Passive Safety
Traditional reactor safety systems are active in the sense that they involve
electrical or mechanical operation on command. Some engineered systems
operate passively, e.g., safety valves.
Inherent or full passive safety design depends only on physical phenomena
such as convection, gravity or resistance to high temperatures, not on
functioning of engineered components.
All reactors have some elements of inherent safety as mentioned above, but in
some recent designs the passive or inherent features substitute for active
systems in cooling etc. Such a design would help in reducing the probability of
a loss of cooling or core melt accidents.
The designs for nuclear plants being developed for implementation in coming
decades contain numerous safety improvements based on operational
experience. Here, the introduction will be given to passive safety and brings out
passive safety features in the present and new designs.
1
1. Categorization of Passive Systems (IAEA, 2009)
The practical definition of a passive safety system is as follows: Either a
system which is composed entirely of passive components and structures or a
system which uses active components in a very limited way to initiate
subsequent passive operation. lAEA have classified passive systems into four
categories to distinguish the different degrees of passivity.
Characteristic Catagory-A Catagory-B Catagory-C Catagory-D
Signal inputs of No No No Yes
intelligence
External power No No No No
sources or forces
Moving No No Yes Either
mechanical parts
Moving working No Yes Yes Either
fluid
Example Barriers such Heat removal Rupture disk or Shutdown
as fuel clad, by natural spring-loaded valve system-l
containment; core circulation for overpressure and -2 in
cooling relying to heat protection; CANDU.
only on radiation exchangers accumulator
or conduction to in water pools, isolated by check
outer structural from the core valve.
parts. or containment.
2
2. Passive Reactor Shutdown Systems
Reactor safety is based on three premises: control, cool and contain. Control
refers to the ability of a reactor to shutdown under all events. Cool refers to
the ability to remove decay heat under all conditions. Contain refers to
containment of radioactivity within the containment or maximum up to the
exclusion zone boundary. Here, it will be given few examples of passive
shutdown in PHWR and sodium cooled fast reactors.
2.1 PHWR/CANDU Reactor
PHWR (Pressurized Heavy Water Reactor)/CANDU (Canada Deuterium
Uranium) shutdown systems are passive in the sense that once they are
actuated by a signal, the devices themselves are inserted into the core via
gravity (shutoff rods) or stored energy (spring assist to the shutoff rods, and
gas-driven poison injection).
More passive approaches could be developed based on change in material
properties with temperature. The SES-10 heating reactor had a second
shutdown system consisting of tubes inserted into the reactor, with a low-
melting-point neutron absorber within them, above the core. 3
This needs no external intelligence but does have a moving fluid, placing it in
Category-B. Even more basic, fuel with a strong negative temperature
feedback coefficient is certainly a passive form of reactivity compensation. If
it truly shutdown the reactor, it would be in Category-A.
However negative feedback does not necessarily shut down the reactor after,
say, an inadvertent insertion of positive reactivity (control rod withdrawal)-it
simply allows the power to rise and then equilibrate at a level where the
negative reactivity due to the higher fuel temperature off-sets the reactivity
addition of the control rod.
One still needs to be sure that the power can be removed somehow (by passive
means) and that the fuel is not damaged. A strong negative coolant
temperature feedback works the same way, but has the added concern that a
fast insertion of cold water could cause a rapid power increase before the
negative fuel or coolant temperature has time to compensate it.
4
2.2 Sodium Fast Reactor
In case of sodium cooled fast reactors many passive shutdown systems have
been developed. One of them in an advanced stage of development involves
the use of a Curie point magnetic switch in the coil of the electromagnet
holding the control rod.
The functioning of this switch is based on usage of a material that
demagnetizes above certain temperature. Demagnetization of the coil makes
the control rods drop into the core thus tripping the reactor. Such a system
will act when sodium temperature goes above set limits.
The switch contains materials which on reaching a particular temperature,
lose the magnetic property and become paramagnetic. Sodium from adjacent
fuel assemblies pass through the Fe-Ni-Co alloy which is incorporated in the
outer core of the electromagnet.
As the temperature of the alloy exceeds the Curie point, the electromagnet
loses its electromagnetism and the control rods fall down into the core. The
drop temperature is controlled between 600 to 650°C by altering the Co
content. 5
3. Passive Decay Heat Removal in LWR/PHWR Reactors
In passive designs, removal of decay heat from the fuel is normally done by
thermosyphoning to an elevated heat sink, usually a heat exchanger in a large supply
of water high up in the building.
Alternatively the entire core and its surroundings can be flooded by pouring water by
gravity from an elevated supply; the core heat is then turned to steam, which flows to
and is removed passively from containment. It is usual in passive designs to remove
decay heat at low pressure; thus some means of depressurizing the heat transport
system is required first.
This is done via a Category-D device, usually intelligence is needed since
depressurization in PWRs means opening valves on the primary side i.e., creating a
controlled small LOCA.
PHWRs offer some inherent advantages in this regard, as already stated-there are two
large volumes of water around the core (the moderator and the shield tank), onto
which one could engineer passive, low pressure heat removal.
Heat removal from the shield tank is only of interest for severe accidents, since by then
the core geometry will have collapsed. The disadvantage of the moderator is that with
current pressure tube designs, the fuel will be severely damaged if the heat has to be
taken out via the moderator. 6
3.1 Pre-pressurized Core Flooding Tanks
Pre-pressurized core flooding tanks, or accumulators, are used in existing nuclear
power plants and they constitute part of the emergency core cooling systems. They
typically consist of large tanks having about 75% of the volume filled with cold
borated water and the remaining volume filled with an inert gas.
As shown in Fig. 1, the contents of the
tank are isolated from the Reactor
Coolant System (RCS) by a series of
check valves that are normally held
shut by the pressure difference between
the RCS and the fill gas in the tank. In
the event of a LOCA, the core pressure
will drop below the fill gas pressure.
This results in opening the check valves
and discharging the borated water into
the reactor vessel. This is a Category-C
passive safety system for conditions
afore mentioned.
Fig. 1: Pre-pressurized flooding tank
7
3.2 Elevated Tank Natural Circulation Loops
Natural circulation loops represent an effective means of providing core
cooling. Several advanced reactor designs implement elevated tanks connected
to the reactor vessel or primary loop at the top and bottom of the tank as
shown in Fig. 2.
The tanks are filled with borated water to
provide coolant injection at system
pressure. The tanks are normally isolated
from the reactor vessel by an isolation
valve located along the discharge line
departing from the bottom of the tank
itself.
The fluid is always sensing full system
pressure through the top connection line.
In the event of an emergency, the bottom
isolation valve is opened to complete the Fig. 2: Elevated tank natural circulation
natural circulation loop and to permit
cold borated water to flow to the core.
8
3.3 Elevated Gravity Drain Tanks
Under low pressure conditions, elevated tanks filled with cold borated water
can be used to flood the core by the force of gravity. In some designs, the
volume of water in the tank is sufficiently large to flood the entire reactor
cavity.
As shown in Fig. 3, operation of the system requires that the isolation valve be
open and that the driving head of the fluid exceed the system pressure plus a
small amount to overcome the cracking pressure of the check valves. This is a
Category-D passive safety system.
Fig. 3: Elevated gravity tank 9
3.4 Passively Cooled Steam Generator Natural Circulation
Some advanced PWR designs incorporate a system to remove decay heat
passively through the steam generators. This is done by condensing steam
from the steam generator inside a heat exchanger submerged in a tank of
water or an air cooled system as shown in Fig. 4. These are Category-D
passive safety systems.
10
Fig. 4: Core decay heat removal using passively cooled steam generator
4. Passive Safety Systems for Containment Cooling and Pressure Suppression
This section describes the types of advanced reactor passive safety systems for
removing the heat from the containment and reducing pressure inside
containment subsequent to a loss of coolant accident.
The types of passive safety systems being incorporated for this function are:
• Containment pressure suppression pools.
• Containment passive heat removal/pressure suppression systems.
• Passive containment spray.
A brief description of each passive safety system for pressure suppression and
containment cooling is provided in the following sections.
11
4.1 Containment Pressure Suppression Pools
Containment pressure suppression pools have been used in BWR designs for
many years. Fig. 5 presents a generic concept of a suppression pool. Following
a LOCA, steam is generated into the drywell (the primary containment)
following vaporization of liquid and/or steam expansion, both of these coming
from the primary system typically due to a break.
From drywell the steam-non
condensable mixture is
subsequently forced through
large vent lines submerged in the
water in the suppression pools.
The steam condenses, thus
mitigating a pressure increase in
the containment. This is given by
Category-B and -C passive safety
systems.
12
Fig. 5: Containment pressure suppression pool
4.2 Containment Passive Heat Removal/Pressure Suppression Systems
This type of passive safety system uses an elevated pool as a heat sink. Steam
vented in the containment will condense on the containment condenser tube
surfaces to provide pressure suppression and containment cooling.
Three variations of the concept are presented in Fig. 6 and 7. In the first
variation of the concept, an Air Heat Exchanger (ARX) is connected with a
pool located on the top of the containment.
Single-phase liquid is expected to flow inside the ARX driven by gravity
gradient caused by the inclination of the same ARX. In the second variation of
the concept, a closed loop filled with single-phase liquid connects with a heat
exchanger in a pool of water.
Natural circulation and heat removal capability are generated when the air
ARX receives heat from the containment: this occurs through liquid heating
and stratification that produces a difference between densities in the rising
and descending leg of the pool-type ARX.
In the third variation of the concept, Fig. 7, two different zones of the
containment, typically characterized by different pressures in case of accident
(pressure is the same during normal operation), are connected with the rising
and the descending side of a pool type ARX. In this case, the steam-air 13
mixture is the working fluid with condensate in the descending leg.
Driving forces may be lower than in the previous cases and working condition
may not be stable over a reasonably wide range of conditions. Positive driving
forces may be low in all three cases and careful system engineering is needed.
These passive safety systems are of Categories-B and -D.
Fig. 6: Containment pressure reduction and heat removal after LOCA using (a) Steam
condensation on condenser tubes (b) External natural circulation loop 14
Fig. 7: Containment pressure reduction and heat removal after LOCA using
external steam condenser heat exchanger
15
System for passive heat removal through steam generators
• The system for passive heat removal through steam generators is designed to continuously
remove residual heat from the core and cool down the RP to 130 °C in DEC conditions (level
3b).
• The system operates for 72 hours without operator participation during accidents with full
blackout and SG feedwater failure.
• Heat is removed passively through steam lines to EHRT tanks.
1
• System designed in four trains structure.
• 1 – emergency heat removal tanks (EHRT);
• 2 – steam lines;
• 3 – condensate pipelines;
• 4 – SG PHRS valves;
• 5 – containment PHRS 5
3
heat exchangers-condensers; 7 2
6
4
• 6 – steam generators;
• 7 – isolation valves
16
System for passive heat removal through steam generators cont..
• Heat is removed from the containment by means of
cooling and condensation of a steam-air medium in
the upper part of the containment.
• Actuation and functioning of the system is passive due
to natural circulation of the steam-air mixture in the
containment atmosphere and natural circulation of
water in the containment PHRS heat exchangers and
containment PHRS tanks.
• The system is actuated by means of occurrence of the
required temperature differential between the
containment atmosphere and water in the
containment PHRS tanks.
EHRT tanks containment
• Supporting systems are not required for the system’s PHRS heat
functioning during 72 hours. with PHRS
heat exchangers-
exchangers condensers
17
4.3 Passive Containment Spray Systems
Fig. 8 shows a design that implements a natural draft air cooled containment.
Subsequent to a LOCA, steam in contact with the inside surface of the steel containment
is condensed. Heat is transferred through the containment wall to the external air.
An elevated pool situated
on top of the containment
provides a gravity driven SPRAY SYSTEM
spray of cold water to
provide cooling in a
LOCA scenario. The air
flow for the cooling
annulus is generated by a STEAM
chimney-like type effect
and is a Category-B
passive safety system. The
containment vessel sprays
are a Category-D passive
safety system.
18
Fig. 8: Containment pressure reduction and heat removal using passive containment spray and natural draft air 17