The individual containment vessels of the NuScale design sit in a common open external tank referred to as the reactor pool. The NuScale containment conforms tightly to the reactor vessel without room for any additional water tanks. The NuScale reactor pool provides the emergency heat sink function provided by the internal RWST in other iPWR designs. In addition, the NuScale reactor pool provides an additional barrier to fission product release (NuScale, 2012).

The NuScale containment is maintained under a vacuum to enhance its heat transfer characteristics. Equipment to draw and maintain the vacuum will be required.

5.3.2 Control room habitability equipment

Current large PWRs require equipment to maintain control room habitability following an accident or toxic gas release. The iPWR designs have the same need for this function. While large PWRs can rely on safety-related AC-backed equipment to function in a long-term manner, the iPWR designs rely on passive systems designed to last at least 72 hours. This typically requires the use of batteries and compressed air systems dedicated to this purpose.

Ever since the Three Mile Island accident, human-factor issues were largely associated with the design of the main control room. The possibilities of applying IIIE principles to improve human performance were limited to a great extent by the constraints of discrete, analogue instruments and controls. However, due to new capabilities offered by technologies like advanced sensors and automation systems, new NPP designs are now expected to introduce fundamental changes, not only in the design of the control room, but also in the role of the operator and the tools they use to monitor and control the plant. This could be regarded as a natural evolution for the industry, but it will require engineers and designers to rethink many tried and tested concepts and assumptions. For example, control centre structures need to be remodelled to make provision for new types of console and panel layouts, large screen displays, new communication media and even different crew structures. This will require a clear shift in the definition of the control room, its controls and instruments, its support structures and also the location of the control room in the plant.

Technically, it has become possible to control the plant from a remote location, but it will be a challenge to prove the reliability of such a scheme under all operational conditions. In addition to the changes in the physical and functional architecture of control rooms, we can also expect to see changes in the allocation of operational functions to humans and systems. The mere fact that future operators will deal with computer-based ‘soft controls’ and a multitude of high-resolution displays will already change their roles and mode of interaction with the plant. Where we today understand the operating crew as consisting of reactor operators, senior reactor operators and supervisors whose roles are largely determined by operating procedures, future operating crews may be regarded rather as part of the joint human-technology system, which in turn is part of the bigger socio-technical system of the plant. The reason for this lies in how the operator’s responsibilities and interaction with the plant will change. The shift will be more than just a role change due to increasing levels of automation, or an increasing supervisory role where operators’ primary function will be to monitor plant status and only to intervene if actual operation deviates from set points. Rather, there are now increasing possibilities for operators to perform ‘predictive control’ by examining past data, predicting future behaviour of processes by means of extrapolation and real-time simulation, and performing corrective actions before an event is likely to occur.

A further shift in the role of the operator will be an increase in the scope of responsibility and collaboration. For example, the scope of control and monitoring functions could increase from just operations, to include maintenance, production planning, and even design and optimisation.

All of these changes represent a paradigm shift for the nuclear industry, and it is almost entirely because of the advancement of automation and HSI technology. The changes have immediate implications for engineers who have to reconcile technological requirements with human abilities and limitations. There can be little doubt that automation is key to achieving cost-effective operations in future nuclear energy systems, but humans will continue to play as important a role in future systems as in today’s safe nuclear power plants. We can expect a different sort of HSI from that of today’s plants, but one in which the operator and crew are able still to intervene when necessary and otherwise oversee automation in many aspects of plant operation. This will require development of more ‘intelligent’ forms of automation and adaptive interface capabilities to facilitate near-autonomous operation as well as efficient human-system collaboration.

The following are some of the most important considerations that need to be included in power plant engineering and design strategies:

• The joint human-technology system must be defined in terms of the dynamic allocation of functions between the humans and the automation system.

• The human-technology system is not static and will require new rules and procedures for allowing a minimum number of operators to control multiple modules concurrently. Even for single module plants, it is possible that higher levels of automation will require fewer operators in the control room. However, regulators are unlikely to accept an unconventional staffing design without some kind of proof of concept. For new plants, this proof could be in the form of simulations or predictive computational models that provide reliable data on operator performance under various plant conditions (Persensky et al., 2005).

• Task support requirements — owing to the dynamic nature of the collaborative human-system relationship and the variable levels of complexity at different levels of automation, there will be variable requirements for task support. In principle, the lower the level of automation, the more the operator’s involvement in plant control and thus the more support is required, especially for non-routine tasks. HSIs that are designed to optimise human performance need to be concerned with fundamental collaborative functions such as coordination, adaptation and communicating shared awareness within the total socio-technical system. This goes beyond the present usage of computerised procedure systems, decision support, databases, data mining systems, and various devices to deliver this information to the user. The usability requirements for task support systems, especially those that use new HSIs, must include measures of the trust the operator places in the technology (Hugo, 2004).

These considerations suggest that HSIs can be examined from many different perspectives, but when we consider the challenges of emerging power plant designs, there are two main themes that seem to influence most considerations for future implementation:

• New HSI technologies offer innovative interaction modalities such as gesture control, augmented reality, remote control and telepresence. Designers need to provide, or obtain, sufficient evidence that these new concepts are conducive to usability and will support improved human performance.

• The applicability of advanced HSIs in the nuclear field is a particularly interesting question because the nuclear industry has been relatively stagnant for a long time. As a result, practices, standards, procedures and technologies have become so entrenched that utilities, vendors, regulators and other stakeholders have to make extraordinary efforts to justify and validate the use of new technologies. Even if those technologies had already shown proof of concept in other industries, the strict regulations and standards of the nuclear industry make implementation of any new technology an exceptional challenge.

The rest of the chapter will cover the most important aspects of HSI technology, starting with a description of the architecture or taxonomy of HSIs as they are typically deployed in ‘modern’ power plants. The following sections will also describe the range of technologies becoming available to designers, the technical capabilities they offer to support human performance, and the use and potential of a range of non-traditional HSIs, such as virtual and augmented reality systems, haptic devices and gesture controllers.

Most iPWR SMR designs aim to balance the use of proven LWR technology with the novel solutions necessary to exploit unique characteristics and potential advantages of SMRs. Thus, it comes as no surprise that developing, analyzing, licensing and ultimately deploying SMRs require testing and validation beyond and on a scale larger than that for ‘traditional’ large loop PWRs.

Testing of components and systems may be hierarchically divided into:

• engineering development tests;

• separate effects component tests;

• integral effects tests;

• integral primary configuration test facilities;

• prototypes.

Engineering development tests aim to demonstrate feasibility and verify engineering capability before fabricating final components. Separate effects component tests examine the design, fabrication, operation and qualification of large-scale prototypic components. They may include accelerated aging, irradiation, seismic testing, etc., and establish performance of components. They also provide data for validation of computer codes. Integral effects tests examine and demonstrate integrated performance of combined systems or features, typically in a scaled setup. They may be used to show interaction between systems, including safety and non-safety systems. They also may provide thermal-hydraulic performance parameters for models and analysis, and be used to validate codes. Integral primary configuration test facilities are clearly of particular interest for iPWR SMRs since the integral primary configuration is the main difference to the existing, operating loop PWRs. They employ electrically heated rods to simulate the reactor core and are used to demonstrate the overall

Table 8.3 Summary of safety-related characteristics for selected integral designs CAREM25 IRIS mPOWER NuScale RITM-200 SIR SMART W-SMR Argentina International USA USA Russian Federation USA, UK Republic of Korea USA CNEA Consortium Babcock & Wilcox NuScale Power OKBM Afrikantov Combustion Engineering KAERI Westinghouse Power level (MWth) 100 1000 530 160 175 1000 330 800 Power level (MWe) 27 335 180 45 50 320 100 225 Primary circuit circulation Natural Forced Forced Natural Forced Forced Forced Forced Fully internal pumps n/a Yes No n/a No No No No Soluble boron-free Yes No Yes No Yes Yes No No core Internal CRDMs Hydraulic Electromag. Electro­ Hydraulic No No No No Electromag. Safety systems Passive Passive Passive Passive (*) Passive Active and passive Passive DHRS Passive Passive Passive Passive (*) Passive Passive Passive CDF Target 1.0 X 10-7 ~1.0 X 10-8 ~10-8 ~1.0 X 10-8 (*) (*) 1.0 X 10-6 Target 1.0 X 10-7 (*) LERF Target 1.0 X 10-8 ~1.0 X 10-9 (*) (*) (*) (*) Target 1.0 X 10-8 (*) NOTES: 1. Table prepared based on public information, mainly from the IAEA ARIS database (IAEA, 2012a). 2. Single unit power level quoted. Most designs consider multi-module siting. 3. CDF = core damage frequency, per reactor-year. 4. LERF = large and early release frequency, per reactor year. 5. n/a = not applicable. 6. (*) = information not available in considered references.

normal and off-normal performance of the whole system and validate system codes. For the same reason, several iPWR concepts are considering or have decided to build a scaled-down prototype. A prototype uses nuclear heat, i. e. it is a critical reactor. Notably, CAREM-25 (IAEA, 2012a) is a 27 MWe prototype for a larger 100-200 MWe commercial version. According to IAEA (2012a), site excavation work for CAREM-25 was completed at the end of August 2012, and construction has begun. As quoted by the World Nuclear News (http://www. world-nuclear — news. org/), in December 2013, the contract for the reactor vessel was awarded, and, according to the Comision National de Energia Atomica (CNEA), the unit is currently scheduled to begin cold testing in 2016 and receive its first fuel load in the second half of 2017.

Engineering development tests for iPWR SMRs are driven by the novel components, or components used in a novel way, as compared to loop PWRs. Depending on the specific iPWR design, this may include, among others: fuel and fuel assembly, internal control rod drive mechanism (electro-magnetic or hydraulic), fully immersed pumps, integral steam generators (frequently with helical coils or multi-stage), integral pressurizer or self-pressurizing systems, and novel instrumentation to address specific needs of integral systems, e. g. flow measurements and nuclear safety instrumentation (Petrovic et al., 2005).

Illustrative examples (listing only a portion of the intended testing) include the following:

• mPower has invested over $100M in a component testing program and integrated system test (IST) facility. It is conducting or planning tests on reactor coolant pumps, CRDMs, fuel, steam generator and emergency high pressure condenser (Azad, 2012; www. babcock. com/products/Pages/IST-Facility. aspx).

• NuScale planned or is performing tests that include steam generators, CRDMs, fuel bundles (Ingersoll, 2012). NuScale has also commissioned a multi-module control room simulator laboratory with 12 independent module simulators, to demonstrate multi-module operation, since the basic configuration of NuScale power plant will include 12 45 MWe modules (Ingersoll, 2012; www. nuscalepower. com).

• Westinghouse is planning a similar series of tests, has already built two full-scale fuel assemblies and has been testing internal CRDMs for its SMR (Kindred, 2012).

Separate effects component tests also reflect iPWR SMR technical features. They may be related or extend engineering development tests beyond the development, and may consider operation and qualification of large-scale prototypic components, including accelerated aging and irradiation testing. Some typical examples include:

• verifying heat transfer characteristics if novel heat exchanger type(s) are considered for primary or decay heat removal;

• steam generators’ long-term inspectability and maintenance;

• main coolant pump operability and long-term performance;

• in-core instrumentation performance and long-term operability;

• fuel assembly performance (vibrations, seismic response).

Integral effects tests are intended to verify coupled performance and interaction between systems and may include (depending on the iPWR design):

• testing coupled performance of steam generator and emergency heat removal system

(EHRS);

• reactor vessel and containment or guard vessel interaction;

• reactor coolant system and ADS (automated depressurization system) coupled

performance.

Of particular importance for iPWR are phenomena related to natural circulation (IAEA, 2005b). This is due to the fact that most of the concepts incorporate passive, natural circulation-driven, decay heat removal systems. Some of the lower-power concepts (e. g. CAREM-25, 27MWe; NuScale, 45 MWe) also employ natural circulation for heat removal in normal full-power operation. A number of tests, related to specific passive systems, are planned, aiming to better understand the phenomena, demonstrate performance of the systems, and validate codes and methodologies needed for design and licensing.

As already mentioned, integral configuration test facilities are indispensable for validation of system models and accurate simulation of the whole system, and as the basis for licensing. Proper scaling is perhaps the most important preparation task for integral testing; it allows replicating correct physics and validating codes even though the geometry itself is not necessarily prototypical in all aspects, and the tests are electrically, not nuclear heated. A hierarchical, two-tiered scaling analysis (H2TS) (Zuber, 1991) provides a framework for systematical decomposition that includes the system, subsystems, modules, constituents, geometrical configurations, physical phases (gas, liquid, and solid), fields and phenomena. Some examples of such facilities are provided below.

The interaction between the PR&PP Working Group and the GIF System Steering Committees (SSCs) has provided insights on the type of reactor system information that is necessary and useful to collect before one begins a PR&PP evaluation. While the focus of the GIF is on six advanced reactor concepts of various designs, some alternative concepts within these designs are potentially SMRs (e. g. there are a sodium fast reactor design of low power as well as a lead fast reactor design of low power). Furthermore all GIF concepts are in the design phase, which is much the same situation as with SMRs.

It is important to include information on major reactor parameters such as power, efficiencies considered, coolant, moderator (if any), power density values, fuel materials (this could be covered under fuel cycles), inlet and outlet conditions, coolant pressure, neutron energy spectrum, etc., for all design options under consideration.

Also useful is a high-level description of the type, or types, of fuel cycles that are unique to the reactor system and its major design options. A material-flow diagram is valuable if available. Discussion should include mention of major waste streams that might contain weapons-usable material or be used to conceal diversion of weapons-usable material.

For a given SMR design, information that is particularly important to PR&PP will include potential fuel types (including high-level characteristics of fresh and spent fuel), fuel storage and transport methods, safety approach and associated vital equipment (for confinement of radioactivity and other hazards, reactivity control, decay heat removal, and exclusion of external events), and approach to physical arrangement as it affects access control and material accounting for fuel (a potential theft target) and access control to vital equipment (a potential sabotage target). Key high-level information to define or develop about the system elements is:

• What material types exist or can exist within a system element?

• What operations are envisioned to occur in a system element, and whether (and how) these

operations can be modified or misused?

• What kind of material movement is envisioned to occur normally in and out of a system

element?

• What safeguards and security are envisioned to exist in the system element?

Potential adversary targets can be identified for the defined system elements. All system elements can be considered or only those that are judged to contain attractive adversary targets. Potential adversary targets are identified by considering material factors, facility factors, and safeguards considerations. Material factors include property attributes that can be determined from process flow sheets, such as isotopic compositions, physical forms, inventories and flow rates, etc. Facility factors include basic characteristics of equipment functions and facility operations, potential for facility/ equipment misuse, facility/equipment accessibility, etc. Safeguards considerations include, for example, the ability of safeguards systems to detect illicit activities, facility accessibility to safeguards inspectors, availability of process information to safeguards inspectors, adequacy of containment and surveillance systems to detect diversion or misuse, and the degree of incorporation of safeguards into process design and operation.

A multi-laboratory team of US subject matter experts, including several members of the PR&PP Working Group, used the PR&PP evaluation methodology as the basis for a technical evaluation of the comparative proliferation potential associated with four generic reactor types in a variety of fuel-cycle implementations. These are a sodium fast reactor, a high temperature gas reactor, a heavy water reactor, and a light water reactor. The evaluation team undertook a systematic assessment, capturing critical assumptions, and identifying inherent uncertainties in the analysis. A summary of the study was presented at the Institute of Nuclear Materials Management (INMM) 51st Annual Meeting (Zentner et al., 2010).

The relevance of the insights varies based on the various stakeholders of a PR&PP evaluation: policy makers, system designers, and the safeguards and physical protection communities.

For policy makers:

• An assessment of the proliferation potential of a particular reactor design in nuclear energy system should consider the system’s overall architecture, accounting for the availability and flow of nuclear material in the front and back end of the fuel cycle.

For designers:

• Of the five PR measures, the designer will directly influence three: detection probability (DP), detection efficiency (DE) and material type (MT).

• To enhance DP and DE, designers can incorporate features in the design to facilitate easier, more efficient and effective safeguards for inspection and monitoring. For example, minimizing the number of entry and exit points for fuel transfer between system elements will enhance material containment, protection and accountancy (MCP&A), thus partially compensating for any lack of knowledge continuity by visual inspection during a fuel transfer.

• Material type for PR is related to the chosen composition of the nuclear material. The designer can optimize the design either to reduce the material’s attractiveness (e. g., increase burnup in the uranium fuel to raise the fraction of Pu-238, thereby lowering the quality of plutonium in the spent fuel), or to make post-acquisition processing of the material more complex, indirectly increasing the technical difficulty for the proliferator.

For safeguards inspectors:

• Augmenting inspections for handling and storing fresh and spent fuel would reduce proliferation potential.

• Enhanced inspection of fresh fuel would reduce the proliferation potential of covert diversion and misuse.

• Optimizing MT and material movement pathways to facilitate accountability measurements can make verification more effective and efficient.

9.2 Future trends

The PR&PP methodology provides a framework to answer a wide variety of non­proliferation and security-related questions for SMRs and to optimize these systems to enhance their ability to withstand the threats of proliferation, theft, and sabotage. The PR&PP methodology provides the tools to assess SMRs with respect to the nonproliferation and security.

PR&PP analysis is intended to be performed, at least at a qualitative level, from the earliest stages of system design, at the level where initial flow diagrams and physical arrangement drawings are developed, and simultaneously with initial hazards identification and safety analysis. The methodology facilitates the early consideration of physical security and proliferation resistance because the structure of the PR&PP methodology bears strong similarity to safety analysis.

The PR&PP methodology adopts the structure of systematically identifying the non-proliferation and security challenges a system may face, evaluating the system response to these challenges, and comparing outcomes. The outcomes are expressed in terms of measures, which reflect the primary information that a proliferant state or an adversary would consider in selecting strategies and pathways to achieve its objectives. By understanding those features of a facility or system that could provide more attractive pathways, the designer can introduce barriers that systematically make these pathways less attractive. When this reduction may not be possible, the analyst can highlight where special institutional measures may be required to provide appropriate levels of security.

Beyond requiring that a systematic process be used to identify threats, analyze the system response, and compare the resulting outcomes, the PR&PP methodology provides a high degree of flexibility to the analyst, subject to the requirement that the results of studies receive appropriate peer review. For this reason, it is anticipated that approaches to performing PR&PP evaluations will evolve over time, as the literature and examples of PR&PP evaluations expand. Different tools for identifying targets, evaluating system response and uncertainty, comparing pathway outcomes, and presenting results can be expected to increase in number, as will the range of questions that can be answered and insights gained from PR&PP studies.

9.3 Sources of further information and advice

The reader is encouraged to see the collection of journal articles on PR&PP that is contained in a special issue of the American Nuclear Society’s Nuclear Technology (Volume 179, Number 1, 2012). This journal issue contains numerous articles on methods and applications of PR&PP and related approaches. The US National Academy of Sciences has issued a review of methods for proliferation risk assessment and its applications to decision making. This report was issued in 2013 and can be obtained at http://www. nap. edu/catalog. php? record_id=18335.

The IAEA has developed manuals for use by member countries on assessment approaches for non-proliferation and security aspects of innovative reactors. It has issued a report on ‘Options to Enhance Proliferation Resistance of Innovative Small and Medium Sized Reactors’ (see IAEA, 2014). Another recently issued report by the IAEA is International Safeguards in Nuclear Facility Design and Construction, IAEA Nuclear Energy Series No. NP-T-2.8, 2013 which discusses how international safeguards concepts can be introduced during the design phase of a nuclear facility.

The IAEA has also developed guidance for proliferation resistance assessments. It can be obtained at: ‘Guidance for the Application of an Assessment Methodology for Innovative Nuclear Energy Systems: INPRO Manual — Proliferation Resistance,’ IAEA-TECDOC-1575 Rev. 1, November 2008

Finally, three major reports on the PR&PP methodology can be found at the website: https://www. gen-4.org/gif/jcms/c_9365/prppProliferation. htm. These are (1) the report on the evaluation methodology itself (Revision 6), (2) the case study for the example sodium fast reactor, which is a four module small reactor, and (3) the joint study performed by the PR&PP working group and the designers of each of the Generation IV designs, some of which are small reactors.

Energy needs, and particularly clean energy needs, across the globe have created a market and demand for SMRs. The promise of SMRs, both with enhanced safety and increased flexibility in applications and financing, has created a global market and potential enterprise that must be supported by more streamlined processes for licensing and deployment. Embarking countries that desire or require nuclear energy will probably demand, solicit and procure a nuclear technology that is proven and has been licensed by a competent regulatory authority. Embarking nations are risk averse and resource limited — they want a proven technology and previously licensed/approved design to mitigate a financial constraint and promote private or public investment. Embarking nations also have limited regulatory resources and capabilities — a certified/approved design will permit a licensing process that can leverage the proven and licensed design. The international nuclear energy community must work together to identify and develop a more effective framework for licensing of these previously approved/certified SMRs. Existing frameworks include the International Atomic Energy Agency (IAEA) International Project on Innovative Nuclear Reactors and Fuel Cycle (INPRO), the International Framework for Nuclear Energy Cooperation (IFNEC), and the NRC’s International Regulatory Development Program (IRDP).

Economic assessment of a given NHES architecture should involve a number of inputs, including market size, profitability, total capital investment, operations and maintenance costs, and manufacturing costs (which include fuel and other fixed or variable costs). The overall system economics vary when additional revenue-producing subsystems are integrated with the SMR. Economic analysis becomes particularly complex when considering the time variability in the cost of electricity, which is also dependent on the production source (taking into account grid priority and feed-in tariffs for renewables), variability in electricity demand, potential future carbon taxes, and revenue from non-electricity products (e. g. methanol).

Private industry requires sound economic analysis and reasonable assurance of value — both present and future — before adopting and implementing innovative energy generation and dissemination strategies. Achieving a low uncertainty estimation on the economic return of hybridized SMRs requires additional research and development activities for some of the proposed subsystems (e. g. advanced, non-water-cooled reactor designs), but more specifically for the functional integration of those subsystems, system monitoring technology, and control system architecture. Even in the case of a hybrid system architecture that employs off-the-shelf subsystems with demonstrated performance history the integration of those subsystems is a departure from the known operational space that introduces economic uncertainty and risk. Some of the considered subsystems operate on very different timescales and with very different characteristics, requiring demonstration of system interaction under transient conditions to verify that the physical interfaces (hardware coupling), control system hierarchy, and control implementation are functional across the range of operating conditions.

The DOE is initiating preliminary work via its labs on concept studies for three A-SMR technologies: (1) the advanced sodium-cooled fast reactor with a design electrical rating of 100 MWe (AFR-100) with Argonne National Laboratory as the lead, (2) a generic small HTGR concept derived from the three HTGR designs evaluated under DOE’s NGNP program with the Idaho National Laboratory as the lead, and (3) a small fluoride salt-cooled reactor, the small, modular, advanced high-temperature reactor (SmAHTR) that is graphite moderated with a design electrical ratings of 20 or 50 MWe with Oak Ridge National Laboratory as the lead.

The initial efforts on all three concepts will focus on two objectives: (1) prepare a brief description of the reactor design in terms of major design features and attributes as a reference design and (2) conduct a technology readiness assessment of the important technologies to provide a status of these technologies and a sense of the R&D that would be needed to develop a commercial design.

Figures 14.5 and 14.6 present illustrations of pre-conceptual designs for the AFR-100 [9] and SmAHTR [10] concepts, respectively, while Tables 14.5 and 14.6 provide basic design system parameters for each concept.

Primary — heat

exchanger

15.5.1 SFR

The KALIMER-600 design served as a starting point for developing a new advanced design which is equipped with advanced design concepts and features.

Various advanced design concepts have been proposed and evaluated against the design requirements which were established to satisfy the Gen IV technology

goals.

The top-tier design requirements of a 600 MWe transuranium (TRU) burning fast reactor are categorized by three criteria: general design requirements, safety and investment protection, and plant performance and economy. Details of these design requirements are given in Table 15.2. These requirements reflect the design policies, especially emphasizing proliferation resistance, safety assurance, and metal fuel performance, and form the basis for developing the detailed system design requirements for key NSSS concepts.

For a variety of reasons, the reactor core can become unstable to power oscillations, e. g., initiated by instability in the reactivity control systems or turbines. In addition, spatial effects caused by the fission product xenon can also be a trigger across, as well as up and down the core. Instability is particularly an issue for large boiling water reactors (BWRs) due to the large core size, although it can occur in smaller cores, but will be least significant in those cases.

Stability in the control systems for the reactor hardware means that total core power oscillations are not usually possible, and nuclear design of the core and control rods can ensure that the xenon effects are self-limiting.

NSSS control and indication instrumentation is not part of the safety system instrumentation; however, NSSS Instrumentation is required for day-to-day operation of the plant and is modeled in the safety analysis so that control systems can be counted on to perform in a safe operating envelope. These control systems are also designed to handle anticipated transients in such a way as to mitigate severe consequences and return the plant to normal operating conditions. If the NSSS control systems fail to keep the reactor within its normal operating envelope, the safety system takes over and either shuts the reactor down and/or actuates safety features to protect the reactor.