Overview of Fission Safety for Laser ICF Fission Energy. Per F. Peterson, Edward Blandford, and Christhian Galvez

Transcription

1 Overview of Fission Safety for Laser ICF Fission Energy Per F. Peterson, Edward Blandford, and Christhian Galvez University of California at Berkeley, Berkeley, This paper reviews fission safety design principles and approaches for coupling inertial confinement fusion (ICF) to a subcritical fission blanket, in Laser ICF Fission Energy (LIFE) power plants. LIFE power plants use fuel derived from either spent fuel from fission reactors, or from natural uranium or thorium. By using fusion neutrons, LIFE plants can fission a large fraction of the heavy metal in the fuel, and thus eliminate any need for enrichment of uranium or reprocessing of the fission fuel used in the LIFE plants. This generates security and economic benefits. This paper reviews fission design, safety and licensing issues that are relevant to LIFE power plants. flow. The design must also consider the flow pattern that will exist in the blanket during shutdown conditions, when low-velocity natural circulation flow dominates. Under natural circulation care must be exercised in design to assure that thermal stratification in the blanket does not result in overheating of ODS ferritic steel structures in the upper portion of the LIFE chamber. I. INTRODUCTION LIFE power plants have been conceived to use either solid fission fuel in pebble form cooled by the liquid fluoride salt flibe (Li 2 BeF 4 ), or a molten fission fuel dissolved in flibe. The very high volumetric heat capacity of liquid salts allows the fission blanket to be compact and have high power density when coupled to a point source of fusion neutrons, as are provided by inertial fusion. For the pebble fuel form, the pebbles can be manufactured to be buoyant and to have a density less than or greater than flibe, so that the pebbles float or sink in the salt. The density of buoyant pebbles can be adjusted by adding a low-density inert graphite kernel at the center of the pebble. Sinking pebbles require sufficient heavy metal loading (likely achievable for LIFE pebbles) so that the average density of the pebble exceeds the density of the salt. Each of these liquid and pebble fuel forms has different implications for the design of a LIFE power plant to allow fuel recirculation and to give appropriate response under anticipated operating occurrences (AOO s), design basis events (DBE s), and beyond design basis events (BDBE s). Under the reference conceptual design, illustrated in Fig. 1, the first-wall structures in the chamber are constructed from oxide dispersion (ODS) ferritic steel to provide resistance to damage by fusion neutron irradiation. Because ODS ferritic steel can only be used up to moderate temperatures (up to around 700 C), the forced-circulation coolant flow in the chamber is routed so that the ferritic steel is exposed to the cool inlet flibe Fig. 1. Initial conceptual design showing a cross section of a LIFE power plant (credit LLNL). The external pressure boundary structures in the chamber are constructed from a high nickel alloy, with the reference material being Alloy 800H with a corrosion resistant cladding of Hastelloy N on surfaces contacting the liquid salt coolant. Alloy 800H is currently ASME Section III code qualified for use up to 760 C. While these materials have high corrosion resistance and can accommodate much higher temperatures than ODS ferritic steel, they are sensitive to neutron irradiation and thus are protected from fission neutrons by a graphite reflector blanket. Even in locations where these materials would not be exposed to neutrons, such as the defueling chute, the reference design includes a graphite liner that protects the structures from direct contact with hot pebbles during transients and accidents. Under transients and accidents, the fuel and all metallic components must be kept at temperatures below their damage thresholds. Because the fuel has a very high temperature threshold for damage, and because the pressure boundary structures can be protected from direct contact with hot fuel by graphite blankets, in general the

2 temperature limits on the ODS ferritic steel first wall limit the safety analysis and define the safety approach. Because LIFE plants will produce power using nuclear fission, their safety assessment will need to be consistent with approaches used to license fission power plants. A U.S. Nuclear Regulatory Commission (NRC) licensing framework for LIFE plants can be most readily derived from the framework being developed for modular helium reactors (MHRs) that use similar fuels. This paper reviews this MHR licensing framework and how it applies to LIFE, and this in turn results in recommendations for key design approaches for the LIFE system. Consistent with the NRC licensing framework, this paper provides a preliminary analysis of postulated initiating events for LIFE power plants, and then selects a subset of normal operating modes, normal operating transients, and accidents to use for initial safety system design. Regulatory design criteria are identified. Design principles for the fission blanket are then discussed, along with a qualitative description of potential fission safety approaches, for three LIFE fuel options (solid pebble fuel that is either buoyant or sinks in the primary salt, and fission fuel dissolved in the primary salt). II. LIFE LICENSING FRAMEWORK Commercial LIFE power plants will be licensed by the U.S. Nuclear Regulatory Commission (NRC), and will be designed to meet applicable safety standards for advanced nuclear power plants. The closest analogy to LIFE plants is MHRs, which use similar fuel as the solidfuel version of the LIFE plant. This MHR licensing framework was developed in the early 1990 s [1], and more recently has been updated in a series of white papers developed for NRC pre-application review of the South African Pebble Bed Modular Reactor (PBMR) [2-5]. Safety design requires systematic identification of potential initiating events that might occur in a reactor due to external initiators (earthquakes, floods, missiles, etc.) or internal initiators (equipment failures, human errors, etc.) [2]. The design of the physical protection system also requires similar analysis to identify initiating events that could be generated deliberately. The probability of the safety-related initiating events is then assessed using probabilistic risk assessment (PRA) methods [3], and the initiating events are categorized into classes based on probability. As applied to MHRs, Anticipated Operating Occurrences (AOO s) are those events with frequencies greater than once per 100 years, and thus could be expected to occur some time during the life of a given plant. Design Basis Events (DBE s) are those events with frequencies between 10-2 and 10-4 per year, and thus could reasonably be expected to occur over the lifetime of a large number (e.g., around 100) plants. Beyond Design Basis Events (BDBE s) are those events with frequencies between 10-4 and 5x10-7 per year. The lower threshold of 5x10-7 per year corresponds to frequency where an individual s risk of death in an accident is less than 0.1% of an individual s risk of death from all types of accidents (Ref. [2], pg. 22). For each category of event (AOO, DBE, BDBE) Top Level Regulatory Criteria (TLRC) establish what the acceptable outcome is. Fig. 2. Relationship between event frequency and consequences for PBMR AOO, DBE, and BDBE sequences, and comparison of consequences with TLRC limits for acceptable versus unacceptable consequences (Ref. [4], pg. 17) Figure 2 illustrates a Licensing Basis Event (LBE) frequency/consequence figure for the PBMR, showing the PBMR AOO, DBE, and BDBE sequences which have been identified and studied. The event frequencies have been calculated using PRA methods, and the vertical error bars show the uncertainty in the assessed event frequency. The event consequences, in terms of radiation dose to an individual at the exclusion area boundary, have been calculated using detailed system models, with uncertainty bounds shown by the horizontal error bars. These dose ranges can be compared to the dose limits established by the TLRC. The principle of Defense in Depth (DiD) is also applied in design to account for the uncertainty in whether all possible LBE s have been identified, and whether the probability and consequences of the LBE s have been properly assessed [5]. A number of methods are available to provide and assess DiD, including measures to reduce the frequency of initiating events, measures to provide diversity in preventing unacceptable outcomes from event sequences (assuring that all fault tree cut sets have multiple members), and assessing plant response to hypothetical degraded states and developing mitigation measures. In the LIFE plant design, DiD considerations will likely require that the beam lines include large valves

3 to isolate the LIFE chamber as a part of a larger containment structure. The LIFE plant design is at the conceptual level, and thus insufficient information exists to comprehensively identify and categorize LBE s. Instead, for the conceptual design process a set of initiating events has been developed for the purpose of design development and optimization. These specific postulated initiating events are discussed in the next section. To assure plant safety under the full range of LBE s, the PBMR has established a set of six top-level safety functions or Regulatory Design Criteria (RDC) that, if met, assure that the TLRC are also met. These RDC are also relevant to LIFE plants, and provide a framework to assess the design of the LIFE safety systems (Ref. [4], pg. 18): Maintain control of radionuclides Control heat generation (reactivity) Control heat removal Control chemical attack Maintain core and reactor vessel geometry Maintain reactor building structural integrity Approaches to meet these top-level safety functions in the LIFE plant are discussed later in this report. IV. LIFE FISSION FUEL OPTIONS AND TRANSIENT RESPONSE The potential approaches to accommodate each of these normal operational requirements and LBE s, while meeting the TLRC, depend upon the fission fuel type. Here the implications for buoyant pebble fuel are discussed first, followed by discussion of sinking pebble fuel and liquid fuel. III. LIFE POSTULATED LICENSING BASIS EVENTS The safety analysis of a LIFE power plant requires the systematic identification of normal operating modes as well as Licensing Basis Events (LBE s) that must be considered in design. For the purpose of conceptual design, a subset is used for analysis and feedback for the design. As the LIFE design process progresses, the set of normal operating modes and LBE s will be periodically updated. For initial conceptual design three general types of normal operation, transients and accidents are considered and discussed. These are: Fuel Recirculation, where under normal full-power operation pebbles are injected into and removed from the core to maintain homogeneous burn up of the pebbles and allow periodic inspection, or liquid fuel is recirculated to allow removal of volatile fission products and to facilitate heat transfer through a heat exchanger to an intermediate coolant. Loss of Forced Cooling Transient (LOFC), an Anticipated Operating Event where intermediate heat transfer and forced circulation of the primary coolant are interrupted, and decay heat removal must then occur by natural circulation heat transfer to an alternative heat sink. Loss of Coolant Accident (LOCA), a Design Basis Event where a break in the primary coolant piping results in the loss of primary coolant inventory, Fig.3. Schematic cross section of a reference LIFE fission blanket design for buoyant pebble fuel. Figure 3 shows a schematic diagram of a potential blanket configuration based on buoyant pebble fuel. Here normal pebble recirculation is achieved using the same approach that has been developed and tested experimentally for the UCB Pebble Bed Advanced High Temperature Reactor (PB-AHTR) [6]. Pebbles are removed from the top of a refueling chute, which is sufficiently long that the pebble residence time in the chute (one to two days) allows short-lived fission products to decay, reducing the radiation levels for subsequent handling of the pebbles. Pebbles are injected into cool coolant entering the bottom of the blanket, and

4 are transported by the coolant flow to the bottom of the pebble bed. Pebble injection and removal for a cylindrical bed have been demonstrated in the Pebble Recirculation Experiment (PREX) under scaled experimental conditions matching the pebble Reynolds and Froude numbers and the pebble to salt density ratio [6]. One important difference in the LIFE configuration is that the primary coolant flow is across the pebble bed, not upward. Because the coolant flow exerts hydrodynamic forces on the pebbles that are large compared to buoyancy forces, this raises the potential that the pebbles may be pinned against the wall and will not move upward. A similar situation exists in the PREX experiment at the top of the device, where the pebble flow converges in a 45 conical section with coolant holes removing the bulk of the coolant flow. In this case the wall suction is not observed to obstruct the movement of pebbles, although as discussed later PREX has a different friction coefficient than LIFE. This issue requires further study for the LIFE blanket design, and likely requires that the flow pattern in the bed also have an upward velocity component to assist the pebble bed motion. Under a LOFC transient, heat removal must be provided by an alternative heat sink. One option is to use a Direct Reactor Auxiliary Cooling System (DRACS). This method has been implemented on the PB-ATHR. RELAP5-3D simulations have shown that the method can remove fission product decay heat with only a small transient increase in the coolant outlet temperature [7]. To do this a loop is provided from the top of the pebble blanket to a DRACS heat exchanger (DHX), as shown in Fig. 3, which transfers heat to an intermediate salt and then to ambient air. The cooled flow then returns to the bottom of the pebble blanket. Bypass flow during forced circulation is minimized using a vortex diode, a passive flow control device used in earlier reactors that provides a high flow resistance in one direction and a low resistance in the other. If the chamber uses a wetted wall rather than solid armor, the wall flow must be physically separate from the coolant flow to the pebbles, because the wetted wall flow will drain after the pumps stop. During a LOFC transient, natural circulation will also generate thermal stratification in the pebble blanket, tending to equalize the temperature distribution horizontally across the blanket. Because the flow pattern during forced circulation directs cool salt flow to the ferritic steel first wall structures and maintains them at lower temperatures, under the transition to natural circulation this thermal stratification effect may redistribute stored energy in the fuel and reflector and result in overheating of the first wall structure. The impact of such natural convection heat transfer must be considered during detailed design and safety analysis of the LIFE fission blanket. During a LOCA, some or all of the primary coolant inventory is lost, disabling natural circulation heat removal from the fuel pebbles and from activated structural materials. In modular helium reactors heat removal following LOCA occurs by conduction from the fuel through a graphite reflector to the reactor vessel. The graphite reflector insulates the vessel from direct contact with the fuel, allowing the fuel to go to high temperatures. For the LIFE chamber this approach is not practical, because it is not possible to adequately insulate the ferritic steel first wall structures from the fuel pebbles without unacceptable neutronics penalties. To protect the first wall structures and to mitigate a LOCA, an active cooling system capable of pumping an emergency coolant such as sodium fluoroborate salt through the blanket must be developed, which is likely impractical, or the pebbles must be drained into a storage location that provides passive heat removal and protects the pebbles from chemical attack. One option for this purpose is to drain the pebbles into an emergency vessel containing a low-density sodium fluoroborate salt (1.790 g/cm 3 at 650 C) or potassium fluoroborate salt (approximately 1.74 g/cm 3 based on additive molar volumes, [8]), which have low density compared to flibe (1.96 g/cm 3 ). Pebbles fabricated with densities greater than the fluoroborate salt density would sink in the salt and could then be cooled and protected from chemical attack. Even if the density of the emergency salt density increases due to mixing with primary salt, most pebbles would remain submerged below the emergency salt surface providing cooling even if their density was slightly above the salt mixture density. Systems to drain pebbles have also been studied for MHRs [9]. Even after the fission pebbles are removed from the blanket, heat will continue to be generated by decay of activation products in the first wall structures. This is a generic issue for fusion blankets, and has been studied extensively. It must also be considered for the LIFE chamber. Buoyant and Sinking Pebbles The primary difference between buoyant and sinking pebbles relates to the approach to recirculating these pebbles through the blanket. Recirculation of buoyant pebbles has been demonstrated experimentally [6], but in a geometry and under flow conditions that differ from those needed for LIFE blankets. In liquid cooled pebble beds under forced circulation hydrodynamic forces on pebbles (friction and form drag) are large compared to buoyancy forces. In the LIFE blanket, it is desired to have the coolant flow across the pebble bed, transverse to the direction of pebble movement, to reduce the pressure losses and pumping power while achieving high power density.

5 In practice, it will likely be required that the flow be at an angle, but not perpendicular to the direction of pebble motion, so that the hydrodynamic forces help move the pebbles in the direction of recirculation. It may be more difficult to obtain the desired flow velocity distribution for the case of sinking pebbles, since the forced convection flow must then be downward, while buoyancy driven flows would be dominantly upward. Options for achieving passive, buoyancy driven heat removal therefore requires more study for sinking pebbles. The required flow velocity distribution will depend upon the coefficient of friction between the pebbles and the graphite reflector surface they slide on. The dynamics of the pebble bed itself depend upon friction between the pebbles and the channel walls, and thus on the friction coefficient of graphite. The mean friction coefficient for graphite in vacuum and in helium, after pre-calcination, is relatively high at at room temperature, dropping to 0.1 to 0.15 at 1500 C. The admission of air sharply decreases the friction coefficient (from about 0.75 to as low as 0.08) (Refs ). The friction coefficient for high temperature pebbles in liquid salts, where the salt may provide some lubricity, is not known, so the primary source of distortion in scaled experiments using polyethylene spheres rubbing against Plexiglas in water, where the coefficient of friction is approximately 0.3, arises from uncertainty in the effects of pebble-to-pebble friction in the motion of the pebble bed. Wear of graphite surfaces is also an important phenomena that is likely to be affected by the liquid salt, both because contact forces are increased due to the higher coolant hydrodynamic forces on pebbles but are reduced due to lower pebble buoyancy forces and due to lubricity of the liquid salt. Liquid Fuel For liquid fuel some recirculation is required to allow removal of volatile fission products and control of salt chemistry (particularly redox control), and recirculation is also used to force the fuel salt flow through an intermediate heat exchanger. Under LOFC transients, decay heat removal may occur by flow through a DRACS heat exchanger. The fuel salt will rapidly thermally stratify after the primary pumps stop, so the thermal effects on the ferritic steel first wall structure will require detailed analysis. For LOCA, possible leak paths for spilled fuel salt must be designed to collect the salt into a drain system or immobilize it by freezing. In the design of molten salt reactors, the reactor and primary loop components are normally located inside a furnace, a hot cell that is insulated and maintained above the salt freezing temperature. This approach may not be desirable for a liquid fueled LIFE chamber, but the choice will affect how spilled salt is transported if a LOCA occurs. Inventory loss due to LOCA will have the potential to interrupt the natural circulation removal of heat to the DRACS system. Therefore LOCA will require that the remaining fuel salt be drained to a subcritical, passively cooled tank, as is also recommended for pebble fuels. V. CONCLUSIONS The Regulatory Design Criteria (RDC) provide a convenient format to discuss the system safety design for the LBE s. This section provides a brief concluding review. 1) Maintain control of radionuclides: Here the primary goal is to fabricate high quality fuel, and to have periodic monitoring of the fuel as it is recirculated to identify pebbles with potential damage. In addition, the reactor building will serve as a containment boundary, and penetrations in the building (particularly the beam tubes) will require isolation valves. The fact that liquid salts provide no source of stored energy (volatility or chemical reactivity) that can pressurize a containment simplifies this RDC. 2) Control heat generation (reactivity): Here the primary goal is to have a highly reliable system to shut off the fusion power if core heat removal is interrupted. This system should have sufficient diversity and redundancy to have high reliability. 3) Control heat removal: Because RDC (2) controls the fission power to prevent core overheating, this RDC relates to decay heat removal. LIFE plants will have the capability to remove heat actively though the intermediate loop. Under LOFC transients, the capability to remove decay heat passively is provided by a DRACS system. Under LOCA, the fuel pebbles are drained into a vessel containing an emergency fluoroborate salt, and passive heat removal occurs from this vessel. 4) Control chemical attack: Here the primary goal is to prevent air or steam ingress from causing exothermic chemical reactions with the graphite shell and matrix of the pebbles. In LIFE plants chemical attack is prevented by keeping the pebbles submerged under a chemically inert salt pool under all LBE s, either in the blanket, or by draining the pebbles into an emergency salt vessel during LOCA. 5) Maintain core and reactor vessel geometry: Here the primary goal is to control the temperature of the ODS ferritic steel of the first wall, and to design the LIFE chamber to accommodate design basis seismic events. Seismic base isolation may be used. 6) Maintain reactor building structural integrity: Here the primary goal is to maintain the functional integrity of the reactor building under all LBE s, including seismic, missile, and other external events. Because the salts have very low pressure, LIFE plants have no stored energy sources to pressurize the reactor

6 building containment, so in this respect LIFE plants are simplified compared to MHRs. The development of the LIFE fission safety approach discussed in this report identifies several areas where further research and study are required. However, the basic framework for achieving fission-reactor safety for LIFE power plants can be derived from that for MHRs, and shows promise that LIFE plants will be capable of achieving very stringent safety levels. VI. REFERENCES 1. U.S. DOE, "Preliminary Safety Information Document for the Standard Modular High Temperature Gas-Cooled Reactor," DOEHTGR , Amendment 13, Chapter 3, August (1992). 2. US Design Certification: Licensing Basis Event Selection for the Pebble Bed Modular Reactor, PBMR Document Number , Rev. 1, June 30, (2006). 3. US Design Certification: Probabilistic Risk Assessment Approach for the Pebble Bed Modular Reactor, PBMR Document Number , Rev. 1, June 13 (2006). 4. US Design Certification: Safety Classification of Structures, Systems and Components for the Pebble Bed Modular Reactor, PBMR Document Number , Rev. 1, August 24 (2006). 5. US Design Certification: Defense-in-Depth Approach for the Pebble Bed Modular Reactor, PBMR Document Number , Rev. 1, August 12 (2006). 6. P. BARDET, J.Y. AN, J.T. FRANKLIN, D. HUANG, K. LEE, M. TOULOUSE AND P.F. PETERSON, The Pebble Recirculation Experiment (PREX) for the AHTR, Proceedings of Global 2007, Boise, Idaho, September 9-13 (2007). 7. A. GRIVEAU, F. FARDIN, H. ZHAO, AND P.F. PETERSON, Transient Thermal Response of the PB-AHTR to Loss of Forced Cooling, Proceedings of Global 2007, Boise, Idaho, September 9-13 (2007). 8. D. F. WILLIAMS, :Assessment of Candidate Molten Salt Coolants for the NGNP/NHI Heat-Transfer Loop, Oak Ridge National Laboratory, ORNL/TM- 2006/69, June (2006). 9. J. DONG and S. YU, Concept of Pebble Bed Based HTGR with Fast Pebble Discharge System," Proceedings of the 2nd International Topical Meeting on High Temperature Reactor Technology, #Paper D02, Beijing, China, September (2004). 10. A. P. SEMENOV, Tribology at high temperatures, Tribology International, 28, (1995). 11. H. ZAJDI, D. PAULMIER and J. LEPAGE, The influence of the Environment on the Friction and Wear of Graphitic Carbons, Applied Surface Science, 44, (1990). 12. L. XIAOWEI, Y. SUYUAN, S. XUANYU, H. SHUYAN, The influence of roughness on tribological properties of nuclear grade graphite, Journal of Nuclear Materials, 350, (2006).