Passive safety systems consist entirely of passive components, or use active elements in a very limited way to initiate subsequently all passive operations [108]. Manual intervention is excluded in all cases. Because they eliminate multiple pumps with their independent and redundant power supplies some proposed passive systems appear potentially more cost-effective and reliable than current active sys­tems [109]. Accordingly, the IAEA initiated in 2004 an internationally coordinated research project to investigate the performance and reliability of passive safety systems deploying natural circulation for the removal of decay heat after a successful reactor scram (a “hot shutdown”). To provide direction for this experimental and analytical program, the following four degrees of passivity were formulated [108]. The specification for the most stringent Category A passive system is as follows [113]

which are exemplified by

i. Hardened fuel cladding [300]

ii. Containments resistant to excess internal pressures, impacts or seismic activity

iii. Heat removal by thermal radiation or conduction to external structures.

Criteria 1, 2 and 3 are satisfied by Category B systems though moving working fluids are now allowed. Examples include reactor shutdown by the destabilization of hydrostatic equilibrium between its pressure vessel and an external pool of borated water, or containment building cooling by intrinsic natural convection to its internal walls. Category C systems conform to restrictions 1 and 2 but allow moving mechanical parts and fluids. An example in presently operational plants is the pre-pressurized accumulators of borated water which are connected into a reactor circuit by check valves. Under normal operation these are held closed by differential pressures, but in a LOCA the pressure differential reverses and the valves open automatically to shut down the reactor. Category D, the least degree of passivity, allows just battery or gravity — powered active components or intelligent signals to initiate their operation but in no way to control it. Examples include electro­magnetically latched scram rods, and those items listed below for decay heat removal or reactor shutdown:

i. Core make-up tanks of borated water which form part of a natural circulation loop with the reactor.

ii. Borated water injection by gravity at low reactor circuit pressures.

iii. PWR circuit cooling by natural circulation using its steam generators whose secondary circuits become large external cold water sources.

iv. A separate natural circulation heat exchanger whose secondary is a separate large external water tank.9

v. Passively cooled core-isolation condensers (BWRs only).

9 Decay heat removal in PFR was achieved by a NaK air-cooled, natural convective heat exchanger attached to each IHX circuit [314].

vi. A natural circulation loop using water collected in the contain­ment building’s sump and the hot reactor core. Any steam produced is vented into and then condensed on its walls, etc.

vii. The spray cooling system for a containment building which is described in Section 7.1.

These Category D passive safety systems and their incorporation into some Generation IV plant proposals are clearly described in Reference 108. However, they are not regarded as preferable to the active systems in presently operational plants. Also the IAEA concludes that the level of understanding and connected code capabilities of the thermal hydraulic phenomena in passive safety systems appear presently to be limited.