**3.4 Inherent safety**

April 3rd 1986 is a date that is unknown to the general public and to large portions of the nuclear industry. The reason was that nothing newsworthy happened that day. The EBR-II functioned as designed without any damage, everyone working in the facility went home that day, and in general it was like any other day in southeast Idaho. Despite nothing being widely reported that day, one of the most significant achievements in nuclear reactor technology was demonstrated. The EBR-II was intentionally placed into an accident scenario that would have melted down any light water reactor. The accident scenario far exceeded that of Three Mile Island. The scenario was to operate the EBR-II at 100% power, disable the primary coolant pumps (for the first experiment) and the secondary cooling pumps (for the second experiment). Both experiments were conducted without SCRAM the reactor. To achieve the plant conditions listed above, EBR-II was modified to create the conditions but still remain in control in case unpredictable behavior occurred. An example of a modification was the cooling pumps. They were not directly disabled; the pump controllers were modified to simulate coast down function shapes, one of which simulated station blackout. Nominally the presented scenario would be a guaranteed melt-down for the typical US nuclear power plant. The EBR-II design, however, managed to achieve a temperature profile shown in **Figure 7**.

**Figure 7** demonstrates that given a catastrophic failure of major safety mechanisms, including failure to SCRAM following the loss of primary reactor coolant pumps or secondary coolant pumps, the peak temperature remained well below the sodium coolant boiling temperature of 870 C. Additionally, the peak temperature only lasted tens of seconds before reducing to a temperature less than that of 100% power. The inherent properties of the reactor design drove the reactor response rather than any engineered active systems. In short, the large thermal mass of the primary coolant pool, the thermal expansion of the core upon heating and the properties of the metal fuel all worked together to cause the reactor to become subcritical before fuel damage occurred following termination of coolant pump operation even without reactor SCRAM. The current fleet of light water reactors subjected

**Figure 7.** *EBR-II driver temperature predicted and measured [14].*

to a similar experiment would melt down without active cooling because the water coolant would eventually boil and the heat removal would be insufficient to prevent fuel melting.

Removal of the heat from the fuel elements and transporting that heat to the outside required several design layers. The first layer starts with the fuel elements, the metallic uranium, sodium bond, and stainless steel 316 cladding which provides an uninterrupted metallic conduction path from the uranium slugs to the sodium coolant. Sodium has one thousand times the heat conduction of water and in EBR-II's design, allowed for the decay heat to be transported rapidly to the sodium pool. **Figure 8** shows the uninterrupted metallic conduction path, the sodium is the green color.

The second layer was the large sodium pool that could absorb a significant amount of heat without changing temperature. Even without active cooling, the natural convection of the sodium over the fuel elements was enough to circulate cool sodium in from the pool and inject hot sodium back in the pool. Given the 337,000 liters of sodium in the pool, it would take many weeks for the pool to reach a temperature where the sodium would begin to boil.

The last layer was the natural convection heat exchanger that led pool sodium to a chimney that naturally exhausted to the outside. The heat exchanger functioned solely on the temperature differential of the pool to the outside and required no external power. The natural convection heat exchanged moderated the temperature in the pool to keep the sodium from boiling away.

In summary, the solution to a run-away heating event was to increase the thermal conduction from the fuel slugs to the outside to the point where the heat generated could not exceed the bandwidth of the heat removed to the outside.

The previous sections describe how EBR-II removed the decay heat from the fuel elements, mitigating a meltdown event. This mitigation only covered long term

**Figure 8.** *Thermal conduction path [15].*

inherent safety, not short term. Short term transients also require mitigation due to their rapid onset. Large reactivity insertions can cause localized heating that cannot be conducted away fast enough leading to fuel melting. An example is, during fuel shuffle operations, an assembly falls into the pool. Mitigation of these events (aside from not causing them in the first place) requires a negative feedback mechanism to compensate for the reactivity change. In reactors, these are called negative reactivity coefficients. They are a result of the inherent physics of a reactor's design and are nominally passive. For example, as a legal requirement in the US, light water reactors have a negative temperature coefficient. Meaning, the hotter the fuel, the less fission occurs, thus preventing a cascade event where heating creates more fission which creates more heating. For EBR-II several of these coefficients kept the reactor in a 100% negative feedback regime.

The first of these and most effective was the expansion of the sodium inside of the core region. The liquid sodium density reduced due to thermal expansion. Given that sodium has a moderating effect on fast neutrons, the decrease in moderation led to an overall negative reactivity feedback due to sodium temperature increases. This proved invaluable in the safety heat removal tests because as the temperature increased, there was a greater the reduction in fissions.

Second, EBR-II's core construction allowed for thermal expansion in the core. As temperature increased the fuel assemblies were pushed away from each other. The core grid plate that locked the bottom of the assemblies would expand due to temperate having the effect of increasing the pitch. Fast reactors in general are very sensitive to geometry changes due to their high-power densities. Any expansion increases the leakage of neutrons due to the increase in effective surface area with the same neutron population.

These two negative reactivities constitute 99% of the reactivity coefficients. They kept the reactor from running away in a thermal transient allowing for thermal conduction to occur. The long-term conductive mechanisms of EBR-II then kept the reactor from melting down. With these passive mechanisms in place, the severe accident scenario described in the previous section could happen without any real consequences. It was due to the inherent safety mechanisms of EBR-II that made April 3rd 1986 just another day in southeast Idaho.
