Introduction To ThorCon TMSR500 Technology and Passive Safety System

Off-gas, Fuel Transfer, and Instrumentation and Figure 5.11 Location of the off-gas components
Control Systems of TMSR 500

Location of Off-Gas Components
The location of the off-gas components is shown in Figure 5.11.

87 | I n t r o d u c t i o n t o T h o r C o n T M S R 5 0 0 T e c h n o l o g y a n d P a s s i v e

Safety System

Off-gas, Fuel Transfer, and Instrumentation and Figure 5.12 Off-gas Flow and Containment Diagram
Control Systems of TMSR 500

Off-Gas Flow and Containment
The off-gas flow and containment diagram can be seen in Figure 5.12.

88 | I n t r o d u c t i o n t o T h o r C o n T M S R 5 0 0 T e c h n o l o g y a n d P a s s i v e

Safety System

Off-gas, Fuel Transfer, and Instrumentation and
Control Systems of TMSR 500

In terms of isotope removal, the off-gas performance is dependent on the heat
indicator, because isotope decay generates heat. The location of the heat
indicates the most likely location of the isotope. The xenon and krypton will
remain and decay in the Can, because the header tanks, OGR-1, and OGR-2
are in the Can and will be replaced every four years. Certain isotopes with a
longer half-life can escape from the Can and enter the holdup tanks. For
example, Kr-85 has a very long half-life and will remain in the system for an
extended time. The others, such as Xe-131m and Xe-133, will decay within the
holdup tank and charcoal bed. Table 5.2 depicts the decay of xenon and krypton
isotopes in each component. When the off-gas and charcoal bed contains a high
concentration of Kr-85 as the radioactive isotope, the Kr-85 will be separated
from the helium gas in the cold trap. The helium gas that returns to the
recirculation will not be the same as the fresh helium. It may still have minor
contamination, but it is very close to fresh helium.

Table 5.2 Decay of Kr and Xe Isotopes

Heat (W) HDR OGR-1 OGR-2 HUP-1 HUP-2 CBED Total
12 0 0 0 0 85
Kr-83m 73 1 1 40 39 12 93
39 0 0 0
Kr-85 0 3264 0 0 0 0 11612
322 0 0 0 3185
Kr-85m 8309 61839 188 0 0 0 3 × 105
867 0 0 0 0 2 × 105
Kr-87 2863 0 4 0 470
0 45 191 42 0 283
Kr-88 2 × 105 32 18864 0 0 43362
9813 11051 0 0 1428
Kr-89 2 × 105 556 395 225 0 0 2 × 105
94346 6156 125 0 0 16419
Kr-90 470 363 0 0 0 2 × 105
10616 0 0 85 12 4 × 105
Xe-131m 11 2010 0 0 106
2 × 105 0
Xe-133 3591 17875 19446

Xe-133m 251

Xe-135 105

Xe-135m 16056

Xe-138 2 × 105

Xe-137 4 × 105

Total Heat 106

HDR = Header Tank

OGR = Off Gas Recuperators

HUP = Holdup Tank

CBED = Charcoal Bed

89 | I n t r o d u c t i o n t o T h o r C o n T M S R 5 0 0 T e c h n o l o g y a n d P a s s i v e

Safety System

Off-gas, Fuel Transfer, and Instrumentation and
Control Systems of TMSR 500

In the off-gas system, the daughter isotopes will accumulate. The major daughter
is calculated and listed in Table 5.3. The Can will contain the majority of the
daughter products, which will be replaced every four years. The header tank and
recuperators have a four-year lifetime as the Can. The holdup tanks and the
charcoal bed have an 80-year lifetime. Along with Rb-85, the main daughter
product in the holdup tank and charcoal bed will be cesium.

Table 5.3 Isotope Accumulation in Off-gas System

HDR OGR-1 OGR-2 HUP-1 HUP-2 CBED

Duration 4 4 4 80 80 80
(years)
Rb-83 0.000 0.000 0.001 0.358 0.342 0.107
Rb-85 3.035 1.192 0.014 0.001 0.000 0.000
Rb-87 7.096 0.798 0.000 0.000 0.000 0.000
Sr-88 8.725 2.161 0.007 0.000 0.000 0.000
4.283 0.020 0.000 0.000 0.000 0.000
Y-89 0.013 0.000 0.000 0.000 0.000 0.000
Sr-90 2.770 7.568 8.523 290.978 0.649 0.002
Cs-133 19.088 14.515 0.947 0.383 0.000 0.000
Cs-135 26.022 1.808 0.000 0.000 0.000 0.000
Ba-138 12.699 0.071 0.000 0.000 0.000 0.000
Cs-137 83.729 28.134 9.492 291.720 0.991 0.109
Total

90 | I n t r o d u c t i o n t o T h o r C o n T M S R 5 0 0 T e c h n o l o g y a n d P a s s i v e

Safety System

Off-gas, Fuel Transfer, and Instrumentation and
Control Systems of TMSR 500

5.3. Instrumentation and Control System (I&C)
According to the IAEA review on the Terminology Used in Nuclear Safety and
Radiation Protection (2018), the plant equipment will be divided into several
items, as shown in Figure 5.13.

Figure 5.13 Review of Plant Items
The TMSR 500 plant has a control philosophy that is different from the LWRs
due to the intrinsic characteristics of the plant. The power control system is load-
following and is not important to safety. TMSR 500 uses automation to replace
most manual inputs from the operators. The operators have limited require
functions:

• Interface with grid,
• Change operating modes,
• Configure plant for maintenance,
• Initiate a SCRAM or drain, and
• Activate non-nuclear emergency systems.
The Instrumentation and Control Architecture of TMSR 500 is shown in Figure
5.14. TMSR 500 has a protection system that shuts the reactor down and keeps
the emergency cooling. In most cases, the reactor shutdown will only use either
shutdown rods or drain the fuelsalt. But in some very limited case, there might
be some valves also need to be turned off.

91 | I n t r o d u c t i o n t o T h o r C o n T M S R 5 0 0 T e c h n o l o g y a n d P a s s i v e

Safety System

Off-gas, Fuel Transfer, and Instrumentation and
Control Systems of TMSR 500

Main Control Backup Control External of
Room the Plant
Room
(per PMOD)

Information Network

Protection Power Fuel Off-gas Salt Loops PMOD PMOD Radiation BOP Control
Control Control Control Support Monitoring Systems
System Control Transfer & System Systems Systems Systems
(per PMOD) System Makeup (per PMOD) Systems
Control
System

Sensors and Actuators

Figure 5.14 The Simplified I&C Architecture

The TMSR 500 has two modules, and the figure above only depicts the system
for one of them. Each module will have its independent control system, such as
the power module control, but it may also share some control systems, such as
the PMOD support system, radiation monitoring system, and BOP Control
Systems. Those control systems are connective sensors and actuators and a
connected information network. The information will be passed to the main
control room, and the backup control room. The protection system is also directly
connected to the main control room and backup control room, so if the network
experiences any problems, it will not affect the protection system. However, it
may be necessary to provide information about the power plant to a control
center run by the government or TMSR 500. For example, in the United States,
government agencies may be interested in the radiation levels surrounding the
power plant.

92 | I n t r o d u c t i o n t o T h o r C o n T M S R 5 0 0 T e c h n o l o g y a n d P a s s i v e

Safety System

Off-gas, Fuel Transfer, and Instrumentation and Figure 5.15 Main Control Room Location
Control Systems of TMSR 500

93 | I n t r o d u c t i o n t o T h o r C o n T M S R 5 0 0 T e c h n o l o g y a n d P a s s i v e

Safety System

Off-gas, Fuel Transfer, and Instrumentation and
Control Systems of TMSR 500

The main control room is located in the Operation House superstructure on the
Main Deck's Port Aft corner. Each power module has its backup control room,
which is located between the Main Deck and the HVAC Deck, Aft of the Decay
Heat Cooling Pond. Figure 5.15 depicts a cross-section of the main control room.
The operation deck is located on the same level as the main deck, which houses
the control room. Aside from the control room, there are several other rooms
used to support the operation.

Figure 5.16 Backup Control Room and Control Systems Room
Figure 5.16 shows control systems in the backup control room. The working deck
is located above the Can and the salt holding tank, so people can access this
floor while working in the room. There is a pump controller as well as an
instrument panel. Figure 5.17 depicts the backup control and the location of the
control system.

94 | I n t r o d u c t i o n t o T h o r C o n T M S R 5 0 0 T e c h n o l o g y a n d P a s s i v e

Safety System

Off-gas, Fuel Transfer, and Instrumentation and Figure 5.17 Backup Control and the Control System
Control Systems of TMSR 500

95 | I n t r o d u c t i o n t o T h o r C o n T M S R 5 0 0 T e c h n o l o g y a n d P a s s i v e

Safety System

Off-gas, Fuel Transfer, and Instrumentation and
Control Systems of TMSR 500

The bottom deck is the HVAC and it is not accessible during the power operation,
but the silo deck and the upper are accessible. There are controllers, control
panels, and sensor panels. The silo deck and the upper deck can be used as the
backup control room. Many of the switchboards and controllers are also on those
two decks.

96 | I n t r o d u c t i o n t o T h o r C o n T M S R 5 0 0 T e c h n o l o g y a n d P a s s i v e

Safety System

Off-gas, Fuel Transfer, and Instrumentation and
Control Systems of TMSR 500

SUMMARIES

1. TMSR 500 is a Molten Salt Reactor that using fuel in liquid, the 7 out of
14 normal operating modes are related to the fuel transfer.

2. The fuel is transferred to the pot through the header tank.
3. There is a manifold with valves that directs the salt flow with one source

and one destination.
4. Connections to the manifold include: Can A FDT, Can B FDT, Can A

Header tank, Can B Header tank, holding tank, transfer cask, and vault.
5. TMSR 500 uses helium as the cover gas for transfer of fuel salt, dry seal,

and removal of gaseous neutron poisons.
6. The main function of an off-gas system are:

a. Supply and circulate helium cover gas
b. Cool the off-gas and return most of them to the primary loop
c. Remove and contain radioactive isotopes
d. Separate krypton and xenon from helium
e. Remove other unwanted gases, mist, and particles
7. The power plant has a control philosophy that is different from that of the
LWRs due to the intrinsic characteristics of the plant
8. The power control system is a load-following system and is not important
to the safety
9. The reactor uses automation to replace most manual inputs from the
operators
10. The operators have limited require functions such as:
a. Interface with grid
b. Change operating modes
c. Configure plant for maintenance
d. Initiate SCRAM of drain
e. Activate non-nuclear emergency systems

97 | I n t r o d u c t i o n t o T h o r C o n T M S R 5 0 0 T e c h n o l o g y a n d P a s s i v e

Safety System

Off-gas, Fuel Transfer, and Instrumentation and
Control Systems of TMSR 500

YOUTUBE VIDEO OF THE TRAINING RECORD:

98 | I n t r o d u c t i o n t o T h o r C o n T M S R 5 0 0 T e c h n o l o g y a n d P a s s i v e

Safety System

TMSR 500 Design and Safety Assessment Process and
Typical MSR Events

Chapter 6. TMSR 500 Design and Safety Assessment
Process and Typical MSR Events

6.1. Safety Philosophy
The TMSR 500 safety is based on control, cool, and contain, which are
abbreviated as the "3 Cs". These three Cs are implemented in TMSR 500 by
eliminating hazards by design rather than mitigation measures. There are mainly
two sources of hazards:

1. Human errors
There have been numerous accidents in history that were either entirely or
partially caused by human error. As a result, TMSR 500 is improving the design
to include procedures systems that can reduce human errors. As a result, the
TMSR 500 will prevent and reduce the possibility of human error compromising
safety.

2. Loss of power
Many of the TMSR 500 system that requires power. As a result, if power is lost,
some systems will fail to function properly. The use of systems that do not rely
on power will eliminate hazards. As a result, even if power is lost, the systems
will continue to function normally.

Even if TMSR 500 tries its best to eliminate hazards, there will still be internal
and external hazards that could happen. Therefore, to manage the residual
hazards, TMSR 500 follows the defense-in-depth concepts consistent with the
IAEA requirements and demonstrates the safety to validate that TMSR 500
design is much safer than the previous generation of NPP instead of relying on
procedures and analysis.

Currently, ThorCon is planning to construct a full scale Pre-Fission Test Bed
Platform without nuclear fuel to demonstrate the safety of the plant, so that
we can further improve safety for the future power plants.

99 | I n t r o d u c t i o n t o T h o r C o n T M S R 5 0 0 T e c h n o l o g y a n d P a s s i v e

Safety System

TMSR 500 Design and Safety Assessment Process and
Typical MSR Events

6.2. Safety Objectives, Goals, and Acceptance Criteria
The hierarchy of the safety objectives are:

a. General safety objective

The general safety objectives of TMSR 500 are:
1. Protect individuals, society, and the environment from any type of harm;
2. Reduce the overall risks to society, the local, and the global environment.

In terms of safety, it is not only about the risk posed by the plant. It is also about
the risk that could be reduced by introducing this plant into society. For example,
the power plant will inevitably introduce some risk, but providing this power with
almost no carbon emissions and no pollution will also reduce the overall risk to
society.

b. Radiation protection objective

The radiation protection projective of TMSR 500 is to protect individuals and the
environment from any harmful effects of ionizing radiation by strictly adhering to
the radiation dose limit specified in regulations. Those are the highest-level
objectives. As a result, it must be converted to quantitative values. Then, it can
be incorporated into the design and demonstrated through the safety evaluation.

c. Radiological acceptance criteria

This criterion is quantifiable. At the normal operations, those limits will be less
than those specified in Schedule III of IAEA Safety Standards No. GSR Part 3,
for planned situations that are accepted by the international community.
The TMSR 500’s committed whole-body dose for any member of the public, at
or beyond the site boundary, for 30 days after an event will be:

a. < 0.5 mSv for any Anticipated Operational Occurrences (AOO), and
b. < 20 mSv for any Design Basis Accident (DBA).
The safety assessment of the TMSR 500 demonstrates that the values are within
those limits and are considered safe.

100 | I n t r o d u c t i o n t o T h o r C o n T M S R 5 0 0 T e c h n o l o g y a n d P a s s i v e

Safety System

TMSR 500 Design and Safety Assessment Process and
Typical MSR Events

d. Safety goals
The TMSR 500 does not necessitate the temporary evacuation or long-term
relocation of the local population, and under any accident conditions, no one
would want to be evacuated or relocated. Thus, any accident would be avoided
if TMSR 500 was used. These safety objectives are designed to supplement
radiological acceptance criteria.
e. Technical acceptance criteria
The TMSR 500 is developing the technical acceptance criteria for the systems
based on the radiation acceptance criteria and safety goals. For example, TMSR
500 is developing the temperature and pressure limits for the vessels, the pipes,
and the containers. Those technical acceptance criteria will have to be
discussed with and approved by the regulators. TMSR 500 is intended to use
the technical acceptance criteria to be developed as a safety assessment.
6.3. Design Process
The TMSR 500 has already established the design objectives and is responsible
for ensuring that those objectives are achieved. TMSR 500 accomplishes this
through a methodological approach. The design will be divided into phases:
conceptual, preliminary, and detailed engineering design. The design process
overview from the conceptual engineering design up to commercialization is
depicted in Figure 6.1 – Figure 6.4.

101 | I n t r o d u c t i o n t o T h o r C o n T M S R 5 0 0 T e c h n o l o g y a n d P a s s i v e

Safety System

TMSR 500 Design and Safety Assessment Process and
Typical MSR Events

Figure 6.1 TMSR 500 Design Process Overview – Conceptual Engineering
Design

The first step of the conceptual engineering design is to establish the
requirements from the safety objectives radiological acceptance criteria, and it
will also contain the design requirements. For example, how many days a year
do they generate power, how much power is generated, and what is the cost of
the power. After the design is established, it will be verified in several ways, such
as design review, confirmatory analysis, and the most important one is to do a
safety assessment. If there are some issues, the process goes back to the design
requirements. It will be reviewed until it meets the requirements. If there are no
issues, the process moves into the next phase, as shown in Figure 6.2.

102 | I n t r o d u c t i o n t o T h o r C o n T M S R 5 0 0 T e c h n o l o g y a n d P a s s i v e

Safety System

TMSR 500 Design and Safety Assessment Process and
Typical MSR Events

Figure 6.2 TMSR 500 Design Process Overview – Preliminary Engineering
Design

In the preliminary engineering design phase, the conceptual design is examined
into systems and the requirement of each system is also defined. After the
system has been completed, the preliminary design integration and preliminary
design verification must be completed. The next step is a detailed engineering
phase, as shown in Figure 6.3.

103 | I n t r o d u c t i o n t o T h o r C o n T M S R 5 0 0 T e c h n o l o g y a n d P a s s i v e

Safety System

TMSR 500 Design and Safety Assessment Process and
Typical MSR Events

Figure 6.3 TMSR 500 Design Process Overview – Detail Engineering Design
The detailed engineering design starts with validation, which is done by test. In
this phase, the component tests will be done on the testbed platform setup. After
the validation is done, the next step is to do the detailed design for the systems
with the input from the test and then verify them. If the verification and validation
are done, the next phase is the detailed design validation. This phase flow is
shown in Figure 6.4.
104 | I n t r o d u c t i o n t o T h o r C o n T M S R 5 0 0 T e c h n o l o g y a n d P a s s i v e

Safety System

TMSR 500 Design and Safety Assessment Process and
Typical MSR Events

Figure 6.4 TMSR 500 Design Process Overview – Detail Design Validation
In this phase, the commissioning and operation of the plant will be demonstrated.
The entire safety philosophy of TMSR 500 is based on tests. As a result, the
demonstration plant will also serve as a testing facility. The demonstration plant
will not only generate power, but it will also generate the data needed for the
power plant's future generation. After the power plant is commercialized, the next
step is to build more power plants and continuously use the knowledge gained
from operations and tests to improve the design.
6.4. Safety Assessment
The safety assessment is an important step in verifying the design of the TMSR
500. It will be the primary tool for verifying the safety objectives, safety goals, and
acceptance criteria. Figure 6.5 depicts the scope of the safety assessment.

105 | I n t r o d u c t i o n t o T h o r C o n T M S R 5 0 0 T e c h n o l o g y a n d P a s s i v e

Safety System

TMSR 500 Design and Safety Assessment Process and
Typical MSR Events

Figure 6.5 Overview of the Safety Assessment Process
106 | I n t r o d u c t i o n t o T h o r C o n T M S R 5 0 0 T e c h n o l o g y a n d P a s s i v e

Safety System

TMSR 500 Design and Safety Assessment Process and
Typical MSR Events

The safety assessment is a systematic approach to generate evidence that the
safety objectives are met based on the design information. Several things need
to be done:

a. Determine the safety functions
b. Confirm the safety classification
c. Confirm the plant's states (operational states and accident conditions)
d. Identify the external and internal hazards and Postulated Initiating Events
(PIE)

All the safety analysis reports study all kinds of events. The safety analysis of
TMSR 500 started with the identification of postulated initiating events (PIE).
PIEs were gathered from multiple sources in the conceptual design phase, such
as:

a. Reviews of ORNL MSRE report
b. Studies on MSR by academic institutes such as ANL or UC Berkeley
c. Studies on MSR by industrial groups such as the US ANS-20.2 working

group
d. Studies of potential failure of each component by TMSR 500
e. Relevant Events in paragraphs 3.124 and 3.125 of IAEA Safety Guide

No. GS-G-4.1
f. Relevant events in NUREG-0800, Chapter 15
g. Relevant events provided by the Indonesia Nuclear Professional

Association

These PIEs are validated using systematic methods such as Master Logic
Diagram (MLD). This validation is to ensure that all component failures and
Hazard and Operability Analysis (HAZOP) are addressed. With all of these
different sources of PIEs and a systematic method for verifying the list, TMSR
500 is confident that all of the important PIEs will be identified in the safety
analysis.

107 | I n t r o d u c t i o n t o T h o r C o n T M S R 5 0 0 T e c h n o l o g y a n d P a s s i v e

Safety System

TMSR 500 Design and Safety Assessment Process and
Typical MSR Events

The PIEs are classified according to their frequency of occurrence to apply
appropriate radiological acceptance criteria and analytical methodologies
(graded approach). For example, the AOO’s frequency of occurrence is ≥ 10-2
per reactor year, while the DBA has a lower frequency of occurrence that is
between 10-2 and 10-6 per reactor year. Then some events happen with a
frequency of occurrence that is less than 10-6 and is considered Beyond Design
Basis Accidents (BDBA). There is also a condition called Design Extension
Condition (DEC), and these are the concepts that became very popular after the
Fukushima accident.

The PIEs will be put into different cut arrays based on their frequency, and then
the pieces will also be grouped. There are two purposes for grouping the PIEs:
improving comprehensiveness and to choosing a few PIEs within each of the
groups to do further analysis. The PIEs are classified as follows:

a. Reactor PIEs: sudden loss of fuelsalt flow from freezing pump shaft
bearings, etc.

b. Power conversion PIEs: impairment of seawater cooling flow, etc.
c. Safety systems PIEs: break or plug in cold-wall or its piping, etc.
d. Plant infrastructure PIEs: loss of all electric power including all AC and DC

supplies and batteries, etc.
e. External PIEs: earthquake, etc.
f. Fuelsalt and Can transfer PIEs: crane dropping spent fuelsalt cask, etc.
g. Operator action PIEs: intentional inappropriate actions.
h. Historical PIEs: PIEs at Chernobyl and Fukushima, etc.

Those are the representative PIEs that can be chosen from those groups for
further analysis, but TMSR 500 will generate more groups and sub-groups.
TMSR 500’s full current list of PIEs is shown in Table 6.1 – Table 6.8. When the
design is approved, there will be additional PIEs identified and combined.

108 | I n t r o d u c t i o n t o T h o r C o n T M S R 5 0 0 T e c h n o l o g y a n d P a s s i v e

Safety System

TMSR 500 Design and Safety Assessment Process and
Typical MSR Events

Table 6.1 Reactor PIEs Group

Initiating Event Progression and Mitigating Safety Impact
Events Action

Loss of fuelsalt Fuelsalt temperature in reactor core None. Radioactive hazard
flow keeps rising. Draining of fuelsalt activated contained.
when temperature exceeds 750°C.

Shutdown rod Fuelsalt temperature in reactor core None. Radioactive hazard
withdrawal keeps rising. Draining of fuelsalt activated contained.
when temperature exceeds 750°C.

Excess makeup Fuelsalt temperature in reactor core None. Radioactive hazard
fuelsalt addition keeps rising. Draining of fuelsalt activated contained.
when temperature exceeds 750°C.

Fuelsalt cold Fuelsalt in temperature in PHX decreases None. Radioactive hazard
slug introduction leading to an increase in core reactivity contained.
when reactor restarted with cold fuelsalt.
Operator action needed to ensure PHX is
operating.

Fuelsalt pump Reactivity is controlled by adding thorium None. Radioactive hazard
stop or restart
make-up salt. contained.

Freeze valves May result in rupture of primary loop None. Radioactive hazard
time lag piping leading to draining of fuelsalt contained. Economic impact
leading to shut down of plant. due to replacement of Can.

Reactivity Increased temperature in reactor triggers None. Radioactive hazard
insertion insertion of shut down rods and draining contained.
of reactor fuelsalt.

Halving salt and Fuelsalt temperature increases and power None.
feedwater flows decreases.

Voids in fuelsalt There is no total positive feedback None.
loop creation of more voids or reactivity.

Cautionary Drain of fuelsalt to FDT. None. Radioactive hazard
controlled contained.
fuelsalt drain

109 | I n t r o d u c t i o n t o T h o r C o n T M S R 5 0 0 T e c h n o l o g y a n d P a s s i v e

Safety System

TMSR 500 Design and Safety Assessment Process and
Typical MSR Events

Station blackout Pumps circulating fuelsalt, secondary salt, None. Radioactive hazard
(SBO) solar salt, and turbine feedwater all stop, contained.
interrupting fuelsalt cooling via the primary
Frozen fuelsalt heat removal path to seawater. The loss
pump bearings of electric power interrupts helium cooling
of the freeze valves, initiating melting of
the fuelsalt plugs and draining of fuelsalt
to FDT and shutdown rod insertion.

Fuelsalt circulation will stop. Increased None. Radioactive hazard

temperature triggers shutdown rod contained.

insertion, freeze valve opening and

draining of fuelsalt to FDT.

Fuelsalt pump Fuelsalt circulation will stop. Increased None. Radioactive hazard
shaft break temperature triggers shutdown rod contained.
insertion, freeze valve opening and
draining of fuelsalt to FDT.

Primary loop Fuelsalt falls to bottom of Can, flows to None. Radioactive hazard
rupture
FDT and cooled by radiation to cold-wall. contained.

Large crack in Consequences similar to primary loop None. Radioactive hazard
primary loop rupture. contained.

Freeze valve Small diameter plug will move to the FDT None. Radioactive hazard
plug breakaway as a solid without clogging the drain-tank contained.
piping.

Primary heat No immediate transfer of fuelsalt to None. Radioactive hazard
exchanger secondary loop because of lower primary contained.
failure loop pressure. Primary heat exchanger
will be isolated once the leak is detected.

Loss of primary Increased temperature and fuelsalt drain. None. Radioactive hazard

heat sink contained.

Off-gas system Some Xe-135 would be dispersed into the Impact needs to be further
rupture inert gas atmosphere in the Can Silo, or analyzed.
into the gas-tight section of the Grid, or
into the basement of the SHX cell
depending on the location of rupture.

Off-gas system Increased header pressure leads to None. Radioactive hazard
blockage reactor shutdown. contained.

Off-gas cold trap Plant continues to operate for hours until None.

failure repairs can be done.

110 | I n t r o d u c t i o n t o T h o r C o n T M S R 5 0 0 T e c h n o l o g y a n d P a s s i v e

Safety System

TMSR 500 Design and Safety Assessment Process and
Typical MSR Events

Unexpected Increased temperature leads to reactor None. Radioactive hazard
fuelsalt partial shutdown. contained.
drain

UO2 Not credible due to limited oxygen and None.
precipitation in existence of Zr in Can.
fuelsalt

Overheating of Fuelsalt drains to FDT. None. Radioactive hazard
Pot or piping contained.

Pump motor Decreased reactivity. None.
overspeed/
under speed

Major break in Fuelsalt will fall to bottom of Can and None. Radioactive hazard
fuelsalt piping drain to FDT. contained.

Fuelsalt drain Fuelsalt will drain to the water-cooled None. Radioactive hazard
tank rupture fuelsalt catcher. contained.

Fuelsalt freeze Pot is fitted with preheating tape that None. Reactor is already
up could be used to melt frozen fuelsalt. FDT shutdown.
cylinders are fitted with heating rods to
melt fuelsalt for transfer.

Freeze valves Increased temperature, no fission energy None. Radioactive hazard
fail to drain and hot standby mode entered. Should contained.
measurement rods fail, and pumps also
fail, temperature increase would breach
primary loop piping and drain fuelsalt to
FDT.

Running out of Radioactive fission product gases will None
bearing seal gas remain contained by a sealed tophat

enclosing the pump motor.

Off gas system Offgas piping is double walled. Leaks are None. Radioactive hazard
leaks detected by monitoring the space contained.
between concentric pipes.

Krypton bottle Kr-85 may leak into the SHX cell. Impact needs to be further
fracture analyzed

Fuelsalt pump Reactor shutdown by control system. None.
impeller damage

111 | I n t r o d u c t i o n t o T h o r C o n T M S R 5 0 0 T e c h n o l o g y a n d P a s s i v e

Safety System

TMSR 500 Design and Safety Assessment Process and
Typical MSR Events

Enriched Falls to bottom of Can and flows to FDT. None.
uranium None.
makeup fuelsalt Increased temperature leads to reactor None. Thorium is not fissile.
tank leak shutdown. None.
Makeup fuelsalt Tank drains to Can and to FDT. None.
dump to Pot None.
Thorium molten Increased temperature leads to fuelsalt None.
salt makeup drain to FDT. None. Can will be replaced
tank leak for large breaches.
Uncontrolled Same consequence as uncontrolled
measurement measurement rod withdrawal. None.
rod withdrawal None.
Measurement Reactor shuts down.
rod
maloperation No small lines carrying fuelsalt outside
Measurement containment.
rod drop
accident For small failure, some radioactive gases
Failure of small would be released into the Silo filled inert
lines carrying gas. A very large breach of the fuelsalt
fuelsalt outside boundary might result in fuelsalt being
containment spilled to the bottom of the Silo onto the
Fuelsalt Fuelsalt Catcher. Failure of the primary
boundary failure heat exchanger tubes would result in
fuelsalt dilution and increase in volume.
Coolant Reactor will shut down.
Pressure Reactor will be shutdown.
Boundary
Failure After power and temperature increases,
Anticipated stable state achieved. None. Maximum
transients reactivity insertion Increased temperature
without scram

112 | I n t r o d u c t i o n t o T h o r C o n T M S R 5 0 0 T e c h n o l o g y a n d P a s s i v e

Safety System

TMSR 500 Design and Safety Assessment Process and
Typical MSR Events

Interruption of Freeze valve opens and fuelsalt drains to None.
primary heat FDT.
transport path

Cooling pond Expansion tank, onboard desalination None.
water loss system, on-deck deluge pumps or
fireboats will provide make up water.

Plugged cold- Partitioned cold-wall design provides None.
wall water adequate cooling.
circulation

Severe rupture Reactor is shut down and fuelsalt is None.
of cold-wall drained to FDT.

Loss of cold-wall Same consequence as severe rupture of None.

heat removal cold-wall.

path

Loss of both Ultimate heat removal is by water in the None.
primary and hull ballast tanks. None.
cold-wall heat
removal paths Reactor shuts down. Fuelsalt is drained to
FDT.
Severe vibration
in rotating
machinery

113 | I n t r o d u c t i o n t o T h o r C o n T M S R 5 0 0 T e c h n o l o g y a n d P a s s i v e

Safety System

TMSR 500 Design and Safety Assessment Process and
Typical MSR Events

Table 6.2 Safety System PIEs Group

Initiating Event Event Progression and Mitigating Safety Impact
Action

Cold-wall Cooling maintained through back-up None.
cooling failure cooling provided by two sources – an
expansion tank and the freshwater
production system.

Cooling pond Back-up water supply available from the None.
runs dry fresh water supply system and seawater
from fire-fighting system.

Cold-wall Cooling is maintained by another passive None.
cooling blocked cooling path which is the basement
surrounding the Silo that is filled with
water.

Fuelsalt drain- Fuelsalt is collected and contained in the None. Radioactive materials
tank rupture Silo which is lined with steel. The steel are contained.
liner is cooled by the Silo Hall basement
water. The salt pools in a pancake shape
geometry which is criticality safe.

Cold-wall Reactor is shut down and fuelsalt is None. Radioactive materials
cooling failure drained to FDT. are contained.

Shut-off rod Reactor is shut down and fuelsalt is None. Radioactive materials
failure drained to FDT. are contained.

114 | I n t r o d u c t i o n t o T h o r C o n T M S R 5 0 0 T e c h n o l o g y a n d P a s s i v e

Safety System

TMSR 500 Design and Safety Assessment Process and
Typical MSR Events

Table 6.3 Power Conversion PIEs Group

Initiating Event Event Progression and Mitigating Safety Impact
Action

Seawater Redundancy provided by having back-up None. Radiation hazard is
cooling pump pump. Two of three pumps required for contained.
failure operation at 100%. Reactor operates at
50% with only one pump and shuts down None. Pump redundancy
Impairment of if all three pumps fail. provided.
seawater
cooling flow Likely cause is debris or sea life.

Impairment will be detected and

corrective action taken.

Loss of Commercial power production None. Economic impact.
condenser interrupted. Reactor kept in hot stand-by
vacuum by sentry turbine generator.

Output Plant will shut down. Transformer None. Economic impact.
transformer replaceable in 2 days.
failure

Steam Solar salt loop fitted with open standpipe None. Radiation hazard is
generator tube to relieve pressure allowing solar salt to contained.
rupture rise and discharge the salt/steam mixture
into a quench tank. None. Radiation materials
Turbine blade containment not impacted
missile Adequate separation (>20 meters) and due to separation.
breaches compartment barriers between turbine
and Fission Island.

Steam- The Fission Island containing radioactive None. Economic impact.
catapulted materials is protected adequate
missile separation. There are two walls between
breaches steam pipes and Fission Island.

Feedwater Commercial Power production None. Economic impact.
system breaks interrupted. In-house power from sentry None. Economic impact.
turbine keeps reactor in hot standby
Decrease in mode. Reactor will shut down if all power
secondary salt is lost.
inventory
Reactor transitions to cold shutdown
mode upon detection of reduction in salt
inventory.

Decrease in Reactor transitions to cold shutdown None. Economic impact.
tertiary salt mode upon detection of reduction in salt
inventory inventory.

115 | I n t r o d u c t i o n t o T h o r C o n T M S R 5 0 0 T e c h n o l o g y a n d P a s s i v e

Safety System

TMSR 500 Design and Safety Assessment Process and
Typical MSR Events

Table 6.4 Plant Infrastructure PIEs Group

Initiating Event Event Progression and Mitigating Safety Impact
Action

Station blackout Reliance on passive safety systems. No impact on reactor safety.
Total station blackout invokes shutdown
via the opening of the freeze valves and
transfer of the fuelsalt to the FDT where
decay heat removal and cooling
dependence on the cold wall and passive
heat rejection to the cooling pond and
atmosphere.

Power control The design intent is that the power control None.
system failure system should not be important to safety.

Sentry turbine- In-house power can be supplied by either No impact on reactor safety.
generator failure the grid connection or partial use of the
power generated by the main TG pending
reactor shutdown to hot standby mode for
repair of the Sentry TG. In the event of
loss of grid connection during this
condition the main TG and reactor cannot
continue to operate, and the freeze
valves would open transferring the
fuelsalt to the FDT with decay heat
removal passively via the cold wall and
cooling pond to atmosphere.

Fire Potential for reliance on passive safety Impact to be determined.

systems for shutdown to FDT and cold

wall stored and decay heat removal.

Flooding No issues if managed as intended by No impact on reactor safety.
dewatering systems. Severe flooding in
excess of built-in dewatering capability
has potential to invoke reliance on
passive safety systems. No criticality risk
with reactor shutdown and fuelsalt in
FDT.

116 | I n t r o d u c t i o n t o T h o r C o n T M S R 5 0 0 T e c h n o l o g y a n d P a s s i v e

Safety System

TMSR 500 Design and Safety Assessment Process and
Typical MSR Events

Table 6.5 External Hazards PIEs Group

Initiating Event Event Progression and Mitigating Safety Impact
Action

Loss of Load Loss of electrical load results in the No impact on reactor safety.
Fire reactor power running back to low power
operation in hot standby mode with the No impact on reactor safety.
Sentry TG supplying in house power No significant damage
requirements. In the event of extended anticipated inside the hull.
loss of grid connection, reactor can be
shutdown with fuel transferred to FDT for
passive cooling.
Ship hull design resists external fire

penetrating inside the hull even for

extreme scenarios such as fuel from

aircraft crash. Potential loss of grid

connection and electrical load and

damage to cranes and shore-based

installations. Potential for reliance on

passive safety systems.

Tornado or Ship hull design and protection by No impact on reactor safety.
hurricane
breakwater provide capability to withstand No significant damage

severe weather events. Potential loss of anticipated inside the hull.

grid connection and electrical load and

damage to cranes and shore-based

installations. Potential for reliance on

passive safety systems.

Tsunami Ship hull design and protection by No impact on reactor safety.
breakwater provide capability to withstand No significant damage
tsunamis. Extreme tsunamis have anticipated inside the hull.
potential to float the hull and reconfigure
the seabed under the hull. Potential loss
of grid connection and electrical load and
damage to shore-based installations.
Potential for reliance on passive safety
systems.

Earthquake Hull design and shear limit of the seabed No impact on reactor safety.
on which TC Isle rests enable the hull to No significant damage
withstand very large earthquakes. Loss of anticipated inside the hull.
grid connection and electrical load
expected for large earthquakes. Potential
for reliance on passive safety systems.

117 | I n t r o d u c t i o n t o T h o r C o n T M S R 5 0 0 T e c h n o l o g y a n d P a s s i v e

Safety System

TMSR 500 Design and Safety Assessment Process and
Typical MSR Events

Lightning strike Steel hull protects the shipboard None

internals. Potential for loss of electrical

grid connection and loss of electrical load.

Electromagnetic Steel hull protects the shipboard None
pulse internals. Potential for loss of grid
connection and loss of electrical load.

Aircraft strike Hull highly resistant to full penetration, no No impact on reactor safety.
effect on reactor Pot, Silo or Cold-wall. No significant damage
Potential with fire for results similar to anticipated inside the hull.
total station blackout and full reliance on
passive safety systems.

Ship strike Prevented by breakwater. Ability to strike No impact on reactor safety.
TC hull with a large ship at significant No significant damage
speed not credible. anticipated inside the hull.

118 | I n t r o d u c t i o n t o T h o r C o n T M S R 5 0 0 T e c h n o l o g y a n d P a s s i v e

Safety System

TMSR 500 Design and Safety Assessment Process and
Typical MSR Events

Table 6.6 Fuelsalt and Can Transfer PIEs

Initiating Event Event Progression and Mitigating Safety Impact
Action

Premature Reactor pot temperature can rise at a None. Radioactive materials
criticality while faster rate than intended. contained in fuelsalt drain
filling Pot Thermoswitches are activated shutting tank.
down the fuelsalt addition pump and
opening of the freeze valves allowing
reactor pot content to drain to the fuelsalt
drain tank.

Premature Overheating of fuelsalt in cask. The None. Radioactive material
fuelsalt transfer fuelsalt to cask transfer pump is chose to contained within cask.
to cask have a low transfer rate of 3-6 hours that
allows for adequate cooling of the
fuelsalt.

Crane and Can Can becomes disengaged from crane None. Radioactive material
accident during transfer to the CanShip Silo and will remain contained in the
falls onto the deck of the hull or CanShip. Can.
Best practice rigging procedures are
employed to minimize impact shocks if
the Can is dropped.

119 | I n t r o d u c t i o n t o T h o r C o n T M S R 5 0 0 T e c h n o l o g y a n d P a s s i v e

Safety System

TMSR 500 Design and Safety Assessment Process and
Typical MSR Events

Table 6.7 Operator Action PIEs Group

Initiating Event Event Progression and Mitigating Safety Impact
Action

Malicious By design TMSR 500 safety does not Impact needs to be further
reactor operator depend on correct operator actions. The analyzed
operator cannot take actions that lead to
Malicious crane a radiation release. The operators cannot Potentially similar impact to
operator override passive safety systems that Crane and can accident, see
prevent a release. Fuelsalt and Can transfer
PIEs
A malicious crane operator might attempt
to operate the crane in a way to damage
a Can or fuel cask. The speed with which
the crane can raise, lower, or swing Cans
or casks is limited.

120 | I n t r o d u c t i o n t o T h o r C o n T M S R 5 0 0 T e c h n o l o g y a n d P a s s i v e

Safety System

TMSR 500 Design and Safety Assessment Process and
Typical MSR Events

Table 6.8 Historic PIEs Group

Initiating Event Event Progression and Mitigating Safety Impact
Action

Fukushima Complete loss of electrical power causing None. Heat generating

loss of cooling to heat generating radioactive materials are

radioactive material. Intrinsic passive cooled by passive means.

decay heat cooling is provided in 3 ways -

the normal path to the ocean via the

primary path and its steam condenser,

the always-active cold-wall and cooling

pond, and the basement water cooling.

Chernobyl Improper operator action can lead to None. Radioactive material
temperature excursion in reactor pot. is contained in the fuelsalt
TMSR 500 intrinsic passive safety drain tank and Can Silo.
systems cannot be overridden by
operator actions. Reactor shuts down
automatically if temperature in pot
exceeds the set limit and fuelsalt is
drained to the fuelsalt drain tank.

Three Mile Overheating of fuelsalt in reactor core. None. Radioactive material
Island Reactor shuts down automatically if is contained in the fuelsalt
temperature in pot exceeds the set limit drain tank and Can Silo.
and fuelsalt is drained to the fuelsalt drain
tank. Operator action cannot override
draining.

Windscale Fire resulting from graphite moderator in None. Event not credible
contact with annealed uranium. TMSR with current design.
500 graphite is cooled by molten salt not
air with fire-supporting oxygen. The
graphite operates at a high temperature
so needs no annealing.

121 | I n t r o d u c t i o n t o T h o r C o n T M S R 5 0 0 T e c h n o l o g y a n d P a s s i v e

Safety System

TMSR 500 Design and Safety Assessment Process and
Typical MSR Events

In the TMSR 500 process, the Systems, Structures, and Components (SSCs are
classified based on the safety functions to be performed. There are additional
factors that considered such as:

a. Frequency to be called upon to perform safety functions
b. Consequence of failing to perform safety functions
c. Time to be called upon to perform safety functions following a PIE

The design, manufacturing, testing, and maintenance rules are set based on the
safety classes of the SSCs (graded approach).

The TMSR 500 safety philosophy starts with eliminating the hazards. In case that
all the hazards cannot be eliminated, the defense-in-depth concept is used.
TMSR 500’s concept is to construct a high-quality plant to minimize the frequency
of failure so that TMSR 500 will have higher reliability. If there are system failures,
TMSR 500 is not relying on actuation to maintain safety. But, TMSR 500 is going
to maximize the use of inherent and engineered features. In case a situation
scenario that needed to actuate safety systems, TMSR 500 does that with
automatic actuation systems rather than the operator to take actions.

6.5. Analysis of Scenario like Fukushima Daiichi

The scenario that is like what happened in Fukushima Daiichi has been analyzed.
The methodologies that are used to calculate and simulate the scenario started
with burnup calculations with fission product removal. This calculation is to
obtain:

a. Time evolution of decay heat (SERPENT),
b. Gamma transport simulation aimed at evaluating the decay heat fraction

deposited in graphite (SERPENT),
c. Finite element calculations to fine-tune the thermal model of graphite

blocks (fine mesh CFD, OpenFOAM), and
d. Heat transfer analysis, including radiative heat transfer, for verifying and

fine-tuning of the drain tank model (CFD, OpenFOAM).

122 | I n t r o d u c t i o n t o T h o r C o n T M S R 5 0 0 T e c h n o l o g y a n d P a s s i v e

Safety System

TMSR 500 Design and Safety Assessment Process and
Typical MSR Events

The sequence of the events is shown in Table 6.9. The TMSR 500 plant is
assumed to be in full-power operation. When the earthquake happens, it will be
detected immediately and is called time zero. When the earthquake is detected,
the system will automatically drop the control rod that will take a few seconds to
drop. After 45 minutes, the power plant will lose all the power sources, including
the backup power from diesel generators. Because of the lost power, the pumps
and the primary and secondary salt flow will stop.

Table 6.9 Sequence of Fukushima Events

Event Mark Time
Plant in full power before the
earthquake t0 0
Detect the earthquake t0 0
Start control rod insertion t1 45 min
Lose all power sources due to
tsunami t1 45 min
Stop primary salt flow t2 45 min
Stop secondary salt flow t3 45 + 10 min
Start to drain fuelsalt

Once the power is lost, the power plant will automatically start to drain the
fuelsalt. The freeze valve will take 10 minutes to open and begin draining. As a
result, approximately 55 minutes after the earthquake, the salt will begin to drain
from the Pot into the FDT. In terms of time zero, the start time of the drain is t3.
Figure 6.6 shows that the drain takes approximately 13 minutes. The flow rate
does not change linearly, as shown in Figure 6.7, but there are some jumps
between minutes 100 and 200.

123 | I n t r o d u c t i o n t o T h o r C o n T M S R 5 0 0 T e c h n o l o g y a n d P a s s i v e

Safety System

TMSR 500 Design and Safety Assessment Process and
Typical MSR Events

Figure 6.6 Curve of the Fuelsalt Figure 6.7 Curve of the Fuelsalt Flow
Volume Change Over the Time Rate Change Over the Time

The draining salt comes from two different branches. The heat exchanger branch
and the core branch. As seen in Figure 6.8, the temperature of the core branch
is always lower than the heat exchanger branch. That happens because there is
a moderator inside the Pot. The mass and volume of the moderator will absorb
the heat and keep the fuelsalt temperature in the Pot lower than in the heat
exchanger. As a result, the overall salt temperature is closer to the Pot because
there is more salt in the core compared to the heat exchanger.

124 | I n t r o d u c t i o n t o T h o r C o n T M S R 5 0 0 T e c h n o l o g y a n d P a s s i v e

Safety System

TMSR 500 Design and Safety Assessment Process and
Typical MSR Events

Figure 6.8 Fuelsalt Temperatures and Flow Rates at the Freeze Valve
The volume flow rate changes over time because of the geometry of the system,
as seen in Figure 6.8. The fuelsalt will enter the FDT after it has been drained
from the Can. The FDT is cooled by an outside cold wall, which is a stainless
container filled with water, and heat is transferred from the FDT to the cold wall
via radiation, limited conduction, and convection.

125 | I n t r o d u c t i o n t o T h o r C o n T M S R 5 0 0 T e c h n o l o g y a n d P a s s i v e

Safety System

TMSR 500 Design and Safety Assessment Process and
Typical MSR Events

The temperature of the FDT is increased in the first several hours, then it starts
to go down because of the decay heat in the fuelsalt, as shown in Figure 6.9.
Time zero is the ending time of the drain, which is t3 + 13 minutes. The highest
temperature for the fuelsalt may be over 1000°C, but due to the cooling of the
cold wall, the FDT temperature has never exceeded 1000°C and will fall below
800°C after 20 hours. The FDT's accumulated percentage of life depletion can
be calculated with this temperature, as shown in Figure 6.10. The position of the
fuelsalt at the top level, which is the highest temperature point, is denoted by the
term "top." The bottom is the FDT's bottom, which is the point with the most
stress. The FDT creep life depletion in 1 drain is always less than 1%, indicating
that the damage to the FDT is very minor in this case.

Figure 6.9 Drain Tank Heat Transfer Figure 6.10 Drain Tank Creep Life
Transient Depletion In 1 Drain

The preliminary analysis concludes that if a Fukushima-like scenario occurs at a
TMSR 500 power plant, the fuelsalt temperature will always be less than 1100°C,
which is significantly lower than the boiling point of the fuel, resulting in no boiling
of the fuel and no increase in pressure within the system. The FDT temperature
will then briefly exceed 800°C but remain below 1000°C for the first 20 hours
before dropping below 800°C. Because the cumulative percentage of FDT creep
life depletion is less than 1%, the FDT can theoretically be reused. The reactor
is currently in Safe Shutdown Mode. The first physical barrier, the FDT, suffers
no damage. There are no challenges to the second or third physical barriers, and
no radioactive material is released.

126 | I n t r o d u c t i o n t o T h o r C o n T M S R 5 0 0 T e c h n o l o g y a n d P a s s i v e

Safety System

TMSR 500 Design and Safety Assessment Process and
Typical MSR Events

6.6. Analysis of Other MSR Events
Some events can happen to MSR and have been studied by Oak Ridge and
some other academic institutes. Those events are loss of flow, which means we
do not have any flow in our loop, loss of heat sink, and inadvertently opening the
freeze valve. The TMSR 500 has four multiple freeze valves in parallel to ensure
that the freeze valve will open when an accident happens. There is also a
possibility that the freeze valve will open inadvertently by itself. After analyzing
those events, the conclusion is the same as the Fukushima-like scenario. The
reactor will always go into the safety shutdown mode, there is no damage to the
FDT, there are no challenges to the second and third physical barriers, and there
is no release of radioactive material. These are just preliminary design analyses.
Further analysis will be done to get more information, and further tests will be
done to validate the conclusion of those analyses.

127 | I n t r o d u c t i o n t o T h o r C o n T M S R 5 0 0 T e c h n o l o g y a n d P a s s i v e

Safety System

TMSR 500 Design and Safety Assessment Process and
Typical MSR Events

SUMMARIES

1. The ThorCon’s Philosophy:
a. The 3 Cs (Control, Cool, and Contain)
b. Eliminate the hazard by design (human error and loss of power)
c. Defense in Depth
d. Safety by test (demonstrate the requirements by some tests)

2. The safety objectives, goals, and radiological/technical acceptance
criteria based on the IAEA Safety Standards are applicated in the design
of TMSR 500, such as:
a. < 0.5 mSv for any AOO
b. < 20 mSv for any DBA

3. The PIEs are gathered from multiple sources in the conceptual design
phase

4. PIEs are categorized based on the frequency of occurrence so that
appropriate radiological acceptance criteria and analytical methodologies
may be applied (graded approach)

5. PIEs are grouped to improve the comprehensiveness and to choose to
represent PIEs of the group for further analysis.

6. The PIEs of TMSR 500 are grouped based on their origin.
7. The DiD concept is implemented in the TMSR 500
8. Some important conclusions from the Fukushima-like scenario are:

a. Fuelsalt temperatures under 1100°C, significantly lower than the
boiling point.

b. The FDT temperatures briefly exceed 800°C but under 1000°C for the
first 20 hours, then under 800°C after 20 hours

128 | I n t r o d u c t i o n t o T h o r C o n T M S R 5 0 0 T e c h n o l o g y a n d P a s s i v e

Safety System

TMSR 500 Design and Safety Assessment Process and
Typical MSR Events

YOUTUBE VIDEO OF THE TRAINING RECORD:

129 | I n t r o d u c t i o n t o T h o r C o n T M S R 5 0 0 T e c h n o l o g y a n d P a s s i v e

Safety System

REFERENCES

REFERENCES

ANDREADES, C., et al., Design summary of the Mark-I Pebble-Bed, Fluoride
salt-cooled, High-temperature Reactor commercial power plant, Nucl.
Technol. 195 3 (2016) 223–238.

Benes, O., et al., Cesium and iodine release from fluoride-based molten salt
reactor fuel, Phys. Chem. Chem. Phys., 2021, 23, 9512-9523 (2021)

BRIGGS, R.B., Molten-Salt Reactor Program - Semiannual Progress Report for
Period Ending July 31, 1964, Rep. ORNL-3708, ORNL (1964).

Chen, K., Thorium Molten Salt Reactor Energy System (TMSR) Program Update,
Generation IV International Forum 25th MSR pSSC Meeting, Shanghai,
2018.

Compere E., et al., Fission Product Behavior in the Molten Salt Reactor
Experiment. ORNL-4865, ORNL (1975)

Devanney, J., ThorCon the Do-Able Molten Salt Reactor (Executive Summary),
1.09 Version (2015)

FRAAS, A.P., SAVOLAINEN, A.W., ORNL Aircraft Nuclear Power Plant Design,
Rep. ORNL-1721, ORNL (1954).

FURUKAWA, K., et al., Compact molten-salt fission power stations (FUJI-series)
and their developmental program, ECS Proceedings Volumes 1987 1
(1987) 896–905.

GREENE, S. R., et al., Pre-Conceptual Design of a Small Modular Fluoride Salt-
Cooled High Temperature Reactor (SmAHTR), Rep. ORNL/TM-2010/199,
ORNL (2010).

Holcomb D., et al., An Overview of Liquid-Fluoride-Salt Heat Transport Systems,
ORNL/TM-2010/156, ORNL (2010)

HUKE, A., et al., The Dual Fluid Reactor – A novel concept for a fast nuclear
reactor of high efficiency, Ann. Nucl. Energy 80 (2015) 225–235.

IAEA Safety Glossary, Terminology Used in Nuclear Safety and Radiation
Protection, IAEA (2018)

IAEA, Advances in Small Modular Reactor Technology Developments, 2020
Edition

IAEA, Status Report – ThorCon (Thorcon US, Inc.) USA/Indonesia.

IAEA, Terminology Used in Nuclear Safety and Radiation Protection, 2018

IGNATIEV, V., et al., Progress in Development of Li, Be, Na/F Molten Salt
Actinide Recycler and Transmuter Concept, Proc. Int. Congr. Advances in
Nuclear Power Plants (ICAPP 2007) (2007).

130 | I n t r o d u c t i o n t o T h o r C o n T M S R 5 0 0 T e c h n o l o g y a n d P a s s i v e

Safety System

REFERENCES

JORGENSEN, L., “ThorCon reactor”, Molten Salt Reactor and Thorium Energy
(DOLAN, T.J., Ed.), Woodhead Publishing, Duxford, UK (2017) Ch. 19.

MACPHERSON, H. G., Molten-Salt Reactor Program Quarterly Progress Report
for Period Ending July 31, 1960, Rep. ORNL-3014, ORNL (1960).

MATHIEU, L., et al., The thorium molten salt reactor: moving on from the MSBR,
Prog. Nucl. Energ. 48 7 (2006) 664–679.

Official website of the Shanghai Institute of Applied Physics, www.sinap.cas.cn

PEDERSEN, T.J., A walkthrough of the Copenhagen Atomics Waste Burner
design, Proc. Int. Thorium Energy Conference, Mumbai, India (2015).

Richardson M., Development of Freeze Valve for Use in the MSRE, ORNL-TM-
128, ORNL (1962)

Robertson R., MSRE Design and Operation Report Part I, ORNL-TM-728, ORNL
(1965)

ROBERTSON, R.C., et al., Conceptual Design of a Single-Fluid Molten-Salt
Breeder Reactor, Rep. ORNL-4541, ORNL (1971).

SCHÖNFELDT, T., et al., Molten Salt Reactor, AWA Denmark patent
WO2018229265, PCT/EP2018/065989, Copenhagen (2018).

SCOTT, I., et al., Stable Salt Reactor Design Concept, Thorium Energy Conf.
2015 (ThEC15), Mumbai, India (2015).

Simulation of Loss of Flow Scenario, 2021

TAUBE, M., et al., Molten Chlorides Fast Breeder Reactor Problems and
Possibilities, Rep. EIR-215, Eidg. Institut fur Reaktorforschung,
Wurenlingen, Switzerland (1972).

ThorCon, Conceptual Modes of Normal Operation, 2021

ThorCon, Conceptual Postulated Initiating Events (draft), 2021

ThorCon, Design Process Overview, 2021

ThorCon, Fission Island Technical Summary, version 1.41, 2021
ThorCon, Simulation of “Fukushima-like” Scenario, 2021

ThorCon, Simulation of Accidental Freeze Valve Opening Scenario, 2021

ThorCon, Simulation of Loss of Heat Sink Scenario, 2021

ThorCon, ThorCon Isle Balance of Plant, version 1.40, 2020
U.S. Atomic Energy Agency Commission, “An Evaluation of the Molten Salt

Breeder Reactor” USAEC Report WASH-1222, 1972

131 | I n t r o d u c t i o n t o T h o r C o n T M S R 5 0 0 T e c h n o l o g y a n d P a s s i v e

Safety System

REFERENCES

Workshop on Molten Salt Reactor Technologies – Commemorating the 50th
Anniversary of the Startup of the MSRE, ORNL, 2015

XU, H., Status and Perspective of TMSR in China, Molten Salt Reactor
Workshop, Paul Scherrer Institut, Switzerland (2017), https://www.gen-
4.org/gif/jcms/c_82829/workshops

Zhang R., et al., Hydrogen Behavior after Water‐ingress Accident of HTR‐PM,

Atomic Energy Science and Technology, Vol. 50, No. 5, (2016)

Zhang Z., et al., The Shandong Shidao Bay 200 MWe High-Temperature Gas-

Cooled Reactor Pebble-Bed Module (HTR-PM) Demonstration Power

Plant: An Engineering and Technological Innovation, Engineering, 2, 112-

118 (2016)

Zhao J., et al., The requirement to the reactor vessel auxiliary cooling system of
fluoride salt-cooled high-temperature reactors during station blackout,
Nuclear Techniques, 2017, 40(9): 090603 (2017)

132 | I n t r o d u c t i o n t o T h o r C o n T M S R 5 0 0 T e c h n o l o g y a n d P a s s i v e

Safety System

INDEX

INDEX

AEC 4, 5 Forward 21, 26, 28
Aft Freeze Valve 33, 34, 39, 41, 48,
AMSTER 10, 21, 26, 94 57, 60, 65, 66, 76,
AOO Fuel transfer
ARE 4 Fuelsalt 109 – 112, 116,
BDBA 119, 123, 123
BeF2 100, 108, 128 GIF
BeO GIS 66, 75, 76, 97, 117
BOP 1, 2 Graphite
Bow 1, 2, 12, 30, 32 –
Can 108 HAZOP 34, 36, 37, 42 –
Header tank
2, 12, 30, 42, 60 45, 47, 56 – 59, 65
Heat – 67, 69 – 71, 75,
1 exchanger
76, 78, 79, 91, 108
28, 71, 92 – 114, 116, 119 –
126, 128
21 1
36, 38, 40 – 43, 27, 29, 71
2, 4, 7, 10, 12, 13,
56, 58, 62, 63, 65 15 – 17, 40 – 44,
– 67, 75, 76, 82, 46, 47, 54 – 60,
121, 122
85, 86, 89, 90, 94, 107
108, 110 – 112, 41, 46, 47, 49, 53,
119 – 121 56, 57, 75 – 80,
82, 89, 90, 97
Canship 20, 119 22, 29, 30, 36, 40,
CFD 45, 49, 60, 112 41, 47, 49, 53, 57,
60, 74, 82, 86,
Coldwall 34, 36, 37, 52, 58, 110, 112, 124
66, 85
Core HTGR 4, 36, 55
1, 3, 6, 19, 20, 32, Hull 21, 27, 113, 117,
Corrosion 33, 35, 39, 40, 41,
DBA 42, 44, 46, 49, 51, HVAC 118, 109
DEC I&C 94, 96
Decay 53, 54, 56 – 58, IAEA 91, 92
heat 60, 74, 76, 79,
Deck 109, 121, 124 Inboard 6, 32, 40, 62, 94,
13, 15 – 17, 42 99, 100, 107, 128
FDT 100, 108
108 21
Fission
island 34, 35, 52, 56, 57, LiF 2, 12, 19
Fission 60, 94, 110, 121 LWR
product 21, 25 – 27, 94, 33, 35, 37, 67, 72,
Fluoride 96, 112, 119 Moderator
91, 97
38, 58, 60, 67, 68, 1, 2, 10 – 13, 15,
75 – 78, 97, 109 –
16, 19, 42 – 44,
117
62, 63, 115, 131 60, 121, 124

5, 32, 33, 47, 54,
56, 57, 79, 85

1, 6, 9, 15, 33, 37,
39

133 | I n t r o d u c t i o n t o T h o r C o n T M S R 5 0 0 T e c h n o l o g y a n d P a s s i v e

Safety System

INDEX

MOSEL 3 Sentry turbine 25, 26, 34 – 36,
MSR 1 – 6, 12, 13, 15, 39, 71, 115, 116
16, 19, 20, 33, 48, SFR
MSRE SGC 4
99, 107 SHXC 22, 29
NaF 2 – 5, 12, 17, 19, SSC 22, 29, 82, 86
Stainless steel
NNSA 34, 107 112
Non-fresh 1, 12, 19, 30, 42, 12, 16, 17, 19, 38,
fuel
NSCA 60 39, 42
OGR 17, 18
ORNL 66 – 68, 74 Starboard side 21 – 23, 25 – 27
Stern 21, 27
Outboard 14 Superstructure 21, 94
PHX 56, 57, 80, 89, 90 Tertiary loop
PIE 1, 3, 5, 7, 10, 12, Testbed 30, 39, 68
ThF4 13, 34, 104
PMOD 34, 40, 107 Thorium
Port side 21 42, 60
Pot Three Cs 2 – 4, 6, 12, 30,
57, 109 UF4 41, 53, 66, 74, 75,
Primary 107 – 109, 114 – Uranium
loop 109, 111
121, 128 Used fuel 32, 39, 99
PWR 28, 66, 75, 92 ZrF4 1, 2, 42, 60
Radtank 2, 6, 8, 12, 30, 41,
Reactivity 21, 24, 25 42, 47, 53, 59, 74,
41, 43, 60, 75, 76,
Secondary 97, 110, 111, 119, 111, 121
loop 59, 66, 76, 78
121, 123, 124
30, 46, 49, 58, 68, 1, 2, 12, 42
69, 71, 79, 97, 109

– 111
12, 55
63, 64
15, 32, 33, 39, 44,
46, 51 – 55, 58,
60, 69
30, 39, 64, 69, 110

134 | I n t r o d u c t i o n t o T h o r C o n T M S R 5 0 0 T e c h n o l o g y a n d P a s s i v e

Safety System

LIST OF PARTICIPANTS

LIST OF PARTICIPANTS

Name Organization
PT ThorCon Power Indonesia
Bob Soelaiman Effendi
Tagor Malem Sembiring Nuclear Energy Regulatory Agency of
Heddy Krishyana Indonesia (BAPETEN)
Agnafan Julian Fortin
Lee Youri Mikhaelia
Catur Febriyanto S
Farid Noor Jusuf
Nur Syamsi Syam
Bambang Eko Aryadi
Zulfiandri
Sri Budi Utami
Anri Amaldi Ridwan, ST.,
M.S.M
Helen Raflis
Muhammad Rifqi Harahap
Diah Hidayanti Sukarno
Daddy Setyawan
Arif Isnaeni
Imron
Ade Awalludin
Rahmat Edhi Harianto
Tiar Fridianto
Alfa Gunawan Zulqarnain
Niniek Ramayani Yasintha
Manda Fermilia
Dwi Cahyadi
Haendra Subekti
Suci Prihastuti
Fery Putrawan Cusmanri
Zakki Muhammad
Mira Wahyu NRP
Muhammad Rommy Ramadhan
Dewi Prima Meiliasari
Donni Taufiq
Asytasia Sabathrin Cindananti
Azizul Khakim
Bintoro Aji

135 | I n t r o d u c t i o n t o T h o r C o n T M S R 5 0 0 T e c h n o l o g y a n d P a s s i v e

Safety System

Yudi Pramono LIST OF PARTICIPANTS
Wiryono
Petit Wiringgalih National Nuclear Energy Agency of
Amil Mardha Indonesia (BATAN)
Agus Dwi Purnomo
Prof. Syarip Gadjah Mada University (UGM)
Ir. Puradwi Ismu Wahyono,
DEA Bandung Institute of Technology (ITB)
Muhammad Subekti Sebelas Maret University (UNS)
Endiah Puji Hastuti
Sukmantodibyo University of Illinois at Urbana-Champaign
Alexander Agung University of Sharjah
Dr. Ir. Andang Widi Harto, M.T President University
Almanzo Arjuna
Zidni Zydan NAIS Co., Inc / Tokyo City University
Harfit Benaya Putra WANTANNAS RI
Prof. Abdul Waris APRI
Sidik Permana
Cici Wulandari Rayyan Instruments & Robotics
Alessandro Widjati
Drs. Suharyana, M.Sc
Luqman Satria Pradana
Harun Ardiansyah
Donny Hartanto
Andhika Feri Wibisono
Eko Yuli Winarno
Liem Peng Hong
Hendri Firman Windarto
Dr. Hendri
Syahrir
Hairil

136 | I n t r o d u c t i o n t o T h o r C o n T M S R 5 0 0 T e c h n o l o g y a n d P a s s i v e

Safety System