Post-Fukushima work: the reactor's "hard core"

After the Fukushima accident the safety authorities imposed a number of requirements on nuclear operators:

1. The case of a single extreme external aggression, or of a combination of extreme external aggressions, far more severe than hitherto considered for the design of the installations, had to be considered as possible. These extreme situations are referred to as "hard-core situations". The situations considered possible for the ILL are the following: 

  • Extreme earthquake with a recurrence interval of over 20000 years (or even more violent), incorporating possible exacerbations caused by the specific configuration of the Grenoble basin
  • Extreme flooding following the breach in series of the 4 dams upstream on the Drac river. The risk of severe scouring (massive displacement of ground cover around and below building foundations liable to result in the tilting of the buildings/structures affected) around the installations by the passage of the wave of water needs to be taken into account.
  • A toxic cloud over the site,following the earthquake and/or flooding of the Grenoble basin in the event of a dam burst, caused in particular by phosgene released by the chemical installations south of Grenoble. 

2. The installation of a small "structures, systems and components" sub-unit designed to resist these "hard-core situation" impacts and:

  • prevent a serious accident and limit its progression
  • limit the massive release of emissions
  • enable the operator to carry out his responsibilities in managing the crisis.

This sub-unit is known as the "hard core" of the nuclear facility.

The most serious accident conceivable on the ILL high-flux reactor (HFR), as on any reactor, is a core meltdown (See La fusion...) .
The HFR hard core therefore includes systems designed to prevent a meltdown in extreme hard core conditions:

1. ARS: Seismic reactor shutdown (ARS): this system guarantees a reactor shutdown in the most extreme "hard core" conditions. When an earthquake occurs, a succession of primary (compression) waves - P waves - and secondary (shear) waves - S waves - are propagated from the epicentre. The compression waves travel faster than shear waves and would therefore be the first to reach the installations. The shear waves, however, are more destructive. As with other reactors, our HFR therefore has an automatic shutdown mechanism triggered by the detection of very low-level (0.01 g) primary waves. As the shutdown occurs preventively at low levels of acceleration, the system which detects and triggers the shutdown does not itself need to resist high levels of acceleration, i.e. to be seismically designed. 
The ILL is in any case protected by its "defence in depth", measures put in place to compensate for any human or technical failure. This consists of several levels of protection, based on a series of barriers preventing the release of any radioactivity into the environment. The ILL's hard core includes a new and entirely automatic system capable of stopping the reactor even in the very hypothetical case of an earthquake not generating primary waves capable of being detected on the site in advance of the more destructive secondary waves. 
This system has been operating since 2016.

2. The CRU and CEN: We have shown (see: "Is a power supply needed …") that the reactor does not need any electricity or an external cold source for cooling once it has been shut down. To cool down the core properly we only need to maintain a certain level of water to ensure the natural convection process.
There are two different systems which guarantee this level of water above the core in the event of a breach in the reactor vessel or pool caused by an earthquake of the severity being considered: 

  • The Emergency core cooling (‘reflood’) system (CRU): the CRU provides the link between the reactor vessel, which has a volume of only 12 m3, and the reactor pool (over 350 m3). The system was brought into manual operation in 2012. From 2018 it will be operated in automatic mode. It will ensure that the core inside the reactor vessel can be inundated with water from the reactor pool passively (by gravity). The CRU ensures that the reactor has the cooling water it needs for about one hour. 
  • The groundwater supply system (CEN): The CEN is a system designed as a means of refilling the reactor pool with water taken from the underground aquifers underneath the ILL site (part of the river Drac's hydraulic system). As it is linked to the CRU, this is a backup system ensuring that there will always by a volume of water maintained in the reactor pool, and by consequence in the reactor vessel. To avoid drowning the reactor after a few hours, there are also a number of pumps in the reactor basement.  Once the correct level of water has been established, the system automatically switches from "groundwater pumping" to "recovered water pumping". The system will be brought into service early in 2018 with the reactor re-start.    

It should be noted that the ILL had decided on its own initiative to require these three core-protection systems to be totally redundant. In other words, the reactor shutdown and water makeup mechanisms can each withstand at least one system failure before themselves failing to fulfil their missions. 

The reactor hard core also includes systems for limiting releases into the environment, should a core meltdown nevertheless occur following extreme external aggression (despite the systems in place designed to prevent such a meltdown). This is a perfect example of our application of the principle of "defence-in-depth".

  • The CDS: Seismic depressurisation circuit (Circuit de Dégonflage Sismique) this is an automatic system linked to the reactor's "dynamic containment" system. It involves extracting a minimal quantity of air from the reactor building, in order to keep the building at a pressure slightly below that outside the building.
    The air extracted is filtered through an iodine trap and two stages of very high-efficiency filters, before being controlled and released via a specific new exhaust stack located 50 metres above ground level on the reactor dome.
    The CDS provides a means of controlling the rate and quality of the emissions, thus avoiding uncontrolled leaks across fissures in the containment caused by a severe earthquake. This system has been operating since 2016.
  • GAS: Seismic pressurisation of the annular space (Gonflage annulaire sismique): this is an automatic system ensuring that the hollow space between the inner and outer reactor building walls is kept at a permanent overpressure compared to the exterior. This "annular space" is filled with clean air.  This provides reinforcement for the dynamic confinement for the transitional periods when the pressure inside the reactor building could be higher than that outside. This is because, whenever the interior of the reactor building is at positive pressure, there will still be clean outside air entering the building through the fissures in the concrete containment after a severe earthquake. This system has been operating since 2016.

As for the other emergency systems, these two systems designed to limit hard-core emissions are entirely redundant. 

The reactor's hard core system also includes all that is required to manage a crisis triggered by extreme external aggression.

1. The emergency reactor control room:
ILL has constructed a new emergency control room dimensioned to cope with any extreme external aggression considered to be a "hard-core situation", including cumulated multiple aggressions.  Previously the ILL relied on an underground control room designed to resist a "safe-shutdown earthquake". It was also designed for the flooding liable to occur on site following a rise in the levels of the Isère or Drac rivers. It was not however sufficiently equipped to deal with the flooding caused by the breach of one or more of the dams upstream. 
The new control room has been operational since the end of 2016 and is capable of:

  • resisting an extreme earthquake measuring 7.3 on the Richter scale
  • resisting flood water rising to a height of 6 metres
  • resisting the scouring liable to result from such flooding
  • protecting the personnel managing such a crisis, even in a core meltdown situation (protection from direct radiation and emissions, but also protection from toxic chemical risks, including in particular from phosgene pollution from the chemical industries south of Grenoble). The control room is equipped with a ventilation system which maintains the crisis management quarters at a positive pressure and which ensures that all the outside air entering the building is filtered. The filter system consists of a very-high-efficiency filter, an iodine trap, and an NBC filter (nuclear, biological and chemical) to counter the phosgene risk. 
  • The 45-metre reactor exhaust stack has been modified to ensure that it poses no risk to the new control room in the event of an earthquake. 

2. Hard-core instrumentation and controls:
The new control room is equipped with all the facilities required for the operation of the hard-core systems in either manual or automatic mode, as desired by the personnel.  Emergency electrical power is available to supply all the hard-core systems (a diesel generator, plus UPS and batteries to ensure continuity during the transfer from the external mains network to the diesel supply). 

3. Monitoring systems
The control room also houses all the instrumentation required to diagnose and monitor the four critical safety functions: 

  • controlling the reactivity of the fuel element: ensure that the reactor is completely shut down
  • controlling the cooling: check the water inventory and thus the proper cooling of the reactor by the CRU and CEN systems
  • controlling confinement: monitor the dynamic confinement process (CDS and GAS)
  • controlling exposure levels: monitor the levels of irradiation and contamination inside and outside the reactor, including the emissions by the seismic depressurisation circuit. The areas inside the emergency control room are also specially monitored to ensure that the levels of radiation and radioactive or toxic contamination are acceptable for the crisis personnel. There are procedures for adjusting the quality of the air and ordering the use of additional protective equipment if necessary (masks, breathing apparatus, etc.).
  • Environmental monitoring: special meteorological monitoring instrumentation (wind speed and direction, low-level or normal concentration of emissions) provides data for assessing the exposure of the population, in addition to measuring the levels of emissions. Even during or after being submerged post-dam-burst, the operators can use drones to take atmospheric air samples and transmit them to the ILL site for analysis in the "hard-core micro-laboratory" designed for extreme earthquake conditions.

4. Communications
The control room has the facilities required for communicating with the authorities in extreme conditions. ILL's access to the "Iridium" satellite communications network will ensure that communication remains possible with those outside the site even if the other systems are down (landlines, GSM etc.).

Finally there may be a need for the crisis personnel to access the reactor building during or after major flooding. This is assured by a Himalayan-type suspended footbridge linking the roof of the emergency control room to an external walkway around the reactor building. The walkway gives access to the roof of the ILL administration building (reinforced for earthquake and flood) and from there to the reactor building. 

With the exception of the building housing the emergency control room, all these systems (power supplies, air quality, monitoring and communication) are also redundant. 

These hard-core reactor systems, together with the reinforcement measures required to protect the hard core from being damaged by installations not seismically reinforced, cost some 30 million euros.  The implementation of the hard-core system will be complete when the reactor restarts early in 2018.