Public resistance to fission is not an objection to its carbon arithmetic, which is settled, but to two accidents. We argue that those accidents are not instances of a single hazard but the two disjoint terms of a harm functional: a fast reactivity excursion, bounded by the sign of a feedback coefficient, and a slow decay-heat transient, bounded by a geometry and a temperature. We derive both bounds from first principles and show that a third constraint, the near-elimination of water, follows from the same physical choice that secures the second, namely operating the core hot enough that thermal radiation, scaling as \(\sigma T^4\), carries decay heat to a passive sink and lets the power cycle reject waste heat to air. The bounded and passive reactor is then the object satisfying three inequalities, \(d\rho/dT<0\), \(T_{\max}\!\mid_{\text{no coolant}}<T_{\text{fail}}\), and \(\dot m_{\text{water}}\to 0\), each a corollary of high operating temperature. We close by mapping where the proofs end. We identify six open problems, of which the sharpest is that a linearly stable reactor may still be transiently unsafe because its kinetics operator is strongly non-normal, and we state the foundational result that a reactor cannot certify its own safety from within its own dynamics: the coefficients that decide stability are inputs from the nuclear many-body problem, so safety is conditional on externally supplied data whose uncertainty propagates into the margins.
The question, restated as two equations
S1 The relocation of emissions
The carbon cost of an added electrical load is not an average but a derivative. Let \(E(\mathbf{d})\) be total system emissions as a function of the dispatch vector \(\mathbf{d}\) that the grid operator selects to meet demand under a merit order. The emission charged to one more unit of demand is the marginal factor
where the sum runs over generators \(g\) and the only nonzero terms are those on the margin, the plants whose output actually moves to follow the new load. In a system with cheap inflexible coal at the bottom of the stack and the same coal setting the margin at most hours, \(\mu_{\text {m}}\) is the intensity of that marginal coal, not the cleaner average across all generation. This is the formal content of the claim that an electric vehicle inherits the dirtiest kilowatt hour rather than the mean one. For coal-heavy regions \(\mu_{\text{m}}\) sits near \(0.7\) to \(0.9\ \mathrm{kg\,CO_2/kWh}\), and the displacement of a tailpipe in the city is paid for by a stack in a mining district. The emission is relocated, not removed, and its relocation is precisely the quantity \(\mu_{\text{m}}\) makes visible.
On a lifecycle basis, counting construction, fuel chain, operation, and decommissioning rather than the instant of generation, coal sits near \(820\ \mathrm{g\,CO_2/kWh}\) and fission near \(5\) to \(12\ \mathrm{g\,CO_2/kWh}\), within the band of wind and below most utility solar. The decisive property is not the mean but the dispatchability premium: fission supplies the margin on demand, so replacing marginal coal with fission collapses \(\mu_{\text{m}}\) by roughly two orders of magnitude, and with it the inherited intensity of every device the grid charges. On the energy ledger the case is not close, which forces the real question. If not carbon, then what is the objection, and does it survive contact with the governing equations.
S2 The harm functional and its two terms
Model the hazard a reactor poses to its surroundings as a functional of the core state over the accident window. To first approximation the harm is the integrated release of energy and activity past the barriers that contain them, and it decomposes cleanly into two physically independent contributions:
with \(\Theta\) the Heaviside step. The two terms do not share a mechanism, a timescale, or a controlling quantity, and almost every confusion about reactor safety comes from treating them as one. Mode 1 is the fission power itself running away when the neutron population \(n(t)\) exceeds a damage threshold; it is fast, microseconds to seconds, and we will show it is bounded by the sign of a single feedback coefficient. Mode 2 is the release that follows when the fuel temperature \(T(t)\) crosses its failure point under decay heat that cannot be switched off; it is slow, hours to days, and we will show it is bounded by a geometry and a temperature.
Mode 1 is the neutron balance. Reduced to point kinetics in Part II, its danger is the inequality between inserted reactivity \(\rho\) and the delayed neutron fraction \(\beta\). Below the line the period is set by precursor decay, of order seconds, and the reactor is controllable; above it the chain sustains itself on prompt neutrons alone and the period collapses to the prompt generation time \(\Lambda\sim 10^{-4}\) s. Chernobyl crossed it:
Mode 2 is the heat equation for an unpowered core. After full shutdown the fission products keep decaying at six to seven percent of full power initially, falling only slowly; the integral the first term of \(\mathcal{H}\) penalizes is suppressed exactly when the peak temperature of the pumpless, operatorless core stays below failure:
A reactor can drive one term of \(\mathcal{H}\) to zero and leave the other lethal, which is the trap each accident fell into from opposite sides. The remainder of the paper bounds both terms, then adds in Part IV a third constraint, \(\dot m_{\text{water}}\to 0\), demanded by the country from which this question was asked, and shows in Part V that the same physical choice secures the heat term and the water term at once.
Each is a corollary of operating the core hot enough that \(\sigma T^4\) does the work pumps and water normally do. Part V makes the common cause explicit; the present section establishes only that the three are the right three.
Fundamental questions and open problems
The three inequalities are provable, and the body of this paper proves them. A safety argument that stopped there would be advocacy. The harder and more honest contribution is to map the boundary of the proofs: the places where the standard analysis is silently incomplete, where a derived result rests on an assumption that can fail, and where the mathematics needed to close the gap is identifiable but not yet done. Six problems follow. Each is stated as a question, located against the existing literature, and given the mathematics of its own gap. They are ordered from the most immediately consequential for safety to the most foundational.
Physics. The Jacobian of the coupled kinetics, thermal, and feedback system (Part II) is non-normal, \(JJ^\dagger \neq J^\dagger J\). The asymmetry is structural: the gain from temperature back to the neutron population, the entry \(J_{nT}=\alpha_T n_s/\Lambda\), and the gain from neutrons to temperature, \(J_{Tn}=K/mc_p\), live in different rows and differ by many orders of magnitude because of the small \(\Lambda\). A non-normal operator does not have orthogonal eigenvectors, and the standard eigenvalue test certifies only the asymptotic fate of a perturbation, not its excursion on the way there.
Literature. Reactor stability is treated almost universally by Routh and Hurwitz on the characteristic polynomial, which is what we do in Part II. The theory of transient growth in non-normal systems is mature in fluid dynamics, where it explains subcritical transition to turbulence in pipe and Couette flow (Trefethen, Trefethen, Reddy, Driscoll, 1993), and is codified in the pseudospectral framework (Trefethen and Embree, 2005). It has barely touched reactor kinetics.
The gap. No one has computed the transient amplification of the reactor kinetics operator and asked whether the amplified excursion can be large enough to drive Doppler feedback into its nonlinear regime, that is, to cross from the eigenvalue-stable basin into the Fuchs and Nordheim excursion regime of Part II.
Mathematics of the gap. The maximum amplification is the matrix exponential norm \(G(t)=\lVert e^{Jt}\rVert_2\), and even when every eigenvalue satisfies \(\operatorname{Re}\lambda_i<0\) the initial growth rate is governed by the symmetric part of the operator,
the numerical abscissa. For the reactor Jacobian the off-diagonal \(\tfrac12(J_{nT}+J_{Tn})\) inherits the enormous \(J_{nT}\sim \alpha_T n_s/\Lambda\), so \(\omega(J)\) is large and positive while the spectrum sits safely in the left half-plane. A perturbation is therefore amplified before it decays. The size of the amplification is bounded below through the \(\varepsilon\)-pseudospectrum \(\sigma_\varepsilon(J)=\{z:\lVert(zI-J)^{-1}\rVert\geq \varepsilon^{-1}\}\) by
the Kreiss lower bound. The open program is concrete: compute \(\sigma_\varepsilon(J)\) and \(G(t)\) for the point and then the spatial kinetics operator, extract the worst-case initial perturbation as the leading right singular vector of \(e^{Jt^\ast}\), and determine the critical perturbation amplitude at which the non-normal transient peak reaches the prompt-critical margin. If that amplitude is small, eigenvalue stability is not a sufficient safety criterion and must be supplemented by a transient-growth bound.
Physics. Decay heat is not a law but a sum over decaying nuclides. With inventory vector \(N(t)\) evolving under the Bateman matrix \(A\) (decay plus neutron-induced transmutation), the decay power is linear in the state, \(P_d(t)=\sum_i Q_i\lambda_i N_i(t)=q^\top e^{At}N_0\), where \(q_i=Q_i\lambda_i\) collects decay energies and constants.
Literature. The Way and Wigner correlation \(0.066\,t^{-0.2}\) (1948) and its standardized successor (ANSI and ANS-5.1) tabulate \(P_d(t)\) for reference fuels; summation calculations from evaluated nuclear data are routine. Treating \(N_0\) as a design variable to be optimized for the safety integral is not.
The gap. Is there a lower bound on \(\int_0^\tau w(t)P_d(t)\,dt\) over admissible initial fuel compositions, and what is the minimizer? The weight \(w(t)\) encodes the window in which decay heat is most dangerous, the first hours when passive rejection has not yet caught up.
Mathematics of the gap. The objective is linear in \(N_0\),
minimized over the feasible set: \(N_0\ge 0\), fabrication and burnup limits, and the criticality constraint \(k_{\text{eff}}(N_0)=1\), which is nonlinear and defines the manifold the fuel must live on. The gradient follows from the adjoint Bateman equation \(-\dot p = A^\top p + w(t)q\) with \(p(\tau)=0\), giving \(\nabla_{N_0}\mathcal{J}=p(0)\); the criticality constraint enters through a Lagrange multiplier on \(\nabla_{N_0}k_{\text{eff}}\), itself a standard perturbation-theory sensitivity. Because the objective is linear, the minimizer lies on the boundary of the feasible set, which is what makes the answer a definite fuel vector rather than a smooth interior optimum. The India-specific instance is the thorium cycle, whose actinide chain has a decay-heat signature in the vulnerable window that the optimization can test against the uranium reference.
Physics. Fission power scales with volume, \(P=q^{\prime\prime\prime}\cdot\tfrac{4}{3}\pi R^3\), while passive heat rejection scales with surface, as conduction to the boundary and radiation off it. The two scalings are in direct geometric conflict: the larger the core, the smaller its passive margin per unit power.
Literature. The conflict is folklore in small modular reactor design and motivates the power ceiling of those designs, but it is rarely written as an explicit optimum.
The gap. State the frontier. Given a required passive margin \(M=(T_{\text{fail}}-T_{\max})/T_{\text{fail}}\), what is the maximum single-core power, and how does power density, which sets capital cost per watt, trade against it?
Mathematics of the gap. From the coupled core to structure result of Part III, with a vessel-to-ground conductance that scales with contact area, \(U_g=u\cdot 4\pi R^2\), the unpowered peak temperature rise is
Imposing \(T_{\max}\le (1-M)T_{\text{fail}}=:\Delta T\) bounds the passively-safe power density,
a function that decreases monotonically with \(R\). The single-core passively-safe power \(P(R)=\tfrac{4}{3}\pi R^3 q^{\prime\prime\prime}_{\max}(R)\) increases with \(R\) but with falling density, so total output and cost per watt pull in opposite directions, and the frontier between them is explicit. The consequence is structural: above a critical power one cannot stay passively safe in a single vessel and must modularize, \(N\) cores each below \(P^\ast=\max_R P(R)\) subject to the margin. The number \(P^\ast\), computed for the conductivity and coupling of a high-temperature core, is the physical origin of the observed few-hundred-megawatt ceiling on passively-safe designs.
Physics. The flux is reconstructed from a finite set of in-core detectors. The xenon-unstable tilt harmonic of Part II, the mode that grows while total power reads flat, may be weakly coupled to a given detector layout and therefore effectively invisible to the control system.
Literature. In-core instrumentation layout is largely heuristic and validated by operating experience; optimal sensor placement is a developed subject in control theory but seldom applied to the modal observability of spatial reactor instabilities.
The gap. Cast spatial kinetics as a linear system in the modal amplitudes and compute the observability of the unstable harmonics for a candidate detector set, then optimize the set.
Mathematics of the gap. With state \(x=(a_0,a_1,\dots,a_M)^\top\) the modal amplitudes, dynamics \(\dot x = Jx\), and output \(y=Cx\) where \(C_{jk}=\psi_k(\mathbf r_j)\) evaluates mode \(k\) at detector \(j\), the observability Gramian is
and the harmonics are observable iff \(W_o\succ 0\). The worst-observed direction is the eigenvector of the smallest eigenvalue of \(W_o\), so the detector placement problem is to choose \(\{\mathbf r_j\}\) to maximize \(\lambda_{\min}(W_o)\), or a determinant criterion for a balanced design. The dual problem, with control-rod worths in place of detector responses, gives the controllability of the same mode. The two connect to the spectral gap of Part II: a large core with a soft first harmonic has a near-singular \(W_o\) for sparse instrumentation and so demands denser, deliberately placed detectors to keep the slow spatial instability both seen and steerable.
Physics. Above a critical core size the first flux harmonic is xenon-unstable on a multi-hour timescale. Near onset the bifurcation is supercritical and the oscillation is small and self-limiting, throttled by the rectified depletion of the mean xenon reservoir it feeds on. Far above onset, where power reactors operate, the cycle is a relaxation oscillation whose amplitude is set not by the normal-form coefficient but by the hard constraint that the xenon concentration cannot go negative.
Literature. Linear onset and period follow Randall and St. John (1958) and are standard. The nonlinear saturated amplitude has no closed form and is normally obtained by direct simulation.
The gap. The two regimes, the small supercritical cycle near onset and the envelope-filling relaxation cycle far from it, are connected by a bifurcation set that is not characterized. Whether the connection passes through a fold of cycles, a homoclinic orbit, or a canard explosion is open, and the answer decides whether the amplitude grows smoothly or jumps.
Mathematics of the gap. The constraint \(X(\mathbf r,t)\ge 0\) makes the saturated dynamics a Filippov or complementarity system rather than a smooth one, so the amplitude is bounded by the physical envelope
and a rigorous amplitude requires either a Lyapunov-function bound that respects the constraint or numerical continuation of the constrained system. The order-unity verdict, that the saturated tilt challenges local fuel limits and therefore mandates active spatial control above the critical size, rests on this envelope rather than on a closed-form amplitude, and tightening it to a sharp bound is the remaining piece.
The claim. It cannot, and this is not a limitation of analysis but a structural feature, the same one that runs through the rest of this Notebook. The coefficients that decide every inequality in this paper, the temperature coefficient \(\alpha_T\), the void coefficient, the resonance integral that sets Doppler feedback, the fission-yield distribution that fixes the decay-heat curve, are not derivable from the reactor’s own equations. They are functionals of neutron cross sections and fission yields, and those are outputs of the nuclear many-body problem, supplied to the reactor model as inputs. The neutron-transport, thermal, and xenon equations take them as given and cannot produce them. A system does not contain the generators of its own description.
Consequence. Safety is therefore never self-certifying. It is conditional on externally supplied data whose uncertainty is real and propagates into the margins. The honest form of every claim \(d\rho/dT<0\) in this paper is not a deterministic inequality but a probability. With \(\alpha_T\) a functional of the cross-section vector \(\sigma\) carrying covariance \(C\) from the evaluated nuclear data, first-order propagation gives
where \(g\) is the sensitivity computed by adjoint perturbation theory and \(\Phi\) the normal distribution function. The deterministic statement \(\alpha_T<0\) is the limit of this as the covariance vanishes, which it never does. The open problem is to carry the covariance of the nuclear data through the stability conditions of this paper and report the probability that each holds, rather than asserting it. This is the rigorous and humble form of the whole argument: physics bounds the two failure modes, but the bound is only as certain as the externally measured constants it cannot derive, and a reactor that could compute its own safety from first principles would be a system that contained its own foundations, which no system does.
Opportunities
Four of the six problems convert directly into research programs that are small enough to begin and specific enough to publish. Each is given in the standard form: the physics, what exists, the gap, the mathematics of the gap, and concrete next steps.
From. Problem 1. Gap. Eigenvalue stability is the universal reactor criterion, yet it does not bound the transient excursion of a non-normal operator. Mathematics. Compute the \(\varepsilon\)-pseudospectrum, the numerical abscissa \(\omega(J)\), the Kreiss constant, and the growth function \(G(t)=\lVert e^{Jt}\rVert\), then map the worst-case perturbation into the Fuchs and Nordheim regime. Next steps. A single paper: the transient-growth function of point kinetics with thermal feedback, the perturbation amplitude that tips a linearly stable core into a finite excursion, and a proposed supplement to the stability criterion. The deliverable is a new, sharper test that a reactor must pass, drawn from a mature theory that reactor analysis has not yet imported.
From. Problem 2. Gap. Fuel composition is optimized for economics and proliferation resistance, rarely for the decay-heat integral over the passive-safety window. Mathematics. The adjoint Bateman program of Problem 2, minimizing \(c^\top N_0\) on the criticality manifold. Next steps. Solve the adjoint problem for a small actinide set, compute the decay-heat signature of a thorium-uranium-233 cycle against the uranium reference in the first hours after shutdown, and report whether the thorium chain narrows or widens the passive-safety margin. India holds the largest thorium reserves of any nation, so a decay-heat advantage, if it exists, has a direct national application.
From. Part IV and the underground-siting result of Part III. Gap. Dry cooling is priced as a clean Carnot penalty, but for a supercritical CO2 cycle a rising ambient walks the compressor inlet off the critical point and inflates compressor work nonlinearly, exactly when summer demand peaks, and the intersection of climate-tuned working-fluid blends with dry-cooled fission is thinly explored. Mathematics. Co-optimize three couplings: the mixture critical temperature \(T_{c,\text{mix}}\) of a doped CO2 blend through the mixing rule and a cubic equation of state, so the inlet stays dense at a summer sink temperature; the dry-cooler area sized against the local ninety-ninth-percentile dry-bulb rather than the mean; and the vessel-to-ground conductance \(U_g\) of an underground siting, which sets the late-time walk-away margin. Next steps. Build the coupled model, run it against the summer ambient of specific Indian inland basins, and identify the sites where the three constraints, \(\dot m_{\text{water}}\to 0\), efficiency above the wet pressurized-water baseline, and the passive heat-sink inequality, hold simultaneously. The figure of merit is the recovered inlet density at fixed summer sink temperature, which is computable from the mixing rule and the equation of state.
From. Problem 4. Gap. The slow spatial xenon instability must be both seen and steerable, yet detector and rod placement are seldom designed against the modal observability and controllability of that specific mode. Mathematics. Maximize \(\lambda_{\min}(W_o)\) over detector positions for the observability Gramian, and its dual over control-rod positions for the controllability Gramian, with the modal system of Part II as the plant. Next steps. Solve the placement optimization for a core large enough to have a soft first harmonic, show how required detector density scales with the spectral gap, and produce a placement that keeps the dangerous mode observable and controllable with the fewest sensors. The result turns the active-control boundary of Part II from a warning into a design specification.
The throughline is the same one the body of the paper establishes. High operating temperature is the physical cause that makes a reactor bounded and passive, and the opportunities above are the places where that single choice is not yet fully exploited: in the transient as well as the asymptotic stability of the core, in the composition of the fuel that sets the decay heat, in the working fluid that lets the heat leave without water, and in the instruments that watch the one mode physics will not self-correct. Problem 6 stands behind all of them as the honest limit. The reactor cannot derive its own safety, only inherit it from constants measured elsewhere, so the work is never to prove safety absolute but to make its conditions explicit and its margins quantified.
Gupta, S. (2026). What Makes a Reactor Safe? Part I, preprint. Founder’s Notebook, Earth5R. https://earth5r.org/what-makes-a-reactor-safe/
- Way, K. and Wigner, E. P. The radiation as a function of time after fission. Physical Review, 73, 1318, 1948.
- Hetrick, D. L. Dynamics of Nuclear Reactors. University of Chicago Press, 1971.
- Randall, D. and St. John, D. S. Xenon spatial oscillations. Nucleonics, 16, 1958.
- Trefethen, L. N., Trefethen, A. E., Reddy, S. C. and Driscoll, T. A. Hydrodynamic stability without eigenvalues. Science, 261, 578, 1993.
- Trefethen, L. N. and Embree, M. Spectra and Pseudospectra: The Behavior of Nonnormal Matrices and Operators. Princeton University Press, 2005.
- Henrici, P. Bounds for iterates, inverses, spectral variation and fields of values of non-normal matrices. Numerische Mathematik, 4, 24, 1962.
- Bateman, H. The solution of a system of differential equations occurring in the theory of radioactive transformations. Proceedings of the Cambridge Philosophical Society, 15, 423, 1910.
- American National Standard, Decay Heat Power in Light Water Reactors. ANSI and ANS-5.1.
- Cacuci, D. G. Sensitivity and Uncertainty Analysis. Chapman and Hall, 2003.
- Span, R. and Wagner, W. A new equation of state for carbon dioxide. Journal of Physical and Chemical Reference Data, 25, 1509, 1996.
DOIs to be confirmed and added on publication. Cross-section covariances from the current evaluated nuclear data library, to be cited by release.
