safetydesignandevaluationinalarge-scalejapan sodium...

Hindawi Publishing CorporationScience and Technology of Nuclear InstallationsVolume 2012, Article ID 614973, 14 pagesdoi:10.1155/2012/614973

Research Article

Safety Design and Evaluation in a Large-Scale JapanSodium-Cooled Fast Reactor

H. Yamano,1 S. Kubo,2 Y. Shimakawa,3 K. Fujita,1 T. Suzuki,1 and K. Kurisaka1

1 FBR Safety Unit, Advanced Nuclear System R&D Directorate, Japan Atomic Energy Agency, 4002 Narita-cho,O-arai, Ibaraki 311-1393, Japan

2 Research and Development Department, Japan Atomic Power Company, 1-1 Kanda-Mitoshiro, Chiyoda-ku, Tokyo 101-0053, Japan3 Reactor Core and Safety Design Department, Mitsubishi FBR Systems, Inc., 2-34-17, Jingumae, Shibuya-ku, Tokyo 150-0001, Japan

Correspondence should be addressed to H. Yamano, [email protected]

Received 16 January 2012; Accepted 20 March 2012

Academic Editor: Sunil S. Chirayath

Copyright © 2012 H. Yamano et al. This is an open access article distributed under the Creative Commons Attribution License,which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.

As a next-generation plant, a large-scale Japan sodium-cooled fast reactor (JSFR) adopts a number of innovative technologies inorder to achieve economic competitiveness, enhanced reliability, and safety. This paper describes safety requirements for JSFRconformed to the defense-in-depth principle in IAEA. Specific design features of JSFR are a passive reactor shutdown system anda recriticality-free concept against anticipated transients without scram (ATWS) in design extension conditions (DECs). A fullypassive decay heat removal system with natural circulation is also introduced for design-basis events (DBEs) and DECs. In thispaper, the safety design accommodation in JSFR was validated by safety analyses for representative DBEs: primary pump seizureand long-term loss-of-offsite power accidents. The safety analysis also showed the effectiveness of the passive shutdown systemagainst a typical ATWS. Severe accident analysis supported by safety experiments and phenomenological consideration led to thefeasibility of in-vessel retention without energetic recriticality. Moreover, a probabilistic safety assessment indicated to satisfy therisk target.

1. Introduction

Since 2006, the Japan Atomic Energy Agency (JAEA) hasconducted a fast reactor cycle technology development(FaCT) project in cooperation with the Japanese electricutilities [1]. In this project, a large-scale sodium-cooled fastreactor (SFR) is designed with oxide fuel cores towards itscommercialization. This SFR was named the Japan sodium-cooled fast reactor (JSFR), characterized by an advancedloop type reactor with innovative technologies for economiccompetitiveness, enhanced safety, and improved reliability[2]. Key milestones were set in the project: the determinationof innovative technologies to be adopted to JSFR in 2010and the presentation of the conceptual design of JSFR in2015. The JSFR demonstration reactor was planned to startits operation in 2025, and research and development (R&D)efforts are currently made regarding the JSFR design studyand innovative technologies.

Several innovative technologies need to be developedin order to meet the safety requirements and reliabilityand economical targets. The key concept of this reactoris a two-loop primary heat transport system (PHTS) fora large power output (to 1500 MW electric) and adoptionof high-chromium steel pipes to simplify arrangement ofpiping, thereby leading to reducing the volume of buildingwith concentrated arrangement of major components. Thesetechnologies can greatly contribute to reducing the capitalcost of the plant. An intermediate heat exchanger (IHX)was integrated with a primary pump in order to compactthe layout of components. A newly designed upper internalstructure (UIS) with a single rotational plug allows reductionin the diameter of the reactor vessel. The UIS has a slit of acertain width, where a fuel-handling machine can handle fuelassemblies beneath the UIS without completely removing theUIS itself from the original position. Such innovative tech-nologies could significantly reduce the capital cost, which

2 Science and Technology of Nuclear Installations

was estimated approximately 0.18 Japanese yen per kWelectric [3]. The JSFR design substantially mitigates adverseeffects caused by sodium leakage or sodium-water reactionsin steam generators (SGs). In particular, the leaked sodiumcan be accommodated by double boundary structures: guardpipes and guard vessels, which cover primary/secondarypipes and vessels, respectively. Besides, access routes for in-vessel structures are provided with the object of in-serviceinspection in the design [4].

JSFR is recognized as one of the Generation IV energysystems. Compared to current generation nuclear reactors,the Generation IV reactors are aimed to have superior fea-tures in terms of economics, safety, sustainability, and prolif-eration resistance. Therefore, the Generation IV SFRs requirea number of innovative technologies, for which enormousR&D efforts are necessary. In contrast, evolutionary SFRswith conventional technologies are also being developed insome countries. Though there are two different approachesin the world, the development of SFRs is steadily movedahead on.

The present paper describes conceptual safety designsand related evaluations for JSFR performed in Phase I ofthe FaCT project (i.e., Japanese fiscal years 2006–2010).Because fast breeder reactors are sure to contribute to futuresustainable development, we assume that JSFRs with closedfuel cycle systems would be widely distributed through theglobal market. Safety design principles of JSFR and theirimplementation should be consistent with this assump-tion and also compatible with both economic targets andnuclear proliferation resistance/physical protection. Alongthis understanding, the safety design concept for JSFR willbe developed in this study. Its validity will also be confirmedby safety evaluations for a wide accident range in thispaper.

2. JSFR Safety Design Concept

2.1. Safety Design Requirements. In terms of safety, a devel-opment target and design requirements in the FaCT projectare shown in Table 1 [3]. It can be said that these targetsare basically consistent with the safety-related goals or userrequirements in both the Generation IV project [5] and theInternational Project on Innovative Nuclear Reactors andFuel Cycles (INPRO) [6].

2.2. Safety Design Principle

2.2.1. Deterministic Approach Based on Defense in Depth. Inorder to achieve the previously mentioned design require-ments SR-1.1 and SR-1.2, we deterministically applied thedefense-in-depth (DiD) philosophy, which was defined inthe report of INSAG [7], to the same extent as it has beenin LWRs. This is because we believe that the validity of DiDphilosophy has been proven through the long experience ofLWRs and that the DiD philosophy is an adequate strategyto achieve a high level of safety in advanced or innovativenuclear systems for which operational experience is ratherlimited. Essential to this philosophy are the establishment of

Table 1: Safety-related development target and design require-ments in the FaCT project.

Development target

Safety level shall be equal to future light water reactors (LWRs)and related fuel cycle system.

Design requirements

SR-1.1

Fundamental safety principles shall beobserved. Safety standards and guidelinesfor former SFRs shall be reflected whilespecific features of new reactors shall beconsidered

SR-1.2

Prevention and mitigation against severeaccident initiators shall be considered soas to avoid execution of offsite emergencyplans

SR-1.3

Total core damage frequency shall be lessthan 10−6/reactor-year consideringmultiple units in a site, and totalcontainment failure frequency in coredamage conditions shall be less than10−7/reactor-year

a highly reliable system that rarely produces abnormal condi-tions and the design of measures for accident prevention andmitigation.

The deterministic approach was also adopted consideringdesign-basis events (DBEs) to specify safety functions such asa reactor shutdown system (RSS) and a decay heat removalsystem (DHRS) for prevention of core damage. In this ap-proach, it is necessary to have the following aims:

(i) selecting DBEs to cover the plant conditions thatmight lead to core damage;

(ii) selecting DBEs for JSFR with a similar sense to thosefor LWRs, taking into account their safety character-istics;

(iii) selecting conservative design conditions, as withthose for LWRs, which include a single-failure crite-rion and conservative treatment of safety parametersin the evaluation.

In recent LWRs, such as ABWR-II, EPR, and AP1000,some design measures to support the containment functionare explicitly provided against severe accidents, which arerecognized as another level category of design conditionin addition to the design-basis approach. Although thiscategory was formerly described as a beyond DBE, it hasrecently been recognized that some extended function bothfor prevention and mitigation should be considered moreexplicitly in the design work. Such conditions for extendedsafety design are called design extension conditions (DECs)[8]. Therefore, we incorporated the DEC concept explicitlyin our safety design policy. Passive safety features are alsointroduced into extended safety functions against DECsespecially to enhance prevention capability. We believe thatthis safety design policy against DECs allows alleviatingundue burden on offsite emergency plans.

Science and Technology of Nuclear Installations 3

2.2.2. Risk-Informed Approach. In addition to the DiD phi-losophy, we also adopted a risk-informed approach using aprobabilistic safety assessment (PSA) technique that playsa role in considerations on the proportion or balance ofdifferent levels of DiD. At the beginning of the FaCT project,we determined that the reference value for large offsite releasefrequency should be less than 10−6/site-year by referring toone one-thousandth of the risk encountered in our dailyactivities. We also paid attention to the specific sequencesthat could result in large early release so as to limit thefrequency to be below that of the other sequences. For areactor facility, our target for large offsite release frequencybecomes the reference value with a further reduction by afactor of at least ten: judging from the fact that one sitemay already have several reactors, we assumed that aboutten reactors would be located in a single site in the future.Therefore, the large offsite release frequency target was setless than 10−7/reactor-year (ry). In terms of the safety designof containment function, containment failure frequency(CFF) is preferable target for designers. In the FaCT project,the CFF was set less than 10−7/ry conservatively ignoring areduction effect in the environment that can be consideredin the large offsite release frequency. Since the containmentfunction could suppress the offsite release of radioactivematerials with a further reduction by a factor of ten, the risktarget of core damage frequency (CDF) was determined lessthan 10−6/ry.

2.3. Safety Design Concept for JSFR. Figure 1 shows theframework of safety assurance in JSFR. It also shows thestructure of DiD, combined with three major safety func-tions, namely, reactivity control, heat removal, and contain-ment. First of all, it is important to establish a reliable systemby adequate design that stands on sound technologies.Furthermore, adequate operation and maintenance also havean important role in ensuring the first level of DiD. Then, theRSS and DHRS play key roles in the second and third levelsof DiD, the objectives of which are the control of abnormaloperation and accidents, respectively, as design measuresagainst DBEs. Two independent RSSs (primary RSS andbackup one) and a redundant/diverse DHRS with passiveoperation form sufficient defense lines so that fuel meltingdoes not occur. Therefore, the containment function in theselevels plays a role only for the confinement of radioactivematerials which are not caused by fuel melting. The fourthlevel of DiD considers design measures against DECs. Inthis level including both of prevention and mitigation ofsevere accidents, the RSS and DHRS provide extendedprevention functions (i.e., passive shutdown feature and acci-dent management), and the containment system providesa mitigation function against radioactive material release.Moreover, attention is paid to the chemical activity of sodiumso as to minimize and localize its influences.

Each of the safety functions is described in detail inSections 2.3.1 to 2.3.4. It should be mentioned here thatpassive safety measures are preferable from the viewpoint ofphysical protection as well as enhancement of these functions[9]. JSFR has such systems for reactor protection and decayheat removal as described below.

2.3.1. Reactor Shutdown Function. The RSS has two inde-pendent subsystems, namely, primary and backup systems.Each of them, consisting of control rods and their drive andscram mechanisms, is designed to allow for rapid shutdownin order to prevent core damage against DBEs. RSSs are acti-vated by the reactor protection system, which is composed oflogic circuits for activation and an instrumentation systemfor detecting abnormal reactor conditions. In order to avoidcommon-cause failure and the propagation of failure, thediversity and independence of the two RSSs are promotedas much as possible. The primary RSS has mechanical de-latch devices with acceleration by gas pressure for insertionof the control rods, while the backup RSS has electromagnetsfor the detachment devices. The control rods in the backupRSS are inserted by gravity. Various kinds of detectorsare redundantly installed in the reactor protection system.Furthermore, different kinds of detectors are independentlyassigned to the primary and the backup RSSs against a singleDBE.

In case of earthquakes, relative displacement between thecore and the control rods might cause oscillatory reactivityinsertion as well as hindering the control rod insertion. Boththe stiff core barrel with its core-restraint function and thestiff support structure of the control rods are designed tosuppress such displacement and oscillation so that the corefuel keeps its integrity against possible reactivity insertionduring the postulated earthquake conditions. The seismicisolation of the reactor building has an important role inreducing the input acceleration for the reactor vessel.

When anticipated transients without scram (ATWS) arepostulated, the reactor core becomes damaged in the order ofminutes, during which period the operators may not be ableto achieve any accident management measures to preventcore damage. Hence, a passive shutdown capability, especiallyagainst ATWS events, has been desired to bring the plant tothe safe shutdown condition without the operator action asthey become commercialized. In order to cope with ATWS,only for the backup RSS, JSFR introduced passive shutdowncapability, in parallel with an active reactor protection systemand instrumentation system.

A Curie-point electromagnet type self-actuated shut-down system (SASS) has been selected as the most promisingprovision for JSFR [10]. The SASS concept is schematicallyillustrated in Figure 2. One of its superior features is simpleone-dimensional movement of the control rods with a largenegative reactivity, which is triggered once the coolant tem-perature around a temperature sensing alloy rises high. Thispassive actuation principle does not require the activationof the reactor protection system, so that it is not necessaryto consider a common-cause failure between the passive andactive shutdown systems. This serves to enhance the reactorshutdown capability, resulting in the increase of reliabilityof the overall RSS. There is a favorable characteristic inthat the uncertainty of the reactivity feedback mechanismcould be small because of its one-dimensional movement incomparison with other passive safety characteristics, such asradial core expansion. The in-service testability in periodicinspections could also present an advantage in maintainingthe reliability and safety levels of the plant. In addition, a


(4) Control of severe plant conditions, includingprevention of accident progression andmitigation of the consequences of severeaccidents

(1) Prevention of abnormaloperation and failures

(2) Control of abnormal operationand detection of failures

(3) Control of accidents within thedesign basis

Levels of DiD

Against chemical reaction of sodium

♦ Rational designmargin

♦ Qualityassurance

♦ Preventivemaintenance

(inspection, on-line monitoring,etc.)

Double boundary system (coolant retentionby guard vessel and guard pipes)

Redundant and diverse passive operation(natural circulation)

AM[accident management]

Unreliability

For DBE

RSS[reactor shut-down system]

DHRS[decay heat

removalsystem]

Heatremoval

Reactivitycontrol

Preventionfor DEC

Primary RSS

Containment

Backup RSS

Mitigationfor DEC

Passive RSSSASS

[self actuatedshutdown system] Recriticality-free

core+

Long-term stabledebris cooling

In-vessel retention

No challenge on CV

1 210− ∼10− /d 10−1∼10−2/d

♦ Sodium leak→ leak-tight guard vessel and pipes (double boundary)

♦ SG tube leak→ double-wall tube, early detection, and rapid depression of steam-water side

10−2/d∗ 10−4/d 10−6/d

∗∗: Lower required level than LWRs

∗: Demand

Pressure-resistant∗∗/leak-tight containment vessel

Figure 1: Basic framework of safety design in JSFR.

stable holding capability during normal reactor operationwas demonstrated at the experimental fast reactor Joyo [11].

As previously mentioned, the core-restraint conceptpermits control rods to insert into the core in case ofearthquake in the JSFR with the seismic isolation system.To assure the reactor shutdown capability in case of hugeearthquake, flexible joints are adopted for the driveline ofthe backup RSS. Thanks to this, the control rods that standby just above the active core can be inserted even if a largehorizontal displacement unexpectedly occurs between thecore structures and UIS.

2.3.2. Core Cooling Function. Since SFRs are generally oper-ated at nearly atmospheric pressure, there is negligible risk ofa loss-of-coolant accident, which is a critical issue in LWRs.In terms of maintaining the core cooling function afterreactor shutdown, the JSFR necessitates the prevention ofboth loss of reactor sodium level (LORL) and protected lossof heat sink (PLOHS). In addition, the reduction of the coreflow rate due to a PHTS pump failure has a large influenceon the short-term core cooling because of its higher powerdensity and because of some positive reactivity feedback ofcoolant density in the fast reactor core. Particulary, a PHTSpump seizure accident is a critical issue in the JSFR two-loop cooling system. To cope with the PHTS pump seizureaccident, the JSFR required some minor but importantdesign modifications, that is, prolonging the delay time to

activate the PHTS pump trip sequence (e.g., 1.0 s) and thehalving time of the primary flow rate within reasonable range(e.g., 5.5 s) [12].

In the loop-type SFR, unlike the pool-type one, the possi-bility of LORL due to PHTS piping failure is apprehended. Inorder to prevent the LORL with high reliability, the followingsystematic design measures were adopted.

(i) The reactor vessel and its guard vessel have no pene-tration at either the sides or bottom.

(ii) The primary coolant boundaries in the PHTS pipingare located in the position above the liquid surfacelevel in the reactor vessel in order to reduce a possibleamount of leak.

(iii) The pressure of the secondary heat transport system(SHTS) is kept slightly higher than that of the PHTSso as to prevent the leaking of primary coolant at theinterface breach.

(iv) The primary coolant boundaries are enclosed witha leak-tight backup structure (i.e., guard vessel andguard pipe) so as to restrict coolant leakage againstthe boundary failure.

(v) Decompressing operations (i.e., PHTS pump trip,isolation of the reactor cover gas from its supplysystem) are automatically actuated so as to preventthe LORL combined with the above item (ii) against


Control roddrive mechanism

SASS

Absorberrod

Corefuel

Temperaturesensing alloy

Detachsurface

Coil

Magneticpath

Iron

core

Figure 2: Schematic diagram of the SASS concept.

double failures in the PHTS boundary and its backupstructure.

(vi) The open space between the primary pipe and itsguard pipe is partitioned to limit the volume of theleak and prevent LORL.

Concerning the primary coolant leakage, the signal fromthe leaked sodium level meter inside the guard pipe for alarge leak and sodium leak detector for a small leak canactivate the reactor shutdown and cooling sequence so thatcore integrity is maintained.

As to prevention of the PLOHS, the decay heat removalis an important safety function, as in LWRs. In order toachieve sufficient reliability, certain redundancy and diversityare required. The DHRS should be designed so that the coreis coolable under DBEs with a single-failure criterion as wellas under DECs such that a long-term station blackout shouldbe considered in the design. In addition, the DHRS shouldsatisfy the reliability target value in order to achieve thereference CDF in the sense of the probability [12].

In general, a passive DHRS without any active compo-nents has higher reliability than an active system. The failure

probability of a passive system is dominated by those ofthe vessel, pipes, and heat exchangers. Such probabilitiesare smaller than those of start-up or operation of activecomponents (e.g., pumps, blowers). Thus, the passive DHRSis suitable for rational design from the viewpoints ofminimizing redundancy and of suppressing subsystems suchas the emergency power supply system. The current JSFRdesign adopts a combination of one loop of direct reactorauxiliary cooling system (DRACS) and two loops of primaryreactor auxiliary cooling system (PRACS). These DHRSs canbe operated under fully passive condition, which means that,without pumps and blowers, it is required only to activate theDC-power-operated dampers of the air coolers. The dampersystem has redundancy so that it does not lose its functioneven considering the single-failure criterion; that is, each aircooler has two dampers in parallel so that an opening failureof a single damper causes less than a 50% reduction in theair flow rate. In addition, diversity is taken into account inthe mechanical design of the dampers between DRACS andPRACS. JSFR is suitable for natural circulation cooling due toits simple and short piping connection and due to the lowerpressure loss of the core design, as well as the sufficient height


difference between the core and the heat exchangers. BothDRACS and PRACS have a sodium-sodium heat exchangerinside the PHTS. Therefore, they are not affected by theabnormal conditions initiated in the SHTS and the steam-water systems.

For DECs, accident management can be expected toprevent core damage because the grace period is long enoughfor operators to implement it. With PSA results, effectiveaccident management measures are being proposed (e.g.,additional damper system).

2.3.3. Containment Function. The reinforced reactor blockof the JSFR reactor building is designed to form a leak-tight containment boundary, the leak rate of which is1%/day. The containment is surrounded by a confinementarea, where an emergency gas treatment system is installed.Function of the confinement area is to reduce the release rateof radioactive materials through the penetrations of pipingat the containment boundary.

In the conventional safety design, the containment sys-tem has been designed to withstand a significant mechanicalload resulting from core disruptive accidents (CDAs) [13].Such an approach is not suitable for future reactors, whichshould meet the development target and at the same timeshould have the economic competitiveness. To significantlyreduce the loads on the containment, the JSFR safety designpursues achieving in-vessel retention (IVR), which is definedas termination of CDAs within the reactor vessel, utilizing theadvantageous features of SFR (i.e., the low-pressurized sys-tem and the superior cooling performance of liquid sodium).A special fuel assembly feature was suggested to eliminate asevere recriticality occurrence resulting in a mechanical loadon the containment in CDAs as well as limiting the sodiumvoid worth. For core debris retention within the reactorvessel, a multilayered structure was provided at the bottomof the reactor vessel.

In conventional SFRs, a sodium leak accident resultingin a little sodium combustion on the containment vesselwas regarded as a representative DBE for the containmentfunction. The double boundary system in the JSFR allowsno significant impact on the containment due to sodiumleak because of the accommodation of its consequence in theguard pipe. As an example of DBE, therefore, the break ofcover-gas piping under the stop of air conditioning deviceoperation due to the containment isolation is anticipated toconfirm the containment function. Such an event is expectedto give less significant impact on the containment vessel asthe last barrier In the JSFR.

Although external events are out of the scope yet in thepresent conceptual design stage, several practical measuresagainst external threats on the containment are beingdiscussed.

2.3.4. Design Measures against Chemical Reaction of Sodium.The JSFR is a system concept suitable for the implementationof a complete double-wall structure (i.e., inner piping andguard piping) for both the PHTS and SHTS, combined withtheir short and simple pipe connection, as shown in Figure 3.

The PHTS double-wall structure enables us to prevent orminimize the combustion of leaked sodium in addition toprevention against LORL. Even if a sodium leak resultingfrom a primary pipe failure occurs, the chemical interactionof the sodium can be prevented in the space between theprimary pipe and its guard pipe, which is filled with nitrogengas, as long as the external boundary is intact. The limitationof this space volume gives no impact on the reactor coolantlevel. According to safety analyses performed separately fromthis study, the core integrity can be ensured though thecoolant leak rate through the flaw depends on the eventsequence. A similar boundary structure is also applied to theSHTS, where a boundary failure does not lead to LORL, asa design measure against sodium leak caused by the innerpipe failure. In the JSFR, the SHTS guard pipe is calledan enclosure. The adoption of the enclosure for the SHTScomes from the viewpoints not only of safety but also ofplant availability, considering the fact that the influence ofthe social acceptance was fairly significant in a sodium leakaccident in the SHTS of the prototype fast reactor Monju.

We expect introduction of a leak-before-break conceptfor high-chromium ferrite steel to contribute to minimizingthe leak rate in coolant boundary failures and to eliminatingthe possibilities for an abrupt decrease in coolant flow inthe reactor core. Although there are some R&D elementsrequired for introduction of the leak-before-break concept,it would be feasible to accommodate sodium leak detectionin the annular region between the inner and guard piping.With that in mind, a double-ended break of the inner pipingshould be taken into account in the DEC of the safetyevaluation in order to verify the tolerance of the guardpiping.

At the beginning of the FaCT project, a double-wallstructure has been proposed for the heat transfer tubes in theSGs in order to suppress the probability of an SG tube leakevent to an extremely unlikely level during the plant lifetime.This feature corresponds to the aim of achieving higher plantavailability by excluding plant outage caused by an SG tubeleak as well. Although this concept is technically feasible, theadoption of an alternative concept is also considered for thedemonstration JSFR by the project judgment in the FaCTPhase-I [2]. JSFRs are designed to be equipped with an SHTSand related subsystems (e.g., early leak detection, the steam-water side pressure release, rupture disks in the SHTS) thathave the role of preventing core damage due to the sodium-water reaction postulated in case of an SG tube leak.

3. Safety Evaluations for DBE

3.1. Event Selections for DBEs. According to the current li-censing practice in Japan, two event categories were setup within the frame of DBEs, namely, abnormal transientsand accidents. Abnormal transients are defined events thatlead to abnormal conditions due to anticipated failure ormalfunction of a single component or a single erroneousoperation. Accidents are defined unlikely events that mightlead to the release of radioactive materials outside the facility.The prevention systems against the events to be classifiedinto the accident were designed so as to limit the annual


Guard pipe

Na

Early detection of leakageenables safe reactor shutdown

Nitrogen gas atmosphere between twopipes prevents sodium combustion

Limiting leak area with double boundaryand ensuring sodium level

Guard vessel

Double boundarystructure

+nitrogen gasatmosphere in the gap

Leakdetector

Figure 3: Schematic diagram of the double-wall structure.

occurrence frequency to the extent below 10−2/ry that meansthe frequency less than once per a reactor lifetime.

In the current stage, it is important to choose andevaluate typical events, which are critical for determiningthe design conditions of the major safety function. In thispaper, a loss-of-flow-(LOF-) type event was described tovalidate the RSS design. A loss-of-offsite power event wasalso described to validate the DHRS design. A comprehensiveevaluation for all the selected DBEs will be conducted in theFaCT Phase-II.

3.2. Safety Criteria and Conditions for DBEs. Basic require-ments for abnormal transients and accidents are the sameas those of current LWRs in Japan. Namely, the requirementfor abnormal transients is that recovery to normal operationis possible after the transient event is terminated. Thismeans that fuel pin and plant damage are negligible. Therequirement for accidents is that the core should be coolablewithout significant damage and provide no significant publicexposure.

Along with these requirements, specific safety criteria forthe hottest fuel pin in the core were tentatively defined in theFaCT Phase-I. The maximum temperature of fuel is limitedby its melting temperature for both abnormal transients andaccidents. In case of fuel melting, the radial expansion offuel pellet induced by the internal pressure in the moltenfuel cavity causes a mechanical load on the cladding tube.The failure of cladding tube could not occur under smallmelt fraction condition due to the lower fuel smear densityof 82% [14]. Nevertheless, the criteria for accidents wereconservatively taken because of no experimental data for fuelpins under a high burn-up condition, being aimed in the

JSFR. The maximum cladding temperature is set tentatively,based on the developed austenitic stainless steel databaseas well as available data for oxide dispersion-strengthenedsteel, which is now under development for its use in theJSFR. According to the results of transient burst tests ofcladding tube, where the temperature increase rate andthe hoop stress of reactor case were simulated, the failurelimit temperature with 95% reliability was obtained over900◦C. The maximum cladding temperature for accidentswas determined at 900◦C. For abnormal transients, it was setat 830◦C with larger margin in order to make the damagenegligible. Since the oxide dispersion-strengthened steel isexpected to have higher strength comparing with austeniticsteel, it is necessary to develop a database for the oxidedispersion-strengthened steel cladding tubes, especially forirradiated ones. The cumulative damage fraction of cladding,for which creep damage is taken into account, is calculated tobe unity when the cladding tube failure occurs. The value forabnormal transients was provided as negligible contributionto cladding damage. For accidents, the value was obtained bysubtracting the contribution of normal operation, abnormaltransients, and fuel-handling from unity. The maximumtemperature of coolant was limited to its boiling temperaturein order to avoid both of significant cladding damage andrapid positive reactivity insertion due to coolant boiling.

The uncertainties of parameters and conditions in theevaluations were conservatively treated. A core burn-up statewas selected so as to provide the most severe evaluationresults, and sufficient uncertainties were considered in itsreactivity coefficients. The single-failure criterion was ap-plied to active components, of which failure provides themost severe result. Loss-of-offsite power was assumed when


0 20 40 60 80 100

Time (s)

3000

2500

2000

1500

1000

500

Tem

pera

ture

(◦ C

)

Tem

pera

ture

(◦ C

)

950

900

850

800

750

700

Safety criterion of cladding

Cladding

Fuel

Safety criterion of fuel

Figure 4: Primary pump seizure accident with primary RSS.

the mitigative systems, which require electric power foroperation, were expected to activate. The effect of nonsafetygrade systems was not counted in the evaluation.

3.3. DBE Analytical Results

3.3.1. Loss-of-Flow-(LOF-) Type Events. In general, the PHTSpump seizure accident in one loop tends to produce severeconsequences in DBEs compared with conventional three- orfour-loop design. Because of the two-loop system, this acci-dent would become a critical safety issue in JSFR. However,some design adjustments described in Section 2.3.2 makeit possible to restrict the maximum cladding temperaturewithin the safety criterion. Each RSS was designed so asto independently shut the core down within the claddingtemperature limit. The primary RSS can be activated bysignals indicating “low ratio of primary pump speed toneutron flux” and “low ratio of primary flow rate to neutronflux.” These signals can be adapted to a low power operation.The backup RSS is activated by another signal with differentmechanism. A plant dynamics calculation method was usedfor this analysis in a similar way performed in the past [12].In the analysis, the seizure is assumed instantaneously inthe failed pump, whereas the flow having time was assumed4.5 s with 1.0 s delay of pump trip in the intact pump afterthe actuation of trip signal. The response times of scramsignals for primary and backup RSSs are set 0.45 s and 0.55 s,respectively.

Figure 4 shows calculated temperatures of fuel andcladding in the hottest pin for the primary RSS case in a full-power operation. The activation signal was the “low ratio ofprimary pump speed to neutron flux” signal. The calculatedtemperatures of fuel and cladding are 2373 and 870◦C atmaximum, respectively, which are less than the safety criteria.

The pump seizure accident has also been calculatedassuming the activation of the backup RSS, as presentedin Figure 5. The calculated maximum temperatures of fueland cladding are 2375 and 893◦C, respectively. These resultssatisfy the safety criteria, although the safety margin is small.It should be noted that the margin to the safety criteria canbe enlarged by some design adjustments, such as the PHTSpump trip sequence and the PHTS flow rate halving time.

0 20 40 60 80 100

Time (s)

3000

2500

2000

1500

1000

500

Tem

pera

ture

(◦ C

)

Tem

pera

ture

(◦ C

)

950

900

850

800

750

700


Cladding

Fuel


Figure 5: Primary pump seizure accident with backup RSS.

0 20 40 60 80 100

Time (s)

3000

2500

2000

1500

1000

500

Tem

pera

ture

(◦ C

)

Tem

pera

ture

(◦ C

)

800

750

700


Cladding

Fuel


650

600

Figure 6: Loss-of-offsite power event (short term after the eventinitiation).

In the low power operation, the calculated maximumtemperatures of fuel and cladding were lower than those inthe full-power operation by approximately 200◦C.

3.3.2. Decay Heat Removal. For the fully passive feature likethis DHRS, the evaluation for abnormal transients is veryimportant, especially from the viewpoint of fuel integrityduring the slower transient events for the establishment ofstable coolant circulation. A loss-of-offsite-power transientanalysis has been done with the same calculation procedureas the pump seizure accident analysis mentioned above. Inthis event, the fully natural circulation capability of one-loopDRACS and two-loop PRACSs would be expected. In thiscalculation, the primary boundary temperature was assumedto mostly correspond to the coolant temperature at the exitof the reactor vessel.

Short-term calculated temperatures of fuel and claddingafter the event initiation are shown in Figure 6. The cal-culated maximum temperatures of fuel and cladding are2369 and 732◦C, respectively. Figure 7 shows long-termcalculated temperatures of fuel cladding and primary coolantboundary. Following the first peak of cladding temperaturejust after the reactor shutdown, the second and third peaksappear around 0.036 h (2.2 min.) and 0.32 h (19 min.),respectively. The second peak is governed by the primary


900

800

700

600

500

4000 0.5 1 1.5 2 2.5

Time (hour)

Fuel cladding

Safety criterionof boundary

Primary coolant boundary

Tem

pera

ture

(◦ C

)

Figure 7: Loss-of-offsite power event (long term).

coolant flow rate that is determined by natural circulationcapability based on a temperature difference in the PHTSbefore the core cooling using the DHRS is effective. Afterthe establishment of natural circulation, the third peak isformed by the balance between the decay heat and the naturalcirculation capability of the DHRS itself. The calculatedmaximum temperatures of fuel cladding at second andthird peaks are 679 and 693◦C, respectively. The calculatedmaximum temperature of primary coolant boundary afterthe establishment of natural circulation is 509◦C, whichis lower than the initial reactor vessel exit temperature.After 0.7 h, the cladding temperature continuously decreases.These calculation results fulfill the safety criteria of fuel,cladding, and coolant boundary. The cumulative damagefraction is also less than the criterion for abnormal transients.

The other DBE analyses with regard to the decay heatremoval also indicated that the natural circulation DHRS iseffective.

4. Safety Evaluations for DEC

4.1. Event Selections for DECs. The DECs are additionalconditions or events, where failure in fundamental preven-tion functions or more severe initiating-event conditions areassumed. Although the DECs are set up in a deterministicway, there should also be risk-based consideration in orderto avoid too conservative design measures. The DECs ofconcern include classical initiators, such as ATWS. Theevent selection of DECs will be defined according to theprogress of the design and PSA study. Along the DiD philos-ophy, the effectiveness of prevention and mitigation designmeasures against CDAs should be validated in the DECcategory. Therefore, the safety evaluation should involvetwo categories for prevention and mitigation. In this paper,as representative DECs, we selected the ATWS, where thepassive shutdown capability and mitigative measures againstCDAs were evaluated.

4.2. Safety Criteria and Conditions for DECs. For DECs, thebasic containment function and postaccident core cooling

shall be maintained. The release level of radioactive materialsshall be below the level at which offsite response is activated.In the JSFR, the following criteria were tentatively defined forthe prevention and mitigation categories.

For the prevention category, the passive shutdown capa-bility is assessed in this paper. The safety criterion was setbelow the boiling point of the coolant for a core outletcoolant temperature. The boiling point at the top of the coreis 1020◦C because the cover gas is slightly pressurized inthe reactor vessel in the JSFR. As mentioned in Section 3.2,the failure limit of fuel cladding due to fuel melting isconsiderably high. The cladding failure limit for low smeardensity fuel is approximately 40% of areal melt fraction[14]. Hence, for the fuel pellet, the maximum melt fractionwas conservatively limited to less than 30%. The meltingtemperature of fuel pellet is ∼2740◦C in the calculated core.

For the mitigation category, no significant mechanicaland thermal impacts on the primary boundary are allowedbecause the JSFR aims at the IVR concept without anysignificant internal challenges on the containment func-tion. Detailed description of the safety criteria is given inSection 4.3.2.

The DEC evaluations were conducted on a best-estimatebasis. The influence of various uncertainties will be investi-gated in a future PSA study.

4.3. DEC Analytical Results

4.3.1. Passive Shutdown Capability Evaluation. The ATWSevents are roughly divided to three types: LOF, transientover-power, loss-of-heat sink type. Thus far, we used tocall “unprotected LOF (ULOF)” for the LOF-type ATWS.In the prevention evaluation category, however, the corecan be protected by the passive shutdown feature. Such aterminology might create confusion, so we call “LOF withoutscram (LOFWS)” for the passive shutdown evaluation in thispaper. Since the LOFWS event tends to produce the mostsevere consequence among three types of the ATWS events,an analytical result only for the LOFWS event is presented inthis paper.

In the LOFWS analysis, a flow coastdown of all primarypumps was assumed without a reactor trip from a full-poweroperation. A one-dimensional plant dynamics analysis codewith point kinetics and heat transfer models was applied tothis event in a similar way performed in the past [10]. Themaximum temperatures of fuel and coolant in the core werecalculated for the nominal hottest channel, which representsthe hottest fuel assembly in the core. The activation tempera-ture of the SASS was set at 660◦C, the feasibility of which wasexperimentally checked in selecting material components.A three-dimensional computational fluid dynamics (CFD)calculation was separately carried out to obtain a coolanttransport time from the top of neighboring fuel assembliesaround the backup control rod (BCR), where the SASS isinstalled, to the SASS temperature-sensing alloy at a nominalflow rate. Based on this CFD calculation, the transport timewas set 1.3 s and only five-BCR insertion was assumed. Inthis event, this time becomes longer due to the reductionof flow rate. As the other parameter, the time constant of


the detachment, defined as a time difference between thetime when a bulk coolant temperature around the SASSreaches the detachment temperature and the time when theSASS detaches, was also calculated by the CFD approach. Toenhance the time constant, some design modification wasnecessary. This design modification depends on the locationsof individual BCRs, so that the time constants for the core-center BCR and the four neighboring BCRs were set as 3.4 sand 1.0 s, respectively. The insertion time of the detachedcontrol rod was set as 1.5 s for 85% of the rod stroke, basedon actual rod insertion test data. After the passive shutdown,although the natural circulation DHRS can be activated inthe design, such a cooling mode is neglected in this analysisfor simplicity.

Figure 8 shows a typical result of fuel, cladding, andcoolant temperatures for the LOFWS, where the halving timeof the coolant flow rate was 6.5 s. The calculated coolanttemperature around the SASS armature at the four BCRsin the inner peripheral positions in the inner core reached660◦C of the SASS detachment temperature and detachedat 11.9 s after the transient onset. This first BCR insertionmitigated a steep power increase. At another core-centerBCR, the SASS detached the rod at 13.3 s. The calculatedmaximum temperatures of fuel and coolant are 2248 and969◦C, respectively, which are less than the safety criteria.Accordingly, the SASS averted bulk coolant boiling, so thatthe core cooling could be maintained. This analysis indicatedthe passive shutdown capability of the SASS against thetypical ATWS.

4.3.2. CDA Evaluation. As the passive safety features are pro-vided against fast sequences, such as ATWS, and redundantaccident managements against slow sequences, the proba-bility of a CDA becomes negligibly small. Nevertheless, theconsequences of CDAs should be mitigated based on theDiD philosophy, since a recriticality potential in the courseof CDAs has been regarded as one of the major safetyissues in fast reactor cores and also as a potential candidatefor early large-release sequences. Enormous effort has beendedicated to the clarification of accident scenarios and theconsequences of CDAs. Once coolant boiling is assumed,a significant reactivity increase is possible because a typ-ical SFR core has positive void reactivity feedback. Overthe years, therefore, the ULOF scenario has particularlybeen investigated from the viewpoint of mechanical designmargin against super-prompt excursion during the initiatingphase and against energetic recriticality during the transitionphase. The thermal design margin has been also investigatedto ensure IVR [15].

As stated in Section 2.3.3, design measures are taken inthe JSFR safety design approach so that severe power burstevents with recriticality can be eliminated and core materialscan be stably cooled in the reactor vessel for the longterm. In developing the CDA scenario, the core degradationsequences were conveniently divided into four phases: initi-ating, early discharge, material relocation, and heat removalphases. To achieve the IVR, the following safety criteria weredefined for the four phases:

3000

2500

2000

1500

1000

500

0

1100

1000

900

800

700

600

5000 20 40 60 80 100

CladdingCoolantSASS center

SASS other four in inner coreFuel

Time (s)

Tem

pera

ture

(◦ C

)

Tem

pera

ture

(◦ C

)


Safety criterion of coolant

1BCR (center) insertion4BCR insertion

SASSdetachmenttemperature

Figure 8: Loss-of-flow without scram accident with passive shut-down.

(i) no severe power burst for the initiating phase,

(ii) early fuel discharge from the core before the forma-tion of the whole-core scale molten fuel pool for theearly discharge phase,

(iii) relocation of disrupted core materials to the coolablegeometry under the subcritical state for the reloca-tion phase,

(iv) long-term stable cooling of disrupted core materialsin the reactor vessel for the heat removal phase.

In order to avoid severe power burst during the initiatingphase, the sodium void worth should be limited to acertain value. In the FaCT Phase-I, the reference value wasdetermined as less than six dollars (6$) based on boththeoretical consideration and the analytic experiences forvarious types of core design [16]. In general, it could beachieved by shortening the core height less than 1 m in alarge-scale core. It was found that a power excursion drivenby positive reactivity insertion due to sodium voiding ina ULOF sequence could be limited by negative Dopplerreactivity insertion due to rapid fuel temperature increaseand would be finally cancelled by negative reactivity insertiondue to rapid fuel dispersal [17]. Before the FaCT Phase-I, ULOF initiating phase calculations were carried out forvarious core designs using the SAS4A code. In case of tallercore height with larger-diameter fuel pins, the effect ofnegative fuel dispersal was slightly delayed. This was dueto its lower fuel-power density and smaller axial fuel worthgradient. Therefore, additional reference values were createdfor an average fuel-specific heat and core height in the coredesign. These values are 40 kW/kg-fuel and 1 m, respectively.These design conditions were implemented into the currentcore design [18]. A fuel smear density is 82% theoretical


density in the JSFR design, so a high failure threshold isexpected. This pin condition would allow a high axial levelof fuel pin failure resulting in negative fuel motion reactivityjust after the failure [19].

The SAS4A analysis showed mild power burst so as notto reach a prompt criticality during the initiating phase, aspresented in Figure 9. Severe power burst has never beenobtained even in parametric calculations [16]. These averagecore fuel enthalpies were less than the solidus temperatureof oxide fuel. In these calculations, sodium voiding andits reactivity effect inside the inner duct were not takeninto account because a separate calculation indicated thatthe sodium boiling inside the duct occurred in the earlydischarge phase; thus it does not affect the peak power level ofinitiating phase.

In the past, it was reported using the SIMMER-III com-puter code that an energetic recriticality occurred only byradial whole-core scale fuel motion [20]. To avoid such arecriticality, Japanese researchers have struggled to createmeasures enhancing axial fuel discharge, which is the mosteffective in reactivity decrease, before enlarging the moltenregion [21]. As one of measures, special fuel assemblies havebeen proposed to enhance the molten fuel discharge. TheFuel Assembly with Inner DUct Structure (FAIDUS) is aconcept in which a steel duct is installed as a fuel escape pathin every fuel assembly [21]. Considering both the superiorfuel discharge capability of FAIDUS and its impact on otheraspects, we additionally proposed a modified concept ofFAIDUS, as shown in Figure 10. In this concept, a smaller-diameter inner duct with an opening at the upper endwas installed [22]. In the modified FAIDUS design, thefuel escape path is shorter and hotter compared to thatof conventional FAIDUS; therefore, the hydraulic diameterof the inner duct can be smaller. This is advantageous forlimiting the impact of the safety feature on core performance.For the conventional FAIDUS, the development of a newgrid spacer is required in order mainly to keep a clearancebetween the fuel pin bundle and the inner duct locatingat the center of the fuel assembly. On the other hand, theconventional wire-spacer technique can be applied to themodified FAIDUS design because the inner duct is attachedat a corner of the wrapper tube; hence, the fuel fabricationof this concept becomes more feasible with less R&D efforts.It should be noted that certain thermal hydraulic problemscaused by the asymmetric arrangement of the modifiedFAIDUS must be resolved through some minor R&D.

The event sequence after termination of the initiatingphase power transient in a relatively higher-power fuelassembly is explained as follows. The inner duct wall failedby the contact of hot liquid fuel/steel mixture. The fuel/steelmixture is ejected into the inner duct driven by the pressurebuild-up in the pin-bundle side due to fission gas releasedfrom melting fuel. Sodium voiding and its upward expansioninside the duct occur due to interaction between ejectedfuel/steel and liquid sodium. The molten fuel is dischargedupward through the voided duct driven by the gas pressure.The discharged fuel is dispersed into the upper sodiumplenum of the reactor vessel. The dispersed fuel is relocatedmainly on the intermediate isolation plate (top level of the

350

Mass

14 16 18 20 22 24

Time after LOF onset (s)

2

1

0

−1

−2

−3

−4

−5

−6

400

300

250

200

150

100

50

0

1

0.9

0.8

0.7

0.6

Fuel discharge onset

Rea

ctiv

ity

($)

Boiling onset

Power Reactivity

Nor

mal

ized

pow

er b

y fu

ll po

wer

(P

0)

Nor

mal

ized

res

idu

al in

-cor

efu

el m

ass

by in

itia

l mas

s (−

)

Figure 9: Initiating and early fuel discharge phases of unprotectedloss-of-flow accident.

Innerduct

Figure 10: Fuel assembly with inner duct for enhancing molten fueldischarge.

core). The above key phenomena have been confirmed byexperimental study [23].

Figure 9 shows the fuel discharge capability for the mod-ified FAIDUS design during the early discharge phase, whichwas evaluated by the SIMMER-III code. In this calculation,the geometry of a single fuel assembly was used to investigatethe phenomena in detail. The fuel assemblies in the corewere divided into several groups depending on the powerlevel, and fuel discharge phenomena in each representativefuel assembly were separately analyzed using a similar powerhistory but different power level corresponding to each fuelassembly group. Although the power time history was givenas the input obtained from the SAS4A result, the reactivityfeedback due to fuel discharge was taken into accountby means of an iterative calculation procedure. In eachcalculation of the representative fuel assembly, almost all themolten fuel in the assembly was discharged upward throughthe inner duct while the immobile solid fuel remained inthe core region of the assembly. The total amount of fuel


discharged from the core, estimated as the summation of thedischarged fuel from all the fuel assemblies in each group,was about 19% of the initial fuel inventory, and the corereached a subcritical condition.

Just after the early discharge of molten fuel, solid fuelwithout mobility would remain in the core in the decay heatlevel. The event sequence during this phase is explained asfollows. Frozen fuel and remaining solid fuel around theupper part of the core fell and accumulated in the lower partof the core. Upper core structures inside the fuel assembly,such as axial fuel blanket, are collapsed as well as the intactfuel in the most-inner outer core. Based on a preliminaryevaluation, the remaining fuel in the core region starts tomelt by the decay heat at 150 to 200 s after the early fueldischarge phase. From a phenomenological point of view,it is expected that this molten fuel would move downwardlocally through the space in the primary control rod guidetube (CRGT) failed by the contact of materials molten by thedecay heat. It should be noted that absorber-rod insertioncould be assumed in backup CRGTs just at the beginningof the material relocation phase because the temperatureof materials of the SASS would reach high enough to loseits magnetic property by contacting with molten fuel andsodium vapor generated during the early fuel dischargephase.

Based on the above event sequence, the reactivity changewas evaluated by a series of static neutronic calculations. Asa result, a significant reactivity insertion would be avoidedby the enhancement of fuel discharge through the primaryCRGTs; therefore the subcritical state would be ensuredduring the relocation phase.

Because the advanced loop concept has a relativelysmall reactor vessel compared with a large fuel inventory, amultilayer debris tray is basically required to hold the fullinventory of core fuel without dryout and recriticality. Properquenching and distribution as well as coolant convection arecrucial points in this concept. A thermal hydraulic calcula-tion was conducted for the coolability of fuel debris [24]. Inthis calculation, all of the fuel was uniformly relocated on themultilayer debris tray. The DHRS consisting of one DRACSand two PRACSs was available in a fully natural circulationmode. The calculation result showed that the decay heatbalanced the removed heat around 30 min. after the startof the transient. The maximum coolant temperature in thedebris bed was less than 900◦C and steadily decreased afterthe peak temperature, so that sufficient cooling capabilityis provided for a long-term stable retention in the reactorvessel.

5. Probabilistic Safety Evaluation

It is required to implement the PSA in order to check whetherthe requirements of CDF and CFF are satisfied. At the earlystage of drawing the design concept, it is also required toconstruct a well-balanced safe system so as to eliminateany weak points and/or remarkable cliff edge effects thatcan appear in the risk curve from the risk point of view.Therefore, our study aimed at comprehending systematicallythe safety characteristics of the system with respect to a risk

potential and at making design improvement effectively insuch a way as to appropriately control and minimize the riskusing the PSA technique.

In SFRs, typical event sequences leading to core damageare categorized into three types: ATWS, LORL, and PLOHS.The point estimates of their frequencies have been evaluatedby the preliminary PSA, focusing on internal events undernormal operation. These point estimates were 1 × 10−8/ry,4 × 10−9/ry, and 9 × 10−9/ry for ATWS, LORL, and PLOHS,respectively [25]. The total CDF is about 2 × 10−8/ry, whichsatisfies less than 10−6/ry in the risk target. This value alsomeets less than 10−7/ry of CFF.

The PSA activity is continued reflecting up-to-date plantdesign. A seismic PSA is also implemented because it isimportant for the seismic isolation system design in theJSFR. According to the preliminary result, the building andcomponents in the JSFR have a sufficient safety margin evenconsidering a current seismic design condition [25].

6. Conclusions

In the present study, the safety design concept for the JSFRhas been established to fulfill the development target thatwould ensure a safety level comparable to future LWRs.Based on the DiD safety philosophy with the complementaryuse of the risk-informed approach, the JSFR adopts highlyreliable systems that rarely cause abnormal conditionsand specific design measures both for accident preventionand mitigation. In designing the JSFR, considering thesuperior safety characteristics of SFRs, three fundamentalsafety requirements were systematically investigated. Thesubsequent consideration provided as appropriate safetydesign measures: the SASS as the passive feature in additionto the two independent RSSs, the fully natural circulationDHRS that can remove the decay heat without the SHTS, theintroduction of double-wall piping against sodium leaks, acore design limiting the sodium void worth, devisal of thespecial fuel assembly for attaining IVR under ATWS, andthe leak-tight containment. Such passive and static measuresthat need not depend on operator actions can encompasshigh safety and reliability as well as being preferable fromthe physical protection point of view. The safety analyses andPSA revealed that the JSFR design fulfilled the safety criteria.Although some of them necessitate further R&D for theirdeployment in future commercialized reactors, we believe allare within reach. In the next phase, further design study willbe steadily performed along with the several R&D efforts.

Acronyms

ATWS: Anticipated transient without scramBCR: Backup control rodCDA: Core disruptive accidentCDF: Core damage frequencyCFD: Computational fluid dynamicsCFF: Containment failure frequencyCRGT: Control rod guide tubeDBE: Design-basis eventDEC: Design extension condition


DHRS: Decay heat removal systemDiD: Defense in depthDRACS: Direct reactor auxiliary cooling systemFaCT: Fast reactor cycle technology developmentFAIDUS: Fuel assembly with inner duct structureIHX: Intermediate heat exchangerINPRO: Innovative nuclear reactors and fuel cyclesIVR: In-vessel retentionJAEA: Japan atomic energy agencyJSFR: Japan sodium-cooled fast reactorLOF: Loss of flowLOFWS: Loss of flow without scramLORL: Loss of reactor levelLWR: Light water reactorPSA: Probabilistic safety assessmentPHTS: Primary heat transport systemPLOHS: Protected loss of heat sinkPRACS: Primary reactor auxiliary cooling systemR&D: Research and developmentRSS: Reactor shutdown systemSG: Steam generatorSHTS: Secondary heat transport systemUIS: Upper internal structureULOF: Unprotected loss of flow.

Acknowledgments

This paper includes the outcome of collaborative studybetween JAEA and JAPC (representing the nine electricutilities, Electric Power Development Co., Ltd. and JAPC) inaccordance with “the agreement about the development of acommercialized fast breeder reactor cycle system”.

References

[1] Y. Sagayama, K. Okada, and T. Nagata, “Progress on reactorsystem technology in the FaCT project toward the commer-cialization of fast reactor cycle system,” in Proceedings of theInternational Conference on the Fast Reactors and Related FuelCycles (FR ’09), IAEA-CN-176-01-02, IAEA, Kyoto, Japan,December 2009.

[2] K. Aoto, N. Uto, Y. Sakamoto, T. Ito, M. Toda, and S. Kotake,“JSFR design study and R&D progress in the Fact project,” inProceedings of the International Conference on the Fast Reactorsand Related Fuel Cycles (FR ’09), IAEA-CN-176-01-07, IAEA,Kyoto, Japan, December 2009.

[3] S. Kotake, Y. Sakamoto, T. Mihara et al., “Developement ofadvanced loop-type fast reactor in Japan,” Nuclear Technology,vol. 170, no. 1, pp. 133–147, 2010.

[4] M. Ichimiya, T. Mizuno, and S. Kotake, “A next generationsodium-cooled fast reactor concept and its R&D program,”Nuclear Engineering and Technology, vol. 39, no. 3, pp. 171–186, 2007.

[5] U.S. DOE, “Nuclear energy research advisory committee andthe generation IV international forum, a technology roadmapfor generation IV nuclear energy systems,” Tech. Rep. GIF-002-00, U.S. DOE, 2002.

[6] IAEA, “Guidance for the evaluation of innovative nuclearreactors and fuel cycles: report of phase 1A of the InternationalProject on Innovative Nuclear Reactors and Fuel Cycles(INPRO),” Tech. Rep. IAEA-TECDOC-1362, IAEA, 2003.

[7] INSAG, “Basic safety principles for nuclear power plant, 75-INSAG-3 rev. 1,” International Nuclear Safety Advisory GroupReport INSAG-12, IAEA, 1999.

[8] U.S. DOE Nuclear Energy Research Advisory Committee andthe Generation IV International Forum, “Crosscutting riskand safety R&D scope report,” Tech. Rep. GIF-011-00, 2002.

[9] U.S. DOE Nuclear Energy Research Advisory Committee andthe Generation IV International Forum, “Technology goals forgeneration IV nuclear energy systems,” Tech. Rep. GIF-019-00,2002.

[10] S. Nakanishi, T. Hosoya, S. Kubo et al., “Development ofpassive shutdown system for SFR,” Nuclear Technology, vol.170, no. 1, pp. 181–188, 2010.

[11] M. Takamatsu, T. Sekine, T. Aoyama, M. Uchida, and S.Kotake, “Demonstration of control rod holding stability ofthe self actuated shutdown system in Joyo for enhancementof fast reactor inherent safety,” Journal of Nuclear Science andTechnology, vol. 44, no. 3, pp. 511–517, 2007.

[12] H. Yamano, S. Kubo, K. I. Kurisaka, Y. Shimakawa, and H.Sago, “Technological feasibility of two-loop cooling system injsfr,” Nuclear Technology, vol. 170, no. 1, pp. 159–169, 2010.

[13] H. Niwa, S. Kubo, and K. Kurisaka, “LMFBR design and itsevolution: (3) Safety system design of LMFBR,” in Proceedingsof the International Conference on the Advanced Nuclear PowerPlants and Global Environment (GENES4/ANP ’03), vol. 1154,AESJ, Kyoto, Japan, September 2003.

[14] I. Sato, T. Asaga, M. Mizuno, and K. Yamamoto, “Understand-ing on fuel pin behavior under the slow TOP condition basedon in-pile test results,” in Proceedings of the IAEA/IWGFRTechnical Committee Meeting on Material-Coolant Interactionsand Material Movement and Relocation in LMFR, pp. 499–518,Oarai, Japan, June 1994.

[15] H. Endo, S. Takahashi, M. Ishida, and T. Hoshi, “A Studyof the initiating phase scenario of unprotected loss-of-flowin a 600MWe MOX homogeneous core,” in Proceedings ofthe IAEA/IWGFR Technical Committee Meeting on Material-Coolant Interactions and Material Movement and Relocation inLMFR, pp. 297–307, IAEA, Oarai, Japan, June 1994.

[16] I. Sato, H. Yamano, and Y. Tobita, “Development of severeaccident evaluation technology (Level 2 PSA) for sodium-cooled fast reactors, (2) identification of dominant factors ininitiating phase of unprotected events,” in Proceedings of theInternational Congress on Advances in Nuclear Power Plants(ICAPP ’09), AESJ, Tokyo, Japan, May 2009, Paper no. 9132.

[17] H. Niwa, “A comprehensive approach of reactor safety re-search aiming at elimination of recriticality in CDA for com-mercialization of LMFBR,” Progress in Nuclear Energy, vol. 32,no. 3-4, pp. 621–629, 1998.

[18] M. Naganuma, T. Ogawa, S. Ohki, T. Mizuno, and S. Kotake,“Minor actinide-bearing oxide fuel core design study for theJSFR,” Nuclear Technology, vol. 170, no. 1, pp. 170–180, 2010.

[19] I. Sato, Y. Tobita, and K. Konishi, “Elimination of severe recrit-icality events in the core disruptive accident of JSFR aiming atin-vessel retention of the core materials,” in Proceedings of theInternational Conference on the Fast Reactors and Related FuelCycles (FR ’09), IAEA-CN-176-03-23P, IAEA, Kyoto, Japan,December 2009.

[20] Y. Tobita,, K. Morita, K. Kawada, H. Niwa, and N. Nonaka,“Evaluation of CDA energetics in the prototype LMFBR withlatest knowledge and tools,” in Proceedings of the 7th Interna-tional Conference on Nuclear Engineering. (ICONE ’99), vol.7145, JSME, Tokyo, Japan,, April 1999.


[21] H. Endo, S. Kubo, S. Kotake et al., “Elimination of recriti-cality potential for the self-consistent nuclear energy system,”Progress in Nuclear Energy, vol. 40, no. 3-4, pp. 577–586, 2002.

[22] Y. Tobita, H. Yamano, and I. Sato, “Analytical study on elim-ination of severe recriticalities in large scale LMFBRS withenhancement of fuel discharge,” Nuclear Engineering andDesign, vol. 238, no. 1, pp. 57–65, 2008.

[23] K. Konishi, J. I. Toyooka, K. Kamiyama et al., “The result ofa wall failure in-pile experiment under the EAGLE project,”Nuclear Engineering and Design, vol. 237, no. 22, pp. 2165–2174, 2007.

[24] K. Koyama, Y. Yamada, S. Hayakawa, M. Watanabe, and O.Watanabe, “Development of severe accident evaluation tech-nology (level 2 PSA) for sodium-cooled fast reactors, (4)identification of dominant factors in core material relocationand heat removal phases,” in Proceedings of the InternationalCongress on Advances in Nuclear Power Plants (ICAPP ’09),Paper no. 9126, AESJ, Tokyo, Japan, May 2009.

[25] K. Kurisaka and S. Okamura, “Preliminary evaluation of JSFRachievement level to risk target,” in Proceedings of the 19thInternational Conference on Nuclear Engineering (ICONE’11), JSME, Osaka, Japan, October 2011, ICONE19-43802,Suspended Makuhari, Chiba, May 2011.

TribologyAdvances in

Hindawi Publishing Corporationhttp://www.hindawi.com Volume 2014

International Journal of

AerospaceEngineeringHindawi Publishing Corporationhttp://www.hindawi.com Volume 2010

FuelsJournal of


Journal ofPetroleum Engineering


Industrial EngineeringJournal of


Power ElectronicsHindawi Publishing Corporationhttp://www.hindawi.com Volume 2014

Advances in

CombustionJournal of


Journal of


Renewable Energy

Submit your manuscripts athttp://www.hindawi.com


StructuresJournal of

International Journal of

RotatingMachinery


EnergyJournal of


Hindawi Publishing Corporation http://www.hindawi.com

Journal ofEngineeringVolume 2014

Hindawi Publishing Corporation http://www.hindawi.com Volume 2014

International Journal ofPhotoenergy


Nuclear InstallationsScience and Technology of


Solar EnergyJournal of


Wind EnergyJournal of


Nuclear EnergyInternational Journal of


High Energy PhysicsAdvances in

The Scientific World JournalHindawi Publishing Corporation http://www.hindawi.com Volume 2014

safetydesignandevaluationinalarge-scalejapan sodium...

Documents