So far we have discussed protective systems aimed at detecting an accident in its early stages and preventing it from developing. Another type of protective system mitigates or controls the consequences of an accident. One such is the post-accident heat removal system.

The rate at which “decay heat” is generated by the decay of radio­active fission products in the fuel after a long period of steady operation is shown in Table 5.1 and Figure 5.2. The heat production is slightly less after shorter periods of operation because fewer of the long-lived fission products have accumulated. It will be seen that even a year after shutdown a 3000 MW (heat) reactor generates more than 1 MW.

Because it is essential to remove this heat and keep the fuel cool for a long period after even the most severe of accidents it is necessary to provide several independent and diverse cooling systems.

The first means of removing the decay heat is to use the normal route to the main condenser via the steam generators. However this requires most of the plant to be intact and operable, and in particular the primary and secondary sodium pumps and the boiler feed and condensate extract pumps have to have electrical supplies.

If the steam plant is not available it may be possible to reject heat directly from the secondary sodium circuits, for example by cooling the external surfaces of the steam generator vessels by circulating air. Almost certainly, however, natural convection cannot be relied on and electrical supplies are needed to power the cooling fans, as well as the sodium pumps.

To cater for the possibility that the secondary sodium circuits are not available it is usual to provide separate dedicated decay-heat rejec­tion circuits with heat exchangers in the reactor vessel. The coolant in these circuits rejects heat to the atmosphere in air-cooled heat exchangers. Because sodium freezes at 98 °C for a sodium-cooled reactor the auxiliary coolant can be a mixture of sodium and potassium which freezes below normal atmospheric temperature. Such decay — heat rejection circuits can be designed to operate entirely by natural convection on both the liquid metal and air sides. With such a heat — rejection system the fuel can be cooled safely even if the secondary circuits do not work and there is no electrical power, because natural convection within the reactor vessel can be relied upon to transfer the heat to the decay-heat rejection heat exchangers.

An additional defence against overheating can be provided by cooling the surface of the reactor vessel itself. This can be done for example by surrounding the leak jacket with a water-cooling circuit that rejects heat to the atmosphere and, as in the case of the liquid metal decay-heat rejection circuits, can be made to work by natural convection. A system of this type is sometimes known as an “RVACS” (reactor vessel auxiliary cooling system). Figure 5.3 shows a typical decay-heat rejection system in diagrammatic form.

All these ways of rejecting decay heat depend on the fuel and the structure of the core remaining intact after the accident and on the primary sodium being able to circulate through it. Provisions for cooling the fuel debris after a very severe accident that has destroyed the core structure are discussed in section 5.4.7.