3Aug10 1

International Seminars on Planetary Emergencies Erice, Sicily -- August 2010

Passive Safety Features for Small Modular Reactors

D. T. Ingersoll, Oak Ridge National Laboratory

P.O. Box 2008, Oak Ridge, TN 37831-6162, USA

ABSTRACT

The rapid growth in the size and complexity of commercial nuclear power plants in the 1970s spawned an interest in smaller, simpler designs that are inherently or intrinsically safe through the use of passive design features. Several designs were developed, but none were ever built, although some of their passive safety features were incorporated into large commercial plant designs that are being planned or built today. In recent years, several reactor vendors are actively redeveloping small modular reactor (SMR) designs with even greater use of passive features. Several designs incorporate the ultimate in passive safety—they completely eliminate specific accident initiators from the design. Other design features help to reduce the likelihood of an accident or help to mitigate the accident’s consequences, should one occur. While some passive safety features are common to most SMR designs, irrespective of the coolant technology, other features are specific to water, gas, or liquid-metal cooled SMR designs. The extensive use of passive safety features in SMRs promise to make these plants highly robust, protecting both the general public and the owner/investor. Once demonstrated, these plants should allow nuclear power to be used confidently for a broader range of customers and applications than will be possible with large plants alone.

INTRODUCTION

The first commercial nuclear power plants to be constructed in the United States had relatively low power capacity, generally less than 200 MWe, and were based on the successful operation of even smaller designs used for marine propulsion by the U.S. Navy. Between 1970 and 1980, plant sizes grew rapidly to plants having capacities exceeding 1000 MWe. In many cases, the detailed designs for the large plants were substantially completed before their smaller predecessors had been operated for any significant time. Problems encountered during the operation of the smaller plants were then accommodated as last-minute engineering patches to the larger plant designs. Also, an increasing concern for potential accidents that could have severe consequences drove the designers to add an increasing number of active backup systems to the plants. For example, the concern for the extreme consequences of a double-ended large pipe break in the primary coolant circuit of a pressurized water reactor (PWR), caused designers to add systems such as high-pressure water injection systems to ensure that the reactor core would remain covered with water in the unlikely occurrence of this extreme accident. By the end of the 1970s, punctuated by the core-damaging accident at the Three Mile Island plant [Kemeny, 1979] on March 28, 1979, plant designs had become encumbered by a complex layering of engineering patches and active safety systems, which drove up the capital and operating costs of the plants while reducing their availability.

3Aug10 2

The accident at Three Mile Island catalyzed a number of additional design and operational changes to nuclear power plants and also stimulated a lot of soul-searching by industry leaders who were uncomfortable with the established trend toward larger, more complex plants. Alvin Weinberg, a pioneer in the nuclear energy community, led a 1983 study [Weinberg, 1985] by the Institute for Energy Analysis to evaluate the viability of designing nuclear reactors that are “inherently safe,” i.e., they require no active engineered systems or operator intervention to mitigate the consequences of an accident. Weinberg’s team evaluated several new concepts and designs that were being developed world-wide and concluded that it should be technically feasible to develop inherently safe designs. In particular, they favored two emerging designs: the water-cooled Process Inherent Ultimately Safe (PIUS) design and the helium-cooled Modular High-Temperature Gas-cooled Reactor (MHTGR) design. Their primary concern with these designs was that they were necessarily constrained to low power capacities and might not be economically viable due to the same economy-of-scale factors that previously drove the industry to very large plants. Additional studies and new government-sponsored programs were initiated in the 1980s, most of which focused on smaller, simpler reactor designs with inherent or “passive” safety features. Although none of these designs were built, several of the more promising features have been incorporated into the newest plant designs that are just now beginning to be ordered and constructed. Several of the designs from the 80s and 90s were initially small output designs, but were subsequently enlarged due to economy-of-scale considerations. An example of this is Westinghouse’s AP-600 design developed within the Advanced Light-Water Reactor program. Although originally certified by the U.S. Nuclear Regulatory Commission (NRC) at 600 MWe, the design was later upsized to 1140 MWe for commercialization. Despite a continued trend toward large plants, there are an increasing number of nuclear plant vendors that are responding to Weinberg’s recommendations and are developing designs that are small and simple and consequently very robust. In response to Weinberg’s concerns about economic competitiveness, these designs further introduce “modularity” at the reactor level, i.e. they replace economy-of-scale with economy-of-replication. These small modular reactor (SMR) designs can be fully fabricated in a factory setting and easily transported and installed at the plant site. Additionally, these designs take maximum advantage of passive safety features in order to keep the design sufficiently simple to remain economically competitive with large plants. The following sections will discuss examples of the types of passive safety features used by the range of SMRs currently under development.

PASSIVE SAFETY FEATURES Like their bigger siblings, SMRs are being developed that use water coolant (light water or heavy water), gas coolant (typically helium), liquid-metal coolant (sodium, lead, or lead-bismuth), or liquid-salt coolant (typically fluoride salt). While each of these classes has unique safety features, many of the same passive safety principles apply to all reactor classes. This paper emphasized these cross-cutting features, although some specific examples are also cited.

3Aug10 3

Many SMR designers share a common set of principles [IAEA, 2009] to improve the safety of their designs: (1) eliminate from the design as many features as possible that have the potential to initiate a serious accident, (2) for those features that can not be eliminated, reduce the probability that an accident will be initiated, and (3) design the system to substantially mitigate the consequences of remaining potential accidents. As an example the developers of the International Reactor Innovative and Secure (IRIS) design claim that of the eight Class IV design basis accidents for a large loop-type PWR, three are completely eliminated from their design, two have reduced probability of occurrence, and two have reduced consequences.[Carelli, 2004] According to the IRIS developers, only the refueling accident remains unchanged from large plant designs. Of the three fundamental design principles, the first approach is clearly the most elegant solution and is a key feature of many SMRs being developed, as discussed in the following section. Elimination of Accident Vulnerabilities Very early in the development of large commercial power plants, the most challenging accident scenario was defined as the double-ended break of the largest diameter coolant pipe, which (for PWRs) was typically the pipe connecting the primary reactor vessel to the steam generator vessel. This postulated break could very quickly remove coolant water from the primary vessel and result in an uncovering of the reactor core, which in turn would quickly cause major damage to the fuel and release a significant fraction of the radioactive materials contained in the fuel. To mitigate the severe consequences of such an accident, complex water injection systems were added to the plant designs. These safety systems, which are never expected to be used for a successfully operated plant, add significant cost, both for initial construction and routine testing and maintenance. Eliminating these safety systems requires that the vulnerability be eliminated, i.e. all large primary coolant pipes must be eliminated from the design. The answer to this issue is the integral primary system reactor (IPSR). An IPSR, sometimes referred to as in integral pressurized water reactor (iPWR), incorporates the reactor core, steam generator(s), and pressurizer into a single common pressure vessel. Figure 1 shows a comparison of a traditional loop-type PWR design compared to an IPSR design. The first (and only) commercial IPSR was the NS Otto Hahn merchant ship, which was commissioned in 1968 and powered by a 35 MW integral reactor [Nuclear Ship, 1968]. In the late 1980s, the Safe Integral Reactor (SIR) was developed by a consortium including the U.K. Atomic Energy Agency, Combustion Engineering, Stone and Webster, and Rolls Royce [Matzie, 1992]. The 320 MWe SIR design was developed specifically to respond to the safety challenges encountered by the early large loop PWRs and represents a precursor to many of the SMR designs that have emerged in the past few years, including the Westinghouse IRIS design referenced earlier.

3Aug10 4

Fig. 1. Simplified schematic of loop (left) and integral (right) designs for pressurized water reactors. Packing all of the primary system components into a single vessel has a number of safety-related advantages:

• All large coolant pipes are eliminated. Only small (5-7 cm diameter) feed water and steam outlet pipes penetrate the primary vessel wall compared to large (80-90 cm diameter) pipes for loop-type PWRs.

• The total inventory of primary coolant contained within the primary vessel is much larger than for an external loop PWR, which increases the heat capacity and thermal inertia of the system. Hence the primary system exhibits a much slower response to core temperature transients.

• The presence of the steam generators within the primary vessel provides an effective heat sink for decay heat removal in a loss-of-flow accident.

• Typically the heat exchangers are placed above the core creating a relatively tall system that facilitates more effective natural circulation of the primary coolant in the case of a coolant pump failure. Some designs have sufficient natural circulation flow rates to eliminate the primary coolant pumps and rely only on natural circulation for normal operation.

• The vessel accommodates a relatively large pressurizer volume that provides better control of under/overpressure transients. For example, the IRIS pressurizer volume is designed to be nearly 5 times larger per unit power than for a large plant.

• The extended riser area above the core provides the possibility for internal placement of the control rod drive mechanisms (CRDM), thus avoiding another potentially serious accident scenario: the rod ejection accident. Also, the reduced number of penetrations in the reactor vessel head simplifies opening of the vessel and eliminated the near-accident situation that occurred at the Davis-Besse plant in which boric acid in the coolant water leaked through a control rod penetration seal and corroded the

3Aug10 5

vessel base material.[Davis-Besse, 2008] Only a thin stainless steel inner liner prevented a major breech in the vessel pressure boundary. Some IPSR designs take advantage of this feature while others use conventional external CRDMs.

• The larger downcomer region between the core and the primary vessel provides extra shielding and results in a much lower fluence to the reactor vessel. This reduces the activation level of the vessel material and reduces another major safety concern: pressurized thermal shock, which results from radiation-induced embrittlement of the reactor vessel.

The major down side of the integral design is that it constrains the reactor to relatively small power levels, i.e. it forces the reactor to be “deliberately small.”[Ingersoll, 2009] Beyond some practical limit, probably in the 300-400 MWe range, the size of the vessel would become prohibitively large to manufacture and transport. To compensate for its inability to scale dimensionally, IPSR designers depend instead on scaling by replication, hence the interest in small modular reactors. An example of this is the NuScale design,[Lorenzini, 2010] which uses twelve 45-MWe reactor IPSR modules to comprise their reference 540 MWe plant design and the Babcock and Wilcox mPower design,[Halfinger, 2010] which uses four 125-MWe modules to comprise a 500 MWe plant. Reduced Source Term Fundamentally, reactor safety comes down to ensuring that a hazardous amount of radiation is not released to operations personnel or the general public. The total quantity of radionuclides in a reactor core is referred to as the reactor “source term.” Although the source term depends on a number of factors, including fuel composition and operational history, it is roughly proportional to the power level of the reactor, i.e. twice the power level yields twice the source term. Hence, small output reactors will have proportionately smaller source terms. The benefits of a lower source term can be manifested in a number of ways, including: reduced shielding, reduced site exclusion boundary, reduced emergency planning zone (EPZ), increased plant safety margins, or some combination of these options. Of course if the total plant is comprised of several reactor modules, the total plant inventory may be comparable to a single-core large plant. However, even in this case, it is more difficult to imagine an accident scenario that results in fuel failure in all reactor modules simultaneously, hence the probability of a large radiation release is reduced. Improved Decay Heat Removal In the event of a loss of forced circulation of the primary coolant, mechanisms must be provided for removal of the residual power that continues to generate heat in the reactor core from the decay of radionuclides. The decay heat can be quite significant—approximately 6% of the full operating power immediately after shutdown. This decay power drops by an order of magnitude within the first day after shutdown, so the primary concern is the short-term heat removal. Conduction of heat through the core material and natural convection of the primary coolant help to move the heat from the fuel to the reactor vessel boundary. But at some point, additional external cooling of the vessel is needed to transfer the heat to the ultimate heat sink (typically the ground or atmosphere).

3Aug10 6

Small plant designs are able to accommodate this heat transfer through passive measures better than large plants for a number of reasons. Firstly, a lower core operating power of the SMR will result in lower decay power because, as with the source term, the total decay power is proportional to the operating power. This advantage is further enhanced by using a lower power density in the fuel, which many SMR designers choose to do in order to lengthen the fuel cycle duration. Secondly, the smaller core volume enables more effective conduction of the decay power to the reactor vessel. This is a result of the smaller core radius, which results in a shorter conduction path from the core centerline (the hottest part of the core) to the reactor vessel. Thirdly, the removal of heat from the external surface area of the vessel is more effective for smaller systems. This feature results from the fact that core power, and hence the decay power, is proportional to the volume of the core, which varies as the cube of the effective core radius. On the other hand, heat removal from the exterior surface of the vessel is proportional to the vessel surface area, which varies roughly as the square of the core radius. As the power level is reduced, the core volume decreases faster than the surface area of the vessel, or conversely, the surface-to-volume ratio increases, hence increasing the relative efficiency of external heat removal. The 1/r relationship between surface area and volume is shown graphically in Fig. 2. [Lorenzini, 2010] As a result, most small reactor designs are able to easily accommodate removal of the decay heat using fully passive, natural convection air or water circulation systems. Also shown in Fig. 2 is the fact that for a given vessel thickness, its ability to withstand internal pressure also varies as 1/r. Consequently, the smaller diameter vessel is able to contain larger pressure transients than a large vessel.

Fig. 2. Relation between heat transfer area (left) or internal pressure (right) to reactor vessel radius. [Lorenzini, 2010]

3Aug10 7

Core Geometry The ability to passively remove decay heat has become a central part of the enhanced safety case for SMRs. In some cases, merely reducing the size of the core (and power) may not be sufficient to provide full passive removal of the decay heat. Such is the case with high-temperature gas-cooled reactors (HTGR). The initial power level of General Atomic’s HTGR design was 2240 MWt but was later downsized to 600 MWt to improve its safety case. [Labar, 2002] Even at this power level, however, it was difficult to ensure adequate decay heat removal using passive systems, owing largely to the poor thermal properties of the helium coolant. During a loss-of-flow transient, natural circulation of the coolant can remove some of the decay heat, but the limited radial conduction to the vessel surface caused unacceptably high temperatures at the core centerline. As a result, General Atomics adopted an annular core design, in which the central portion of the core is replaced by a graphite reflector. The annular-core design and the large thermal inertia provided by the graphite moderator in the modular high-temperature reactor (MHR) provides a similar favorable transient response as the water-cooled IPSR.

Fig. 3. Cutaway of GT-MHR reactor vessel (left) and cross-section of core region (right). [Labar, 2002]

3Aug10 8

Other Passive Safety Design Features Some SMR designs such as IRIS and NuScale utilize a helical coil steam generator rather than the more traditional straight tube steam generator. During normal heat-up of the tubes, the helical coil configuration allows the tube bundle to expand radially outward in response to thermal expansion of the tubes rather than longitudinally, which reduces mechanical stresses on the tubes at the upper and lower headers. Furthermore, the higher pressure primary coolant is placed on the shell side of the steam generator, which places the tubes in compression and reduces the likelihood of a tube rupture. These design choices are expected to reduce the anticipated failure rate of the steam generators, and hence reduce radiological exposures due to repair and replacement activities. In addition to immersing the containment vessel in a large pool of water to facilitate decay heat removal, the NuScale design has a vacuum region between the reactor vessel and the containment vessel. This feature increases the steam condensation rate in the case of a steam release from the reactor vessel. The steam condensate collects at the bottom of the containment vessel and provides an effective conduction pathway from the reactor vessel to the containment pool. During normal operation, the vacuum region acts like a thermos bottle and obviates the need for vessel insulation, which creates a sump plugging challenge for traditional plants. Some water-cooled SMR designs choose to remove soluble boron from the primary coolant as an added safety feature. Eliminating the soluble boron, which is present in traditional large plants to compensate for fission product buildup and fissile depletion, must be balanced by another form of reactivity control such as burnable poisons or additional control rods. However, eliminating the soluble boron provides a strongly negative moderator feedback mechanism during coolant voiding transients, and avoids boric acid corrosion issues such as encountered at the Davis-Besse plant cited earlier. Conclusions The concept of small modular reactors evolved from lessons learned during the rapid escalation of nuclear plant size during the 1970s as a way to achieve plant safety without the cost and complexity of the large plants. There continues to be interest in SMRs today for the same reasons and for a range of additional reasons such as affordability, site flexibility, operational flexibility and reduction in fossil power emissions. Clever design and engineering, such as the integral primary system reactor configuration, can result in designs that appear to offer the same or better safety performance while offering enhanced plant robustness and resiliency to perturbations, thus protecting the considerable capital investment. The trade-off is that these designs are constrained to be of smaller capacity, and the commercial viability of SMRs continues to be a dominant and unresolved concern. Several SMR vendors believe that the cost savings from economy-of-replication will be sufficient to overcome the economy-of-scale factor, and they are moving forward aggressively to bring new designs to market. With a desperate global need for safe, clean and abundant energy, the time has come to prove them right.

3Aug10 9

REFERENCES

[Carelli, 2004] M. D. Carelli, et al, “The design and safety features of the IRIS reactor,”

Nuclear Engineering and Design, 230, p. 151-167 (2004). [Davis-Besse, 2008] “Davis-Besse Reactor Pressure Vessel Head Degradation: Overview,

Lessons Learned, and NRC Actions Based on Lessons Learned,” U.S. Nuclear Regulatory Commission, NUREG/BR-0353, Rev. 1 (2008).

[Matzie, 1992] R. Matzie, et al, “Design of the Safe Integral Reactor,” Nuclear Engineering

and Design, 136, p.73-83 (1992). [Halfinger, 2010] J. Halfinger, “A practical, scalable, modular ALWR,” presentation at the

International Conference on Advances in Nuclear Power Plants (ICAPP) 2010, San Diego, CA, June 13-17, 2010 (2010).

[IAEA, 2009] “Design Features to Achieve Defense in Depth in Small and Medium

Reactors,” International Atomic Energy Agency, NP-T-2.2 (2009). [Ingersoll, 2009] D. T. Ingersoll, “Deliberately small reactors and the second nuclear era,”

Progress in Nuclear Energy, 51, p. 589-603 (2009). [Kemeny, 1979] J. Kemeny, “Report of the President’s Commission on the Accident at

Three Mile Island,” U.S. Government Printing Office, Washington, D.C. (1979). [LaBar, 2002] M. P. LaBar, “The Gas Turbine–Modular Helium Reactor: A Promising Option for

Near Term Deployment,” presented at the International Congress on Advanced Nuclear Power Plants, Embedded Topical American Nuclear Society 2002 Annual Meeting, Hollywood, FL, June 9–13, 2002, GA-A23952 (2002).

[Lorenzini, 2010] P. Lorenzini, “NuScale Power: Capturing the ‘Economies of Small’,” presentation

at the International Conference on Advances in Nuclear Power Plants (ICAPP) 2010, San Diego, CA, June 13-17, 2010 (2010).

[Nuclear Ship, 1968] “Nuclear Ship ‘Otto Hahn’,” Atomwirk. Atomtech., 13, p294-330 (1968). [Weinberg, 1985] A. M. Weinberg, et al, The Second Nuclear Era, Praeger Publishers

(1985).