All fast reactor designs in the SMR family offer design flexibility in setting desired combinations of reactivity coefficients and effects. This flexibility, coupled with the inherent properties of advanced types of fuel, creates a potential to prevent transient overpower accidents, to ensure increased reactor self-control in a variety of other anticipated transients without scram and combinations thereof, and to enable ‘passive shutdown’ (see definition at the end of Appendix 2) and passive load following capabilities of a plant.[8] Smaller specific core power or relatively tall reactor vessels facilitate the use of natural convection of a single phase liquid metal coolant to remove decay heat or even the heat produced in normal operation (for heavy liquid metal cooled SMRs). For sodium cooled

reactors, smaller reactor size facilitates achievement of negative whole core sodium void reactivity effect. For lead cooled reactors, there could be a certain size limit to ensure reliable seismic design [2].

Figure 9 and 10 show general layouts of the 4S-LMR and the SSTAR, respectively.

t— CLOSURE HEAD

CO2 OUTLET NOZZLE (1 OF 8)

CO2 INLET NOZZLE (1 OF 4)

Pb-TO-CO2 HEAT

EXCHANGER (1 OF 4)

FLOW SHROUD

RADIAL REFLECTOR

ACTIVE CORE AND

FISSION GAS PLENUM

FLOW DISTRIBUTOR HEAD

Fast spectrum liquid metal cooled SMR designs are represented by the 4S-LMR concept of a sodium cooled small reactor without on-site refuelling developed by the Central Research Institute of Electric Power Industry (CRIEPI) and Toshiba in Japan (see Annex VIII) and by the SSTAR and STAR-LM concepts of small lead cooled reactors without on-site refuelling developed by the Argonne National Laboratory (ANL) in the USA (see Annex IX). Lead cooled SMR concepts use CO2 as the working media in the Brayton cycle power circuit, and incorporate no intermediate heat transport system. Although essentially different in several important features, both the sodium cooled and the lead cooled SMR concepts belong to a family of pool type integral design liquid metal cooled fast reactors, and close cooperation between their designers was established long ago [3]. Of the two designs, the 4S-LMR is in a more advanced stage, because for a similar design — different essentially in the type of fuel used and named the 4S — the conceptual design and major parts of the system design have been completed [3]. A pre-application review by the US NRC was initiated in the fall of 2007. Construction of a demonstration reactor and safety tests are planned for early 2010 [3]. Different from the 4S-LMR, both the SSTAR and STAR-LM are at a pre-conceptual stage. It should be noted that the small size and capacity of fast reactors considered in this section are, first of all, conditioned by the requirement for operation without on-site refuelling (see [3] for more detail) and not by the a priori considerations of achieving a somewhat higher degree of passive response in accidents.

Tables 28-32 summarize the design features of the 4S-LMR, the SSTAR and the STAR-LM contributing to defence in depth Levels 1-5.

Design features contributing to Level 1 of defence in depth, “Prevention of abnormal operation and failure”, are summarized in Table 28.

TABLE 28. DESIGN FEATURES OF SODIUM COOLED AND LEAD COOLED FAST SMRs CONTRIBUTING TO LEVEL 1 OF DEFENCE IN DEPTH # Design feature What is targeted SMR designs 1 Low pressure primary coolant system Little non-nuclear energy stored in the primary coolant system — elimination of a potential of release of this energy 4S-LMR, SSTAR, STAR-LM 2 Use of metallic fuel with high thermal conductivity (relatively low temperature) High margin to fuel failure 4S-LMR 3 Use of nitride fuel with high thermal conductivity (relatively low temperature) High margin to fuel failure SSTAR, STAR-LM 4 Relatively low linear heat rate of fuel Higher margin to fuel failure 4S-LMR 5 Power control via pump flow rate in the power circuit, with no control rods in the core Elimination of an accident with control rod ejection 4S-LMR 6 Large negative feedback from fast spectrum core plus natural convection of coolant in all modes, enabling passive load following and ‘passive shutdown’3 Essential prevention or de-rating of initiating events resulting from malfunctioning of systems or components, or operator actions that would otherwise need to be considered sources of failure SSTAR, STAR-LM 7 Low burnup reactivity swing over long core lifetime/refuelling interval Elimination of transient overpower accident due to control rod ejection SSTAR, STAR-LM 8 Elimination of feedback control of moveable reflectors (that compensate for reactivity changes due to fuel burnup); a pre-programmed reflector drive system is used Prevention of transient overpower 4S-LMR 9 Electromagnetic impulsive force used in the reflector driving system Intrinsic limitation of the speed of positive reactivity insertion 4S-LMR 10 Intermediate heat transport system Prevention of a sodium-water reaction 4S-LMR

11 Pb coolant not reacting chemically with CO2 working fluid; no intermediate heat transport system

12 Natural convection of coolant plus open fuel element lattice (large fuel element pitch to diameter ratio)

13 Primary electromagnetic (EM) pumps arranged in two units connected in series, with each unit capable of taking on one half of the pump head

14 Reactor vessel enclosed in a guard vessel to prevent loss of the primary coolant; pool type design with intermediate heat exchangers located inside the main reactor vessel

15 Use of double piping, double tubes and double vessels for secondary sodium, including heat transfer tubes from the steam generator

16 Reactor vessel enclosed in a guard vessel such that even in the case of primary vessel boundary rupture, the faulted level of lead will always exceed Pb entrances to the PB to CO2 heat exchangers;

High boiling point of the Pb coolant (1740°C), exceeding the point at which stainless steel core structures melt;

Pool type design configuration;

High density of Pb coolant limits void growth and downward penetration following a postulated in-vessel heat exchanger tube rupture

17 Highly reliable system of control of dissolved oxygen potential in the Pb coolant

Elimination of a chemical interaction between the primary coolant and the working fluid of a power circuit	SSTAR, STAR-LM
Elimination of loss of flow accidents; Prevention of flow blockage accidents	SSTAR, STAR-LM
Prevention of loss of flow	4S-LMR
Prevention of loss of coolant (LOCA)	4S-LMR
Prevention of LOCA Prevention of a sodium-water reaction	4S-LMR
Prevention of loss of coolant (LOCA) and its possible consequences	SSTAR, STAR-LM

Maintenance of the integrity of stainless steel SSTAR, cladding in all modes of operation by preventing STAR-LM corrosion;b

Prevention of the formation of corrosion debris with a potential to block the coolant area

a ‘Passive shutdown’ is used to denote bringing a reactor to a safe low power state with balanced heat production and passive heat removal, with no failure of the barriers preventing radioactivity release to the environment. The shutdown should take place using inherent and passive safety features only, with no operator intervention, no active safety systems involved, no requirement for external power and water supplies, and with a practically infinite grace period. b Corrosion/erosion is generally a slow and easily detectable process.

A low pressure primary coolant system, securing low non-nuclear energy stored in the primary coolant system is a common feature of all liquid metal cooled reactors, irrespective of their size and capacity. In addition to this, like many innovative liquid metal cooled reactors of a variety of capacities and sizes, all SMRs considered in this section rely on advanced fuel designs with high thermal conductivity, ensuring increased margins to fuel failure.

The lead cooled SSTAR and STAR-LM reactors incorporate optimum sets of reactivity feedbacks, provided by design and contributing to the elimination of transient overpower, as well as to the prevention or de-rating of the initiating events resulting from malfunctioning of systems or operator actions. Specifically, the designers of the SSTAR and STAR-LM mention the so-called ‘passive shutdown’ capability of their reactors as provided by design.

1 All-negative temperature reactivity coefficients

2 Large negative feedback in fast spectrum Increased self-control in case of

core; natural convection of coolant in all abnormal operation, including passive

modes; physical properties of Pb coolant load following and ‘passive shutdown’ and nitride fuel with high heat conductivity

Slow pace of transients due to abnormal 4S-LMR, SSTAR, STAR-LM operation

4 Sodium leak detection system in heat Enhanced detection of failure of the 4S-LMR

transfer tubes of the steam generator, secondary sodium boundary

capable of detecting both inner and outer tube failures

5 Two redundant power monitoring systems; Enhanced control of abnormal operation 4S-LMR balance of plant temperature monitoring and detection of failure system; electromagnetic pump performance monitoring system; cover gas radioactivity monitoring system, etc.

Control of the corrosion/erosion SSTAR, STAR-LM

processes of stainless steel claddings in Pb flow and detection of failures

7 Independent and redundant shutdown Reactor shutdown

systems (see Table 30 for details)

The sodium cooled 4S-LMR provides for power control via pump flow rate in the power circuit, with no control rods in the core, and for pre-programmable movement of axial reflectors with no feedback control, contributing to burnup reactivity compensation. Both of these features contribute to the prevention of transient overpower accidents.

To prevent a sodium-water reaction, the 4S-LMR incorporates an intermediate heat transport system, like most of sodium cooled fast reactors. As the CO2 is used as a working medium in the power circuits of the SSTAR and STAR-LM, which does not react chemically with Pb, these reactors do not incorporate an intermediate transport system.

Natural convection is used in the SSTAR and STAR-LM to remove heat under normal operation, eliminating loss of flow accidents. De-rating of loss of flow in the 4S-LMR is achieved by a scheme with two electromagnetic pumps connected in series.

Both sodium and lead cooled SMRs incorporate guard vessel to prevent LOCA; the 4S-LMR also incorporates double piping and double vessels for secondary sodium, including heat transfer tubes of the steam generator.

Finally, a reliable system of corrosion control is assumed to be provided for the SSTAR and STAR-LM to maintain the integrity of stainless steel claddings and to prevent the formation of corrosion debris with the potential of coolant area blockage. For these reactors it is important to maintain the oxygen potential in the correct regime to prevent the formation of PbO, which needs to be avoided. There could also be corrosion debris such as Fe that migrates into the coolant where it forms iron oxide, which should be filtered out.

For Level 2 of defence in depth, “Control of abnormal operation and prevention of failure”, contributions come from large thermal inertia of the primary coolant system and reactor internals, resulting in the slow progress of transients, and from optimum negative feedback, provided by design and ensuring a high-degree of reactor self-control. Specifically, passive load following and ‘passive shutdown’ capabilities are mentioned for the SSTAR and STAR-LM. Monitoring and detection systems are other important contributors. Finally,

1 Use of metallic fuel with high thermal conductivity (relatively low temperature)

2 Use of nitride fuel with high thermal conductivity (relatively low temperature)

3 Relatively low linear heat rate of fuel

4 All-negative temperature reactivity coefficients

5 Large negative feedback from fast spectrum core, natural convection of coolant in all modes, physical properties of Pb coolant and nitride fuel with high heat conductivity

6 Negative whole core void worth

7 — Very high boiling point of Pb coolant (1740°C);

— Escape path for gas/void to reach free surface provided by design;

— The reactor vessel is enclosed in a guard vessel such that even in the case of primary vessel boundary rupture, the faulted level of lead will always exceed Pb entrances to the PB to CO2 heat exchangers

8 Large specific (per unit of power) inventory of the primary coolant

9 Effective radial expansion of the core (negative feedback), provided by design

10 Low pressure loss in the core region, provided by design

11 A combined system of electromagnetic pumps and synchronous motors (SM), ensuring favourable flow coast-down characteristics

12 Natural convection of coolant in all modes of operation plus open fuel element lattice (large fuel element pitch to diameter ratio)

13 Two independent systems of reactor shutdown, each capable of shutting down the reactor by:

— A drop of several sectors of the reflector; or

— Gravity-driven insertion of the ultimate shutdown rod

14 Two independent and redundant active safety grade shutdown systems

High margin to fuel failure; larger grace period

High margin to fuel failure; larger grace period

Higher margin to fuel failure; larger grace period

Increased reactor self-control in design basis accidents

Increased self-control of the reactor in design basis accidents, including passive load following and ‘passive shutdown’ (in the case of a failure of both scram systems)

Prevention of design basis accidents propagation into beyond design basis conditions (due to coolant boiling or loss)

Prevention of core void as the extension of design basis accidents; securing of normal heat removal path through Pb/CO2 heat exchangers in DBA

Increased grace period

Increased reactor self-control in design basis accidents; prevention of DBA propagation into beyond design basis conditions

Increased level of natural circulation to remove decay heat from the core

Increased grace period in the case of pump failure

Increased reliability of heat removal through natural convection of coolant via Pb-CO2 heat exchangers and, in the case of their failure, by natural convection based decay heat removal systems RVACS and DRACS

Reactor shutdown

Reactor shutdowna

15

Redundant and diverse passive auxiliary cooling Increased reliability of decay heat removal systems (RVACS and IRACS or PRACS), both from the core using draught of environmental air as an ultimate heat sink

Protection of the reactor vessel and enclosure SSTAR, STAR-LM from over-pressurization when one or more in­vessel Pb to CO2 heat exchanger tubes fail [9] [10] [11] [12] [13] [14]

The 4S-LMR incorporates no active safety systems. However, there are several active systems providing normal operation of the reactor at rated or de-rated power, e. g., electromagnetic pumps providing forced convention of sodium coolant to remove core heat, or a burnup reactivity compensation system based on slow upward movement of the reflector, using an advanced pre-programmed drive mechanism. These systems can contribute to performing safety functions in certain accident scenarios. No information was provided on which systems of the 4S-LMR are safety grade.

All passive and active safety systems in the SSTAR and the STAR-LM are assumed to be safety grade.

The design features contributing to Level 4 of defence in depth, “Control of severe plant conditions, including prevention of accident progression and mitigation of consequences of severe accidents” fit in the following main groups; see Table 31:

(1) Inherent safety features contributing to prevention of core melting, numbers 1-5 of Table 31;

(2) Redundant and diverse passive decay heat removal systems with natural draught of air used as an ultimate heat sink, discussed in more detail in conjunction with Level 3 of defence in depth;

(3) Inherent and passive design features for the prevention of recriticality, numbers 8-9 of Table 31. These include an effective mechanism of fuel carry-over from the core in case of fuel element cladding failure (4S-LMR) and high density of the Pb coolant securing movement of molten fuel to the upper free level of lead (SSTAR and STAR-LM);

(4) Guard vessels in addition to the main vessels, for all designs, and double piping for the 4S-LMR; see numbers 11-13 of Table 31;

(5) Location of the containment and reactor in a concrete silo below ground level, for all designs considered.

For Level 5 of defence in depth, “Mitigation of radiological consequences of significant release of radioactive materials”, the designers of the 4S-LMR foresee no measures needed beyond the plant boundary in response to any severe accidents or combinations thereof, even when there is no operator intervention, no emergency team actions, and no external power and water supply. The designers of the SSTAR and STAR-LM take a more conservative approach, suggesting that standard measures may still be applicable, but within the exclusion zone reduced against that of present day reactors; see Table 32 and Table 35.

Issues of achieving plant licensing with reduced off-site emergency planning requirements are discussed in more detail in section 3.2.1., in conjunction with measures planned in response to severe accidents for pressurized water type SMRs. This discussion is also relevant to sodium cooled and lead cooled fast reactors considered in this section.

Tables 33 and 34 summarize the information on design basis and beyond design basis accidents and acceptance criteria.

TABLE 32. DESIGN FEATURES OF SODIUM COOLED AND LEAD COOLED FAST SMRs CONTRIBUTING TO LEVEL 5 OF DEFENCE IN DEPTH

# Design feature What is targeted SMR designs

1 Inherent and passive safety features ensure the plant will survive all postulated design basis and beyond design basis accidents, including anticipated transients without scram and combinations thereof, without operator intervention, emergency team actions, and external power and water supply [15]

Eliminate the need for any intervention 4S-LMR in the public domain beyond plant boundaries as a consequence of any accident condition within the plant

To reduce the exclusion zone compared SSTAR, STAR-LM

to that provided for currently operated

reactors

TABLE 33. SUMMARY OF DESIGN BASIS AND BEYOND DESIGN BASIS EVENTS, INCLUDING THOSE SPECIFIC FOR A PARTICULAR SMR

TABLE 34. SUMMARY OF ACCEPTANCE CRITERIA SMR design Deterministic acceptance criteria Probabilistic acceptance criteria (or targets) 4S-LMR Acceptance criteria for DBA are based on the experience with conventional light water reactors and previous design experience with sodium cooled fast reactors; specifically, the criteria that have been applied in the Clinch River Breeder reactor project are used (see Annex VIII); Acceptance criteria for ATWS and AWS are presented explicitly; see Annex VIII. The acceptance criteria for DBA are risk-informed, as indicated by Table VIII-4 in Annex VIII, and envelop both normal operation, anticipated events and unlikely and very unlikely events (frequency down to 10-6/year), which in the 4S are treated as design basis events; The acceptance criteria for ATWS and AWS are specified in a deterministic way, with no frequency being indicated. SSTAR, STAR-LM It is expected that development of the SSTAR (and even more so the STAR-LM) would take place on a timescale consistent with application of the new risk-informed and technology-neutral 10 CFR 53 regulations, which would provide a basis for the definition of acceptance criteria. No further details have been provided.

Table 33 also lists the features that are specific for the considered SMRs but not for a reactor line as a whole. For the sodium cooled 4S-LMR, these are failure in insertion of the ultimate shutdown rod and failure in the operation of the pre-programmed moveable reflector, in view of the fact that these design features are unique to the 4S-LMR. As both SSTAR and STAR-LM are being designed with a non-conventional CO2 based Brayton cycle power circuit, specific events are indicated as those related to disruption in the operation of this power circuit.

The 4S-LMR appears to be the only SMR concept in this report for which the acceptance criteria for design basis accidents are specified in a risk-informed way; see Annex VIII. Addressed within the design basis are events with a frequency as low as 10-6 x 1/year. In contrast, the acceptance criteria for severe accidents, which
in the case of the 4S-LMR include extremely rare failures of more than one redundant system, are specified in a deterministic way, with no frequency indicated.

For the SSTAR and STAR-LM, an expectation of new technology neutral and risk informed regulations to arrive in time for design completion is mentioned, but no details are provided regarding the acceptance criteria themselves.

Table 35 summarizes design features for protection against external event impacts, while Table 36 lists measures foreseen in response to severe accidents.

For both the 4S-LMR and the SSTAR and STAR-LM, strong reliance on inherent and passive safety features expected to render unnecessary operator intervention, emergency team actions and external power and water supplies, while ensuring a ‘passive shutdown’ capability of the reactor, are mentioned as factors important for protection against both internal and external event impacts and combinations thereof.

The design features of sodium cooled and lead cooled fast SMRs addressed in this report fit in within the fundamental requirements suggested in the IAEA safety standard Safety of Nuclear Power Plants: Design Requirements [7].

However, all considered fast spectrum SMR designs are being developed to offer several unique qualities, such as:

(1) A ‘passive shutdown’ capability, i. e., the capability to bring the reactor to a safe low power state with balanced heat production and passive heat removal, and with no failure to barriers preventing radioactivity release to the environment; all relying on inherent and passive safety features only, and with practically indefinite grace period;

TABLE 35. SUMMARY OF DESIGN FEATURES FOR PROTECTION AGAINST EXTERNAL EVENT IMPACTS SMR design Aircraft crash / Earthquakes Other external events 4S-LMR The reactor vessel is located in a shaft below the ground level, which, together with the containment and a relatively small footprint of the plant, contributes to increased protection against aircraft crash. The reactor building is isolated horizontally by seismic isolators; the ‘tiny’ shaped reactor results in a higher characteristic frequency; thus, the design is expected to be rigid against a vertical shock The capability of the plant to survive all postulated accidents relying only on inherent and passive safety features without the need for operator intervention, emergency team actions, and an external power and water supply, is rated as an important feature contributing to protection of the plant against external event impacts. No further details were provided SSTAR, STAR-LM The reactor vessel is located in a shaft below the ground level, which, together with the containment and a relatively small footprint of the plant, contributes to increased protection against aircraft crash. No information was provided regarding seismic design The capability of passive load following and ‘passive shutdown’ provided by inherent and passive safety features could be viewed as an important feature contributing to protection of the plant against external event impacts. No further details were provided TABLE 36. SUMMARY OF MEASURES PLANNED IN RESPONSE TO SEVERE ACCIDENTS SMR design Measures 4S-LMR Safety analyses have shown that 4S-LMR fuel never melts under any hypothetically postulated conditions, such as ATWS or AWS. Some fuel pins with maximum cladding temperature might fail in more severe AWS events; Analyses performed for hypothetical conditions when all fuel element claddings fail show the dose equivalent to be 0.01 Sv at a distance of 20 m from the reactor. No measures beyond this boundary are required SSTAR, STAR-LM It is envisioned that the exclusion zone for SSTAR and STAR-LM may at least be reduced in size as a result of inherent safety features and the expected low probability of radioactive material release relative to light water reactor designs with a similar power level. No further details were provided

(2) Very low pressure in the primary coolant system, challenging the notion of a primary pressure boundary used throughout the safety standard [7];

(3) Design basis events encompassing events with occurrence frequencies as low as 10-6 1/year and including combinations of unprotected transients [2, 3], each of which is rated severe for the current generation of light water reactors.

The designers of fast spectrum SMRs target licensing within the currently established national regulatory framework but mention that further elaboration of national regulatory norms toward technology-neutral and risk-informed approach could facilitate licensing considerations and further design improvements.

As an example, the recently published IAEA report Proposal for a Technology-Neutral Safety Approach for New Reactor Designs [13] suggests that “the means for shutting down the reactor shall consist of a minimum of two lines of protection (shutdown mechanisms — whether they be control rods or inherent feedback features of the core design) required to achieve the mission within the reliability requirements for safety”.