Safety Design and Analysis

Training Course on
High Temperature Gas-cooled Reactor Technology
October 19-23, Serpong, Indonesia
Hiroyuki Sato
Japan Atomic Energy Agency

Safety Design Objective

The fundamental safety objective is to
protect people and the environment from harmful effects of ionizing radiation

Safety
principles
Safety
Requirements
Safety Guides

The basis for requirements and measures for the protection of

people and the environment against radiation risks and for the
safety of facilities and activities that give rise to radiation risks.
Design requirements for the structures, systems
and components of a nuclear power plant, as well as for
procedures and organizational processes that are
required to meet safety principles
Recommendations and guidance on how to comply
with the safety requirements, indicating an
international consensus that it is necessary to take
the measures recommended

p.2

Safety Requirements
Chapter Title

Requirement
#

Contents

Management of Safety in
Design

1-3

Responsibilities, Plant design management,

Safety throughout the lifetime of the plant

Principal Technical
Requirements

4-12

Fundamental safety function, Defense in

depth, Safety assessment

General Plant Design

13-42

Design basis, Safety Classification,

Design considerations, Safety analysis

43-82

Reactor core and associated features,

Reactor coolant systems, Containment
structure and confinement, Instrumentation
and control systems, Backup power supply,
Supporting systems and auxiliary systems,
other power conversion systems, radiation
protection

Design Specific Plant Systems

*Safety Requirements for Modular HTGRs proposed by JAEA

p.3

Fundamental Safety Function

Confinement of
Radioactivity

Control of
Heat Removal

Control of
Heat Generation

Low core power

density
Un-insulated RPV
Slow heat up due
to massive
graphite
components
Heat removal by
passive
conduction &
radiation

Large negative
temperature
coefficient
intrinsically
reduce reactor
power
Two independent
and diverse
systems for
reactor
shutdown

Control
Chemical Attack
Non-reacting
coolant
Limited source of
water
Graphite and
coated layer
protects fuel

p.4

Inherent Features on Radioactivity Confinement

1.0

Primary radionuclide retention

barrier in the HTGR consists of the
three ceramic coating layers
surrounding the fissionable fuel
kernel to form a fuel particle.
Fuel particles can withstand
extremely high temperature
without losing their ability to retain
radionuclides under accident
conditions.

Failure fraction [-]

0.8
0.6
0.4
0.2
0
1600

1800 2000 2200 2400

2600 2800

Temperature [oC]

* INL, INL/EXT-10-18610 (2010).

p.5

Inherent Features on Control of Heat Removal

Core
barrel

Air

Core

Inner
reflector

Side
reflector

RPV

Natural
convection

RCCS

Cavity
wall

Conduction
Radiation

Conduction

Reactor cavity
cooling system
(RCCS

HTGR can remove core heat even engineered

safety system does not work due to large
thermal capacity, high thermal conductivity
and low power density in core

p.6

Inherent Features on Control of Heat Generation

HTGR can intrinsically shut down reactor without relying on the control rod
insertion because of large negative temperature coefficient
Control rod
RPV
Natural
convection
Water
Heat
removal

VCS

Heat
removal

Primary system
Radiation

Circulator
HTTR LOFC Test

In order to demonstrated the

characteristics, LOFC test was
conducted by using the HTTR.
All circulator was stopped without
scram.
Reactor reached stable condition
by itself, i.e., only by physical
phenomena without active forced
cooling and control rod insertion.

Power (%) Flow rate (%)

Reject to atmosphere

100
50
0
30
15
0

Stop of circulator
Core flow rate Test result

Reactor power
Test result

1
2
3
4
Elapsed time (hr)

p.7

Inherent Features on Control of Chemical Attack

Helium Gas Turbine

SiC Oxidation

Reduce risk of water ingress by utilizing

helium gas turbine
Enable to eliminate water cooling system
by employing dry cooling tower due to
high temperature waste heat

Protective oxide layer may formed due to

oxidation of SiC layer with oxygen in air.

He
To dry
cooling
tower

Reactor

Helium gas
turbine

Partial pressure of oxygen (Pa)

Heat
exchangers

SiC (s) + 3/2O2 (g)SiO2 (s) + CO (g)

SiC (s) + CO (g) SiO (g) + 2C (s)
1800
105

Temperature (K)
1400

1000

Protective oxide
layer region
SiC + C
Gasification
region
SiC

IAEA, IAEA-TECDOC-784 (1995).

p.8

Defense in Depth
LWR
IAEA SSR2/1, DS462

Plants states (considered in design)

Operational states
Normal
AOO
operation
Level 1
Level 2
Conservative

design, high
quality in
construction
and operation

HTGR
- Japans
proposal

Accident conditions

Level 3

Control, limiting
and protection
systems

Engineered safety features,

safety systems and
procedures

Conditions
practically
eliminated

Complementary measures and accident

management (AM)

Plants states (considered in design)

Operational states
Normal
AOO
operation

Accident conditions (DBA)

Single failure criterion Multiple failures

[No large FP release]

Level 3a
Level 1

Level 2

Modular HTGRs

Future
modular HTGRs

Severe
accidents
No core
[including
melt
core melt]
Level 4

DEC

DBA

Level 1

Level 2

Conditions
practically
eliminated

Level 3b

Level 3
Engineered safety features
and inherent safety features

Level 4
AM

Level 3

Inherent safety features

p.9

Physical Barrier
Level of defense in depth and physical barriers shall be
distinguished.

Regardless of the redundancy or diversity of physical barriers,

the defense in depth to assure the reactor safety is applied.
Modular HTGRs
Set of barriers

Future modular HTGRs

A barrier

Confinement
Reactor coolant pressure boundary

Coated fuel particle (CFP)

Core graphite
CFP

p.10

Safety Classification
In compliance to defense in depth, Structures, Systems, &
Components (SSC) which are indispensable to achieve TRLC are
classified into the following categories with 3 classes;

Prevention System (PS)

SSCs whose failure or malfunction have the possibility to cause a
excessive amount of radiation exposure to the public outside the
site boundary
e.g. Reactor coolant pressure boundary, etc.
Mitigation System (MS)
SSCs whose function are to prevent an escalation of conditions or put
under control immediately, thereby prevent or mitigate possible
undue radiation exposure to the public or site personnel
e.g. Engineered safety features, etc.
p.11

Safety Evaluation Summary

Safety evaluation is made for the purpose of
demonstrating that safety requirements are met for
all postulated initiating events that could occur over
a broad range of operational states, including
different levels of availability of the safety systems.
There are two basic types of safety evaluation
- Deterministic safety analysis
Used to verify that design can met with
acceptance criteria.
- Probabilistic risk assessment
Used to determine the probability of damage
for each physical barrier, and evaluate the risk
that arises from low frequency sequences

Acceptance Criteria

Event Selection

Safety Analysis

The following slide will show brief procedure of safety evaluation taking the HTTR safety
evaluation result as an example
p.12

HTTR Outline
HTTR
Graphite-moderated and helium-cooled VHTR
Fuel Rods

Graphite
Block

Major specification
Thermal power
Fuel
Core material
Coolant
Inlet temperature
Outlet temperature
Pressure

Intermediate
heat
exchanger
(IHX)
Containment
vessel

30 MW
Coated fuel particle /
Prismatic block type
Graphite
Helium
395C
950C
4 MPa

First criticality : 1998

Full power operation : 2001
50 days continuous 950oC operation : 2010
Loss of forced cooling test at 9MW : 2010
Reactor
pressure vessel

Hot- gas duct

p.13

HTTR Configuration

p.14

TLRC and Plant States

Dose Limits

Criteria

Normal Operation

1 mSv of annual radiation exposure outside the site boundary

Accident

No significant risk of radiation exposure to the public*

* effective dose equivalent shall not exceed 5 mSv

Anticipated Operational Occurrence (AOO)

A postulated event does not result in core damage & the event can be put
under control with the condition which allows the resumption of normal
operation
Accident (ACD)
A postulated event does not lead to considerable core damage, that
the event does not cause, in its process, a secondary damage which
would lead to another abnormal condition, & that the function of the
barriers against the release of radioactive materials in the event is
adequate.

p.15

Acceptance Criteria for Fuel during AOOs

The coated layer of fuel shall maintain integrity during AOOs
1.0
0.8

Failure fraction [-]

Failure of coated layer observed above 2000oC

is due to degradation of mechanical strength by
thermal decomposition of SiC & internal
pressure increase because of CO & FP
production
It is estimated that impact of burnup increase
on temperature is not significant
Integrity of coated layer under 1600oC is
assured

0.6
0.4
0.2

0
1600

1800 2000 2200 2400

2600 2800

Temperature [oC]

The peak fuel temperature shall be less than 1600 oC

* INL, INL/EXT-10-18610 (2010).
p.16

Acceptance Criteria for Core during ACDs

The core shall maintain subcriticality &
coolability during ACDs
a. The fuels shall be maintained in the
graphite fuel block or sleeve
b. The structural integrity of the
graphite support structures e.g.
support posts shall prevent the core
from collapsing
Residual effective thickness at
bottom plate of graphite sleeve
shall be larger than 5 mm
Residual effective diameter of
support posts shall be larger than
80 mm

Graphite
sleeve
Fuel
compact
Bottom
plate
High
temperature
plenum block
Support
post
Coaxial
piping
p.17

Acceptance Criteria for RCPB

The material composing RCPB shall have stable strength during normal operation &
abnormal conditions
The pressure load imposed on RCPB shall not exceed the allowable limit
In case of the HTTR, acceptance criteria are determined in accordance with HighTemperature Metallic Component Design Guideline
Allowable Pressure
AOO: Allowable pressure for service condition II in MITI Notice No.501
Pressure on the RCPB shall not exceed 110% of the maximum allowable working pressure
ACD: Allowable pressure for service condition in III in MITI Notice No.501
(High temperature component refers to High-Temperature Metallic
Component Design Guideline)
(a) Pressure on the RCPB (except the IHX heat transfer tube) shall not exceed 120%
of the maximum allowable working pressure
(b) IHX heat transfer tube shall avoid creep buckling

p.18

Acceptance Criteria for RCPB

Allowable Temperature
2 Cr-Mo steel
The degradation of tension strength by thermal aging under 550oC for short time is negligible
ACD: 550oC, AOO: 500oC (50oC margin to ACD)
Austenite steel
Allowable temperature for the material in FBR component design guideline is 650oC
ACD: 650oC, AOO: 550oC (50oC margin to ACD)
Hastelloy XR
Characteristic of creep rupture under 1000oC is stable ,
Accumulated creep damage under 980oC is below the allowable limit
ACD: 1000oC, AOO: 980oC

p.19

Event Selection
Event selection is performed based on deterministic approach
Abnormal events to be postulated as AOOs & ACDs are selected based on the
investigation of main causes which affect each item of the acceptance criteria
The initiating events are identified by FMEA & classified into similar event groups
The most severe events with respect to the acceptance criteria within each similar event
group are selected as representative events
Occurrence frequency of representative events are examined in order to confirm the
adequacy of above event selection
Evaluation item

Core
damage

Event Sequence
Increase of
fuel temp.

Reactivity
addition

Loss of core
support

Graphite
corrosion

Abnormal Events
Abnormality of reactivity
control system
Air ingress
Water ingress
p.20

General Procedure
Input

Safety Design

Design Database

Core Design

SSC Design

Safety Analysis

Acceptance
Criteria
Output

Safety Analysis Report

p.21

Safety Analysis Code

Evaluation item related to acceptance criteria, e.g. peak fuel temperature, RCPB
temperatures, etc. are analyzed by safety evaluation codes
In case of the HTTR, following codes were used
Codes
BLOOST-J2
THYDE-HTGR
TAC-NC
RATSAM6

Objective
Obtain transient response of fuel during abnormal events related to RI
Obtain transient response of plant during abnormal events
Obtain transient response of reactor temperature during DLOFC accidents
Obtain shear force stress during DLOFC accidents

COMPARE-MOD1

Obtain transient response of pressure & temperature in CV during DLOFC

accidents

GRACE/OXIDE-3F

Obtain oxidation rate of graphite materials by intruded air or water during

related accidents e.g. DLOFC accident or PPWC tube rupture, etc.

FLOWNET/TRUMP Obtain fuel & block temperature during channel blockage accidents
HTCORE
PLAIN

Obtain release rate of FP from core after the occurrence of accident

Obtain distribution of FP plateout in primary loop during nominal operation

Y. Shiina et al., JAERI-M 90-034 (1990).

H. Mikami et al., JAERI-M 88-256 (1988).

K. Sawa et al., JAERI-M 91-198 (1991).

p.22

Calculation Condition (1/2)

Initial process values are set based on rated condition of high temperature operation
mode with errors estimated in the operation
Rated condition

Safety Design Evaluation

Reactor power

100% (30MW)

102.5% (30.75MW)

Reactor outlet temp.

950oC

967oC

Reactor inlet temp.

395oC

397oC

Primary loop pressure

41 kg/cm2

42.5 kg/cm2

Reactor outlet temperature variation during operation is determined using the following
expression
Tout 2= (Stability of Tin) 2 + (Tout Tin)2 x {(Error of P) 2 + (Error of F) 2 }
Tout : Reactor outlet temp., Tin: Reactor inlet temp., P: Reactor power, F: Reactor flow rate

p.23

Calculation Condition (2/2)

The parameters for the safety design evaluation shall be specified such that they give
conservative result to a reasonable extent in view of the objective of the analysis
- Thermal conductivity of graphite, emissivity, temperature coefficients ,
CR insertion curve, reactor kinetic parameters, flux skewing
The SSC belongs to MS-1 & MS-2 specified in safety design are allowed to be taken into
account in the safety design evaluation
- MS-1: CR, ACS, VCS, CV, EG, Emergency purification system, etc.
- MS-2: Stack, post-ACD instrumentation, etc
A single failure of a component or within a system which is designed to cope with an
accident shall be assumed in addition to postulating an initiating event for assessment
- Stop of one of two AGC, Malfunction of one of two system in VCS,
Malfunction of one of two system in emergency purification system, etc
The analysis of an accident shall take into account unavailability of off-site power if
functions of the engineered safety features are expected
- ACS starts after 60 s elapsed from event initiation
p.24

Representative Events
Challenges to core heat removal
Pressurized loss-of-forced circulation (PLOFC) accident
Depressurization loss-of-forced circulation (DLOFC) accident, etc.
Challenges to control heat generation
Accidental control rod withdrawal
Station blackout without trip, etc.
Challenges to control chemical attack
Air ingress due to helium coolant pressure boundary leak/break, etc.
Water ingress due to boundary leak/break in water cooler
External hazards
Earthquake, Hurricane, etc.
p.25

DLOFC Accident Initiating Event

Rupture of
concentric pipe in
primary cooling
system

p.26

DLOFC Accident Sequence

Rupture of primary co-axial piping
Evaluation items related to
acceptance criteria, e.g. peak
THYDE-HTGR
Release of primary coolant into CV
fuel temperature, RCPB
temperatures, etc. during
Depressurization of
Release of coolant
RATSAM6
Depressurized Loss-of-Forced
primary loop
mass & energy into CV
Circulation (DLOFC) accidents
are analyzed by codes
Pressure &
Reactor scram
corresponding to their
temperature increase COMPAREMOD1
capability
in CV
Dose evaluation for DLOFC is
Equalization of
pressure
between
NC in reactor
conducted by using
reactor and CV
temperature response of core
Oxidation of
& shear force ratio in primary
CV
cooldown
Core heat removal
graphite
loop obtained in the above
by VCS
component
GRACE
analysis

TAC-NC

Core cooldown

CV pressure &
temperature
decrease

Oxidation becomes
negligible due to
core cooldown
p.27

Removable reflector

VCS

RPV

Core

Permanent reflector

2D (R-Z) finite element

temperature analysis code TAC-NC
is used to obtain temperature
response of fuel & RPV
Decay heat is considered in the
core (CR insertion is assumed)
NC from core to the flow path
between RPV and permanent
reflector is considered
NC in cavity is neglected
VCS panel temperature is set as
boundary condition (90oC)
Oxidation heat is neglected
Conservativeness are taken into
account for initial conditions,
thermal properties & emissivity
Air intrudes into core by NC

Removable reflector

DLOFC Analysis Model

Carbon block

R-Z Finite Element Model for Transient Simulation

p.28

Radiation Path in DLOFC Accident

External and internal exposure
from radiation cloud
Skyshine gamma-ray exposure

Radiation
cloud

Direct gamma-ray exposure

Emergency
ventilation
system
RPV

Circulating
activity in PCS

Lift off of
plated-out FP
Primary
cooling
system
(PCS)

Leakage

FP release (Immediate release)

FP release
from fuel
matrix

FP release (Delayed release)

Radiation exposure

Containment Vessel

Reactor building
p.29

DLOFC Simulation Results (1/2)

Oxidation of support post
is larger than graphite
sleeve since the air
contact with the support
post during the early stage
Peak fuel temperature does not exceed
initial temperature due to small power
density
Peak RPV temp is close to limit due to NC

K. Kunitomi et al., Nucl. Eng. Des., 233, 235-249 (2004).

p.30

Pressure (kg/cm2)

DLOFC Simulation Results (2/2)

Acceptance criteria

Reactor scram
Elapsed time (s)

Peak CV pressure is close to limit

However, increase in CV volume needs careful
consideration since CO concentration is close to limit

JAEA, JAEA Oarai R&D center Reactor installment licensing application document [Supplementary volume 3 HTTR].

Flammable range
Detonation range

p.31

Water Ingress Accident Initiating Event

Rupture of heat
transfer tube in
water cooler

p.32

Water Ingress Accident Sequence

Though the pressure of
pressurized water loop
(3.5MPa) is lower than
primary loop (4.0MPa), it is
assumed that the ingress of
water immediately occurs
after the rupture of heat
transfer tube
Amount of water ingress into
primary loop is performed by
hand calculation considering
pumping by feed water pump
& gravity
Amount of water ingress into
core is calculated considering
accumulated heat in SG
structure & profile of primary
loop flow rate

Rupture of PPWC heat

transfer tube
Reactor scram, PPWC
pump stop
Water ingress into
primary loop

ACS startup
THYDE-HTGR

Core cooldown

Water ingress into core

OXIDE-3F
Oxidation of
graphite
component

Oxidation becomes
negligible due to
core cooldown

p.33

Water Ingress Simulation Results

Pressure [kg/cm2]

Temperature [oC]

Primary coolant pressure

Peak fuel temperature

Reacted water with

graphite is considerably
smaller than amount of
water ingress into
primary loop because of
IVs actuation & GC stop
Reactor power does not
increase due to large
shutdown margin
Safety valve of primary
loop does not open
No FP release into CV

Elapsed time [min]

Water ingress into primary loop

175 kg

Oxidized graphite

44 kg

S. Saito et al., JAERI-1332 (1994).

p.34

Major Results of Abnormal Events

Evaluation items

Event

Results

Fuel temp.

Leakage in inner pipe of concentric pipe

1715oC

RPV temp.

DLOFC events

530oC

RCPB pressure

Rupture of inner pipe of concentric pipe in primary

cooling system

45.9
kg/cm2

PPWC tube temp.

Rupture of pipe in pressurized water cooling system

368oC

IHX tube temp.

Rupture of inner pipe of concentric pipe in secondary

cooling system

956oC

CV pressure

Rupture of concentric pipe in primary cooling system

4.7 kg/cm2

Graphite oxidation

Rupture of concentric pipe in primary cooling system

3.6 mm
(Sleeve)

Effective dose rate

Rupture of concentric pipe in primary cooling system

1.5 mSv

JAEA, JAEA Oarai R&D center Reactor installment licensing application document [Supplementary volume 3 HTTR].

p.35

Radionuclide Transportation in HTGR

Reactor building (RB)

Normal
operation

RCPB
Plate-out on RCPB
Fuel element

Dust sorption

ACD
Release to
environment

Release to building

Lift off
Plate-out on RB

Removal by
Purification system

p.36

Plate-out on RCPB
Circulating FP in primary loop deposits
on RCPB Plate-out.
The deposited FP becomes radiation
source for worker does in maintenance.
A part of deposited FP departures from
RCPB in case of ACD
The mechanism of plate-out can be
classified in to the following:
- Mass transfer from coolant flow to wall
proximity region of RCPB
- Adsorption and desorption equilibrium
between wall proximity region and RCPB
surface
- Diffusion in RCPB
- Sublimation from RCPB to coolant

Mass transfer
region
RCPB
FP concentration
Sublimation
Coolant
flow
Diffusion
Mass
transfer

Adsorption
desorption
p.37

Plate-out Experiments
Country

Facility

FP

Material

Condition

GBR

Dragon

Cs, Sr, IAg

DEU

AVR/VAMPYR-I

Cs, Sr, Ag, I

Ti, 15Mo3, 4541, 4961,

FP plate-out considering dust effect, 850-900oC, Laminar
ST35.8, 10CrMo910

DEU

AVR/VAMPYR-II

Cs, Ag, I

Incoloy800, Inconel617 FP plate-out considering dust effect 400-850oC, Turbulent

DEU

SCAFEX

Cs, Sr, I, Ag

DEU

LAMINAR

Cs, I

Incoloy800, Inconel617,
FP plate-out, 300-900oC, Re:6000-10000
10CrMo910, 15Mo3

FP plate-out

FP plate-out, 100oC-350oC, Re:1500-4000

FRA

PEGASE/SAPHIR

Cs

15Mo3, 4541,
Nimocast713LC,
Inconel625

FRA

PEGASE/CPL-2

Cs, I

Incoloy800, Hastelloy B,
FP plate-out, 350-750oC,
SS347, SS410, T22

FRA

SILOE/COMEDIE

Cs, Co, I, Ag,

Te,Cr

Incoloy800, Hastelloy X,
FP plate-out, 600-835oC, 16-45g/s
SS AISI 347

JPN

JMTR/OGL-I

Cs, I

SUS, Hastelloy X

FP plate-out, RT-950oC, 10-60 m/s

USA

GAIL

Cs, Sr, I

1/2Cr 1/2Mo

FP plate-out, 90-500oC, Re:12000

USA

Peach Bottom Unit1 Cs, Sr, I

FP plate-out

USA

Fort St. Vrain

FP plate-out

Cs, Sr

FP plate-out, 585-970oC, 11-13g/s

p.38

Evaluation for Plate-out FP

Plate-out activity on the
circulator in Fort. St. Vrain was
radiochemically examined at
General Atomics.
Generally, the comparison
between prediction and test
data are in good agreement.
(Over prediction in Cs-134 by
factor of 2, Underprediction in Cs137 by factor of 1.4)

IAEA, IAEA-TECDOC-978 (1997).

p.39

Removal in Purification System

A part of circulating FP is removed by purification system
CCT and PCT removes Kr and Xe, as well as I, Br, respectively
Filter

Heater
Filter

Heater

Pre charcoal
trap (PCT)

Oxide copper
bed

Molecular sieve
trap

Cold charcoal trap

(CCT)

N. Sakaba, Nucl. Eng. Des., 233, 147-154 (2004).

p.40

Lift off from RCPB

FP departure
from RCPB
Chemical desorption
FP
concentration
decrease

Temperature
increase

Physical departure
Moisture increase

Failure in heat
transfer tube

Coolant leakage

Failure in piping

O
H H

Lift force

H
O

Coolant
flow

Increase in velocity

Drag force

RCPB
p.41

Release to Confinement
RCPB leakage or RCPB failure
The following FP is released to confinement
on reactor coolant
a. Circulating FP in primary loop
b. FP detached from RCPB
c. FP adsorbed in dust

FP
Safety
valve

SG

Tube rupture in SG
According to the amount of water and
steam intruded in primary loop, FP is
released to confinement through safety
valve.
Reactor

Confinement
p.42

Release to Environment
Released FP from
primary loop

FP accumulated
in core

Confinement
A part of FP is deposited on the
confinement surface
Velocity is the dominant parameter
because of the large velocity in case of
rupture in RCPB

Released
from stack

Leakage in
confinement

Environment
p.43