Abstract
The safety goal of the current designs of advanced high-temperature thermal gas-cooled reactors (HTRs) is that no core meltdown would occur in a depressurization event with a combination of concurrent safety system failures. This study focused on the analysis of passive decay heat removal (DHR) in a GEN IV direct-cycle gas-cooled fast reactor (GFR) which is based on the technology developments of the HTRs. Given the different criteria and design characteristics of the GFR, an approach different from that taken for the HTRs for passive DHR would have to be explored. Different design options based on maintaining core flow were evaluated by performing transient analysis of a depressurization accident using the system code RELAP5-3D. The study also reviewed the conceptual design of autonomous systems for shutdown decay heat removal and recommends that future work in this area should be focused on the potential for Brayton cycle DHRs.
1. Introduction
With the advent of the U.S. led GEN IV initiative to develop an entirely new generation of nuclear reactor plants, there is now the opportunity to revisit the design of the gas-cooled fast reactor (GFRs) and enhance the safety case. It was recognized even during the 1960s when gas-cooled fast reactors (GCFRs) [1] were being considered and advocated as an alternative to the mainstream world-wide program development of the liquid metal fast breeder reactor (LMFBRs) that gas coolant be it helium or carbon dioxide, had in the low-pressure range poor heat transfer properties and low thermal mass inertia compared to liquid metal coolant, in particular sodium. This early realization led to the focus on extensive research programs and development of reliable active decay heat removal systems.
The design of decay heat removal (DHR) systems and the question of whether or not passive heat removal mechanisms can play a useful role are in a large part determined by the definition of the design basis. Most accident sequences can be accommodated by the provision of reliable/highly reliable system design of which active decay heat removal systems are the key to long-term recovery and stable cooldown. Depressurization initiators with loss of off-site power and a loss of a shut-down train (single failure criteria) have all been accommodated in the design basis of the earlier GCFRs.
For the early design work on active DHR systems, forty years ago the general residual heat removal (RHR) system criteria were that; two independent, diverse, and functionally redundant decay heat removal systems were to be provided to ensure that a loss of coolable core geometry resulting from decay heat removal failure should not have a frequency greater than per reactor year [2]. The GA design for the 300 MW(e) gas-cooled fast reactor (GCFRs) demonstration plant had two separate RHR systems which provided the reliability required for forced-convection shutdown core cooling in the GCFR. The normal operational RHR was provided by the three main loop cooling systems (MLCS) with their associated steam-driven helium circulators and steam generators. A diverse backup safety RHR capability was provided by a core auxiliary cooling system (CACS), which consisted of three independent auxiliary loops with electric-motor-driven helium circulators and pressurized water heat exchangers. Heat rejection for the MLCS was accomplished through the normal power conversion system components or by direct steam relief to the atmosphere for a limited time. For the initial shutdown heat removal phase of main loop cooling, reactor decay heat provides the heat source for generating circulator drive steam and makeup feedwater supplied by individual shutdown feedwater pumps. The initial phase lasted for about 30 minutes following shutdown. Following this, long-term decay heat removal was initiated, with oil-fired auxiliary boilers providing circulator drive steam and the steam generators serving as heat dumps. Heat rejection for the CACS was accomplished through individual pressurized water loops with heat rejection to the atmosphere by air-cooled heat exchangers.
To define what constituted an adequate RHR system for the GCFR, a target probability of per reactor year was adopted for loss of coolable core geometry. For this design analysis, it was further assumed that the major portion of this target could be allocated to the loss of RHR systems, implying that loss of coolable core geometry due to failure of the reactor shutdown systems or to gross structural failures can be reduced to a small fraction of the overall target. This assumption was supported by earlier analyses. A further suballocation of the overall target into a failure rate target of per year for the MLRHR (main loop RHR) system and a target of /demand of the CACS failure rate was utilized. The early design work indicated that the CACS system could be expected to meet its target but that the MLRHR system required improvements. These targets implied that only once in 100 years of reactor operation would there be a demand for the CACS to perform the RHR function and that intersystem dependencies were systematically eliminated. Since the MLRHR function was supported by the main loop heat removal train, the power supply system, and a number of auxiliary and support systems, a further suballocation of the per year target for each required system was necessary and resulted in an allocation of per year for the failure rate of the MLRHR train.
One of the principal improvements considered was the addition of a backup system to the MLRHR system called the shutdown cooling system (SCS), which shared the main circulator shaft and impeller and the steam generator with the MLRHR system. The SCS shared the steam generators and the main circulator with the MLCS, except that the circulator was driven by a pony motor with a safety-grade power supply. Heat rejection in the SCS was accomplished through three air water coolers, which rejected heat to the atmosphere. The water was recirculated to the steam generator through three separate shutdown feedwater pumps.
The reference system of SCS and CACS was limited by power supply reliability. This was evidenced by the substantial reduction in the statistically independent RHR failure probability by a factor of 30 for pressurized RHR and by a factor of 500 for depressurized RHR with repressurization. For a revised design with separate emergency power supplies of the SCS and the CACS, the dominance of RHR failure by electric power supplies was removed to the extent that the running reliability during long downtime events was now controlling. These long downtime events are identical with the events which require depressurization and therefore, the revised design was controlled by the RHR reliability for depressurized events. Substantial gains in RHR reliability were indicated due to natural circulation for pressurized RHR and for depressurized RHR with repressurization.
Within the space of the last ten years, the thermal gas-cooled reactors have redefined the safety envelopes. Both the HTGR and the PBMR [3] have claimed walk-away safety. With the failure of reactivity scram systems, failure of active heat removal systems including the decay heat removal systems, total loss of electric power both off-site and emergency, and for depressurization events the position is that no core meltdown would occur. Given this background, it would appear appropriate for the GEN IV GFR to have such a safety goal too. From the view point of decay heat removal accidents this would mean that protected depressurization initiators with total loss of electric power would not result in core meltdown. In other words, a station blackout combined with a depressurization would not lead to a severe accident. This is a major challenge and it should be understood that this postulated beyond-design basis accident is a very low probability event in residual risk space. Passive safety mechanisms would need to be utilized.
The GFR being one of the six reactor concepts selected in the framework of the Generation IV Initiative (GEN IV), has been undergoing active international design development in the past few years. In particular several design concepts have been studied to address the issue of decay heat removal in a loss of coolant accident (LOCA). The reference French CEA DHR concept [4] consists of a dedicated DHR system that removes decay heat by forced convection (battery powered blower) in the short term and natural convection in the long-term. In order to provide the back pressure to sustain natural circulation through the reactor core and the DHR system, a guard containment has been designed to enclose the whole primary system and maintain a pressure of 10 bar. Other design considerations, such as the need to provide an isolation valve in the cold leg of the cross-duct to avoid core bypass when the DHR system is activated and the injection of nitrogen into the guard containment to provide back pressure are discussed in [5, 6]. Performance of the dedicated DHR system in a LOCA has been analyzed using system codes TRACE and CATHARE for a GFR with plate-type fuel [7]. Other means of providing decay heat removal have been reported previously and they include: use of power conversion loops instead of dedicated DHR systems [8], injection of gas into the reactor vessel [9], and standalone Brayton cycle turbomachinery [10]. This paper discusses a parallel design study conducted in the US to address decay heat removal in a direct cycle GFR with a pin core design.
2. Passive Conduction/Radiation
Table 1 summarizes the potential passive decay heat removal mechanisms. The DOE supported GFR GEN IV project, [11], and I-NERI project [12] have produced results for a small modular GFR (600 MWt), and a large reactor (2400 MWt) with a pin core design. Based on the sum total of these lessons learned, a number of conclusions can be drawn for each of the potential mechanisms identified in Table 1.
The major design parameter for conducting/radiating core decay heat passively to the ultimate heat sink is core fuel power density. However, current fuel cycle economic factors for a uranium startup core would set a minimum power density range on the order of 70–100 W/cc. This is still a major reduction from the historical GCFR parameter of a 250 W/cc range. To summarize, fuel power density is definitely a very important parameter in the feasibility of proposed passive decay heat removal mechanisms. Reducing fuel power density would aid the safety case. However, economics and in particular fuel cycle economics sets the lower limits on the power density. The range of 70–100 W/cc should probably be the range. With core fuel power density of 70–100 W/cc, the thermal gas reactor “conduction cooldown” mode of passive heat transfer of core generated heat through conduction and/or radiation inter- and intrafuel elements to the vessel boundary is not possible for the GFR. This is regardless of fuel form, block/plate, pin or pebble. With the limited conductivity of the potential core fuel and structural materials, even 1 to 2% decay heat would lead to core disruption conditions. With the high temperature requirements of the GEN IV GFR (850°C coolant outlet) and the fuel flux/fluence conditions, the set of potential materials is small. However, even if graphite with its neutron-spectrum-softening disadvantage, utilized in the thermal gas reactor cores, was used, success would not be attained. The crux of the matter is the low (5 W/cc) power density of the thermal gas reactor. Lowering the density of the fuel by adding diluents, could lower the power density and still retain the high specific power requirements. This would also be attractive from the view point of adding thermal inertia. However a fast reactor core requires significantly higher fuel densities/loading to maintain criticality over a high burnup fuel cycle (30% volume fraction of 10 gm/cc ceramic fuel with 20% fissile). Moreover the thermal properties of potential diluents are in the same range of the fuel. Adding diluents is not a potential solution for the GFR given the state of current core material development work. Adding thermal inertia to absorb decay power in sensible heat until 0.1% decay power is reached, is not feasible.
Unless substantially higher conductivity core materials can be developed, passive removal of decay heat (1% nominal power) through pure conduction cooldown alone to the vessel boundary will not be feasible for economic operations of the GFR. Moreover, the heat rates by radiation from the core outer boundary to the vessel walls are much smaller than for HTGRs because of an order of magnitude smaller GFR core volume dictated by the higher power density. This is not a thermal gas-cooled reactor where as discussed previously, a power density of 5 W/cc is economically acceptable. This points out that conduction alone is not the sole difficulty in transporting core decay heat to the wall boundary through the fuel elements. For fuel forms such as the pin, as opposed to monolithic blocks, radiation heat transfer is a major component of the fuel element-to-fuel element heat transfer. To compare the relative effectiveness of conductivity relative to radiation in transferring heat from fuel element to fuel element to the vessel wall boundary, reference should be made to [13]. The results show that the resistance to radiation heat transfer is by far the largest hurdle at the core power density of interest.
3. Natural Convection
In facilitating natural convection decay heat removal for the GFR, a passive system based on an in-vessel emergency heat exchanger was first studied, followed by a more detailed study that instituted a hybrid passive system for decay heat removal. The hybrid system consists of two ex-vessel components, a battery-powered blower and an emergency heat exchanger that operates on natural circulation cooling. The blower is designed to work during the early phase of the depressurization accident while natural circulation cooling will provide for the long-term cooling needs of the reactor system.
3.1. Pure Passive
A self-sustaining method for decay heat removal has been investigated and it is based on an in-vessel emergency heat exchanger, which will remove heat from the primary system and transfer it to the outside environment. The emergency heat exchanger will establish natural circulation flow through the reactor core thus removing decay heat in a passive manner. A check valve inline with the in-vessel emergency heat exchanger will open upon loss of forced flow providing a flow path from the upper plenum to the downcomer of the reactor vessel, thus completing the natural circulation loop. In order for natural circulation cooling to function efficiently the primary system and the containment might need to be pressurized to ensure a sufficiently high coolant density. This will be accomplished by having a guard containment structure around the primary system.
Figure 1 is a node diagram showing the RELAP5 model of the reactor system (600 MWt) that is used to investigate the passive cooling in a depressurization accident. A guard containment that surrounds the whole system is modeled as a volume that provides the back pressure to the reactor system via the assumed break that is in the cold duct of the reactor vessel. Figure 2 is a node diagram of the emergency heat exchanger system. It consists of an in-vessel heat exchanger of HEATRIC design, a secondary loop of compressed CO2, and an external water heat exchanger that dissipates the energy to a heat sink.
In this preliminary study the power conversion unit (PCU) is approximated by a series of pipe components only and no turbomachinery or heat exchanger is modeled. One end of the PCU volume is connected to the reactor outlet in the upper plenum region (the hot duct). The other end of the PCU is connected to the reactor inlet in the downcomer region (the cold duct) via a time-dependent junction. The time-dependent junction is used to simulate the coasting down of forced flow through the reactor as a result of the PCU tripping on a depressurization accident. In addition a junction between the PCU and the downcomer will open when flow stops in the time-dependent junction, simulating the flow path between the reactor and the PCU.
The depressurization accident is initiated by opening a trip valve on the cold duct of the PCU volume. The assumed break area is 0.000645 m2 (1 in2). The break flow goes to a pipe component representing the guard containment. The main objective of the preliminary study is to assess the back pressure requirement for a successful decay heat removal via a passive system. The figure of merit for success is to maintain the maximum fuel temperature below 1600°C. A relatively large guard containment volume (18720 m3) was used in the analyses to moderate the rise in the guard containment pressure as a result of leakage from the pipe break. This way the back pressure could be easily changed by varying the initial pressure parametrically.
A success case is achieved when the guard containment pressure is initially set to 2.0 MPa. In this transient the pressures in the reactor and the guard containment converge to about 2.5 MPa (see Figure 3). The emergency heat exchanger is able to match the decay power (see Figure 4) and the fuel temperature (see Figure 5) is well below the 1600°C limit. A similar analysis is done for an initial guard containment pressure of 1.0 MPa. In this case the maximum fuel temperature (see Figure 6) exceeds the 1600°C limit at about 3000 seconds after the initiation of the break.
3.2. Hybrid Active/Passive
The purely passive decay heat analysis suggests that passive heat removal is possible if the system back pressure is high enough to sustain sufficient natural circulation flow through the core and the emergency heat exchanger. The amount of the required natural circulation flow is dependent on the heat load, that is, the decay heat. If some other mechanism(s) can maintain core cooling in the early phase of a shutdown transient then the requirement can be relaxed for natural circulation cooling (passive cooling) in the later phase of the transient. A hybrid active/passive combination approach to the decay heat removal is evaluated for the advanced 2400 MWt GEN-IV gas-cooled fast reactor. The hybrid system is an emergency cooling system (ECS) (external to the reactor) consisting of battery-powered blower and natural circulation heat exchanger designed to remove decay heat both actively and passively. For the first 24-hours after shutdown when natural circulation alone may not be sufficient to cool the core, the ECS will operate in the active mode with the blower running. The ECS heat exchangers are sized to enable a self-sustaining method for long-term heat removal (after 24-hours) by natural circulation cooling when the blower is off. Since the natural circulation mass flow rate through the ECS primary circuit and the corresponding heat removal rate both increase with system pressure, a guard containment structure surrounding the primary system is designed to support an elevated back pressure condition in a depressurization accident.
A series of transient analyses using the system code RELAP5-3D (version 2.4.1.1a) has been performed to confirm the efficacy of the proposed hybrid active/passive emergency cooling system. The accident sequence of interest is a station blackout simultaneous with a small break (10 sq. inch/0.0645 m2) in the reactor vessel. The analyses cover the three phases of decay heat removal in a depressurization accident: (1) forced flow cooling by the power conversion unit (PCU) coast down, (2) active forced flow cooling by a battery powered blower, and (3) passive cooling by natural circulation. The RELAP5 model [14] includes the helium-cooled reactor, the ECS (primary and secondary side), the PCU with all the rotating machinery (turbine and compressors) and the heat transfer components (recuperator, precooler and intercooler), and the guard containment that surrounds the reactor and the PCU.
In the latest pin core design [15], the 2400 MWt GFR reference core consists of 427 hexagonal fuel subassemblies, surrounded radially by 174 reflector subassemblies and 318 shield subassemblies. There are two types of fuel subassemblies, regular and control. Each regular subassembly has 271 fuel pins housed in a hexagonal can. Each control subassembly has 234 fuel pins with either a central control rod or a central shutdown rod. Each fuel pin in the subassembly has three axial regions, a top and bottom axial reflector section at each end and an active mid core section (1.34 m) consisting of fissile material (uranium carbide (UC) annular pellets). The cladding material for the fuel pin is silicon carbide (SiC). In the RELAP5 model, fuel subassemblies in the core are grouped into three radial zones by power, which are hot assembly, hot zone, and average zone. Each radial zone with its own heat structure and hydraulic channel is further divided into ten axial zones (nodes) with mid-core symmetry and a cosine axial power shape. The fraction of total power generated in the three radial zones is shown in Table 2.
The GFR is designed for a system pressure of 7.0 MPa and a core of Pa. Primary coolant flow (helium) is 1249 kg/s and the core inlet and outlet temperatures are 480°C and 850°C respectively. Other core parameters are summarized in Table 3.
The RELAP5 representations of the primary system and the power conversion unit (PCU) by hydraulic volumes are shown in Figure 7. The thermal cycle utilized in the GFR plant is a recuperative gas turbine cycle with intermediate cooling. Rotating components of the PCU (turbomachines), namely, the generator, turbine, low- and high-pressure compressors, are all on one shaft. A bypass valve that connects the high- and low-pressure side of the PCU is used for the over-speed protection of the turbine.
The emergency cooling system (ECS) is sized to handle 2% decay heat removal by natural convection in a % configuration, that is, four separate loops of 1% power capacity. In the RELAP5 model the emergency heat removal system is represented by a single loop with a % capacity and one heat exchanger, which is sized to handle 2% of full power. A battery powered blower downstream of the heat exchanger is sized to provide sufficient forced flow cooling during the first 24 hour after a reactor shutdown. Details of the volume representation of the ECS are shown in Figure 8.
The evaluation of the hybrid decay heat removal scheme is by way of analyzing a depressurization accident initiated by a break in the reactor pressure boundary (assumed at the high point of the reactor vessel) followed by a scram on low system pressure. Three transient calculations, defined in Table 4, have been performed to assess different aspects of modeling assumptions.
Helium flow through the core becomes laminar when natural circulation is established subsequent to turning off the battery powered blower. Case 26 is designed to examine the impact of increased form losses of grid spacers in laminar flow [14].
One of the ways to increase the natural circulation flow is by increasing the back pressure of the guard containment. This is realized in Case 32 by connecting a constant pressure time-dependent volume to the guard containment. The time-dependent volume, simulating a gas accumulator, maintains the back pressure at 800 kPa (8 bars) by injecting helium gas at 20°C when necessary. All three transient cases (no. 17, 26 and 32) assume a guard containment free volume of 2025 m3.
The success criteria for the transients are:
(1)maximum fuel temperature less than 1600°C (1873 K).(2)maximum core outlet temperature (helium) less than 850°C (1123 K).Both Cases 26 and 32 are restart cases. So they share the same result as for Case 17 up to the point of the restart, s for Case 26 and s for Case 32. The timeline for one of the cases (Case 32) is shown in Table 5 to illustrate the progression of the accident.
During the early phase of the transient, core flow is first driven by the power conversion system, followed by a battery powered blower. Preliminary results of the analysis indicate that the core is adequately cooled when the blower is running. It is then not necessary to simulate every second of the first 24-hours while the blower is in operation. A fast forward in time in simulation is done by linearly decreasing the reactor power from 26.2407 MW at s to 13.9748 MW at s. The later power level is equivalent to the decay power 24-hours after a shutdown. At 15000s the blower is turned off and the reactor power is maintained constant at the 24 hour decay power level for the rest of the calculation.
Preliminary results also indicate that with the blower off, the high-pressure point of the system is in the downcomer of the reactor. There are two flow paths from the downcomer, one leads to the core and the other goes to the PCU via the cold duct. With the blower off RELAP5 predicts about half of the natural circulation flow bypassing the core and instead flows through the PCU in the reverse direction (normal flow is from the hot duct to the cold duct). The PCU bypass flow is prevented by simulating a check valve, “activated” at s, that isolates the PCU from the downcomer.
Since the early phase of the transient is common for all three cases, results from Case 32 are used to illustrate the pressure responses of the reactor and the guard containment to a depressurization accident initiated by a 0.0645 m2 (10 sq. inch) break at time zero. It takes about 170s for the system pressure, as shown in Figure 9, to reach the scram setpoint of 6 MPa. The sudden drop in reactor pressure after scram is due to the opening of the turbine bypass valve in the PCU to control overspeeding of the rotating components. As a way to restore full turbine output, the bypass valve is reclosed at s and the reactor pressure responded positively. The pressures in the reactor and the guard containment slowly become equalized and the pressure equalization point occurs at a pressure of 800 kPa and at s. In Case 32 an accumulator is assumed to inject helium into the guard containment after s to maintain a constant back pressure of 800 kPa for the reactor system.
Plotted in Figures 10 and 11 is the rate of heat transfer into the heat exchanger in the emergency cooling system. The reactor power also is shown in the figures for comparison. Except for a period before s the ECS heat exchanger is able to remove all the decay power while the blower is running (before s). For the two cases #17 and 32 the energy removed by the ECS heat exchanger under natural circulation (for s) is seen to approach the decay power toward the end of the simulation. The increase in heat removal rate at s is due to the closure of the core bypass flow path through the PCU thus directing all flow through the ECS heat exchanger.
Figure 12 shows the peak fuel temperature as a function of time for the three transient cases. Before the reactor scrams at s there is a reduction in core flow due to system depressurization. This is accompanied by a corresponding increase in fuel temperature as shown in Figure 12. There is a rapid drop in fuel temperature after the reactor scram but the temperature starts to increase again after the compressors of the PCU have stopped running. The rate of temperature increase is abated slightly when the blower is turned on at s. By about s the energy removal power of the ECS heat exchanger exceeds the decay power (see Figure 10) and the fuel temperature starts to turn around in a downward trend. The peak fuel temperature is seen to be lower in Case 32 than the other two cases between s and 15000s. This is due to the higher blower flow in Case 32 as a result of higher helium density from the higher system pressure.
The accelerated drop in the peak fuel temperature at s is an artifact of the accident scenario that calls for the isolation of the PCU from the downcomer of the reactor. With this action the helium flow can no longer bypass through the PCU and the full blower flow is now directed to the core. The linear rate of decrease of the peak fuel temperature between s and 15000s is a reflection of the imposed linear decay in reactor power. At a state of reduced power and reduced pressure, the natural circulation flow is much lower than the blower flow and the effect is evident in the rapid increase in the peak fuel temperature after the mode of heat transfer has changed from forced to natural convection at s.For Cases 17 and 32 the leveling off of the peak fuel temperature toward the end of the calculation is indicative of natural circulation cooling matching the energy output of the reactor.
The general trend of the core outlet temperature, as shown in Figure 13 resembles that of the peak fuel temperature in Figure 12. The similarity between the responses of these two temperatures is not surprising because the location of the peak fuel temperature is generally near the core outlet. For cases 17 and 32, the core outlet temperature reaches a quasi-steady value of 1000 K while the temperature of Case 26 exceeds the success criterion of 1123 K.
The above results shows that Case 17 is a success case meeting both success criteria on fuel temperature and core outlet temperature at the end of the calculation at s. Case 26 with the realistic spacer losses (Reynolds number dependent) results in reduced natural circulation (as compared to Case 17) and the core outlet temperature exceeding the success criterion. At the end of the calculation at s the maximum fuel temperature has reached about 1400 K and is still increasing. For Case 32 where a constant back pressure of 800 kPa is maintained in the guard containment both the maximum fuel temperature and core outlet temperature have reached a quasi-steady state value by the end of the calculation and are within the success criteria. Case 32 demonstrates that it is possible to rely on natural circulation flow alone to remove decay power 24-hours after shutdown.
4. Autonomous Active Systems
Figure 14 shows a schematic diagram for a direct-cycle plant with an autonomous shutdown decay heat removal system (inside the dotted perimeter) in parallel with the main power conversion unit. If the main power conversion unit (on the left side of the figure) were not present and all of the primary flow went to the autonomous system, the plant layout would essentially be that of a reactor plant with a small simplified PCU also running on Brayton cycle. There is a precooler heat exchanger between the turbine and the compressor part of this small PCU, or heat engine, and the heat exchanger rejects heat to the water side of the RHR system. It could produce electric power, via a generator/motor if desired. The autonomous system is designed to run off the core decay heat except when perhaps the decay power is extremely low. The electricity generated by this system could be separate from the main (site) power grid and is therefore available even when the plant becomes disconnected from the main power grid.
When there is a loss of site power, the core power converted by the autonomous system continues to provide the motive power for the compressor, shown in Figure 14, that drives flow through the core and the heat exchanger. If the autonomous system is not running all the time then there is a start-up device, which could be a compressed gas accumulator in the circuit to the turbine and the compressor. This would actuate in the event that there is an interruption in power supplied to the plant systems and also for situations when the core power gets too low to keep the main PCU running. In the latter case, the autonomous system would enable the flow to keep circulating longer and the plant to continue removing decay heat longer. The core decay heat provides the motive power to keep the core cooled and the flow removes the decay heat.
In the event the autonomous system fails during normal operation it may be necessary to shut the plant down. During normal operation of the reactor plant, the compressors in the power conversion unit keep the pressure at the reactor inlet higher than that at the outlet and thereby drive the flow though the reactor core. If the compressor in the autonomous system was not running, then the pressure differential across the reactor core would cause most of the main primary flow to bypass the reactor core and go backward through the primary side of the heat exchanger that is connected to the auxiliary heat engine. Therefore, a check valve, shown in Figure 14, is needed to prevent backward flow if the compressor for the autonomous system is not be running.
The autonomous system could be running all of the time, including normal operation of the reactor plant, so that it would always be available and does not need to be started during an emergency. Therefore, the system would be removing heat all of the time and would impact plant efficiency unless it also generated electricity. Also, the system would have to be designed to insure that it ran properly at both full system pressure and at depressurized conditions, which in some plant designs could be as low as one atmosphere. The autonomous system potentially could be usable for normal decay heat removal while the plant is shutdown and during fuel handling.
During a depressurization accident there would probably be only outflow through the break from the pressurized primary circuit to the reactor containment and no concurrent ingress of cold containment gases. After the depressurization, however, it may be possible for cold gases to enter through the break. This represents a potential problem. If cooled gases from the containment entered the primary system through the break and prevented hot coolant from the reactor core from reaching the turbine that is powering to the autonomous system, the auxiliary heat engine would stop running. This could be the result of a large break in or near the reactor vessel outlet plenum, for example. Therefore, it may be highly desirable to place the system inside the primary vessel so that there is no external primary piping between the vessel and the system, for example, the heat exchangers that are added to the primary circuit could be placed inside the primary vessel, as shown in Figure 15 for a direct-cycle plant.
An important issue is the potential for check valve failures. If during normal full reactor power operation, the check valves failed to prevent backflow through the primary side of the auxiliary engine heat exchanger, a significant part of the primary flow could bypass the reactor core. Autonomous systems have moving parts and therefore cannot be considered to be passive systems. They may be classified as “semipassive”, as opposed to “active”, because they do not necessarily need to be started up in an emergency, as one would need to do with a backup diesel-powered electric generator.
5. Summary and Conclusions
With the advent of the U.S. led GEN IV initiative to develop an entirely new generation of nuclear reactor plants, there is now the opportunity to revisit the design of the gas-cooled fast reactor (GFRs) and enhance the passive safety case. The GFR safety approach for the passive removal of decay heat in a protected depressurization accident with total loss of electric power needs to be different from that taken for the HTRs. The HTR conduction cooldown to the vessel wall boundary mode for economically attractive core designs is not feasible in the case of the GFR because the high power densities require decay heat fluxes well beyond those achievable by the heat conduction and radiation heat transfer mode. A set of alternative design options has been evaluated for potential passive safety mechanisms characteristics of the GFR. For the pin design core, two approaches to decay heat removal, autonomous systems and natural convection have been identified. For direct-cycle plants both concepts require that one or more additional primary flow loops be added to the plant. These loops have heat exchangers that either power the autonomous systems or merely dump decay heat. These extra loops require check valves to help prevent reverse flow that could cause a significant portion of the main coolant flow to bypass the reactor core. An issue that is common to the use of either autonomous or natural convective systems is a break in the primary system boundary that would allow cold containment gas to enter the reactor vessel between the reactor outlet plenum and the inlet to the decay heat removal system. This could be detrimental for an autonomous system, since it is powered by the heated coolant from the reactor core. This would also be detrimental for a natural convection system, since it would diminish the buoyancy that drives the primary flow around the natural convective circuit. In order to avoid this problem, or minimize its likelihood of occurrence, it was suggested that the heat exchangers that are added to the primary circuit to be placed inside the primary vessel, as shown in Figure 15 for a direct-cycle plant. To bolster the safety case for natural convection, the primary vessel will be enclosed within a guard containment (secondary containment) to maintain the coolant pressure at some significant level. Since autonomous systems add complex machinery to the plant, they cannot be considered to be passive, but may be considered to be semipassive. Natural convective systems do not work at atmospheric conditions and therefore require some form of pressurized confinement, but if this pressurized confinement is provided, the system can be passive. Natural convective systems are less complex than autonomous ones, but providing a confinement/guard containment with sufficient pressure capability could be a challenge.
The decay power immediately after scram from full power is close to 7% of full power. Since natural convective decay heat removal systems typically can remove no more than only about 1 or 2% of decay power, the excess decay energy must be temporarily stored in the reactor until the decay power has declined sufficiently. A RELAP5 transient model was used to assess natural convection in a direct-cycle plant in which the natural convection heat exchanger was assumed to be 10 m about the reactor fueled region. The results showed that for helium coolant the guard containment pressure would have to be about 13 bar if the primary system temperature were not to exceed about 850°C. The accident analyzed was the protected major depressurization accident with total loss of electric power. The results obtained with the model show that there is significant margin from the assumed fuel disruption criteria when the guard containment postevent pressure is 20 bar. The current consensus reached on the natural convention approach to the depressurized decay heat accidents is a combination of both active and passive means. A guard containment surrounding the primary system is utilized which is designed for 0.7 to 1.0 MPa back-up pressure. This back-up pressure plus whatever natural convection is available at this pressure level will be utilized to reduce significantly the blower power of the active decay heat removal system (DHR) sized to remove 2-3% decay power. The objective is to be able to use power supplies such as batteries without the need for startup. This back-up pressure level should then be sufficient to support natural convection removal of the decay heat after 24-hours. The power requirement would be also be decreasing during this period as the after-heat further decays. Furthermore, additional work should be pursued to extend the primary system coast-down upon trip of the main power conversion units (PCUs) which are Brayton cycle turbo-compressors. With the use of the Brayton cycle turbo-compressors there is the potential for using the core decay heat to provide the driving power for the turbo-machinery flow thus maintaining core cooling by the primary coolant flow. As a complementary autonomous concept, turbo-compressor sets could be used in place of electrically-driven blowers in the DHR system. The target is to remove the need for electric power in these accident situations.
In conclusion, a design for a pin-type core that employs a natural convective heat removal system has been selected and the modeling capability to analyze it has been assembled and a system evaluation has been performed. It is recommended that follow-on GEN-IV project work is performed to consider the implications of an autonomous system for this core design and safety approach for the primary vessel design, the balance-of-plant layout and the containment considerations.
Acknowledgments
This manuscript has been authored by employees of Brookhaven Science Associates, LLC under Contract no. DE-AC02-98CH10886 with the U.S. Department of Energy. The publisher by accepting the manuscript for publication acknowledges that the United States Government retains a nonexclusive, paid-up, irrevocable, world-wide license to publish or reproduce the published form of this manuscript, or allow others to do so, for United States Government purposes. The ANL work was supported by the U.S. Department of Energy under Contract numbers W-31-109-Eng-38 and DE-AC02-98CH10886. This material is based upon work supported by the U.S. Department of Energy under the I-NERI and GEN IV programs.