It may be possible to make the consequences of a core-disruptive accident less severe by incorporating “passive” protective devices in the design. By “passive” is meant a mechanism that takes protective action without external actuation, either by the automatic trip system or by human intervention. There are two main classes: devices to reduce reactivity and devices to prevent recriticality.

Reduction of Reactivity. The reactor trip system works by inserting the control and shut-off rods into the core on receipt of a trip signal (see section 5.2.1). The reduction of reactivity can be made passive by designing the control-rod mechanisms so that the absorbers enter the core in direct response to overheating. This can be done for example by making the core of the electromagnets that attach the absorbers to their actuators of a material with a Curie point above but close to the normal core outlet temperature. In a Slow LOF or Slow TOP accident the outlet temperature rises, the magnets become ineffect­ive and the absorbers fall under gravity into the core. An alternative is to incorporate a component with a high thermal expansion coef­ficient, which responds to the overheating by pushing the absorbers away from the magnets or disengaging mechanical latches, so that they fall.

If the accident has distorted the core the absorbers might not be able to fall freely in their guide tubes. Articulated absorbers, with joints that enable them to negotiate bends, may have a higher probability of entering the core. It may also be possible to increase the chance of insertion by means of spring mechanisms that propels the absorbers downwards when they have been disconnected from the actuators.

Another approach to reducing reactivity automatically when the core is overheated is to increase the neutron leakage. As explained in section 1.6.4, in the case of liquid coolants, loss of coolant from the periphery of the core reduces reactivity because it increases the leakage. The effect can be enhanced in a number of ways. If the neut­ron reflector above the core or, in the case of a breeder reactor, the upper axial breeder is replaced by coolant (sometimes called a coolant “plenum”), when the outlet temperature rises the density of the coolant falls, leakage is increased and reactivity falls. For a sodium- cooled reactor the effect is much greater in a more severe accident in which the coolant boils and the plenum is filled with vapour.

Radial leakage can be increased by “gas expansion modules”, or GEMs as they are often known. These are subassemblies at the periphery of the core that normally contain coolant, but also have reservoirs of trapped gas arranged so that when the gas expands on overheating it expels the coolant. GEMs are attractively simple and reliable, but suffer from the disadvantage that, unless there are very many of them, the amount of reactivity reduction is small. They also have a deleterious effect on the performance of the reactor because they reduce the reactivity in normal operation so that for example the enrichment has to be higher than would otherwise be necessary.

Relocation of Material. The risk of recriticality arises when the fuel becomes free to move, and particularly if it melts. It may be possible to design the structure in such a way that molten fuel is led safely out of the core. One approach is to incorporate in some or all of the subassemblies central ducts that are normally empty except for coolant. The walls of these ducts are made of a material that has a lower melting point than the subassembly wrappers. During the transition phase the molten fuel melts the wall, enters the duct and flows out of the core, either under the influence of gravity or more likely propelled by boiling and vaporising coolant.

A variant of this is to use the control rod and shut-off rod guide tubes, which are already present as ducts through the core. The guide tubes themselves would be made of low-melting-point material and molten fuel could flow out through them. The control rod guide tubes would not be so effective at the beginning of the life of a new core, however, when they would be occupied by the fully inserted control absorbers, but the shut-off rod guide tubes would always be available when the reactor was critical.

The main drawback of any passive mechanism to control the move­ment of molten fuel is that it would be difficult to demonstrate that it worked correctly. Extensive testing would be required. And it should be noted that such testing of the behaviour of molten fuel as has been done indicates that its “natural” tendency is to disperse, without the provision of any special dispersal path or duct.