As with many SMRs, the primary goals of the System Integrated Modular Advanced Reactor (SMART) design are enhanced safety and reliability. SMART is a 100 MWe integral system with 57 half-height (2 m) fuel assemblies using a standard 17 X 17 pin array design. Reactivity control includes control rods, burnable poisons within the fuel and soluble boron within the primary coolant. The 25 magnetic jack control rod drive mechanisms are external to the reactor pressure vessel, as are the four reactor coolant pumps that circulate the primary coolant. The integral system includes eight once-through helical coil steam generators and an internal pressurizer. The reactor pressure vessel and passive safety systems are contained within a traditional large — volume containment structure.

The SMART design is supported by an extensive testing program, including safety tests, methods validation tests and component/system performance tests. Specific components that were tested include the fuel assemblies, steam generators, control rod drive mechanisms, and safety injection systems, as well as overall thermal — hydraulic performance.

Steam nozzle

Upper guide structure Core support barrel Feedwater nozzle

Flow mixing
header assembly

Core

Figure 2.5 SMART (Republic of Korea) — Korea Atomic Energy Research Institute (KAERI) © Korea Atomic Energy Research Institute (KAERI).

The initial concept was started in 1997 and achieved Standard Design Approval from the Korean regulator in 2012. Although SMART can be used for electricity only, a co-generation design option has been developed that provides for 90 MWe of electrical output in addition to 40 000 ton/day of potable water using a four-unit multi-effects distillation plant. This co-generation plant can supply sufficient electricity and water to support approximately 100 000 people. Although the first-of-a-kind SMART SMR may be constructed in Republic of Korea, the design is intended primarily for export and no large-scale deployment is expected within the country. Key parameters and a representative graphic for the SMART design are given in Figure 2.5. [5]

The question arises why interest in SMRs has re-emerged and burgeoned over the last decade. The reason is that SMRs offer an attractive vehicle to surmount the current barriers to deployment of the current generation of large-rated advanced light-water plants (the Generation III+ designs) and alternative coolant (Generation IV) plants. Principal among these barriers is the large initial investment required to construct a reactor, the attendant significant financial risk to the investor, and the mismatch of reactor size to the electric power grid serviced by many electricity­generating entities.

Given the incentives for SMR deployment, what are the challenges? The major uncertainties are the ability to reduce the financial risk sufficiently to attract investors, the ability to reduce the projected levelized unit electricity cost (LUEC) differential between that of SMRs and the competition offered by lower-cost natural gas power plants and large nuclear plants, and compatibility of fuel cycles with existing facilities. These incentives and challenges are elaborated next.

Gas-cooled reactors are the second most common reactor technology used for commercial power application, due largely to the several carbon dioxide-cooled reactors deployed in the United Kingdom. All gas-cooled SMRs under development today use helium as the primary coolant. Both Germany and the United States previously built and operated helium-cooled test or demonstration reactors, and China and Japan each currently have small helium-cooled test reactors in operation. The key advantage of helium-cooled reactors is that the reactor can operate at much higher temperatures using a single-phase coolant, which is much simpler to manage. Typical gas-cooled reactors operate with an outlet temperature in the range of 700-800 °C, compared to 300-325 °C for LWRs. The advantage of the higher temperature is a higher efficiency conversion of the core heat to electricity and the ability to support a much broader range of industrial heat applications. The key drawback to gas-cooled reactors is that gases have a much lower heat capacity than liquids; therefore, the gas must be pumped at high velocity to remove the core heat. A related consequence is that the temperature differential across the core is very large, typically 500 °C, compared to 25-50 °C for a pressurized LWR. This temperature differential creates material challenges within the core and the secondary side of the plant.

The helium-cooled SMR designs under development generally fall into either a pebble bed or a prismatic configuration. In the case of the pebble bed, the fuel is dispersed in spheres about the size of a billiards ball. These spherical fuel elements stochastically migrate through the core and are continually removed and reinserted into the core for additional burnup. The prismatic configuration uses a more traditional rod geometry for the fuel and the rods are contained within monolithic blocks of graphite that are stacked to form the reactor core. In the case of prismatic configurations, the core is refueled in batch mode similar to fuel assembly-based LWRs.

Table 2.3 lists the four gas-cooled reactor SMR designs that currently have significant commercial support.

1.4.1 People’s Republic of China: HTR-PM design

The High Temperature Reactor Pebble-bed Module (HTR-PM) is a pebble-bed-type high-temperature, helium-cooled reactor. The fuel is UO2 enriched to 8.5% and contained in tristructural isotropic-type (TRISO) graphite-coated particles that are dispersed in 6 cm diameter graphite spheres. The 3 m diameter by 11 m tall core region represents a tall graphite ‘hopper’ containing 420 000 randomly packed spherical fuel

Figure 2.16 HTR-PM (China) — Institute of Nuclear and New Energy Technology (INET) © Institute of Nuclear and New Energy Technology (INET).

elements. The fuel elements migrate downward through the core as spheres are moved from the central discharge channel in the bottom reflector and optionally reinserted at the top of the core if maximum burnup has not been achieved. The graphite block reflector that defines the core region is contained within a 5.7 m diameter by 25 m tall steel pressure vessel. The helium coolant flows upward through the side reflector and then downward through the core region before flowing through a cross-duct to the helium/water steam generator contained in a separate steel pressure vessel. The steam generator is a once-through, counter-flow heat exchanger with multiple helical coil modules.

The HTR-PM is a successor to the HTR-10, a 10 MWt test reactor operated at the Tsinghua University. The HTR-10 was used to demonstrate the safety response of the HTR-PM, including its response to a loss of off-site power, a main helium blower failure, and a loss of main heat sink. The budget for construction of the first HTR-PM plant was approved in 2008 and the two-unit plant is being built in Rongcheng, Shandong Province, China. Construction was delayed after the destruction of the Fukushima Daiichi plant in Japan, but is now continuing with an expected completion in 2014. Key parameters and a representative graphic for the HTR-PM design are given in Figure 2.16. [14]

In accident situations, reactor materials can undergo chemical reactions that release stored energy in addition to the generation of decay heat. The primary reactions which occur at operating or modestly low temperatures are listed in Table 1.6 and elaborated below:

• For the sodium reactor, oxidation of the sodium coolant released by steam generator tubing failure by contact with secondary system water which also produces hydrogen; of less concern is the sodium reaction with air which causes relatively low heat release but vigorous emission of oxide fumes. The sodium leak in the Monju reactor to air from failure of an instrument penetration in December, 1995, caused only modest sodium leakage to the piping compartment. The event forced the shutdown of the reactor for 14 years, even though the overwhelming portion of this period was due to loss of public confidence versus the need for repairs and refurbishment. The EBR-II had to deal with numerous sodium leaks during its 30-year operating lifetime. These leaks were safely managed and the reactor operated as both a research reactor and a small power demonstrator.

• For graphite-moderated reactors, graphite oxidation from inadvertent air ingress; release of stored energy due to atom displacements in graphite (Wigner energy) can also occur as happened in the UK Windscale reactor, but the elevated operating temperature of modern SMR gas-cooled reactors eliminates this energy storage mechanism.

All other chemical reactions of interest occur at very high temperatures which would be encountered if the reactors suffered conditions of core degradation. These include the following:

• For water-cooled reactors, oxidation of the zircaloy and steel core cladding and structures by the primary water coolant; this reaction is not only strongly exothermic but also produces hydrogen. The hydrogen when mixed with dry air is flammable in a composition range between 4% and 75% H2. Typically containments are sized in PWRs to maintain hydrogen content below 4% by volume; BWRs employ smaller containments by virtue of their pressure suppression design which then requires either inerting (Mark I and II designs) or employment of hydrogen recombiners and igniters (Mark III design) to prevent hydrogen burning or explosions.

• For all liquid-cooled reactors, oxidation of metals that may exist in molten core material (called corium) by water and carbon dioxide released from thermal decomposition of the concrete containment basemat upon contact with corium; corium contact with the basemat could only occur if the reactor vessel failed.

A major positive characteristic of lead and lead-bismuth coolants is that their reactions with water/steam and air are slight and hence of no reactor safety consequence.

Integral reactors have been adopted in nuclear-powered submarines; it is not well known, however, that the first, and so far the only, ‘commercial’ iPWR was operational as early as 1964. It was the nuclear ship Otto Hahn, a German nuclear-powered freighter and research facility, which was launched in 1964 and commissioned in 1968. She sailed 650 000 nautical miles in 10 years without any technical problems, but was eventually docked because of nuclear hysteria, with ports and harbors refusing entry to a nuclear ship. The Otto Hahn featured helical steam generators, a solution favored by several current designs.

As far as terrestrial power reactors are concerned, the first iPWR type design to be proposed was the PIUS (Process Inherent Ultimate Safety) reactor by the Swedish ASEA-Atom in the early 1980s. It was conceived in response to the Three Mile Island accident with the objective of replacing the active safety approach with inherent safety.

Essentially, the reactor was placed in a large pool of borated water in a concrete pressure vessel located underground. Core cooling was by natural circulation with upper and lower density locks to prevent mixing between the circulated hot reactor coolant and the cold pool water. PIUS got quite a bit of attention, but never real traction. Initially ASEA-Atom had a 500 MWe integral design with steam generators inside the vessel, but later switched to a more conventional 640 MWe with steam generators outside.1 PIUS was first and foremost a natural circulation reactor, with the integral configuration being a mean of implementation, which was eventually dropped.

A true iPWR was proposed in the mid-1980s by US Combustion Engineering. This was the MAP (Minimum Attention Plant), a 900 MWt self-pressurized, full natural circulation design with multiple once-through steam generators located inside the vessel.2 MAP was eventually shelved by Combustion Engineering (which had become ABB-CE) in favor of the 320 MWe SIR (Safe Integral Reactor), developed in the late 1980s in collaboration with Rolls-Royce, Stone and Webster and the United Kingdom Atomic Energy Authority (UKAEA).3 The SIR core design, based on the CE System 80 commercial PWR, had a 55 kW/liter core power density, about half that of traditional PWRs, 24 month refueling cycle, 12 once-through integral steam generators arranged in an annular space above the core and an integral pressurizer in the vessel head. The six wet-winding glandless coolant pumps were mounted around the upper circumference of the vessel.

SIR was typical of iPWR designs which, starting in the early 1990s, were developed, and still continue to be, across the world, most notably in Russia, Argentina, Republic of Korea, Japan, China, as discussed in Part IV of this Handbook. In the USA the first significant effort was the IRIS (International Reactor Innovative and Secure), developed from the late 1990s to the end of 2009, when it was terminated.4,5 The IRIS project was led by Westinghouse with a major part of the work being performed by the international partners, which included industry, laboratories and academia. While in other countries the current effort on iPWR designs has continued on the concepts developed earlier, the current US effort has basically started anew, spurred by the Department of Energy (DOE) solicitation of SMR designs, which was finalized in 2011.

Going back to SIR, a very significant contribution to advancing the state of the art was a seminal paper by the UKAEA partner investigating the cost benefits of smaller reactors.6 It showed that the traditional capital cost economy of scale does not hold when other factors typical of smaller plants are taken into consideration. The paper listed and discussed quite a number of these factors: increased factory fabrication, more replication, multiple units at a single site, improved availability, faster progression along the learning curve, bulk ordering, better match to demand, smaller front-end investment, reduced construction time, increased lifetime, design appropriate to site and, elimination/downgrading of some safety systems. Most of these factors will be discussed in Chapter 10. The last factor, about the safety systems, is of momentous importance and will be fully explored in Section 3.4.

The next two sections, dealing with the safety and economics imperatives, are based on work performed during the 10 years of development of the IRIS design.

There are many reasons for this choice, aside from the familiarity of this author. The key one is that IRIS has systematically sought both safety excellence beyond the generally accepted limits and the synergism between safety and economics. Practical reasons are that IRIS is no longer being pursued and its work has been fully documented in over 500 open literature publications which provide a jumping point for iPWR designs, both present and future.

The ABV-6M is one of two floating commercial nuclear power plant designs being developed in the Russian Federation derived from reactor designs used for propulsion of ice-breakers. It is an integral pressurized water reactor except that the gas pressurizer and control rod drive mechanisms are external to the reactor vessel. The ABV-6M uses natural circulation of the primary coolant. Fuel assemblies are the same as used in the larger KLT-40S design (described below). Each 38 MWt unit has a capacity of 8.5 MWe. The complete power unit is approximately 5 m long by 3.6 m wide by 4.5 m tall and weighs 200 tons.

Figure 2.6 ABV-6M (Russian Federation) — OKBM Afriantov © Joint Stock Company ‘Afriantov OKB Mechanical Engineering’.

Normally two units are mounted on a barge with a maximum size of 140 m length by 21 m width capable of navigating the larger rivers in Russia. Each unit can also run in co-generation mode producing 6 MWe of electricity and 14 MWt of heat for water desalination (20 000 m3/day) or district heat applications (12 Gkal/h). Initial construction, routine refueling and maintenance, and final decommission of the units will be conducted at a centralized facility. No on-board refueling will be performed. The ABV-6M is also being considered for land-based siting and would be shipped to the site by truck or barge as a prefabricated package. Key parameters and a representative graphic for the ABV-6M design are given in Figure 2.6. [6, 7]

The two major incentives for SMR deployment are as follows.

1.2.1.1 Reduction of initial investment and associated financial risk

The modular concept allows the investor to achieve the level of total power supply desired by time-sequenced construction increments. Not only does each module increment cost less than that of the large monolithic competitor plant, but the time profile of capital investments can be somewhat offset by revenues from the earliest module deployments as they achieve commercial operation. However, when module construction is staggered, great care must be taken to insure that construction does not adversely impact the safety of the operating SMR.

The Pebble Bed Modular Reactor (PBMR) design began in 1996 as a 400 MWt annular core design with an outlet temperature of 900 °C coupled to a direct Brayton power conversion cycle. Currently, it is a 250 MWt cylindrical core design with an outlet temperature of 750 °C coupled to an indirect Rankine cycle with co-generation capability for process heat applications. The fuel is TRISO-coated UO2 particles, which were developed in Germany for the Arbeitsgemeinschaft Versuchsreaktor (AVR) and thorium high-temperature reactor (THTR) test reactors. The particles are dispersed in 6 cm diameter spherical fuel elements randomly packed in a graphite — reflected core region — 360 000 in all. The fuel elements migrate through the core at a rate of approximately 8 cm per day with a total residence time of roughly 100 days per pass and a total of three passes through the core. Reactivity is controlled using six control rods located in the reflector blocks. Eighteen shutdown channels in the reflector can accommodate absorber balls.

Several test facilities were constructed to support the original PBMR design, including a helium test facility, a heat transfer test facility and numerous component — level test facilities. Many of these tests are still valid for the current PBMR-CG design, which intended to be a co-generation plant producing both electricity and process steam. Normally deployed as a twin unit plant, the inlet feedwater and outlet steam from the secondary side of both units would be collected and shared between a turbine-generator set and a secondary heat exchanger for process steam production. A 1:1 split in steam for the turbine and process heat exchanger is expected, yielding a two-unit plant electrical output of 100 MWe. Key parameters for the PBMR-CG design are given in Figure 2.17. [15]

Figure 2.17 PBMR-CG (South Africa) — PBMR Ltd.

An important benefit of water and sodium coolants is their ability to scrub or retain fission products which would be released from the fuel and pass through these coolants in the event of a severe accident. This coolant characteristic would reduce the amount of fission products which might otherwise escape to the environment

Table 1.6 Energy release reactions and fission product scrubbing in various coolants Water Helium Sodium1 Lead/Lead — Bismuth Energy Zr-water/steam reactions: • Air reactions: Water reactions: Water reactions: release Zr(s) + 2H2O(I) ^ C(s) + O2(g) ^ CO2(g) Na(l) + H2O(g) ^ NaOH(/) + Virtually no reaction ZrO2(s) + 2^(g) + 393.15 kJ/(mol C)(798 K) &H2(g) + 160.1 kJ/(mol Na) with cold water or steam. 537.8 kJ/(mol Zr)(500 K) C(s) + CO2 (g) ^ 2 CO(g) -171.4 kJ/(mol C) (798 K) (798 K) Air reaction: Zr(s) + 2H2O(g) ^ Na(l) + NaOH(/) ^ Results in Pb2O and then ZrO2(s) + 2H2(g) + CO(g) + Z2O2(g) ^ Na2O(s) + Z2H2(g) + PbO. At the temperature 583.6 kJ/(mol Zr)(1477 K) CO2(g) 13.3 kJ/(mol Na)(798 K) of 450 °C the latter is + 282.3 kJ/(mol CO) transformed to The hydrogen produced (798 K) The hydrogen produced Pb2O3, and then at can be oxidized as can be oxidized as 450-470 °C to Pb3O4. H2(g) + ^(g) ^ HO(g) + All these unstable 241.8 kJ/(mol H2)(298 K) Na(l) + Z2H2(g) ^NaH(s) + compositions dissociate 57.3 kJ/(mol Na)(798 K) into PbO and O2 Burning reaction, zone of small flames at the sodium-air interface. Air reaction: Na2O oxide is produced which upon burning in air forms Na2O2. In the molten sodium only Na2O oxide is stable.

Fission (1) Volatile FPs belonging to alkali None (1) Volatile FPs belonging to Same as sodium3 product (FP) metals such as Cs, K, Rb will form alkali metals such as Cs, K, scrubbing in X-OH chemical compounds and will Rb have the same electronic primary remain in the water. structures as sodium (Na) atoms coolants2 (2) Volatile FPs belonging to and dissolve in sodium, but they halogens such as I, Cl, Br will have very high vapour pressures dissolve in water in ionic form such and will evaporate with sodium as I(-1), Cl(-1), and Br(-1). during long accident times. (3) Non-volatile FPs such as Sr, Ba, (2) Volatile FPs belonging to Y, La, Zr, Nb, Mo, Tc and Rh do halogens such as I, Cl, Br will not dissolve significantly in water. form Na-X (NaI, NaCl, NaBr) (Sr and Ba will react with water to chemical compounds with form soluble oxides). sodium. (3) Non-volatile FPs such as Sr, Ba, Y, La, Zr, Nb, Mo, Tc, and Rh do not dissolve significantly in sodium. 1Endo et al. (1990). 2Pers. Comm. H. Endo (JNS Organization) to E. Baglietto (MIT), Jan 2013. 3Pers. Comm. G. Toshinsky (SSC IPPE) to N. Todreas (MIT), July 2013.

if the containment were to be bypassed. As also detailed in Table 1.6, the various chemical-based fission products behave differently with regard to their retention in water and in sodium.

The conclusions which can be drawn are that relative scrubbing capabilities are (1) higher for water for alkali fission products, (2) higher for sodium for halogen fission products, (3) similar for non-volatile fission products, and (4) indeterminate due to lack of evidence for volatiles such as Sb and Te. Lead coolant behavior is similar to that of sodium. For gas reactors the coolant does not scrub fission products, but scrubbing occurs as plateout on cold surfaces.

Nuclear reactor safety is achieved through a sound design and the use of safety systems, i. e. protective systems which counteract the accident and/or attenuate its consequences. The ideal scenario would be a design so perfect that no safety systems are necessary, that is, a design where accidents either cannot occur or, if they do, their consequences are acceptable. Obviously this is Utopia, but the integral configuration offers a very good approximation to it. The most immediate, and universally adopted, possibility offered by the integral configuration is the elimination of the large LOCAs, simply because there are no large pipes to be broken. This is only one of the many opportunities offered to the designer. The IRIS project developed a unique approach, articulated over three tiers.

• The first tier, called Safety-by-Design, is a significant step beyond passive safety. The underlying principle is to intrinsically eliminate as many potential accidents as possible by proper design, rather than coping with their consequences through safety systems, either active or passive.

• The second tier is provided by simplified passive safety systems, which protect against the remaining potential accidents and mitigate their consequences.

• The third tier is provided by active systems which are not required to perform safety functions (i. e. are not safety grade) and are not accounted for in deterministic safety analyses, but are used as necessary to improve reliability and decrease the CDF. Their use and characteristics are optimized through a design based on probabilisitic safety assessment (PRA).

The iPWR offers the possibility of being able by design to: (1) eliminate some of the accidents (e. g. large LOCAs, control rod ejection); (2) decrease the probability of occurrence for the vast majority of the remaining accidents; and, (3) mitigate the consequences.

In loop-type PWRs there are typically eight accidents classified as Class IV design basis events (DBEs), i. e. accidents which can cause a radiation release to the environment. Thus, the DBEs eventually dictate the necessary safety systems. Table 3.1 (from Petrovic et al.5) summarizes the design characteristics; the safety implications of each design characteristic; the impacted accident and events; the related Class IV accident; and, bottom line, how they fare under the Safety-by-Design approach used by the IRIS reactor. As shown in the table, systematic implementation of the Safety-by-Design approach enables elimination of three out of the eight DBEs typically considered for LWRs, while four more are downgraded to a lower severity

class (as low as Class 1 for the locked rotor accident) where radiation release will not occur. The only remaining Class IV accident is the fuel-handling accident, because the iPWR, like practically all the power reactors, needs to be periodically refueled.

This is of course very impressive, but in reality DBEs very seldom do occur. Three Mile Island started with a small LOCA and Fukushima was the consequence of an external event (Chernobyl was atypical). So, attention must be paid to have proper, reliable passive safety systems (second tier). This practice is now adopted by all iPWR designs and most of the other LWR designs. The importance of the third tier, the active non-safety grade systems, was originally not recognized by the large LWRs where all the emphasis was placed on the passive systems, but the active systems do play a critical role in improving reliability and decreasing the CDF through an interactive and iterative PRA and safety design procedure.

From the very beginning of the IRIS design process, the PRA was iteratively used to guide and improve the design, as shown in Figure 3.1. The process is conceptually quite straightforward, but also quite time consuming, requiring tens of design iterations. It enabled IRIS to move from an initial CDF value of 2E-6 to a final value of 2E-8, at least a decade less than the most advanced of the other LWRs. As it will be recollected, E-8 is an act of God probability.

In the case of IRIS the cylindrical primary vessel has a 6 m diameter and the spherical containment a 25 m diameter. The containment is housed in the auxiliary building which also houses the remaining components of the nuclear steam supply system (NSSS), such as the spent fuel pool. The IRIS auxiliary building is of a cylindrical shape which is intrinsically more resistant to impact than an angular configuration. The containment is located one-third underground and also underground is the spent fuel pool. IRIS was designed several years before the occurrence of Fukushima, which would have been served very well by the IRIS Safety-by-Design.

Large break LOCAs cannot occur in an integral reactor, but small break LOCAs do. While their consequences are mostly insignificant from a technical standpoint, they do cause a negative financial, regulatory and public acceptance impact. And, of course, there is the possibility of triggering a higher-level accident. One of the accomplishments of the IRIS Safety-by-Design was to completely neutralize the small LOCAs. First, all lower level vessel penetrations are eliminated up to 2 m above the top of the core and there are no penetrations on the vessel head because of the internal control rods. The grand total is seven penetrations for safety and auxiliary systems. Furthermore, IRIS was designed such that if a penetration fails and a small LOCA does occur, there are no adverse consequences.

Once a break occurs, steam exits from the vessel into the containment, initiating the vessel depressurization; as the internal steam generators remove the decay heat,

steam condenses with a further depressurization effect. The IRIS containment was designed such that at the same wall thickness and design strain for traditional loop PWRs it can take an operating pressure approximately four times higher due to its spherical shape and diameter being about half. Because of the simultaneous vessel pressure decrease (due to the steam generators’ heat removal) and containment pressure increase that is safely allowed by the improved IRIS containment design, the two pressures equalize quickly and no further steam exits the break. LOCAs of various break sizes and elevations were evaluated and the LOCA duration was about half an hour, with the core remaining safely covered in all cases (for the worst size/elevation combination, about 2 m of water were still left above the top of the core). Once the steam egression phase is over, the vessel and containment are thermo-hydraulically coupled through the break and long-term cooling of the vessel/containment system can be controlled through external cooling of the containment.

The complex coupled behavior of this patented design was extensively analyzed and experimental verification was planned at the SIET test facility in Piacenza, Italy, where tests of the Westinghouse AP 600 passive systems had been performed. The design of the IRIS test facility mockup and the extensive test campaign plans were completed when the IRIS program was terminated.

Historically the emphasis in the safety design and analysis has been on the internal events. However, as more and more improved handling of the internal events is being achieved, the external events, in primis seismic, have become determinant in establishing the total CDF. And, of course, Fukushima has been quite a reminder. The very compact iPWR can dispose of the seismic events through the Safety-by­Design approach, since it can be sited on seismic isolators in a partly underground location.

Elimination of the consequences from the seismic events, which are by far the most significant of the external events, will keep the total CDF in the order of E-8/yr as determined by the internal events. On the other hand, seismic CDF for non-isolated plants could be of the order of E-6/yr or more, i. e. of the same order of magnitude as the internal events in the most recent LWR designs, thus significantly affecting the overall safety. Seismic is the most critical of the external events, while others can be kept under E-8/yr through proper application of the Safety by Design. An in-depth discussion can be found in Carelli et al1 and Alzbutas et al8

Another consideration is the plant resistance to terrorist attacks, which can be handled through Security-by-Design, rooted on the same principles as the Safety — by-Design. A typical example is a very low profile above ground (in the IRIS case it was less than 30 m), an uninviting choice to airborne terrorists with many taller targets to choose from. This application of the Security-by-Design would be even more effective for other iPWRs which are smaller than the 335 MWe IRIS.

In the same vein as the Safety-by-Design and Security-by-Design, the iPWR offers intrinsic possibilities to improve proliferation resistance and physical protection, as addressed in Chapter 9.