A systematic approach to identify initiating events and its relationship to Probabilistic Risk Assessment: Demonstrated on the Molten salt reactor experiment

One of the first steps in developing a risk assessment model is an exhaustive search for initiating events, which is a systematic and comprehensive starting point to answer the question “what can go wrong?” for a given system design.

Progress in Nuclear Energy 129 (2020) 103507 Contents lists available at ScienceDirect Progress in Nuclear Energy journal homepage: http://www.elsevier.com/locate/pnucene A systematic approach to identify initiating events and its relationship to Probabilistic Risk Assessment: Demonstrated on the Molten Salt Reactor Experiment Brandon M Chisholm a, *, Steven L Krahn a, Karl N Fleming b a b Vanderbilt University, Dept of Civil and Environmental Engineering, PMB 351831, 2301 Vanderbilt Place, 37235, Nashville, TN, USA KNF Consulting Services LLC, 816 West Francis Ave, Spokane, WA, 99205, USA A R T I C L E I N F O A B S T R A C T Keywords: Molten salt reactor Initiating events Safety Risk assessment Process hazards analysis Master logic diagram One of the first steps in developing a risk assessment model is an exhaustive search for initiating events, which is a systematic and comprehensive starting point to answer the question “what can go wrong?” for a given system design Identifying Postulated Initiating Events (PIEs) for a reactor design that is at a conceptual or preliminary stage facilitates the incorporation of risk insights into the next iteration of the design process and allows for the early establishment of more quantifiable risk assessment models, such as event sequence diagrams and event tree analysis Liquid-Fueled Molten Salt Reactors (LF-MSRs) are an example of an advanced reactor technology that does not benefit from having a wealth of operating experience or prior risk-informed safety assessment efforts Furthermore, design details, such as normal operating conditions and the composition of radioactive material inventories, can deviate substantially from those in other reactors, such that a systematic and comprehensive approach to identifying PIEs for an LF-MSR may highlight accident initiators that have not previously been identified In the present work, the Master Logic Diagram (MLD) and Hazards and Operability (HAZOP) study approaches were used, together, to identify and consider PIEs for multiple inventories of radioactive material across various Plant Operating States (POSs) in a specific LF-MSR design – the Molten Salt Reactor Experiment (MSRE) Potentially risk-significant PIEs identified during the analyses of the MSRE design are presented Furthermore, considerations for exhaustively identifying PIEs for advanced reactor designs are discussed; for example, the combination of inductive and deductive methods was found to provide a robust identification of PIEs in a way that is conducive to the analysis of a nuclear reactor design at an early design stage Introduction Developers of next generation commercial nuclear reactor systems are proposing innovative design concepts that are intended to provide advantages over existing nuclear reactors in several areas, including economics, proliferation resistance, reliability, and safety (GIF, 2002) With respect to safety, the expectation from the marketplace and regu­ lators is that advanced reactors “will provide enhanced margins of safety and/or use simplified, inherent, passive, or other innovative means to accomplish their safety and security functions.” (NRC, 2008) Because the various advanced non-Light Water Reactor (non-LWR) technologies utilize different coolants, fuel forms, and safety system designs, the nuclear industry and regulators have recognized the benefit of defining a technology-inclusive, risk-informed, and performance-based (TI-RIPB) methodology to assess the safety associated with non-LWR designs, rather than relying on prescriptive rules, such as those prepared for LWRs (NRC, 2019; GIF, 2011) In order to optimize the safety and manage the risks associated with advanced reactor designs, a safety assessment approach should also support safety that is “built-in” to the system design in a fundamental way, rather than “added on” to compensate for safety limitations (GIF, 2002) In the US, the Licensing Modernization Project (LMP) (NEI, 2019) has defined a methodology that uses industry-standard analyses, such as Process Hazards Analysis (PHA) and Probabilistic Risk Assessment (PRA),1 to support TI-RIPB applications, including: * Corresponding author E-mail addresses: brandon.m.chisholm@vanderbilt.edu (B.M Chisholm), steve.krahn@vanderbilt.edu (S.L Krahn), karlfleming@comcast.net (K.N Fleming) Also known internationally as Probabilistic Safety Assessment (PSA) https://doi.org/10.1016/j.pnucene.2020.103507 Received 29 January 2020; Received in revised form 30 July 2020; Accepted 31 August 2020 Available online October 2020 0149-1970/© 2020 The Authors Published by Elsevier Ltd This is an (http://creativecommons.org/licenses/by-nc-nd/4.0/) open access article under the CC BY-NC-ND license B.M Chisholm et al Progress in Nuclear Energy 129 (2020) 103507 • Evaluation of design alternatives; • Incorporation of risk insights early in the design process and continuing during the development of the design; • Selection and evaluation of Licensing Basis Events (LBEs); • Safety classification of structures, systems, and components and development of performance targets; and • Evaluation of defense-in-depth adequacy inside and outside the core and volatile radionuclides in off-gas streams Because these inventories of radioactive material present unique chal­ lenges to the barriers that are intended to prevent their release from the system, a thorough identification of IEs could find occurrences that have not previously been considered for other reactor technologies The goal of the present work is to systematically identify Postulated Initiating Events (PIEs) for a specific LF-MSR design, the Molten Salt Reactor Experiment (MSRE) The context for this work in relation to prior efforts to identify and organize PIEs for LF-MSRs is presented in Section Then, in Section 3, the methodology for the analysis of MSRE IEs is defined The results of the MSRE IE analysis are discussed in Section 4, and conclusions regarding these results and the overall approach are presented in Section The development of the LMP methodology benefitted from interna­ tional guidance, such as the Integrated Safety Assessment Methodology (ISAM) described by the Generation IV International Forum (GIF) (GIF, 2011), and the body of knowledge associated with risk-informed and performance-based technology A risk-informed safety assessment approach will comprehensively and systematically evaluate the hazards and risks associated with the system design Fundamentally, a risk analysis consists of answers to the questions in the “risk triplet” originally defined by Kaplan and Garrick (1981) The three questions that make up the triplet are answered in the development of a PRA model and are expressed as follows: Background This section presents insights gained from literature relevant to the identification and evaluation of PIEs for LF-MSRs Definitions for important terms are described (Sect 2.1) before the existing guidance on PIE analysis is discussed (Sect 2.2) Finally, prior efforts to analyze PIEs for LF-MSRs are briefly summarized (Sect 2.3) What can happen? (i.e., what can go wrong?) How likely is it to happen? If it does happen, what are the consequences? 2.1 Definitions A related fourth question that can be asked is “what are the un­ certainties in addressing each of these questions using PRA?” Given the risk triplet, and an understanding of the role played by uncertainty, an important starting point for any good safety assessment is a compre­ hensive and systematic analysis of occurrences that have the potential to result in undesirable consequences within the system These occurrences are called initiating events (IEs).2 Because of the extensive operating experience associated with LWRs, generic IE lists are available for LWRs (IAEA, 1993; McClymont and Poehlman, 1982; Mackowiak et al., 1985), although it is still necessary to account for design-specific factors that influence the IEs within a PRA model However, advanced reactors have little to no commercial operating experience; further, the fundamental physical phenomena that govern the performance of non-LWRs can deviate substantially from those in LWRs The foregoing realities render previous reactor operating experience of limited value with respect to exhaustively identifying IEs for the risk assessment of non-LWRs In developing a systematic approach to iden­ tify IEs for a new design, it is necessary to understand the safety features of the reactor plant, the nature of radiological hazards, and how the plant is designed to retain hazardous material within physical and functional barriers As a result, a systematic search for IEs naturally provides the initial building blocks for the PRA models that account for the plant response to the IEs, in addition to developing a list of IEs to be modeled There is significant history in developing PRA models for some types of advanced non-LWRs, such as High-Temperature Gas-cooled Reactors (HTGRs) (DOE, 1988) and Sodium-cooled Fast Reactors (SFRs) (GE Hitachi, 2017); however, only recently has work to develop PRA models for Molten Salt Reactors (MSRs) been initiated In particular, the Liquid-Fueled Molten Salt Reactor (LF-MSR) is an advanced reactor technology for which a comprehensive identification of IEs is needed No commercial LF-MSRs have been operated, and less work has been conducted in the area of LF-MSR safety assessment in comparison to other non-LWR technologies Additionally, LF-MSRs have the potential to have significant inventories of radionuclides, including those in different locations other than the reactor core, that are in forms not commonly present in other commercial nuclear reactor designs These radionuclides include soluble fission products dissolved in molten salt Within the risk assessment community, IEs3 are typically character­ ized as the starting point for providing answers to the first question of Garrick and Kaplan’s risk triplet presented above (i.e., “what can go wrong?”) The remaining part of the answer to this question is to provide a model for the plant response to the IE, for only then can the conse­ quences be fully realized For the purposes of quantitative risk analysis, IEs are used in event sequence4 modeling and Event Tree Analysis (ETA) to complete the answer of the first question and to set up the framework for answering the second question of the risk triplet (i.e., “how likely is it to happen?”) by estimating the frequencies of event sequences of in­ terest The end states of the event sequences form the boundary condi­ tions for answering the third question of the triplet (i.e., “what are the consequences?”) Because the definition of risk also involves defining consequences of interest, the specific scope of what is considered to be an IE can vary among different industries In the most general sense, an IE is a deviation from normal conditions that could, if not responded to in a correct and timely manner, lead to a consequence of concern (Modarres, 2006; CCPS, 2015) In the present analysis, the consequence of concern is the transport of radioactive material through a barrier that is intended to prevent its release Accordingly, this work will use a definition based upon the definition used in the non-LWR PRA Standard (ASME/ANS, 2013); an IE is “a perturbation to the plant that challenges plant control and safety systems whose failure could potentially lead to an undesirable end state and/or radioactive material release.” However, the Interna­ tional Atomic Energy Agency (IAEA) notes that the term “initiating event” is typically used in relation to event reporting and analysis, while “postulated initiating event” is used during the consideration of hypo­ thetical events at the design stage (IAEA, 2019) As such, the events identified in the present work for the MSRE are considered to be postulated initiating events (PIEs) Further drawing from the above referenced IAEA guidance, in this work a hazard is defined as “a factor or condition that might operate against safety.” Accordingly, the hazard evaluations (i.e., PHA studies) conducted on the MSRE were organized efforts to identify hazardous situations associated with operation of the system being reviewed Also sometimes referred to as “initiators” An event sequence is comprised of an IE, the plant response to the IE (which includes a sequence of successes and failures of mitigating systems) and a welldefined end state (Nuclear Energy Institute, 2019) A more rigorous definition of “initiating event” for the purposes of this work is presented in Section 2.1 B.M Chisholm et al Progress in Nuclear Energy 129 (2020) 103507 (CCPS, 2008).5 As will be discussed in Section 3, the barriers that are intended to prevent the release of radioactive material (and the challenges to these barriers) can change substantially in an LF-MSR depending upon the specific configuration of the plant Recognizing this fact, an objective of this work will be to identify key considerations for the analysis of PIEs in LF-MSRs for Plant Operating States (POSs) other than at-power opera­ tions, such as shutdown conditions Using guidance in the non-LWR PRA Standard (ASME/ANS, 2013), a POS is defined in the present work as “a standard arrangement of the system during which conditions are rela­ tively constant and are distinct from other configurations in ways that impact risk.” The standard requirements for IE analysis recognize that the possibilities and frequencies of IEs are highly dependent on the POS similar plants (based on safety assessments and system operating expe­ rience) to support comprehensiveness (IAEA, 1993; CCPS, 2015; ASME/ANS, 2013; NRC, 1983; IAEA, 2010) Although the MSRE rep­ resents the only LF-MSR system with significant operating experience, and the authorization for the MSRE was largely deterministic (Flanagan, 2017), a Preliminary Hazards Analysis (PrHA) was documented (Beall, 1961) and used as an input to the final MSRE Safety Analysis Report (SAR) (Beall et al., 1964) PIEs identified for the MSRE in these reports include some PIEs that are typically considered for other reactor types (e.g., uncontrolled control rod withdrawal and loss of heat sink) as well as some PIEs unique to LF-MSRs (e.g., freeze valve failure, loss of graphite from the core, and precipitation of fissile material) One notable weakness of the pre-operational MSRE safety assessment was that the analysis focused exclusively on PIEs that could result in release of radioactive material from a single inventory: the fuel salt As will be discussed in Section 3.1, during different POSs, significant inventories of radioactive material could also be present in the MSRE off-gas and in the MSRE fuel salt processing system Only a single, bounding scenario resulting in the release of volatile radionuclides during processing of the fuel salt was documented (in a separate report by Lindauer, 1967) before processing operations were conducted, and there does not seem to have been any documented efforts to identify PIEs that could lead to release of volatile radionuclides from the MSRE Off-Gas System (OGS) A recent effort (Chisholm et al., 2018) grouped the PIEs identified by the MSRE team in the PrHA (Beall, 1961) and SAR (Beall et al., 1964) into different categories; however, without the use of a systematic and comprehensive search for PIEs, the list of MSRE PIEs developed by Chisholm et al (2018) cannot be considered complete Another recent study (Geraci, 2017) was conducted to identify key PIEs for a modern commercial LF-MSR design, Flibe Energy’s Liquid Fluoride Thorium Reactor (LFTR) A list of PIEs was compiled by surveying generic lists of LWR PIEs (IAEA, 1993), NRC reports (Mack­ owiak et al., 1985; Poloski et al., 1999; Eide et al., 2007; NRC, 1990), and MLDs being developed for solid-fueled Fluoride-cooled High-temperature Reactors (FHRs)6 (Mei et al., 2014; Zuo et al., 2016) to identify PIEs that related to the hazards identified by the What-If analysis7 of the LFTR design conducted by the Electric Power Research Institute (EPRI) (2015) A total of 18 PIEs were identified, with 10 PIEs determined to be similar to those typically considered for LWRs and determined to be unique to the LFTR design However, the anal­ ysis in (Geraci, 2017) does not explicitly mention hazards or PIEs that could potentially result in release of radioactive material from the OGS; further, the PIEs identified in the study that relate to radioactive ma­ terial inventories other than the fuel salt are either: broadly defined (e g., operator error), related to external events (e.g., seismic events), or are internal events that potentially impact many plant functions simul­ taneously (e.g., fire within the plant or loss of offsite power without scram) Because the only LF-MSR-specific reference surveyed for this PIE analysis was a What-If analysis (which is not a comprehensive PHA method, see CCPS, 2008), a more comprehensive study of hazards and potential initiators is warranted to provide confidence that important PIEs were not overlooked An example of the performance of a systematic search for PIEs for an LF-MSR design is presented in (Pyron, 2016) In the study, Pyron applies the MLD approach to Thorium Tech Solution Inc.’s FUJI-233Um design (IAEA, 2007) The PIEs identified in the MLD were compared to a list of FHR PIEs (Allen et al., 2013) and typical examples of events analyzed in LWR PRAs (NRC, 2007; Schweizerische Eidgenosse, 2009) and then grouped into categories All of the categories but one (i.e., the 2.2 Approaches for identifying initiating events in advanced reactor designs Risk assessment (e.g., PRA or PSA) is a key component of a RIPB safety assessment (NRC, 2019; NEI, 2019; IAEA, 2019) Along with system familiarization, identification of PIEs is acknowledged as one of the first steps in evaluating risk associated with system designs in many industries (Modarres, 2006), including the aerospace (NASA, 2011), chemical process (CCPS, 2000), and commercial nuclear industries (NRC, 1983; IAEA, 2010) A frequently cited tool to facilitate the iden­ tification of PIEs is the Master Logic Diagram (MLD) (IAEA, 1933; Modarres, 2006; NASA, 2011; NRC, 1983) MLD is a deductive (i.e., top-down) analysis that results in a model that resembles a fault tree, but is intended to document a thought process rather than calculate a failure probability (Papazoglou and Aneziris, 2002) The MLD approach can be useful to determine elementary failures (or combinations of elementary failures) that could challenge normal operations; however, development of an MLD alone does not provide sufficient confidence that PIEs have been comprehensively identified (IAEA, 2010) It is worthwhile to note that example applications of MLDs vary from case to case in relation to content and structure, but all lead to a sys­ tematic identification of PIEs for a particular design An objective of this paper is to propose a suitable structure for an LF-MSR MLD that can be used not only for identifying PIEs, but also for forming the structure of the plant response model for PIEs that are identified The combination of a deductive analysis (such as MLD) with an inductive analysis to determine hazardous physical and/or chemical reactions of concern to a design has been found to be particularly effective to ensure completeness of PIE identification and resolution of uncertainty surrounding design quality (Nagel and Stephanopoulos, 1995) The variety of industry-standard inductive analyses includes: semi-structured PHA methods (e.g., What-If analysis), structured PHA methods (e.g., Hazard and Operability, HAZOP), and structured analysis of failure modes (e.g., Failure Modes and Effects Analysis, FMEA) (CCPS, 2015) Selection of a specific hazard evaluation method is dependent upon several factors, including design maturity, nature of the facility, and intended use of the results of the study (Chisholm et al., 2019a) For example, the results of a HAZOP study are typically more comprehen­ sive than those of a What-If analysis, and a HAZOP study requires less detailed design information than does an FMEA (CCPS, 2008) Detailed guidance on selecting and conducting various hazard evaluation studies is available in the references (CCPS, 2008; Stamatis, 2003; Crawley and Tyler, 2015; EPRI, 2018; EPRI, 2019a; NRC, 2001) 2.3 Relevant LF-MSR safety assessment efforts In addition to original analyses, an exhaustive search for PIEs should also involve the review of lists of PIEs that have been developed for i.e., solid-fueled, molten salt-cooled reactors The What-If analysis technique is a loosely-structured, brainstorming PHA method in which hazards are evaluated through the asking of questions or voicing of concerns about possible undesired events (Center for Chemical Proce, 2008) This use deviates from the definition of “hazard analysis” presented in the ASME/ANS Non-LWR PRA Standard (American Society of Mecha, 2013) B.M Chisholm et al Progress in Nuclear Energy 129 (2020) 103507 “MSR-specific category”) were derived based upon the categories of Anticipated Operational Occurrences (AOOs) and postulated accidents recommended in the US NRC Standard Review Plan for LWRs (NRC, 2007) Although the MLD developed in (Pyron, 2016) includes consid­ eration of PIEs for the release of radioactive material from inventories other than those related to the fuel salt loop, there is a disparity between the resolution of the PIE decomposition that could lead to the release of fuel salt and that of PIEs that could lead to the release of material from other inventories For example, “release of core material/core damage” is decomposed into hazards that could result in a transport of fuel salt through the first barrier to its release (including insufficient reactivity control, insufficient cooling, overcooling, etc.), while “off-gas system failure” is not decomposed any further in the MLD Therefore, it seems that use of an inductive analysis tool, such as a HAZOP study, may be able to increase the understanding of functional and/or specific sub­ system or component failures that could contribute to a release of radioactive material from the OGS of an LF-MSR A recent workshop was held with the objective of identifying PIEs for a generic LF-MSR design, with participants including representatives from prospective reactor vendors, industry bodies, US and Canadian regulators, US and Canadian national laboratories, and the academic community (Holcomb et al., 2019) To facilitate the brainstorming ex­ ercise, summary high-level design information, taken from the MSRE and the concepts for both the Molten Salt Demonstration Reactor and the Molten Salt Breeder Reactor, for the following subsystems was briefly presented: • • • • • the systems or procedures used for detection, prevention, and mitiga­ tion, while the MLD offers a more convenient graphical tool to present hazards and understand logical connections between different hazards (G`erardin et al., 2019) These conclusions support the idea that the combination of a deductive analysis (such as MLD) combined with an inductive analysis (such as an FFMEA or a HAZOP study) is an effective way to systematically and comprehensively identify PIEs for a design that does not benefit from extensive prior safety assessment information or operating experience However, the search for MSFR PIEs only considered PIEs for normal operations As will be discussed in the following section (Sect 3), it is possible that for some LF-MSR designs, the composition and physical location of the major inventories of radioactive material will vary depending upon the POS Accordingly, the challenges to the barriers that are intended to prevent the release of radioactive material (and the safety functions protecting the barriers) may need to be evaluated separately for each inventory for each POS to ensure a comprehensive enumeration of PIEs in LF-MSR designs The analysis presented in the following sections evaluates how to incorporate the insights from the review of the above efforts into the systematic approach for identifying MSRE PIEs Methodology The approach to identify PIEs for the MSRE primarily draws from the LMP guidance on PRA development (Southern Company, 2019) and the non-LWR PRA Standard (ASME/ANS, 2013) The identification of PIEs discussed in this article is a portion of a larger project that had the objective of demonstrating how early stage reactor developers might exercise various aspects of the LMP’s TI-RIPB methodology (Nuclear Energy Institute, 2019) that has been endorsed by the US NRC in Draft Regulatory Guide DG-1353 (NRC, 2019); discussion of that project structure and presentation of other portions of the work are available in the references (EPRI, 2018; EPRI, 2019a) The MSRE design was chosen to provide an illustrative demonstra­ tion of the TI-RIPB methodology because it represents an early stage design with a unique set of detailed, publicly available information associated with LF-MSR design and operation Most notably, the original MSRE literature (Lindauer, 1967; Robertson, 1965; Moore, 1972; Guy­ mon, 1973) has sufficiently detailed information to support the evalu­ ation of hazards associated with “auxiliary” systems containing significant inventories of radioactive material, such as the OGS and fuel processing systems Although modern commercial LF-MSR design con­ cepts may deviate substantially from the MSRE design in ways that impact the risk profile of the plant (e.g., inclusion of power cycle equipment), the amount and level of detail of the publicly available MSRE design information enabled a more in-depth application of the developed methodology compared to what would be possible using a less detailed design The MSRE PIEs identified by this work may be useful as a starting point for the identification of PIEs for other LF-MSR designs; however, the approach to PIE identification that is demon­ strated is technology-inclusive such that it can be applied to any nuclear reactor design Finally, because this study is the first comprehensive evaluation of PIEs for the MSRE, the present analysis focuses only on the identification of internal events and does not enumerate PIEs related to external events (such as flooding or seismic events) This prioritization of the evaluation of internal events in early safety analysis is consistent with international guidance (Wielenberg et al., 2017) and US nuclear industry standards (ASME/ANS, 2013) The identification and evaluation of external events would need to be covered for a full scope risk assessment of the MSRE design; however, this study prioritized the demonstration of a tool that could be used to analyze a reactor design at the conceptual or pre­ liminary design stages Reactor and fuel salt system; Drain tank and decay heat removal system; Off-gas system; Fuel processing system; and Reactor building For each of the subsystems, the participants of the workshop were asked to brainstorm “what could go wrong?” and the answers were recorded (Holcomb et al., 2019) The structure of the study to brain­ storm PIEs that could pertain to inventories of radioactive material other than the fuel salt represents an improvement in comprehensiveness over previous studies that have focused mostly on the fuel salt system; however, the 140 PIEs listed in (Holcomb et al., 2019) were not cate­ gorized beyond the subsystem to which they pertain The list of PIEs in (Holcomb et al., 2019) represents the results of an inductive analysis of PIEs that can be used to supplement more comprehensive design-specific studies Perhaps the most systematic and comprehensive effort to identify and evaluate PIEs for an LF-MSR to-date is the analysis described in (G`erardin et al., 2019) As part of the Safety Assessment of the Molten Salt Fast Reactor (SAMOFAR) project under the Horizon 2020 Euratom research program, Gerardin et al developed an initial list of PIEs for normal operating conditions of the Molten Salt Fast Reactor (MSFR) conceptual design through use of both the MLD approach and perfor­ mance of a Functional Failure Modes and Effects Analysis (FFMEA) Combining the results of both analyses, 13 “families” of PIEs were identified by grouping together PIEs that resulted in similar conse­ quences and at least one “representative event” was identified for each family The representative PIEs were assumed to envelope all similar PIEs in terms of radiological consequences, but it is noted in (G`erardin et al., 2019) that the list of PIEs will be iteratively updated as additional data and design detail is developed Based on the list of PIEs, it was concluded in (G`erardin et al., 2019) that PIEs were identified for the MSFR that had not previously been identified for LWRs, such as “loss of fuel flow.” Additionally, Gerardin et al concluded that, in general, the results of the MLD and FFMEA methods agreed well, but some events were iden­ tified by only one method and not the other In particular, the inductive method of the FFMEA was determined to have provided more detail on B.M Chisholm et al Progress in Nuclear Energy 129 (2020) 103507 3.1 Overview of MSRE design and major inventories of radioactive material radioactive materials in the MSRE requires the consideration of mate­ rials existing in different forms and different concentrations, which are contained by an array of different barriers to release Because these aspects (especially the barriers to release) can vary substantially for different POSs, a preliminary list of major MSRE POSs was developed using guidance from the ASME/ANS non-LWR PRA Standard (ASME/ANS, 2013) Table provides an overview of important MSRE POSs For each POS, original MSRE design and operations reports (Beall et al., 1964; Lindauer, 1967; Robertson, 1965; Moore, 1972; Guymon, 1973) were reviewed and used to define each unique inventory on the basis of fundamental criteria, such as chemical composition, physical properties, and barriers to release The following paragraphs identify and characterize some of the major inventories of radioactive material in the MSRE design for various POSs The molten fluoride-based fuel salt had fission products and trans­ uranics (including fissile material) dissolved within it During normal operations, the fuel salt was circulated around the fuel salt loop by the fuel salt pump; however, the approach to ensure subcriticality of the fuel and shut down the MSRE was to allow the fuel salt to drain via gravity from the fuel salt loop and into at least one of two fuel salt drain tanks The fuel salt was kept in the fuel salt loop by a frozen plug of salt in a freeze valve during normal operations, and this plug was thawed to enact a fuel salt drain Each drain tank had a dedicated freeze valve in which a plug of salt could be frozen to isolate the vessel from the fill/ drain line once the fuel salt had drained to the tank(s) A fraction of the volatile fission products in the fuel salt was removed during operation to remove neutron poisons When salt was being circulated by the fuel salt pump, a portion of the fuel salt in the pump bowl was sprayed out of holes in a distributor ring, which allowed noble gas fission products (mostly xenon and krypton) to vent from the salt (Robertson, 1965) A helium sweep gas was introduced to the pump bowl to carry an estimated 10.36 TBq (280 Ci) each second out of the fuel salt loop and into the so-called “main” OGS The main OGS was designed to provide holdup time to allow for the decay of all radioactive isotopes to insignificant amounts – with the exception of 85Kr, 131mXe, and 133Xe Volume holdups were used to allow for the decay of short-lived radioisotopes, while water-cooled charcoal beds were A high-level schematic of the major systems of the MSRE is shown in Fig 1, and documentation of design details and operating experience are available in the references (Beall et al., 1964; Lindauer, 1967; Rob­ ertson, 1965; Moore, 1972; Guymon, 1973) The approximately MW (thermal) test reactor was designed, constructed, and operated at Oak Ridge National Laboratory (ORNL) in the 1960’s Between 1965 and 1969, the MSRE was critical for a total of 17,655 h (Guymon, 1973) The reactor was fueled with UF4 dissolved in a carrier molten fluoride salt Heat from fission was generated in the fuel salt as it passed through the graphite channels of the reactor vessel, and then transferred in the heat exchanger to the molten fluoride coolant salt Fission product gases were removed continuously from the circulating fuel salt by spraying a portion of the salt into the cover gas above the liquid in the fuel pump tank From this space, the fission product gases were swept out by a low flow purge of helium into the OGS The coolant salt was circulated through a heat exchanger and radiator, where air was blown axially across the tubes to remove the heat The air was then exhausted to the atmosphere via a stack The MSRE was equipped with drain tanks for storing the fuel and coolant salts when the reactor was not operating The salts were drained by gravity and transferred back to the circulating system by pressurizing the tanks with helium The MSRE also included a simple processing facility for the offline treatment of fuel salt batches for removal of oxide contamination and for recovering the uranium Addi­ tional major auxiliary systems included: (1) a helium cover-gas system with treatment stations for oxygen and moisture removal; (2) two closed-loop oil systems for lubricating the bearings of the fuel and coolant pumps; (3) a closed loop component cooling system (CCS) for cooling in-cell components using 95% N2 and less than 5% O2; (4) several cooling water systems; (5) a ventilation system for contamina­ tion control; and (6) an instrument air system The development of an exhaustive enumeration of reactor specific PIEs begins with the identification and characterization of the different inventories of hazardous material that are present in a system design (Southern Company, 2019) The distribution and movement of Fig High-level schematic of major MSRE components (Guymon, 1973) B.M Chisholm et al Progress in Nuclear Energy 129 (2020) 103507 Table MSRE plant operating states (POSs) Plant Operating State (POS) Major Inventories of Radioactive Material Minor Inventories of Radioactive Material Status of Selected Barriers Notes At Power (Normal Operations) • Fuel salt in fuel salt loop • Volatile radionuclides in main OGS line • Fuel salt: FV-103 frozen, FV105 and 106 thawed • OGS: main charcoal beds • Safety system response triggers thawing of FV-103 (drain to drain tank via gravity) Filling (fuel salt) • Fuel salt in Drain Tank, fill/drain line, and fuel salt loop • Volatile radionuclides in auxiliary OGS line • Fuel salt in Drain Tank(s) • Volatile radionuclides in auxiliary OGS line • Fuel salt heel in drain tank • Liquid waste storage • Tritium • Liquid waste storage • Tritium • Transfer FVs frozen, FV-103 thawed • OGS: auxiliary charcoal bed • He pressure used to fill system • Coolant salt loop filled • Heel/deposits in fuel salt loop • Deposits in main OGS line/components • Liquid waste storage • Tritium • Heel/deposits in fuel salt loop • Heel in fuel salt DT(s) • Deposits in OGS lines/ components • Liquid waste storage • Tritium • Heel/deposits in fuel salt loop • Deposits in main OGS line/components • Liquid waste storage • Tritium • Transfer FVs, FV-104 and FV105 frozen • OGS: auxiliary charcoal bed • Heat removal by Afterheat Removal System; fuel salt can be in DT or • Processing FV frozen • Volatile radionuclides: processing charcoal trap None • Similar to “Shutdown” • Confinement barriers may change • System may be opened • Fuel salt loop likely cold Shutdown Fuel salt processing • Fuel in Fuel Storage Tank (FST) • Volatile process flow in fuel processing line/components Maintenance • Fuel salt in Drain Tank(s) • Volatile radionuclides in auxiliary OGS line designed to provide average residence times of 90 days for xenon and 7.5 days for krypton (Robertson, 1965) After being held up for this decay, the effluent of the OGS was exhausted to the atmosphere after passing through filters to retain solids and then being massively diluted An “auxiliary” OGS was also provided to handle the intermittent, relatively large flows of helium that were produced during salt transfer operations These off-gas streams could contain significant amounts of radioactive gases and particulates (Robertson, 1965) Unlike the main OGS, the auxiliary OGS did not contain any volume holdups; however, the auxiliary OGS did have a charcoal bed that was located in the same water-filled cell as the main charcoal beds The effluent of the auxiliary charcoal bed flowed into the same line as the effluent of the main charcoal beds before passing through the stack filters, being diluted, and eventually being exhausted via the stack Lines were provided to flow the off-gas from the fuel salt drain tanks to either the main OGS or the auxiliary OGS, with isolation valves in the lines that could be opened and closed to direct the gas flow Other significant inventories of radioactive material in the MSRE design would have been present at times in the fuel processing and handling equipment in the fuel processing cell and adjacent adsorber cubicle It is important to note that because the MSRE did not perform online fuel salt processing, fuel salt would not have been in the fuel salt system and the fuel processing system at the same time This consider­ ation is very important for identifying POSs that condition the MSRE PIEs Although the radionuclides entered the fuel processing cell in the form of fuel salt, during fluorination (for recovery of U), many elements were volatilized out of the fuel salt Thus, the salt remaining in the fuel storage tank (FST) after uranium recovery, the off-gas from the fluori­ nation process (including the volatilized UF6), and the radionuclides removed from this process stream by various components were all forms of hazardous material that were not present anywhere else in the MSRE system The material described above represents a significant majority of the total radioactivity that was in the MSRE plant; however, there were several other smaller distinct inventories of radioactive material For example, around TBq (55 Ci) of tritium was produced in the MSRE per day, mainly due to neutron interactions with lithium-6 in the fuel salt), with about half of this tritium carried into the OGS by the off-gas of the fuel salt Some of the tritium was absorbed into the core graphite, and measurable amounts diffused to the cooling air across the radiator and to the reactor cell atmosphere (Briggs, 1971) Additionally, a heel of approximately 10% of the fuel salt volume was estimated to remain in the drain tanks after the fuel salt loop was filled (Bell, 1970), and fission, corrosion, or activation products could have plated out on or been absorbed into components with sustained fuel salt contact Similarly, OGS components could contain deposits due to condensation or the decay of volatile radionuclides into solid daughter isotopes At any given point, there also may have been some amount of radioactive material contained in the liquid waste system in the liquid waste storage tank filters or the associated piping and pumps It is important to note that within the framework of the LMP meth­ odology, the selection of LBEs includes the identification of AOOs, in addition to the less likely design basis and beyond design basis events (Nuclear Energy Institute, 2019) Thus, tracking smaller inventories of radioactive material could be important if there are high frequency AOOs that result in their release; hence, simply focusing on the largest inventories of radioactive material (as typically done in an LWR PRA) may not be sufficient for PRA of an advanced non-LWR 3.2 Conduct of Process Hazards Analysis studies of the MSRE The starting point for developing a model to analyze risk in a reactor design, especially one at an early stage of design, can be the performance of a qualitative PHA study using one of several PHA methods that are recommended by both the nuclear (ASME/ANS, 2013) and chemical process industries (CCPS, 2008) As part of a larger project led by the authors of this article (EPRI, 2019a), the HAZOP method was selected for use in order to gather qualitative insights about the MSRE design and to support the development of more quantifiable models of risk (Chis­ holm et al., 2019a, 2019b) In order to conduct a HAZOP study, it is necessary to divide the reactor design into analyzable sections or “nodes.” Based on a review of MSRE design information, 21 relevant nodes were identified based on primary function and normal operating conditions (a complete list of the nodes is available in EPRI, 2019b) Due B.M Chisholm et al Progress in Nuclear Energy 129 (2020) 103507 • Level 9: Occurrence contributing to functional failure • Levels 10+: Specific subsystem/component failures with similar system consequences to funding and time constraints, it was not possible to conduct a com­ plete HAZOP study on every individual node; accordingly, it was necessary to select the nodes of the MSRE that were of highest priority to be the subject of a HAZOP study Some of the nodes identified in the MSRE not differ substantially from systems with significant industrial experience (e.g., the tower cooling water system and the instrument air system) and others nodes may not be common to modern commercial MSR design concepts (e.g., the sampler-enricher) Additionally, because PRA models are typically developed for a specific combination of radioactive material inventory, POS, and hazard group (ASME/ANS, 2013), an important step of system characterization was to develop an understanding of which nodes would contain (or interface with) the major inventories of radiological mate­ rials within the MSRE design Performing a PHA study on these nodes will likely help identify PIEs of most interest to LF-MSR designers and regulators, since the consequences of event sequences associated with these nodes have the potential to be more severe than those associated with other nodes Thus, the first MSRE nodes selected to be analyzed using the HAZOP method were the main MSRE OGS, the component cooling system (CCS), the fuel salt processing equipment, and the fuel salt loop Although the MSRE CCS did not contain a significant radioactive material inventory during normal operations, the system: performed functions that will likely need to be addressed in most or all MSR de­ signs, was integral to safe operation of the MSRE, and had not been the subject of detailed prior hazard evaluations or risk assessments In the MSRE design, the CCS interfaced with the reactor cell atmosphere, which could become contaminated if radionuclides from the fuel salt loop or main OGS were transported past the first barrier to their release The MSRE CCS also had a direct interface with the MSRE stack and the environment Many of the MSRE HAZOP study results (discussed in detail in Sec­ tion 4.1) identified causes that could result in the failure of a barrier (or multiple barriers) intended to prevent the release of radioactive mate­ rial Regarding the interface between the HAZOP study and the devel­ opment of the MSRE MLD, such causes documented in the HAZOP study results were used to inform the decomposition of the lower levels of the MLD, including: challenges leading to barrier failure, functional failures producing the challenge, and system or component failures resulting in the failure of the function protecting the barrier The LMP guidance on PRA development provides some suggestions for considerations that were used to organize the logical decomposition in the MLD (Southern Company, 2019) For example, as mentioned in Sect 3.1, reactor-specific PIEs can be grouped based on which inventory of radioactive material they could cause to be released However, the discussion in Sect 3.1 also demonstrated that the barriers in the MSRE that are intended to prevent the release of a single inventory of material can vary for different POSs, including those listed in Table In the MSRE MLD, Level corresponds to the POSs and Level is the major inventories of radioactive material that could be released during each POS The safety approach taken by the MSRE designers was to ensure that each inventory had at least two levels of independent barriers be­ tween the material and the environment (Beall et al., 1964); Level continues the decomposition by the level of the barrier that fails to contain radionuclides As discussed further in Sect 4, the barriers that are intended to contain radionuclides in LF-MSRs are not always struc­ tural barriers that prevent the transport of all materials For example, the MSRE processing system consisted of a variety of functional barriers (including NaF traps, a caustic scrubber, and activated charcoal traps) that were intended to contain certain radionuclides but allow helium cover gas to flow through the system and be exhausted to the atmosphere PIEs with similar consequences that require similar responses by plant systems are often grouped together in PRA models (ASME/ANS, 2013) In the MSRE, the plant responses that are important to mitigate the consequences of a barrier failure are dependent upon where the radioactive material is transported following the failure For example, different plant responses would be required if the main charcoal beds failed in such a way that radioactive material was released to the Charcoal Bed Cell or if Volume Holdup in the main OGS failed in such a way that radioactive material was released to the reactor cell, even though both the main charcoal beds and Volume Holdup constitute part of the first barrier to release of radioactive material in the OGS Thus, Level of the MSRE MLD decomposes the PIEs based upon the interface through which a specific barrier failure allows the radioactive material to be transported The interfaces and barriers for the radioac­ tive material inventories in the MSRE fuel salt and off-gas during normal operations are displayed in Tables and 3, respectively Level of the MLD separates the challenges to individual barriers based on whether they would lead to a rapid failure of a barrier (i.e., “acute”) or contribute over time to the failure of a barrier (i.e., “latent”), and Level is the specific challenge that leads to the failure of the barrier In general, a structural failure of a barrier can be due to (1) overpressure, (2) underpressure, (3) corrosion, (4) erosion, (5) external loading, (6) high temperature, or (7) vibration (Papazoglou and Ane­ ziris, 2002) Because some of the barriers in the MSRE are functional, some causes leading to underperformance of the containment function are also included in the MLD Level of the MLD distinguishes the functional failure that presents the challenge to the barrier, and Level contains the occurrence that represents the functional failure Any decomposition past Level in the MSRE MLD displays specific subsys­ tem or component failures that would have similar consequences that contribute to the occurrence shown in Level Within the context of the LMP framework, the functions presented in Level of the MSRE MLD represent safety functions that are responsible for the prevention and/or mitigation of an unplanned radiological release from any source within the plant, and the systems and components performing these functions are decomposed in Level and beyond These functions, systems, and components can be used in a TI-RIPB manner for safety classification of equipment and to evaluate defense-in-depth (Nuclear Energy Institute, 2019) For the first level of barriers, the occurrences in Level can be 3.3 Development of MSRE Master Logic Diagram In addition to the PHA studies of the MSRE design, the MLD approach was used to systematically identify any PIEs that may have been over­ looked by the inductive HAZOP method An MLD additionally provides a visual tool to organize PIEs that are identified The “top event” of the MSRE MLD is the release of radioactive material This undesired event is then logically decomposed down into simpler contributing events that could lead to the top event (Papazoglou and Aneziris, 2002) The decomposition continues until a sufficient level of detail is reached and all physically possible phenomena have been considered The basic events that cannot be further divided into sub-events represent PIEs for the MSRE design The MLD for the MSRE PIEs was developed according to the following levels: • • • • • • • • Level 1: Release of radioactive material (overall event of interest) Level 2: POS during which the release occurs Level 3: Inventory of radioactive material with potential for release Level 4: Level of barrier between inventories and the public/ environment Level 5: Interface where barrier fails Level 6: Acute vs latent failures of barrier Level 7: Challenge leading to failure of barrier Level 8: Functional failure leading to barrier challenge B.M Chisholm et al Progress in Nuclear Energy 129 (2020) 103507 Table Interfaces and barriers for radioactive material in the MSRE fuel salt during normal operations Interface (Second Barrier to RN Release) RN Inventory Boundary (First Barrier) Third Barrier to RN Release Reactor Cell and CCS Fuel salt piping, reactor vessel, fuel salt pump bowl, heat exchanger shell, freeze flanges Heat exchanger tubes MSRE Building and Ventilation System Coolant Salt System Notes Coolant Cell/MSRE Building and Ventilation System (Coolant Cell not maintained at negative differential pressure like Reactor Cell and Drain Tank Cell) Reactor Cell and CCS/MSRE Building and Ventilation System Off-Gas System Gas/liquid interface in fuel salt pump bowl Cover Gas System Fuel salt pump bowl Reactor Cell/Special Equipment Room/MSRE Building and Ventilation System Fuel Salt Drain/Fill System Freeze Valve FV-103 Drain Tank Cell and CCS considered PIEs for the MSRE; however, some of these occurrences in Level for barriers in the second level or beyond (such as the barriers in the CCS) represent pivotal events that occur after a PIE in an MSRE event sequence The unique combination of successes and/or failures of these mitigating systems determine the end state of the plant at the conclusion of event sequences Transfer of material could be from Coolant Salt into Fuel Salt or from Fuel Salt out to Coolant Salt Transfer of only volatile radionuclides from fuel salt pump bowl to OGS during normal operations Transfer of material from cover gas to fuel salt pump bowl only during normal operations identified to be capable of propagating effects from a deviation in the CCS node to the fuel salt loop A loss of component cooling gas flow could compromise the ability to maintain a frozen plug of salt in the main freeze valve below the reactor vessel The heat conducted into the valve body from the pipeline heaters and the circulating fuel salt could melt the plug, which could result in an unscheduled drain of the fuel salt loop Although the drain tanks were designed to have geometry such that the concern of criticality in the drain tank would be limited, the fuel salt would be at its highest temperature and the decay heat would be at a maximum if the reactor was drained from full power (Beall et al., 1964) Conversely, any cause of increased heat removal by the CCS could in­ crease the size of the frozen salt plug in the freeze valve, and could in­ crease the amount of time needed to thaw the freeze valve in the case that a fuel salt drain was initiated The HAZOP results also highlighted the significant role that fuel salt chemistry can play in LF-MSR fuel salt performance, and deviations in chemistry can be the cause of potential system deviations or upsets For example, deposition of materials from the fuel salt onto surfaces in the system could: affect the ability to transfer heat from one node to another; change the redox conditions of the salt and increase corrosion rates; foul sensors and prevent an accurate indication of process conditions; or plug small lines One chemistry-related issue that was experienced during MSRE operations was the leakage of lubricating oil from the fuel salt pump into the fuel salt in the pump bowl This lubricating oil broke down in the pump bowl and was suspected to cause plugging of the offgas line from the pump bowl (Guymon, 1973) Another more serious chemistry related deviation that was postulated (but not observed Results 4.1 MSRE HAZOP study results An excerpt depicting deviations from the HAZOP study of the MSRE main OGS during normal operations is shown in Table 4.1.1 Fuel salt loop During the HAZOP study of the MSRE fuel salt loop, a total of 66 deviations were evaluated and documented One unique aspect regarding the fuel salt loop is that all of the transients and accidents evaluated by the MSRE team in the Preliminary Hazards Report (Beall, 1961) and the SAR (Beall et al., 1964) related to the inventory of radioactive material in the fuel salt loop Consequently, the HAZOP study results for the fuel salt loop identified more deviations that had been considered by the MSRE team in the original ORNL documentation, compared to the results of the studies on the other nodes However, deviations from normal operations in the fuel salt loop that had not been covered in the MSRE documentation were able to be identified For example, an interface between the fuel salt loop and the CCS node was Table Interfaces and barriers for radioactive material in the MSRE off-gas during normal operations Interface (Second Barrier to RN Release) RN Inventory Boundary (First Barrier) Third Barrier to RN Release Notes Reactor Cell and Component Cooling System (CCS) Concentric OGS Pipe Fuel salt pump bowl, OGS piping and connections, Volume Holdup OGS piping and connections in Coolant Drain Cell OGS piping and connections in Instrument Box Volume Holdup 2, Main Charcoal Beds, Auxiliary Charcoal Beds (structural integrity) HCV-533 (closed) MSRE Building and Ventilation System Coolant Drain Cell/MSRE Building and Ventilation System Vent House N/A Off-gas could potentially flow from fuel salt pump bowl into cover gas system piping Coolant Drain Cell is not kept at a negative differential pressure like Reactor Cell Main Charcoal Beds (functional) N/A OGS piping and connections in Valve Pit OGS piping and connections in Vent House N/A N/A - See Note Instrument Box Charcoal Bed Cell (waterfilled) Auxiliary Charcoal Bed (functional) MSRE Stack (atmosphere) Valve Pit Vent House N/A - See Note Charcoal Bed Cell is located underground next to MSRE building During normal operations, flow is isolated from Auxiliary Charcoal Bed by closing of HCV-533 HCV-557C is designed to automatically isolate flow to MSRE stack upon high levels of radiation Valve Pit is located next to MSRE building If Main Charcoal Beds function as intended, gas stream should have low concentration of radioactive material B.M Chisholm et al Progress in Nuclear Energy 129 (2020) 103507 Table Example of deviations captured in HAZOP study of MSRE main OGS during normal operations DEVIATION CAUSE CONSEQUENCE SAFETY SYSTEMS Temperature Increase Decreased heat removal by charcoal bed cell cooling water system (Volume Holdup [VH-2] and main charcoal beds) • Possible damage to beds from overheating • Reduction in adsorber effectiveness, increased radioactivity of effluent Pressure Increase High fuel salt pump bowl cover gas pressure (e.g., regulator failure) • Increased off-gas flow through entire system (VH1, particle trap, VH-2, charcoal bed) • Increased particulate carryover from fuel salt pump bowl • Decreased residence time in VH-1, VH-2, and charcoal beds Increased pressure downstream of pump bowl • Cooling tower water flow rate (FI–851C) and temperature indications (TI-858) • Radiation monitors downstream of charcoal beds to observe changes in radioactivity (RE557-A/B) • Pressure indications in fuel salt pump bowl (PT522/592) • RM-557A radiation monitors downstream of charcoal beds with automatic safety action (RM557-A/B) • Temperature indications throughout system (TE-522-1, TE-524-1, TE-556-1A) Additionally, the HAZOP studies identified many deviations that could affect void fraction and thus have effects on the reactivity of the MSRE core This interaction places a higher significance on the interface between the OGS node and the fuel salt system Any scenario that can increase or decrease the amount of volatile fission gases removed from the fuel salt (including plugging in the off-gas line, plugging of the stripping spray rings in the pump bowl, or high cover gas supply pres­ sure) could also affect parameters such as power level, pressure, and temperatures in the fuel salt loop during operation) was oxygen contamination of fuel salt that was sig­ nificant enough to alter redox conditions such that uranium precipita­ tion would be possible 4.1.2 Off-gas system and component cooling system During the HAZOP studies, 35 potential deviations were identified and evaluated for the MSRE OGS, and 40 deviations were identified and evaluated for the CCS Unlike the MSRE fuel salt loop, a portion of the boundary of the OGS during normal operations was formed by a func­ tional barrier Rather than providing a structural barrier to prevent transport of any material through the charcoal beds, the activated car­ bon retained certain elements (such as Kr and Xe) for an extended period of time via adsorption, and this residence time allowed for the decay of radionuclides The results of the HAZOP study identified many de­ viations from normal operating conditions that would decrease the effectiveness of this functional barrier For example, ignition of the activated carbon in the charcoal beds due to volatile organic materials in the off-gas stream or a rapid expansion of water vapor due to an inleakage of cooling water could lead to a reduction in the adsorption effectiveness and lead to an increased rate of radioactive material transport past the normal main OGS boundary (Zerbonia et al., 2001) In addition, any cooling water that leaked into the bed would have the potential to react with any remaining fluorine in the off-gas and produce HF, which is toxic and corrosive The scenario of water intrusion into the charcoal beds poses a possible occupational hazard as well as a method to damage components important to the control of radioactive material During the MSRE HAZOP studies, many deviations were identified that suggested that interfaces between gas and salt pose potentially hazardous conditions in an LF-MSR design MSRE operational experi­ ence suggested that the corrosion rate at these surfaces could be significantly higher than corrosion rates encountered elsewhere in the system (Guymon, 1973), and it is also possible that the deposition rate of impurities from the salt on structural materials could be higher at these locations The MSRE team also experience a significant number of complications related to fuel salt “aerosol” or “mist,” which was caused by bubbling and splashing around the interface between the fuel salt and the cover gas in the fuel salt pump bowl This mist could be responsible for material transport from a fuel salt system to an OGS, which could result in plugging of small-diameter off-gas lines Another scenario that was experienced during MSRE operation was thermal expansion of the fuel salt that was significant enough to allow fuel salt to overflow into the OGS from the fuel salt pump bowl (Guymon, 1973) Because the coefficient of thermal expansion for the salts considered for use in LF-MSRs is so high, increases in level due to thermal expansion represent another potential cause of plugged lines (especially small diameter off-gas lines) If a thermal expansion transient is significant enough, it is possible that any seals above the salt/gas interface (e.g., the fuel salt pump shaft seal) could be at risk of being compromised by the hot, radioactive salt 4.1.3 Fuel processing system A total of 88 potential deviations were identified and evaluated for the components involved in the fluorination of MSRE fuel salt One major issue experienced during the operation of the fluorinating equipment in the MSRE was corrosion (Lindauer, 1969) The high con­ centration of fluorine in the gas stream attacked the Hastelloy-N struc­ tural material and increased the amount of impurities (such as NiF2, FeF2, and CrF2) in the fuel salt Additionally, fluorination in the FST allowed for the formation of MoF6, which is volatile and therefore was carried out of the FST along with the other volatile species (such as UF6) Two deviations identified during the HAZOP study of this node per­ tained to corrosion concerns First, increased fluorine concentration in the FST could be caused by a failure of the fluorine control valve If no corrective actions were taken, this increase in fluorine concentration would likely increase the corrosion rate in the FST, which would in­ crease the production rate of MoF6 This MoF6 in the process gas stream could compete with UF6 for absorption in the uranium absorbers or produce hydrated oxides of Mo that could cause an obstruction in lines downstream of the caustic scrubber Additionally, because Mo has a similar heat capacity to U, the accuracy of the Hastings mass-flowmeters used to monitor the uranium content of the gas stream entering and exiting the absorbers could be negatively impacted (Lindauer, 1969) The second deviation related to increased corrosion rates could be caused by a loss of helium flow in the gas flow upstream of the caustic scrubber This loss of helium flow could increase the rate of corrosion in the dip tubes of the caustic scrubber Although a microphone to monitor plugging was provided, as well as a spare (redundant) dip tube in the scrubber that could be used in case the primary dip tube plugged, it is possible that increased corrosion rates in the dip tubes could result in plugging significant enough to produce reverse flow through the ura­ nium absorbers This reverse flow was identified during the HAZOP study to be a possible cause of disrupted process flow and the possible desorption of UF6 or other radionuclides that had been previously deposited in the absorbers As mentioned above, the role of fuel salt chemistry in the safe and reliable performance of an LF-MSR system emphasizes the importance of having the ability to accurately monitor conditions of the salt The MSRE did not have the capability to analyze salt conditions during processing and relied on batch samples taken from the system and analyzed in B.M Chisholm et al Progress in Nuclear Energy 129 (2020) 103507 plugging in the main OGS piping near the outlet of the fuel salt pump bowl represents a failure to control the pressure of the main OGS and a failure to control the pressure of the fuel salt loop, since the off-gas would not be able to be swept out of the fuel salt pump bowl Howev­ er, the plugging could be caused (or exacerbated) by a failure to control the fuel salt chemistry (e.g., ingress of contaminants leading to increased deposits in the off-gas line) or a failure to control heat removal from the off-gas flow (e.g., overcooling of the OGS piping by the CCS resulting in condensation) Additionally, because the volatile fission product poisons cannot be swept into the OGS from the fuel salt pump bowl, this PIE also represents a failure to control nuclear heat generation in the fuel salt loop Therefore, for the radioactive material in the fuel salt during normal operations, the “basic event” of a plug in the off-gas outlet from the fuel salt bowl can be identified as a possible contributor to the structural failure of a barrier due to overpressure, as well as a possible contributor to the structural failure of a barrier due to high temperature In comparison to the HAZOP method, the MLD approach was better suited to identify specific latent phenomena contributing to barrier failure Examples of such phenomena include excessive radiation dam­ age, excessive thermal fatigue, and excessive erosion rates The MLD approach also identified pre-existing deficiencies that could contribute to barrier failures such as an insufficient seal in a freeze flange (leading to leakage or rupture of the flange) or an insufficient frozen plug of salt in a freeze valve (leading to leakage or spurious thawing of a freeze valve) Another advantage of the MLD method over the HAZOP approach is that the visual representation of the MLD is easier to un­ derstand quickly than are the tabular results of the HAZOP study Although the MLD approach was able to identify some failures and phenomena that were not identified during the HAZOP study, the HAZOP results identified a higher number of PIEs that were not readily identified by the development of the MLD alone The HAZOP approach was more useful to examine the MSRE due to the room for creativity and flexibility during the brainstorming of deviation causes In contrast to the rigid structure of the MLD, the use of parameter/guideword com­ binations such as “high temperature” and “high pressure” were partic­ ularly useful to identify subsystem and component failures that could potentially lead to the failure of a barrier intended to prevent the release of radionuclides Finally, perhaps the most significant difference between the appli­ cation of the MLD and HAZOP approaches was the amount of informa­ tion documented during the analysis of PIEs While the results of the another facility, separate from the MSRE facility As an alternative to online salt chemistry measurements, the MSRE team used surrogate measurements, and the HAZOP study identified deviations that could affect the efficacy of these surrogates to adequately indicate system conditions For example, incorrect calibration of the mass-flowmeters used during fluorination could lead to material accountability errors when calculating how much uranium has been removed from the fuel salt and the component in which it was deposited One component containing an inventory of particularly hazardous material that was identified during the HAZOP study was the caustic solution in the scrubber Due to the changes made to the system before operation, the scrubber became the main component responsible for the capture of iodine and fluorine (Lindauer, 1969) Because these changes were made after the initial system design, there is limited information available regarding analysis of the contents of this component Multiple deviations that could result in a release of the material from the scrubber to the fuel processing cell were identified during the HAZOP study, including violent reactions in the scrubber or decreased heat removal from the scrubber It is possible that the release of this material to the fuel processing cell could also volatilize iodine 4.2 Development of MSRE MLD The MLD approach was also used to analyze the same inventories of radioactive material that were studied using the HAZOP method (i.e., the fuel salt during normal operations, the off-gas during normal oper­ ations, the process flow during fluorination, and the fuel salt during fluorination); EPRI’s CAFTA software (EPRI, 2014) was used to create the MLD The highest levels of the MSRE MLD can be seen in Fig 2, and an example of the breakdown to Level for the radioactive material in the fuel salt off-gas during normal operations is shown in Fig The MSRE MLD highlights the idea that many phenomena in an LFMSR are very closely coupled For instance, in the fuel salt loop, the magnitude of the reactivity effects due to a change in fuel salt loop operating pressure is affected by the temperature of the fuel salt (Beall et al., 1964) Additionally, pressure transients in the fuel salt loop have multiple (sometimes competing) reactivity effects, including changes in void fraction and poison concentration (Beall et al., 1964) The complicated nature of these relationships can make it somewhat difficult to determine the “basic event” or failed safety function that ultimately would be responsible for a potential barrier failure For example, Fig Levels 1–4 of the MSRE MLD 10 B.M Chisholm et al Progress in Nuclear Energy 129 (2020) 103507 Fig Example of Levels 4–9 of the MSRE MLD for the radioactive material in the off-gas during normal operations MLD convey information including where radioactive material could be transported due to a failure of a given barrier and what function certain systems or components perform, the tabular HAZOP results contain much more information that could be used to support the development of more quantifiable models of risk, such as ETA Examples of details captured in the HAZOP results that would be useful towards a further analysis of risks associated with a design include discussion of consequences that affect operability or could contribute to the failure of a barrier in another system and discussion of safety systems that would allow for prevention or mitigation of undesired consequences preventing transport of radioactive material without structurally failing Similar PIEs were identified for the inventory of radioactive material in the process flow during fluorination, including insufficient charge in the caustic scrubber and loss of helium supply flow Either of these PIEs could potentially lead to a release of radioactive material via the MSRE stack if the proper response by the operators and/or plant systems is not successful Multiple MSRE PIE categories were identified for scenarios in which radioactive material did not pass through a structural barrier, but instead flowed from one system to another Associated with this trans­ port of radioactive material through system boundaries is a change in the systems and functions that prevent the further release of the trans­ ported material For example, a spurious drain of the fuel salt to the fuel salt drain tank does not pose an immediate challenge to any of the barriers preventing release of this material to the reactor cell; however, certain responses of systems in the Drain Tank Afterheat Removal Sys­ tem are required to ensure that decay heat is adequately removed from the fuel salt to prevent the barriers in the Fuel Salt Drain/Fill System from being challenged by excessive temperature Another interesting observation made based on the MSRE PIEs identified is that a failure to control pressure was identified multiple times as a functional failure resulting in a challenge to a barrier Overpressurization was identified as a possible cause of failure for a variety of barriers, including the fuel salt pump seal, OGS piping and connec­ tions, and salt processing piping and components Additionally, the driving force for the off-gas flow is the cover gas supplied to the fuel salt pump bowl, and the driving force for the fluorination processing flow is the fluorine gas supplied to the FST Thus, a blockage of flow at many different points downstream of these vessels could contribute to the pressurization and potential failure of multiple components upstream For example, plugging of the OGS piping immediately downstream of the outlet of fuel salt pump bowl could initiate a pressure transient that does not pose a challenge to any barriers in the main OGS, but that 4.3 Identification of MSRE PIEs The 26 categories of PIEs identified using the HAZOP study results and the MSRE MLD are listed in Table along with the inventories of radioactive material to which each category is applicable It can be seen that of the categories (19%) are applicable to more than one inventory, and none of the categories are applicable to more than two inventories Compared to the prior efforts to identify and group PIEs in LF-MSRs discussed in Sect 2.3, the categories of MSRE PIEs contain a number of new functional failures for the removal and/or retention of volatile nuclides For example, a PIE identified for the MSRE off-gas during normal operations is the ignition of the activated carbon in the main charcoal bed, perhaps due to the presence of volatile organic material This failure to control heat generation from a chemical reaction in the charcoal bed could decrease the efficiency of the adsorption reaction and reduce the time that volatile radionuclides (like Kr and Xe) decay before leaving the component Thus, this PIE belongs to the category “increased radioactive material concentration in effluent to MSRE Stack” and would require a plant response in order to mitigate the consequences of an increased rate of radioactive release from the MSRE stack The implication associated with the identification of this type of PIE is that a barrier can fail to perform the intended function of 11 B.M Chisholm et al Progress in Nuclear Energy 129 (2020) 103507 Table MSRE PIE categories identified and applicable inventories of radioactive material PIE Category Normal Operations – Fuel Salt Normal Operations – Off-gas X X X X X X X X X Release of radioactive material to Reactor Cell Leak of fuel salt material into coolant salt Ingress of coolant salt into fuel salt Increase in radioactive material transfer to OGS Leakage or spurious drain of fuel salt to drain tank Contamination of helium cover gas system Reactivity transients with forced fuel salt flow Reactivity transients without forced fuel salt flow Release of radioactive material in Coolant Drain Cell Leakage through or inadvertent opening of HCV-533 Release of radioactive material to Instrument Box Release of radioactive material to valve pit Release of radioactive material to Charcoal Bed Cell Increased radioactive material concentration in effluent to MSRE Stack Release of radioactive material to vent house Pressure feedback transient to fuel salt pump bowl Contamination of Fluorine Supply System Release of radioactive material to Fuel Processing Cell Release of radioactive material to Absorber Cubicle Unintended criticality Release of radioactive material to Spare Cell Leakage of radioactive material through transfer freeze valve Unintended flow of radioactive material to Liquid Waste Storage Tank Pressure feedback transient to Fuel Storage Tank (FST) Fuel salt flow into process line Fuel salt flow into transfer line challenges barriers to the radioactive material in the fuel salt (e.g., the fuel salt pump bowl seal) However, the responses necessary to mitigate the consequences of this PIE would likely involve the radioactive ma­ terial in the off-gas (i.e., providing an alternative flowpath around the blocked line) Accordingly, the MSRE PIE categories for pressure feed­ back transients were created to capture this type of PIEs One category of PIEs that is commonly considered for LWRs, and has been identified for the FUJI 233-Um and the MSFR, is a decrease in heat extraction from the primary system (i.e., fuel salt in the case of LF-MSRs) (Pyron, 2016; NRC, 2007; G` erardin et al., 2019) However, calculations made by the MSRE team indicated that, due to inherent feedback in the MSRE fuel salt, a complete loss of load at full operating power resulted in a mild temperature transient with no core pressure surge (Beall et al., 1964) Additionally, the analysis of MSRE PIEs identified that an over-temperature malfunction of the electric heaters for the fuel salt loop could possibly affect the heat balance of the fuel salt loop in a similar way to loss of load Because no analysis was identified that suggested the concern of a barrier failure related to a decrease in fuel salt loop heat extraction (or an increase in fuel salt loop heat addition), these PIEs were grouped under the MSRE PIE category of “reactivity transients with forced fuel salt flow.” Another commonly identified PIE category for LF-MSRs is a decrease in fuel salt flow rate (Pyron, 2016; G`erardin et al., 2019) In LWRs, PIEs that result in a decrease in Reactor Coolant System flow rate represent a failure of the heat removal function (NRC, 2007), but in LF-MSRs, fuel salt flow is related to both heat removal and heat generation functions A decrease in fuel salt flow immediately increases the number of fissions caused by delayed neutrons released in the core, in addition to decreasing the rate of heat removal, which increases the temperature at the core outlet (Beall et al., 1964) However, in response to increased fuel salt temperature, the heat generation rate in the fuel salt decreases substantially Accordingly, the PIEs associated with decreases in fuel salt flow rate, such as a fuel salt pump trip, were included in the MSRE PIE category “reactivity transients without forced fuel salt flow.” This grouping recognizes that the timescale of the system response necessary to mitigate challenges to barriers is different for reactivity transients that occur with the fuel salt under natural convection instead of forced flow, Fluorination – Process Flow Fluorination – Fuel Salt X X X X X X X X X X X X X X X X X X X X X X but also acknowledges that the barrier challenges associated with a decrease in fuel salt flow are related to the reactivity balance in the loop rather than the heat balance Finally, each of the individual PIEs presented in (Pyron, 2016) and (G`erardin et al., 2019) can be grouped into one of the categories of the MSRE PIE categories listed in Table However, due to the tight coupling of phenomena in LF-MSRs, the MSRE PIE categories identified in this work seem to lend themselves better towards further evaluation using traditional risk assessment methods (such as ETA) An example from (G`erardin et al., 2019) is the comparison of two PIEs: (1) an un­ detected deviation of the fuel salt chemical composition and (2) a rupture of the gas processing unit with a leak of processing fluid Both of these PIEs are considered to belong to the same PIE families in (G`erardin et al., 2019) (i.e., “Loss of fuel composition/chemistry control”); how­ ever, the plant response required to mitigate a release of radioactive material would be different for an event sequence in which radioactive material has been transported past a barrier (i.e., Scenario #2) than it would for an event sequence in which no barrier has failed yet (i.e., Scenario #1) By contrast, both a rupture of MSRE OGS piping and a rupture of MSRE fuel salt piping are considered in the present work to belong to the same MSRE PIE group (i.e., “Release of radioactive ma­ terial to the reactor cell”) Although the composition of the radioactive material release to the cell may be different if it is released from the fuel salt loop than if it is released from the OGS, the plant response required to further prevent the release of the radioactive material from the reactor cell would be similar for these two PIEs Conclusions One of the first steps in beginning a safety assessment is defining PIEs by systematically and comprehensively answering the question “what can go wrong?” for a given system design Generic lists of PIEs are available for LWRs, but LF-MSRs not benefit from having a wealth of operating experience Furthermore, design details, such as normal operating conditions and the composition of radioactive material in­ ventories, can deviate substantially from those of LWRs In the present work, a methodology using a combination of MLD and HAZOP 12 B.M Chisholm et al Progress in Nuclear Energy 129 (2020) 103507 approaches was used to identify and consider PIEs for a specific LF-MSR design in a way that is conducive to the analysis of an advanced nonLWR reactor design at an early design stage Analyzing the PIEs for a reactor design that is at a conceptual or preliminary stage of design fa­ cilitates the incorporation of risk insights into the next iteration of the design process and allows for the early establishment of more quantifi­ able risk assessment models that form the building blocks for PRA models Using the HAZOP and MLD methods to identify how inventories of radioactive material could be transported through barriers intended to prevent their release identified 26 categories of PIEs for distinct in­ ventories of radioactive materials in the MSRE across different POSs Using a combination of inductive and deductive approaches provided for a robust methodology to identify PIEs Compared to previous efforts to identify PIEs for LF-MSR designs, the present work identified new functional failures in which radioactive material was not necessarily released due to the structural failure of a component, but the material was still transported through a boundary that would likely require a plant response to mitigate undesired consequences One example of such a PIE is the overheating of the main charcoal beds in the OGS during normal operations (possibly due to loss of cooling or to chemical re­ actions in the bed) that would reduce the effectiveness of the activated carbon to adsorb volatile radionuclides This occurrence could increase the concentrations of radionuclides in the effluent to the MSRE stack above desired levels Overall, the HAZOP study method was useful to identify system and component failures that could challenge barriers intended to prevent the release of radionuclides, as well as to document details regarding the consequences of failures and the safety systems intended to mitigate or prevent the consequences The MLD approach was helpful to identify latent phenomena contributing to barrier failure and to organize PIEs in a readily accessible manner However, similar to other qualitative PHA methods, neither the HAZOP approach nor the MLD approach directly results in the development of a quantifiable model of risk; this task would require the use of other tools, such as Fault Tree Analysis The concepts of hazardous material inventories and the barriers to the release of hazardous material were found to be fundamental to the identification of PIEs for LF-MSRs Significant inventories of radioactive material may exist outside of the fuel salt that is fissioning in the core (e g., volatile radionuclides in the OGS and the separation of radionuclides via processing of the fuel salt), and the barriers that are designed to retain this material may change depending on the POS Additionally, the safety functions that are intended to prevent failure may be notably different for different sets of barriers Therefore, an exhaustive identi­ fication of PIEs for an LF-MSR should consider the challenges to the barriers for each unique arrangement of material inventories The results also suggest that not all functional categories of PIEs that are often considered for LWRs will necessarily be relevant for the safety assessment of LF-MSRs For example, due to inherent feedback mecha­ nisms, a complete loss of load for the MSRE design did not represent a significant challenge to any barriers intended to prevent the release of radionuclides This fact emphasizes the need to focus on the major in­ ventories of hazardous materials and the failure of barriers intended to prevent the release of the material when using the MLD methodology for the identification of PIEs in an LF-MSR design, rather than simply basing the functional decomposition upon the MLD structure used for other nuclear reactor designs Additionally, categorizing PIEs based upon the interfaces through which radioactive material will be transported in the case of a barrier failure appears to be an appropriate manner to meet the objectives of IE analysis prescribed by industry standard approaches (ASME/ANS, 2013) Although PIEs are sometimes grouped functionally (e.g., “radioactive release from a subsystem or component”), in an LF-MSR, the plant responses that are important to mitigate the consequences may be different depending on where the radioactive material is released (e.g., “releasing radionuclides to a seal-welded containment that is maintained at a negative differential pressure” vs “releasing ra­ dionuclides to a water-filled concrete pit”) Grouping the PIEs based upon the interface through which radioactive material is transported can also help minimize the number of redundant event sequences (e.g., “increase in heat removal by coolant salt” vs “loss of electric fuel salt pipeline heater”) that will be modeled when developing more quanti­ fiable models of risk, such as event sequence diagrams or ETA The present identification of internal events represents the first step of PIE analysis for the MSRE For a full scope risk assessment of the MSRE design, the analysis of PIEs would need to be expanded to include identification of external hazard scenarios, the consideration of corre­ lations between internal and external hazards, and thorough consider­ ation of all PIEs for all reactor POSs (Wielenberg et al., 2017) Examples of relevant planned future research includes tasks under the SAMOSA­ FER project to build upon the results of the SAMOFAR project (e.g., G`erardin et al., 2019) and increase the comprehensiveness of the risk and safety assessment of the MSFR design Finally, it is possible that consideration of PIEs that could lead to other undesirable consequences other than release of radioactive material (such as release of hazardous chemicals or loss of investment) may be of interest to LF-MSR stake­ holders In particular, the use of an interaction matrix may be useful to ensure a comprehensive understanding of all potential chemical re­ actions that could occur and their associated consequences (CCPS, 2008) Credit author statement Brandon M Chisholm: Conceptualization, Methodology, Investiga­ tion, Data Curation, Writing – Original Draft, Writing – Review & Editing, Visualization, Funding acquisition, Steven L Krahn: Concep­ tualization, Methodology, Investigation, Resources, Writing – Review & Editing, Supervision, Funding acquisition, Karl N Fleming: Conceptu­ alization, Methodology, Validation, Writing – Review & Editing, Supervision Declaration of competing interest The authors declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper Acknowledgements This work was supported by several different groups under a variety of funding arrangements, including the US Department of Energy’s Of­ fice of Nuclear Energy (through Nuclear Energy University Program Graduate Fellowship DE-NE0000646), the Electric Power Research Institute (Agreement 10007945), and Southern Company The authors also wish to thank Oak Ridge National Laboratory for their cooperation during the project The authors would like extend their sincerest gratitude to Carole Leach, Paul Marotta, and Allen Croff for their contributions to this article References Allen, T., et al., 2013 Fluoride-Salt-Cooled, High-Temperature Reactor (FHR) Subsystems Definition, Functional Requirement Definition, and Licensing Basis Event (LBE) Identification White Paper Integrated Research Project Workshop American Society of Mechanical Engineers (ASME) and American Nuclear Society (ANS), 2013 Standard for Probabilistic Risk Assessment for Advanced Non-LWR Nuclear Power Plant Applications AMSE/ANS RA S-1.4-2013 Beall, S., 1961 Molten Salt Reactor Experiment Preliminary Hazards Report Oak Ridge National Laboratory ORNL-CF-61-2-46 Beall, S.E., et al., 1964 MSRE Design and Operations Report - Part V: Reactor Safety Analysis Report Oak Ridge National Laboratory ORNL-TM-732 Bell, M., 1970 Calculated Radioactivity of MSRE Fuel Salt Oak Ridge National Laboratory ORNL-TM-2970 13 B.M Chisholm et al Progress in Nuclear Energy 129 (2020) 103507 International Atomic Energy Agency (IAEA), 2019 IAEA Safety Glossary: Terminology Used in Nuclear Safety and Radiation Protection IAEA, Vienna, Austria, 2018 Edition Kaplan, S., Garrick, B.J., 1981 On the quantitative definition of risk Risk Anal (1), 11–27 Lindauer, R., 1967 MSRE Design and Operations Report - Part VII: Fuel Handling and Processing Plant Oak Ridge National Laboratory ORNL-TM-907 Rev Lindauer, R., 1969 Processing of the MSRE Flush and Fuel Salts Oak Ridge National Laboratory ORNL-TM-2578 Mackowiak, D.P., Gentillon, C.D., Smith, K.L., 1985 Development of Transient Initiating Event Frequencies for Use in Probabilistic Risk Assessments Idaho Falls, ID NUREG/CR3862 McClymont, A.S., Poehlman, B.W., 1982 ATWS: A Reappraisal, Part 3: Frequency of Anticipated Transients EPRI Palo Alto, CA, EPRI-NP-2230 Mei, M., et al., 2014 Research on initial event analysis for solid thorium molten salt reactor probabilistic safety assessment Nucl Tech 37 (9), 090601 Modarres, M., 2006 Risk Analysis in Engineering: Techniques, Tools, and Trends CRC Press, Boca Raton, FL Moore, R.L., 1972 MSRE Design and Operations Report - Part IIB: Nuclear and Process Instrumentation Oak Ridge National Laboratory ORNL-TM-729B Nagel, C., Stephanopoulos, G., 1995 Inductive and deductive reasoning: the case of identifying potential hazards in chemical processes Adv Chem Eng 21, 187–225 National Aeronautics and Space Administration (NASA), 2011 Probabilistic Risk Assessment Procedures Guide for NASA Managers and Practictioners NASA/SP2011-3421 Nuclear Energy Institute (NEI), 2019 Risk-Informed Performance-Based Guidance for Non-light Water Reactor Licensing Basis Development NEI 18-04, Report Revision Nuclear Regulatory Commission (NRC), 1983 PRA Procedures Guide, vol NUREG/ CR-2300, Washington, DC Nuclear Regulatory Commission (NRC), 1990 Severe Accident Risks: an Assessment for Five U.S Nuclear Power Plants Washington, DC NUREG-1150 Nuclear Regulatory Commission (NRC), 2001 Integrated Safety Analysis Guidance Document NUREG-1513 Nuclear Regulatory Commission (NRC), 2007 Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants, LWR Edition Washington, DC, NUREG-0800 Nuclear Regulatory Commission (NRC), 2008 Policy Statement on the Regulation of Advanced Reactors, 73 FR 60612 Nuclear Regulatory Commission (NRC), 2019 Guidance for a Technology-Inclusive, Risk-Informed, and Performance-Based Methodology to Inform the Licensing Basis and Content of Applications for Licenses, Certifications, and Approvals for Non-lightwater Reactors Draft Regulatory Guide DG-1353 Papazoglou, I.A., Aneziris, O.N., 2002 Master Logic Diagram: method for hazard and initiating event identification in process plants J Hazard Mater A97, 11–30 Poloski, J.P., et al., 1999 Rates of Initiating Events at U.S Nucler Power Plants: 19871995 Idaho Falls, ID, NUREG/CR-5750 Pyron, D.A., 2016 Safety Analysis for the Licensing of Molten Salt Reactors MS Thesis Paul Scherrer Institute Robertson, R.C., 1965 MSRE Design and Operations Report - Part I: Description of Reactor Design Oak Ridge National Laboratory ORNL-TM-728 Schweizerische Eidgenossenschaft, 2009 Probabilistic Safety Analysis (PSA): Quality and Scope Guideline for Swiss Nuclear Installations ENSI-A05/e Southern Company, 2019 Modernization of Technical Requirements for Licensing of Advanced Non-light Water Reactors: Probabilistic Risk Assessment Approach SC29980-101 Rev Stamatis, D.H., 2003 Failure Mode and Effect Analysis: FMEA from Theory to Execution, second ed American Society for Quality (ASQ), Quality Press, Amsterdam, Netherlands Wielenberg, A., et al., 2017 ASAMPSA_E/WP30/D30.7/2017-31 Methodology for Selecting Initiating Events and Hazards for Consideration in an Extended PSA, vol Zerbonia, R.A., et al., 2001 Carbon bed fires and the use of carbon canisters for air emissions control on fixed-roof tanks J Air Waste Manag Assoc 51, 1617–1627 Zuo, J., et al., 2016 The analysis of initiating events in PSA for TMSR Charlotte, NC In: Presented at 24th International Conference on Nuclear Engineering (ICONE24) June 26-30, 2016 Briggs, R., July, 1971 Additional Calculations of the Distribution of Tritium in the MSRE Oak Ridge National Laboratory ORNL CF-71-7-8 Center for Chemical Process Safety (CCPS), 2000 Guidelines for Chemical Process Quantitative Risk Analysis, second ed American Institute of Chemical Engineers (AIChE), New York, NY Center for Chemical Process Safety (CCPS), 2008 Guidelines for Hazard Evaluation Procedures, third ed John Wiley & Sons, Inc and the American Institute of Chemical Engineers (AIChE), New York, NY Center for Chemical Process Safety (CCPS), 2015 Guidelines for Initiating Events and Independent Protection Layers in Layer of Protection Analysis American Institute of Chemical Engineers (AIChE), New York, NY Chisholm, B., et al., 2018 A New Look at Licensing Basis Events for the Molten Salt Reactor Experiment Oak Ridge National Laboratory ORNL/TM-2018/788 Chisholm, B., et al., 2019a Considerations for early-stage safety assessments for advanced reactor designs Trans Am Nucl Soc 121 (1), 993–996 Chisholm, B., et al., 2019b Development of a methodology for early integration of safety analysis into advanced reactor design Charleston, SC In: Presented at 2019 International Topical Meeting on Probabilistic Safety Assessment and Analysis (PSA 2019) April 28-May 3, 2019 Crawley, F., Tyler, B., 2015 HAZOP: Guide to Best Practice, third ed Elsevier, Amsterdam, Netherlands US Department of Energy (DOE), 1988 Probabilistic Risk Assessment for the Standard Modular High Temperature Gas-Cooled Reactor DOE-HTGR-86-011, Revision Eide, S.A., et al., 2007 Industry-average Performance for Components and Initiating Events at U.S Commercial Nuclear Power Plants Idaho Falls, ID, NUREG/CR-6928 Electric Power Research Institute (EPRI), 2014 CAFTA Fault Tree Analysis System, Version 6.0b Software Manual EPRI Report 3002004316 Electric Power Research Institute (EPRI), 2015 Program on Technology Innovation: Technology Assessment of a Molten Salt Reactor Design – the Liquid Fluoride Thorium Reactor (LFTR) Palo Alto, CA EPRI Report 3002005460 Electric Power Research Institute (EPRI), 2018 Program on Technology Innovation: Early Integration of Safety Assessment into Advanced Reactor Design, Preliminary Body of Knowledge and Methodology Palo Alto, CA EPRI Report 3002011801 Electric Power Research Institute (EPRI), 2019a Development of a Technology-Neutral Approach to Safety-In-Design for Advanced Nuclear Power: Progress Report, Insights, and Lessons Learned Palo Alto, CA EPRI Report 3002015752 Electric Power Research Institute (EPRI), 2019b Molten Salt Reactor Experiment (MSRE) Case Study: Using Risk-Informed, Performanc-Based Technical Guidance to Inform Future Licensing for Advanced Non-light Water Reactors EPRI AR LR 2019-06 NRC ADAMS ML19249B632 Flanagan, G., 2017 Historical perspective - MSRE safety basis authorization In: Presented at 2017 ORNL MSR Workshop Oak Ridge, TN Generation IV International Forum (GIF), 2002 A Technology Roadmap for Generation IV Nuclear Energy Systems GIF-002-00 Generation IV International Forum Risk and Safety Working Group (GIF RSWG), 2011 An Integrated Safety Assessment Methodology (ISAM) for Generation IV Nuclear Systems, Version 1.1 Geraci, N.C., 2017 Initiating Event Analysis of a Lithium Fluoride Thorium Reactor Masters of Science (MS), Engineering Management and Systems Engineering Old Dominion University G`erardin, D., et al., 2019 A methodology for the identification of the postulated initiating events of the Molten Salt Fast Reactor Nucl Eng Technol 51, 1024–1031 Guymon, R.H., 1973 MSRE Systems and Components Performance Oak Ridge National Laboratory ORNL-TM-3039 GE Hitachi Nuclear Energy, 2017 Final Scientific/Technical Report: Development/ Modernization of an Advanced Non-LWR Probabilistic Risk Assessment Federal Grant DE-NE-0008325 Holcomb, D.E., et al., 2019 Molten Salt Reactor Initiating Event and Licensing Basis Event Workshop Summary Oak Ridge National Laboratory ORNL/TM-2019/1246 International Atomic Energy Agency (IAEA), 1993 Defining Initiating Events for Purposes of Probabilistic Safety Assessment Vienna, Austria IAEA-TECDOC-719 International Atomic Energy Agency (IAEA), 2007 Molten salt reactor for sustainable nuclear power - MSR FUJI In: Status of Small Reactor Designs without On-Site Refuelling IAEA-TECDOC-1536, Annex XXX: Vienna, Austria International Atomic Energy Agency (IAEA), 2010 Development and Application of Level Probabilistic Safety Assessment for Nuclear Power Plants Report No SSG-3 14 ... helium into the OGS The coolant salt was circulated through a heat exchanger and radiator, where air was blown axially across the tubes to remove the heat The air was then exhausted to the atmosphere... design in a way that is conducive to the analysis of an advanced nonLWR reactor design at an early design stage Analyzing the PIEs for a reactor design that is at a conceptual or preliminary stage... however, the approach to ensure subcriticality of the fuel and shut down the MSRE was to allow the fuel salt to drain via gravity from the fuel salt loop and into at least one of two fuel salt drain