The removal of decay heat from a nuclear core can be accomplished by passive means using either an emergency heat exchanger or an isolation condenser (IC), depending on the system design. In some advanced pressurized water reactors (PWR), the emergency heat exchanger decay heat removal system consists of a closed loop that includes a shell and tube heat exchanger immersed in a large liquid pool that is elevated above the core. The relative elevation between the heat source and heat sink creates a buoyancy-driven natural circulation flow that eliminates the need for a pump. Decay heat is removed from the core by convective heat transfer from the fuel to the single-phase liquid in the reactor vessel. The heat stored in the liquid is carried by natural circulation to the emergency heat exchanger. Heat is transferred from the fluid through the emergency heat exchanger tubes into the pool by three mechanisms; single-phase convective heat transfer at the tube inside surface, heat conduction through the tube walls, and nucleate boiling at the tube outside surface. Some advanced PWRs use the steam generator as an intermediate emergency heat exchanger with a passively cooled, natural circulation feedwater loop.

Some advanced boiling water reactors (BWR) use isolation condensers as the means of removing core decay heat. The IC consists of a shell and tube heat exchanger immersed in a large liquid pool elevated above the core. In a BWR, core decay heat is removed by nucleate boiling. The steam generated by this process is condensed inside the IC tubes creating a low pressure region inside the tubes which draws in additional steam. Thus the driving mechanism for the flow is steam condensation. Heat is transferred through the IC tubes into the pool by three mechanisms; single-phase steam condensation (phase change) at the tube inside surface, heat conduction through the tube walls, and convective heat transfer at the tube outside surface. The condensate is returned as a single-phase liquid to the reactor vessel by gravity draining. Performance of the IC can be affected by the presence of non-condensable gases.

The following is a listing of the emergency heat exchanger related local phenomena:

• emergency heat exchanger loop flow resistance

• Buoyancy force

• Single-phase convective heat transfer

• Shell-side nucleate boiling heat transfer

The following is a listing of the IC related local phenomena:

• IC loop flow resistance

• Low pressure steam condensation

• Condensation heat transfer in the presence of non-condensable gases

• Shell-side convection heat transfer

• Condensate/steam countercurrent flow limitations

As part of the IAEA’s overall effort to foster international collaborations that strive to improve the economics and safety of future water-cooled nuclear power plants, an IAEA Coordinated Research Project (CRP) was started in early 2004. This CRP, entitled Natural Circulation Phenomena, Modeling and Reliability of Passive Safety Systems that Utilize Natural Circulation, focuses on the use of passive safety systems to help meet the safety and economic goals of a new generation of nuclear power plants. This CRP has been organized within the framework of the IAEA Department of Nuclear Energy’s Technical Working Groups for Advanced Technologies for Light Water Reactors and Heavy Water Reactors (the TWG-LWR and the TWG-HWR) and provides an international cooperation on research work underway at the national level in several IAEA Member States.

The use of passive safety systems was addressed in 1991 at the IAEA Conference on “The Safety of Nuclear Power: Strategy for the Future” [1]. Subsequently, experts in research institutes and nuclear plant design organizations from several IAEA Member States collaboratively presented their common views in a paper entitled ‘Balancing passive and active systems for evolutionary water cooled reactors’

[2] . The experts noted that a designer’s first consideration is to satisfy the required safety function with sufficient reliability, and the designer must also consider other aspects such as the impact on plant operation, design simplicity and costs. The Safety Fundamentals of the IAEA Safety Standards

[3] recommends “an appropriate combination of inherent and engineered safety features” for defence in depth. Design Requirements of the IAEA Safety Standards [4] mentions “following a postulated initiating event, the plant is rendered safe by passive safety features or by the action of safety systems that are continuously operating in the state necessary to control the postulated initiating event”.

The use of passive safety systems such as accumulators, condensation and evaporative heat exchangers, and gravity driven safety injection systems eliminate the costs associated with the installation, maintenance and operation of active safety systems that require multiple pumps with independent and redundant electric power supplies. As a result, passive safety systems are being considered for numerous reactor concepts (including in Generation III and III+ concepts) and are expected to find applications in the Generation-IV reactor concepts, as identified by the Generation IV International Forum (GIF). Another motivation for the use of passive safety systems is the potential for enhanced safety through increased safety system reliability.

The CRP benefits from earlier IAEA activities that include developing databases on physical processes of significant importance to water cooled reactor operations and safety [5,6], technical information exchange meetings on recent technology advances [7-13], and Status Reports on advanced water cooled reactors [14,15]. In the area of thermal hydraulic phenomena in advanced water cooled reactors, recent IAEA activities have assimilated data internationally on heat transfer coefficients and pressure drop [5]; and have shared information on natural circulation data and analytical methods [5], and on experimental tests and qualification of analytical methods [8]. This CRP also benefits from a recent report issued by IAEA [16] on the status of innovative small and medium sized reactor designs.

In order to establish the progress of work in this CRP, an Integrated Research Plan with description of the tasks addressing the objectives of the CRP was defined. These tasks are:

• Establish the state-of-the-art on natural circulation

• Identify and describe reference systems

• Identify and characterize phenomena that influence natural circulation

• Examine application of data and codes to design and safety

• Examine the reliability of passive systems that utilize natural circulation.

The activity under the first task is aimed at summarizing the current understanding of natural circulation system phenomena and the methods used experimentally to investigate and model such phenomena. In November 2005, the IAEA issued a technical document [17], developed by the collaborative effort of the CRP participants and with major contributions from some selected experts in the CRP, aimed at documenting the present knowledge in six specific areas; advantages and

challenges of natural circulation systems in advanced designs, local transport phenomena and models, integral system phenomena and models, natural circulation experiments, advanced computation methods, and reliability assessment methodology.

The activity for the third task is aimed at identifying and categorizing the natural circulation phenomena of importance to advanced reactors and passive safety system operations and reliability. This task is the major link between the second and the fourth tasks. The activities related to the second task and the fourth task including the fifth task are agreed to be published in two different IAEA — TECDOCs by the CRP participants. Since the third task is the backbone for both tasks, inclusion of this task in both IAEA-TECDOCs in an appropriate form is a logical consequence.

The aim of this publication is to describe passive safety systems in a wide range of advanced water — cooled nuclear power plant designs with the goal of gaining insights into the system design, operation, and reliability without endorsement of the performance. This publication has a unique feature which includes plant design descriptions with a strong emphasis on passive safety systems of the specific design. These descriptions of the passive safety systems together with the phenomena identification (including the definitions of the phenomenon to describe in some detail the titles of the phenomenon considered) are given in the Annexes and Appendix of this report, respectively. Based on the passive systems and phenomena, which are considered, a cross reference matrix has been established and also presented in this report. As basis for the phenomenon identification, earlier works performed within the OECD/NEA framework during 1983 to 1997 were considered. These are:

• Code validation matrix of thermal-hydraulic codes for LWR LOCA and transients [24],

• State of the art report (SOAR) on thermo-hydraulic of emergency core cooling in light water reactors [23],

• Separate effects test (SET) validation matrix for light water reactors [19],

• Integral facility tests validation matrix for light water reactors [20],

• Status report on relevant thermal-hydraulic aspects of advanced reactor designs [21].

Since the Generation III and III+ reactor designs contain technological features that are common to the current generation reactors, the phenomena identified during the work performed for first item to fourth item can be used as base knowledge. The fifth item provides the important and relevant thermal hydraulic phenomena for advanced reactor designs in addition to the relevant thermal hydraulic phenomena identified for the current generation of light water reactors (LWR). The list of relevant phenomena established in reference 21 has been taken as basis for the CRP work and has been modified according to the reactor types and passive safety systems considered in this report. It is to be noted that in identifying the relevant thermal hydraulic phenomena in the list which is provided in this report, expert judgement is the main contributor.

IAEA-TECDOC-626 provides definitions for safety related terms as applied to advanced reactors [16]. In that document, the concepts of passive and active safety systems are defined and discussed. The definition of a passive safety system is as follows: Either a system which is composed entirely of passive components and structures or a system which uses active components in a very limited way to initiate subsequent passive operation. Four categories were established to distinguish the different degrees of passivity.

Category A

This category is characterized by:

• no signal inputs of ‘intelligence’

• no external power sources or forces

• no moving mechanical parts, and

• no moving working fluid.

Examples of safety features included in this category are physical barriers against the release of fission products, such as nuclear fuel cladding and pressure boundary systems; hardened building structures for the protection of a plant against seismic and or other external events; core cooling systems relying only on heat radiation and/or conduction from nuclear fuel to outer structural parts, with the reactor in hot shutdown; and static components of safety related passive systems (e. g. tubes, pressurizers, accumulators, surge tanks), as well as structural parts (e. g. supports, shields).

Category B

This category is characterized by:

• no signal inputs of ‘intelligence’

• no external power sources or forces

• no moving mechanical parts; but

• moving working fluids.

Examples of safety features included in this category are reactor shutdown/emergency cooling systems based on injection of borated water produced by the disturbance of a hydrostatic equilibrium between the pressure boundary and an external water pool; reactor emergency cooling systems based on air or water natural circulation in heat exchangers immersed in water pools (inside containment) to which the decay heat is directly transferred; containment cooling systems based on natural circulation of air flowing around the containment walls, with intake and exhaust through a stack or in tubes covering the inner walls of silos of underground reactors; and fluidic gates between process systems, such as ‘surge lines’ of pressurized water reactors (PWRs).

Category C

This category is characterized by:

• no signal inputs of ‘intelligence’

• no external power sources or forces; but

• moving mechanical parts, whether or not moving working fluids are also present.

Examples of safety features included in this category are emergency injection systems consisting of accumulators or storage tanks and discharge lines equipped with check valves; overpressure protection and/or emergency cooling devices of pressure boundary systems based on fluid release through relief valves; filtered venting systems of containments activated by rupture disks; and mechanical actuators, such as check valves and spring-loaded relief valves, as well as some trip mechanisms (e. g. temperature, pressure and level actuators).

Category D

This category is characterized by:

• signal inputs of ‘intelligence’ to initiate the passive process

• energy to initiate the process must be from stored sources such as batteries or elevated fluids

• active components are limited to controls, instrumentation and valves to initiate the passive system

• Manual initiation is excluded.

Examples of safety features included in this category are emergency core cooling and injection systems based on gravity that are initiated by battery-powered electric or electro-pneumatic valves; emergency reactor shutdown systems based on gravity or static pressure driven control rods.

The reader of the present document should consider that:

(a) The information provided shall not be taken as an advertisement for any reactor type.

(b) The description of selected design does not imply a preference relative to other water cooled reactor systems that are not described.

(c) There is no implicit recommendation that passive systems should be preferred to active systems.

(d) Nomenclature in the Annexes may not be consistent with that in the main text. Harmonization was not attempted for the text provided in the Annexes for different reactor designs.

After the heat transport system is crash cooled and the loops of the HTS are isolated automatically by the LOCA signal (see discussion for broken loop above), the CMTs replenish the inventory of the intact loop and limit the extent and duration of voiding that occurs.

When the HTS is full and free of void, natural circulation can be relied upon to remove heat from the fuel (see Section II-2.1). This is supported by provision of feedwater to the secondary side of the steam generators as a heat sink. Feedwater is supplied from either the main or emergency feedwater systems. Feedwater may also be supplied from the RWS, though this make-up must be initiated manually.

The characterization of the nuclear reactor designs based on the passive (sub-) systems constitutes the objective of the present section. This can be achieved by combining the reactor descriptions given in Annexes I to XX and the passive systems identified in Sections 2 and 3. Furthermore, the ‘passive’ thermal-hydraulic phenomena characterized in Section 4 can be cross-correlated with the reactor configurations.

All of these is achieved by Tables 3 and 4 that make reference to two reactor categories, respectively:

(a) PWR, BWR and SCWR (Super Critical Water Cooled Reactor) systems, Annexes I to XIII;

(b) Integral Reactor Systems, Annexes XIV to XX.

The main information in Tables 3 and 4 connects the reactor type with the passive safety systems, e. g. column 1 and 4. Thermal-hydraulic phenomena are cross-connected with specific passive safety systems in columns 4 and 5. Finally columns 2 and 3 provide elements, as an example, namely the thermal power and the ‘boiling’ or ‘pressurized’ feature, that characterize the reactor system.

‘Proven’ technology reactors, i. e. with final design already scrutinized in a formal safety review process, or under construction, or with an already built and operated prototype, are listed in Table 3, with a few exceptions constituted by the RMWR, the LSBWR and the SCWR that are at different levels of early design stages.

Integral type reactors are considered in Table 4. All of these are of PWR type, second column, and can be assumed to constitute a special class of Light Water Reactors (LWR). In integral PWR, the major components of the nuclear steam supply system (NSSS) such as the core, steam generators, main coolant pumps, and pressurizer are integrated into a reactor vessel without any pipe connections between those components. This makes integral PWR systems relatively compact.

As a difference from the reactors listed in Table 3, all the integral reactor systems in Table 4 are in a design stage and no-one of such design has undergone a comprehensive safety scrutiny process (i. e. the licensing). However, in some cases, e. g. CAREM and to a lower extent IRIS, the reactor systems are under design since couple of decades, thus testifying the technological difficulties encountered for the exploitation of the integral nuclear reactor configuration idea.

6. CONCLUSIONS

Passive systems are widely considered in ‘innovative’ or advanced nuclear reactor designs and are adopted for coping with critical safety functions. The spread and the variety of related configurations are outlined in the present document.

Twenty ‘innovative’ nuclear reactors are described, specially giving emphasis to the passive safety systems, in the annexes and distinguished in two groups; (see also Tables 3 and 4):

• Advanced water cooled nuclear power plants,

• Integral reactor systems.

The levels of development, or even the actual deployment of the concerned reactor designs (i. e. equipped with passive systems) for electricity production are very different, and the range of maturity of these extend from reactors already in operation to preliminary reactor designs which are not yet submitted for a formal safety review process.

A dozen different passive system types, having a few tens of reactor specific configurations, suitable to address safety functions in primary loop or in containment have been distinguished, as in Table 2. These include systems like the core make-up tanks, the containment spray cooling and the isolation condenser.

The thermal-hydraulic performance of the passive systems has been characterized by less than a dozen key phenomena at their time characterized through specific descriptions including a few tens of relevant thermal-hydraulic aspects, see Table 1 and the Appendix. Cross correlations between key thermal-hydraulic phenomena, reactor specific safety systems and ‘innovative’ nuclear plants have also been established (See Tables 2, 3, and 4).

There is the need to demonstrate the understanding of the key thermal-hydraulic phenomena that are selected for characterizing the performance of passive systems: this implies the identification of parameter ranges, the availability of proper experimental programs and the demonstration of suitable predictive capabilities for computational tools.

Comprehensive experimental and code development research activities have been conducted, also very intensely at an international level, in the past three to four decades in relation to the understanding of thermal-hydraulic phenomena and for establishing related code predictive capabilities for existing nuclear power reactors. In the same context, research activities also addressed some of the phenomena for passive systems. However, a systematic effort for evaluating the level of understanding of thermal-hydraulic phenomena for passive systems and connected code capabilities appears to be limited and in general lacking.

Appendix

Boric acid is introduced into the reactor coolant to control long term reactivity. Forced coolant circulation during normal operation ensures that the boric acid is homogeneously distributed in the reactor coolant system (RCS) so that the boron concentration is practically uniform. Decrease of the boron concentration results in an increase of the reactivity. Causes for decreasing of boron concentration are injection of coolant with less boron content from interfacing systems (external dilution) or separation of the borated reactor coolant into highly concentrated and diluted fractions (inherent dilution). Examples of external dilution are the injection of coolant of reduced boron concentration by the makeup system, and injection of low-boron pump sealing water into the primary system. Inherent dilution can occur after reflux condenser heat transfer or back flow from the secondary system in case of primary-to-secondary leakage accidents.

Operation in the reflux condenser mode over a lengthy period of time could occur in the event of small-break loss-of-coolant accidents (SB-LOCA) concurrent with limited operability of the emergency core cooling (ECC) systems. In such an event the condensate descending down the cold — leg steam generator (SG) tubing into the SG outlet plenum and from there into the pump seal could form slugs of low-boron water. On restoration of natural circulation after refilling of the reactor coolant system such slugs would be transported towards the reactor core. However, on their way to the core, they would be mixed in the cold-leg piping, the reactor pressure vessel (RPV) downcomer and the lower plenum and thus increase in boron concentration.

Restarting of a reactor coolant pump (RCP) after a SB-LOCA or a SG tube rupture (SGTR) is very unlikely to occur as such events can be clearly identified on the basis of measured data and starting of a RCP is an action which would provide several individual actions and therefore some time. Assuming that an inadvertent demineralized water injection into one loop were to occur before starting of the RCP in this loop in spite of the monitoring and measurement of the boron concentration of the water injected into the RCS, a slug of demineralized water moves towards the core inlet after pump start.

Mixing of the diluted slug with the ambient coolant of higher boron content provides the only mitigation mechanism before the slug enters the core.

The main mixing mechanism in case of the low-boron water slug accelerated by the RCP start is turbulent mixing between the fluid flows having different velocities whereas in case of re-establishing the natural circulation after a reflux condensation phase the main mixing mechanism is buoyancy driven turbulent mixing. The density differences between the fluids are due to the temperature and the boron concentration differences.

This section describes the types of advanced reactor passive safety systems for removing the decay heat from the core after a reactor scram. The types of passive safety systems considered for this function are:

• Pre-pressurized core flooding tanks (accumulators)

• Elevated tank natural circulation loops (core make-up tanks)

• Gravity drain tanks

• Passively cooled steam generator natural circulation

• Passive residual heat removal heat exchangers

• Passively cooled core isolation condensers

• Sump natural circulation

A brief description of each is provided in the following sections. Combinations of these systems are incorporated into the designs described in Annexes I to XX.

Following a LOCA, large flow paths are established interconnecting the fuelling machine vaults and SG enclosures with the rest of the reactor building. These flow paths allow natural circulation flows to prevent formation of regions of locally high temperature and/or hydrogen concentration to protect the integrity of containment.

For LOCA events with the LTC system available, the LTC system alone is capable of removing decay heat and maintaining indefinitely the integrity of the reactor building.

If the LTC system fails, steam will be discharged to the reactor building both from the break and eventually, from the moderator system as well (see the discussion for the broken HTS loop above). In this case, either the LACs or the containment cooling spray will suppress the pressure and temperature inside containment. If the LACs are unavailable to provide forced circulation, the natural circulation airflows will prevent regions of locally high temperature and/or hydrogen concentration inside containment.

Phenomena have been classified into two categories (a) phenomena occurring during interaction between primary system and containment; and (b) phenomena originated by the presence of new components and systems or special reactor configurations. This classification considers the information provided in the CSNI Report [25] which has been developed for the primary systems having in mind the safety assessment, and is intended to provide complementary aspects that are relevant to advanced water-cooled nuclear power plant designs, including containment designs. Therefore the descriptions given below are intended to supplement those in the CSNI Report.

Behaviour in large pools of liquid

Large pools of water (e. g. up to several thousand cubic meters) at near atmospheric pressure are incorporated into several advanced designs. These large pools provide a heat sink for heat removal from the reactor or the containment by natural circulation, as well as a source of water for core cooling. Examples include the pressure suppression pool (wet-well) of the ESBWR, the in­containment refuelling water storage tank of the AP-1000, the pool of the emergency condenser of the SWR-1000 and the gravity driven water pool of the AHWR.

Large pools may have a very wide spectrum of geometric configurations. Heat transfer in a limited zone in terms of volume (e. g. by condensing injected steam or by heat transfer from an isolation condenser) does not imply homogeneous or nearly homogeneous temperature in the pool. Three­dimensional convection flows develop affecting the heat transfer process, which results in a temperature stratification.

Steam generated by heat transfer or following injection may be released from the pool into the containment and influences the increase of the containment pressure. Compared to a homogeneous temperature distribution, the fluid at the top of the pool may reach the saturation temperature while the bulk fluid is sub-cooled. The evaporation from the top of the pool results in a pressure increase in the containment. Therefore the temperature stratification influences plant design. The three-dimensional nature of the temperature stratification requires appropriate modelling.

Several advanced reactor designs implement core make-up tanks (CMTs) to provide natural circulation cooling to the core. CMTs are elevated tanks connected to the reactor vessel and primary loop at the top and bottom of the tank. Special lines connect the bottom of the tank with the vessel, and are termed direct vessel injection (DVI). In connection to this, an important interaction occurs between the CMT, the accumulator and the IRWST also considering the actuation signal for automatic depressurization. The tanks are filled with cold borated water and can provide coolant injection at system pressure. The tanks are normally isolated from the reactor vessel by an isolation valve located at the bottom of the vessel. The fluid is always sensing full system pressure through the top connection line. In the event of an emergency, the bottom isolation valve is opened to complete the natural circulation loop and permitting cold borated water to flow to the core. The relative elevation between the core and the CMT and the density difference between the hot primary system water and the cold CMT water creates a buoyancy-driven natural circulation flow that eliminates the need for a pump. Decay heat is removed from the core by convective heat transfer from the fuel to the single-phase liquid in the reactor vessel. CMT behaviour includes natural circulation, liquid thermal stratification in the tank, and liquid flashing during plant depressurization.

Pre-pressurized core flooding tanks, or accumulators, are used in existing nuclear power plants and they constitute part of the emergency core cooling systems. They typically consist of large tanks having about 75% of the volume filled with cold borated water and the remaining volume filled with pressurized nitrogen or an inert gas. As shown in Figure 1, the contents of the tank are isolated from the reactor coolant system (RCS) by a series of check valves that are normally held shut by the pressure difference between the RCS and the fill gas in the tank. In the event of a loss of coolant accident (LOCA), the core pressure will drop below the fill gas pressure. This results in opening the check valves and discharging the borated water into the reactor vessel. This is a Category C passive safety system for conditions mentioned above.

Natural circulation loops represent an effective means of providing core cooling. Several advanced reactor designs implement elevated tanks connected to the reactor vessel or primary loop at the top and bottom of the tank as shown in Figure 2. The tanks are filled with borated water to provide coolant injection at system pressure. The tanks are normally isolated from the reactor vessel by an isolation valve located along the discharge line departing from the bottom of the tank itself. The fluid is always sensing full system pressure through the top connection line. In the event of an emergency, the bottom isolation valve is opened to complete the natural circulation loop and to permit cold borated water to flow to the core. In order to reduce the number of pipelines connected with the reactor pressure vessel, the delivery (or bottom) line of the core make-up tank (CMT) is in common with the emergency core coolant delivery line. In case of a number of accident scenarios, the CMT delivery can start before the accumulator delivery and end-up after the accumulator emptying. In those situations the CMT delivered flow-rate can be affected by the accumulator delivered flow-rate to a noticeable extent. Furthermore, specifically when the CMT delivery line is connected with the cold or hot leg (i. e. without the presence of the direct vessel injection), the direction of the fluid motion in the discharge line should be checked: in other terms there is the possibility that CMT liquid is used to cool the steam generator, or in any case, is diverted from its principal mission that is core cooling. This is a Category D passive safety system.