To cope with Design Basis Accidents (DBAs) means are provided to ensure the fulfilment of the basic safety functions, such as reactivity control (reactor trip) and fuel cooling. The systems based on natural phenomena are implemented in many new designs to fulfil these safety functions, and natural circulation systems play an important role. Different approaches used in new reactor concepts can be summarised as follows.

As to the reactivity control, traditional gravity-driven (in PWR and PHWR) or gas-pressure driven (in BWR) control rods is the main system to ensure reactor scram in currently operating reactors and in the advanced concepts. Although very good reliability records exist for scram excitation, some new reactor concepts have implemented additional passive means to enhance the reactivity control function. For the WWER-1000/V-392 design, a special rapid boronated water supply system has been designed as a diverse system to the gravity-driven control rod insertion system. The concentrated boron solution is supplied to the reactor due to the pressure difference between discharge and suction of the main coolant pump (pump head) where the boron solution tank is joined. The operability of the system has been confirmed by extensive experimental investigation using a scaled model. A similar rapid emergency boration system is also implemented in the Sizewell PWR for diverse reactor shutdown. It

3

consists of four tanks of boron solution (3 m of 7000 ppm concentration of boron in each tank), connected to each cold leg. The inertia of the main coolant pumps is sufficient for the system to fulfil its function. All CANDU plants built in the last 20 years and new ones have a rapid gadolinium nitrate injection system that can shut the reactor down as quickly as the shutoff rod system. This injection system uses high-pressure helium to inject a gadolinium solution into the low-pressure moderator. Instrumentation separate from the shutoff rod system and other safety systems but with equal capability to the shutoff rod system is used to open quick-acting, fail-open valves between the helium gas and the gadolinium solution. As applied to the passive reactivity control, one should note the problem of the deboration possibility in the naturally circulated primary coolant. In some cases, this problem may lead to the consideration of specific reactivity initiated accidents difficult for quantitative analysis.

The safety function “fuel cooling during transients and accidents” is ensured by provision of sufficient coolant inventory, by coolant injection, by sufficient heat transfer, by circulation of the coolant, and by provision of an ultimate heat sink. Depending on the type of transient or accident, a subset of these functions or all of them may be required. Various passive systems/components are proposed for future reactor concepts to fulfil these functions. It is a feature of many new concepts that the water for replenishment of primary coolant inventory is entirely stored inside the containment. This ensures protection against external events and reduces the risk of loss of coolant accidents with containment bypass. Additional features implemented in some new designs to improve the replenishment of primary coolant inventory function include:

(a) Pressurizer relief via the relief tank to the water storage tank;

(b) Removal of heat from the primary circuit to the water storage tank via heat exchangers located in the water storage tank;

(c) Water storage tank combined with the containment sump;

(d) Water storage tank located at higher elevation than the reactor core for gravity-driven injection;

(e) Storage of a portion of water at high elevation under the full primary pressure for coolant injection at high pressure.

Most of the new concepts incorporate a combination of different passive and active means to ensure the function “coolant injection”. Passive injection systems at high primary pressure are new in comparison to systems in operating reactors. AP-600 is an example of a design where this function is provided by core make-up tanks (CMT). Pneumatic isolation valves in the injection lines open automatically if one of the initiation setpoints (e. g. low primary pressure, low pressurizer level) is reached. These valves are fail-safe since they will open even if A. C. power fails. As long as the reactor coolant system (RCS) is still filled with liquid, cold water from the CMT flows to the RCS by natural recirculation. After the coolant starts to boil, steam enters the CMT, the natural recirculation is terminated and injection to the RCS continues due to gravity. To assure continued injection by medium and low-pressure injection systems before the CMTs are empty, stepwise depressurization of the RCS is initiated if the liquid level in the CMT falls below defined setpoints.

Passive accumulator injection at medium primary pressure is applied in current pressurized water reactors as well as in advanced concepts. Improvements of efficiency have been suggested for the future reactors on the basis of experience, such as optimised initial pressure, water/gas ratio, and flow resistance in the injection line. Also, the absence of isolation valves in the injection lines is being considered in some new designs to increase the system reliability. The tendency in some advanced designs in comparison with the existing plants is to widen the primary pressure range for passive injection and to make it more controllable. The Westinghouse AP-600, the Russian WWER V-392 and V-407, the Mitsubishi APWR and the Indian AHWR designs could be mentioned as examples of this tendency. In particular, the Mitsubishi APWR design makes use of an advanced accumulator system to ensure the safety functions of core cooling. It has the function of both the accumulator tank and the low — pressure injection pump of conventional plants. So the low-pressure injection pumps are eliminated and the safety injection system configuration is simplified.

Passive low-pressure injection is foreseen in some new concepts to replace or to back up the traditional pump injection being used for the operating plants. To ensure passive injection, the traditional water storage tank can be installed at higher level than the reactor core or special low-pressure injection tanks at high elevation can be provided. Since the water is at containment atmosphere, injection by gravity can only take place after complete de­pressurization of the reactor coolant system. This is accomplished e. g. by the last step of the de-pressurization sequence in the AP-600 design or by the special de-pressurisation system in the WWER-640/V-407 design; this system starts passively when the primary pressure decreases below 6 bar.

The function “provision of sufficient heat transfer” in the advanced concepts is ensured in the same fashion as in currently operated reactors. This function is assured as long as sufficient water is supplied to the fuel rods. Sufficient water in the core is provided by the systems ensuring injection of the coolant as described above. Heat transport in reactor designs using mainly passive means is ensured during accidents by natural circulation between the core as heat source and heat sink (e. g. steam generators as in the Russian WWER-1000/V-392 design or heat exchangers in the water storage tank as in AP-600 design); the natural circulation may exist in single phase, two phase and boiler-condenser modes. Some advanced designs make use of relatively new natural circulation paths, e. g. natural circulation after LOCA between sump and core via the sump screen and broken pipe in AP-600 or between the core, the flooded pool around the reactor and the spent fuel pool via the depressurization pipes and further connection pipes in WWER-640/V-407 design. The Indian AHWR uses natural circulation driven core heat removal during normal operation and hot shut down, making the core heat removal capability immune to the station black-out event.

The function “ultimate heat sink” for accident conditions in the advanced concepts is mainly ensured either by the water stored in tanks (located inside or outside the containment) or by heat transfer directly to the surrounding atmosphere (via special heat exchanger or via containment shell). In the first case, the heat sink may be limited in time, and human actions are required to restore it. For this type of the ultimate heat sink, the passive containment cooling water storage tank in the AP-600, which is needed especially for accidents in the design extension area, or the water tanks for passive containment cooling and for passive decay heat removal in WWER-640 /V-407 and AHWR designs are examples. An example of the unlimited heat sink is the use of air heat exchangers in WWER-1000/V-392 design located outside the containment. Another aspect of heat sinks that is sometimes made passive is the feed water to the boilers. In evolutionary CANDU designs, for example, there is gravity feed from an elevated tank into the boilers. High capacity valves can be opened in the steam system to depressurize the boilers and allow gravity flow for makeup.

The approaches described above result in the specific design decisions implemented in new reactor concepts, and some examples of these decisions are given below.

AC-600/1000 (China): The AC-600/1000 designs rely totally on passive safety systems to accomplish safety functions. The high natural circulation cooling capability due to the small flow resistance of the reactor coolant loops is very useful for reactor decay heat removal during accidents. The emergency residual heat removal system is used to remove decay heat from the reactor core following the event of station black out, main steam line break or loss of feed water. The steam generator secondary side, one emergency feed water tank and one emergency air cooler establish a natural circulation circuit. Air coolers are located in a chimney. The containment cooling system consists of the containment cooling water storage tank located at the top of the containment, and cooling sprayers. The system is used to remove decay heat from the inside to the outside of the containment during LOCA or main steam line break located inside the containment. First, the water in the tank on the top of the containment will be sprayed onto the surface of the steel shell of the containment by gravity, cooling the shell and resulting in reducing containment pressure and temperature. The tank capacity can meet the requirements of 72 hours for steel shell cooling after LOCA. After the tank empties, natural circulation flow of air through the annulus between the steel shell and the concert shell can remove the heat continuously.

WWER-640/V-407 (Russia): The Steam generator passive heat removal system is designed to remove the decay heat in the case of non-LOCA events and to support the emergency core cooling in the case of LOCA. The reactor coolant system and passive heat removal equipment layout provide heat removal from the core following reactor shutdown via the steam generator to the water tanks located outside the containment and further to the atmosphere by natural circulation. The water inventory in this tank is sufficient for the long-term heat removal (at least 24 hours) and can be replenished from an external source. The containment passive heat removal system of WWER-640 /V-407 reactor removes heat from the containment in the case of a LOCA. The steam from the containment atmosphere condenses on the internal steel wall of the double-containment being cooled from outside surface by the water stored in the tank. The system operates due to natural circulation and is capable of removing decay heat for 24- hour period following reactor trip.

WWER-1000/V-392 (Russia): This reactor incorporates an important passive system to remove core decay heat in case of station blackout (so called SPOT). The SPOT system consists of four groups of closed natural circulation circuits. In the ribbed tubular air-cooled heat exchanger (four heat exchangers for each circuit), steam extracted from the steam generator condenses, and the condensate flows by gravity to the steam generator boiler water volume. Under normal plant operation, the SPOT system is under standby. In the case of plant blackout, the SPOT state changes to the operating condition. Natural circulation in the SPOT system is provided by the corresponding layout of the steam generator, heat exchanger and draught air duct.

SWR (Germany): The Siemens AG [now Framatome ANP] has been developing a 1000 MW(e) boiling water reactor, the SWR 1000. One of the main characteristics of this reactor is the replacing of the active safety systems in part with passive safety systems. In many of these passive systems, natural circulation is the essential mechanism. The emergency condenser system consists of four heat exchanger subsystems. It provides passive heat removal from the reactor pressure vessel to a large water inventory stored inside the containment. These condensers commence functioning on the basis of the drop in the RPV water level. If the water level inside the RPV drops, the primary steam enters the tube bundles, condenses and is returned by gravity to the reactor vessel. During the condensation process, the water in the condenser is heated and would start to boil, the resulting steam is discharged from the condenser to the atmosphere. In the event of failure of the active residual heat removal system, four containment-cooling condensers are designed to remove residual heat from the containment to the dryer separator storage pool located above the containment. They use natural circulation both on the primary and on the secondary sides.

AP-600 (USA): The AP-600 is a 600 MW(e), advanced nuclear power reactor developed by Westinghouse. The AP-600 uses passive safety systems to improve the safety, reliability and protect investment. These systems rely on natural forces such as gravity, compressed gas and natural circulation to make the system work. The passive core cooling system is designed to provide adequate core cooling for the design basis accidents. The system consists of two passive residual heat removal systems (PRHR) heat exchangers, two core makeup tanks (CMT), two accumulators, one in-containment refuelling water storage tank (IRWST), and two reactor coolant system (RCS) depressurization spargers. Among others, the system is designed to perform the emergency core decay heat removal, provide core decay heat removal during transients, accidents, or whenever the normal heat removal paths are unavailable. The emergency core decay heat removal system primarily consists of two heat exchangers located in the IRWST. Only one heat exchanger is required for decay heat removal. The PRHR heat exchangers are connected to the RCS through a common inlet line from one of the hot legs. The outlet line is connected to the associated steam generator cold leg plenum, reactor coolant pump suction. The two heat exchangers are elevated above the reactor coolant loops to induce natural circulation flow through the heat exchangers when the reactor coolant pumps are not available. The passive containment cooling system cools the containment following an accident such that the design pressure is not exceeded and the pressure is rapidly reduced. The steel containment provides the heat transfer area that removes heat from inside containment and rejects it to the atmosphere. Heat is removed from the containment vessel by continuous natural circulation flow of air. During an accident, the air-cooling is supplemented by evaporation of water. The water drains by gravity from a tank located at the top of the containment building onto the outer surface of the steel containment. The water tank is sized for 72 hours of operation, after which the tank is expected to be refilled.

CANDU (Canada): The exiting CANDU reactors as well as the proposed new designs rely to varying degrees on heat removal processes driven by natural circulation. Passive heat sinks based on NC, are utilized in current CANDU reactors, which are able to mitigate the accident progression for more than 24 hours. The passive heat sink consists of the heavy water moderator, which is contained within a low-pressure vessel, called a calandria. The calandria vessel is in turn contained in a calandria vault filled with light water, which provides a second passive emergency heat sink. An elevated reserve water storage tank inside the containment has been included into advanced evolutionary CANDU designs. This tank provides the emergency make up water to the moderator and permits passive heat removal by thermo­siphoning from the shield tank. The amount of water is sufficient for more than 40 hours of passive decay heat removal.

A conceptual CANDU design employs a passive moderator heat rejection system. The idea is to allow the heavy water in the calandria to achieve a temperature near the boiling point and to allow this water to flash to steam as it rises in a pipe from the calandria to an elevated heat exchanger. Sub-cooled heavy water would then be returned to the calandria. The differences in density between the two-phase flow in the riser and the liquid in the down comer would provide the buoyancy force to drive the flow. An integrated passive design for heat rejection through containment was investigated by AECL. The system uses an annular jacket as an intermediate heat sink coupled to in — containment heat sources and a finned outer containment wall. The system employs a natural circulation loop to transfers the heat to the water jacket. Also heat from the water jacket is conducted through the steel wall to air following upward by natural convection.