A systematic approach to identify initiating events and its relationship to Probabilistic Risk Assessment: Demonstrated on the Molten salt reactor experiment

Progress in Nuclear Energy 129 (2020) 103507

Contents lists available at ScienceDirect

Progress in Nuclear Energy
journal homepage: />
A systematic approach to identify initiating events and its relationship to
Probabilistic Risk Assessment: Demonstrated on the Molten Salt
Reactor Experiment
Brandon M. Chisholm a, *, Steven L. Krahn a, Karl N. Fleming b
a
b

Vanderbilt University, Dept. of Civil and Environmental Engineering, PMB 351831, 2301 Vanderbilt Place, 37235, Nashville, TN, USA
KNF Consulting Services LLC, 816 West Francis Ave, Spokane, WA, 99205, USA

A R T I C L E I N F O

A B S T R A C T

Keywords:
Molten salt reactor
Initiating events
Safety
Risk assessment
Process hazards analysis
Master logic diagram

One of the first steps in developing a risk assessment model is an exhaustive search for initiating events, which is
a systematic and comprehensive starting point to answer the question “what can go wrong?” for a given system
design. Identifying Postulated Initiating Events (PIEs) for a reactor design that is at a conceptual or preliminary

stage facilitates the incorporation of risk insights into the next iteration of the design process and allows for the
early establishment of more quantifiable risk assessment models, such as event sequence diagrams and event tree
analysis. Liquid-Fueled Molten Salt Reactors (LF-MSRs) are an example of an advanced reactor technology that
does not benefit from having a wealth of operating experience or prior risk-informed safety assessment efforts.
Furthermore, design details, such as normal operating conditions and the composition of radioactive material
inventories, can deviate substantially from those in other reactors, such that a systematic and comprehensive
approach to identifying PIEs for an LF-MSR may highlight accident initiators that have not previously been
identified. In the present work, the Master Logic Diagram (MLD) and Hazards and Operability (HAZOP) study
approaches were used, together, to identify and consider PIEs for multiple inventories of radioactive material
across various Plant Operating States (POSs) in a specific LF-MSR design – the Molten Salt Reactor Experiment
(MSRE). Potentially risk-significant PIEs identified during the analyses of the MSRE design are presented.
Furthermore, considerations for exhaustively identifying PIEs for advanced reactor designs are discussed; for
example, the combination of inductive and deductive methods was found to provide a robust identification of
PIEs in a way that is conducive to the analysis of a nuclear reactor design at an early design stage.

1. Introduction
Developers of next generation commercial nuclear reactor systems
are proposing innovative design concepts that are intended to provide
advantages over existing nuclear reactors in several areas, including
economics, proliferation resistance, reliability, and safety (GIF, 2002).
With respect to safety, the expectation from the marketplace and regu­
lators is that advanced reactors “will provide enhanced margins of safety
and/or use simplified, inherent, passive, or other innovative means to
accomplish their safety and security functions.” (NRC, 2008) Because
the various advanced non-Light Water Reactor (non-LWR) technologies
utilize different coolants, fuel forms, and safety system designs, the
nuclear industry and regulators have recognized the benefit of defining a

technology-inclusive, risk-informed, and performance-based (TI-RIPB)
methodology to assess the safety associated with non-LWR designs,

rather than relying on prescriptive rules, such as those prepared for
LWRs (NRC, 2019; GIF, 2011). In order to optimize the safety and
manage the risks associated with advanced reactor designs, a safety
assessment approach should also support safety that is “built-in” to the
system design in a fundamental way, rather than “added on” to
compensate for safety limitations (GIF, 2002). In the US, the Licensing
Modernization Project (LMP) (NEI, 2019) has defined a methodology
that uses industry-standard analyses, such as Process Hazards Analysis
(PHA) and Probabilistic Risk Assessment (PRA),1 to support TI-RIPB
applications, including:

* Corresponding author.
E-mail addresses: (B.M. Chisholm), (S.L. Krahn), (K.N. Fleming).
1
Also known internationally as Probabilistic Safety Assessment (PSA).
/>Received 29 January 2020; Received in revised form 30 July 2020; Accepted 31 August 2020
Available online 4 October 2020
0149-1970/© 2020 The Authors.
Published by Elsevier Ltd.
This is an
( />
open

access

article

under

the

CC

BY-NC-ND

license


B.M. Chisholm et al.

Progress in Nuclear Energy 129 (2020) 103507

• Evaluation of design alternatives;
• Incorporation of risk insights early in the design process and
continuing during the development of the design;
• Selection and evaluation of Licensing Basis Events (LBEs);
• Safety classification of structures, systems, and components and
development of performance targets; and
• Evaluation of defense-in-depth adequacy.

inside and outside the core and volatile radionuclides in off-gas streams.
Because these inventories of radioactive material present unique chal­
lenges to the barriers that are intended to prevent their release from the
system, a thorough identification of IEs could find occurrences that have
not previously been considered for other reactor technologies.
The goal of the present work is to systematically identify Postulated
Initiating Events (PIEs) for a specific LF-MSR design, the Molten Salt
Reactor Experiment (MSRE). The context for this work in relation to
prior efforts to identify and organize PIEs for LF-MSRs is presented in
Section 2. Then, in Section 3, the methodology for the analysis of MSRE

IEs is defined. The results of the MSRE IE analysis are discussed in
Section 4, and conclusions regarding these results and the overall
approach are presented in Section 5.

The development of the LMP methodology benefitted from interna­
tional guidance, such as the Integrated Safety Assessment Methodology
(ISAM) described by the Generation IV International Forum (GIF) (GIF,
2011), and the body of knowledge associated with risk-informed and
performance-based technology.
A risk-informed safety assessment approach will comprehensively
and systematically evaluate the hazards and risks associated with the
system design. Fundamentally, a risk analysis consists of answers to the
questions in the “risk triplet” originally defined by Kaplan and Garrick
(1981). The three questions that make up the triplet are answered in the
development of a PRA model and are expressed as follows:

2. Background
This section presents insights gained from literature relevant to the
identification and evaluation of PIEs for LF-MSRs. Definitions for
important terms are described (Sect 2.1) before the existing guidance on
PIE analysis is discussed (Sect 2.2). Finally, prior efforts to analyze PIEs
for LF-MSRs are briefly summarized (Sect 2.3).

1. What can happen? (i.e., what can go wrong?)
2. How likely is it to happen?
3. If it does happen, what are the consequences?

2.1. Definitions

A related fourth question that can be asked is “what are the un­

certainties in addressing each of these questions using PRA?” Given the
risk triplet, and an understanding of the role played by uncertainty, an
important starting point for any good safety assessment is a compre­
hensive and systematic analysis of occurrences that have the potential to
result in undesirable consequences within the system. These occurrences
are called initiating events (IEs).2 Because of the extensive operating
experience associated with LWRs, generic IE lists are available for LWRs
(IAEA, 1993; McClymont and Poehlman, 1982; Mackowiak et al., 1985),
although it is still necessary to account for design-specific factors that
influence the IEs within a PRA model. However, advanced reactors have
little to no commercial operating experience; further, the fundamental
physical phenomena that govern the performance of non-LWRs can
deviate substantially from those in LWRs.
The foregoing realities render previous reactor operating experience
of limited value with respect to exhaustively identifying IEs for the risk
assessment of non-LWRs. In developing a systematic approach to iden­
tify IEs for a new design, it is necessary to understand the safety features
of the reactor plant, the nature of radiological hazards, and how the
plant is designed to retain hazardous material within physical and
functional barriers. As a result, a systematic search for IEs naturally
provides the initial building blocks for the PRA models that account for
the plant response to the IEs, in addition to developing a list of IEs to be
modeled.
There is significant history in developing PRA models for some types
of advanced non-LWRs, such as High-Temperature Gas-cooled Reactors
(HTGRs) (DOE, 1988) and Sodium-cooled Fast Reactors (SFRs) (GE
Hitachi, 2017); however, only recently has work to develop PRA models
for Molten Salt Reactors (MSRs) been initiated. In particular, the
Liquid-Fueled Molten Salt Reactor (LF-MSR) is an advanced reactor
technology for which a comprehensive identification of IEs is needed.

No commercial LF-MSRs have been operated, and less work has been
conducted in the area of LF-MSR safety assessment in comparison to
other non-LWR technologies. Additionally, LF-MSRs have the potential
to have significant inventories of radionuclides, including those in
different locations other than the reactor core, that are in forms not
commonly present in other commercial nuclear reactor designs. These
radionuclides include soluble fission products dissolved in molten salt

Within the risk assessment community, IEs3 are typically character­
ized as the starting point for providing answers to the first question of
Garrick and Kaplan’s risk triplet presented above (i.e., “what can go
wrong?”). The remaining part of the answer to this question is to provide
a model for the plant response to the IE, for only then can the conse­
quences be fully realized. For the purposes of quantitative risk analysis,
IEs are used in event sequence4 modeling and Event Tree Analysis (ETA)
to complete the answer of the first question and to set up the framework
for answering the second question of the risk triplet (i.e., “how likely is it
to happen?”) by estimating the frequencies of event sequences of in­
terest. The end states of the event sequences form the boundary condi­
tions for answering the third question of the triplet (i.e., “what are the
consequences?”).
Because the definition of risk also involves defining consequences of
interest, the specific scope of what is considered to be an IE can vary
among different industries. In the most general sense, an IE is a deviation
from normal conditions that could, if not responded to in a correct and
timely manner, lead to a consequence of concern (Modarres, 2006;
CCPS, 2015). In the present analysis, the consequence of concern is the
transport of radioactive material through a barrier that is intended to
prevent its release. Accordingly, this work will use a definition based
upon the definition used in the non-LWR PRA Standard (ASME/ANS,

2013); an IE is “a perturbation to the plant that challenges plant control
and safety systems whose failure could potentially lead to an undesirable
end state and/or radioactive material release.” However, the Interna­
tional Atomic Energy Agency (IAEA) notes that the term “initiating
event” is typically used in relation to event reporting and analysis, while
“postulated initiating event” is used during the consideration of hypo­
thetical events at the design stage (IAEA, 2019). As such, the events
identified in the present work for the MSRE are considered to be
postulated initiating events (PIEs).
Further drawing from the above referenced IAEA guidance, in this
work a hazard is defined as “a factor or condition that might operate
against safety.” Accordingly, the hazard evaluations (i.e., PHA studies)
conducted on the MSRE were organized efforts to identify hazardous
situations associated with operation of the system being reviewed
3

Also sometimes referred to as “initiators”.
An event sequence is comprised of an IE, the plant response to the IE (which
includes a sequence of successes and failures of mitigating systems) and a welldefined end state (Nuclear Energy Institute, 2019).
4

2
A more rigorous definition of “initiating event” for the purposes of this work
is presented in Section 2.1.

2


B.M. Chisholm et al.

Progress in Nuclear Energy 129 (2020) 103507

(CCPS, 2008).5
As will be discussed in Section 3, the barriers that are intended to
prevent the release of radioactive material (and the challenges to these
barriers) can change substantially in an LF-MSR depending upon the
specific configuration of the plant. Recognizing this fact, an objective of
this work will be to identify key considerations for the analysis of PIEs in
LF-MSRs for Plant Operating States (POSs) other than at-power opera­
tions, such as shutdown conditions. Using guidance in the non-LWR PRA
Standard (ASME/ANS, 2013), a POS is defined in the present work as “a
standard arrangement of the system during which conditions are rela­
tively constant and are distinct from other configurations in ways that
impact risk.” The standard requirements for IE analysis recognize that
the possibilities and frequencies of IEs are highly dependent on the POS.

similar plants (based on safety assessments and system operating expe­
rience) to support comprehensiveness (IAEA, 1993; CCPS, 2015;
ASME/ANS, 2013; NRC, 1983; IAEA, 2010). Although the MSRE rep­
resents the only LF-MSR system with significant operating experience,
and the authorization for the MSRE was largely deterministic (Flanagan,
2017), a Preliminary Hazards Analysis (PrHA) was documented (Beall,
1961) and used as an input to the final MSRE Safety Analysis Report
(SAR) (Beall et al., 1964). PIEs identified for the MSRE in these reports
include some PIEs that are typically considered for other reactor types
(e.g., uncontrolled control rod withdrawal and loss of heat sink) as well
as some PIEs unique to LF-MSRs (e.g., freeze valve failure, loss of
graphite from the core, and precipitation of fissile material). One
notable weakness of the pre-operational MSRE safety assessment was
that the analysis focused exclusively on PIEs that could result in release

of radioactive material from a single inventory: the fuel salt. As will be
discussed in Section 3.1, during different POSs, significant inventories of
radioactive material could also be present in the MSRE off-gas and in the
MSRE fuel salt processing system. Only a single, bounding scenario
resulting in the release of volatile radionuclides during processing of the
fuel salt was documented (in a separate report by Lindauer, 1967) before
processing operations were conducted, and there does not seem to have
been any documented efforts to identify PIEs that could lead to release of
volatile radionuclides from the MSRE Off-Gas System (OGS). A recent
effort (Chisholm et al., 2018) grouped the PIEs identified by the MSRE
team in the PrHA (Beall, 1961) and SAR (Beall et al., 1964) into 7
different categories; however, without the use of a systematic and
comprehensive search for PIEs, the list of MSRE PIEs developed by
Chisholm et al. (2018) cannot be considered complete.
Another recent study (Geraci, 2017) was conducted to identify key
PIEs for a modern commercial LF-MSR design, Flibe Energy’s Liquid
Fluoride Thorium Reactor (LFTR). A list of PIEs was compiled by
surveying generic lists of LWR PIEs (IAEA, 1993), NRC reports (Mack­
owiak et al., 1985; Poloski et al., 1999; Eide et al., 2007; NRC, 1990),
and MLDs being developed for solid-fueled Fluoride-cooled
High-temperature Reactors (FHRs)6 (Mei et al., 2014; Zuo et al., 2016)
to identify PIEs that related to the hazards identified by the What-If
analysis7 of the LFTR design conducted by the Electric Power
Research Institute (EPRI) (2015). A total of 18 PIEs were identified, with
10 PIEs determined to be similar to those typically considered for LWRs
and 8 determined to be unique to the LFTR design. However, the anal­
ysis in (Geraci, 2017) does not explicitly mention hazards or PIEs that
could potentially result in release of radioactive material from the OGS;
further, the PIEs identified in the study that relate to radioactive ma­
terial inventories other than the fuel salt are either: broadly defined (e.

g., operator error), related to external events (e.g., seismic events), or
are internal events that potentially impact many plant functions simul­
taneously (e.g., fire within the plant or loss of offsite power without
scram). Because the only LF-MSR-specific reference surveyed for this PIE
analysis was a What-If analysis (which is not a comprehensive PHA
method, see CCPS, 2008), a more comprehensive study of hazards and
potential initiators is warranted to provide confidence that important
PIEs were not overlooked.
An example of the performance of a systematic search for PIEs for an
LF-MSR design is presented in (Pyron, 2016). In the study, Pyron applies
the MLD approach to Thorium Tech Solution Inc.’s FUJI-233Um design
(IAEA, 2007). The PIEs identified in the MLD were compared to a list of
FHR PIEs (Allen et al., 2013) and typical examples of events analyzed in
LWR PRAs (NRC, 2007; Schweizerische Eidgenosse, 2009) and then
grouped into 8 categories. All of the categories but one (i.e., the

2.2. Approaches for identifying initiating events in advanced reactor
designs
Risk assessment (e.g., PRA or PSA) is a key component of a RIPB
safety assessment (NRC, 2019; NEI, 2019; IAEA, 2019). Along with
system familiarization, identification of PIEs is acknowledged as one of
the first steps in evaluating risk associated with system designs in many
industries (Modarres, 2006), including the aerospace (NASA, 2011),
chemical process (CCPS, 2000), and commercial nuclear industries
(NRC, 1983; IAEA, 2010). A frequently cited tool to facilitate the iden­
tification of PIEs is the Master Logic Diagram (MLD) (IAEA, 1933;
Modarres, 2006; NASA, 2011; NRC, 1983). MLD is a deductive (i.e.,
top-down) analysis that results in a model that resembles a fault tree, but
is intended to document a thought process rather than calculate a failure
probability (Papazoglou and Aneziris, 2002). The MLD approach can be

useful to determine elementary failures (or combinations of elementary
failures) that could challenge normal operations; however, development
of an MLD alone does not provide sufficient confidence that PIEs have
been comprehensively identified (IAEA, 2010).
It is worthwhile to note that example applications of MLDs vary from
case to case in relation to content and structure, but all lead to a sys­
tematic identification of PIEs for a particular design. An objective of this
paper is to propose a suitable structure for an LF-MSR MLD that can be
used not only for identifying PIEs, but also for forming the structure of
the plant response model for PIEs that are identified.
The combination of a deductive analysis (such as MLD) with an
inductive analysis to determine hazardous physical and/or chemical
reactions of concern to a design has been found to be particularly
effective to ensure completeness of PIE identification and resolution of
uncertainty surrounding design quality (Nagel and Stephanopoulos,
1995). The variety of industry-standard inductive analyses includes:
semi-structured PHA methods (e.g., What-If analysis), structured PHA
methods (e.g., Hazard and Operability, HAZOP), and structured analysis
of failure modes (e.g., Failure Modes and Effects Analysis, FMEA) (CCPS,
2015). Selection of a specific hazard evaluation method is dependent
upon several factors, including design maturity, nature of the facility,
and intended use of the results of the study (Chisholm et al., 2019a). For
example, the results of a HAZOP study are typically more comprehen­
sive than those of a What-If analysis, and a HAZOP study requires less
detailed design information than does an FMEA (CCPS, 2008). Detailed
guidance on selecting and conducting various hazard evaluation studies
is available in the references (CCPS, 2008; Stamatis, 2003; Crawley and
Tyler, 2015; EPRI, 2018; EPRI, 2019a; NRC, 2001).
2.3. Relevant LF-MSR safety assessment efforts
In addition to original analyses, an exhaustive search for PIEs should

also involve the review of lists of PIEs that have been developed for

6

i.e., solid-fueled, molten salt-cooled reactors.
The What-If analysis technique is a loosely-structured, brainstorming PHA
method in which hazards are evaluated through the asking of questions or
voicing of concerns about possible undesired events (Center for Chemical Proce,
2008).
7

5
This use deviates from the definition of “hazard analysis” presented in the
ASME/ANS Non-LWR PRA Standard (American Society of Mecha, 2013).

3


B.M. Chisholm et al.

Progress in Nuclear Energy 129 (2020) 103507

“MSR-specific category”) were derived based upon the categories of
Anticipated Operational Occurrences (AOOs) and postulated accidents
recommended in the US NRC Standard Review Plan for LWRs (NRC,
2007). Although the MLD developed in (Pyron, 2016) includes consid­
eration of PIEs for the release of radioactive material from inventories
other than those related to the fuel salt loop, there is a disparity between
the resolution of the PIE decomposition that could lead to the release of
fuel salt and that of PIEs that could lead to the release of material from

other inventories. For example, “release of core material/core damage”
is decomposed into 7 hazards that could result in a transport of fuel salt
through the first barrier to its release (including insufficient reactivity
control, insufficient cooling, overcooling, etc.), while “off-gas system
failure” is not decomposed any further in the MLD. Therefore, it seems
that use of an inductive analysis tool, such as a HAZOP study, may be
able to increase the understanding of functional and/or specific sub­
system or component failures that could contribute to a release of
radioactive material from the OGS of an LF-MSR.
A recent workshop was held with the objective of identifying PIEs for
a generic LF-MSR design, with participants including representatives
from 7 prospective reactor vendors, industry bodies, US and Canadian
regulators, US and Canadian national laboratories, and the academic
community (Holcomb et al., 2019). To facilitate the brainstorming ex­
ercise, summary high-level design information, taken from the MSRE
and the concepts for both the Molten Salt Demonstration Reactor and
the Molten Salt Breeder Reactor, for the following subsystems was
briefly presented:
•
•
•
•
•

the systems or procedures used for detection, prevention, and mitiga­
tion, while the MLD offers a more convenient graphical tool to present
hazards and understand logical connections between different hazards
(G`erardin et al., 2019). These conclusions support the idea that the
combination of a deductive analysis (such as MLD) combined with an
inductive analysis (such as an FFMEA or a HAZOP study) is an effective

way to systematically and comprehensively identify PIEs for a design
that does not benefit from extensive prior safety assessment information
or operating experience. However, the search for MSFR PIEs only
considered PIEs for normal operations. As will be discussed in the
following section (Sect. 3), it is possible that for some LF-MSR designs,
the composition and physical location of the major inventories of
radioactive material will vary depending upon the POS. Accordingly, the
challenges to the barriers that are intended to prevent the release of
radioactive material (and the safety functions protecting the barriers)
may need to be evaluated separately for each inventory for each POS to
ensure a comprehensive enumeration of PIEs in LF-MSR designs.
The analysis presented in the following sections evaluates how to
incorporate the insights from the review of the above efforts into the
systematic approach for identifying MSRE PIEs.
3. Methodology
The approach to identify PIEs for the MSRE primarily draws from the
LMP guidance on PRA development (Southern Company, 2019) and the
non-LWR PRA Standard (ASME/ANS, 2013). The identification of PIEs
discussed in this article is a portion of a larger project that had the
objective of demonstrating how early stage reactor developers might
exercise various aspects of the LMP’s TI-RIPB methodology (Nuclear
Energy Institute, 2019) that has been endorsed by the US NRC in Draft
Regulatory Guide DG-1353 (NRC, 2019); discussion of that project
structure and presentation of other portions of the work are available in
the references (EPRI, 2018; EPRI, 2019a).
The MSRE design was chosen to provide an illustrative demonstra­
tion of the TI-RIPB methodology because it represents an early stage
design with a unique set of detailed, publicly available information
associated with LF-MSR design and operation. Most notably, the original
MSRE literature (Lindauer, 1967; Robertson, 1965; Moore, 1972; Guy­

mon, 1973) has sufficiently detailed information to support the evalu­
ation of hazards associated with “auxiliary” systems containing
significant inventories of radioactive material, such as the OGS and fuel
processing systems. Although modern commercial LF-MSR design con­
cepts may deviate substantially from the MSRE design in ways that
impact the risk profile of the plant (e.g., inclusion of power cycle
equipment), the amount and level of detail of the publicly available
MSRE design information enabled a more in-depth application of the
developed methodology compared to what would be possible using a
less detailed design. The MSRE PIEs identified by this work may be
useful as a starting point for the identification of PIEs for other LF-MSR
designs; however, the approach to PIE identification that is demon­
strated is technology-inclusive such that it can be applied to any nuclear
reactor design.
Finally, because this study is the first comprehensive evaluation of
PIEs for the MSRE, the present analysis focuses only on the identification
of internal events and does not enumerate PIEs related to external events
(such as flooding or seismic events). This prioritization of the evaluation
of internal events in early safety analysis is consistent with international
guidance (Wielenberg et al., 2017) and US nuclear industry standards
(ASME/ANS, 2013). The identification and evaluation of external events
would need to be covered for a full scope risk assessment of the MSRE
design; however, this study prioritized the demonstration of a tool that
could be used to analyze a reactor design at the conceptual or pre­
liminary design stages.

Reactor and fuel salt system;
Drain tank and decay heat removal system;
Off-gas system;
Fuel processing system; and

Reactor building.

For each of the subsystems, the participants of the workshop were
asked to brainstorm “what could go wrong?” and the answers were
recorded (Holcomb et al., 2019). The structure of the study to brain­
storm PIEs that could pertain to inventories of radioactive material other
than the fuel salt represents an improvement in comprehensiveness over
previous studies that have focused mostly on the fuel salt system;
however, the 140 PIEs listed in (Holcomb et al., 2019) were not cate­
gorized beyond the subsystem to which they pertain. The list of PIEs in
(Holcomb et al., 2019) represents the results of an inductive analysis of
PIEs that can be used to supplement more comprehensive design-specific
studies.
Perhaps the most systematic and comprehensive effort to identify
and evaluate PIEs for an LF-MSR to-date is the analysis described in
(G`erardin et al., 2019). As part of the Safety Assessment of the Molten
Salt Fast Reactor (SAMOFAR) project under the Horizon 2020 Euratom
research program, Gerardin et al. developed an initial list of PIEs for
normal operating conditions of the Molten Salt Fast Reactor (MSFR)
conceptual design through use of both the MLD approach and perfor­
mance of a Functional Failure Modes and Effects Analysis (FFMEA).
Combining the results of both analyses, 13 “families” of PIEs were
identified by grouping together PIEs that resulted in similar conse­
quences and at least one “representative event” was identified for each
family. The representative PIEs were assumed to envelope all similar
PIEs in terms of radiological consequences, but it is noted in (G`erardin
et al., 2019) that the list of PIEs will be iteratively updated as additional
data and design detail is developed. Based on the list of PIEs, it was
concluded in (G`erardin et al., 2019) that PIEs were identified for the
MSFR that had not previously been identified for LWRs, such as “loss of

fuel flow.”
Additionally, Gerardin et al. concluded that, in general, the results of
the MLD and FFMEA methods agreed well, but some events were iden­
tified by only one method and not the other. In particular, the inductive
method of the FFMEA was determined to have provided more detail on
4


B.M. Chisholm et al.

Progress in Nuclear Energy 129 (2020) 103507

3.1. Overview of MSRE design and major inventories of radioactive
material

radioactive materials in the MSRE requires the consideration of mate­
rials existing in different forms and different concentrations, which are
contained by an array of different barriers to release. Because these
aspects (especially the barriers to release) can vary substantially for
different POSs, a preliminary list of major MSRE POSs was developed
using guidance from the ASME/ANS non-LWR PRA Standard
(ASME/ANS, 2013). Table 1 provides an overview of important MSRE
POSs. For each POS, original MSRE design and operations reports (Beall
et al., 1964; Lindauer, 1967; Robertson, 1965; Moore, 1972; Guymon,
1973) were reviewed and used to define each unique inventory on the
basis of fundamental criteria, such as chemical composition, physical
properties, and barriers to release. The following paragraphs identify
and characterize some of the major inventories of radioactive material in
the MSRE design for various POSs.
The molten fluoride-based fuel salt had fission products and trans­

uranics (including fissile material) dissolved within it. During normal
operations, the fuel salt was circulated around the fuel salt loop by the
fuel salt pump; however, the approach to ensure subcriticality of the fuel
and shut down the MSRE was to allow the fuel salt to drain via gravity
from the fuel salt loop and into at least one of two fuel salt drain tanks.
The fuel salt was kept in the fuel salt loop by a frozen plug of salt in a
freeze valve during normal operations, and this plug was thawed to
enact a fuel salt drain. Each drain tank had a dedicated freeze valve in
which a plug of salt could be frozen to isolate the vessel from the fill/
drain line once the fuel salt had drained to the tank(s).
A fraction of the volatile fission products in the fuel salt was removed
during operation to remove neutron poisons. When salt was being
circulated by the fuel salt pump, a portion of the fuel salt in the pump
bowl was sprayed out of holes in a distributor ring, which allowed noble
gas fission products (mostly xenon and krypton) to vent from the salt
(Robertson, 1965). A helium sweep gas was introduced to the pump
bowl to carry an estimated 10.36 TBq (280 Ci) each second out of the
fuel salt loop and into the so-called “main” OGS. The main OGS was
designed to provide holdup time to allow for the decay of all radioactive
isotopes to insignificant amounts – with the exception of 85Kr, 131mXe,
and 133Xe. Volume holdups were used to allow for the decay of
short-lived radioisotopes, while water-cooled charcoal beds were

A high-level schematic of the major systems of the MSRE is shown in
Fig. 1, and documentation of design details and operating experience are
available in the references (Beall et al., 1964; Lindauer, 1967; Rob­
ertson, 1965; Moore, 1972; Guymon, 1973). The approximately 8 MW
(thermal) test reactor was designed, constructed, and operated at Oak
Ridge National Laboratory (ORNL) in the 1960’s. Between 1965 and
1969, the MSRE was critical for a total of 17,655 h (Guymon, 1973). The

reactor was fueled with UF4 dissolved in a carrier molten fluoride salt.
Heat from fission was generated in the fuel salt as it passed through the
graphite channels of the reactor vessel, and then transferred in the heat
exchanger to the molten fluoride coolant salt. Fission product gases were
removed continuously from the circulating fuel salt by spraying a
portion of the salt into the cover gas above the liquid in the fuel pump
tank. From this space, the fission product gases were swept out by a low
flow purge of helium into the OGS. The coolant salt was circulated
through a heat exchanger and radiator, where air was blown axially
across the tubes to remove the heat. The air was then exhausted to the
atmosphere via a stack. The MSRE was equipped with drain tanks for
storing the fuel and coolant salts when the reactor was not operating.
The salts were drained by gravity and transferred back to the circulating
system by pressurizing the tanks with helium. The MSRE also included a
simple processing facility for the offline treatment of fuel salt batches for
removal of oxide contamination and for recovering the uranium. Addi­
tional major auxiliary systems included: (1) a helium cover-gas system
with treatment stations for oxygen and moisture removal; (2) two
closed-loop oil systems for lubricating the bearings of the fuel and
coolant pumps; (3) a closed loop component cooling system (CCS) for
cooling in-cell components using 95% N2 and less than 5% O2; (4)
several cooling water systems; (5) a ventilation system for contamina­
tion control; and (6) an instrument air system.
The development of an exhaustive enumeration of reactor specific
PIEs begins with the identification and characterization of the different
inventories of hazardous material that are present in a system design
(Southern Company, 2019). The distribution and movement of

Fig. 1. High-level schematic of major MSRE components (Guymon, 1973).
5

B.M. Chisholm et al.

Progress in Nuclear Energy 129 (2020) 103507

Table 1
MSRE plant operating states (POSs).
Plant Operating State
(POS)

Major Inventories of Radioactive
Material

Minor Inventories of
Radioactive Material

Status of Selected Barriers

Notes

At Power (Normal
Operations)

• Fuel salt in fuel salt loop
• Volatile radionuclides in main
OGS line

• Fuel salt: FV-103 frozen, FV105 and 106 thawed
• OGS: main charcoal beds

• Safety system response triggers thawing of
FV-103 (drain to drain tank via gravity)

Filling (fuel salt)

• Fuel salt in Drain Tank, fill/drain
line, and fuel salt loop
• Volatile radionuclides in auxiliary
OGS line
• Fuel salt in Drain Tank(s)
• Volatile radionuclides in auxiliary
OGS line

• Fuel salt heel in drain
tank
• Liquid waste storage
• Tritium
• Liquid waste storage
• Tritium

• Transfer FVs frozen, FV-103
thawed
• OGS: auxiliary charcoal bed

• He pressure used to fill system
• Coolant salt loop filled

• Heel/deposits in fuel salt
loop

• Deposits in main OGS
line/components
• Liquid waste storage
• Tritium
• Heel/deposits in fuel salt
loop
• Heel in fuel salt DT(s)
• Deposits in OGS lines/
components
• Liquid waste storage
• Tritium
• Heel/deposits in fuel salt
loop
• Deposits in main OGS
line/components
• Liquid waste storage
• Tritium

• Transfer FVs, FV-104 and FV105 frozen
• OGS: auxiliary charcoal bed

• Heat removal by Afterheat Removal System;
fuel salt can be in 1 DT or 2

• Processing FV frozen
• Volatile radionuclides:
processing charcoal trap

None

• Similar to “Shutdown”
• Confinement barriers may
change
• System may be opened

• Fuel salt loop likely cold

Shutdown

Fuel salt processing

• Fuel in Fuel Storage Tank (FST)
• Volatile process flow in fuel
processing line/components

Maintenance

• Fuel salt in Drain Tank(s)
• Volatile radionuclides in auxiliary
OGS line

designed to provide average residence times of 90 days for xenon and
7.5 days for krypton (Robertson, 1965). After being held up for this
decay, the effluent of the OGS was exhausted to the atmosphere after
passing through filters to retain solids and then being massively diluted.
An “auxiliary” OGS was also provided to handle the intermittent,
relatively large flows of helium that were produced during salt transfer
operations. These off-gas streams could contain significant amounts of
radioactive gases and particulates (Robertson, 1965). Unlike the main
OGS, the auxiliary OGS did not contain any volume holdups; however,

the auxiliary OGS did have a charcoal bed that was located in the same
water-filled cell as the main charcoal beds. The effluent of the auxiliary
charcoal bed flowed into the same line as the effluent of the main
charcoal beds before passing through the stack filters, being diluted, and
eventually being exhausted via the stack. Lines were provided to flow
the off-gas from the fuel salt drain tanks to either the main OGS or the
auxiliary OGS, with isolation valves in the lines that could be opened
and closed to direct the gas flow.
Other significant inventories of radioactive material in the MSRE
design would have been present at times in the fuel processing and
handling equipment in the fuel processing cell and adjacent adsorber
cubicle. It is important to note that because the MSRE did not perform
online fuel salt processing, fuel salt would not have been in the fuel salt
system and the fuel processing system at the same time. This consider­
ation is very important for identifying POSs that condition the MSRE
PIEs. Although the radionuclides entered the fuel processing cell in the
form of fuel salt, during fluorination (for recovery of U), many elements
were volatilized out of the fuel salt. Thus, the salt remaining in the fuel
storage tank (FST) after uranium recovery, the off-gas from the fluori­
nation process (including the volatilized UF6), and the radionuclides
removed from this process stream by various components were all forms
of hazardous material that were not present anywhere else in the MSRE
system.
The material described above represents a significant majority of the
total radioactivity that was in the MSRE plant; however, there were
several other smaller distinct inventories of radioactive material. For
example, around 2 TBq (55 Ci) of tritium was produced in the MSRE per
day, mainly due to neutron interactions with lithium-6 in the fuel salt),

with about half of this tritium carried into the OGS by the off-gas of the

fuel salt. Some of the tritium was absorbed into the core graphite, and
measurable amounts diffused to the cooling air across the radiator and to
the reactor cell atmosphere (Briggs, 1971). Additionally, a heel of
approximately 10% of the fuel salt volume was estimated to remain in
the drain tanks after the fuel salt loop was filled (Bell, 1970), and fission,
corrosion, or activation products could have plated out on or been
absorbed into components with sustained fuel salt contact. Similarly,
OGS components could contain deposits due to condensation or the
decay of volatile radionuclides into solid daughter isotopes. At any given
point, there also may have been some amount of radioactive material
contained in the liquid waste system in the liquid waste storage tank
filters or the associated piping and pumps.
It is important to note that within the framework of the LMP meth­
odology, the selection of LBEs includes the identification of AOOs, in
addition to the less likely design basis and beyond design basis events
(Nuclear Energy Institute, 2019). Thus, tracking smaller inventories of
radioactive material could be important if there are high frequency
AOOs that result in their release; hence, simply focusing on the largest
inventories of radioactive material (as typically done in an LWR PRA)
may not be sufficient for PRA of an advanced non-LWR.
3.2. Conduct of Process Hazards Analysis studies of the MSRE
The starting point for developing a model to analyze risk in a reactor
design, especially one at an early stage of design, can be the performance
of a qualitative PHA study using one of several PHA methods that are
recommended by both the nuclear (ASME/ANS, 2013) and chemical
process industries (CCPS, 2008). As part of a larger project led by the
authors of this article (EPRI, 2019a), the HAZOP method was selected
for use in order to gather qualitative insights about the MSRE design and
to support the development of more quantifiable models of risk (Chis­
holm et al., 2019a, 2019b). In order to conduct a HAZOP study, it is

necessary to divide the reactor design into analyzable sections or
“nodes.” Based on a review of MSRE design information, 21 relevant
nodes were identified based on primary function and normal operating
conditions (a complete list of the nodes is available in EPRI, 2019b). Due
6


B.M. Chisholm et al.

Progress in Nuclear Energy 129 (2020) 103507

• Level 9: Occurrence contributing to functional failure
• Levels 10+: Specific subsystem/component failures with similar
system consequences

to funding and time constraints, it was not possible to conduct a com­
plete HAZOP study on every individual node; accordingly, it was
necessary to select the nodes of the MSRE that were of highest priority to
be the subject of a HAZOP study.
Some of the nodes identified in the MSRE do not differ substantially
from systems with significant industrial experience (e.g., the tower
cooling water system and the instrument air system) and others nodes
may not be common to modern commercial MSR design concepts (e.g.,
the sampler-enricher). Additionally, because PRA models are typically
developed for a specific combination of radioactive material inventory,
POS, and hazard group (ASME/ANS, 2013), an important step of system
characterization was to develop an understanding of which nodes would
contain (or interface with) the major inventories of radiological mate­
rials within the MSRE design. Performing a PHA study on these nodes
will likely help identify PIEs of most interest to LF-MSR designers and

regulators, since the consequences of event sequences associated with
these nodes have the potential to be more severe than those associated
with other nodes. Thus, the first MSRE nodes selected to be analyzed
using the HAZOP method were the main MSRE OGS, the component
cooling system (CCS), the fuel salt processing equipment, and the fuel
salt loop.
Although the MSRE CCS did not contain a significant radioactive
material inventory during normal operations, the system: performed
functions that will likely need to be addressed in most or all MSR de­
signs, was integral to safe operation of the MSRE, and had not been the
subject of detailed prior hazard evaluations or risk assessments. In the
MSRE design, the CCS interfaced with the reactor cell atmosphere,
which could become contaminated if radionuclides from the fuel salt
loop or main OGS were transported past the first barrier to their release.
The MSRE CCS also had a direct interface with the MSRE stack and the
environment.
Many of the MSRE HAZOP study results (discussed in detail in Sec­
tion 4.1) identified causes that could result in the failure of a barrier (or
multiple barriers) intended to prevent the release of radioactive mate­
rial. Regarding the interface between the HAZOP study and the devel­
opment of the MSRE MLD, such causes documented in the HAZOP study
results were used to inform the decomposition of the lower levels of the
MLD, including: challenges leading to barrier failure, functional failures
producing the challenge, and system or component failures resulting in
the failure of the function protecting the barrier.

The LMP guidance on PRA development provides some suggestions
for considerations that were used to organize the logical decomposition
in the MLD (Southern Company, 2019). For example, as mentioned in
Sect. 3.1, reactor-specific PIEs can be grouped based on which inventory

of radioactive material they could cause to be released. However, the
discussion in Sect. 3.1 also demonstrated that the barriers in the MSRE
that are intended to prevent the release of a single inventory of material
can vary for different POSs, including those listed in Table 1. In the
MSRE MLD, Level 2 corresponds to the POSs and Level 3 is the major
inventories of radioactive material that could be released during each
POS. The safety approach taken by the MSRE designers was to ensure
that each inventory had at least two levels of independent barriers be­
tween the material and the environment (Beall et al., 1964); Level 4
continues the decomposition by the level of the barrier that fails to
contain radionuclides. As discussed further in Sect. 4, the barriers that
are intended to contain radionuclides in LF-MSRs are not always struc­
tural barriers that prevent the transport of all materials. For example,
the MSRE processing system consisted of a variety of functional barriers
(including NaF traps, a caustic scrubber, and activated charcoal traps)
that were intended to contain certain radionuclides but allow helium
cover gas to flow through the system and be exhausted to the
atmosphere.
PIEs with similar consequences that require similar responses by
plant systems are often grouped together in PRA models (ASME/ANS,
2013). In the MSRE, the plant responses that are important to mitigate
the consequences of a barrier failure are dependent upon where the
radioactive material is transported following the failure. For example,
different plant responses would be required if the main charcoal beds
failed in such a way that radioactive material was released to the
Charcoal Bed Cell or if Volume Holdup 1 in the main OGS failed in such a
way that radioactive material was released to the reactor cell, even
though both the main charcoal beds and Volume Holdup 1 constitute
part of the first barrier to release of radioactive material in the OGS.
Thus, Level 5 of the MSRE MLD decomposes the PIEs based upon the

interface through which a specific barrier failure allows the radioactive
material to be transported. The interfaces and barriers for the radioac­
tive material inventories in the MSRE fuel salt and off-gas during normal
operations are displayed in Tables 2 and 3, respectively.
Level 6 of the MLD separates the challenges to individual barriers
based on whether they would lead to a rapid failure of a barrier (i.e.,
“acute”) or contribute over time to the failure of a barrier (i.e., “latent”),
and Level 7 is the specific challenge that leads to the failure of the
barrier. In general, a structural failure of a barrier can be due to (1)
overpressure, (2) underpressure, (3) corrosion, (4) erosion, (5) external
loading, (6) high temperature, or (7) vibration (Papazoglou and Ane­
ziris, 2002). Because some of the barriers in the MSRE are functional,
some causes leading to underperformance of the containment function
are also included in the MLD. Level 8 of the MLD distinguishes the
functional failure that presents the challenge to the barrier, and Level 9
contains the occurrence that represents the functional failure. Any
decomposition past Level 9 in the MSRE MLD displays specific subsys­
tem or component failures that would have similar consequences that
contribute to the occurrence shown in Level 9. Within the context of the
LMP framework, the functions presented in Level 8 of the MSRE MLD
represent safety functions that are responsible for the prevention and/or
mitigation of an unplanned radiological release from any source within
the plant, and the systems and components performing these functions
are decomposed in Level 9 and beyond. These functions, systems, and
components can be used in a TI-RIPB manner for safety classification of
equipment and to evaluate defense-in-depth (Nuclear Energy Institute,
2019).
For the first level of barriers, the occurrences in Level 9 can be

3.3. Development of MSRE Master Logic Diagram

In addition to the PHA studies of the MSRE design, the MLD approach
was used to systematically identify any PIEs that may have been over­
looked by the inductive HAZOP method. An MLD additionally provides a
visual tool to organize PIEs that are identified. The “top event” of the
MSRE MLD is the release of radioactive material. This undesired event is
then logically decomposed down into simpler contributing events that
could lead to the top event (Papazoglou and Aneziris, 2002). The
decomposition continues until a sufficient level of detail is reached and
all physically possible phenomena have been considered. The basic
events that cannot be further divided into sub-events represent PIEs for
the MSRE design.
The MLD for the MSRE PIEs was developed according to the
following levels:
•
•
•
•
•
•
•
•

Level 1: Release of radioactive material (overall event of interest)
Level 2: POS during which the release occurs
Level 3: Inventory of radioactive material with potential for release
Level 4: Level of barrier between inventories and the public/
environment
Level 5: Interface where barrier fails
Level 6: Acute vs. latent failures of barrier
Level 7: Challenge leading to failure of barrier

Level 8: Functional failure leading to barrier challenge
7


B.M. Chisholm et al.

Progress in Nuclear Energy 129 (2020) 103507

Table 2
Interfaces and barriers for radioactive material in the MSRE fuel salt during normal operations.
Interface (Second
Barrier to RN
Release)

RN Inventory Boundary (First Barrier)

Third Barrier to RN Release

Reactor Cell and CCS

Fuel salt piping, reactor vessel, fuel salt
pump bowl, heat exchanger shell,
freeze flanges
Heat exchanger tubes

MSRE Building and Ventilation System

Coolant Salt System

Notes

Coolant Cell/MSRE Building and Ventilation System (Coolant
Cell not maintained at negative differential pressure like Reactor
Cell and Drain Tank Cell)
Reactor Cell and CCS/MSRE Building and Ventilation System

Off-Gas System

Gas/liquid interface in fuel salt pump
bowl

Cover Gas System

Fuel salt pump bowl

Reactor Cell/Special Equipment Room/MSRE Building and
Ventilation System

Fuel Salt Drain/Fill
System

Freeze Valve FV-103

Drain Tank Cell and CCS

considered PIEs for the MSRE; however, some of these occurrences in
Level 9 for barriers in the second level or beyond (such as the barriers in
the CCS) represent pivotal events that occur after a PIE in an MSRE event
sequence. The unique combination of successes and/or failures of these
mitigating systems determine the end state of the plant at the conclusion

of event sequences.

Transfer of material could be from Coolant
Salt into Fuel Salt or from Fuel Salt out to
Coolant Salt
Transfer of only volatile radionuclides from
fuel salt pump bowl to OGS during normal
operations
Transfer of material from cover gas to fuel
salt pump bowl only during normal
operations

identified to be capable of propagating effects from a deviation in the
CCS node to the fuel salt loop. A loss of component cooling gas flow
could compromise the ability to maintain a frozen plug of salt in the
main freeze valve below the reactor vessel. The heat conducted into the
valve body from the pipeline heaters and the circulating fuel salt could
melt the plug, which could result in an unscheduled drain of the fuel salt
loop. Although the drain tanks were designed to have geometry such
that the concern of criticality in the drain tank would be limited, the fuel
salt would be at its highest temperature and the decay heat would be at a
maximum if the reactor was drained from full power (Beall et al., 1964).
Conversely, any cause of increased heat removal by the CCS could in­
crease the size of the frozen salt plug in the freeze valve, and could in­
crease the amount of time needed to thaw the freeze valve in the case
that a fuel salt drain was initiated.
The HAZOP results also highlighted the significant role that fuel salt
chemistry can play in LF-MSR fuel salt performance, and deviations in
chemistry can be the cause of potential system deviations or upsets. For
example, deposition of materials from the fuel salt onto surfaces in the

system could: affect the ability to transfer heat from one node to another;
change the redox conditions of the salt and increase corrosion rates; foul
sensors and prevent an accurate indication of process conditions; or plug
small lines. One chemistry-related issue that was experienced during
MSRE operations was the leakage of lubricating oil from the fuel salt
pump into the fuel salt in the pump bowl. This lubricating oil broke
down in the pump bowl and was suspected to cause plugging of the offgas line from the pump bowl (Guymon, 1973). Another more serious
chemistry related deviation that was postulated (but not observed

4. Results
4.1. MSRE HAZOP study results
An excerpt depicting 2 deviations from the HAZOP study of the
MSRE main OGS during normal operations is shown in Table 4.
4.1.1. Fuel salt loop
During the HAZOP study of the MSRE fuel salt loop, a total of 66
deviations were evaluated and documented. One unique aspect
regarding the fuel salt loop is that all of the transients and accidents
evaluated by the MSRE team in the Preliminary Hazards Report (Beall,
1961) and the SAR (Beall et al., 1964) related to the inventory of
radioactive material in the fuel salt loop. Consequently, the HAZOP
study results for the fuel salt loop identified more deviations that had
been considered by the MSRE team in the original ORNL documentation,
compared to the results of the studies on the other nodes. However,
deviations from normal operations in the fuel salt loop that had not been
covered in the MSRE documentation were able to be identified. For
example, an interface between the fuel salt loop and the CCS node was

Table 3
Interfaces and barriers for radioactive material in the MSRE off-gas during normal operations.
Interface (Second Barrier to

RN Release)

RN Inventory Boundary (First Barrier)

Third Barrier to RN Release

Notes

Reactor Cell and Component
Cooling System (CCS)
Concentric OGS Pipe

Fuel salt pump bowl, OGS piping and
connections, Volume Holdup 1
OGS piping and connections in Coolant Drain
Cell
OGS piping and connections in Instrument Box
Volume Holdup 2, Main Charcoal Beds,
Auxiliary Charcoal Beds (structural integrity)
HCV-533 (closed)

MSRE Building and Ventilation
System
Coolant Drain Cell/MSRE
Building and Ventilation System
Vent House
N/A

Off-gas could potentially flow from fuel salt pump bowl
into cover gas system piping

Coolant Drain Cell is not kept at a negative differential
pressure like Reactor Cell

Main Charcoal Beds (functional)

N/A

OGS piping and connections in Valve Pit
OGS piping and connections in Vent House

N/A
N/A - See Note

Instrument Box
Charcoal Bed Cell (waterfilled)
Auxiliary Charcoal Bed
(functional)
MSRE Stack (atmosphere)
Valve Pit
Vent House

N/A - See Note

8

Charcoal Bed Cell is located underground next to MSRE
building
During normal operations, flow is isolated from Auxiliary
Charcoal Bed by closing of HCV-533
HCV-557C is designed to automatically isolate flow to

MSRE stack upon high levels of radiation
Valve Pit is located next to MSRE building
If Main Charcoal Beds function as intended, gas stream
should have low concentration of radioactive material


B.M. Chisholm et al.

Progress in Nuclear Energy 129 (2020) 103507

Table 4
Example of deviations captured in HAZOP study of MSRE main OGS during normal operations.
DEVIATION

CAUSE

CONSEQUENCE

SAFETY SYSTEMS

Temperature
Increase

Decreased heat removal by charcoal bed cell cooling
water system (Volume Holdup 2 [VH-2] and main
charcoal beds)

• Possible damage to beds from overheating
• Reduction in adsorber effectiveness, increased
radioactivity of effluent

Pressure
Increase

High fuel salt pump bowl cover gas pressure (e.g.,
regulator failure)

• Increased off-gas flow through entire system (VH1, particle trap, VH-2, charcoal bed)
• Increased particulate carryover from fuel salt
pump bowl
• Decreased residence time in VH-1, VH-2, and
charcoal beds Increased pressure downstream of
pump bowl

• Cooling tower water flow rate (FI–851C) and
temperature indications (TI-858)
• Radiation monitors downstream of charcoal
beds to observe changes in radioactivity (RE557-A/B)
• Pressure indications in fuel salt pump bowl (PT522/592)
• RM-557A radiation monitors downstream of
charcoal beds with automatic safety action (RM557-A/B)
• Temperature indications throughout system
(TE-522-1, TE-524-1, TE-556-1A)

Additionally, the HAZOP studies identified many deviations that
could affect void fraction and thus have effects on the reactivity of the
MSRE core. This interaction places a higher significance on the interface
between the OGS node and the fuel salt system. Any scenario that can
increase or decrease the amount of volatile fission gases removed from
the fuel salt (including plugging in the off-gas line, plugging of the

stripping spray rings in the pump bowl, or high cover gas supply pres­
sure) could also affect parameters such as power level, pressure, and
temperatures in the fuel salt loop.

during operation) was oxygen contamination of fuel salt that was sig­
nificant enough to alter redox conditions such that uranium precipita­
tion would be possible.
4.1.2. Off-gas system and component cooling system
During the HAZOP studies, 35 potential deviations were identified
and evaluated for the MSRE OGS, and 40 deviations were identified and
evaluated for the CCS. Unlike the MSRE fuel salt loop, a portion of the
boundary of the OGS during normal operations was formed by a func­
tional barrier. Rather than providing a structural barrier to prevent
transport of any material through the charcoal beds, the activated car­
bon retained certain elements (such as Kr and Xe) for an extended period
of time via adsorption, and this residence time allowed for the decay of
radionuclides. The results of the HAZOP study identified many de­
viations from normal operating conditions that would decrease the
effectiveness of this functional barrier. For example, ignition of the
activated carbon in the charcoal beds due to volatile organic materials in
the off-gas stream or a rapid expansion of water vapor due to an
inleakage of cooling water could lead to a reduction in the adsorption
effectiveness and lead to an increased rate of radioactive material
transport past the normal main OGS boundary (Zerbonia et al., 2001). In
addition, any cooling water that leaked into the bed would have the
potential to react with any remaining fluorine in the off-gas and produce
HF, which is toxic and corrosive. The scenario of water intrusion into the
charcoal beds poses a possible occupational hazard as well as a method
to damage components important to the control of radioactive material.
During the MSRE HAZOP studies, many deviations were identified

that suggested that interfaces between gas and salt pose potentially
hazardous conditions in an LF-MSR design. MSRE operational experi­
ence suggested that the corrosion rate at these surfaces could be
significantly higher than corrosion rates encountered elsewhere in the
system (Guymon, 1973), and it is also possible that the deposition rate of
impurities from the salt on structural materials could be higher at these
locations. The MSRE team also experience a significant number of
complications related to fuel salt “aerosol” or “mist,” which was caused
by bubbling and splashing around the interface between the fuel salt and
the cover gas in the fuel salt pump bowl. This mist could be responsible
for material transport from a fuel salt system to an OGS, which could
result in plugging of small-diameter off-gas lines. Another scenario that
was experienced during MSRE operation was thermal expansion of the
fuel salt that was significant enough to allow fuel salt to overflow into
the OGS from the fuel salt pump bowl (Guymon, 1973). Because the
coefficient of thermal expansion for the salts considered for use in
LF-MSRs is so high, increases in level due to thermal expansion represent
another potential cause of plugged lines (especially small diameter
off-gas lines). If a thermal expansion transient is significant enough, it is
possible that any seals above the salt/gas interface (e.g., the fuel salt
pump shaft seal) could be at risk of being compromised by the hot,
radioactive salt.

4.1.3. Fuel processing system
A total of 88 potential deviations were identified and evaluated for
the components involved in the fluorination of MSRE fuel salt. One
major issue experienced during the operation of the fluorinating
equipment in the MSRE was corrosion (Lindauer, 1969). The high con­
centration of fluorine in the gas stream attacked the Hastelloy-N struc­
tural material and increased the amount of impurities (such as NiF2,

FeF2, and CrF2) in the fuel salt. Additionally, fluorination in the FST
allowed for the formation of MoF6, which is volatile and therefore was
carried out of the FST along with the other volatile species (such as UF6).
Two deviations identified during the HAZOP study of this node per­
tained to corrosion concerns. First, increased fluorine concentration in
the FST could be caused by a failure of the fluorine control valve. If no
corrective actions were taken, this increase in fluorine concentration
would likely increase the corrosion rate in the FST, which would in­
crease the production rate of MoF6. This MoF6 in the process gas stream
could compete with UF6 for absorption in the uranium absorbers or
produce hydrated oxides of Mo that could cause an obstruction in lines
downstream of the caustic scrubber. Additionally, because Mo has a
similar heat capacity to U, the accuracy of the Hastings mass-flowmeters
used to monitor the uranium content of the gas stream entering and
exiting the absorbers could be negatively impacted (Lindauer, 1969).
The second deviation related to increased corrosion rates could be
caused by a loss of helium flow in the gas flow upstream of the caustic
scrubber. This loss of helium flow could increase the rate of corrosion in
the dip tubes of the caustic scrubber. Although a microphone to monitor
plugging was provided, as well as a spare (redundant) dip tube in the
scrubber that could be used in case the primary dip tube plugged, it is
possible that increased corrosion rates in the dip tubes could result in
plugging significant enough to produce reverse flow through the ura­
nium absorbers. This reverse flow was identified during the HAZOP
study to be a possible cause of disrupted process flow and the possible
desorption of UF6 or other radionuclides that had been previously
deposited in the absorbers.
As mentioned above, the role of fuel salt chemistry in the safe and
reliable performance of an LF-MSR system emphasizes the importance of
having the ability to accurately monitor conditions of the salt. The MSRE

did not have the capability to analyze salt conditions during processing
and relied on batch samples taken from the system and analyzed in
9


B.M. Chisholm et al.

Progress in Nuclear Energy 129 (2020) 103507

plugging in the main OGS piping near the outlet of the fuel salt pump
bowl represents a failure to control the pressure of the main OGS and a
failure to control the pressure of the fuel salt loop, since the off-gas
would not be able to be swept out of the fuel salt pump bowl. Howev­
er, the plugging could be caused (or exacerbated) by a failure to control
the fuel salt chemistry (e.g., ingress of contaminants leading to increased
deposits in the off-gas line) or a failure to control heat removal from the
off-gas flow (e.g., overcooling of the OGS piping by the CCS resulting in
condensation). Additionally, because the volatile fission product poisons
cannot be swept into the OGS from the fuel salt pump bowl, this PIE also
represents a failure to control nuclear heat generation in the fuel salt
loop. Therefore, for the radioactive material in the fuel salt during
normal operations, the “basic event” of a plug in the off-gas outlet from
the fuel salt bowl can be identified as a possible contributor to the
structural failure of a barrier due to overpressure, as well as a possible
contributor to the structural failure of a barrier due to high temperature.
In comparison to the HAZOP method, the MLD approach was better
suited to identify specific latent phenomena contributing to barrier
failure. Examples of such phenomena include excessive radiation dam­
age, excessive thermal fatigue, and excessive erosion rates. The MLD
approach also identified pre-existing deficiencies that could contribute

to barrier failures such as an insufficient seal in a freeze flange (leading
to leakage or rupture of the flange) or an insufficient frozen plug of salt
in a freeze valve (leading to leakage or spurious thawing of a freeze
valve). Another advantage of the MLD method over the HAZOP
approach is that the visual representation of the MLD is easier to un­
derstand quickly than are the tabular results of the HAZOP study.
Although the MLD approach was able to identify some failures and
phenomena that were not identified during the HAZOP study, the
HAZOP results identified a higher number of PIEs that were not readily
identified by the development of the MLD alone. The HAZOP approach
was more useful to examine the MSRE due to the room for creativity and
flexibility during the brainstorming of deviation causes. In contrast to
the rigid structure of the MLD, the use of parameter/guideword com­
binations such as “high temperature” and “high pressure” were partic­
ularly useful to identify subsystem and component failures that could
potentially lead to the failure of a barrier intended to prevent the release
of radionuclides.
Finally, perhaps the most significant difference between the appli­
cation of the MLD and HAZOP approaches was the amount of informa­
tion documented during the analysis of PIEs. While the results of the

another facility, separate from the MSRE facility. As an alternative to
online salt chemistry measurements, the MSRE team used surrogate
measurements, and the HAZOP study identified deviations that could
affect the efficacy of these surrogates to adequately indicate system
conditions. For example, incorrect calibration of the mass-flowmeters
used during fluorination could lead to material accountability errors
when calculating how much uranium has been removed from the fuel
salt and the component in which it was deposited.
One component containing an inventory of particularly hazardous

material that was identified during the HAZOP study was the caustic
solution in the scrubber. Due to the changes made to the system before
operation, the scrubber became the main component responsible for the
capture of iodine and fluorine (Lindauer, 1969). Because these changes
were made after the initial system design, there is limited information
available regarding analysis of the contents of this component. Multiple
deviations that could result in a release of the material from the scrubber
to the fuel processing cell were identified during the HAZOP study,
including violent reactions in the scrubber or decreased heat removal
from the scrubber. It is possible that the release of this material to the
fuel processing cell could also volatilize iodine.
4.2. Development of MSRE MLD
The MLD approach was also used to analyze the same inventories of
radioactive material that were studied using the HAZOP method (i.e.,
the fuel salt during normal operations, the off-gas during normal oper­
ations, the process flow during fluorination, and the fuel salt during
fluorination); EPRI’s CAFTA software (EPRI, 2014) was used to create
the MLD. The highest levels of the MSRE MLD can be seen in Fig. 2, and
an example of the breakdown to Level 9 for the radioactive material in
the fuel salt off-gas during normal operations is shown in Fig. 3.
The MSRE MLD highlights the idea that many phenomena in an LFMSR are very closely coupled. For instance, in the fuel salt loop, the
magnitude of the reactivity effects due to a change in fuel salt loop
operating pressure is affected by the temperature of the fuel salt (Beall
et al., 1964). Additionally, pressure transients in the fuel salt loop have
multiple (sometimes competing) reactivity effects, including changes in
void fraction and poison concentration (Beall et al., 1964). The
complicated nature of these relationships can make it somewhat difficult
to determine the “basic event” or failed safety function that ultimately
would be responsible for a potential barrier failure. For example,

Fig. 2. Levels 1–4 of the MSRE MLD.
10


B.M. Chisholm et al.

Progress in Nuclear Energy 129 (2020) 103507

Fig. 3. Example of Levels 4–9 of the MSRE MLD for the radioactive material in the off-gas during normal operations.

MLD do convey information including where radioactive material could
be transported due to a failure of a given barrier and what function
certain systems or components perform, the tabular HAZOP results
contain much more information that could be used to support the
development of more quantifiable models of risk, such as ETA. Examples
of details captured in the HAZOP results that would be useful towards a
further analysis of risks associated with a design include discussion of
consequences that affect operability or could contribute to the failure of
a barrier in another system and discussion of safety systems that would
allow for prevention or mitigation of undesired consequences.

preventing transport of radioactive material without structurally failing.
Similar PIEs were identified for the inventory of radioactive material in
the process flow during fluorination, including insufficient charge in the
caustic scrubber and loss of helium supply flow. Either of these PIEs
could potentially lead to a release of radioactive material via the MSRE
stack if the proper response by the operators and/or plant systems is not
successful.
Multiple MSRE PIE categories were identified for scenarios in which
radioactive material did not pass through a structural barrier, but

instead flowed from one system to another. Associated with this trans­
port of radioactive material through system boundaries is a change in
the systems and functions that prevent the further release of the trans­
ported material. For example, a spurious drain of the fuel salt to the fuel
salt drain tank does not pose an immediate challenge to any of the
barriers preventing release of this material to the reactor cell; however,
certain responses of systems in the Drain Tank Afterheat Removal Sys­
tem are required to ensure that decay heat is adequately removed from
the fuel salt to prevent the barriers in the Fuel Salt Drain/Fill System
from being challenged by excessive temperature.
Another interesting observation made based on the MSRE PIEs
identified is that a failure to control pressure was identified multiple
times as a functional failure resulting in a challenge to a barrier. Overpressurization was identified as a possible cause of failure for a variety
of barriers, including the fuel salt pump seal, OGS piping and connec­
tions, and salt processing piping and components. Additionally, the
driving force for the off-gas flow is the cover gas supplied to the fuel salt
pump bowl, and the driving force for the fluorination processing flow is
the fluorine gas supplied to the FST. Thus, a blockage of flow at many
different points downstream of these vessels could contribute to the
pressurization and potential failure of multiple components upstream.
For example, plugging of the OGS piping immediately downstream of
the outlet of fuel salt pump bowl could initiate a pressure transient that
does not pose a challenge to any barriers in the main OGS, but that

4.3. Identification of MSRE PIEs
The 26 categories of PIEs identified using the HAZOP study results
and the MSRE MLD are listed in Table 5 along with the inventories of
radioactive material to which each category is applicable. It can be seen
that 5 of the categories (19%) are applicable to more than one inventory,
and none of the categories are applicable to more than two inventories.

Compared to the prior efforts to identify and group PIEs in LF-MSRs
discussed in Sect. 2.3, the categories of MSRE PIEs contain a number of
new functional failures for the removal and/or retention of volatile
nuclides. For example, a PIE identified for the MSRE off-gas during
normal operations is the ignition of the activated carbon in the main
charcoal bed, perhaps due to the presence of volatile organic material.
This failure to control heat generation from a chemical reaction in the
charcoal bed could decrease the efficiency of the adsorption reaction
and reduce the time that volatile radionuclides (like Kr and Xe) decay
before leaving the component. Thus, this PIE belongs to the category
“increased radioactive material concentration in effluent to MSRE
Stack” and would require a plant response in order to mitigate the
consequences of an increased rate of radioactive release from the MSRE
stack. The implication associated with the identification of this type of
PIE is that a barrier can fail to perform the intended function of
11


B.M. Chisholm et al.

Progress in Nuclear Energy 129 (2020) 103507

Table 5
MSRE PIE categories identified and applicable inventories of radioactive material.
PIE Category

Normal Operations –
Fuel Salt

Normal Operations –

Off-gas

X
X
X
X
X
X
X
X

X

Release of radioactive material to Reactor Cell
Leak of fuel salt material into coolant salt
Ingress of coolant salt into fuel salt
Increase in radioactive material transfer to OGS
Leakage or spurious drain of fuel salt to drain tank
Contamination of helium cover gas system
Reactivity transients with forced fuel salt flow
Reactivity transients without forced fuel salt flow
Release of radioactive material in Coolant Drain Cell
Leakage through or inadvertent opening of HCV-533
Release of radioactive material to Instrument Box
Release of radioactive material to valve pit
Release of radioactive material to Charcoal Bed Cell
Increased radioactive material concentration in effluent to MSRE Stack
Release of radioactive material to vent house
Pressure feedback transient to fuel salt pump bowl
Contamination of Fluorine Supply System

Release of radioactive material to Fuel Processing Cell
Release of radioactive material to Absorber Cubicle
Unintended criticality
Release of radioactive material to Spare Cell
Leakage of radioactive material through transfer freeze valve
Unintended flow of radioactive material to Liquid Waste Storage Tank
Pressure feedback transient to Fuel Storage Tank (FST)
Fuel salt flow into process line
Fuel salt flow into transfer line

challenges barriers to the radioactive material in the fuel salt (e.g., the
fuel salt pump bowl seal). However, the responses necessary to mitigate
the consequences of this PIE would likely involve the radioactive ma­
terial in the off-gas (i.e., providing an alternative flowpath around the
blocked line). Accordingly, the MSRE PIE categories for pressure feed­
back transients were created to capture this type of PIEs.
One category of PIEs that is commonly considered for LWRs, and has
been identified for the FUJI 233-Um and the MSFR, is a decrease in heat
extraction from the primary system (i.e., fuel salt in the case of LF-MSRs)
(Pyron, 2016; NRC, 2007; G`
erardin et al., 2019). However, calculations
made by the MSRE team indicated that, due to inherent feedback in the
MSRE fuel salt, a complete loss of load at full operating power resulted in
a mild temperature transient with no core pressure surge (Beall et al.,
1964). Additionally, the analysis of MSRE PIEs identified that an
over-temperature malfunction of the electric heaters for the fuel salt
loop could possibly affect the heat balance of the fuel salt loop in a
similar way to loss of load. Because no analysis was identified that
suggested the concern of a barrier failure related to a decrease in fuel salt
loop heat extraction (or an increase in fuel salt loop heat addition), these

PIEs were grouped under the MSRE PIE category of “reactivity transients
with forced fuel salt flow.”
Another commonly identified PIE category for LF-MSRs is a decrease
in fuel salt flow rate (Pyron, 2016; G`erardin et al., 2019). In LWRs, PIEs
that result in a decrease in Reactor Coolant System flow rate represent a
failure of the heat removal function (NRC, 2007), but in LF-MSRs, fuel
salt flow is related to both heat removal and heat generation functions. A
decrease in fuel salt flow immediately increases the number of fissions
caused by delayed neutrons released in the core, in addition to
decreasing the rate of heat removal, which increases the temperature at
the core outlet (Beall et al., 1964). However, in response to increased
fuel salt temperature, the heat generation rate in the fuel salt decreases
substantially. Accordingly, the PIEs associated with decreases in fuel salt
flow rate, such as a fuel salt pump trip, were included in the MSRE PIE
category “reactivity transients without forced fuel salt flow.” This
grouping recognizes that the timescale of the system response necessary
to mitigate challenges to barriers is different for reactivity transients that
occur with the fuel salt under natural convection instead of forced flow,

Fluorination –
Process Flow

Fluorination –
Fuel Salt

X
X
X
X
X

X
X
X
X

X
X
X
X
X
X
X
X
X

X
X

X
X

but also acknowledges that the barrier challenges associated with a
decrease in fuel salt flow are related to the reactivity balance in the loop
rather than the heat balance.
Finally, each of the individual PIEs presented in (Pyron, 2016) and
(G`erardin et al., 2019) can be grouped into one of the categories of the
MSRE PIE categories listed in Table 5. However, due to the tight
coupling of phenomena in LF-MSRs, the MSRE PIE categories identified
in this work seem to lend themselves better towards further evaluation
using traditional risk assessment methods (such as ETA). An example

from (G`erardin et al., 2019) is the comparison of two PIEs: (1) an un­
detected deviation of the fuel salt chemical composition and (2) a
rupture of the gas processing unit with a leak of processing fluid. Both of
these PIEs are considered to belong to the same PIE families in (G`erardin
et al., 2019) (i.e., “Loss of fuel composition/chemistry control”); how­
ever, the plant response required to mitigate a release of radioactive
material would be different for an event sequence in which radioactive
material has been transported past a barrier (i.e., Scenario #2) than it
would for an event sequence in which no barrier has failed yet (i.e.,
Scenario #1). By contrast, both a rupture of MSRE OGS piping and a
rupture of MSRE fuel salt piping are considered in the present work to
belong to the same MSRE PIE group (i.e., “Release of radioactive ma­
terial to the reactor cell”). Although the composition of the radioactive
material release to the cell may be different if it is released from the fuel
salt loop than if it is released from the OGS, the plant response required
to further prevent the release of the radioactive material from the
reactor cell would be similar for these two PIEs.
5. Conclusions
One of the first steps in beginning a safety assessment is defining PIEs
by systematically and comprehensively answering the question “what
can go wrong?” for a given system design. Generic lists of PIEs are
available for LWRs, but LF-MSRs do not benefit from having a wealth of
operating experience. Furthermore, design details, such as normal
operating conditions and the composition of radioactive material in­
ventories, can deviate substantially from those of LWRs. In the present
work, a methodology using a combination of MLD and HAZOP
12


B.M. Chisholm et al.

Progress in Nuclear Energy 129 (2020) 103507

approaches was used to identify and consider PIEs for a specific LF-MSR
design in a way that is conducive to the analysis of an advanced nonLWR reactor design at an early design stage. Analyzing the PIEs for a
reactor design that is at a conceptual or preliminary stage of design fa­
cilitates the incorporation of risk insights into the next iteration of the
design process and allows for the early establishment of more quantifi­
able risk assessment models that form the building blocks for PRA
models.
Using the HAZOP and MLD methods to identify how inventories of
radioactive material could be transported through barriers intended to
prevent their release identified 26 categories of PIEs for 4 distinct in­
ventories of radioactive materials in the MSRE across 2 different POSs.
Using a combination of inductive and deductive approaches provided
for a robust methodology to identify PIEs. Compared to previous efforts
to identify PIEs for LF-MSR designs, the present work identified new
functional failures in which radioactive material was not necessarily
released due to the structural failure of a component, but the material
was still transported through a boundary that would likely require a
plant response to mitigate undesired consequences. One example of such
a PIE is the overheating of the main charcoal beds in the OGS during
normal operations (possibly due to loss of cooling or to chemical re­
actions in the bed) that would reduce the effectiveness of the activated
carbon to adsorb volatile radionuclides. This occurrence could increase
the concentrations of radionuclides in the effluent to the MSRE stack
above desired levels.
Overall, the HAZOP study method was useful to identify system and
component failures that could challenge barriers intended to prevent the
release of radionuclides, as well as to document details regarding the

consequences of failures and the safety systems intended to mitigate or
prevent the consequences. The MLD approach was helpful to identify
latent phenomena contributing to barrier failure and to organize PIEs in
a readily accessible manner. However, similar to other qualitative PHA
methods, neither the HAZOP approach nor the MLD approach directly
results in the development of a quantifiable model of risk; this task
would require the use of other tools, such as Fault Tree Analysis.
The concepts of hazardous material inventories and the barriers to
the release of hazardous material were found to be fundamental to the
identification of PIEs for LF-MSRs. Significant inventories of radioactive
material may exist outside of the fuel salt that is fissioning in the core (e.
g., volatile radionuclides in the OGS and the separation of radionuclides
via processing of the fuel salt), and the barriers that are designed to
retain this material may change depending on the POS. Additionally, the
safety functions that are intended to prevent failure may be notably
different for different sets of barriers. Therefore, an exhaustive identi­
fication of PIEs for an LF-MSR should consider the challenges to the
barriers for each unique arrangement of material inventories.
The results also suggest that not all functional categories of PIEs that
are often considered for LWRs will necessarily be relevant for the safety
assessment of LF-MSRs. For example, due to inherent feedback mecha­
nisms, a complete loss of load for the MSRE design did not represent a
significant challenge to any barriers intended to prevent the release of
radionuclides. This fact emphasizes the need to focus on the major in­
ventories of hazardous materials and the failure of barriers intended to
prevent the release of the material when using the MLD methodology for
the identification of PIEs in an LF-MSR design, rather than simply basing
the functional decomposition upon the MLD structure used for other
nuclear reactor designs.
Additionally, categorizing PIEs based upon the interfaces through

which radioactive material will be transported in the case of a barrier
failure appears to be an appropriate manner to meet the objectives of IE
analysis prescribed by industry standard approaches (ASME/ANS,
2013). Although PIEs are sometimes grouped functionally (e.g.,
“radioactive release from a subsystem or component”), in an LF-MSR,
the plant responses that are important to mitigate the consequences
may be different depending on where the radioactive material is
released (e.g., “releasing radionuclides to a seal-welded containment

that is maintained at a negative differential pressure” vs. “releasing ra­
dionuclides to a water-filled concrete pit”). Grouping the PIEs based
upon the interface through which radioactive material is transported
can also help minimize the number of redundant event sequences (e.g.,
“increase in heat removal by coolant salt” vs. “loss of electric fuel salt
pipeline heater”) that will be modeled when developing more quanti­
fiable models of risk, such as event sequence diagrams or ETA.
The present identification of internal events represents the first step
of PIE analysis for the MSRE. For a full scope risk assessment of the
MSRE design, the analysis of PIEs would need to be expanded to include
identification of external hazard scenarios, the consideration of corre­
lations between internal and external hazards, and thorough consider­
ation of all PIEs for all reactor POSs (Wielenberg et al., 2017). Examples
of relevant planned future research includes tasks under the SAMOSA­
FER project to build upon the results of the SAMOFAR project (e.g.,
G`erardin et al., 2019) and increase the comprehensiveness of the risk
and safety assessment of the MSFR design. Finally, it is possible that
consideration of PIEs that could lead to other undesirable consequences
other than release of radioactive material (such as release of hazardous
chemicals or loss of investment) may be of interest to LF-MSR stake­
holders. In particular, the use of an interaction matrix may be useful to

ensure a comprehensive understanding of all potential chemical re­
actions that could occur and their associated consequences (CCPS,
2008).
Credit author statement
Brandon M. Chisholm: Conceptualization, Methodology, Investiga­
tion, Data Curation, Writing – Original Draft, Writing – Review &
Editing, Visualization, Funding acquisition, Steven L. Krahn: Concep­
tualization, Methodology, Investigation, Resources, Writing – Review &
Editing, Supervision, Funding acquisition, Karl N. Fleming: Conceptu­
alization, Methodology, Validation, Writing – Review & Editing,
Supervision.
Declaration of competing interest
The authors declare that they have no known competing financial
interests or personal relationships that could have appeared to influence
the work reported in this paper.
Acknowledgements
This work was supported by several different groups under a variety
of funding arrangements, including the US Department of Energy’s Of­
fice of Nuclear Energy (through Nuclear Energy University Program
Graduate Fellowship DE-NE0000646), the Electric Power Research
Institute (Agreement 10007945), and Southern Company. The authors
also wish to thank Oak Ridge National Laboratory for their cooperation
during the project.
The authors would like extend their sincerest gratitude to Carole
Leach, Paul Marotta, and Allen Croff for their contributions to this
article.
References
Allen, T., et al., 2013. Fluoride-Salt-Cooled, High-Temperature Reactor (FHR)
Subsystems Definition, Functional Requirement Definition, and Licensing Basis
Event (LBE) Identification White Paper. Integrated Research Project Workshop.

American Society of Mechanical Engineers (ASME) and American Nuclear Society (ANS),
2013. Standard for Probabilistic Risk Assessment for Advanced Non-LWR Nuclear
Power Plant Applications. AMSE/ANS RA S-1.4-2013.
Beall, S., 1961. Molten Salt Reactor Experiment Preliminary Hazards Report. Oak Ridge
National Laboratory. ORNL-CF-61-2-46.
Beall, S.E., et al., 1964. MSRE Design and Operations Report - Part V: Reactor Safety
Analysis Report. Oak Ridge National Laboratory. ORNL-TM-732.
Bell, M., 1970. Calculated Radioactivity of MSRE Fuel Salt. Oak Ridge National
Laboratory. ORNL-TM-2970.

13


B.M. Chisholm et al.

Progress in Nuclear Energy 129 (2020) 103507
International Atomic Energy Agency (IAEA), 2019. IAEA Safety Glossary: Terminology
Used in Nuclear Safety and Radiation Protection. IAEA, Vienna, Austria, 2018
Edition.
Kaplan, S., Garrick, B.J., 1981. On the quantitative definition of risk. Risk Anal. 1 (1),
11–27.
Lindauer, R., 1967. MSRE Design and Operations Report - Part VII: Fuel Handling and
Processing Plant. Oak Ridge National Laboratory. ORNL-TM-907 Rev. 1.
Lindauer, R., 1969. Processing of the MSRE Flush and Fuel Salts. Oak Ridge National
Laboratory. ORNL-TM-2578.
Mackowiak, D.P., Gentillon, C.D., Smith, K.L., 1985. Development of Transient Initiating
Event Frequencies for Use in Probabilistic Risk Assessments. Idaho Falls, ID. NUREG/CR3862.
McClymont, A.S., Poehlman, B.W., 1982. ATWS: A Reappraisal, Part 3: Frequency of
Anticipated Transients. EPRI. Palo Alto, CA, EPRI-NP-2230.
Mei, M., et al., 2014. Research on initial event analysis for solid thorium molten salt

reactor probabilistic safety assessment. Nucl. Tech. 37 (9), 090601.
Modarres, M., 2006. Risk Analysis in Engineering: Techniques, Tools, and Trends. CRC
Press, Boca Raton, FL.
Moore, R.L., 1972. MSRE Design and Operations Report - Part IIB: Nuclear and Process
Instrumentation. Oak Ridge National Laboratory. ORNL-TM-729B.
Nagel, C., Stephanopoulos, G., 1995. Inductive and deductive reasoning: the case of
identifying potential hazards in chemical processes. Adv. Chem. Eng. 21, 187–225.
National Aeronautics and Space Administration (NASA), 2011. Probabilistic Risk
Assessment Procedures Guide for NASA Managers and Practictioners. NASA/SP2011-3421.
Nuclear Energy Institute (NEI), 2019. Risk-Informed Performance-Based Guidance for
Non-light Water Reactor Licensing Basis Development. NEI 18-04, Report Revision 1.
Nuclear Regulatory Commission (NRC), 1983. PRA Procedures Guide, vol. 1. NUREG/
CR-2300, Washington, DC.
Nuclear Regulatory Commission (NRC), 1990. Severe Accident Risks: an Assessment for
Five U.S. Nuclear Power Plants. Washington, DC. NUREG-1150.
Nuclear Regulatory Commission (NRC), 2001. Integrated Safety Analysis Guidance
Document. NUREG-1513.
Nuclear Regulatory Commission (NRC), 2007. Standard Review Plan for the Review of
Safety Analysis Reports for Nuclear Power Plants, LWR Edition. Washington, DC,
NUREG-0800.
Nuclear Regulatory Commission (NRC), 2008. Policy Statement on the Regulation of
Advanced Reactors, 73 FR 60612.
Nuclear Regulatory Commission (NRC), 2019. Guidance for a Technology-Inclusive,
Risk-Informed, and Performance-Based Methodology to Inform the Licensing Basis
and Content of Applications for Licenses, Certifications, and Approvals for Non-lightwater Reactors. Draft Regulatory Guide DG-1353.
Papazoglou, I.A., Aneziris, O.N., 2002. Master Logic Diagram: method for hazard and
initiating event identification in process plants. J. Hazard Mater. A97, 11–30.
Poloski, J.P., et al., 1999. Rates of Initiating Events at U.S. Nucler Power Plants: 19871995. Idaho Falls, ID, NUREG/CR-5750.
Pyron, D.A., 2016. Safety Analysis for the Licensing of Molten Salt Reactors. MS Thesis.
Paul Scherrer Institute.

Robertson, R.C., 1965. MSRE Design and Operations Report - Part I: Description of
Reactor Design. Oak Ridge National Laboratory. ORNL-TM-728.
Schweizerische Eidgenossenschaft, 2009. Probabilistic Safety Analysis (PSA): Quality and
Scope. Guideline for Swiss Nuclear Installations. ENSI-A05/e.
Southern Company, 2019. Modernization of Technical Requirements for Licensing of
Advanced Non-light Water Reactors: Probabilistic Risk Assessment Approach. SC29980-101 Rev 0.
Stamatis, D.H., 2003. Failure Mode and Effect Analysis: FMEA from Theory to Execution,
second ed. American Society for Quality (ASQ), Quality Press, Amsterdam,
Netherlands.
Wielenberg, A., et al., 2017. ASAMPSA_E/WP30/D30.7/2017-31. Methodology for
Selecting Initiating Events and Hazards for Consideration in an Extended PSA, vol. 2.
Zerbonia, R.A., et al., 2001. Carbon bed fires and the use of carbon canisters for air
emissions control on fixed-roof tanks. J. Air Waste Manag. Assoc. 51, 1617–1627.
Zuo, J., et al., 2016. The analysis of initiating events in PSA for TMSR. Charlotte, NC. In:
Presented at 24th International Conference on Nuclear Engineering (ICONE24). June
26-30, 2016.

Briggs, R., July, 1971. Additional Calculations of the Distribution of Tritium in the MSRE.
Oak Ridge National Laboratory. ORNL CF-71-7-8.
Center for Chemical Process Safety (CCPS), 2000. Guidelines for Chemical Process
Quantitative Risk Analysis, second ed. American Institute of Chemical Engineers
(AIChE), New York, NY.
Center for Chemical Process Safety (CCPS), 2008. Guidelines for Hazard Evaluation
Procedures, third ed. John Wiley & Sons, Inc. and the American Institute of Chemical
Engineers (AIChE), New York, NY.
Center for Chemical Process Safety (CCPS), 2015. Guidelines for Initiating Events and
Independent Protection Layers in Layer of Protection Analysis. American Institute of
Chemical Engineers (AIChE), New York, NY.
Chisholm, B., et al., 2018. A New Look at Licensing Basis Events for the Molten Salt
Reactor Experiment. Oak Ridge National Laboratory. ORNL/TM-2018/788.

Chisholm, B., et al., 2019a. Considerations for early-stage safety assessments for
advanced reactor designs. Trans. Am. Nucl. Soc. 121 (1), 993–996.
Chisholm, B., et al., 2019b. Development of a methodology for early integration of safety
analysis into advanced reactor design. Charleston, SC. In: Presented at 2019
International Topical Meeting on Probabilistic Safety Assessment and Analysis (PSA
2019). April 28-May 3, 2019.
Crawley, F., Tyler, B., 2015. HAZOP: Guide to Best Practice, third ed. Elsevier,
Amsterdam, Netherlands.
US Department of Energy (DOE), 1988. Probabilistic Risk Assessment for the Standard
Modular High Temperature Gas-Cooled Reactor. DOE-HTGR-86-011, Revision 5.
Eide, S.A., et al., 2007. Industry-average Performance for Components and Initiating
Events at U.S. Commercial Nuclear Power Plants. Idaho Falls, ID, NUREG/CR-6928.
Electric Power Research Institute (EPRI), 2014. CAFTA Fault Tree Analysis System, Version
6.0b. Software Manual. EPRI Report 3002004316.
Electric Power Research Institute (EPRI), 2015. Program on Technology Innovation:
Technology Assessment of a Molten Salt Reactor Design – the Liquid Fluoride
Thorium Reactor (LFTR). Palo Alto, CA. EPRI Report 3002005460.
Electric Power Research Institute (EPRI), 2018. Program on Technology Innovation:
Early Integration of Safety Assessment into Advanced Reactor Design, Preliminary
Body of Knowledge and Methodology. Palo Alto, CA. EPRI Report 3002011801.
Electric Power Research Institute (EPRI), 2019a. Development of a Technology-Neutral
Approach to Safety-In-Design for Advanced Nuclear Power: Progress Report,
Insights, and Lessons Learned. Palo Alto, CA. EPRI Report 3002015752.
Electric Power Research Institute (EPRI), 2019b. Molten Salt Reactor Experiment (MSRE)
Case Study: Using Risk-Informed, Performanc-Based Technical Guidance to Inform
Future Licensing for Advanced Non-light Water Reactors. EPRI AR LR 2019-06. NRC
ADAMS. ML19249B632.
Flanagan, G., 2017. Historical perspective - MSRE safety basis authorization. In:
Presented at 2017 ORNL MSR Workshop. Oak Ridge, TN.
Generation IV International Forum (GIF), 2002. A Technology Roadmap for Generation

IV Nuclear Energy Systems. GIF-002-00.
Generation IV International Forum Risk and Safety Working Group (GIF RSWG), 2011.
An Integrated Safety Assessment Methodology (ISAM) for Generation IV Nuclear
Systems, Version 1.1.
Geraci, N.C., 2017. Initiating Event Analysis of a Lithium Fluoride Thorium Reactor.
Masters of Science (MS), Engineering Management and Systems Engineering. Old
Dominion University.
G`erardin, D., et al., 2019. A methodology for the identification of the postulated
initiating events of the Molten Salt Fast Reactor. Nucl. Eng. Technol. 51, 1024–1031.
Guymon, R.H., 1973. MSRE Systems and Components Performance. Oak Ridge National
Laboratory. ORNL-TM-3039.
GE Hitachi Nuclear Energy, 2017. Final Scientific/Technical Report: Development/
Modernization of an Advanced Non-LWR Probabilistic Risk Assessment. Federal
Grant DE-NE-0008325.
Holcomb, D.E., et al., 2019. Molten Salt Reactor Initiating Event and Licensing Basis
Event Workshop Summary. Oak Ridge National Laboratory. ORNL/TM-2019/1246.
International Atomic Energy Agency (IAEA), 1993. Defining Initiating Events for
Purposes of Probabilistic Safety Assessment. Vienna, Austria. IAEA-TECDOC-719.
International Atomic Energy Agency (IAEA), 2007. Molten salt reactor for sustainable
nuclear power - MSR FUJI. In: Status of Small Reactor Designs without On-Site
Refuelling. IAEA-TECDOC-1536, Annex XXX: Vienna, Austria.
International Atomic Energy Agency (IAEA), 2010. Development and Application of
Level 1 Probabilistic Safety Assessment for Nuclear Power Plants. Report No. SSG-3.

14