The reactor accident at Three Mile Island is often named nuclear critics as a major reason for opposition to reactors. In fact, the Three Mile Island accident established the validity of the "Defense in Depth" nuclear safety concept beyond all reasonable doubt. Despite a considerable attempt be plaintive lawyers in a Three Mile Island related law suit, no evidence emerged that the TMI accident caused illnesses or death.

The Defense in Depth concept is simple. If a nuclear accident happens, the accident may not effect a second layer of defense against radiation release. The solution then is to add layers of defense one on top of the other. Each layer of defense makes the escape of radioactive materials more unlikely. In addition, there can be in time improvements in nuclear safety technology that make each layer of nuclear defense more effective. Hence we can design conventional reactors that will produce a single accident casualty once every 50 billion years.

This does not satisfy nuclear safety critics who argue that nuclear accidents are still possible, and even one casualty every 50 billion years is still too many. It is, however possible to go beyond the probabilistic model of nuclear safety, and adopt a deterministic model. A probabilistic model assumes that given the laws of nature, total nuclear safety is impossible. But this is because there are laws of nature that create safety issues with specific nuclear technologies. We know that reactors can be designed to operate controlled only the laws of nature, and that human intervention in natural reactors is unnecessary. How is this possible to know? Because it has happened before, long before the human discovery of nuclear science, and indeed nearly two billion years before human beings walked on the Earth. We know that it is possible for natural reactors to operate over time spans of a hundred and fifty million years at a place called Oklo, in Gabon, Africa. One of the remarkable aspects of the Oklo natural reactors, was that during their active phases over a period of hundred's of thousands of years, none ever experienced a core melt down. James Lovelock explained how the Oklo remained under control during their hundred and fifty million years of "operation."
This kind of reactor is not explosive; indeed it is self-regulating. The presence of water, through its ability to slow and reflect neutrons, is an essential feature of the reactor. When power output increases, water boils away and the nuclear reaction slows down.
Researchers now believe that the Oklo reactors went critical in half hour spurts, and then shut down for the next 2.5 hours. Now if it is possible for nature to create and operate 16 reactors safely for millions of years, it most certainly is possible for human beings to imitate nature. We just have to understand the rules that nature used to created its own reactors, and find ways of applying them to nuclear safety. There are other natural rules which can be applied to nuclear safety. Reactor researchers Uri Gat and L.H. Dodds believed that natural safety concept coupled with the continuous removal of radioactive materials from a reactor core, would lead to the development of an ultimate safe reactor. They explain,
The Ultimate Safe Reactor (U.S.R) is a special concept of a molten salt reactor with prime and complete emphasis on safety.’. . . the U S R has all the safety benefits that are passive, inherent and non-tamperable and, in addition, has proliferation resistant attributes and simplified waste that is free of fissile material, . . . The U.S.R has no control rods and is temperature controlled by elevation of fuel in the core.
But even greater safety is possible according to Gat and Dodds.
The absolute and ultimate safe reactor (A+U.S.R) is a special concept of the U.S.R which utilizes natural convection to transfer the heat from the core to the heat exchanger. The A+U.S.R has no safety related mechanical operating parts nor any externally actuated controls, it becomes the ultimate in PINT safety. The reactor responds internally and inherently to a change in power demand via its temperature response.
PINT safety is defined as (passive, inherent, non-tamperable safety.) Inherent safety means that the natural feed back from and process within a reactor that tends toward instability - for example an increase of core heat or neutron output tends to stabilize the reactor. Thus in Gat and Dodds safe molten salt reactor, increases in core heat, causes the core salt to expand, the expansion of the core salt pushes some of the salt out of the core, taking some fissionable materials with it, As the amount of fissionable material inside the core decreases, fission slows and eventually stops completely before core heating becomes dangerous. Gat and Dodds absolute and ultimate safe reactor would not require a staff to operate. Like the Oklo reactors it would be basically self controlling.

In addition to its natural safety features, the fuel salts of the absolute and ultimate safe reactor would be continuously cleaned of radioactive fission products that would be dissolved in the fuel.
The molten salt reactor with fuel processing can be designed to be almost as safe as desirable. The basic features of fluoride based molten salts allow for a high temperature, and thus efficient, operation at low pressures. The molten salts are inert and well compatible with selected structural materials. The MSR is not subject to safety concerns from chemical or mechanical violent reactions or explosions. External cooling results in a simple design with few structural requirements that permits optimization of the design for safety eliminating compromises. The online processing results in an equilibrium fuel that requires no excess reactivity for bum-up or poison compensation. The fission product inventory, and therefore the source term, is held low. The severe accidents of uncontrolled super- critically or loss of cooling that fails to remove the after heat can become a hypothetical accident. The dreaded melt down looses all its meaning in a fluid fuel reactor. In an MSR, a spill may be self containing by the freezing of the fuel upon cooling. Freeze valves are one more feature that can make an MSR PINT (passive, inherent, non-tamper- able) safe.

The U.S.R and the A+U.S.R are concepts that bring together the safety features of an MSR and result in a reactor with safety features that are beyond current require- ments and expectations.
Se Kee Oh, and Kunmo Chung of Anjou University in South Korea, argue that continuous cleaning of radioactive fission products from nuclear fuel is an offensive rather than a defensive safety measure.
By means of a continuous separation and reconstitution process, in reactor inventories of fission products as sources of decay heat and releasable radioactivity can be kept as low as is reasonably achievable. Moreover, . . . (in) a severe accident, such as a large failure of a reactor vessel, the total amount of radioactive material released into the air should be ignorable, because volatile fission products generated in the circulating fuel salt can be completely filtered out by the salt purification process.
Eugene Wigner foresaw the advantage of the ability to purify the nuclear carrier fluid of fluid fuel reactors. It is possible to design conventional reactors natural or passive safety features, but only fluid fuel reactors can be designed with offensive safety features that include continuous fuel purification. Passive safety features can help protect conventional reactor cores from meltdown, and can strengthen containment defenses in the event of a meltdown. Both natural safety and offensive safety can lower nuclear costs, although with only passive safety features, conventional nuclear plants will still be very expensive. Thus the route to lower nuclear costs lies through the use of fluid fuels that can be continuously cleaned of fission products. With cleaner nuclear fuel the worst case nuclear accident scenario becomes relatively trivial, and reactors become unrewarding targets for terrorists attacks. Offensive nuclear safety then, as Gat and Dodds suggested is the route to the absolute and ultimate safe reactor. It is also the path to lower reactor construction costs. Now you can't beat that.