One of the first steps in developing a risk assessment model is an exhaustive search for initiating events, which is a systematic and comprehensive starting point to answer the question “what can go wrong?” for a given system design.
Trang 1Available online 4 October 2020
0149-1970/© 2020 The Authors Published by Elsevier Ltd This is an open access article under the CC BY-NC-ND license (http://creativecommons.org/licenses/by-nc-nd/4.0/).
A systematic approach to identify initiating events and its relationship to
Probabilistic Risk Assessment: Demonstrated on the Molten Salt
Reactor Experiment
Brandon M Chisholma,*, Steven L Krahna, Karl N Flemingb
aVanderbilt University, Dept of Civil and Environmental Engineering, PMB 351831, 2301 Vanderbilt Place, 37235, Nashville, TN, USA
bKNF Consulting Services LLC, 816 West Francis Ave, Spokane, WA, 99205, USA
A R T I C L E I N F O
Keywords:
Molten salt reactor
Initiating events
Safety
Risk assessment
Process hazards analysis
Master logic diagram
A B S T R A C T One of the first steps in developing a risk assessment model is an exhaustive search for initiating events, which is
a systematic and comprehensive starting point to answer the question “what can go wrong?” for a given system design Identifying Postulated Initiating Events (PIEs) for a reactor design that is at a conceptual or preliminary stage facilitates the incorporation of risk insights into the next iteration of the design process and allows for the early establishment of more quantifiable risk assessment models, such as event sequence diagrams and event tree analysis Liquid-Fueled Molten Salt Reactors (LF-MSRs) are an example of an advanced reactor technology that does not benefit from having a wealth of operating experience or prior risk-informed safety assessment efforts Furthermore, design details, such as normal operating conditions and the composition of radioactive material inventories, can deviate substantially from those in other reactors, such that a systematic and comprehensive approach to identifying PIEs for an LF-MSR may highlight accident initiators that have not previously been identified In the present work, the Master Logic Diagram (MLD) and Hazards and Operability (HAZOP) study approaches were used, together, to identify and consider PIEs for multiple inventories of radioactive material across various Plant Operating States (POSs) in a specific LF-MSR design – the Molten Salt Reactor Experiment (MSRE) Potentially risk-significant PIEs identified during the analyses of the MSRE design are presented Furthermore, considerations for exhaustively identifying PIEs for advanced reactor designs are discussed; for example, the combination of inductive and deductive methods was found to provide a robust identification of PIEs in a way that is conducive to the analysis of a nuclear reactor design at an early design stage
1 Introduction
Developers of next generation commercial nuclear reactor systems
are proposing innovative design concepts that are intended to provide
advantages over existing nuclear reactors in several areas, including
economics, proliferation resistance, reliability, and safety (GIF, 2002)
With respect to safety, the expectation from the marketplace and
regu-lators is that advanced reactors “will provide enhanced margins of safety
and/or use simplified, inherent, passive, or other innovative means to
accomplish their safety and security functions.” (NRC, 2008) Because
the various advanced non-Light Water Reactor (non-LWR) technologies
utilize different coolants, fuel forms, and safety system designs, the
nuclear industry and regulators have recognized the benefit of defining a
technology-inclusive, risk-informed, and performance-based (TI-RIPB) methodology to assess the safety associated with non-LWR designs, rather than relying on prescriptive rules, such as those prepared for LWRs (NRC, 2019; GIF, 2011) In order to optimize the safety and manage the risks associated with advanced reactor designs, a safety assessment approach should also support safety that is “built-in” to the system design in a fundamental way, rather than “added on” to compensate for safety limitations (GIF, 2002) In the US, the Licensing Modernization Project (LMP) (NEI, 2019) has defined a methodology that uses industry-standard analyses, such as Process Hazards Analysis (PHA) and Probabilistic Risk Assessment (PRA),1 to support TI-RIPB applications, including:
* Corresponding author
1 Also known internationally as Probabilistic Safety Assessment (PSA)
Contents lists available at ScienceDirect Progress in Nuclear Energy journal homepage: http://www.elsevier.com/locate/pnucene
https://doi.org/10.1016/j.pnucene.2020.103507
Received 29 January 2020; Received in revised form 30 July 2020; Accepted 31 August 2020
Trang 2•Evaluation of design alternatives;
•Incorporation of risk insights early in the design process and
continuing during the development of the design;
•Selection and evaluation of Licensing Basis Events (LBEs);
•Safety classification of structures, systems, and components and
development of performance targets; and
•Evaluation of defense-in-depth adequacy
The development of the LMP methodology benefitted from
interna-tional guidance, such as the Integrated Safety Assessment Methodology
(ISAM) described by the Generation IV International Forum (GIF) (GIF,
2011), and the body of knowledge associated with risk-informed and
performance-based technology
A risk-informed safety assessment approach will comprehensively
and systematically evaluate the hazards and risks associated with the
system design Fundamentally, a risk analysis consists of answers to the
questions in the “risk triplet” originally defined by Kaplan and Garrick
(1981) The three questions that make up the triplet are answered in the
development of a PRA model and are expressed as follows:
1 What can happen? (i.e., what can go wrong?)
2 How likely is it to happen?
3 If it does happen, what are the consequences?
A related fourth question that can be asked is “what are the
un-certainties in addressing each of these questions using PRA?” Given the
risk triplet, and an understanding of the role played by uncertainty, an
important starting point for any good safety assessment is a
compre-hensive and systematic analysis of occurrences that have the potential to
result in undesirable consequences within the system These occurrences
are called initiating events (IEs).2 Because of the extensive operating
experience associated with LWRs, generic IE lists are available for LWRs
(IAEA, 1993; McClymont and Poehlman, 1982; Mackowiak et al., 1985),
although it is still necessary to account for design-specific factors that
influence the IEs within a PRA model However, advanced reactors have
little to no commercial operating experience; further, the fundamental
physical phenomena that govern the performance of non-LWRs can
deviate substantially from those in LWRs
The foregoing realities render previous reactor operating experience
of limited value with respect to exhaustively identifying IEs for the risk
assessment of non-LWRs In developing a systematic approach to
iden-tify IEs for a new design, it is necessary to understand the safety features
of the reactor plant, the nature of radiological hazards, and how the
plant is designed to retain hazardous material within physical and
functional barriers As a result, a systematic search for IEs naturally
provides the initial building blocks for the PRA models that account for
the plant response to the IEs, in addition to developing a list of IEs to be
modeled
There is significant history in developing PRA models for some types
of advanced non-LWRs, such as High-Temperature Gas-cooled Reactors
(HTGRs) (DOE, 1988) and Sodium-cooled Fast Reactors (SFRs) (GE
Hitachi, 2017); however, only recently has work to develop PRA models
for Molten Salt Reactors (MSRs) been initiated In particular, the
Liquid-Fueled Molten Salt Reactor (LF-MSR) is an advanced reactor
technology for which a comprehensive identification of IEs is needed
No commercial LF-MSRs have been operated, and less work has been
conducted in the area of LF-MSR safety assessment in comparison to
other non-LWR technologies Additionally, LF-MSRs have the potential
to have significant inventories of radionuclides, including those in
different locations other than the reactor core, that are in forms not
commonly present in other commercial nuclear reactor designs These
radionuclides include soluble fission products dissolved in molten salt
inside and outside the core and volatile radionuclides in off-gas streams Because these inventories of radioactive material present unique chal-lenges to the barriers that are intended to prevent their release from the system, a thorough identification of IEs could find occurrences that have not previously been considered for other reactor technologies The goal of the present work is to systematically identify Postulated Initiating Events (PIEs) for a specific LF-MSR design, the Molten Salt Reactor Experiment (MSRE) The context for this work in relation to prior efforts to identify and organize PIEs for LF-MSRs is presented in Section 2 Then, in Section 3, the methodology for the analysis of MSRE IEs is defined The results of the MSRE IE analysis are discussed in Section 4, and conclusions regarding these results and the overall approach are presented in Section 5
2 Background
This section presents insights gained from literature relevant to the identification and evaluation of PIEs for LF-MSRs Definitions for important terms are described (Sect 2.1) before the existing guidance on PIE analysis is discussed (Sect 2.2) Finally, prior efforts to analyze PIEs for LF-MSRs are briefly summarized (Sect 2.3)
2.1 Definitions
Within the risk assessment community, IEs3 are typically character-ized as the starting point for providing answers to the first question of Garrick and Kaplan’s risk triplet presented above (i.e., “what can go wrong?”) The remaining part of the answer to this question is to provide
a model for the plant response to the IE, for only then can the conse-quences be fully realized For the purposes of quantitative risk analysis, IEs are used in event sequence4 modeling and Event Tree Analysis (ETA)
to complete the answer of the first question and to set up the framework for answering the second question of the risk triplet (i.e., “how likely is it
to happen?”) by estimating the frequencies of event sequences of in-terest The end states of the event sequences form the boundary condi-tions for answering the third question of the triplet (i.e., “what are the consequences?”)
Because the definition of risk also involves defining consequences of interest, the specific scope of what is considered to be an IE can vary among different industries In the most general sense, an IE is a deviation from normal conditions that could, if not responded to in a correct and timely manner, lead to a consequence of concern (Modarres, 2006; CCPS, 2015) In the present analysis, the consequence of concern is the transport of radioactive material through a barrier that is intended to prevent its release Accordingly, this work will use a definition based upon the definition used in the non-LWR PRA Standard (ASME/ANS, 2013); an IE is “a perturbation to the plant that challenges plant control and safety systems whose failure could potentially lead to an undesirable end state and/or radioactive material release.” However, the Interna-tional Atomic Energy Agency (IAEA) notes that the term “initiating event” is typically used in relation to event reporting and analysis, while
“postulated initiating event” is used during the consideration of
hypo-thetical events at the design stage (IAEA, 2019) As such, the events identified in the present work for the MSRE are considered to be postulated initiating events (PIEs)
Further drawing from the above referenced IAEA guidance, in this work a hazard is defined as “a factor or condition that might operate against safety.” Accordingly, the hazard evaluations (i.e., PHA studies) conducted on the MSRE were organized efforts to identify hazardous situations associated with operation of the system being reviewed
2 A more rigorous definition of “initiating event” for the purposes of this work
is presented in Section 2.1
3 Also sometimes referred to as “initiators”
4 An event sequence is comprised of an IE, the plant response to the IE (which includes a sequence of successes and failures of mitigating systems) and a well- defined end state (Nuclear Energy Institute, 2019)
Trang 3(CCPS, 2008).5
As will be discussed in Section 3, the barriers that are intended to
prevent the release of radioactive material (and the challenges to these
barriers) can change substantially in an LF-MSR depending upon the
specific configuration of the plant Recognizing this fact, an objective of
this work will be to identify key considerations for the analysis of PIEs in
LF-MSRs for Plant Operating States (POSs) other than at-power
opera-tions, such as shutdown conditions Using guidance in the non-LWR PRA
Standard (ASME/ANS, 2013), a POS is defined in the present work as “a
standard arrangement of the system during which conditions are
rela-tively constant and are distinct from other configurations in ways that
impact risk.” The standard requirements for IE analysis recognize that
the possibilities and frequencies of IEs are highly dependent on the POS
2.2 Approaches for identifying initiating events in advanced reactor
designs
Risk assessment (e.g., PRA or PSA) is a key component of a RIPB
safety assessment (NRC, 2019; NEI, 2019; IAEA, 2019) Along with
system familiarization, identification of PIEs is acknowledged as one of
the first steps in evaluating risk associated with system designs in many
industries (Modarres, 2006), including the aerospace (NASA, 2011),
chemical process (CCPS, 2000), and commercial nuclear industries
(NRC, 1983; IAEA, 2010) A frequently cited tool to facilitate the
iden-tification of PIEs is the Master Logic Diagram (MLD) (IAEA, 1933;
Modarres, 2006; NASA, 2011; NRC, 1983) MLD is a deductive (i.e.,
top-down) analysis that results in a model that resembles a fault tree, but
is intended to document a thought process rather than calculate a failure
probability (Papazoglou and Aneziris, 2002) The MLD approach can be
useful to determine elementary failures (or combinations of elementary
failures) that could challenge normal operations; however, development
of an MLD alone does not provide sufficient confidence that PIEs have
been comprehensively identified (IAEA, 2010)
It is worthwhile to note that example applications of MLDs vary from
case to case in relation to content and structure, but all lead to a
sys-tematic identification of PIEs for a particular design An objective of this
paper is to propose a suitable structure for an LF-MSR MLD that can be
used not only for identifying PIEs, but also for forming the structure of
the plant response model for PIEs that are identified
The combination of a deductive analysis (such as MLD) with an
inductive analysis to determine hazardous physical and/or chemical
reactions of concern to a design has been found to be particularly
effective to ensure completeness of PIE identification and resolution of
uncertainty surrounding design quality (Nagel and Stephanopoulos,
1995) The variety of industry-standard inductive analyses includes:
semi-structured PHA methods (e.g., What-If analysis), structured PHA
methods (e.g., Hazard and Operability, HAZOP), and structured analysis
of failure modes (e.g., Failure Modes and Effects Analysis, FMEA) (CCPS,
2015) Selection of a specific hazard evaluation method is dependent
upon several factors, including design maturity, nature of the facility,
and intended use of the results of the study (Chisholm et al., 2019a) For
example, the results of a HAZOP study are typically more
comprehen-sive than those of a What-If analysis, and a HAZOP study requires less
detailed design information than does an FMEA (CCPS, 2008) Detailed
guidance on selecting and conducting various hazard evaluation studies
is available in the references (CCPS, 2008; Stamatis, 2003; Crawley and
Tyler, 2015; EPRI, 2018; EPRI, 2019a; NRC, 2001)
2.3 Relevant LF-MSR safety assessment efforts
In addition to original analyses, an exhaustive search for PIEs should
also involve the review of lists of PIEs that have been developed for
similar plants (based on safety assessments and system operating expe-rience) to support comprehensiveness (IAEA, 1993; CCPS, 2015; ASME/ANS, 2013; NRC, 1983; IAEA, 2010) Although the MSRE rep-resents the only LF-MSR system with significant operating experience, and the authorization for the MSRE was largely deterministic (Flanagan, 2017), a Preliminary Hazards Analysis (PrHA) was documented (Beall, 1961) and used as an input to the final MSRE Safety Analysis Report (SAR) (Beall et al., 1964) PIEs identified for the MSRE in these reports include some PIEs that are typically considered for other reactor types (e.g., uncontrolled control rod withdrawal and loss of heat sink) as well
as some PIEs unique to LF-MSRs (e.g., freeze valve failure, loss of graphite from the core, and precipitation of fissile material) One notable weakness of the pre-operational MSRE safety assessment was that the analysis focused exclusively on PIEs that could result in release
of radioactive material from a single inventory: the fuel salt As will be discussed in Section 3.1, during different POSs, significant inventories of radioactive material could also be present in the MSRE off-gas and in the MSRE fuel salt processing system Only a single, bounding scenario resulting in the release of volatile radionuclides during processing of the fuel salt was documented (in a separate report by Lindauer, 1967) before processing operations were conducted, and there does not seem to have been any documented efforts to identify PIEs that could lead to release of volatile radionuclides from the MSRE Off-Gas System (OGS) A recent effort (Chisholm et al., 2018) grouped the PIEs identified by the MSRE team in the PrHA (Beall, 1961) and SAR (Beall et al., 1964) into 7 different categories; however, without the use of a systematic and comprehensive search for PIEs, the list of MSRE PIEs developed by Chisholm et al (2018) cannot be considered complete
Another recent study (Geraci, 2017) was conducted to identify key PIEs for a modern commercial LF-MSR design, Flibe Energy’s Liquid Fluoride Thorium Reactor (LFTR) A list of PIEs was compiled by surveying generic lists of LWR PIEs (IAEA, 1993), NRC reports (Mack-owiak et al., 1985; Poloski et al., 1999; Eide et al., 2007; NRC, 1990), and MLDs being developed for solid-fueled Fluoride-cooled High-temperature Reactors (FHRs)6 (Mei et al., 2014; Zuo et al., 2016)
to identify PIEs that related to the hazards identified by the What-If analysis7 of the LFTR design conducted by the Electric Power Research Institute (EPRI) (2015) A total of 18 PIEs were identified, with
10 PIEs determined to be similar to those typically considered for LWRs and 8 determined to be unique to the LFTR design However, the anal-ysis in (Geraci, 2017) does not explicitly mention hazards or PIEs that could potentially result in release of radioactive material from the OGS; further, the PIEs identified in the study that relate to radioactive ma-terial inventories other than the fuel salt are either: broadly defined (e g., operator error), related to external events (e.g., seismic events), or are internal events that potentially impact many plant functions simul-taneously (e.g., fire within the plant or loss of offsite power without scram) Because the only LF-MSR-specific reference surveyed for this PIE analysis was a What-If analysis (which is not a comprehensive PHA method, see CCPS, 2008), a more comprehensive study of hazards and potential initiators is warranted to provide confidence that important PIEs were not overlooked
An example of the performance of a systematic search for PIEs for an LF-MSR design is presented in (Pyron, 2016) In the study, Pyron applies the MLD approach to Thorium Tech Solution Inc.’s FUJI-233Um design (IAEA, 2007) The PIEs identified in the MLD were compared to a list of FHR PIEs (Allen et al., 2013) and typical examples of events analyzed in LWR PRAs (NRC, 2007; Schweizerische Eidgenosse, 2009) and then grouped into 8 categories All of the categories but one (i.e., the
5 This use deviates from the definition of “hazard analysis” presented in the
ASME/ANS Non-LWR PRA Standard (American Society of Mecha, 2013)
6 i.e., solid-fueled, molten salt-cooled reactors
7 The What-If analysis technique is a loosely-structured, brainstorming PHA method in which hazards are evaluated through the asking of questions or voicing of concerns about possible undesired events (Center for Chemical Proce,
2008)
Trang 4“MSR-specific category”) were derived based upon the categories of
Anticipated Operational Occurrences (AOOs) and postulated accidents
recommended in the US NRC Standard Review Plan for LWRs (NRC,
2007) Although the MLD developed in (Pyron, 2016) includes
consid-eration of PIEs for the release of radioactive material from inventories
other than those related to the fuel salt loop, there is a disparity between
the resolution of the PIE decomposition that could lead to the release of
fuel salt and that of PIEs that could lead to the release of material from
other inventories For example, “release of core material/core damage”
is decomposed into 7 hazards that could result in a transport of fuel salt
through the first barrier to its release (including insufficient reactivity
control, insufficient cooling, overcooling, etc.), while “off-gas system
failure” is not decomposed any further in the MLD Therefore, it seems
that use of an inductive analysis tool, such as a HAZOP study, may be
able to increase the understanding of functional and/or specific
sub-system or component failures that could contribute to a release of
radioactive material from the OGS of an LF-MSR
A recent workshop was held with the objective of identifying PIEs for
a generic LF-MSR design, with participants including representatives
from 7 prospective reactor vendors, industry bodies, US and Canadian
regulators, US and Canadian national laboratories, and the academic
community (Holcomb et al., 2019) To facilitate the brainstorming
ex-ercise, summary high-level design information, taken from the MSRE
and the concepts for both the Molten Salt Demonstration Reactor and
the Molten Salt Breeder Reactor, for the following subsystems was
briefly presented:
•Reactor and fuel salt system;
•Drain tank and decay heat removal system;
•Off-gas system;
•Fuel processing system; and
•Reactor building
For each of the subsystems, the participants of the workshop were
asked to brainstorm “what could go wrong?” and the answers were
recorded (Holcomb et al., 2019) The structure of the study to
brain-storm PIEs that could pertain to inventories of radioactive material other
than the fuel salt represents an improvement in comprehensiveness over
previous studies that have focused mostly on the fuel salt system;
however, the 140 PIEs listed in (Holcomb et al., 2019) were not
cate-gorized beyond the subsystem to which they pertain The list of PIEs in
(Holcomb et al., 2019) represents the results of an inductive analysis of
PIEs that can be used to supplement more comprehensive design-specific
studies
Perhaps the most systematic and comprehensive effort to identify
and evaluate PIEs for an LF-MSR to-date is the analysis described in
(G`erardin et al., 2019) As part of the Safety Assessment of the Molten
Salt Fast Reactor (SAMOFAR) project under the Horizon 2020 Euratom
research program, Gerardin et al developed an initial list of PIEs for
normal operating conditions of the Molten Salt Fast Reactor (MSFR)
conceptual design through use of both the MLD approach and
perfor-mance of a Functional Failure Modes and Effects Analysis (FFMEA)
Combining the results of both analyses, 13 “families” of PIEs were
identified by grouping together PIEs that resulted in similar
conse-quences and at least one “representative event” was identified for each
family The representative PIEs were assumed to envelope all similar
PIEs in terms of radiological consequences, but it is noted in (G`erardin
et al., 2019) that the list of PIEs will be iteratively updated as additional
data and design detail is developed Based on the list of PIEs, it was
concluded in (G`erardin et al., 2019) that PIEs were identified for the
MSFR that had not previously been identified for LWRs, such as “loss of
fuel flow.”
Additionally, Gerardin et al concluded that, in general, the results of
the MLD and FFMEA methods agreed well, but some events were
iden-tified by only one method and not the other In particular, the inductive
method of the FFMEA was determined to have provided more detail on
the systems or procedures used for detection, prevention, and mitiga-tion, while the MLD offers a more convenient graphical tool to present hazards and understand logical connections between different hazards (G`erardin et al., 2019) These conclusions support the idea that the combination of a deductive analysis (such as MLD) combined with an inductive analysis (such as an FFMEA or a HAZOP study) is an effective way to systematically and comprehensively identify PIEs for a design that does not benefit from extensive prior safety assessment information
or operating experience However, the search for MSFR PIEs only considered PIEs for normal operations As will be discussed in the following section (Sect 3), it is possible that for some LF-MSR designs, the composition and physical location of the major inventories of radioactive material will vary depending upon the POS Accordingly, the challenges to the barriers that are intended to prevent the release of radioactive material (and the safety functions protecting the barriers) may need to be evaluated separately for each inventory for each POS to ensure a comprehensive enumeration of PIEs in LF-MSR designs The analysis presented in the following sections evaluates how to incorporate the insights from the review of the above efforts into the systematic approach for identifying MSRE PIEs
3 Methodology
The approach to identify PIEs for the MSRE primarily draws from the LMP guidance on PRA development (Southern Company, 2019) and the non-LWR PRA Standard (ASME/ANS, 2013) The identification of PIEs discussed in this article is a portion of a larger project that had the objective of demonstrating how early stage reactor developers might exercise various aspects of the LMP’s TI-RIPB methodology (Nuclear Energy Institute, 2019) that has been endorsed by the US NRC in Draft Regulatory Guide DG-1353 (NRC, 2019); discussion of that project structure and presentation of other portions of the work are available in the references (EPRI, 2018; EPRI, 2019a)
The MSRE design was chosen to provide an illustrative demonstra-tion of the TI-RIPB methodology because it represents an early stage design with a unique set of detailed, publicly available information associated with LF-MSR design and operation Most notably, the original MSRE literature (Lindauer, 1967; Robertson, 1965; Moore, 1972; Guy-mon, 1973) has sufficiently detailed information to support the evalu-ation of hazards associated with “auxiliary” systems containing significant inventories of radioactive material, such as the OGS and fuel processing systems Although modern commercial LF-MSR design con-cepts may deviate substantially from the MSRE design in ways that impact the risk profile of the plant (e.g., inclusion of power cycle equipment), the amount and level of detail of the publicly available MSRE design information enabled a more in-depth application of the developed methodology compared to what would be possible using a less detailed design The MSRE PIEs identified by this work may be useful as a starting point for the identification of PIEs for other LF-MSR designs; however, the approach to PIE identification that is demon-strated is technology-inclusive such that it can be applied to any nuclear reactor design
Finally, because this study is the first comprehensive evaluation of PIEs for the MSRE, the present analysis focuses only on the identification
of internal events and does not enumerate PIEs related to external events (such as flooding or seismic events) This prioritization of the evaluation
of internal events in early safety analysis is consistent with international guidance (Wielenberg et al., 2017) and US nuclear industry standards (ASME/ANS, 2013) The identification and evaluation of external events would need to be covered for a full scope risk assessment of the MSRE design; however, this study prioritized the demonstration of a tool that could be used to analyze a reactor design at the conceptual or pre-liminary design stages
Trang 53.1 Overview of MSRE design and major inventories of radioactive
material
A high-level schematic of the major systems of the MSRE is shown in
Fig 1, and documentation of design details and operating experience are
available in the references (Beall et al., 1964; Lindauer, 1967;
Rob-ertson, 1965; Moore, 1972; Guymon, 1973) The approximately 8 MW
(thermal) test reactor was designed, constructed, and operated at Oak
Ridge National Laboratory (ORNL) in the 1960’s Between 1965 and
1969, the MSRE was critical for a total of 17,655 h (Guymon, 1973) The
reactor was fueled with UF4 dissolved in a carrier molten fluoride salt
Heat from fission was generated in the fuel salt as it passed through the
graphite channels of the reactor vessel, and then transferred in the heat
exchanger to the molten fluoride coolant salt Fission product gases were
removed continuously from the circulating fuel salt by spraying a
portion of the salt into the cover gas above the liquid in the fuel pump
tank From this space, the fission product gases were swept out by a low
flow purge of helium into the OGS The coolant salt was circulated
through a heat exchanger and radiator, where air was blown axially
across the tubes to remove the heat The air was then exhausted to the
atmosphere via a stack The MSRE was equipped with drain tanks for
storing the fuel and coolant salts when the reactor was not operating
The salts were drained by gravity and transferred back to the circulating
system by pressurizing the tanks with helium The MSRE also included a
simple processing facility for the offline treatment of fuel salt batches for
removal of oxide contamination and for recovering the uranium
Addi-tional major auxiliary systems included: (1) a helium cover-gas system
with treatment stations for oxygen and moisture removal; (2) two
closed-loop oil systems for lubricating the bearings of the fuel and
coolant pumps; (3) a closed loop component cooling system (CCS) for
cooling in-cell components using 95% N2 and less than 5% O2; (4)
several cooling water systems; (5) a ventilation system for
contamina-tion control; and (6) an instrument air system
The development of an exhaustive enumeration of reactor specific
PIEs begins with the identification and characterization of the different
inventories of hazardous material that are present in a system design
(Southern Company, 2019) The distribution and movement of
radioactive materials in the MSRE requires the consideration of mate-rials existing in different forms and different concentrations, which are contained by an array of different barriers to release Because these aspects (especially the barriers to release) can vary substantially for different POSs, a preliminary list of major MSRE POSs was developed using guidance from the ASME/ANS non-LWR PRA Standard (ASME/ANS, 2013) Table 1 provides an overview of important MSRE POSs For each POS, original MSRE design and operations reports (Beall
et al., 1964; Lindauer, 1967; Robertson, 1965; Moore, 1972; Guymon, 1973) were reviewed and used to define each unique inventory on the basis of fundamental criteria, such as chemical composition, physical properties, and barriers to release The following paragraphs identify and characterize some of the major inventories of radioactive material in the MSRE design for various POSs
The molten fluoride-based fuel salt had fission products and trans-uranics (including fissile material) dissolved within it During normal operations, the fuel salt was circulated around the fuel salt loop by the fuel salt pump; however, the approach to ensure subcriticality of the fuel and shut down the MSRE was to allow the fuel salt to drain via gravity from the fuel salt loop and into at least one of two fuel salt drain tanks The fuel salt was kept in the fuel salt loop by a frozen plug of salt in a freeze valve during normal operations, and this plug was thawed to enact a fuel salt drain Each drain tank had a dedicated freeze valve in which a plug of salt could be frozen to isolate the vessel from the fill/ drain line once the fuel salt had drained to the tank(s)
A fraction of the volatile fission products in the fuel salt was removed during operation to remove neutron poisons When salt was being circulated by the fuel salt pump, a portion of the fuel salt in the pump bowl was sprayed out of holes in a distributor ring, which allowed noble gas fission products (mostly xenon and krypton) to vent from the salt (Robertson, 1965) A helium sweep gas was introduced to the pump bowl to carry an estimated 10.36 TBq (280 Ci) each second out of the fuel salt loop and into the so-called “main” OGS The main OGS was designed to provide holdup time to allow for the decay of all radioactive isotopes to insignificant amounts – with the exception of 85Kr, 131mXe, and 133Xe Volume holdups were used to allow for the decay of short-lived radioisotopes, while water-cooled charcoal beds were
Fig 1 High-level schematic of major MSRE components (Guymon, 1973)
Trang 6designed to provide average residence times of 90 days for xenon and
7.5 days for krypton (Robertson, 1965) After being held up for this
decay, the effluent of the OGS was exhausted to the atmosphere after
passing through filters to retain solids and then being massively diluted
An “auxiliary” OGS was also provided to handle the intermittent,
relatively large flows of helium that were produced during salt transfer
operations These off-gas streams could contain significant amounts of
radioactive gases and particulates (Robertson, 1965) Unlike the main
OGS, the auxiliary OGS did not contain any volume holdups; however,
the auxiliary OGS did have a charcoal bed that was located in the same
water-filled cell as the main charcoal beds The effluent of the auxiliary
charcoal bed flowed into the same line as the effluent of the main
charcoal beds before passing through the stack filters, being diluted, and
eventually being exhausted via the stack Lines were provided to flow
the off-gas from the fuel salt drain tanks to either the main OGS or the
auxiliary OGS, with isolation valves in the lines that could be opened
and closed to direct the gas flow
Other significant inventories of radioactive material in the MSRE
design would have been present at times in the fuel processing and
handling equipment in the fuel processing cell and adjacent adsorber
cubicle It is important to note that because the MSRE did not perform
online fuel salt processing, fuel salt would not have been in the fuel salt
system and the fuel processing system at the same time This
consider-ation is very important for identifying POSs that condition the MSRE
PIEs Although the radionuclides entered the fuel processing cell in the
form of fuel salt, during fluorination (for recovery of U), many elements
were volatilized out of the fuel salt Thus, the salt remaining in the fuel
storage tank (FST) after uranium recovery, the off-gas from the
fluori-nation process (including the volatilized UF6), and the radionuclides
removed from this process stream by various components were all forms
of hazardous material that were not present anywhere else in the MSRE
system
The material described above represents a significant majority of the
total radioactivity that was in the MSRE plant; however, there were
several other smaller distinct inventories of radioactive material For
example, around 2 TBq (55 Ci) of tritium was produced in the MSRE per
day, mainly due to neutron interactions with lithium-6 in the fuel salt),
with about half of this tritium carried into the OGS by the off-gas of the fuel salt Some of the tritium was absorbed into the core graphite, and measurable amounts diffused to the cooling air across the radiator and to the reactor cell atmosphere (Briggs, 1971) Additionally, a heel of approximately 10% of the fuel salt volume was estimated to remain in the drain tanks after the fuel salt loop was filled (Bell, 1970), and fission, corrosion, or activation products could have plated out on or been absorbed into components with sustained fuel salt contact Similarly, OGS components could contain deposits due to condensation or the decay of volatile radionuclides into solid daughter isotopes At any given point, there also may have been some amount of radioactive material contained in the liquid waste system in the liquid waste storage tank filters or the associated piping and pumps
It is important to note that within the framework of the LMP meth-odology, the selection of LBEs includes the identification of AOOs, in addition to the less likely design basis and beyond design basis events (Nuclear Energy Institute, 2019) Thus, tracking smaller inventories of radioactive material could be important if there are high frequency AOOs that result in their release; hence, simply focusing on the largest inventories of radioactive material (as typically done in an LWR PRA) may not be sufficient for PRA of an advanced non-LWR
3.2 Conduct of Process Hazards Analysis studies of the MSRE
The starting point for developing a model to analyze risk in a reactor design, especially one at an early stage of design, can be the performance
of a qualitative PHA study using one of several PHA methods that are recommended by both the nuclear (ASME/ANS, 2013) and chemical process industries (CCPS, 2008) As part of a larger project led by the authors of this article (EPRI, 2019a), the HAZOP method was selected for use in order to gather qualitative insights about the MSRE design and
to support the development of more quantifiable models of risk (Chis-holm et al., 2019a, 2019b) In order to conduct a HAZOP study, it is necessary to divide the reactor design into analyzable sections or
“nodes.” Based on a review of MSRE design information, 21 relevant nodes were identified based on primary function and normal operating conditions (a complete list of the nodes is available in EPRI, 2019b) Due
Table 1
MSRE plant operating states (POSs)
Plant Operating State
(POS) Major Inventories of Radioactive Material Minor Inventories of Radioactive Material Status of Selected Barriers Notes
At Power (Normal
Operations)
• Fuel salt in fuel salt loop
• Volatile radionuclides in main OGS line
• Fuel salt heel in drain tank
• Liquid waste storage
• Tritium
• Fuel salt: FV-103 frozen, FV-
105 and 106 thawed
• OGS: main charcoal beds
• Safety system response triggers thawing of FV-103 (drain to drain tank via gravity)
Filling (fuel salt) • Fuel salt in Drain Tank, fill/drain
line, and fuel salt loop
• Volatile radionuclides in auxiliary OGS line
• Liquid waste storage
• Tritium
• Transfer FVs frozen, FV-103 thawed
• OGS: auxiliary charcoal bed
• He pressure used to fill system
• Coolant salt loop filled
Shutdown • Fuel salt in Drain Tank(s)
• Volatile radionuclides in auxiliary OGS line
• Heel/deposits in fuel salt loop
• Deposits in main OGS line/components
• Liquid waste storage
• Tritium
• Transfer FVs, FV-104 and FV-
105 frozen
• OGS: auxiliary charcoal bed
• Heat removal by Afterheat Removal System; fuel salt can be in 1 DT or 2
Fuel salt processing • Fuel in Fuel Storage Tank (FST)
• Volatile process flow in fuel processing line/components
• Heel/deposits in fuel salt loop
• Heel in fuel salt DT(s)
• Deposits in OGS lines/
components
• Liquid waste storage
• Tritium
• Processing FV frozen
• Volatile radionuclides:
processing charcoal trap
None
Maintenance • Fuel salt in Drain Tank(s)
• Volatile radionuclides in auxiliary OGS line
• Heel/deposits in fuel salt loop
• Deposits in main OGS line/components
• Liquid waste storage
• Tritium
• Similar to “Shutdown”
• Confinement barriers may change
• System may be opened
• Fuel salt loop likely cold
Trang 7to funding and time constraints, it was not possible to conduct a
com-plete HAZOP study on every individual node; accordingly, it was
necessary to select the nodes of the MSRE that were of highest priority to
be the subject of a HAZOP study
Some of the nodes identified in the MSRE do not differ substantially
from systems with significant industrial experience (e.g., the tower
cooling water system and the instrument air system) and others nodes
may not be common to modern commercial MSR design concepts (e.g.,
the sampler-enricher) Additionally, because PRA models are typically
developed for a specific combination of radioactive material inventory,
POS, and hazard group (ASME/ANS, 2013), an important step of system
characterization was to develop an understanding of which nodes would
contain (or interface with) the major inventories of radiological
mate-rials within the MSRE design Performing a PHA study on these nodes
will likely help identify PIEs of most interest to LF-MSR designers and
regulators, since the consequences of event sequences associated with
these nodes have the potential to be more severe than those associated
with other nodes Thus, the first MSRE nodes selected to be analyzed
using the HAZOP method were the main MSRE OGS, the component
cooling system (CCS), the fuel salt processing equipment, and the fuel
salt loop
Although the MSRE CCS did not contain a significant radioactive
material inventory during normal operations, the system: performed
functions that will likely need to be addressed in most or all MSR
de-signs, was integral to safe operation of the MSRE, and had not been the
subject of detailed prior hazard evaluations or risk assessments In the
MSRE design, the CCS interfaced with the reactor cell atmosphere,
which could become contaminated if radionuclides from the fuel salt
loop or main OGS were transported past the first barrier to their release
The MSRE CCS also had a direct interface with the MSRE stack and the
environment
Many of the MSRE HAZOP study results (discussed in detail in
Sec-tion 4.1) identified causes that could result in the failure of a barrier (or
multiple barriers) intended to prevent the release of radioactive
mate-rial Regarding the interface between the HAZOP study and the
devel-opment of the MSRE MLD, such causes documented in the HAZOP study
results were used to inform the decomposition of the lower levels of the
MLD, including: challenges leading to barrier failure, functional failures
producing the challenge, and system or component failures resulting in
the failure of the function protecting the barrier
3.3 Development of MSRE Master Logic Diagram
In addition to the PHA studies of the MSRE design, the MLD approach
was used to systematically identify any PIEs that may have been
over-looked by the inductive HAZOP method An MLD additionally provides a
visual tool to organize PIEs that are identified The “top event” of the
MSRE MLD is the release of radioactive material This undesired event is
then logically decomposed down into simpler contributing events that
could lead to the top event (Papazoglou and Aneziris, 2002) The
decomposition continues until a sufficient level of detail is reached and
all physically possible phenomena have been considered The basic
events that cannot be further divided into sub-events represent PIEs for
the MSRE design
The MLD for the MSRE PIEs was developed according to the
following levels:
•Level 1: Release of radioactive material (overall event of interest)
•Level 2: POS during which the release occurs
•Level 3: Inventory of radioactive material with potential for release
•Level 4: Level of barrier between inventories and the public/
environment
•Level 5: Interface where barrier fails
•Level 6: Acute vs latent failures of barrier
•Level 7: Challenge leading to failure of barrier
•Level 8: Functional failure leading to barrier challenge
• Level 9: Occurrence contributing to functional failure
• Levels 10+: Specific subsystem/component failures with similar system consequences
The LMP guidance on PRA development provides some suggestions for considerations that were used to organize the logical decomposition
in the MLD (Southern Company, 2019) For example, as mentioned in Sect 3.1, reactor-specific PIEs can be grouped based on which inventory
of radioactive material they could cause to be released However, the discussion in Sect 3.1 also demonstrated that the barriers in the MSRE that are intended to prevent the release of a single inventory of material can vary for different POSs, including those listed in Table 1 In the MSRE MLD, Level 2 corresponds to the POSs and Level 3 is the major inventories of radioactive material that could be released during each POS The safety approach taken by the MSRE designers was to ensure that each inventory had at least two levels of independent barriers be-tween the material and the environment (Beall et al., 1964); Level 4 continues the decomposition by the level of the barrier that fails to contain radionuclides As discussed further in Sect 4, the barriers that are intended to contain radionuclides in LF-MSRs are not always struc-tural barriers that prevent the transport of all materials For example, the MSRE processing system consisted of a variety of functional barriers (including NaF traps, a caustic scrubber, and activated charcoal traps) that were intended to contain certain radionuclides but allow helium cover gas to flow through the system and be exhausted to the atmosphere
PIEs with similar consequences that require similar responses by plant systems are often grouped together in PRA models (ASME/ANS, 2013) In the MSRE, the plant responses that are important to mitigate the consequences of a barrier failure are dependent upon where the radioactive material is transported following the failure For example, different plant responses would be required if the main charcoal beds failed in such a way that radioactive material was released to the Charcoal Bed Cell or if Volume Holdup 1 in the main OGS failed in such a way that radioactive material was released to the reactor cell, even though both the main charcoal beds and Volume Holdup 1 constitute part of the first barrier to release of radioactive material in the OGS Thus, Level 5 of the MSRE MLD decomposes the PIEs based upon the interface through which a specific barrier failure allows the radioactive material to be transported The interfaces and barriers for the radioac-tive material inventories in the MSRE fuel salt and off-gas during normal operations are displayed in Tables 2 and 3, respectively
Level 6 of the MLD separates the challenges to individual barriers based on whether they would lead to a rapid failure of a barrier (i.e.,
“acute”) or contribute over time to the failure of a barrier (i.e., “latent”), and Level 7 is the specific challenge that leads to the failure of the barrier In general, a structural failure of a barrier can be due to (1) overpressure, (2) underpressure, (3) corrosion, (4) erosion, (5) external loading, (6) high temperature, or (7) vibration (Papazoglou and Ane-ziris, 2002) Because some of the barriers in the MSRE are functional, some causes leading to underperformance of the containment function are also included in the MLD Level 8 of the MLD distinguishes the functional failure that presents the challenge to the barrier, and Level 9 contains the occurrence that represents the functional failure Any decomposition past Level 9 in the MSRE MLD displays specific subsys-tem or component failures that would have similar consequences that contribute to the occurrence shown in Level 9 Within the context of the LMP framework, the functions presented in Level 8 of the MSRE MLD represent safety functions that are responsible for the prevention and/or mitigation of an unplanned radiological release from any source within the plant, and the systems and components performing these functions are decomposed in Level 9 and beyond These functions, systems, and components can be used in a TI-RIPB manner for safety classification of equipment and to evaluate defense-in-depth (Nuclear Energy Institute, 2019)
For the first level of barriers, the occurrences in Level 9 can be
Trang 8considered PIEs for the MSRE; however, some of these occurrences in
Level 9 for barriers in the second level or beyond (such as the barriers in
the CCS) represent pivotal events that occur after a PIE in an MSRE event
sequence The unique combination of successes and/or failures of these
mitigating systems determine the end state of the plant at the conclusion
of event sequences
4 Results
4.1 MSRE HAZOP study results
An excerpt depicting 2 deviations from the HAZOP study of the
MSRE main OGS during normal operations is shown in Table 4
4.1.1 Fuel salt loop
During the HAZOP study of the MSRE fuel salt loop, a total of 66
deviations were evaluated and documented One unique aspect
regarding the fuel salt loop is that all of the transients and accidents
evaluated by the MSRE team in the Preliminary Hazards Report (Beall,
1961) and the SAR (Beall et al., 1964) related to the inventory of
radioactive material in the fuel salt loop Consequently, the HAZOP
study results for the fuel salt loop identified more deviations that had
been considered by the MSRE team in the original ORNL documentation,
compared to the results of the studies on the other nodes However,
deviations from normal operations in the fuel salt loop that had not been
covered in the MSRE documentation were able to be identified For
example, an interface between the fuel salt loop and the CCS node was
identified to be capable of propagating effects from a deviation in the CCS node to the fuel salt loop A loss of component cooling gas flow could compromise the ability to maintain a frozen plug of salt in the main freeze valve below the reactor vessel The heat conducted into the valve body from the pipeline heaters and the circulating fuel salt could melt the plug, which could result in an unscheduled drain of the fuel salt loop Although the drain tanks were designed to have geometry such that the concern of criticality in the drain tank would be limited, the fuel salt would be at its highest temperature and the decay heat would be at a maximum if the reactor was drained from full power (Beall et al., 1964) Conversely, any cause of increased heat removal by the CCS could crease the size of the frozen salt plug in the freeze valve, and could in-crease the amount of time needed to thaw the freeze valve in the case that a fuel salt drain was initiated
The HAZOP results also highlighted the significant role that fuel salt chemistry can play in LF-MSR fuel salt performance, and deviations in chemistry can be the cause of potential system deviations or upsets For example, deposition of materials from the fuel salt onto surfaces in the system could: affect the ability to transfer heat from one node to another; change the redox conditions of the salt and increase corrosion rates; foul sensors and prevent an accurate indication of process conditions; or plug small lines One chemistry-related issue that was experienced during MSRE operations was the leakage of lubricating oil from the fuel salt pump into the fuel salt in the pump bowl This lubricating oil broke down in the pump bowl and was suspected to cause plugging of the off- gas line from the pump bowl (Guymon, 1973) Another more serious chemistry related deviation that was postulated (but not observed
Table 2
Interfaces and barriers for radioactive material in the MSRE fuel salt during normal operations
Interface (Second
Barrier to RN
Release)
Reactor Cell and CCS Fuel salt piping, reactor vessel, fuel salt
pump bowl, heat exchanger shell, freeze flanges
MSRE Building and Ventilation System
Coolant Salt System Heat exchanger tubes Coolant Cell/MSRE Building and Ventilation System (Coolant
Cell not maintained at negative differential pressure like Reactor Cell and Drain Tank Cell)
Transfer of material could be from Coolant Salt into Fuel Salt or from Fuel Salt out to Coolant Salt
Off-Gas System Gas/liquid interface in fuel salt pump
bowl Reactor Cell and CCS/MSRE Building and Ventilation System Transfer of only volatile radionuclides from fuel salt pump bowl to OGS during normal
operations Cover Gas System Fuel salt pump bowl Reactor Cell/Special Equipment Room/MSRE Building and
Ventilation System Transfer of material from cover gas to fuel salt pump bowl only during normal
operations Fuel Salt Drain/Fill
Table 3
Interfaces and barriers for radioactive material in the MSRE off-gas during normal operations
Interface (Second Barrier to
RN Release) RN Inventory Boundary (First Barrier) Third Barrier to RN Release Notes
Reactor Cell and Component
Cooling System (CCS) Fuel salt pump bowl, OGS piping and connections, Volume Holdup 1 MSRE Building and Ventilation System Off-gas could potentially flow from fuel salt pump bowl into cover gas system piping Concentric OGS Pipe OGS piping and connections in Coolant Drain
Cell Coolant Drain Cell/MSRE Building and Ventilation System Coolant Drain Cell is not kept at a negative differential pressure like Reactor Cell Instrument Box OGS piping and connections in Instrument Box Vent House
Charcoal Bed Cell (water-
filled) Volume Holdup 2, Main Charcoal Beds, Auxiliary Charcoal Beds (structural integrity) N/A Charcoal Bed Cell is located underground next to MSRE building Auxiliary Charcoal Bed
(functional) HCV-533 (closed) N/A - See Note During normal operations, flow is isolated from Auxiliary Charcoal Bed by closing of HCV-533 MSRE Stack (atmosphere) Main Charcoal Beds (functional) N/A HCV-557C is designed to automatically isolate flow to
MSRE stack upon high levels of radiation
Vent House OGS piping and connections in Vent House N/A - See Note If Main Charcoal Beds function as intended, gas stream
should have low concentration of radioactive material
Trang 9during operation) was oxygen contamination of fuel salt that was
sig-nificant enough to alter redox conditions such that uranium
precipita-tion would be possible
4.1.2 Off-gas system and component cooling system
During the HAZOP studies, 35 potential deviations were identified
and evaluated for the MSRE OGS, and 40 deviations were identified and
evaluated for the CCS Unlike the MSRE fuel salt loop, a portion of the
boundary of the OGS during normal operations was formed by a
func-tional barrier Rather than providing a structural barrier to prevent
transport of any material through the charcoal beds, the activated
car-bon retained certain elements (such as Kr and Xe) for an extended period
of time via adsorption, and this residence time allowed for the decay of
radionuclides The results of the HAZOP study identified many
de-viations from normal operating conditions that would decrease the
effectiveness of this functional barrier For example, ignition of the
activated carbon in the charcoal beds due to volatile organic materials in
the off-gas stream or a rapid expansion of water vapor due to an
inleakage of cooling water could lead to a reduction in the adsorption
effectiveness and lead to an increased rate of radioactive material
transport past the normal main OGS boundary (Zerbonia et al., 2001) In
addition, any cooling water that leaked into the bed would have the
potential to react with any remaining fluorine in the off-gas and produce
HF, which is toxic and corrosive The scenario of water intrusion into the
charcoal beds poses a possible occupational hazard as well as a method
to damage components important to the control of radioactive material
During the MSRE HAZOP studies, many deviations were identified
that suggested that interfaces between gas and salt pose potentially
hazardous conditions in an LF-MSR design MSRE operational
experi-ence suggested that the corrosion rate at these surfaces could be
significantly higher than corrosion rates encountered elsewhere in the
system (Guymon, 1973), and it is also possible that the deposition rate of
impurities from the salt on structural materials could be higher at these
locations The MSRE team also experience a significant number of
complications related to fuel salt “aerosol” or “mist,” which was caused
by bubbling and splashing around the interface between the fuel salt and
the cover gas in the fuel salt pump bowl This mist could be responsible
for material transport from a fuel salt system to an OGS, which could
result in plugging of small-diameter off-gas lines Another scenario that
was experienced during MSRE operation was thermal expansion of the
fuel salt that was significant enough to allow fuel salt to overflow into
the OGS from the fuel salt pump bowl (Guymon, 1973) Because the
coefficient of thermal expansion for the salts considered for use in
LF-MSRs is so high, increases in level due to thermal expansion represent
another potential cause of plugged lines (especially small diameter
off-gas lines) If a thermal expansion transient is significant enough, it is
possible that any seals above the salt/gas interface (e.g., the fuel salt
pump shaft seal) could be at risk of being compromised by the hot,
radioactive salt
Additionally, the HAZOP studies identified many deviations that could affect void fraction and thus have effects on the reactivity of the MSRE core This interaction places a higher significance on the interface between the OGS node and the fuel salt system Any scenario that can increase or decrease the amount of volatile fission gases removed from the fuel salt (including plugging in the off-gas line, plugging of the stripping spray rings in the pump bowl, or high cover gas supply pres-sure) could also affect parameters such as power level, pressure, and temperatures in the fuel salt loop
4.1.3 Fuel processing system
A total of 88 potential deviations were identified and evaluated for the components involved in the fluorination of MSRE fuel salt One major issue experienced during the operation of the fluorinating equipment in the MSRE was corrosion (Lindauer, 1969) The high con-centration of fluorine in the gas stream attacked the Hastelloy-N struc-tural material and increased the amount of impurities (such as NiF2, FeF2, and CrF2) in the fuel salt Additionally, fluorination in the FST allowed for the formation of MoF6, which is volatile and therefore was carried out of the FST along with the other volatile species (such as UF6) Two deviations identified during the HAZOP study of this node per-tained to corrosion concerns First, increased fluorine concentration in the FST could be caused by a failure of the fluorine control valve If no corrective actions were taken, this increase in fluorine concentration would likely increase the corrosion rate in the FST, which would in-crease the production rate of MoF6 This MoF6 in the process gas stream could compete with UF6 for absorption in the uranium absorbers or produce hydrated oxides of Mo that could cause an obstruction in lines downstream of the caustic scrubber Additionally, because Mo has a similar heat capacity to U, the accuracy of the Hastings mass-flowmeters used to monitor the uranium content of the gas stream entering and exiting the absorbers could be negatively impacted (Lindauer, 1969) The second deviation related to increased corrosion rates could be caused by a loss of helium flow in the gas flow upstream of the caustic scrubber This loss of helium flow could increase the rate of corrosion in the dip tubes of the caustic scrubber Although a microphone to monitor plugging was provided, as well as a spare (redundant) dip tube in the scrubber that could be used in case the primary dip tube plugged, it is possible that increased corrosion rates in the dip tubes could result in plugging significant enough to produce reverse flow through the ura-nium absorbers This reverse flow was identified during the HAZOP study to be a possible cause of disrupted process flow and the possible desorption of UF6 or other radionuclides that had been previously deposited in the absorbers
As mentioned above, the role of fuel salt chemistry in the safe and reliable performance of an LF-MSR system emphasizes the importance of having the ability to accurately monitor conditions of the salt The MSRE did not have the capability to analyze salt conditions during processing and relied on batch samples taken from the system and analyzed in
Table 4
Example of deviations captured in HAZOP study of MSRE main OGS during normal operations
Temperature
Increase Decreased heat removal by charcoal bed cell cooling water system (Volume Holdup 2 [VH-2] and main
charcoal beds)
• Possible damage to beds from overheating
• Reduction in adsorber effectiveness, increased radioactivity of effluent
• Cooling tower water flow rate (FI–851C) and temperature indications (TI-858)
• Radiation monitors downstream of charcoal beds to observe changes in radioactivity (RE- 557-A/B)
Pressure
Increase High fuel salt pump bowl cover gas pressure (e.g., regulator failure)
• Increased off-gas flow through entire system (VH-
1, particle trap, VH-2, charcoal bed)
• Increased particulate carryover from fuel salt pump bowl
• Decreased residence time in VH-1, VH-2, and charcoal beds Increased pressure downstream of pump bowl
• Pressure indications in fuel salt pump bowl (PT- 522/592)
• RM-557A radiation monitors downstream of charcoal beds with automatic safety action (RM- 557-A/B)
• Temperature indications throughout system (TE-522-1, TE-524-1, TE-556-1A)
Trang 10another facility, separate from the MSRE facility As an alternative to
online salt chemistry measurements, the MSRE team used surrogate
measurements, and the HAZOP study identified deviations that could
affect the efficacy of these surrogates to adequately indicate system
conditions For example, incorrect calibration of the mass-flowmeters
used during fluorination could lead to material accountability errors
when calculating how much uranium has been removed from the fuel
salt and the component in which it was deposited
One component containing an inventory of particularly hazardous
material that was identified during the HAZOP study was the caustic
solution in the scrubber Due to the changes made to the system before
operation, the scrubber became the main component responsible for the
capture of iodine and fluorine (Lindauer, 1969) Because these changes
were made after the initial system design, there is limited information
available regarding analysis of the contents of this component Multiple
deviations that could result in a release of the material from the scrubber
to the fuel processing cell were identified during the HAZOP study,
including violent reactions in the scrubber or decreased heat removal
from the scrubber It is possible that the release of this material to the
fuel processing cell could also volatilize iodine
4.2 Development of MSRE MLD
The MLD approach was also used to analyze the same inventories of
radioactive material that were studied using the HAZOP method (i.e.,
the fuel salt during normal operations, the off-gas during normal
oper-ations, the process flow during fluorination, and the fuel salt during
fluorination); EPRI’s CAFTA software (EPRI, 2014) was used to create
the MLD The highest levels of the MSRE MLD can be seen in Fig 2, and
an example of the breakdown to Level 9 for the radioactive material in
the fuel salt off-gas during normal operations is shown in Fig 3
The MSRE MLD highlights the idea that many phenomena in an LF-
MSR are very closely coupled For instance, in the fuel salt loop, the
magnitude of the reactivity effects due to a change in fuel salt loop
operating pressure is affected by the temperature of the fuel salt (Beall
et al., 1964) Additionally, pressure transients in the fuel salt loop have
multiple (sometimes competing) reactivity effects, including changes in
void fraction and poison concentration (Beall et al., 1964) The
complicated nature of these relationships can make it somewhat difficult
to determine the “basic event” or failed safety function that ultimately
would be responsible for a potential barrier failure For example,
plugging in the main OGS piping near the outlet of the fuel salt pump bowl represents a failure to control the pressure of the main OGS and a failure to control the pressure of the fuel salt loop, since the off-gas would not be able to be swept out of the fuel salt pump bowl
Howev-er, the plugging could be caused (or exacerbated) by a failure to control the fuel salt chemistry (e.g., ingress of contaminants leading to increased deposits in the off-gas line) or a failure to control heat removal from the off-gas flow (e.g., overcooling of the OGS piping by the CCS resulting in condensation) Additionally, because the volatile fission product poisons cannot be swept into the OGS from the fuel salt pump bowl, this PIE also represents a failure to control nuclear heat generation in the fuel salt loop Therefore, for the radioactive material in the fuel salt during normal operations, the “basic event” of a plug in the off-gas outlet from the fuel salt bowl can be identified as a possible contributor to the structural failure of a barrier due to overpressure, as well as a possible contributor to the structural failure of a barrier due to high temperature
In comparison to the HAZOP method, the MLD approach was better suited to identify specific latent phenomena contributing to barrier failure Examples of such phenomena include excessive radiation dam-age, excessive thermal fatigue, and excessive erosion rates The MLD approach also identified pre-existing deficiencies that could contribute
to barrier failures such as an insufficient seal in a freeze flange (leading
to leakage or rupture of the flange) or an insufficient frozen plug of salt
in a freeze valve (leading to leakage or spurious thawing of a freeze valve) Another advantage of the MLD method over the HAZOP approach is that the visual representation of the MLD is easier to un-derstand quickly than are the tabular results of the HAZOP study Although the MLD approach was able to identify some failures and phenomena that were not identified during the HAZOP study, the HAZOP results identified a higher number of PIEs that were not readily identified by the development of the MLD alone The HAZOP approach was more useful to examine the MSRE due to the room for creativity and flexibility during the brainstorming of deviation causes In contrast to the rigid structure of the MLD, the use of parameter/guideword com-binations such as “high temperature” and “high pressure” were partic-ularly useful to identify subsystem and component failures that could potentially lead to the failure of a barrier intended to prevent the release
of radionuclides
Finally, perhaps the most significant difference between the appli-cation of the MLD and HAZOP approaches was the amount of informa-tion documented during the analysis of PIEs While the results of the
Fig 2 Levels 1–4 of the MSRE MLD