F O R U M O N P H Y S I C S & S O C I E T Y
of The American Physical Society
October 2001

Edwin S. Lyman

Introduction

The Bush Administration has made the expansion of nuclear power generation a centerpiece of its domestic energy policy. However, the White House has not addressed the practical issue of how to overcome the nearly three-decade-long aversion among U.S. electric utilities to investing in new nuclear plants. In today's deregulating market, utilities will not build new nuclear power plants unless they are clearly competitive with fossil fuel plants (or receive substantial government subsidies). Compounding the difficulty are the nagging questions that continue to inhibit public acceptance of nuclear power: severe accident risk, non-proliferation, vulnerability to sabotage and nuclear waste disposal. To solve all these problems simultaneously will be a considerable challenge --- one unlikely to be met by the current generation of light-water reactors (LWRs), the only reactor type now used for power generation in the U.S.

Given this context, it should come as no surprise that the U.S. nuclear industry is hanging its hopes on a radically different type of plant known as the pebble-bed modular reactor (PBMR). The mega-utility Exelon has invested in a project of the South African state utility Eskom to develop and commercialize the PBMR, and is now engaged in detailed discussions with the U.S. Nuclear Regulatory Commission (NRC), in anticipation of submitting a license application for construction of ten 110 MWe PBMR modules in December 2002. Once construction approval is granted, Exelon hopes to build the first module in only 20 months.

Advocates of the helium-cooled, graphite-moderated PBMR argue that it is significantly safer than LWRs and should be exempted from a number of regulatory requirements that apply to the current generation of nuclear plants. If the NRC were to waive these regulations, these advocates claim that a PBMR could be developed with many of the characteristics that make gas turbines economically attractive: low capital cost, short construction time, high conversion efficiency and feasibility of modular production and distribution. Without these exemptions, however, the prospect of a commercially viable PBMR would become much less certain.

The nuclear industry has a long history of proposing new nuclear plant designs that sound great in theory but disappoint in practice, and the PBMR may be no exception. Some technical features of the PBMR are clearly improvements over LWRs, but others raise new safety concerns. Unlike LWRs, the PBMR does not have the benefit of thousands of reactor-years' worth of operating experience. Only a handful of high-temperature gas-cooled reactors (HTGRs) have operated in the past, and the results have been decidedly mixed. Moreover, none of these reactors had employed the unique power conversion system proposed for the PBMR, in which the reactor coolant is used as the working fluid of a gas turbine to directly generate electricity.

Definitive resolution of the numerous open technical issues is likely to take quite some time. This is time that Exelon --- which hopes to obtain a license from NRC in only two-and-a-half years --- is not inclined to expend. The increased flexibility that utilities need to compete in a deregulated market limits their timelines for decision-making, and may well be incompatible with the caution and rigor that advanced nuclear reactor development requires.

PBMR Design and Safety Features

Although the general outlines of the PBMR are known, the design that Exelon plans to submit to the NRC has not been finalized, so the following description is subject to change. The reactor consists of an annular core surrounded by graphite blocks. The core consists of 330,000 "pebbles": softball-sized graphite spheres, each containing 15,000 fuel microspheres, and 110,000 graphite spheres containing no fuel. Each fuel microsphere is composed of a uranium dioxide pellet (enriched to 8% U-235), enclosed in a three-layer coating consisting of a layer of silicon carbide sandwiched by two layers of pyrolytic carbon. This so-called TRISO fuel has exhibited good fission product retention in German tests up to temperatures of about 1600 C. Fuel pebbles are continuously loaded at the top of the core, flow downward, and are discharged at the bottom. Because the PBMR is fueled while operating, shutdowns would be required only for maintenance purposes and would take place every six years. (In contrast, LWRs must be shut down for fuel reloading; currently this is done about every eighteen months.) Fuel burnups are intended to go as high as 80,000 MWD/MT, whereas NRC limits the maximum burnup of LWR fuel pins to 62,000 MWD/MT. (MWD/MT= megawatt-days per metric ton, a measure of the total amount of heat extracted from a fuel element.)

The temperature resistance of the fuel and the use of a single-phase, gaseous coolant enables the reactor to operate at a coolant temperature of about 900 C, considerably higher than the operating temperature of LWRs. The higher temperature alone allows the reactor to achieve a conversion efficiency of 39%. Use of the coolant in a direct gas turbine cycle (known as the Brayton cycle) further increases the efficiency to about 43%.

Because the PBMR is continuously refueled, the excess reactivity can be kept low. Also, the design has a more negative fuel temperature coefficient than LWRs, as the Doppler feedback is greater for the less-thermal neutron spectrum associated with a graphite moderator.* These features reduce the risk of reactivity accidents for most scenarios (but increases the risk for accidents involving core overcooling).

A major component of the PBMR safety basis is a low power density (an order of magnitude below that of an LWR) and large thermal capacity (as a result of the large mass of graphite in the core), together with the high-temperature resistance of the fuel. The maximum power rating of each module (265 MWth) and the high surface-to-volume ratio of the core were chosen so that in the event of a loss of coolant from the primary system, adequate cooling would be provided without the need for forced convection. PBMR designers claim that in the event of a total loss of primary coolant and no operator intervention, the core heatup rate would be slow and the maximum fuel temperature would not exceed 1600 C. Thus the design does not include conventional emergency core cooling systems, which are required for LWRs to provide emergency water sources in the event of a loss-of-coolant accident.

PBMR advocates are so confident in the safety of the reactor (some even call it "meltdown-proof") that they have proposed a drastic weakening of a number of safety requirements that apply to the current generation of U.S. nuclear plants. These proposals include (1) use of a filtered, vented confinement building instead of a robust containment capable of preventing a large release of radioactive materials in the event of severe core damage; (2) a reduction of the size of the emergency planning zone (EPZ) from 16 kilometers to 400 meters; (3) a reduction in the number of staff, including operators and security personnel; and (4) a reduction in the number of systems whose components must meet the most stringent quality assurance standards.

However, there is insufficient technical justification for these measures. The presence of a pressure-resistant, leak-tight containment and the maintenance of comprehensive emergency planning are both prudent "defense-in-depth" measures that could mitigate the impact of a severe accident with core damage. Defense-in-depth is the requirement that nuclear reactors should have multiple, independent barriers in place to prevent injuries to the public and damage to the environment. The presence of multiple barriers is a hedge against uncertainty and an acknowledgement that the understanding of the performance of any one barrier is incomplete.

PBMR promoters claim that a robust containment is unnecessary because the design-basis depressurization accident cannot cause damage to the PBMR fuel severe enough to result in a large radiological release. They argue further that such a containment would actually be detrimental to safety because it would inhibit heat transfer and interfere with the passive mechanism needed to cool the core in the event of a loss-of-coolant accident. However, a containment is needed not only to inhibit the relatively minor releases that would occur during the design-basis accident, but also to mitigate the consequences of a more severe accident. Containments can also help to protect the reactor core from a sabotage attack utilizing truck bombs or hand-held rocket launchers --- an ominous possibility that should not be discounted.

If one could predict with confidence that severe accidents or sabotage attacks were so unlikely as to be incredible, then protection against them might not be justified. However, in the case of the PBMR, significant uncertainties remain, both in the likelihoods of potential severe accidents and in the identification of every potential accident sequence. The PBMR designers have not yet carried out a probabilistic risk assessment (PRA) and do not even have estimates of the risks of more severe accidents.

Among the largest sources of uncertainty for the PBMR are the potential for and consequences of a graphite fire. The large mass of graphite in the PBMR core must be kept isolated from ingress of air or water. Graphite can oxidize at temperatures above 400 C, and the reaction becomes self-sustaining at 550 C (the maximum operating temperature of the fuel pebbles is 1250 C)[1]. Graphite also reacts when exposed to water vapor. These reactions could lead to generation of carbon monoxide and hydrogen, both highly combustible gases.

If a pipe break were to occur, leading to a depressurization of the primary system, it has been shown that flow stratification through the break can cause air inflow and the potential for graphite ignition[2]. While the PBMR designers claim that the geometry of the primary circuit will inhibit air inflow and hence limit oxidation, this has not yet been conclusively shown.

The consequences of an extensive graphite fire could be severe, undermining the argument that a conventional containment is not needed. Radiological releases from the Chernobyl accident were prolonged as a result of the burning of graphite, which continued long after other fires were extinguished[3]. Even though the temperature of a graphite fire might not be high enough to severely damage the fuel microspheres, the burning graphite itself would be radioactive as a result of neutron activation of impurities and contamination with "tramp" uranium released from defective microspheres. An even worse consequence would be combustion of carbon monoxide, which could damage and disperse the core while at the same time destroying the reactor building, which is not being designed to withstand high pressure. In contrast, the large-volume concrete containments utilized at most pressurized-water reactors can withstand explosive pressures of about 9 atmospheres.

Another important source of uncertainty comes from the complexity of the PBMR core, which is constantly in motion. A PBMR operator must be able to accurately compute the pebble flow, neutron flux and core temperature distributions without the benefit of in-core instrumentation (since there are no structures to support such instrumentation). Previous experience with the AVR test reactor in Germany, a precursor to the PBMR, indicates cause for concern. Experiments measuring the He coolant temperature in the AVR found numerous "hot spots" in the coolant that exceeded 1280 C, whereas the maximum predicted temperature was only 1150 C[4]. After NRC staff highlighted these findings, Exelon raised the design maximum fuel temperature limit during PBMR normal operation from 1060 C to 1250 C. This is of concern because above 1250 C the SiC layer of the TRISO fuel coating will degrade as a result of attack by palladium isotopes produced during fission[5]. It also calls into question the accuracy of the current generation of computer codes for PBMR core analysis.

PBMR Fuel Performance

The safety case for the PBMR places great emphasis on the ability of the fuel pebbles to contain radionuclides under design-basis accident conditions. In order to provide assurance that the fuel will perform as expected, several levels of confirmation are required.

First, the fundamental fuel behavior must be sufficiently well understood that a complete set of technical specifications for the fuel can be derived. It appears that this is not yet the case. There are numerous instances in which TRISO microspheres manufactured to identical specifications and irradiated under identical conditions exhibited drastically different fission product release behavior that could not be attributed to observed physical defects like cracking of the SiC layer[6]. This indicates that there are technical factors affecting TRISO performance that have not yet been identified.

Second, when a complete set of technical specifications is finally at hand, the PBMR fuel manufacturing process will have to be reliable enough to ensure that the specifications are met. Because PBMR fuel is credited to a greater degree than LWR fuel for maintaining safety under accident conditions, and is less tolerant than LWR fuel to defects, PBMR fuel will have to be subjected to more stringent quality control. However, even if the requirements were no more stringent for PBMR fuel than for LWR fuel, inspecting the enormous microsphere flow with a high enough sampling rate to ensure an adequately low defect level would be a considerable challenge. The number of TRISO microspheres manufactured annually to support ten PBMR modules (1150 MWe total) would be on the order of ten billion, three orders of magnitude greater than the number of uranium fuel pellets needed to supply an LWR of the same capacity.

Finally, even if the above two criteria are satisfied, there must be assurance that the behavior of the fuel will not be significantly worse than expected if conditions in the core deviate from predictions --- that is, the fuel should "fail gracefully." It is on this count that the current TRISO fuel technology is clearly a loser. While past experiments have shown that the SiC layer of TRISO fuel limits the release of highly hazardous radionuclides like Cs-137 to below 0.01% of inventory up to 1600 C, the retention capability is rapidly lost as the temperature continues to increase. At 1800 C, releases of 10% of the Cs-137 inventory have been observed, which is on the order of the release expected during a LWR core-melt accident[7]. Without a leak-tight containment present, the release into the environment would be comparable to the release from the fuel.

Thus in order to justify the absence of a leak-tight containment, Exelon needs to demonstrate that the PBMR maximum fuel temperature will not exceed 1600 C during the design-basis depressurization accident, and that more severe accidents that could cause higher fuel temperatures are so improbable that they do not need to be considered. However, given the uncertainties discussed in the previous section --- like a discrepancy between calculated and measured maximum temperatures of at least 130 C --- there are serious grounds for skepticism.

Nuclear Waste Disposal

PBMR proponents do not normally bring up the issue of final disposal of the reactor's spent fuel. There is a reason for this: the volume of the spent fuel produced by a PBMR is significantly greater than that of the spent fuel produced by a conventional LWR, per unit of electricity generated. This is because the uranium in the fuel spheres is diluted in a large mass of graphite.

One can estimate the volume of spent pebbles discharged per unit of electricity generated for the Eskom PBMR as follows. Each pebble has a radius of 3 cm and a volume of 113 cm^3. Eskom calculates that operating a 110 MWe unit continuously at full power for 40 years will require 13.8 full fuel loads. Since each fuel load contains 330,000 pebbles (not counting the pure graphite spheres), this means that 4.55 million will be required over the plant lifetime. The amount of electricity generated during this period is 1.61 million MWD, so the total volume of spent fuel produced is 320 cm^3/MWD.

A typical 1150 MWe PWR operating on an 18-month cycle will discharge about 84 fuel assemblies per outage, with each assembly having a volume of about 186,000 cm^3. The amount of electricity generated is 630,000 MWD. Therefore, the volume of spent fuel produced is 25 cm^3/MWD, a factor of 13 less than for the PBMR.

Conclusion

The greatest amount of experience worldwide with nuclear reactor technology has been with the LWR. Even so, many outstanding technical and safety issues with LWR technology remain unresolved, and new surprises in well-established areas, like metallurgy, continue to arise. The development needed to take a new and unproven technology like the PBMR to a point where one can have confidence in the workability of the design will be substantial. Fundamental issues associated with the relationship between fuel quality control and fuel behavior under normal and accident conditions will have to be resolved, probably through extensive testing. While it is hard to estimate the amount of time and effort that would be required to do a satisfactory job, it is clear that the schedule that has been proposed by Exelon is inadequate for the task.

To get over the high hurdle of public acceptance, new nuclear plants should be clearly safer than existing ones. This is not the case with the PBMR. This problem is compounded by Exelon's desire to reduce safety margins required for current plants. In the aftermath of Chernobyl, the U.S. nuclear industry tried to reassure the public that such an accident could not happen here because U.S. reactors were equipped with robust containments, unlike Chernobyl. This argument will make it more difficult for Exelon to justify its choice of PBMR containment to the public.