Home Energy Nuclear Electricity Climate Change Lighting Control Contacts Links


XYLENE POWER LTD.

FNR TWO INDEPENDENT SHUTDOWN SYSTEMS

By Charles Rhodes, P.Eng., Ph.D.

SCOPE:
This web page focuses on the two independent shutdown systems of each FNR. Each shutdown state is a default state which is reached automatically without human intervention.
 

SHUTDOWN DEFINITIONS:
1) WARM REACTOR SHUTDOWN
In a warm shutdown the primary sodium pool maintains its temperature and the generators keep operating at minimum power. A normal warm shutdown occurs as the FNR's thermal load drops to zero. There is no withdrawal of movable fuel bundles. Nuclear fission stops but the sodium surface temperature remains at the reactor setpoint, typically 460 degrees C. The nitrate salt remains in liquid form and there is a low level of power generation sufficient to meet the parasitic electrical loads.

2) COOL REACTOR SHUTDOWN
A cool reactor shutdown is used to attain or maintain a liquid sodium temperature in the range 105 C to 120 C as required for fuel bundle or intermediate heat exchange bundle service. This condition is achieved by partial withdrawal of movable fuel bundles. Nuclear fission stops and will not restart until the sodium coolant temperature drops below about 105 degrees C. Note that recovery from a cool reactor shutdown requires external supply of sufficient electrical power to meet the parasitic load until the heat transport fluid (HTF) is warm enough for electricity generation. That electricity generation can then be used to melt the nitrate salt in its dump tanks which enables major electricity generation.
 

3) COLD REACTOR SHUTDOWN
A cold shutdown occurs when a potentially dangerous or damaging condition is anticipated or detected. All movable fuel bundles are fully withdrawn. Nuclear fission stops and will not restart even if the sodium temperature falls to room temperature. In practice a cold shutdown is seldom used because it may cause a subsequent lengthy restart procedure. The heat required to raise the sodium up to its melting point near 100 degrees C must come from an external energy source. Hence a lot of externally supplied energy is required to recover from a prolonged cold reactor shutdown.
 

4) AUTOMATIC COLD SHUTDOWN
A cold reactor shutdown will be triggered by an enclosure failure, likely caused by some form of missile or meteorite strike. In this emergency the argon cover gas is lost and the main concern is suppression of a uncontrolled sodium fire which might potentially lead to release of airborne radio isotopes. Suppression of a sodium fire may involve release of a large amount of NaCl into the sodium and potential damage to stainless steel components caused by that NaCl. Hence an emergency cold shutdown may result in the reactor being off for a long period of time. When an emergency cold shutdown occurs heat should be extracted from the sodium pool as fast as possible. When the sodium is sufficiently cool, the exposed sodium surface should be flooded with kerosene to prevent further oxidation of the exposed sodium and air exposure should be minimized to prevent a kerosene fire.

5)

HIGH TEMPERATURE SHUTDOWN:
In normal opertion the reactor shuts down when it reaches its setpoint temperature. If that setpoint temperature is significantly exceeded then there is something wrong with the fuel geometry and the reactor should be immediately cold shut down by full withdrawal of movable fuel bundles. The reactor should not be used for further power production until the cause of the high temperature trip is determined and remedied.
 

SAFETY SHUTDOWN PRINCIPLES:
Safety shutdown systems operate on the principle that in addition to the normal control system which causes a warm shutdown with no thermal load there must be two fully independent safety shutdown systems, either of which can force a shutdown. Each shutdown system has its own overhead liquid Na tank to gravity feed the hydraulic motors on the relevant movable fuel bundle actuators. The feed valves are arranged such that on loss of station power the Na in the overhead tanks flows down through the relevant hydraulic motors causing withdrawal of the movable fuel bundles.

A key issue in fuel bundle design is that with half of the movable fuel bundles fully withdrawn from the matrix of fixed fuel bundles and the remainder of the movable fuel bundles in their normal operating position the reactor must shut down. This fuel bundle design constraint enables safe reactor fuel assembly/disassembly and allows independent operation of the two fully independent FNR cold shutdown systems. In order to achieve reactor zone symmetry the fissile fuel concentration in the movable active fuel bundles may have to be higher than the fissile fuel concentration in the fixed active fuel bundles.

For each of the safety shutdown systems there are independent mechanical and electronic constraints on the sodium temperature setpoint and its rate of change. There are also independent position, temperature and gamma ray sensors.

For public safety the aforementioned two safety shutdown systems should be continuously monitored and periodically tested to ensure that they will reliably function when required.

These two independent shutdown systems are backed up by physical barriers. To present a hazard to the public the warm shutdown system and both cold shutdown systems must all simultaneously fail.

Independent functionality of the two safety systems is an essential condition for safe unattended FNR operation.

Generally there is a requirement for service personnel to periodically physically confirm the proper operation of each shutdown system. Provided that these scheduled checks are performed and if necessary any defective devices are promptly repaired or replaced, the probability of all of the shutdown systems failing simultaneously, other than via sabotage, is less than microscopic.
 

REQUIRED FUEL BUNDLE NUCLEAR SHUTDOWN PERFORMANCE:
1) Reactor discharge temperature setpoint modulation is achieved by changing the insertion depth of the movable fuel bundles in the matrix of fixed fuel bundles.

2) A reactor coolant temperature rise above its setpoint should cause a warm reactor shutdown.

3) The movable fuel bundles are divided into two groups, A and B, in a staggered pattern similar to the red and black squares on a checker board. Each interior member of group A has four adjacent group B members. Similarly each interior member of group B has four adjacent group A members.

4) The maximum possible reactor reactivity occurs when both groups A and B are fully inserted into the matrix of fixed fuel bundles.

5) In normal reactor operation both groups A and B are partially inserted.

6) Full withdrawal of either group A or group B from the matrix of fixed fuel bundles while the remainder of the movable fuel bundles remain in their normal operating position must cause a reactor cool or cold shutdown. This reactivity design constraint enables operation of the two fully independent FNR shutdown systems and also enables safe reactor fuel assembly / disassembly.

7) In order to achieve reactor zone symmetry when the movable fuel bundles are fully withdrawn the average fissile fuel concentration in the movable fuel bundles should be higher than the average fissile fuel concentration in the fixed fuel bundles.

8) If any single movable fuel bundle is accidentally moved toward being over inserted, then immediate full withdrawal of either the remaining group A movable fuel bundles or the remaining group B movable fuel bundles must cause an immediate reactor shutdown.

9) If any two movable fuel bundles are accidentally moved toward being fully inserted then full withdrawal of all of the remaining movable fuel bundles must immediately occur and must cause a reactor shutdown.
 

TEMPERATURE AND GAMMA OUTPUT LIMITING:
For each of the two safety shutdown system there are independent mechanical and electronic constraints on the fuel average temperature setpoint and its rate of change. There are also independent position, temperature and gamma ray sensors that via an independent control can over ride other setpoint control signals to force a reactor shutdown.

The maximum insertion rate of movable fuel bundles into the matrix of fixed fuel bundles is physically limited to prevent both fuel over heating and possible approach to prompt neutron criticality.

The fuel bundle geometry in a FNR must be mechanically stable. The working temperature of each fuel bundle is kept sufficiently low that the fuel bundle geometry cannot become unstable via fuel tube melting, structural melting or sodium boiling due to a large temperature difference between the material operating temperature and their melting and boiling points.

The temperature of the sodium inside an indicator tube is a reliable but somewhat time delayed indication of the liquid sodium temperature at the corresponding movable fuel bundle discharge.
 

FNR SHUTDOWN STRATEGY:
At a planned and/or scheduled reactor shutdown the best strategy is to withdraw the movable fuel bundles but maintain a thermal load on the reator that balances the fission product decay heat so that the reactor maintians it soperating temperature for as long as possible. Hence electricity generation is maintained for feeding house power circuits. This strategy maintains the molten salt temperature in some of the heat transport loops and hence maintains house power electricity generation capacity. Only when the fission product decay heat is no longer sufficient to operate one turbogenerator are the reactor cooling pumps shifted to an external source of power.
 

FORCED COLD SHUTDOWN:
On a forced cold shutdown the FNR no longer maintains temperature. The movable fuel bundles all fully withdraw. The nitrate salt circuits all drain down to their dump tanks. If the primary sodium temperature rises above its trip point fission product decay heat is removed from the reactor by the NaK and heat transfer fluid. Natural circulation of the NaK transfers heat from the primary sodium pool to NaK and then heat transfer fluid and then water in the steam generators which heat is vented as steam.
 

This web page last updated June 10, 2023

Home Energy Nuclear Electricity Climate Change Lighting Control Contacts Links