-depth be relaxed? 3. Are prototypes necessary? 4. What might be a severe accident policy for the new generation of reactors? 5. How significant are human factors in the new generation of reactors?

Many of these questions are only now being asked by the NRC. Should serious proposals for building passively stable reactors arise, the NRC will have to answer these questions.

PASSIVELY STABLE REACTORS AND THE PUBLIC

Proponents of passively stable reactors cannot prove that they are either necessary or sufficient for a rebirth of nuclear energy. On the other hand, enough political support seems to have developed in favor of passively stable

Ann

u. R

ev. E

nerg

y. 1

990.

15:1

33-1

52. D

ownl

oade

d fr

om w

ww

.ann

ualr

evie

ws.

org

by L

omon

osov

Mos

cow

Sta

te U

nive

rsity

on

01/2

9/14

. For

per

sona

l use

onl

y.

ADVANCED REACTORS 15 1

reactors that it seems likely that several such devices will be built and operated during this decade.

Nor is nuclear energy the only technology that seeks salvation in passive, or inherent, safety. The chemical industry, after the 1974 Flixborough cyclohex­ane disaster, in which 28 people were killed, has begun to incorporate inherent safety in plant design, largely at the urging of Prof. Trevor Kletz (19). Indeed, the term "inherent safety" appeared in Kletz's writings five years before it was applied to nuclear reactors. And just as the Chemobyl accident has forced a generally skeptical nuclear industrial establishment to take passively stable reactors seriously, so the Bhopal accident has had the same effect on the chemical industrial establishment (20, 2 1).

What may be at issue here is the public's rejection of probabilistic argu­ments in dealing with technological risk. For some risks, like nuclear con­tamination, and Bhopal-like chemical contamination (and perhaps oil spills in the wake of Exxon Valdez), the magnitude of a possible disaster may loom much more importantly than its probability. Best of all is complete safety; since this is in a sense impossible (unless Petrangeli's absolute containment succeeds), next best is transparent safety-Leo the public, or at least the skeptical elites who influence public opinion, must be convinced by the transparency of a design of a device that the use of that device cannot harm the pUblic.

The nuclear establishment by and large may regard such a demand by the public, with its implicit rejection of probabilistic arguments, as being unrea­sonable. But the public is the final arbiter in these matters. If engineers cannot design, build, and operate nuclear reactors that the public judges on the basis of its criteria to be acceptable, there will be no second nuclear age until and unless the current Age of Anxiety gives way to a new Age of Reason in which risks are judged more rationally than they are now (22).

Literature Cited

I. Am. Nucl. Soc. 1989. World list of nu­clear power plants. Nucl. News 32( 10):77-96

2a. Report of the Study of Critical Environ­mental Problems. 1970. Man's Impact on the Global Environment. Cambridge, Mass: MIT

2b. Spiewak, I., Weinberg, A. M. 1985. Inherently safe reactors. Annu. Rev. En­ergy 10:43 1-62

3. Sciolino, E. 1986. Gorbachev favors atom safety code. The New York Times. June 4

4. Int. At. Energy Agency. 1989. Consul­tants Meet. Advanced Reactors, Nov. 30-31, Vienna, Austria

5. Int. At. Energy Agency. 1988. Descrip­tion of safety-related terms. Consultants Meet. Description of Passive Safety­Related Terms, Oct. 3-5, Vienna. 622-I3-TC-633

6. Taylor, J. J. 1989. Improved and safer nuclear power. Science 244:3 18-25

7. Wolfe, B., Wilkins, D. R. 1989. Future directions in Boiling-Water Reactor de­sign. Nucl. Eng. Des. 1 15:281-88

8. Cicognani, G., Broomfield, A. M., Lallement, R., Marth, W. 1989. The European breeder program. Nucl. Tech. 88(2): 175-82

9. Chang, Y. I. 1989. The integral fast reactor. Nucl. Technol. 88:(2): 129-38

Ann

u. R

ev. E

nerg

y. 1

990.

15:1

33-1

52. D

ownl

oade

d fr

om w

ww

.ann

ualr

evie

ws.

org

by L

omon

osov

Mos

cow

Sta

te U

nive

rsity

on

01/2

9/14

. For

per

sona

l use

onl

y.

152 FORSBERG & WEINBERG

10. Berglund, R. C., Trippets, F. E. 1989. PRISM, The plant design concept of the U.S. Advanced Liquid Metal Reactor program. ANTO-SP06S. 51st Am. Pow­er Conj., Chicago

11. Planchon, H. P., Sackett, J. I., Golden, G. H. , Sevy, R. H. 1987. Implications of the EBR-II inherent safety demonstra­tion test. Nucl. Eng. Des. 101(1):75-90

12. Wakabayashi, H. 1985. Small, in­trinsically safe reactor implications. On the New Concepts of Light-Water Reac­lOrs. Vniv. Tokyo, VTNL-Memo-0008

13. Forsberg, C. W. 1986. A Process In­herent Ultimately Safe-Boiling Water Reactor. Nucl. Technol. 72:121-34

14. KrUger, K., Cleveland, J. 1989. Loss­of-Coolant Accident Experiment at the AVR Gas-Cooled Reactor. Trans. Am. Nucl. Soc. 60:735-36

IS. Gat, V. , Daugherty, S. R. 1986. The Vltimate Safe (V.S. ) Reactor. Alterna­tive Energy Sources VII. Washington, DC: Hemisphere

16. Velikhov, E. P. 1989. Safe nucJear reac­tors of the 21st century-proposal for an international project. Nucl. Europe 7-8:32

17. Forsberg. C. W., Moses, D. L.. Lewis, E. B., Gibson, R., Pearson, R., et al. 1989. Proposed and Existing Passive and Inherent Safety-Related Structures. Systems and Components (Building Blocks) for Advanced Light-Water Reac­tors. ORNL-6554. Oak Ridge, Tenn: Oak Ridge Natl. Lab.

18. Beckjord, E. S. 1989. Safety aspects of evolutionary and advanced reactors. Proc. Conj. Technology-Based Confi­dence Building: Energy and the En­vironment, July 9-14, St. Johns Col­lege, Santa Fe

19. Kletz, T. 1984. Cheaper, Safer Plants or Wealth and Safety at Work-Notes on Inherently Safer and Simpler Plants. Rugby, Warwickshire, England: Inst. Chern. Eng.

20. Kletz, T. 1989. Friendly plants. Chem. Eng. Prog. 8S(7):18-26

21. Corbett, H. J. 1988. Industry must live up to public expectations. Chern. Eng. Prog. 84(9):5

22. Weinberg, A. M. 1989. Engineering in an age of anxiety. Issues Sci. Technol. VI(2):37-43

23. Int. At. Energy Agency. 1988. Status of Advanced Technology and Design for Water-Cooled Reactors: Light-Water Reactors. IAEA-TECDOC-479. Vien­na, Austria

24. Wilkins, D. R. , Seko, T., Sugino, S., Hashimoto, H. 1986. Advanced BWR: design improvements build on proven technology. Nucl. Eng. Int. 31(383):36-45

25. Int. At. Energy Agency. 1989. Status of Advanced Technology and Design for Water-Cooled Reactors: Heavy Water Reactors. IAEA-TECDOC-51O. Vien­na, Austria

26. McCandless, R. J., Redding, J. R. 1989. Simplicity: the key to improved safety, performance and economics. Nucl. Eng. Int. 34(424):20--24

27. Teare, K. R. 1989. SIR-An imagina­tive way ahead. Nucl. Eng. Int. 34(419):32-34

28. Vijuk, R., Bruschi, H. 1988. AP600 offers a simpler way to greater safety, operability, and maintainability. Nucl. Eng. Int. 33(412):22-28

29. Kataoka, Y . • Suzuki, H., Murase, M., Sumida, I., Horiuchi, T. , Miki, M. 1988. Conceptual design and thermal­hydraulic characteristics of natural circulation Boiling-Water Reactors. Nucl. Techno!' 82:147-56

30. Sako, K. 1988. Conceptual design of SPWR. Am. Nucl. Soc. Top. Meet. on Safety of Next Generation Power Reac­tors, Seattle, Wash.

31. Hannerz, K. 1988. Making progress on PIUS design and verification. Nucl. Eng. Int. 33(412):29-31

32. Lanning, D. D. 1989. Modularized High-Temperature Gas-Cooled Reactor systems. Nucl. Technol. 88(2):139-56

33. Varley, B. 1989. Interest grows in the Modular HTGR. Nucl. Eng. Int. 34(424):25-28

34. Staudt, J. E., Lidsky, L. M. 1987. De­sign Study of an MGR Direct Brayton Cycle Power Plant. MITNPI-TR-018. Cambridge, Mass: MIT

Ann

u. R

ev. E

nerg

y. 1

990.

15:1

33-1

52. D

ownl

oade

d fr

om w

ww

.ann

ualr

evie

ws.

org

by L

omon

osov

Mos

cow

Sta

te U

nive

rsity

on

01/2

9/14

. For

per

sona

l use

onl

y.