Safety barriers and defense in depth

Reactor safety is organized around three functions: control reactivity, cool the fuel and contain radioactivity. For the third there is a series of physical barriers. The first is the ceramic uranium dioxide pellet itself, which holds most of the fission products in its crystal lattice. The second is the sealed zirconium-alloy cladding that encloses the pellets in each rod. The third is the primary circuit: the steel vessel, with walls up to 30 cm thick, and its piping. The fourth is the containment building, reinforced concrete at least one meter thick with a steel liner, designed to withstand the pressure of an accident inside and an impact from outside.

On top of those barriers sits defense in depth, which the IAEA formalizes in five levels: prevent failures through conservative design and good operation; detect and control them with protection systems before they become an accident; cope with the accidents anticipated in the design using safety systems; mitigate severe accidents beyond the design basis by protecting the containment; and, finally, mitigate the radiological consequences off site with emergency plans. Each level is designed assuming the previous one has failed.

Within each level, systems are duplicated and diversified. Redundancy means having two, three or four trains of the same system, each able to perform the function alone, physically separated so that a fire or a flood cannot take them all out. Diversity means performing the same function by different principles: two shutdown systems, one with rods and one with boron injection; cooling by pumps and by natural circulation; diesel generators and batteries. The aim is to eliminate common-cause failures, which is exactly what happened at Fukushima when the tsunami flooded every diesel generator in the same basement at once.

The result is measured as core damage frequency. The NRC requires less than once every 10,000 reactor-years; today's best plants are around one in a million and Generation III+ designs approach one in ten million. Three Mile Island showed in 1979 what the barriers are worth: half the core melted, but the vessel and the containment held almost everything, and the average dose to the two million neighbors was about 14 microsieverts. Chernobyl had no containment.