Reactor safety FAQ
What are the technical specifications of the ILL’s reactor?
The ILL’s high-flux reactor is devoted exclusively to research. It operates continuously during 50-day cycles.
Its core comprises a single highly enriched uranium fuel element (10 kg) that is cooled by heavy water. The reactor produces the most intense continuous neutron flux in the world, namely 1.5 x 1015 neutrons per second and per cm2. Its thermal power of 58 MW is not reused and is removed by a secondary cooling system supplied with water from the river Drac.
The heavy water vessel that contains the core is situated in a pool filled with demineralised water which provides shielding from the neutron and gamma radiation produced by the core. The reactor is controlled by means of a neutron-absorbing rod, which is gradually withdrawn from the core as the uranium is burned up. It also has 5 safety rods, which are also neutron-absorbing devices and are used to shut down the reactor in the event of an emergency.
The neutrons produced in the reactor by fission are very high-energy neutrons (speed: 20 000 km/s). They are slowed down by the heavy water both to trigger further fission events in order to sustain the chain reaction (thermal neutrons with a speed of 2.2 km/s) and to supply neutrons to the scientific instruments.
Three components located in the immediate vicinity of the core also make it possible to produce hot neutrons (10 km/s), as well as cold and ultra-cold neutrons (700 m/s and 10 m/s, respectively). These components are a hot source, comprising a graphite sphere maintained at a temperature of 2600°C, and two cold sources, the largest of which is a sphere containing 20 litres of deuterium maintained in a liquid state at -248°C, in which the neutrons are slowed down to the desired energy by a succession of collisions with the deuterium atoms.
The neutrons are extracted from inside the reactor vessel by around twenty beamtubes, some of which are directed at the hot source or one of the cold sources. These beamtubes, which extend outside the reactor pool in the form of neutron guides, then supply neutrons to around forty experimental areas equipped with leading-edge instruments, located up to 100 m from the reactor.
Is the ILL’s high-flux reactor an “old” reactor?
It is true that the ILL was founded in 1967 and that the high-flux reactor went critical for the first time in 1971.
However, the lifetime of a reactor is linked to the aging of the components “bombarded” by the neutrons (the flux), in particular the reactor vessel. In power plants, this vessel cannot be replaced.
On the high-flux reactor, however, these components are all replaced regularly. The reactor vessel was replaced in its entirety at the beginning of the 1990s, and the “new” installation then restarted in 1995, the first and only time this operation has ever been performed on a reactor. This vessel has currently been in use for the equivalent of just 8 years of operation at full power.
Similarly, between 2004 and 2007, 30 million euro were invested in the seismic reinforcement of the reactor building. As a result, the building is fully compliant with the most recent seismic design regulations in France (known as the Règle Fondamentale de Sûreté or Basic Safety Rule).
All other components are maintained, upgraded and replaced in accordance with standard practice.
What magnitude of earthquake is the ILL’s reactor designed to withstand?
An earthquake with a magnitude of 5.7 occurring at a depth of 7 km right under the reactor.
When it was built in 1970, the reactor was designed to withstand an earthquake corresponding to the criteria defined in the seismic regulations in force at the time (intensity VIII, as per French Seismic Code PS 67). Since then, our knowledge of seismic hazards has evolved, as have the regulations, which have become even more stringent.
In 2004, studies were resumed to define the earthquake characteristics to be taken into consideration and to verify the behaviour of the ILL’s installations under seismic conditions. These studies led to the carrying out of major seismic reinforcement work, which was completed in 2006 at a cost of around 30 million euro. The ILL’s reactor is now designed to withstand an earthquake with a magnitude of 5.7 occurring at a depth of 7 km right under the reactor building.
The approach used is the approach recommended in the Basic Safety Rule on seismic hazards (RFS 2001-01) issued by the French Nuclear Safety Authority (ASN) for evaluating the seismic hazard at the sites of nuclear installations. This approach is broken down into several stages:
- Identifying the earthquakes likely to occur in the vicinity of the installation
This study was assigned to outside experts who used a method which basically involves defining zones in which the probability of an earthquake is identical at every point within the zone. In other words, the seismotectonic zone in which ILL is located is first of all defined, as are the adjacent zones. It is then assumed that if an earthquake has occurred anywhere in the zone, another earthquake may occur at any other place in the same zone. The study is based on knowledge of seismic faults and historical seismicity data, which goes back to the 14th century (see SISFrance database). The most powerful earthquake observed in each zone is then taken as the basis for the next stage.
- Defining the earthquake characteristics to be taken into account for designing or reinforcing the installation
The next stage involves “shifting” the earthquakes identified in stage 1) to the most penalising position for the site, i.e. directly under the installation in the case of the maximum earthquake identified in the zone in which the installation is located, and to the edge of the zone as close to the installation as possible in the case of the maximum earthquakes identified in the neighbouring zones. For ILL, 2 earthquakes, known as SMHV (Séismes Maximaux Historiquement Vraisemblables – Maximum Historically Probable Earthquakes), have been identified as relevant:
a. The earthquake of Corrençon (1962) with a magnitude of 5.2 at a depth of 7 km
b. The earthquake of Chamonix (1905) with a magnitude of 5.7, at a distance of 15 km
The magnitude of each SMHV is then increased by 0.5 units in order to define the Safe-Shutdown Earthquake (SSE) in each case, i.e. the maximum earthquake for which the structures, systems, and components important to safety must be designed to withstand and remain functional.
- Calculating the ground motions corresponding to these earthquakes
The ground motions are calculated using the method recommended by Basic Safety Rule RFS 2001-01 and taking into account “site effects”, i.e. the amplification effects on ground motions due to the different sediments that fill the Grenoble basin. These calculations produce the “acceleration response spectra” and determine the maximum acceleration generated by the earthquake depending on the ground motion frequency. This calculation demonstrates that the most penalising earthquake to be taken into account is the Corrençon earthquake. Moreover, the acceleration level of the SSE is around 1.5 times greater than that of the SMHV.
Consequently, it was the response spectrum calculated for the Corrençon SSE, i.e. an earthquake with a magnitude of 5.7, occurring directly beneath the installation at a depth of 7 km that was used by earthquake engineers to calculate the reinforcement work needed to ensure that the reactor building can withstand the SSE, while nevertheless taking account of design margins.
After the Fukushima-Daïchi accident France's nuclear safety authorities asked nuclear operators, and reactor operators in particular (EDF, AREVA, CEA and ILL), to base the calculations on an even more serious earthquake (see: Is a more powerful earthquake possible?).
Is a more powerful earthquake possible?
The studies carried out were based on the rate of seismicity of the Alps, which is considered to be moderate on a world scale.
Scientists estimate that in south-east France:
- the frequency of earthquakes with a magnitude greater than 4 is one every 3 years,
- the frequency of earthquakes with a magnitude greater than 5 is one every 30 years
- the frequency of earthquakes with a magnitude greater than 6 is one every 300 years
The strongest historic earthquake occurred in Lambesc in the south of France in 1909, with a magnitude estimated at 6. It is therefore highly unlikely that an earthquake with a magnitude greater that 5.7 would ever occur directly beneath the installation.
As far as the region around Grenoble is concerned, seismologists consider that an earthquake with a magnitude of between 5.5 and 6 could occur on the Belledonne Border Fault located 15 km from the ILL. The acceleration levels at ILL would not exceed the limit values of the SSE. It is therefore extremely unlikely that the reactor will ever be subjected to more powerful seismic movements than those taken into account in its design.
Could a dam break cause a tsunami-like wave?
Following the Fukushima accident, the ILL decided to take as reference extreme scenario, the cascade failure of dams located on the same river. Studies show that the scenario that would cause the most serious damage would be the failure of the four dams on the river Drac.
To calculate the height and speed of the water when it reaches the ILL site, we assumed the total and instantaneous collapse of the “Le Sautet” dam when completely full. We also assumed that, on reaching the dams situated below the “Le Sautet” dam, the “wave” created by the initial dam break would cause the total and instantaneous collapse of these other dams (which we also assumed to be completely full):
St Pierre de Cognet
Notre Dame de Commiers
It is important to note that this is the worst-case scenario. In fact, as the other big dams, such as Tignes, Roselend and Grand’maison, are located on different rivers and are much further away, it is totally impossible that the dam-break waves caused by their failure would reach Grenoble at the same time as each other and at the same time as the wave on the river Drac.
The ILL commissioned the company Artélia (ex-Sogreah, a specialist in this type of work) to carry out a specific study on the consequences of the cascade failure of all four dams on the river Drac. The study was based on worst-case modelling assumptions and concluded that a wave of almost 6 metres in height would reach the ILL site approximately 50 minutes after the breach of the Monteynard dam.
This hazard, which is assumed to be caused by an extreme earthquake, is used as the design basis for the “hardened safety core” of components of the ILL’s high-flux reactor.
New studies have been carried out on the ability of the reactor's two containment walls to withstand this level of flooding. Similarly, all the openings in the reactor walls (personnel and equipment airlocks, truck door, pipe and cable penetrations, etc.) have been checked and, if necessary, reinforced. The necessary reinforcement work was carried out between 2014 and 2017.
Is the ILL’s reactor designed to withstand a dam break?
The reactor building is designed to mechanically withstand the pressure of the water. Even in a situation of this kind, it would remain watertight.
The rise in water levels caused by the breach of the Monteynard dam would not therefore affect the building’s structure. On the other hand, it would lead to a total loss of electrical power, as the two 20 kV substations and the two emergency diesel generators would be under water.
The loss of these power supplies would automatically trigger the shutdown of the reactor by safety rod drop. Cooling would be adequately provided by simple natural convection using the water in the reactor pool.
Is human intervention required to shut down the reactor in the event of an earthquake?
The reactor has three sensors (3-axis accelerometers) which permanently monitor ground movements. If two of these three sensors detect an acceleration greater than 0.01 g, the safety rods automatically fall, shutting down the reactor. This acceleration corresponds to a weak earthquake with a magnitude of less than 3 close to the reactor.
Of course, this automatic shutdown takes place under the supervision and control of the reactor operator teams.
The reactor has five independent safety rods. During reactor operation, these safety rods are always in the raised position. They are held suspended in this position by means of electromagnets. The rod drop is therefore a “failsafe” mechanism: any failure, loss of power supply, cable break, etc… causes the safety rods to fall by the force of gravity due to the loss of current to the electromagnets. This automatic shutdown does not therefore require any external energy source.
To speed up the rod drop time, the safety rods are driven downwards by compressed air at a pressure of 10 bar, which is permanently available in small reservoirs located above the safety rods. Any fall in the pressure of the compressed air in these reservoirs also automatically triggers a safety rod drop.
Is a power supply needed to cool the reactor after its shutdown?
After the reactor shuts down, the core can be cooled by simple natural convention, i.e. without any source of electrical energy.
Once the reactor shuts down, in other words once the fission chain reaction in the uranium fuel stops, the core nevertheless continues to release energy because of the radioactivity of the fission products it contains. This energy per unit of time is known as the residual core power. As this residual power is due to the radioactivity of the core, it therefore decreases with time as this radioactivity decreases.
After a normal operating cycle, i.e. after 46 days at full power of 57 MW, the reactor core gives off the following residual power:
- 2 MW immediately after reactor shutdown;
- 0.55 MW after one hour;
- 0.18 MW after 24 hours;
- 0.08 MW after one week.
This residual power is not only low but also decreases very rapidly. This is due, on the one hand, to the reactor’s low operating power (57 MW) and, on the other, to its short operating cycle (46 days). The fuel element, a single fuel rod which constitutes the whole of the reactor core, must then be changed. As the reactor cycle is short, the level of radioactivity of the long-lived fission products (those with long half-lives) does not have time to accumulate.
Nevertheless, the core still has to be constantly cooled to prevent its temperature from rising and hence avoid any risk of fuel meltdown.
During a normal shutdown, the main coolant pumps are left to run for an hour, providing a water flow rate through the core of 2400 m3/h. Once these are shut off, the pumps of the shutdown cooling system continue to operate alone, providing a water flow rate through the core of 150 m3/h. The cooling water is water taken from the river Drac. The heat from the core is transferred to this water via heat exchangers, an operating mode which avoids any thermal stress on the fuel element or the reactor vessel.
In the event of the loss of external power supplies, the main pumps of the primary cooling system will stop. This triggers the automatic shutdown of the reactor but also the automatic startup of the emergency backup diesel generators. These generators make it possible to restore power to the main systems, in particular the shutdown cooling system.
Finally, even in the event of the total loss of external and emergency backup power supplies, the pumps of the shutdown cooling system continue to function for one hour, as they have batteries which guarantee autonomous operation for this length of time. If these batteries fail, cooling is no longer provided by means of forced convection but by simple natural convection, which is perfectly adequate to ensure that the reactor core is properly cooled.
Is an external source of cooling water necessary after the reactor is shut down?
The reactor core is situated at the centre of a heavy water vessel with a volume of around 15 m3, which itself is located at the bottom of a pool containing 450 m3 of light water. In the event of the total loss of all power supplies, both external and emergency backup supplies, the core is cooled by natural convection in the reactor vessel, during which process the water in the vessel stabilises at a temperature of around 60°C. The reactor vessel itself is cooled, again by natural convection, by the water in the reactor pool, the temperature of which stabilises at below 60°C.
Could the ILL’s reactor explode?
An explosion such as the one that occurred in the n° 4 reactor of the Chernobyl power plant due to a runaway fission reaction cannot happen with the ILL’s reactor. The equivalent scenario for research reactors like ours, known as a BORAX accident, does not produce an explosion capable of damaging all the reactor’s structures, including its containment. The energy stored in the reactor core and released in the “explosion” is much too low to do such damage. Obviously, this is due to the fact that the core of the ILL’s reactor is very small (10 kg of uranium compared with the 190 tonnes contained in the core of Chernobyl's RBMK-type reactor).
The French Nuclear Safety Authority (ASN) requires that the design of experimental reactors such as the ILL’s take into account a so-called “BORAX-type accident” scenario, named after an American research facility that was deliberately destroyed in the 1950s in order to study this phenomenon.
An accident of this type did actually occur at the SL1 reactor in the United States when one of the reactor’s control rods was accidentally and extremely quickly withdrawn from the core. This led to such a rapid exponential increase in the nuclear power generated by the chain reaction that the heat produced in the fuel plates caused them to melt before it could be transferred to the cooling water. The dispersal in the cooling water of a large amount of molten aluminium in the form of very fine droplets then caused the water to vaporise suddenly and explosively. This is known as a “vapour explosion”.
To come back to the ILL’s reactor, the energy released in such a scenario would be less than 200 MJ and would cause the partial destruction of the reactor vessel. The reactor pool and its metal liner have therefore been designed to withstand this “explosion” while remaining leaktight. This phenomenon might also produce a spray of water, but this would not be very powerful and would not therefore damage the reactor containment.
It is important to note that even the most highly unlikely scenario would not create the conditions necessary to trigger a BORAX-type accident at the ILL’s reactor. In fact, this is generally true for the other comparable research reactors in the world. In most other countries, therefore, the safety authorities do not include a BORAX-type accident in the design basis of their reactors.