Tables I-8 to I-12 below provide the designer’s response to questionnaires developed at an IAEA technical meeting “Review of passive safety design options for SMRs” held in Vienna on 13-17 June 2005. These questionnaires were developed to summarize passive safety design options for different SMRs according to a common format, based on the provisions of IAEA Safety Standards [I-2] and other IAEA publications [I-3, I-6]. The information presented in Tables I-8 to I-13 provided a basis for conclusions and recommendations of the main part of this report.

TABLE I-8. QUESTIONNAIRE 1 — LIST OF SAFETY DESIGN FEATURES CONSIDERED FOR/ INCORPORATED INTO THE KLT-40S DESIGN

# Safety design features

1. Negative reactivity coefficients on specific volume of the coolant, on fuel and coolant temperature and on reactor power in the whole range of variation of reactor parameters

2. Absence of liquid boron reactivity control system

3. High thermal conductivity of the fuel composition (uranium dioxide granules in the inert matrix)

4. Use of a gas pressurizer system

5. Insertion of scram control rods into the core by force of accelerating springs [32] [33]

What is targeted?

In reactivity initiated accidents: limitation of reactor power increase, ensuring reliable core cooling, prevention of pressure and temperature increase in the primary circuit

Exclusion of inadvertent reactivity insertion as a result of boron dilution

Prevention of the fuel element cladding temperature increase in loss of flow accidents; prevention of the primary pressure and temperature increase in accidents with disruption of heat removal

Exclusion of electric heaters — a potentially unreliable component

Increased reliability of a reactor shutdown Increased reliability of a reactor shutdown

# Safety design features What is targeted?

7. Use of a passive emergency heat removal system

8. Adequate level of natural circulation flow in the primary system

9. Limitation of uncontrolled movement of the control rods by an overrunning clutch and by movement limiters, for an accident with a break in the CPS drive support bar

10. Use of self-actuating devices in safety systems

11. Use of once-through steam generators

12. Use of a ‘soft’ pressurizer system

13. Provision of a mechanical strength margin on the primary pressure

14. High thermal capacity of primary system components

15. Modular design of the reactor unit

16. Leaktight reactor coolant system

17. Favourable conditions for the realization of a ‘leak before break’ concept in application to the structures of the primary circuit, provided by design

18. Use of restriction devices in the pipelines of the primary circuit systems

19. Connection of primary coolant systems to a ‘hot’ part of the reactor

20. Use of hydro-accumulators in the ECCS

21. Use of a steam generator with lower pressure inside the tubes in normal operation mode

22. Use of secondary system pipelines designed for primary pressure, up to the cut-off valves

23. Use of a passive reactor vessel cooling system

24. Use of a passive containment heat removal system [34]

Increased reliability of emergency heat removal Reliable core cooling

Decrease of a positive reactivity inserted under impact loads or under a break of the CPS drive casing, or under a break of the CPS drive support bar

Increased reliability of an emergency reactor shutdown; increased reliability of a startup of emergency heat removal systems

Limited increase of heat power removed by the secondary circuit in case of a steam line break accident

Damping of the transients; increased time margins for measures on accident management

Increased time margin for measures on management of accidents with heat removal disruption

Increased time margin for measures on management of accidents with heat removal disruption

Elimination of long pipelines in the reactor coolant system

Decreased probability of loss of coolant accidents

Reduced probability of a guillotine break for the primary pipelines

Limitation of the break flow in case of a pipeline guillotine rupture; less strict requirements to the ECCS

Ensuring fast transition to a steam flow through a break in case of a pipeline rupture; limitation of break flow; less strict requirements to the ECCS

Providing a time margin for personnel to take actions on accident management in case of a failure of the active means of emergency water supply (pump failure)

Reduced probability of a steam generator tube rupture Absence of coolant release in the case of a steam generator leak In-vessel retention of the corium

Reliable decrease of containment pressure and limitation of radioactive release in accidents

Limitation of radioactive release in accidents; additional protection from the impacts of external events

TABLE I-9. QUESTIONNAIRE 2 — LIST OF INTERNAL HAZARDS

Hazards (safety functions) that are of concern How these hazards (safety functions) are addressed (performed)

(relevant) for a reactor line in the KLT-40S

1. Prevent unacceptable reactivity transients — Negative values of reactivity coefficients; -Absence of liquid boron system; 2. Avoid loss of coolant -Low velocity of control rod movement; minimized number of simultaneously driven control rod groups; -Limitation of uncontrolled movement of the control rods by an overrunning clutch or by movement limiters, for an accident with a break of the CPS drive support bar. -Modular design of the reactor unit; elimination of long pipelines in the reactor coolant system; -Installation of restriction devices in the pipelines of the primary circuit systems; -Connection of primary coolant systems to a ‘hot’ part of the reactor; -Use of hydro-accumulators within the ECCS; -Use of coolant recirculation system. 3. Avoid loss of heat removal -Use of passive emergency heat removal system; — Redundancy of the active systems. 4. Avoid loss of flow -Adequate natural circulation flow in the primary system; — Redundancy of the circulation pumps; -Use of two coils in the MCP electric motor.

5. Avoid exothermic chemical reactions — It is ensured that thermal state of the fuel rods in emergency

conditions excludes the exothermic reaction of zirconium oxidation by steam.

TABLE I-10. QUESTIONNAIRE 3 — LIST OF INITIATING EVENTS FOR ABNORMAL OPERATION OCCURRENCES (AOO)/DESIGN BASIS ACCIDENTS (DBA)/BEYOND DESIGN BASIS ACCIDENTS (BDBA)

List of initiating events for # AOO/DBA/BDBA typical for a reactor line (PWRs)	Design features of the KLT-40S used to prevent progression of the initiating events to Initiating events specific AOO/DBA/BDBA, to control DBA, to this particular SMR to mitigate BDBA consequences, etc.
1. Disruptions of reactivity due to control rod malfunctioning	-Negative values of reactivity coefficients; -Low velocity of control rod movement; minimized number of simultaneously driven control rod groups; -Two independent systems of reactivity control — shim and scram control rods; -Use of self-actuating devices — drive circuit breakers, self-actuated on primary pressure; -Mechanical strength margin on the primary pressure.
2. Reactivity disruption due to boron dilution	— Boric acid is not used for excess reactivity compensation.
3. Loss of flow due to pump coastdown	— Adequate (sufficient) natural circulation flow in the primary system; -Use of two coils in the MCP electric motor.

TABLE I-10. QUESTIONNAIRE 3 — LIST OF INITIATING EVENTS FOR ABNORMAL OPERATION OCCURRENCES (AOO)/DESIGN BASIS ACCIDENTS (DBA)/BEYOND DESIGN BASIS ACCIDENTS (BDBA) (cont.)

4. Loss of primary system — Modular design of the reactor unit; elimination of integrity (LOCAs) long pipelines in the reactor coolant system;

-Connection of the primary coolant systems to a ‘hot’ part of the reactor;

-Installation of restriction devices in pipelines of the primary circuit systems.

See Table I-11 Specific initiating event for the

KLT-40S is a break of the connection pipeline between the pressurizer and the gas balloons; Specific beyond design basis accident for the KLT-40S is a break of the primary circuit pipeline with a failure to cut off the gas balloons.

5. Interfacing systems LOCA — Up to the cut-off valves, the interfacing systems are

designed for primary pressure.

6. Loss of power supply — Use of a passive emergency heat removal system

providing the removal of heat over 24 hours.

Structures, systems and components of the floating NPP are designed taking into account possible impacts of natural and human induced external events typical of a floating NPP location site and transportation routes, and meet the regulatory requirements. [35] [36] [37]

TABLE I-11. QUESTIONNAIRE 3 (PART 2) — DESIGN FEATURES OF THE KLT-40S THAT PREVENT PROGRESSION OF SPECIFIC INITIATING EVENTS TO A MORE SEVERE PHASE

Specific initiating event for the KLT-40S (see Table I-10)	Design features that prevent progression of the initiating events to a more severe phase
Disconnection of the gas balloons from the pressurizer during power operation	-Gas already present in the pressurizer ensures the absence of unacceptable pressure increase; -Availability of warning and protection emergency signals on primary pressure increase (active systems); -Availability of self-actuating devices providing a reactor shutdown and startup of the passive EHRS.
Rupture of a pipeline connecting the gas balloons to the pressurizer	-A flow limiter is installed in the pressurizer surge line; -Availability of the cut-off valves ensuring a disconnection of the gas balloons and leak termination in the case of a break after the cut-off valves.
Explosion of the gas balloons	-Fire-extinguishing systems available in the protective enclosure and in the containment; -Pressure sources that have pressure head higher than the design pressure of the balloons do not exist.
Collision with another ship	-On-board protection structures available, including reinforced sheets of outer clothing and deck planking sheets adjacent to the board, as well as longitudinal stiffening ribs of the board.
Sinking of the FPU	-System of containment flooding is available that prevents containment destruction by external hydrostatic pressure; this system is provided to protect the environment from possible radioactive contamination in the case of a FPU sink
Grounding of the FPU, including onto rocky ground	-The bottom ceiling is isolated from the containment structures by horizontal crimps in the bulkheads.
Helicopter crash-landing	-Protective structures consisting of steel planking and other structures of appropriate dimensions and strength are provided.

о

о

#	Safety design features	Category: A-D (for passive systems only), according to IAEA-TECDOC-626 [1-6]	Relevant DID level, according to NS-R-1 [1-2] and INSAG-10 [1-3]
1.	Negative reactivity coefficients on specific volume of the coolant, on fuel and coolant temperature and on reactor power in the whole range of variation of the reactor parameters	A	1
2.	Absence of a liquid boron reactivity control system (excess reactivity is compensated for by a heterogeneous absorber in the burnable poison rods and by the CPS control rods)	A	1
3.	High thermal conductivity of the fuel composition (uranium dioxide granules in the inert matrix)	A	3
4.	Insertion of scram control rods into the core by force of accelerating springs	D (by automatic system) C (by self-actuating devices)	3
5.	Insertion of shim control rods into the core by gravity force (under their own weight)	D (by automatic system) C (by self-actuating devices)	3
6.	Use of a passive emergency heat removal system	D (by automatic system) C (by self-actuating devices)	3
7.	Adequate level of natural circulation flow in the primary system	В	1
8.	Limitation of uncontrolled movement of the control rods by an overrunning clutch or by movement limiters, in case of an accident with a break in the CPS drive support bar	c	3
9.	Self-actuating devices in the safety systems	c	3
10.	Steam generators of a once-through design	A	1
11.	‘Soft’ pressurizer system	A	1,3
12.	Provision of a mechanical strength margin on the primary pressure	A	1,3
13.	Modular design of the reactor unit, eliminating long pipelines in the reactor coolant system	A	1
14.	Totally leaktight reactor coolant system	A	1
15.	Installation of restriction devices in the pipelines of the primary circuit systems	A	3
16.	Connection of the primary coolant systems to a ‘hot’ part of the reactor	В	3
17.	Hydro-accumulators in the ECCS	C	3
18.	Steam generator with lower pressure inside the tubes in a normal operation mode	A	1
19.	Passive reactor vessel cooling system	D	4
20.	Containment	A	3,4
21.	Passive containment heat removal system	D	4
22.	Availability of the protective enclosure	A	4

TABLE 1-13. QUESTIONNAIRE 5 — POSITIVE/NEGATIVE EFFECTS OF PASSIVE SAFETY DESIGN FEATURES IN AREAS OTHER THAN SAFETY Passive safety design features Positive effects on economics, physical protection, etc. Negative effects on economics, physical protection, etc. Absence of liquid boron reactivity control system Decrease in plant costs and operation simplification Certain deterioration of fuel cycle characteristics Use of passive systems Increase of plant construction and maintenance costs Use of self-actuating devices in safety systems Increase of plant construction and maintenance costs Modular design of the reactor unit Compactness of the reactor unit, decrease in Certain deterioration of maintainability as compared containment dimensions, decrease in plant costs to loop type plants Totally leaktight reactor coolant system Decrease of the amount of radioactive waste, reduction in operation costs

REFERENCES TO ANNEX I

[I-1] INTERNATIONAL ATOMIC ENERGY AGENCY, Status of Advanced Light Water Reactor Designs 2004, IAEA-TECDOC-1391, IAEA, Vienna (2004).

[I-2] INTERNATIONAL ATOMIC ENERGY AGENCY, Safety of Nuclear Power Plants: Design, IAEA Safety Standards Series No. NS-R-1, IAEA, Vienna (2000).

[I-3] INTERNATIONAL NUCLEAR SAFETY ADVISORY GROUP, Defence in Depth in Nuclear Safety, INSAG-10, Vienna (1996).

[I-4] Radiation Safety Regulations (NRB-99): Hygiene Regulations, Ministry of Health (Minzdrav) of the Russian Federation, Moscow, (1999) (in Russian).

[I-5] General Principles of Safety Provision for NPPs, OPB-88/97. NP-001-97 (PNAE G-01-011-97). Moscow, Gosatomnadzor RF (1997).

[I-6] INTERNATIONAL ATOMIC ENERGY AGENCY, Safety Related Terms for Advanced Nuclear Plants, IAEA-TECDOC-626, IAEA, Vienna (1991).

Annex II