1. Introduction
Decarbonization of energy production has become a central issue in today’s societies. Nuclear energy holds an essential place in this prospect. Besides heavy-duty electricity production, other industrial and communal needs could be served by integrating novel nuclear energy production systems, among which are low-power nuclear devices, like small modular reactors (SMRs).
The ELSMOR (towards European Licensing of Small Modular Reactors) project addresses this topic as an answer to the Horizon 2020 Euratom NFRP-2018-3 call (“ELSMOR Official Website”, http://www.elsmor.eu/about/). The consortium includes 15 partners from eight European countries, involving research institutes, major European nuclear companies and technical support organizations. The 3.5-year project, launched in September 2019, investigates selected safety features of light-water (LW) SMRs with focus on licensing aspects.
SMRs promise a number of innovations in the domain of nuclear power. Such innovations may, for example, improve the speed of building and commissioning and the costs of the projects through the use of common and standardized designs, enabling series production. They may also bring technical benefits, such as increased autonomy and the possibility to extensively use passive safety features within the plant, which may be a safety asset.
In this context, one of the goals of ELSMOR is to create methods and tools for the European stakeholders to assess and verify the safety of LW-SMRs to be deployed in Europe. Providing a comprehensive compliance framework that regulators can adopt and operate, the licensing process of such SMRs could be optimized, helping their deployment.
2. Project structure and progress
Activities have been thematized in 7+1 work packages (WPs), seven targeting different topics of SMRs and their specific safety features relevant for safety analyses, and one WP dedicated to project coordination. For demonstrative purposes, the main features of a new European SMR (E-SMR) design have been drafted in WP number 5.
This article will focus on the work performed in WP number 2. This work gives an overview of the specific issues that LW-SMRs may bring about in the different domains of nuclear safety, in terms of:
Methodological standpoints: safety goals, safety requirements, safety principles (mainly defense-in-depth implementation, see: https://www.iaea.org/publications/4716/defence-in-depth-in-nuclear-safety);
Main safety functions of reactivity control, decay heat removal (DHR) and confinement management;
Severe accident (SA) management;
Other safety issues particular to SMRs: use of shared systems, performing of multi-unit probabilistic safety assessment (PSA), spent fuel management, transport and disposal.
Considering these safety domains, a set of safety requirements to be fulfilled by a LW-SMR in the prospect of its licensing in a European country was established. For these requirements, the aim of the project was to cover the most structuring safety domains of nuclear safety. To tackle the identified safety issues, safety methodologies were studied or developed, and applied to case studies. Consequently, the results of WP2 should provide efficient tools for the licensing of the various LW-SMRs designs to be deployed in Europe.
An exhaustive compilation of the safety conclusions made in this work is available (see: ELSMOR Deliverable 2.12: Synthesis: summary of methodology recommendations for LW-SMR safety assessment – S. Lansou, December 2021, available at: https://www.elsmor.eu/wp-content/uploads/2023/06/ELSMOR_D2_12_signatures.pdf). In the present article, the main outcomes are presented.
3. State-of-the-art of ongoing LW-SMRs safety assessment and of ongoing LW-SMR concepts
To contextualize the work performed in WP number 2, a synthetic state-of-the-art of ongoing LW-SMR safety assessment and concepts will be given. It is based on the work realized by ELSMOR partners in WP number 1 (see: ELSMOR Deliverable 1.1: Improved safety features of LW-SMR – S. Buchholz, M. Ricotti, O. Martin, N. Thuy, C. Lombardo, A. Kornytskyi, N. Playez, S. Israel, A. Kaliatka, December 2021, available at: http://www.elsmor.eu/wp-content/uploads/2020/06/D1.1-Improved-safety-features-of-LW-SMRs.pdf).
3.1. State-of-the-art of ongoing LW-SMRs safety assessment
Nuclear safety directives and good practices on safety assessment of LW-SMRs have been reviewed in terms of special regulations regarding LW-SMR. This review was based on information from:
European safety directives,
IAEA guidelines,
WENRA (Western European Nuclear Regulators' Association) guidance,
ENSREG (European Nuclear Safety Regulators Group) guidance,
National rules and regulations on selected EU and non-EU (Canada, Russia, USA) countries that are currently in an SMR licensing process.
Some of the main documents reviewed are listed in references 1 to 18–20 and 21. The complete list of references reviewed can be found in ELSMOR Deliverable 1.1.
The main conclusion of this review is that it has showed that the existing regulation can also be applied for LW-SMRs:
The EU safety directives establishes a high-level framework, in which the member states can develop their own regulations. This framework is technology neutral.
Within the IAEA regulations, no explicit guidance for SMRs is given, but the current documents reviewed can be applied to LW-SMRs.
WENRA guidance can be applied to LW-SMRs, in particular the objectives given in 20: low frequencies for accident without core melt, practical elimination for accident with core melt (or implementation of measures to limit consequences), independency of DiD levels and radiation protection under the concept of ALARP (as low as reasonable possible).
Statements and/or special requirements regarding SMRs have not been found in the ENSREG documents. However, ENSREG guidance reviewed can be applied to LW-SMRs.
The national nuclear rules and regulations of the considered countries are also applicable for LW-SMRs. In France, Germany and Lithuania, the national regulation can apply and there is, to date, no specific requirements for design, commissioning, and operation specific to SMRs. It was noticed that in the US, the regulations are more prescriptive. This may be a problem for licensing an SMR. In this case, design specific reviews can be performed, which is unpractical when a large number of designs need to be assessed. For example, the US NRC had to develop a Design Specific Review Standard for the US LW-SMR project NuScale2. This document outlines the sections of the safety review process that are different because of design specificities of NuScale compared to a large-scale reactor. There is a combination of areas of reduced scope review (auxiliary systems, offsite power, etc.) and areas where the review is augmented (containment integrity, reactor systems, etc.). Therefore, the regulations will be modified with the development of a new framework for regulatory processes for advanced reactors, through a Licensing Modernization Project (LMP): a systematic and technology-neutral process for, in particular, identifying “licensing-basis” events and classifying SSC.
3.2. State-of-the-art of ongoing LW-SMR concepts
A number of SMRs on an advanced development stage have been reviewed by the ELSMOR project using publicly available materials like conference or journal papers, documents of IAEA and data provided by project partners. The resulting SMR descriptions obtained include a general technical description of the SMR concepts as well as descriptions regarding the safety systems. Figure 1 lists the SMR designs screened. The designs have been screened regarding the following items: reactivity control, decay heat removal, containment integrity, decommissioning, spent fuel management, transport and disposal, multi-unit site and sharing of systems issues, severe accident management and emergency planning, operation and human factors. This review was a base for the activities performed in WP number 2 to identify the main LW-SMRs design-related safety issues and to provide subsequent methodology recommendations for their safety assessment.
Figure 1. Screened SMR designs, alphabetically ordered.
(ELSMOR Deliverable 1.1: Improved safety features of LW-SMR – S. Buchholz, M. Ricotti, O. Martin, N. Thuy, C. Lombardo, A. Kornytskyi, N. Playez, S. Israel, A. Kaliatka, December 2021, available at: http://www.elsmor.eu/wp-content/uploads/2020/06/D1.1-Improved-safety-features-of-LW-SMRs.pdf).
4. Methodology recommendations for LW-SMR safety assessment
4.1. Recommendations related to high-level safety methodologies used for licensing
SMRs’ innovative features may lead to adaptations in the way some safety principles and approaches (in particular WENRA) technologically neutral safety requirements) can be applied. The existing framework should still constitute the basis of the safety demonstration. Adequate methodologies should be developed to evaluate the application of the framework with respect to SMRs specificities. The main concerned subjects are: Defense-in-depth (DiD) implementation, severe accident, limitation of radiological consequences for accidents without and with core melt, resistance to hazards, autonomy of the plant and approaches for practical elimination of situations leading to large or early releases.
In this context, a set of high-level requirements to be fulfilled by LW-SMRs for their deployment in Europe was developed. These requirements are in line with international and European safety guidelines (International Atomic Energy Agency (IAEA), WENRA, European Nuclear Safety Regulators Group (ENSREG)). They account for SMR specificities and they can help the designers to adopt specific design features limiting national specificities, thus spurring the licensing process. These requirements are presented in Table 1 (single-unit requirements). In addition, requirements accounting for the plant modularity have been established. The term modularity is used as reference to the fact that several reactors, hereafter called modules, are part of a same installation and sharing some elements (support systems, reactor building, etc.) which involves the consideration of possible interactions between them, either directly (hazard generation) or indirectly (through the failure of shared common systems). Requirements are presented in Table 2 (multi-unit requirements). The requirements described in these tables are the ones to which it was estimated that the reader should point his attention at, as they concern key SMR-related elements. However, in the frame of the work performed, a total of 35 requirements were written, see ELSMOR Deliverable 2.1: LW-SMRs main safety goals - N. Playez, E. Courtin, L. Ammirabile, S. Israel (https://www.elsmor.eu/wp-content/uploads/2021/12/ELSMOR_D2_1__final_signed.pdf).
Table 1. High-level requirements to be fulfilled by light-water small modular reactors (LW-SMRs).
Single-Unit requirements. Acronyms used in the table – DiD: Defence-In-Depth, SMR: Small Modular Reactor, EPZ: Emergency Planning Zone, DBC: Design Basis Conditions, DEC-A: Design Extension Conditions without core melt, DEC-B: Design Extension Conditions with core melt.
| Domain | Requirement | Points of attention related to small modular reactors (SMR) designs | Higher safety goal reference |
|---|
| Defense-in-Depth (DiD) | DiD progressiveness and sufficient independence between DiD levels | Small modular reactors (SMR) tend to use passive systems. In such case, passive systems and SMRs safety characteristics are expected to provide alternative means to justify a sufficient independence between the different levels of DiD.
In particular, such demonstration could rely on the combination of passive, active systems and SMR safety characteristics.
However, these technologies address new challenges:
• no or limited operational experience;
• uncertainties concerning their qualification and reliability assessments;
• related operational aspects as periodic testing, maintenance and in-service inspections should be further studied. | IAEA SSR2/11, INSAG-1022, GENIV BSA23, WENRA, SO1-SO320 |
| Forgiving DiD and grace time | Some SMR designs may give the opportunity to provide an enhanced forgiving defense thanks to a more favorable ratio between power and water inventory or broader operating margins. This must be justified. | Same as above |
| Emergency Planning Zone (EPZ) | SMRs features may contribute to a reduction of the size of the EPZ through the reinforcement of the safety demonstration and the resulting potential reduction of the radiological releases. | IAEA SSR2/11, INSAG-1022, GENIV BSA23. |
| DBC (Design Basis Conditions) | List of DBCs | Some events are excluded in the design of SMRs (e.g., large breaks on primary loops for integrated SMRs). However, any exclusion should be drastically justified.
Moreover, the introduction of new events challenging the plant safety functions by SMRs specificities should be accounted for. | WENRA SO220
WENRA PO1, PO221 |
| DEC-A (Design Extension Conditions without core melt) | Types of DEC-A | Deterministic failure of SMR passive safety systems used for the limitation of DBC consequences should be considered as a DEC-A situation since they are not failure proof. | WENRA SO220
WENRA PO321 |
| DEC-B (Design Extension Conditions with core melt) | Severe accident is postulated | The severe accident defined as the whole core melting accident must be considered and mitigated by DiD-level 4 measures.
Indeed, despite scale and power reduction, the whole core melting accident remains physically possible if the fuel elements are not drastically modified (as compared to conventional cores). Excluding the whole core melting accident can only rely on physical impossibility. | WENRA SO320
WENRA PO121
|
| Independence of DEC-B safety features | For an SMR passive system, the claim of its high reliability cannot be enough to justify its use in all levels of DiD. To do so, only the physical impossibility of the function failure suffices. | WENRA SO420
WENRA PO2, PO421 |
| Plant Autonomy | Autonomy of the electrical power supply and of the heat sink | This requirement must be verified considering the modularity of the plant. Conditions affecting several units or the fuel assembly storage pool (or both simultaneously) require a particular attention. | IAEA SSR2/11 |
| Autonomy and external intervention | SMRs could be settled in remote regions, resulting in longer time for external resources to be provided. This should be accounted for in the safety demonstration. | WENRA PO621 |
Table 2. Requirements accounting for the plant modularity.
Multi-unit requirements. Acronyms used in the figure: CCF: Common Cause Failure, DiD: Defence-In-Depth, DBC: Design Basis Conditions, DEC-A: Design Extension Conditions without core melt, DEC-B: Design Extension Conditions with core melt, SMR: Small Modular Reactor.
| Domain | Requirement | Points of attention related to small modular reactors (SMR) design | |
|---|
| DBC (Design Basis Conditions) | Impact of an event on several units | The plant modularity implies the possibility, for an initiating event, to impact several units. This issue must be considered in DBC analysis. | WENRA SO220
WENRA PO1, PO221 |
| DEC-A (Design Extension Conditions without core melt) | Multi-unit Common Cause Failure (CCF) from a common initiating event | It is required to treat as a DEC-A any CCF event impacting the DBC features of several units. | / |
| Initiating multi-unit CCF | It is required to treat a CCF on independent safety normal operating systems of several units as a DEC-A. | / |
| Hazards | Propagation of hazards | Propagation of an internal hazard from a unit to another should be prevented. This should be accounted for in the safety demonstration. | WENRA SO120 |
| Extreme hazards on several units | The occurrence of an extreme external hazard (post-Fukushima situation) may impact all units of the plant. Large or early releases should be prevented by prevention and/or mitigation of fuel damage. | WENRA SO320
WENRA PO621 |
| Multi-unit requirement | Systems shared among units | The safety demonstration should be provided for each unit, independently of others.
Shared systems between units may impact the safety of the plant.
The use of a system on a unit should not impair its capability to perform its safety function for other units when needed. |
In addition, a safety assessment methodology was developed to assess the safety of innovative reactors designs (Figure 2). It can contribute to the safety assessment of LW-SMRs. This methodology is accompanied by methods, appropriated from various methodologies, in particular:
Figure 2. ELSMOR safety assessment methodology.
(see ELSMOR Deliverable 2.2: Overview of safety methodologies for innovative reactor designs and proposal of a general methodology for LWSMR - L.Ammirabile, S.Buchholz, T. Nguyen, December 2020, available at: http://www.elsmor.eu/wp-content/uploads/2021/12/ELSMOR_D2.2_report_final.pdf). Acronyms used in the figure – DiD: Defence-In-Depth, V&V: Verification and Validation.
Integrated Safety Assessment Methodology (ISAM) developed by the Gen IV International Forum's Risk and Safety Working Group (GIF RSWG)),
INPRO methodology (Safety part),
SARGEN_IV methodology,
HARMONICS methodology.
A description of these methodologies and links to their associated bibliographic references are provided in ELSMOR Deliverable 2.2: Overview of safety methodologies for innovative reactor designs and proposal of a general methodology for LWSMR - L. Ammirabile, S. Buchholz, T. Nguyen, December 2020 (http://www.elsmor.eu/wp-content/uploads/2021/12/ELSMOR_D2.2_report_final.pdf). The complete algorithm of the ELSMOR safety assessment methodology developed is illustrated in Figure 1.
As part of this general ELSMOR’s methodology, a flexible, non-accident specific methodology, called Graphical Independence of DiD assessment (GID), has been developed for subsequent safety demonstration. GID may be used during conceptual design phases. The method provides the functions and sub-functions that have to be enabled to ensure the fundamental safety functions in all plant states. This allows the checking of independence between the main systems involved in the performance of these functions at various DiD levels. In this way, GID was applied to the heat removal function of the E-SMR (WP5) in power operation.
4.2. Recommendations related to the implementation of the main safety functions by the LW-SMR
In the context of the safety assessment of a nuclear reactor, three fundamental safety functions should be controlled for the reactor, for all its plant states (power operation, hot shutdown, cold shutdown, including refuelling operations) and for all levels of DiD: the control of the reactivity, the heat removal and the confinement of radioactive materials. The safety requirements related to these functions in various countries were studied and their applicability to LW-SMRs was verified.
4.2.1. Reactivity control. In large pressurized water reactors (PWR), safety criteria related to reactivity control are satisfied by inherent fuel characteristics, by the control rods and the boric acid injection system in the primary water.
For SMRs, the reactivity control should also rely on the same inherent fuel characteristics and mainly on control rods (CR), particularly for boron-free designs (this design decision may be driven by economics and depends on the plant power level). Thus, the control of the geometry of the fuel assemblies is essential: distortion, bowing, damages due to mechanical forces/stress should be considered. Criticality events due to maintenance issues are also of concern in this context.
Uncertainties associated with the design of SMRs CRs should be assessed. It is needed to justify the CR insertion in case they are credited, in particular in loss of coolant accident (LOCA) scenarios, as LOCAs can induce distortion of the core barrel and misalignment of CRs.
For SMRs, the CRs insertion rate by gravity drop in case of SCRAM could be an issue, because of two factors: the limited height of the core and the limited weight of the CRs themselves. These two factors, influencing non-linearly the mechanical friction resistance, the fluid resistance, and the fluid-solid coupling, resulting in the interaction between gravity, buoyancy, and friction, might lead to an overall decreased speed of insertion with respect to that of large PWRs. The speed of insertion by gravity drop should therefore be carefully evaluated both in the design phase and in the safety assessment for licensing.
Concerning the redundancy and diversity of shutdown systems, IAEA SSR-2/1 states that “The means for shutting down the reactor shall consist of at least two diverse and independent systems.” and that “At least one of the two different shutdown systems shall be capable, on its own, of maintaining the reactor subcritical by an adequate margin and with high reliability, even for the most reactive conditions of the reactor core.”1. In this regard, SMR designs tend to rely mainly on CRs as the first shutdown system and implement as a second one the fast injection of boric acid into the primary system by either active or passive driving forces. Considering the borication system, special attention should be paid to the long-term stability of the correct boron concentration.
For some SMRs, the cancelation of the use of boron (completely or partially) for the control of the reactivity in normal operation is proposed. For SMRs relying on burnable neutron poisons (rather than on a borication system), IAEA’s SSG-522 requests the evaluation of the effects of a depletion of burnable absorbers on the core reactivity to ensure an adequate shutdown margin in all resulting applicable core conditions throughout the operating cycle. Such designs have several advantages from a safety aspect. The elimination of certain accident scenarios is possible (boron dilution). The operational flexibility is improved (no dilution time during operation, simplification of the maintenance, reduction of effluent wastes). The radioprotection is improved as well (reduction of up to 1/3 of the tritium production). However, certain safety issues have to be tackled in the safety demonstration: the disappearance of a redundant reactivity control system and the increased reliance on CRs (necessary to increase the effectiveness of the CRs: use of particular absorbing materials, an increase of the number of CR pins or of CRs). Consequently, there may be a potential need to exclude rod ejection by the use of innovative solutions. A faster depletion of CRs due to their increased exposure to neutrons may require more frequent inspections. The degree of reliability of innovative systems will have to be proved, experimental data being necessary. Moreover, attention should be paid to some potential situations in which the shutdown margin would not be sufficient to prevent some recriticality after shutdown in the long term (i.e. in cold shutdown).
4.2.2. Decay heat removal (DHR). The following recommendations have been established to ensure a robust safety demonstration of the DHR function.
The reliability of passive DHR systems has to be demonstrated. Methodologies devoted to their reliability assessment have been developed in the frame of European R&D activities and of EURATOM projects (see 24, available at: https://www.frontiersin.org/articles/10.3389/fenrg.2014.00040/full and 25, available at: https://www.sciencedirect.com/science/article/pii/S0149197021004133). All types of failures should be considered in DHR safety systems (single, passive, functional and common cause failure (CCF)). In particular, specific failure modes for passive safety systems are identified in the reliability assessment methodologies. They refer mainly to thermohydraulic failures, leading to functional failures. For example, a degradation of heat transfer capabilities or pressure drops in the heat exchanger tube bundle, may lead to fluid dynamic instability and oscillating/reduced flowrate, inducing a functional degradation in terms of released thermal power to the heat sink. These passive systems may be subject to spurious actuation and this should be accounted for (this is not related to their passive character).
Passive decay heat removal systems (DHRS) are subject to a two-phase flow thermohydraulic operation. Hence the thermohydraulic codes used for their simulation need to be qualified for several related phenomena, in particular: natural circulation in the passive loop and in the water pool, subcooled nucleate, saturated boiling or condensation on the tube or plate walls (in-tube, ex-tube, within plates) of the heat exchangers and effects of non-condensable gases. Input data must be properly considered as the range of conditions necessary to perform the safety function could be narrow for passive systems, especially when associated with uncertainties in the model correlations, in the initial conditions and in the boundary conditions (see 19, available at: https://www.wenra.eu/sites/default/files/publications/rhwg_passive_systems_2018-06-01_final.pdf).
4.2.3. Confinement. The following recommendations have been established to ensure a robust safety demonstration of the confinement function.
4.2.3.1. Passive heat removal through containment wall
For NUWARDTM-type designs, the containment vessel is submerged in a large water pool. In some accident conditions, inflowing steam is condensed on the containment inner wall and heat is transferred into the pool. Consequently, the only element available to control the pressure inside the containment during a LOCA is the condensation on the containment wall and the resulting heat transfer to the pool.
The containment integrity must be ensured, despite overpressure, under-pressure or thermal loads.
It must be demonstrated that for all kinds of accidents, in particular LOCA and main steam line breaks (MSLB) the heat transfer into the large water pool is sufficient to keep containment integrity. This includes the effect of non-condensable gases on the condensation heat transfer. The more compact containment design of SMRs comes with the potential for more severe and possibly faster overpressure transients; however, the exclusion of a large break from the design reduces short-term loads.
4.2.3.2. Impacts of earthquakes
The impact of large pools on the resistance of the plant toward earthquakes is an issue. Seismic waves will induce oscillations of the water pool outside the containment. At the same time, seismic waves will be transferred to the containment vessel via its connection to the ground plate, which may be in phase with pool oscillations. A detailed analysis should expose occurrence of peak loads to containment structures that may challenge its leak-tightness. On the pool side, it should be demonstrated that there is no unacceptable loss of pool inventory for containment cooling due to earthquakes so that the pool remains available as a heat sink in case of design basis conditions (DBC) and design extension conditions (DEC) scenarios.
4.2.3.3. Wetwell/pool
Certain designs (e.g., Flexblue, CAREM) present a containment composed of several separate compartments (wetwell and drywell). In this case, transport processes of non-condensable gases can lead to their accumulation in specific compartments, affecting local temperatures and pressures. This can pose specific challenges for the operation of passive heat removal systems and induce heat and pressure loads to the containment.
4.3. Issues related to severe accident management
Extreme physical conditions such as the one the facility may encounter during a severe accident (SA) should be considered in the safety assessment. The aim is to verify that the facility can perform its functions despite such extreme conditions. It is expected that the low power of SMRs does not question the major principles established for the safety demonstration regarding SA management for large PWR. SMR-related issues are highlighted in the following paragraph.
Objectives should be defined in terms of potential impacts between units and on populations in case several units are involved. Referring to SA scenarios, an ELSMOR emergency planning zone (EPZ) assessment methodology was developed for SMR multi-unit plants (see 26, available at: https://www.sciencedirect.com/science/article/pii/S0029549321003198). For the E-SMR, the full-scope determination of EPZ distances for the E-SMR was performed using the output data of the DEC analyses in WP5.
SMRs extensively rely on passive systems for the prevention and mitigation of core melting (e.g., passive in-vessel corium retention by ex-vessel cooling, external flooding of the reactor pressure vessel (RPV) from water tanks, etc.). In this regard, the difficulty of assessing the reliability of passive devices, particularly in the context of design extension conditions with core melt (DEC-B) scenarios (extreme and widely varying conditions) has been highlighted. Consequently, a set of requirements on the credit of passive systems for DEC-B scenarios has been established. These requirements mainly concern the need for:
A demonstrated reliability of the passive systems in extreme DEC-B conditions. These systems should be designed for boundary conditions including high or extreme pressures and temperature fields. These systems must be demonstrated to reliably achieve their missions over the full range of conditions they are likely to experience with robust demonstration. It should be demonstrated that there are no cliff-edges near the mission envelope and adequate safety or margins should be achieved by design.
The ability of operators to deal with these systems: severe accident dedicated safety provisions must have the necessary instrumentation to get the essential information to the operators, limiting the missing information about the system status or abilities. This instrumentation should be designed according to the DEC-B physical conditions and support operators with suitable human machine interfaces (HMI).
To the extent possible, passive systems used in DEC-B should be tested under realistic severe accident conditions.
The use of innovative equipment for SMRs and their associated issues regarding DEC-B sequences management has to be considered (integrated design, compact containment, alternative cladding and fuel material, boron-free coolant).
The limits of the tools and codes used in Europe for SA calculations are of concern, especially regarding particular phenomena: debris beds formation, cooling, melting, crust formations, steel relocation paths, etc.
SMRs tend to adopt a severe accident management strategy based on in-vessel melt retention (IVMR). In this regard, safety requirements were established:
Molten corium retention: the realistic thickness of the metallic layer on a corium pool in the lower plenum should be known and its limited impact on the RPV be demonstrated.
Reactor pit flooding: to realize IVMR strategy, the outer RPV wall has to be flooded with water. Sufficient water sources in the containment and the RPV have to be ensured to do so.
Heat removal: Effective heat removal by natural circulation and recirculation into the RPV are claimed. The effectiveness of these systems must be ensured in case of SA. Sufficient liquid level in the reactor pit must guarantee natural circulation. Any risk of steam blockage, due to higher local heat flux, and limiting the wall cooling should be avoided.
Ultimate heat sink (UHS): to ensure the long-term feasibility of IVMR strategy. It is necessary to demonstrate the long-term availability of the UHS.
4.4. Safety issues particular to SMRs
Some safety issues, which are SMR-related were studied. They consist of the potential multi-unit character of the SMR plant and the management of systems shared among SMR units. Safety requirements accounting for the plant modularity are presented in Table 2 (multi-unit requirements).
4.4.1. Shared systems. An extensive use of equipment shared between the units is foreseen for SMRs: auxiliary systems (e.g., boron supply, demineralized water supply), control rooms, pools used as UHS, etc. This may raise issues:
Initiating events affecting several units of the plant simultaneously may occur (LOOP, failure of a steam line in case of a common turbine…);
An initiating event should not induce hazardous effects on neighbouring units;
Some shared equipment can be used to mitigate consequences of accidents occurring simultaneously in several units.
In line with the previous points, IAEA TECDOC 193627 mentions that each unit of a multi-modular facility should dispose of its own safety systems for design-extension conditions, when possible. If a safety system or safety device is shared between several units, the shared safety system or safety device must be functionally capable of meeting the safety requirements of each unit or of all units simultaneously.
4.4.2. Multi-unit PSA. One key characteristic of SMRs is their installation within a multi-unit plant. This impacts PSA quantifications.
The traditional risk matrix should be extended to incorporate multi-unit sequences. As one of the major factors in PSA, CCF quantification has to be revisited, particularly considering the number of impacted equipment (which may be too high on a multi-unit site to provide an accurate quantification) and nature (whether the equipment is involved on several units or not). These modifications of the risk matrix would also justify the need for new probabilistic numerical targets (i.e., event frequency).
4.4.3. Spent fuel management and disposal. It has been shown that the approaches and techniques used to justify the safety of large-power reactors are applicable to SMRs. A smaller size of fuel assemblies and a smaller mass of fuel, with a similar level of burnup, would reduce the severity of the consequences of major design accidents. Yet, some design features of SMRs induce issues regarding accidents related to the spent fuel pool (SFP) of the plant, as illustrated below.
For SMR boron-free designs, an important amount of gadolinium may be used in the fuel as a burnable neutron poison. This may increase the importance of the gadolinium peak in the fuels compared to PWR. This may be an issue during outages phases of partially spent fuel. This phenomenon should be considered in the design of SFP racks.
The use of innovative equipment and passive systems for SMRs also induces particular requirements for fuel management:
Practical elimination of the SFP fuel damage accidents must consider SMR specificities (reactivity aspects: clear water in the SFP, fuel reactivity; use of passive systems; plant modularity …);
Any potential for severe consequences to arise (consideration of worst conditions for common SFP with full cores stored from all reactors) should be identified.
If passive heat removal systems are used for the SFP (single-phase heat removal system, for example), their performance must be demonstrated (proven codes, adequate modelling of related physical phenomena, experimental support).
Moreover, the mutual impacts between the SFP and the reactors should be considered in case the fuel is stored within the containment (as in Water-Water Energy Reactor (VVER) technologies for example):
SMR modules and the SFP can be impacted through their shared systems (e.g., supply of cooling water to SFP cooling system and to diesel generators, power supply, ventilation).
An accident in an SMR module can impact the SFP.
An accident in the SFP can impact an SMR module: flooding due to SFP system piping rupture (if applicable), accidents in the SFP leading to conditions which require emergency shutdown of the unit by the personnel.
Management of accident sequences should consider both the reactors and the SFP.
Considering decommissioning, onsite decommissioning for multi-unit plants may be sequenced (decommissioning of units while some others are still operating). This would require particular safety resolutions (implementation of particular removal routes, works close to operating units...).
5. Synopsis and outlook
ELSMOR tackles an array of critical aspects of light-water SMR licensing. The project establishes an assessment methodology for such purposes, based on extensive experimental and analytical work. The work performed in WP2 has permitted an overview of the different issues that LW-SMRs may bring about in the different domains of nuclear safety, in terms of:
Methodological standpoints (safety goals, safety requirements);
Main safety functions of reactivity control, decay heat removal and confinement management;
Severe accident management and Emergency Planning Zones (EPZ);
Safety issues peculiar to SMRs: shared systems, multi-unit PSA aspects and spent fuel management, transport and disposal.
The upcoming European TANDEM project (“TANDEM Official Website”, http://tandemproject.eu/) will study the use of SMR designs for subsequent cogeneration plant studies, considering H2 production, district heating and power supply for urban areas. In this prospect, the safety analysis methodologies developed in ELSMOR may be used and adapted. In addition, as a number of SMR projects are ongoing in Europe, as described in the state-of-the art provided in this article, the ELSMOR work presented in this article may benefit them. The safety methodologies developed through this work may be used in the prospect of the licensing of the various LW-SMRs designs to be installed in Europe. It may ease the licensing processes as it provides a set of safety requirements to be fulfilled by a LW-SMR in the prospect of licensing in Europe and developed various methodologies to tackle a set of identified safety issues.
Ethics and consent
Ethical approval and consent were not required.
