Pressurized water small and medium sized reactors are represented by three concepts using integral layout of the primary circuit with in-vessel location of steam generators and control rod drives; one compact modular loop-type design features reduced length piping, an integral reactor cooling system accommodating all main and auxiliary systems within a leaktight pressure boundary, and leak restriction devices, and one design, originating from the mid 1980s, has the primary pressure boundary enclosed in an enveloping shell with low enthalpy, slow moving water.

The concepts with integral primary circuit layout include the CAREM-25 with 27 MW(e), a prototype for a series of larger capacity SMRs being developed by the CNEA (Argentina), the IRIS with 335 MW(e), being developed by the international consortium led by Westinghouse (USA), and the SCOR concept with 630MW(e), being developed by CEA (France). The CAREM-25 and the IRIS have reached detailed design stages with deployments targeted for 2011 and 2015 respectively, while the SCOR is just a conceptual design. Detailed design descriptions of the CAREM-25, IRIS, and SCOR are presented in [2], and corresponding structured descriptions of their passive safety design features are given in Annexes II, III, and IV. Figure 3 provides an illustration of the primary coolant system layout for the indicated designs.

Compact modular loop-type concepts are represented by the KLT-40S, a 35 MW(e)/150 MW(th) reactor for a twin-unit floating heat and power plant, the construction of which started in the Russian Federation in April 2007. The power circuits of the two units are separate, with each producing more heat power than required to generate the rated electrical output; the remaining heat power is to be used for district heating (as provided for in ‘Lomonosov’, a first of a kind floating nuclear power plant under construction in Russia) or for seawater desalination (it is foreseen future units will be deployed outside of the Russian Federation). A detailed description of the KLT-40S design, developed by OKBM and several other Russian organizations, is provided in [4]; a structured design description of passive safety design features is given in Annex I. IAEA publications [2, 3] provide descriptions of several other floating reactors as well as land-based NPPs, employing a design concept similar to that of the KLT-40S. Layout of the KLT-40S reactor is shown in Fig. 4.

The MARS reactor with 150 MW(e) per module, in which the primary pressure boundary is enclosed in a pressurized low enthalpy containment, was developed by a consortia of academic, research and industrial organizations in Italy. The detailed design stage was reached, and several testing programmes were completed. A design description of the MARS is presented in [2]; passive safety design features of the MARS are described in Annex V. Layout of the MARS primary coolant system is shown in Fig. 5.

Design features of pressurized water SMRs contributing to enhancement of Level 1 of defence in depth are summarized in Table 1; subsequent levels are summarized in Tables 2, 3, 4 and 5, respectively.

At Level 1 of defence in depth, “Prevention of abnormal operation and failure”, the dominant tendency is to exclude loss of coolant accidents (LOCA) or limit their scope and hazard by applying certain features in reactor design, such as:

— In-vessel location of steam generators in PWRs with integral design of the primary circuit (CAREM-25, IRIS, SCOR), eliminating large diameter piping and, hence, large-break LOCA;

— In-vessel location of the control rod drive mechanism (CAREM-25, IRIS, SCOR), which reduces the number and diameter of necessary in-vessel penetrations;

— Compact modular design of the reactor unit, eliminating long pipelines in the reactor coolant system, leak restriction devices in the primary pipelines, and a so-called ‘leaktight’ reactor coolant system with packless canned pumps, welded joints, and leaktight bellows sealed valves (KLT-40S, based on submarine and icebreaker reactor experiences); internal, fully immersed pumps are also applied in the IRIS and the SCOR reactors with integral design of the primary circuit;

— Primary pressure boundary enclosed in a pressurized, low enthalpy containment (a shell) with only a single, small diameter pipeline between the primary coolant pressure boundary and the auxiliary systems (MARS).

UPPER HEAD
REACTOR COOLANT PUMP (1 OF 8)
Control rod drive
SG STEAM OUT
CONTROL RODS DRIVE MECHANISMS
RPV
Barrel ■+-
STEAM GENERATOR ——— (1 OF 8)
Steam generator
SG FEED­WATER IN
DOWNCOMER
Core
(a)	(b)
FIG. 3. Schematics of the primary coolant system for (a) IRIS; (b) CAREM-25; and (c) SCOR.

1- REACTOR

2- STEAM GENERATOR

3- MAIN CIRCULATION PUMP

4- CPS DRIVES

5- ECCS ACCUMULATOR

6- PRESSURIZER (1st vessel)

7- PRESSURIZER (2nd vessel)

8- STEAM LINES

9- LOCALIZING VALVES

10- HX Of PURIFICATION AND

COOLDOWN SYSTEM

# Design features	What is targeted	SMR designs

1 Elimination of liquid boron reactivity control system

2 Relatively low core power density

3 Integral design of primary circuit with in-vessel location of steam generators and (hydraulic) control rod drive mechanisms

4 Compact modular design of the reactor unit, eliminating long pipelines in the reactor coolant system

5 Primary pressure boundary enclosed in a pressurized, low enthalpy containment

6 Leaktight reactor coolant system (welded joints, packless canned pumps, and leaktight bellows, sealed valves, etc.)

7 Internal, fully immersed pumps

8 Leak restriction devices in the primary pipelines

9 A single, small diameter double connecting line between the primary coolant pressure boundary and auxiliary systems

10 Natural circulation based heat removal from the core in normal operation, eliminating main circulation pumps

11 Steam generator with lower pressure inside the tubes in normal operation mode

12 Steam generator designed for a full primary system pressure

Exclusion of inadvertent reactivity insertion as a result of boron dilution

Larger thermal-hydraulic margins

Exclusion of large-break loss of coolant accidents (LOCA), exclusion of inadvertent control rod ejection, larger coolant inventory and thermal inertia

Decreased probability of LOCA

Elimination of LOCA resulting from failure of the primary coolant pressure boundary, elimination of control rod ejection accidents

Decreased probability of LOCA

Elimination of pump seizure, rotor lock, and seal LOCA

Limitation of the break flow in case of a pipeline guillotine rupture

Prevention of LOCA caused by rupture of the connecting line

Elimination of loss of flow accidents (LOFA)

Reduced probability of a steam tube rupture; prevention or downgrading of a steam line break or a feed line break

Prevention or downgrading of a steam line break or a feed line break

As already mentioned, all PWRs with integral design of the primary circuit incorporate in-vessel control rod drives, which is not only a design feature intended to minimize reactor vessel penetration but which is meant primarily to exclude reactivity initiated accidents with inadvertent control rod excursion (otherwise potentially facilitated by high primary pressure). Integral design of the primary circuit with in-vessel steam generators and control rod drives[3] apparently necessitates using a relatively low core power density, which in turn contributes to providing larger thermal-hydraulic margins.

Elimination of liquid boron reactivity control, which facilitates prevention of inadvertent reactivity excursion as the result of boron dilution, can not be attributed to a certain class of reactor concepts; it is applied in the KLT-40S and the CAREM-25 but not in other concepts considered.

Finally, the use of natural convection for heat removal in normal operation, which eliminates loss of flow accidents owing to pump failure, is not a preferable feature of PWR type small and medium sized reactors; it is applied only in the small-powered CAREM-25 design (with 27 MW(e)).

Four of the considered reactors have applied design features to prevent steam generator tube rupture, see Table 1. The KLT-40S, the MARS and the IRIS use steam generators with lower pressure inside the tubes in normal operation mode. Also in the IRIS and the MARS, steam generators are designed for full primary system pressure.

All in all, PWRs with integral design of the primary circuit have a tangible and transparent approach to the elimination of several accident initiators caused by design. The question of whether this can only be applied to reactors within the small to medium power range is, however, open. For example, the French SCOR has up to 630 MW(e), credited to a steam generator of original design borrowing from the experience of marine propulsion reactors [2]. A recent paper on SCOR [16] points to the option to develop a PWR of integral design with as much as 1000 MW(e). In the latter case, however, the reactor vessel height would exceed 30 m (actually, two vertically adjusted half-vessels are used in SCOR). It should also be noted that the SCOR is at a conceptual design stage, while the IRIS and CAREM-25 have reached detailed design stages.

At Level 2 of defence in depth, “Control of abnormal operation and detection of failure”, active systems of instrumentation and control and negative reactivity coefficients over the whole burnup cycle are common to all designs. These are features typical of all state of the art reactor designs, independent of their unit power range.

A relatively large coolant inventory in the primary circuit and high heat capacity of the nuclear installation as a whole, resulting from integral (IRIS, CAREM-25, SCOR) or compact modular (KLT-40S) design of the nuclear installation, are factors contributing to large thermal inertia and a slow pace of transients, altogether allowing more time for failure detection or corrective actions. Larger coolant inventory and higher heat capacity of the primary circuit are related to relatively large reactor vessels and internals or lower core power density as compared to a typical large PWR.

TABLE 2. DESIGN FEATURES OF PRESSURIZED WATER SMR CONCEPTS CONTRIBUTING TO LEVEL 2 OF DEFENCE IN DEPTH

Timely detection of abnormal operation All designs and failures

2 Negative reactivity coefficients over the whole cycle [4]

Prevention of transient over-criticality due to abnormal operation and failures

Slow progression of transients due to abnormal operation and failures

Slow progression of transients due to KLT-40S abnormal operation and failures

5 Favourable conditions for Facilitate implementation of leak before KLT-40S

implementation of the leak before break break concept

concept, through design of the primary circuit

6 Little coolant flow in the low Facilitate implementation of leak before MARS

temperature pressurized water break concept

containment enclosing the primary pressure boundary

7 Redundant and diverse passive or active Reactor shutdown shutdown systems

#	Design feature	What is targeted	SMR designs
1	Negative reactivity coefficients over the whole cycle	Prevention of transient over-criticality and bringing the reactor to a sub­critical state in design basis accidents	All designs
2	Relatively low core power density	Larger thermal-hydraulic margins	MARS, IRIS, CAREM-25, SCOR
3	Relatively low primary coolant temperature	Larger thermal-hydraulic margins	MARS
4	A relatively large coolant inventory in the primary circuit (or primary circuit and the pressurized low enthalpy containment, enclosing the primary pressure boundary; or primary circuit and the reactor building), resulting in large thermal inertia	Slow progression of transients in design basis accidents	CAREM-25, SCOR, IRIS, MARS
5	High heat capacity of nuclear installation as a whole	Limitation of temperature increase in design basis accidents	KLT-40S
6	Restriction devices in pipelines of the primary circuit, with primary pipelines being connected to the hot part of the reactor	Limitation of scope and slower progression of LOCA	KLT-40S
7	Use of once-through steam generators	Limitation of heat rate removal in a steam line break accident	KLT-40S
8	Steam generator designed for full primary pressure	Limitation of the scope of a steam generator tube rupture accident	IRIS, MARS
9	A dedicated steam dump pool located in the containment building	Prevention of steam release to the atmosphere in case of a steam generator tube rupture	SCOR
10	Enclosure of the relief tank of a steam generator safety valve in a low temperature pressurized water containment enclosing the primary pressure boundary	Prevention of steam release to the atmosphere in the case of a steam generator tube rupture	MARS
11	‘Soft’ pressurizer system3	Damping pressure perturbations in design basis accidents	KLT-40S
12	Self-pressurization, large pressurizer volume, elimination of sprinklers, etc.	Damping pressure perturbations in design basis accidents	CAREM-25, IRIS, SCOR
13	Limitation of inadvertent control rod movement by an overrunning clutch and by the limiters	Limitation of the scope of reactivity insertion in an accident with control rod drive bar break	KLT-40S
14	Redundant and diverse reactor shutdown and heat removal systems	Increased reliability in carrying out safety functions	All designs
15	Insertion of control rods to the core, driven by gravity	Reactor shutdown	KLT-40S, CAREM-25
16	Insertion of control rods to the core, driven by force of springs	Reactor shutdown	KLT-40S
17	Non-safety-grade control rod system with internal control rod drives	Reactor shutdown	IRIS
18	One shutdown system based on gravity driven insertion of control rods to the core	Reactor shutdown	SCOR

#	Design feature	What is targeted	SMR designs
Safety-grade active mechanical control rod Reactor shutdown scram system Additional (optional) passive scram system Reactor shutdown actuated by a bimetallic core temperature sensor and operated by gravity Gravity driven high pressure borated water Reactor shutdown injection device (as a second shutdown system) Injection of borated water from the Reactor shutdown emergency boron tank at high pressure (as an auxiliary shutdown measure)
19 20	MARS MARS CAREM-25 IRIS SCOR
21
22
23 24 25 26
Active safety injection system based on Reactor shutdown devices with a small flow rate
27
28
29
30
31
32
33
A small automatic depressurization system Depressurization of the reactor vessel IRIS from the pressurizer steam space when in-vessel coolant inventory drops below a specified level Safety (relief) valves Protection of reactor vessel from IRIS, CAREM-25 overpressurization
34

#	Design feature	What is targeted	SMR designs
35	Long term gravity make-up system	Assures that the core remains covered indefinitely following a LOCA	IRIS
36	Emergency injection system (with borated water), actuated by rupture disks	Prevention of core uncovery in LOCA	CAREM-25

a A ‘soft’ pressurizer system is characterized by small changes in primary pressure under a primary coolant temperature increase. This quality, due to a large volume of gas in the pressurizing system, results in a period of pressure increase up to the limit value under the total loss of heat removal from the primary circuit.

Compact modular design of a reactor unit, eliminating long pipelines in the reactor coolant system, with leak restriction devices in the primary pipelines and a so-called ‘leaktight’ reactor coolant system with packless canned pumps, welded joints, and leaktight bellows sealed valves, implemented in the KLT-40S, are mentioned as factors contributing to effective realization of the leak before break concept. In the MARS design, implementation of leak before break is facilitated by maintaining a small coolant flow in the low temperature pressurized water shell (containment) enclosing the primary pressure boundary.

Finally, redundant and diverse passive or active shutdown systems are provided in all designs in case abnormal operation runs out of control or the source of failure is not detected in a timely and adequate fashion.

As discussed above, certain design features provided at Level 1 of defence in depth in PWR type SMRs contribute to prevention or de-rating of certain design basis accidents, such as large break or medium break LOCA, core uncovery in LOCA, steam generator tube rupture, reactivity accidents with inadvertent ejection of a control rod or loss of flow, thus narrowing the scope of events to be dealt with at Level 3 of defence in depth, “Control of accidents within design basis”. For the remaining events, a variety of design features are specified at Level 3. Altogether, these features fit into the following main groups: [5]

#	Design feature	What is targeted	SMR designs
1	Relatively low core power density	Limitation or postponement of core melting	IRIS, CAREM-25, SCOR, MARS
2	Relatively low temperature of reactor coolant	Limitation or postponement of core melting	MARS
3	Low heat-up rate of fuel elements predicted in a hypothetical event of core uncovery, owing to design features	Prevention of core melting due to core uncovery	CAREM-25
4	Low enthalpy pressurized water containment embedding the primary pressure boundary	Additional barrier to possible radioactivity release into the environment	MARS
5	Passive emergency core cooling, often with increased redundancy and grace period (up to infinite in time)	Provision of sufficient time for accident management, e. g., in the case of failure of active emergency core cooling systems	KLT-40S, IRIS, CAREM-25 SCOR, MARS
6	Passive system of reactor vessel bottom cooling	In-vessel retention of core melt	KLT-40S
7	Natural convection of water in flooded reactor cavity	In-vessel retention of core melt	SCOR
8	Passive flooding of the reactor cavity following a small LOCA	Prevention of core melting due to core uncovery; in-vessel retention	IRIS
9	Flooding of the reactor cavity, dedicated pool for steam condensation under a steam generator tube rupture	Reduction of radioactivity release to the environment due to increased retention of fission products	SCOR
10	Containment and protective enclosure (shell) or double containment	Prevention of radioactive release in severe accidents; protection against external event impacts (aircraft crash, missiles)	KLT-40S, IRIS, CAREM-25 MARS
11	Containment building	Prevention of radioactive release in severe accidents; protection against external event impacts (aircraft crash, missiles)	All designs
12	Very low leakage containment; elimination or reduction of containment vessel penetrations	Prevention of radioactivity release to the environment	IRIS
13	Reasonably oversized reactor building, in addition to a primary coolant pressure boundary and additional water filled pressurized containment	Prevention of radioactivity release to the environment in unforeseen LOCA and severe accidents (LOCAs are prevented by design through the CPP	MARS
14	Indirect core cooling via containment cooling	Prevention of core melting; in-vessel retention	IRIS
15	Passive containment cooling system	Reduction of containment pressure and limitation of radioactivity release	KLT-40S
16	Relatively small, inert, pressure suppression containment	Prevention of hydrogen combustion	SCOR
17	Inert containment	Prevention of hydrogen combustion	IRIS
18	Reduction of hydrogen concentration in the containment by catalytic recombiners and selectively located igniters	Prevention of hydrogen combustion	CAREM-25
19	Sufficient floor space for cooling of molten debris; extra layers of concrete to avoid containment basement exposure directly to such debris	Prevention of radioactivity release to the environment	CAREM-25

The approaches for using safety grade or non-safety-grade systems vary between different SMR concepts. In the IRIS (Annex II), all passive safety systems are safety grade; all safety grade systems are passive. For example, the refuelling water storage tank is safety grade. All active systems are non-safety-grade.

In the CAREM-25 (Annex III), all safety systems are passive and safety grade; auxiliary active systems are safety grade also.

In the SCOR (Annex IV), redundant residual heat removal systems on the primary coolant system with pool as a heat sink (RRPp) are safety grade; similar designation systems with air as a heat sink (RRPa) are safety grade, except for the chilled water pool and pumps. The startup shutdown system is non-safety-grade. The safety injection system is the only active safety system that is safety grade. In the case of a steam generator line rupture, there is no need for a safety grade auxiliary feedwater system, because normal operation systems are used in this case.

In the MARS (Annex V), all nuclear components of the reactor core are safety grade. CPP — the enveloping primary circuit boundary — is non-safety-grade. The hydraulic connections to the primary coolant boundary are safety grade. The steam generator tubes are safety grade. The containment building is safety grade. SCCS — the passive core cooling system — is safety grade. The optional passive scram system is safety grade, as well as the active scram system.

No information on the grade of safety systems was provided for the KLT-40S.

The design features of PWR type SMRs contributing to Level 4 of defence in depth, “Control of severe plant conditions, including prevention of accident progression and mitigation of consequences of severe accidents”, could be categorized as follows:

(1) Inherent or passive safety features, provided by design, contributing to the limitation or postponing of core melting, or the prevention of core melting due to core uncovery, or providing additional barriers to possible radioactivity release to the environment. These are highlighted in numbers 1-4 of Table 4;

(2) Passive emergency core cooling systems, often redundant and offering an increased grace period up to infinite autonomy. These are intended to provide sufficient time for accident management. Passive emergency core cooling systems and passive decay heat removal systems are highlighted in more detail in Table 3;

(3) Passive systems of reactor vessel cooling based on natural convection of water in a flooded reactor cavity, intended to secure in-vessel retention of the corium; see numbers 6-9 of Table 4. It should be noted that features of smaller reactors such as reduced core power density or relatively larger or taller reactor vessels, discussed above in conjunction with Level 1 of defence in depth, facilitate effective in-vessel retention of corium and allow exclusion of core catchers from the reactor design;

(4) Containment buildings, in most cases a containment and a protective shell or a double containment, typical of all PWR type SMRs, are highlighted in numbers 10-13 of Table 4. Similar to reactors of other types and capacities, these are intended to prevent radioactivity release to the environment in severe accidents, and are also designed to provide protection against the impacts of external events (discussed later in this section). The containments for PWR type SMRs are more compact than for large PWRs, providing a smaller target for external aircraft missiles. However, they can be made reasonably oversized to confine hydrogen and other gaseous products in case of a severe accident;

(5) Design features to prevent hydrogen combustion of limited hydrogen concentration inside the containment; see numbers 16-18 of Table 4;

(6) In the CAREM-25, sufficient floor space for cooling of molten debris and extra layers of concrete to avoid containment basement exposure directly to such debris provides a kind of substitute to the core catcher.

For Level 5 of defence in depth, “Mitigation of radiological consequences of significant release of radioactive materials”, the designers of several PWR type SMRs considered in the present report mention smaller source terms, possibly resulting from relatively smaller fuel inventory, less non-nuclear energy stored in the reactor, and lower integral decay heat rates compared to a typical large PWR; see Table 5. The designers also suggest that design features for Levels 1-4 of defence in depth could be sufficient to achieve the goal of defence in depth Level 5. However, such a suggestion needs to be proven and accepted by regulators, which had not occurred at the time this report was prepared. Certain activities of PWR type SMR designers targeted at proving the option of a reduced emergency planning zone were, however, in progress. One such activity, generic for

#	Design feature	What is targeted	SMR designs

1 Mainly administrative measures Mitigation of radiological consequences KLT-40S

resulting in significant release of radioactive materials

2 Relatively small fuel inventory, less non — Smaller source term Several designs

nuclear energy stored in the reactor, and

lower integral decay heat rate

3 Design features of Levels 1-4 could be Exclusion of a significant release of KLT-40S, IRIS, CAREM,-25

sufficient to achieve defence in depth Level 5a radioactive materials beyond the plant MARS, SCOR

boundary or essential reduction of the zone of off-site emergency planning

a Some features mentioned by contributors to Annexes II, III, IV as contributing to defence in depth level 5 generically belong to the defence in depth level 4.

many innovative SMRs, is being carried out under the IAEA coordinated research project Small Reactors without On-site Refuelling, using the IRIS reactor as an example.

Table 6 summarizes information on design basis and beyond design basis events provided by the designers of PWR type SMRs in Annexes I-V, and highlights events specific to a given SMR but not for generic PWR reactor lines. De facto, such events are mentioned only for the KLT-40S, for which two groups of specific events are specified, the first group of two related to the ‘soft’ pressurizer system operated by gas from a gas balloon, and the latter group of five specific to a floating (barge-mounted) NPP For an IRIS design version under consideration for future licensing without off-site emergency planning, consideration of such rare hypothetical events as rupture of the reactor vessel and failure of all safety systems is made. It should be noted that this will not be the case for first of a kind plant licensing. In several cases, a qualitative comparison of the progression of transients in a given SMR and in a typical PWR is provided; see Annexes I-V for details.

Table 7 summarizes the information on acceptance criteria for design basis and beyond design basis events, provided by the designers of PWR type SMRs in Annexes I-V. Deterministic acceptance criteria for design basis accidents (DBA) are in most cases similar to those used for typical PWRs. Probabilistic acceptance criteria for beyond design basis accidents (BDBA) are specified as numbers for core damage frequency and large (early) release frequency in all cases except for the CAREM-25, where the requirement is to meet nationally established risk informed criteria set by the annual probability-effective dose curve shown in Fig. 6. For one design, the MARS of Italy, notwithstanding the fact that the probabilistic safety assessment granted a much lower value, core damage frequency is still accepted at 10-7 1/year level, in view of a possible common cause failure resulting from ultra-catastrophic, natural events (meteorite impact).

Table 8 summarizes the information on design features for protection against external event impacts provided by the designers of PWR type SMRs in Annexes I-V, with a focus on protection against aircraft crash and seismic events. Regarding other natural and human induced external events, more detailed information on the IRIS and the CAREM-25 designs is provided in a dedicated IAEA report Advanced Nuclear Plant Design Options to Cope with External Events, IAEA-TECDOC-1487 [6]. The requirements for plant protection against external hazards, excluding seismic hazard, are in the IAEA safety standard [9].

Protection against aircraft crash is generally provided by the containment or a double containment (or the containment and a protective shell), with relatively small containment size rated as a factor that reduces the probability of an external missile impact on the plant. In the case of the IRIS, the reactor building is half­embedded underground; thus, the reactor additionally appears to be a low profile, minimum sized target from an aircraft.

Structures, systems, and components of the KLT-40S are designed taking into account possible impacts of natural and human induced external events typical of floating NPP installation sites and transportation routes; see details in Table 6. Crash landing of a helicopter is mentioned as an event considered in the design. For the

TABLE 6. SUMMARY OF DESIGN BASIS AND BEYOND DESIGN BASIS EVENTS, INCLUDING THOSE SPECIFIC FOR A PARTICULAR SMR

# SMR design Lists of initiating events

CAREM-25, protection against aircraft crash is assumed to be provided by appropriate site selection, while the MARS containment is designed to withstand the worst aircraft impact.

Seismic design corresponds to 0.4-0.5 g peak ground acceleration (PGA); for the KLT-40S, the equipment, machinery, and systems important to safety, and their mounting, are designed to withstand 3 g PGA. Where indicated, the approach to seismic design is in line with IAEA safety standards [8].

The designers of all SMR type PWRs foresee that, eventually, their designs could be licensed with reduced or even eliminated off-site emergency planning measures, or at least without evacuation measures beyond the plant boundary; see Table 9.

As a desired or possible feature, reduced off-site emergency planning is mentioned in the Technology Goals of the Generation IV International Forum [15] in the User Requirements of the IAEA’s International Project on Innovative Reactors and Nuclear Fuel Cycles (INPRO) [14], and in the recommendations of the International Nuclear Safety Advisory Group (INSAG-12) [11], with a caution that full elimination of off-site emergency planning may be difficult to achieve or with a recommendation that Level 5 of defence in depth still needs to be kept, notwithstanding its possibly decreased role [11].

Achieving the goal of reduced off-site emergency planning would require both development of a methodology to prove that such reduction is possible in the specific case of a plant design and siting, and adjustment of existing regulations. A risk-informed approach to reactor qualification and licensing could be of value here, once it gets established. Within the deterministic safety approach it might be very difficult to justify reduced emergency planning in view of a prescribed consideration of a postulated severe accident with

TABLE 7. SUMMARY OF ACCEPTANCE CRITERIA

# SMR design Deterministic acceptance criteria Probabilistic acceptance criteria (or targets)

Probabilistic acceptance criteria defined in compliance with Russian regulatory document OPB-87/97 (see Annex I):

Core damage frequency (CDF) 10-5 1/year; Probability of large radioactivity release 10-61/year The probabilistic risk assessment (PRA) has demonstrated CDF to be one order of magnitude less than the prescribed limit, taking into account uncertainties

3 CAREM-25 Deterministic acceptance criteria for DBA are Risk-informed criteria set by the annual probability — assumed to be the same as for conventional effective dose curve are applied to BDBA (Annex III) PWRs

The qualitative and quantitative objectives of No details have been provided radiological protection of the population and the environment developed for Generation III reactors, e. g., the EPR, are applied

radioactivity release to the environment, e. g., owing to a common cause failure, such a catastrophic natural disaster. Probabilistic safety assessment (PSA), as a supplement to the deterministic approach, might help justify very low core damage frequency (CDF) or large early release frequency (LERF), but it does not address the consequences and, therefore, does not provide for assessment of the source terms. Risk informed approach that introduces quantitative safety goals based on the probability-consequences curve, could help solve the dilemma by providing for a quantitative measure for the consequences of severe accidents and by applying a rational technical and non-prescriptive basis to define a severe accident.

It is worth mentioning that nuclear regulations in some countries, e. g., Argentina, already incorporate provisions for applying a risk-informed approach in the analysis of severe accidents, see Fig. 6 and Annex III.

The IAEA has recently published a report entitled Proposal for a Technology-Neutral Safety Approach for New Reactor Designs, IAEA-TECDOC-1570 [13]. Based on a critical review of the IAEA safety standard NS-R-1 Safety of the Nuclear Power Plants: Design Requirements [7], IAEA-TECDOC-1570 outlines a methodology/process to design a new framework for development of the safety approach based on quantitative safety goals (a probability-consequences curve correlating to each level of defence in depth), fundamental safety functions, and generalized defence in depth, which includes probabilistic considerations. Different from this, the current safety approach [7] is based on qualitative safety goals, fundamental safety functions, application of defence in depth, and application of probabilistic safety assessments complementing deterministic methods.

Future IAEA publications and, specifically, a report of the above mentioned coordinated research project, will provide more details on the progress of justification for limiting measures of Level 5 of defence in depth to plant sites.

In the meantime, the designers of PWR type SMRs accept that licensing of their plants in the near term could be accomplished in line with existing regulations prescribing standard measures for the mitigation of

TABLE 8. SUMMARY OF DESIGN FEATURES FOR PROTECTION AGAINST EXTERNAL EVENT IMPACTS

# SMR design Aircraft crash / Earthquakes

1 KLT-40S No details provided regarding aircraft crash; crash-landing

of a helicopter is considered in the design. The equipment, machinery, and systems important to safety and their mounting are designed to withstand 3 g peak ground acceleration (PGA). Seismic design: 7 on the MSK scale at 10-2 1/year frequency for design earthquakes; 8 on the MSK scale at 10-4 1/year frequency for maximum design earthquakes

2 IRIS The reactor, the containment, the passive safety systems,

the fuel storage, the control room, and the back-up control room located in the reinforced concrete auxiliary building are half-embedded underground. The reactor appears as a low-profile, minimum sized target from an aircraft; 0.5g PGA

3 CAREM-25 Aircraft crash is not considered in the CAREM-25 design —

protection is assumed to be provided by site selection and administrative measures; there are two shells (containment, confinement), and the nuclear module is compact and small, which reduces the probability of an external missile impact on the containment; 0.4 g PGA; ‘probable earthquake’ is similar to operating basis earthquake (US NRC) or L-S1 (IAEA classification); ‘severe earthquake’ is similar to safe shutdown earthquake (US NRC) or L-S2 (IAEA classification)

4 SCOR No information was provided

5 MARS Designed against aircraft crash/seismic loads under

reference site conditions

TABLE 9. SUMMARY OF MEASURES PLANNED IN RESPONSE TO SEVERE ACCIDENTS

# SMR design Measures [6]

Effective Dose (Sv)

FIG. 6. Acceptance criteria for beyond design basis accidents as provided for by regulations in Argentina (see Annex III).

radiological consequences of significant release of radioactive materials. These measures are mostly of an administrative character. In particular, the KLT-40S designers mention that administrative measures are foreseen for plant personnel and the population within a 1 km radius of the plant, but indicate that evacuation is not required at any distance from the floating NPP; for more details see Annex I.

Design approaches used to achieve defence in depth in pressurized water SMRs considered in this report are generally in line with recommendations of the IAEA Safety Standards Series No. NS-R-1, Safety of the Nuclear Power Plants: Design Requirements [7]. Specifically, designers often refer to [7] when discussing safety objectives, safety functions, defence in depth concepts, accident prevention, radiation protection and acceptance criteria, safety classifications, safety assessment and single failure criterion, common cause failure and redundancy, diversity and independence, conservatism in design, and human factors. It should be noted that, because of limited information obtained from Member States, this report is not intended to provide a review of safety design approaches applied by SMR designers against IAEA safety standards.

Designers anticipate that future revisions of safety standards with more focus on a risk informed approach to design qualification, such as suggested in IAEA-TECDOC-1570 [13], could facilitate the goal of achieving plant qualification and licensing with reduced off-site emergency planning requirements.