PBMR advocates are so confident in the safety of the reactor (some even call it “meltdown-proof”) that they have proposed a drastic weakening of a number of safety requirements that apply to the current generation of U.S. nuclear plants. These proposals include (1) use of a filtered, vented confinement building instead of a robust containment capable of preventing a large release of radioactive materials in the event of severe core damage; (2) a reduction of the size of the emergency planning zone (EPZ) from 16 kilometers to 400 meters; (3) a reduction in the number of staff, including operators and security personnel; and (4) a reduction in the number of systems whose components must meet the most stringent quality assurance standards.
However, there is insufficient technical justification for these measures. The presence of a pressure-resistant, leak-tight containment and the maintenance of comprehensive emergency planning are both prudent “defense-in-depth” measures that could mitigate the impact of a severe accident with core damage. Defense-in-depth is the requirement that nuclear reactors should have multiple, independent barriers in place to prevent injuries to the public and damage to the environment. The presence of multiple barriers is a hedge against uncertainty and an acknowledgement that the understanding of the performance of any one barrier is incomplete.
PBMR promoters claim that a robust containment is unnecessary because the design-basis depressurization accident cannot cause damage to the PBMR fuel severe enough to result in a large radiological release. They argue further that such a containment would actually be detrimental to safety because it would inhibit heat transfer and interfere with the passive mechanism needed to cool the core in the event of a loss-of-coolant accident. However, a containment is needed not only to inhibit the relatively minor releases that would occur during the design-basis accident, but also to mitigate the consequences of a more severe accident. Containments can also help to protect the reactor core from a sabotage attack utilizing truck bombs or hand-held rocket launchers — an ominous possibility that should not be discounted.
If one could predict with confidence that severe accidents or sabotage attacks were so unlikely as to be incredible, then protection against them might not be justified. However, in the case of the PBMR, significant uncertainties remain, both in the likelihoods of potential severe accidents and in the identification of every potential accident sequence. The PBMR designers have not yet carried out a probabilistic risk assessment (PRA) and do not even have estimates of the risks of more severe accidents.
Among the largest sources of uncertainty for the PBMR are the potential for and consequences of a graphite fire. The large mass of graphite in the PBMR core must be kept isolated from ingress of air or water. Graphite can oxidize at temperatures above 400 C, and the reaction becomes self-sustaining at 550 C (the maximum operating temperature of the fuel pebbles is 1250 C)[1]. Graphite also reacts when exposed to water vapor. These reactions could lead to generation of carbon monoxide and hydrogen, both highly combustible gases.
If a pipe break were to occur, leading to a depressurization of the primary system, it has been shown that flow stratification through the break can cause air inflow and the potential for graphite ignition[2]. While the PBMR designers claim that the geometry of the primary circuit will inhibit air inflow and hence limit oxidation, this has not yet been conclusively shown.
The consequences of an extensive graphite fire could be severe, undermining the argument that a conventional containment is not needed. Radiological releases from the Chernobyl accident were prolonged as a result of the burning of graphite, which continued long after other fires were extinguished[3]. Even though the temperature of a graphite fire might not be high enough to severely damage the fuel microspheres, the burning graphite itself would be radioactive as a result of neutron activation of impurities and contamination with “tramp” uranium released from defective microspheres. An even worse consequence would be combustion of carbon monoxide, which could damage and disperse the core while at the same time destroying the reactor building, which is not being designed to withstand high pressure. In contrast, the large-volume concrete containments utilized at most pressurized-water reactors can withstand explosive pressures of about 9 atmospheres.
Another important source of uncertainty comes from the complexity of the PBMR core, which is constantly in motion. A PBMR operator must be able to accurately compute the pebble flow, neutron flux and core temperature distributions without the benefit of in-core instrumentation (since there are no structures to support such instrumentation). Previous experience with the AVR test reactor in Germany, a precursor to the PBMR, indicates cause for concern. Experiments measuring the He coolant temperature in the AVR found numerous “hot spots” in the coolant that exceeded 1280 C, whereas the maximum predicted temperature was only 1150 C[4]. After NRC staff highlighted these findings, Exelon raised the design maximum fuel temperature limit during PBMR normal operation from 1060 C to 1250 C. This is of concern because above 1250 C the SiC layer of the TRISO fuel coating will degrade as a result of attack by palladium isotopes produced during fission[5]. It also calls into question the accuracy of the current generation of computer codes for PBMR core analysis.