The Secure Transportable Autonomous Reactor-Liquid Metal (STAR-LM, [IX-1]) is a scaled up version of SSTAR at a power level of 181 MW(e) (400 MW(th)) for high efficiency electric power production with optional production of desalinated water using a portion of the reject heat. The STAR-LM reactor vessel size is assumed to be limited in height by a rail shipment limitation of 18.9 m. The power level of 400 MW(th) approaches the maximum value at which heat transport can be accomplished through single phase natural circulation given the reactor vessel height limitation. The scaled up version can alternately be used for hydrogen and oxygen generation using a Ca-Br thermo chemical (‘water cracking’) cycle, if cladding and structural materials for operation with the Pb up to about 800°C can be developed; this high temperature version is named STAR-H2, see the corresponding concept description in [IX-1]. Conditions and dimensions for STAR-LM are provided in Table IX-3. The reactivity feedback coefficients are given in Table IX-4.

VIII — 3. PASSIVE SAFETY DESIGN FEATURES OF SSTAR

The SSTAR safety design approach is based upon the defence in depth principle of providing multiple levels of protection against the release of radioactive materials by the following:

(i) Design to achieve a high level of reliability such that specific traditional accident initiators are eliminated or accident initiators are prevented from occurring;

(ii) Provision of protection in the event of equipment failure or operating error;

(iii) Provision of additional protection of public health and safety in an extremely unlikely event, which is not expected to occur during the lifetime of the plant or which was not foreseen at the time the plant was designed and constructed.

Inherent safety features

The inherent safety features of SSTAR take advantage of the key inherent properties of Pb coolant, transuranic nitride fuel, and a fast neutron spectrum core, together with specific design options including a pool reactor vessel containing all major primary coolant system components and natural circulation heat transport.

The Pb primary coolant has a high boiling temperature of about 1740°C, which is well above temperatures at which the stainless steel structures lose their strength and melt. Pb is, therefore, a low pressure coolant and does not flash should a leak develop in the primary coolant system boundary. All major primary system

Characteristics Value

Characteristic/reactivity coefficient	BOC	Part of the cycle ~13 years	EOC
Delayed neutron fraction	0.0035	0.0032	0.0031
Prompt neutron lifetime, s	5.34 x 10-07	5.04 x 10-07	4.98 x 10-07
Coolant density, cents/°C	0.18	0.21	0.22
Core radial expansion, cents/°C	-0.14	-0.15	-0.15
Axial expansion, cents/°C	-0.19	-0.20	-0.21
Fuel Doppler, cents/°C	-0.12	-0.11	-0.10
Coolant void worth, $	11.64	12.20	12.20

components including the core and Pb to CO2 heat exchangers are contained inside the reactor vessel, which is surrounded by a guard vessel. The coolant level inside the reactor vessel is such that, in the event of a reactor vessel leak, the faulted level of coolant contained by the guard vessel always exceeds the Pb entrances to the Pb to CO2 heat exchangers. The lack of coolant flashing or boiling due to the high Pb boiling temperature, combined with the pool system configuration and a guard vessel, preclude the loss of primary coolant. It also assures that heat removal from the core and heat transfer to the in-vessel heat exchangers or the vessel wall for heat removal by the RVACS continues by means of natural circulation of a single phase primary Pb coolant.

The lead coolant is calculated not to react chemically with the working fluid above about 250°C, which is well below the Pb melting temperature of 327° C. In particular, there is no formation of combustible gas or exothermic energy release. Lead does not react vigorously with either water or air. Compatibility of Pb and the working fluid makes it possible to eliminate the need for an intermediate cooling circuit, enhancing plant reliability.

Lead has low neutron absorption. This permits the core to be opened up by increasing the coolant volume fraction without a significant reactivity penalty. Increasing the coolant volume fraction increases the hydraulic diameter for coolant flow through the core, reducing the core frictional pressure drop. As a result, natural circulation is more effective and can transport a greater core power. It is possible to design LFRs in which natural circulation is effective at power levels exceeding 100% of the nominal, eliminating the need for main coolant pumps. Eliminating main coolant pumps eliminates loss of flow accident initiators. The open lattice core configuration with wide openings for coolant crossflow eliminates flow blockage accident initiators in which coolant flow entering at the bottom of the core is postulated to be locally blocked.

The high heavy liquid metal coolant density (pPb = 10 400 kg/m3) limits void growth and downward penetration following a postulated in-vessel heat exchanger tube rupture such that the void is not transported to the core, but instead rises benignly to the lead free surface through a deliberate escape channel between the in­vessel heat exchangers and the vessel wall.

The transuranic nitride fuel has a high thermal conductivity which, when combined with bonding of the fuel pellets to the cladding by means of liquid Pb between the pellets and cladding, reduces peak fuel temperatures during normal operation and accidents. This reduces the stored energy in the fuel and decreases the positive reactivity contribution resulting from cooldown of the fuel while fuel and coolant temperatures equilibrate during accidents as core power decreases.

Transuranic nitride fuel has a high decomposition temperature estimated to exceed 1350°C, such that the fuel maintains its integrity at temperatures above which stainless steel structural materials lose their strength or melt.

Nitride fuel is expected to be compatible with both the Pb bond and ferritic/martensitic steel cladding.

Nitride fuel has a high atom density, making it possible to reduce the volume which must be occupied by fuel and thus further enabling an increase of the coolant volume fraction without the loss of ability to achieve a core internal conversion ratio of unity and a low burnup reactivity swing, which in turn reduces the effects of rod withdrawal accident initiators.

Nitride fuel has a low fission gas release per unit volume. This reduces the thermal creep of cladding resulting from hoop stress loading due to internal pressurization of the fuel pin by a released fission gas.

The fast neutron spectrum core with Pb coolant and transuranic nitride fuel has strong reactivity feedbacks, which provide significant negative reactivity upon a heat-up or equilibration of system temperatures. The strong reactivity feedback reduces core power to match heat removal from the reactor system inherently, shutting down the reactor in the event two shutdown systems fail to scram it.

The strong reactivity feedback of the fast neutron spectrum core with Pb coolant and transuranic nitride fuel enables autonomous load following, whereby core power adjusts itself through inherent mechanisms to match heat removal from the reactor system without operation of control rods, thereby simplifying operation and eliminating potential operator errors.

The low burnup reactivity swing of the 30-year lifetime fast neutron spectrum core decreases excess reactivity requirements, reducing the amount of reactivity insertion accompanying unintended withdrawal of one or more of the control rods.

Passive safety systems

The SSTAR currently incorporates a single safety grade emergency heat removal system, which is the reactor vessel auxiliary cooling system (RVACS). The RVACS cools the exterior of the guard vessel by natural draught of air, which is always in effect. Because the RVACS represents only a single safety grade system, it would be required to have a high reliability with respect to seismic events or sabotage. For example, a seismic event could result in blockage of airflow channels. At particular sites, flooding or dust storms might be factors. It is planned to add safety grade passive direct reactor auxiliary cooling system (DRACS) heat exchangers, located inside of the reactor vessel, to provide for independent and redundant means of emergency heat removal.

Passive pressure relief from the primary coolant system is provided to enable CO2 to escape from the primary coolant system without over-pressurizing the primary coolant system boundary, in the event of a heat exchanger tube rupture.

Active safety systems

The SSTAR incorporates two independent and redundant safety grade active shutdown systems. The core layout in Fig. IX-2 shows primary and secondary control rod locations.

VIII — 4. ROLE OF PASSIVE SAFETY DESIGN FEATURES IN DEFENCE IN DEPTH

Some major highlights of passive safety design features in SSTAR, structured in accordance with various levels of defence in depth [IX-2, IX-3], are shown below.

Level 1: Prevention of abnormal operation and failure

The aim of the first level of defence in depth is to prevent deviations from normal operation and to prevent system failures. The inherent safety features of Pb coolant, nitride fuel, and a fast spectrum core, together with natural circulation heat transport and pool vessel configuration reduce the probability of failures through the elimination of reliance upon components, systems, or operator actions that would otherwise need to be considered possible sources of failure. Specific traditional postulated accidents such as loss of flow or local flow blockage are eliminated.

Cladding and structures are protected from significant corrosion by the Pb coolant through control of the dissolved oxygen potential in the coolant within a suitable regime that avoids the formation of lead oxide while allowing protective Fe3O4 solid oxide layers to be formed initially upon structures at lower temperatures. The systems for monitoring dissolved oxygen potential and maintaining oxygen levels in the desired regime shall be

Level 2: Control of abnormal operation and detection of failure

The aim of the second level of defence is to detect and intercept deviations from normal operational states in order to prevent anticipated operational occurrences from escalating to accident conditions. Due to the inherent safety features and passive safety design options of SSTAR, the expectation is that anticipated operational occurrences will not escalate into accidents. Therefore, it is expected that detection is not a necessity in order to avoid escalation into accident conditions.

Level 3: Control of accidents within the design basis

For the third level of defence, it is assumed that, although very unlikely, the escalation of certain anticipated operational occurrences or postulated initiating events (PIEs) may not be arrested by a preceding level and a more serious event may develop. Traditionally, escalation into a more serious event requires the occurrence of additional failures following the onset of the accident initiator. Although specific traditional postulated accidents such as loss of flow or local flow blockage are eliminated, other traditional postulated accidents such as reactivity insertion due to withdrawal of one or more control rods, loss of normal heat sink, heat exchanger tube rupture, loss of load, or station blackout remain. Due to the inherent safety features of SSTAR, core and heat exchangers remain covered by molten Pb coolant and natural circulation heat transport removes the core power, which leaves the reactor system either by normal heat removal paths or by the RVACS. System fuel and coolant temperatures remain within acceptable values well below temperatures at which the structures begin to lose their strength or at which a failure of the cladding could occur. There is no need for reliance upon active systems or operator actions to provide for cooling of the core or heat removal from the reactor system.

For liquid metal cooled fast reactors, an example of a failure in addition to the accident initiator is the assumption of a failure to scram the reactor through the primary and secondary shutdown systems. For SSTAR, it is not necessary for either of the two independent and redundant shutdown systems to operate as well as for operators to take action to insert control rods. The inherent feedbacks of the fast spectrum core with Pb coolant and nitride fuel cause the power level to decrease such that the core power matches the heat removal from the reactor system. The reactor core self-regulates the power level to match heat removal through either the normal heat removal path involving in-vessel Pb to CO2 heat exchangers or the emergency heat removal path through the RVACS.

If one or more in-vessel Pb to CO2 heat exchanger tubes were to fail, the passive pressure relief system would release CO2 from the reactor system, protecting the reactor vessel and upper closure head from over­pressurization.

If the reactor vessel were to fail in addition to the accident initiator, the guard vessel would retain the primary Pb coolant such that the core and in-vessel heat exchangers remain covered by a single phase Pb primary coolant.

If the normal heat removal path or a shutdown heat removal path were to fail, then the RVACS would remove the power generated in the core and transported to the reactor vessel through natural circulation of the Pb coolant. As discussed above, DRACS heat exchangers shall also be incorporated into the reactor vessel to enhance reliability of emergency heat removal beyond that provided by the RVACS. Therefore, it is not expected that a second failure would result in an escalation into a more serious event in terms of the release or transport of radioactivity from the fuel pins.

Level 4: Control of severe plant conditions, including prevention of accident progression and mitigation of consequences of severe accidents

The aim of the fourth level of defence is to address severe accidents in which the design basis could be exceeded and to ensure that radioactive releases are kept as low as practicable.

The SSTAR incorporates a guard vessel surrounding the reactor vessel and an upper closure head, which covers both the guard and the reactor vessels. A hermetic seal is established between the upper closure head and the guard vessel. Thus, the guard vessel and the upper closure head perform the function of a containment vessel surrounding the reactor vessel and retaining radioactivity as long as over-pressurization of the guard vessel and the upper closure head system does not occur. A containment structure is provided above the upper closure head. In the event of a rupture of one or more Pb to CO2 heat exchanger tubes, the CO2 would vent through the upper closure head into the volume of the containment structure.

Level 5: Mitigation of radiological consequences of significant release of radioactive materials

The fifth and final level of defence is aimed at mitigation of the radiological consequences of potential releases of radioactive materials that may result from accident conditions. It is envisioned that the exclusion zone surrounding a SSTAR reactor may at the least be reduced in size as a result of inherent safety features, as well as the expected low probability for radioactive material release relative to light water reactor designs with a similar power level.