Inherent safety features of the MARS design are the following:

• The same set of inherent safety features that are typical of conventional PWRs (negative reactivity coefficients in all power and coolant temperature ranges; all nuclear components of the reactor core are safety grade; etc.) [V-1, V-2];

• The primary coolant system and all components of the emergency core cooling system (SCCS) are located inside a pressurized primary containment which is filled with water at the same pressure as the primary coolant, but at a lower temperature (70°C). This pressurised containment, called CPP (pressurized containment for primary loop protection, see Fig. V-2), allows for a substantial reduction (up to total elimination) of primary stresses on the primary coolant boundary and provides for an intrinsic protection from coolant loss; the CPP does not need to be safety grade;

• Complete hydraulic isolation of the primary coolant within the primary coolant pressure boundary during most of the operation time (coolant outflow and inflow for purification purposes operate only periodically, over short periods); hydraulic connections to the primary coolant boundary are safety grade;

• Low maximum fuel temperature, which is due to coolant temperature being lower than 250°C, relatively low core power density, and elimination of fast fuel enthalpy increase accidents (due to the elimination of control rod ejection accidents). Altogether, this provides for substantially increased margin to fuel melting and, additionally, limits the potential release of radioactive isotopes into the coolant during any plant condition;

• Low fuel temperature gradients, due to relatively low core power density; slow thermal transients in fuel (no accident resulting in rapid fuel enthalpy increase is possible because the core is always adequately cooled); which limits possible fuel failure;

• Relatively low coolant temperature, below threshold values for a steam generator tube rupture; the steam generator tubes are safety grade;

• Very high values of minimum departure from the nucleate boiling ratio (DNBR), both in normal operation and as anticipated in the most severe design basis accidents;

• A substantial reduction in the number of physical connections between the primary coolant loop and auxiliary circuits (in total two small diameter lines, generally intercepted, for the chemical and volumetric control system (CVCS), and two small diameter lines, normally intercepted, connected to the safety/relief valve discharge tank, enclosed within the containment for primary loop protection (CPP)); the interconnection lines are safety grade up to the fourth interception valve on each line;

• The containment building, designed to withstand external events such as aircraft impact, provides additional protection against a potential release of radioactive products to the environment during postulated accidents (it may resist up to several bars of internal pressurization; even in the incredible event of a severe accident, the maximum internal overpressure is of the order of fractions of a bar); the containment building is safety grade;

• By design, human factors cannot affect the safety systems;

• All of the few MARS safety systems can be easily and rapidly tested for full operation at any time during plant operation.

The passive safety systems incorporated in the MARS design are the following:

• A passive emergency core cooling system (SCCS), based only on natural convection of cooling fluids and using external air as the ultimate heat sink, Fig. V-3. The SCCS is designed to transfer core decay heat directly from the reactor pressure vessel to the external air, without the intervention of any energized system or component. The system operating principle relies on fluid density differences, due to temperature differences between vertical fluid columns, for fluid circulation. The SCCS includes two trains; each train can remove 100% of the core decay heat power. In an accident causing a reduction of core coolant flow (such as a station blackout or primary pump trip), system activation is automatic, requiring no intervention either by the operator or by the control and monitoring system, because the primary coolant system interception valves are kept in a closed position by the force of primary coolant flow and start opening when this flow decreases below a set point value. The SCCS includes only one non­static mechanical component — check valves of an innovative design [V-1] — which is 400% redundant; the SCCS is safety grade;

• An additional (optional) passive scram system actuated by a bimetallic core temperature sensor and operated by gravity (ATSS — additional, temperature-actuated scram system). This system provides for the insertion of additional control rods to the core when the core coolant temperature reaches a preset value. The operation of this system (Fig. V-4) is based on the differential thermal expansion of the bimetallic sensor located inside the fuel assembly; the differential displacement, due to coolant temperature increase, causes the release of a conventional type control rod cluster. This system is safety grade;

• Special connections of components in the primary coolant system, including bolted flanges for load transmission and welded gaskets for leakage prevention; they may be safety grade.

The main scram system in the MARS plant is an active type scram system based on control rods, similar to that used in conventional PWRs. The control rods in this system are divided into four different banks. This system is safety grade.