Assessment of the Licensing of ThorCon Reactors in Indonesia

Report ID: QA-TC-01

Date: 2016-06-11

Summary
This report describes the principles of test-then-license for novel
reactor types, and a preliminary assessment of the licenseability of the
Martingale Inc. ThorCon reactor concept in Indonesia.

Qvist

Atomenergi AB
Developing the next generation of nuclear power

This report is confidential and is for the intended recipient only. Access, disclosure, copying, distribution by
anyone outside the intended recipient organization is prohibited and constitutes a criminal offence.

1.

Introduction to Test-then-License (TTL)

The basic idea of test-then-license (TTL) is that a set of integral tests of a full size
reactor and associated systems is used to demonstrate the ability of the overall system
to successfully mitigate a set of bounding accident cases, according to a carefully
predetermined test plan. Successful performance in these tests should be sufficient
proof of the safety of the nuclear power plant concept. These tests will also serve to
validate the computer codes that have been developed for design and accident analysis,
providing confidence in the reliability of simulations for the scenarios not covered by
the test program.
The general concept of certification using a prototype test for certification is already
well established procedure for certifying commercial aircraft in use by, for instance, the
Federal Aviation Authority (FAA) in the United States and the European Aviation
Safety Authority (EASA) in Europe. The emphasis on safety of commercial aircraft is
comparable to that applied to a nuclear reactor and the benefit of resolving all the safety
and design issues prior to serial production is a common objective. In commercial
aircraft licensing, there is a requirement for extensive testing of the first production or
prototype machine over a wide range of operational and emergency conditions, in
addition to the standard production design documentation, safety analysis and
component testing. The scope of the certification test programs is established in
collaboration with the licensing authorities prior to conduct of the tests and include
testing beyond the range of normal operation and anticipated events.
While no commercial nuclear reactor has been licensed in this way in recent times,
a similar general procedure is well suited for the licensing of novel types of nuclear
reactors for which there is limited existing experience and knowledge base. Some form
of TTL is inevitable for new and unproven technologies, and is effectively carried out
during the start-up tests that are performed before putting any reactor facility in to
operation. Full scale tests are the only way to achieve confidence in certain parameters
of safety importance. The prototype used for testing should ideally be as similar (even
identical) to the production reactor proposed, with the main difference being that the
prototype will need contain far more instrumentation and measurement acquisition
technology than the serial production plant for which it acts as a prototype. If these
facts are taken in to account and integrated in to the process of licensing from the very
beginning, a clearer, more transparent and less time-consuming path to license can
readily be achieved. A proposed step-by-step TTL approach is laid out in the following
section. Site-specific licensing issues and the transportation of fissile and/or radioactive
material to and from nuclear sites are not covered in this document.

This report is confidential and is for the intended recipient only. Access, disclosure, copying, distribution by
anyone outside the intended recipient organization is prohibited and constitutes a criminal offence.

2. Step-by-step generic test-then-license strategy

1. The first step in the licensing process after finalizing the reference design will
be to perform a thorough review of accident scenarios that may lead to the
release of radioactive material. Deterministic analysis will need be performed
using new purpose-developed codes (validated as far as possible against
relevant experimental data) and, if applicable, existing transient analysis code
packages, to evaluate the expected plant performance in accident scenarios.
2. The applicant performs a detailed risk assessment on the Reference Plant
Design. A combination of deterministic and, where applicable, probabilistic
methods should be used to identify the risk dominant accident sequences
(RDAS) that will form what are traditionally referred to as Design Basis
Accidents (DBAs). Once this step is finished, an initial temporary construction
license for the nuclear prototype could be granted.
3. The vendor will develop, together with a small dedicated team from the
regulatory agency, a Test Plan for Certification. Based on the risk assessments,
the applicant identifies critical safety components, systems and structures, and
develops a series of subsystem and integral tests to confirm the performance of
the components and systems as required to validate performance and computer
codes. These tests will form the basis of the safety case for the technology. A
list of expected types of integral system testing is given in Appendix A. The
applicant provides an estimate for relevant performance parameters as well the
calculation uncertainty, the regulator in turn provides the expected/acceptable
behavior and span of allowed values (deviation from expectation) for these
parameters, which will act as the threshold at which further action needs to be
taken. If at any time the system behavior is of concern to the regulator, tests can
be stopped until the issues are resolved.++ddddd ddd ddd ddd ddddd
+++++++++ +++++++++++++++++++++++++++++++++++++++++++++
4. Granting of License. Once the test program is completed and reviewed, a
general certification for the design can be issued. It is recognized that not all
areas of performance can be tested using a real reactor, but as a result of the
tests, the computer codes that are used to demonstrate performance can be
validated and by extension justified for broader application. This area needs to
be reviewed to assure that the tests provide an adequate justification for
application over the range of conditions expected.

This report is confidential and is for the intended recipient only. Access, disclosure, copying, distribution by
anyone outside the intended recipient organization is prohibited and constitutes a criminal offence.

The test referred to above are specifically integral tests on a scaled (ideally full-scale)
prototype of the proposed plant. Any required separate experiments to establish
material properties and corrosion rates will run concurrent with the main prototype test
plans. Once the TTL demonstration is completed, the regulator could with high
confidence issue a general certificate for construction. Future licensing actions would
be based on assuring that new plants are built as specified in the certificate, in addition
to grid integration studies and site-specific licensing issues. Once testing is completed,
it would be straightforward to grant a commercial operating license for the final critical
prototype plant itself if requested. Since the prototype is under continuous on-site
supervision by the regulator, there is no motivation for any obstacle to allow the selling
of electric power produced during the later stages of the testing process to the grid in
order to recover some of the expenses.

3. Preliminary assessment of the licenseability of MSRs & ThorCon

Studies and limited operational experience indicate that Molten Salt Reactor (MSR)
technology could in principle offer intrinsic safety characteristics equal to, or
exceeding, those of any competing nuclear reactor system. The factor that introduces
additional uncertainty and difficulty in the licensing of any MSR system is the relative
lack of real-world operational experience and knowledge base, certainly in comparison
to water-cooled systems but also compared to other advanced designs such as Sodium
Fast Reactors (SFRs). It is beyond the scope of this work to perform a careful specific
assessment of the safety and licenseability of the Martingale Inc. ThorCon plant.
However, the approach used in the ThorCon development process has been validated
against the best practice principles that act to raise the level of confidence in the safety
of the design and to lower the barriers to licensing. These principles are in summary:
1. Application of the existing nuclear knowledge base
The main applicable knowledge base for MSR designs of any type is the
information available from the development program that ran at the Oak Ridge
National Laboratory (ORNL) in the United States from the early 1960s to the mid
1970s. The Molten Salt Reactor Experiment (MSRE), a reactor operating 19651969, constitutes the most valuable nuclear documentation supporting new MSR
development. The more directly a new concept incorporates existing MSRE data
and other high-quality experimental program results in their design (i.e., the more
efficiently the new design leverages data from what has been proven in the past),
the lower the pre-existing barriers to licensing are.

This report is confidential and is for the intended recipient only. Access, disclosure, copying, distribution by
anyone outside the intended recipient organization is prohibited and constitutes a criminal offence.

2. Level of deviation from proven technology

In the selection of materials and operating conditions (temperatures, stresses,
fluence etc.), there is a trade-off in any nuclear design process between maximizing
the nuclear (and economic) performance of the plant and minimizing the
technological uncertainty. Using, as far as practical, materials for which there is
neutron irradiation data and relevant material specifications following the format of
American Society for Testing and Materials (ASTM) standard or equivalent, greatly
reduces uncertainty.
3. System complexity
The complexity of any nuclear installation correlates in a direct way with the
challenge of reaching a high level of confidence in the analysis of its safety. The
inherent safety characteristics of MSRs typically act to reduce complexity by the
reducing or eliminating the reliance on active systems to ensure safety, while the
online processing of nuclear materials greatly add to the complexity of analyzing
the safety of the entire system.
The Martingale Inc. ThorCon reactor have been evaluated against this general guiding
principles, with the following general conclusions:
1. Application of the existing nuclear knowledge base
The ThorCon design approach is described by the company itself as a
straightforward scale-up of the successful Molten Salt Reactor Experiment
(MSRE), which would appear to be in direct agreement with the first principle.
This is in many ways correct, and large parts of the MSRE experience is
effectively utilized in the ThorCon design. However, it is important to note that
there are several important differences which will require original R&D work
on the side of Martingale Inc. The fuel and coolant of the MSRE was a lithium
fluoride based salt (LiF-BeF2-ZrF4-UF4), while the ThorCon design uses a
sodium fluoride salt (NaF-BeF2-ThF4-UF4). The structural material in the
MSRE was Hastelloy-N, while ThorCon primarily uses standard stainless steel
(SS316Ti).
2. Level of deviation from proven technology
The ThorCon design is in many aspects very conservative, which raises
confidence regarding this point. The design lifetime of a ThorCon primary
system is 4 years, based on a conservative estimate of the graphite moderator
lifetime. The general approach regarding conservatism, the determination of
This report is confidential and is for the intended recipient only. Access, disclosure, copying, distribution by
anyone outside the intended recipient organization is prohibited and constitutes a criminal offence.

operating conditions and material selections instills confidence in the safety

case and the licenseability of the plant. Martingale Inc. will need to prove the
compatibility of their chosen structural materials in the specific conditions of
the reactor.
3. System complexity
The ThorCon concept essentially eliminates most of the typically added
complexity of MSR systems, while making use of the increased simplicity
offered by the inherent safety of the design. The decision to not include fuel
processing on-site vastly reduces complexity regarding system design and onsite safeguards. The complexities of accurate transient simulations of a system
with a moving delayed neutron precursor population, and the on-line treatment
of radioactive gases systems are both inevitable in a liquid-fuelled system. In
terms of licenseability, the ThorCon design has a great advantage over more
complex systems in its avoidance of all online fuel and non-gaseous fission
product processing.

The ThorCon design has has negative temperature reactivity feedbacks, very extensive
decay heat removal capabilities and multiple strong barriers between radioactive
material and the environment. All of these features indicate that the plant has the
potential to achieve a very high level of intrinsic safety.

4. Summary and conclusions

Even if not presented as such, a test-then-license approach is near-inevitable when
introducing novel nuclear reactor technology.* Thus, designing the regulatory process
around such a philosophy will help to reduce time, costs and increase confidence in the
safety of the plant. Indonesia is in an ideal position to implement such a plan, having
relatively little commercial light-water-reactor legacy regulatory structure in place, and
strong interest specifically from commercial vendors of novel (non-LWR) concepts.

* The Super-Phenix reactor was one of the most thoroughly pre-analyzed nuclear systems ever
constructed. During the start-up tests of the reactor, it was evident that the control rod worth had been
greatly overestimated in calculations. After this was discovered, the regulator demanded an explanation
of the discrepancy and a minor redesign specifically to compensate for the lower-than-expected worth.
With test data in hand, the vendor could quickly identify the analysis problem and adjust the system
design. This pragmatic process in essence became, by necessity, one of test then license. Properly
designed, safety related tests (such as control rod worth confirmation) on a full-scale real system can be
designed with an extremely high level of safety, even if initial uncertainties are high. A single completely
safe test on the real system can capture information that may not become available even after years of
analytical studies, thus saving time and cutting costs for both regulator and vendor.
This report is confidential and is for the intended recipient only. Access, disclosure, copying, distribution by
anyone outside the intended recipient organization is prohibited and constitutes a criminal offence.

The Martingale Inc. ThorCon development and design process generally adheres to the
identified best-practice approach of conservatism, simplicity and the utilization, to the
fullest extent possible, existing information and proven materials. Major R&D needs
specifically applicable to the ThorCon design in the near-term are:
1) The development of a sophisticated transient analysis code which captures all
the safety-relevant physics of the plant. A major task for the prototype plant will
be to validate this code.
2) Structural material compatibility with the specific coolant and fuel salt at
applicable temperatures and during the influence of irradiation
3) Proof-of-concept of the off-gas treatment system
In summary, based on a preliminary review, the ThorCon reactor will be an inherently
safe and cost-effective way for Indonesia to produce climate-neutral energy that is
practical to be built in the near future.

This report is confidential and is for the intended recipient only. Access, disclosure, copying, distribution by
anyone outside the intended recipient organization is prohibited and constitutes a criminal offence.

Appendix 1. Expected test during licensing process

The final test plan is expected to include, at a minimum:
a. Non-nuclear test program and verification
i. Full non-nuclear-heating thermal hydraulics and heat transfer
verifications of all relevant components
ii. Component testing (pumps, sensors, chemistry control, fuel salt
add/removal systems, fuse valve etc.)
iii. Gas treatment systems tests
iv. Balance of plant systems tests
v. Control system and control room operations testing
b. Zero-power critical (nuclear) calculations and sensor verification
i. Critical mass (fuel salt fissile fraction)
ii. Fuel composition reactivity effects
iii. Control rod worth & shutdown margin
iv. Control system operation
v. Iso-thermal integral reactivity coefficient
vi. Spectral calculations
vii. Sensors/detectors related to neutron flux
c. Low power tests
i. Power & flow coefficients of reactivity
ii. Reactivity feedback components
iii. Fission product poisoning
iv. Shielding verification
v. Gas treatment system test program
vi. Sensors/detectors related to power/temperature/neutron flux
d. At power tests
i. Identical to low-power tests, and
ii. Phase-in of steam cycle / power conversion testing
iii. Grid synchronization testing (at power level of ~30%)
iv. Sequential increase of power toward full nominal power
v. Full nominal system operation testing
e. Inherent safety test program
i. Test program to verify inherent safety characteristics in relevant
identified accident scenarios
f. Medium term operation verification
i. Corrosion and neutron damage test specimen examination
This report is confidential and is for the intended recipient only. Access, disclosure, copying, distribution by
anyone outside the intended recipient organization is prohibited and constitutes a criminal offence.

Short Biography of the Report Author

Dr. Staffan Qvist
Dr. Staffan Qvist is the chairman of the International Atomic Energy Agency (IAEA)
study on safety systems for advanced/fast nuclear reactors. He received a PhD in
Nuclear Engineering with a focus on the safety of advanced reactor systems from the
University of California Berkeley, and BSc/MSc degrees in Mechanical & Nuclear
Engineering from the Royal Institute of Technology in Stockholm. He is a researcher
at Uppsala University, a visiting scientist at UC Berkeley, and has been a visiting
professor at the Warsaw Technical University and a reactor operator trainer at the
Forsmark Nuclear Power Plant. Dr. Qvist is the inventor the "Autonomous Reactivity
Control" (ARC) system for enhanced passive safety of advanced reactors, recently
supported by a dedicated research program by the US. Department of Energy. Dr. Qvist
represents Sweden to the Technical Working Group on Fast Reactors at the IAEA, and
has published numerous scientific articles on the safety, core design, mechanical
engineering and optimization of advanced nuclear systems.
Contact information
Email: staffanq@gmail.com
Telephone: +46765624043

This report is confidential and is for the intended recipient only. Access, disclosure, copying, distribution by
anyone outside the intended recipient organization is prohibited and constitutes a criminal offence.