In the design of ISIS emphasis has been put in the prevention of core damaging accidents.

The two main safety functions, reactor shutdown and decay heat removal, are performed without recourse to the usual sensor — logic-actuator chain, i. e. with no inputs of "intelligence", nor external power sources or moving mechanical parts, according to the definition of Category В Passive Components (ref./2/).

An active Reactor Protection System, aimed at anticipating passive system interventions, is included in the design, but is not credited in the safety analysis.

As anticipated in the Reactor System Description, mixing of the Primary Water with the Intermediate Water and the consequent natural heat transfer toward the Reactor Pool is the basic feature to assure safety under Design Basis Accidents such as Loss Of the Station Service Power and Loss of Heat Sink (ref. /3/).

During these DB Accidents the pressure boundary integrity assures the availability of water to cool the core and to transfer the decay heat to the Reactor Pool.

In case of LOCA Accidents, the Core shutdown and cooling functions are possible only if a sufficient inventory of water remains available.

The design features of ISIS guarantee the availability of this water because of the prompt self-depressurization of the system which is the consequence of the same hot-cold water mixing process.

To illustrate the effectiveness of this self­depressurization capability, the two following DB Accidents are presented :

— double ended break of the lower pipe

connection between RPV and Pressurizer;

— Steam Generator tube rupture.

Additionally, the extremely fast transient

following an hypothetical break at the bottom of the RPV is reported as an exercise to better understand the therm alhydraulic phenomena linked to the self-depressurization.

All transient analyses have been carried out using the RELAP5 computer code, with a nodalization made up of 256 control volumes 262 flow junctions and 78 heat structures; neutronic point kinetics has been used to evaluate the power in the core.

Loss Of Coolant Accident

This accident consists in a double ended break of the lower, 150 mm nominal diameter line connecting the RPV and the Pressurizer. This accident scenario has been chosen because this is

the largest line of the pressure boundary and also because the break location is far from both Density Locks, thus worsening the loss of cold water from the vessels (ref. /4/).

Considering that, the break location is 25 m below the Reactor Pool water level, the absolute pressure at the break outside the RPV is 3.5 bar. No action is credited of any active protection or control system.

When the accident starts, interconnected thermalhydraulic phenomena occur simultaneously within both RPV and Pressurizer. Cold water outflows from both RPV and Pressurizer; hot primary water replaces the losses in the Intermediate Plenum through both Density Locks. This phase lasts about 2-3 seconds. Then flashing hot water causes Primary Pumps cavitation which, in turn, allows the inlet of intermediate water into the primary system and the Core via the Lower Density Lock with a quick decrease of generated power.

The Reactor behaviour can now be explained considering that the Primary Pumps remain cavitating all over the transient and the primary system behaves like two channels hydraulically connected in parallel.

Both channels, the one made up by the Core and the Riser, and the second by the Downcomer and the SGU, are alternatively flooded by intermediate water entering the primary system through the Lower Density Lock. Self-depressurization of the system takes place mainly because of the following two water mixing effects (fig. 3):

In the RPV. hot primary water flowing from the Upper Density Lock mixes up with the large volume of cold intermediate water of the RPV Head, purposely provided for this function 1.

In the Pressurizer. hot water flowing down through the vertical pipes mixes up with the large volume of cold intermediate water underneath.

The system pressure at the break equals the external pressure in about 450 seconds.

1 Thermalhydraulic phenomena in the large plenum of the RPV Head would be better predicted by a 3D code which is, in any case, needed to optimize the design of the internal structures to enhance water mixing in this region.

At this moment the RPV water stops flowing out and reversal flow of cold, high-boron water from the Reactor Pool sets on.

The core is shutdown (fig. 4) by intermediate water entering through the Lower Density Lock.

Later on in the transient, reversal flow from the Reactor Pool starts recovering the water level in the RPV; at the end of the computer run (i. e. after 900 seconds) about 40 t of water have already entered the RPV from the Reactor Pool.

During the transient the Core never uncovers or heats up as shown in Figure 6. The maximum temperature of the "average" fuel rod has remained lower than at nominal conditions. A similar behaviour is shown for the clad surface temperature.

Steam Generator Tube Rupture

In this accident a break of 10 cm^ cross section located at the connection between SGU
tubes and steam headers is simulated; the break size is approximately equivalent to the cumulated cross sections of 8 SGU tubes.

No credit has been taken for action of active systems that can mitigate the consequence of the accident, but for the Primary Pumps Speed Control System which delays the inlet of highly borated water through the Lower Density Lock. The steam pressure and the feedwater flow rate are assumed accordingly to remain constant during the transient.2

When the accident occurs, water from the primary system enters the SGU ruptured tubes at a max mass flow rate of 96.5 Kg/s.

An equal amount of intermediate water enters the primary system through the Upper Density Lock as long as the Primary Pump Control System is capable to control the hot-cold interface level in the Lower Density Lock.

Primary water with increasing boron concentration enters the core and reduces the generated power (fig. 7).

transient.

Both effects of reduced core power with associated lower primary water temperature and Pressurizer self-depressurization reduce the overall primary system pressure (fig. 8) down to the secondary system pressure (tube-side SGU pressure) which has been assumed to remain at its nominal value.

At this time the primary water stops flowing into the SGU tubes. Figure 9 shows that the cumulated amount of water loss is less than 8 tonnes which corresponds to the inventory of the hot water in the pressurizer.

The curve of the fuel temperature shows a steadely decreasing pattern, fig. 10.

Break at the bottom of the Pressure Vessel

In this exercise an hypothetical break of 500 cm2 cross section has been assumed to occur at the bottom of reactor pressure vessel; this accident scenario is arbitrary and imagined to generate a very severe thermalhydraulic transient; in fact the break is positioned at the lowest location of pressure boundary and therefore has the potential of completely emptying the RPV. This exercise is intended to demonstrate that the self-depressurization process can avoid the uncovering of the core even in this case. No protection or control systems, no any other active system was credited during the accident analysis.

When the transient starts, there is a large blowdown of intermediate water from the RPV and Pressurizer into the Reactor Pool (the initial mass flow rate through the break is about 7000 kg/s). The escaping flow rate is fed by displaced primary water which is mostly contained in the SGU. Primary water leaves the SGU from the bottom via the Downcomer and, after few seconds, also from the top via the Primary Pumps and Upper Density Lock.

At the very begining of the transient the water flowing down through the Down earner splits in two streams: the one leaves the Inner Vessel through the Lower Density Lock and the second flows up through the Core, the Riser and leaves the Inner Vessel through the Upper Density Lock. The reactor core is continously fed

by primary water flowing upwards and its temperature is continuously decreasing because it is kept cooled since the beginning of the transient.

At the time of about 7 seconds, with Primary Pumps in cavitation, the primary water stops leaving the Inner Vessel through the Lower Density Lock and a reversal flow of intermediate water sets on flooding the core.

At this moment the usual way of natural circulation of ISIS reactor is recovered and the primary system fed with cold and borated water.

The mixing of cold and hot water initiates the self-depressurization of the system in the way described before for the case of LOCA (fig. 11).

The system continues its depressurization up to the time of about 200 seconds when its pressure drops below the Reactor Pool pressure at the break location.

The evolution of the generated power is shown in fig. 13; the power reduction during the first 7 seconds is caused by the void effect associated to the depressurization and the following shutdown is assured by the borated water.

800 600 400 200 0.0

At this moment, the total mass of displaced water (figure 12) is less than 200 tonnes (approximately 50% of the total inventory of one module) and the RPV has been emptied only down to about the center line of the SGU.

After about 1000 seconds, the initial water inventory is completely recovered and the reactor is in the state of stable cold shutdown.

Fig. 15 — Break at the bottom of the RPV
Clad surface temperature at different elevations