Flexblue ® Underwater Reactor : Introduction to the Concept and to the Passive Safety Strategy for a Steam Generator Tube Rupture Accident

Nuclear power plants (NPPs), which are operating and under construction are large-scale reactors with an electrical output around 1,000 MWe. These plants do not address the needs of developing countries or archipelagos, where the grids are smaller and the investment capacities are limited. For this reason, many nuclear designers develop Small Modular Reactors (SMRs), which can generate electrical output below 300 MWe. DCNS offers a FLEXBLUE® as a solution to the problem. FLEXBLUE® is a subsea-based Small Modular Reactor and fully transportable nuclear module. A FLEXBLUE® module is designed for the single purpose of delivering electricity to the grid. Its power output is 160 MWe and is sent to the grid by submarine cables. The goal of this study is to work out an innovative strategy to handle a steam generator tube rupture with passive systems only, without releasing any radioactive elements to the environment, and without flooding the containment. Corresponding Author: Vincent GOURMEL, email: vincent.gourmel@ dcnsgroup.com Received: 29 July 2016 Accepted: 21 August 2016 Published: 21 September 2016 Publishing services provided by Knowledge E Vincent GOURMEL. et al. This article is distributed under the terms of the Creative Commons Attribution License, which permits unrestricted use and redistribution provided that the original author and source are credited. Selection and Peer-review under the responsibility of the ICoNETS Conference Committee.


Introduction
Nowadays, most of nuclear power plants (NPPs) operating in the world or under construction are large-scale reactors with an electrical output around 1,000 MWe.This offer corresponds to the needs of large power grids like those in Europe, USA, Japan or China where electrical connections are powerful and utilities can afford a huge initial investment.However, these units are too powerful to fit in smaller grids where they would represent more than 10% of the installed capacity.Thus, current nuclear offer does not address the needs of developing countries or archipelagos, where the grids are smaller and the investment capacities reduced.This is why many nuclear designers are developing new concepts of NPPs: Small Modular Reactors (SMRs).Electrical output of these future plants will be below 300 MWe.The financing would be eased by a more progressive capital expenditure, a shorter construction time and an accelerated return on investment [1].The large reactors "economies of scale" are replaced by small units "economies of number" (series effect, learning effect, shared support facilities).
But the small modular reactors costs are still penalized by important civil engineering work since reactor system is sealed into large underground concrete structures.Furthermore, ICoNETS Conference Proceedings there is significant energy demand in areas where land is scarce, highly populated or unsuitable for the construction of NPPs -because of the threat of natural hazards for example.Based on these two ascertainments, DCNS has imagined a solution to address the energy needs of such countries, without requiring a suitable construction land and without high civil engineering cost.This solution is FLEXBLUE ® , a subsea-based Small Modular Reactor.
DCNS is a French state-owned company, which has been designing, building, maintaining and dismantling ships of the French Navy and many foreign Navies for several centuries.DCNS engineering offices and shipyards have especially designed and built nuclear submarines and nuclear aircraft carriers during the last 50 years.Not less than 17 nuclear-propelled ships have been delivered by DCNS teams.
The goal of this study is to work out an innovative strategy to handle a steam generator tube rupture (SGTR) with passive systems only, without releasing any radioactive elements to the environment, and without flooding the containment.A SGTR is a major accident for Pressurized Water Reactors.Indeed, when a PWR is at power, the steam generator (SG) tubes form both the second and the third confinement barriers because the main steam lines at SG outlets bypass the containment.When a rupture occurs, possibly contaminated primary fluid flows out the containment to the secondary system.

Location and Lifecycle
FLEXBLUE ® is a subsea and fully transportable nuclear module.Its power output is 160 MWe and is sent to the grid by submarine cables.The module is anchored on the seabed, a few kilometers away from the shore, at an immersion depth comprised between 50 and 100 meters.The module is a 150-meter long, 14-meter diameter horizontal cylinder.Several modules can be gathered into a FLEXBLUE ® farm.The module is remotely operated from an onshore control center.There is not permanent staff on board, only occasional presence for light maintenance.A FLEXBLUE ® module is not a submarine: it is not self-propelled; it does not use any military devices but only civilian technologies.It is designed for the single purpose of delivering electricity to the grid.
Once set up on the seabed, the reactor starts a 40-month production cycle.Then, production stops for refueling.The module is removed and transported by a ship to a coastal support facility where the spent fuel pool is located.Then the module is sent back on production site and a new cycle begins.Major maintenance and control occur every ten years (every three fuel cycles).FLEXBLUE ® 's lifecycle is presented in Fig. 1 and its module main characteristics are shown in Table 1.

Construction
FLEXBLUE ® will be completely manufactured in factories and then assembled in a shipyard, using naval modular construction techniques that DCNS perfectly masters.Components can be made in different places in parallel, which reduces the construction time.Then, they are mounted on modular structures named 'skids'.The skids are finally inserted into the hull.
Compared to a large outdoor construction site, this industrial process enables a very modular assembly, a reduced construction time and a better quality of the work (which eases the compliance demonstration).Thus, the industrial risk is reduced.DOI 10.18502/ken.v1i1.475The construction cost of a SMR is supposed to be higher than the one of a large NPP, because of the economies of scale [2].However, economies of scale are not the only ways to decrease the capital cost per MWe.There are many SMR specific factors that make the capital cost of a SMR close to the one of a large reactor:
Co-siting: when several units are built on the same site (like a FLEXBLUE ® farm), capital cost is reduced because a lot of work is shared (geological studies, site licensing process, public acceptance, grid connection).

2.
Modular design: as explained in the previous section, a modular design and a modular construction contributes to reduce the cost of a nuclear unit.

3.
Series effect: because of their small output, the scheduled number of SMRs is high.
Thanks to this serial production, there will be a "learning effect": the Nth-of-a-kind will be less expensive as N is growing.

4.
Shared facilities: SMRs will make possible an increased mutualisation of support functions which is cost efficient.In the FLEXBLUE® concept, the control centre operates an entire farm.The support facility (refuelling, waste management, maintenance) is shared between several modules and even several farms.

5.
No civil engineering: this factor is FLEXBLUE® specific.The module does not require any expensive and time-consuming large concrete building like typical NPPs and other SMRs.
By considering the beneficial of those factors, SMRs can be competitive againts the usual large NPPs, and generally in the energy market [2].DCNS analysis leads to the same conclusion, and shows that the levelized cost of energy produced by a FLEXBLUE ® module will be between 100 and 120 €/MWh.This cost is slightly higher than electricity cost from new NPPs but still very competitive in the energy market.
Besides, the investment required is much more progressive and make the nuclear energy accessible for utilities which have not the capacity to finance the upfront cost of a large NPP [3].
The market that FLEXBLUE ® addresses is very large.An important share of human activity and population is located near seawater, so electricity demand is high on the coastlines.FLEXBLUE ® is the only nuclear solution to deliver electricity at a short distance of a coastal highly populated area without compromising safety.In addition, immersion is a great protection against many natural hazards like tsunamis or earthquakes (the module will be attached on the seabed by anti-seismic studs).FLEXBLUE ® also answers to the needs of countries eager to create local qualified jobs and to reduce their reliance on fossil fuels (to be more independent energetically or to reduce their greenhouse gases emissions, or both).For a new-comer country in nuclear energy, FLEXBLUE ® offers the possibility of investing at one's own speed.This flexibility is a key asset in today's uncertain energy market.

Impact
The FLEXBLUE ® concept offers valuable differentiating advantages compared with other NPPs in terms of impact.Indeed, immersion is much more an opportunity than a risk.First, there is no visual impact: the power plant is not visible.Then, there is no population in the vicinity of the module.FLEXBLUE ® is the only solution to produce high quantities of electricity without requiring a single square meter of land and without being nearby of any population.As a consequence, no relocation of the population has to be envisaged in case of a severe accident: the land is entirely preserved.
About the environmental impact, one of the objectives of FLEXBLUE ® early-stage design is to reduce the generation of waste.In particular, there is no soluble boron needed to control the core.It contributes a lot to the reduction of effluents production.Thus, a module does not release any radioactive liquid effluents during the fuel cycle.Storage capacities are foreseen, and liquid effluents will be collected and treated every three years by the support facility.Another great asset of FLEXBLUE ® is its removability.The installation of modules is fully reversible because there is no large concrete structure.Thus, no dismantling is needed onsite at the end of the plant lifetime.The intact site will be quickly restored to the environment.
This full removability also authorizes modules to change production site along their 60-year lifetime.Dismantling of the module will take place in an appropriated shipyard, like it has already been done for several retired nuclear submarines.
Thanks to these unique features, unmatched in the nuclear field, FLEXBLUE ® is respectful of the environment and more easily acceptable for the population.It makes the nuclear energy more accessible to countries eager to develop their electrical production with clean, safe, reliable and low-carbon solutions.

KnE Energy
ICoNETS Conference Proceedings two-loop reactor, with a pressure vessel, two horizontal recirculating steam generators (SGs), two canned coolant pumps and a pressurizer as shown in Fig. 4. Primary loops are designed to ease natural circulation.Meanwhile, FLEXBLUE ® reactor characteristics are given in Table 2 [4].The primary system and all the auxiliary and safety systems that carry primary fluid are located inside the reactor compartment of the module as shown in Fig. 3.This compartment forms the third barrier of confinement (the first one is the fuel cladding and the second one is the primary system pressure boundary).The other compartments host the turbo-generator, an on board control room, instrumentation and control panels, process auxiliaries and a living area for occasional workers.In addition, the onshore control center hosts emergency generators that can supply active systems in the module through submarine cables in case of abnormal transients, but none of those are safety-related.Nuclear safety is fully guaranteed by the passive devices located into the module.This safety concept is inspired by the lessons learned from previous nuclear accidents in the world, especially the Fukushima Daiichi accident.In the FLEXBLUE ® concept, safety does not depend neither on emergency diesel generators (that have been flooded by the tsunami in Fukushima) nor on human intervention (that can lead to mistaken actions).Safety only relies on some automatic operations, and mainly on permanent natural phenomena: gravity and natural circulation of water between a heat source (the core) and a heat sink (the ocean).This makes the FLEXBLUE ® safety concept very robust.

Reactivity control
If an emergency signal is actuated by an abnormal situation in the reactor, chain reaction can be stopped passively by two diversified devices.The first one is the control rods that drop in the core by gravity.The second one is the gravity-driven emergency boron injection system, which is actuated only in case of anticipated transient without scram.Both these devices can independently shutdown the reactor and keep it subcritical up to cold shutdown state [4].

Core cooling
The core residual heat after scram is removed by four cooling loops, each one able to transfer 50% of decay heat: i.Two primary chains are connected to the primary circuit: each one includes an inlet pipe connected to a hot leg, a passive primary heat exchanger (PPHX) immersed in a large safety water tank, and an outlet pipe connected to a cold leg.The intermediate heat sink formed by the safety tank is cooled by the ocean through the metallic hull.
ii.Two secondary chains are connected to the secondary circuit: each one includes an inlet pipe connected to a main steam line, an emergency condenser (EC) directly immersed in seawater and an outlet pipe connected to a feedwater line.
Thanks to the infinite heat sink -seawater -and to the elevation difference of the heat sink with respect to the heat sources, the four chains operate passively by natural circulation.
In normal conditions operation, they are closed by pneumatic valves and open to their fail safe position when electrical load is lost.The targeted long-term safe state of the reactor is a shutdown state where continuous cooling of the reactor core is achieved by natural circulation as shown in Fig. 4.
Protection against loss-of-coolant accidents is ensured by two passive safety injection trains.Each one includes a direct vessel injection line fed by three injection sources: a core makeup tank (CMT) pressurized by the primary circuit, a classical accumulator (Acc) pressurized at 40 bars by nitrogen and a large safety tank which feeds the primary circuit by gravity when primary pressure has decreased to near containment pressure.In addition, a two-train automatic depressurization system (ADS) is connected to the pressurizer (PZR) and to the hot legs to generate a controlled depressurization of the primary circuit which enables faster DOI 10.18502/ken.v1i1.475

KnE Energy
ICoNETS Conference Proceedings injection.Once these systems have actuated, the long-term equilibrium state is reached when the safety tanks are empty and the reactor compartment is flooded as shown in Fig. 5.At that point, a passive recirculation path is in place: water boils off the core, is released in the containment, condensates on the containment walls, collects in the sump and is injected back into the reactor pressure vessel through sump screens and direct vessel injection lines by gravity as shown Fig. 6.Decay heat is transported and removed through the metallic hull.
Thanks to the unlimited heat sink (the ocean), grace period is theoretically infinite for both targeted safe states, which is a breakthrough in nuclear safety.

Radioactivity confinement
Confinement of the radioactive isotopes is guaranteed by three hermetic barriers: the fuel cladding, the primary circuit pressure boundary and the containment boundary.The latter one is formed by the hull and the reactor compartment walls and is designed to sustain a 10bar internal pressure.To protect its sealing against over pressurization, it is equipped with a Pressure Suppression System as shown in Fig. 7. Indeed, in case of a break in the primary or secondary systems, the pressure in the reactor compartment quickly rises.The pressurized airvapor mixture in the drywell is passively driven to the bottom of the wetwell where the vapor is condensed.It significantly reduces the pressure in the drywell.

Complements
The large safety tank in the reactor compartment plays three important roles: intermediate heat sink for the passive primary heat exchangers; low-pressure injection source in case of a loss of coolant accident; suppression pool to protect the containment sealing.They also act as an efficient radiation shield to protect workers and systems located in the adjacent compartment.
The capability of the hull to reject decay heat to seawater is a key point of the safety concept.It is needed to cool the safety tank and to condense vapor in the containment.FLEXBLUE ® hull heat transfers have been investigated [6].Results show the great potential of the design to remove residual power to the heat sink as shown in Fig. 8.

ICoNETS Conference Proceedings
The easiest strategy to manage a SGTR in the FLEXBLUE® reactor is to consider the tube rupture as a small break LOCA as shown in Fig. 9.The accident analysis of this transient is presented in [8].This strategy is acceptable: all the safety criteria are respected.However, the consequences on the availability of the plant are important.The reactor compartment is flooded with primary water and it would take time to restore the operability of the plant.

Analysis Tool and Reactor Model
Athlet ATHLET (Analysis of Thermal-Hydraulics of Leaks and Transients) is a thermal-hydraulic system code developed by the German technical safety organization GRS.It is applicable to the analysis of light water reactors, and has already been used for the analysis of transients involving horizontal SGs, similar to the ones of Flexblue ® .It is composed of four main calculation modules: thermofluid dynamics, heat transfer and heat conduction, neutron kinetics, and control & balance of plant.

Modelisation
FLEXBLUE® reactor is modelled with ATHLET in accordance with GRS guidelines [9,10].The nodalization of the circuits is performed in order to get both a sufficient accuracy and an acceptable calculation time.Two core channels are modelled: an outer ring and an inner channel where power density is higher.In this latter one, the hot fuel pin is modelled to calculate peak clad and fuel temperatures.The two loops are modelled, as well as all the safety systems with the exception of the emergency boron injection system (failure of scram is not considered in the studied transients).Pressurizer and piping are considered perfectly insulated.The injection sources (tanks and accumulators) are not borated.The active auxiliary systems and the regulations are modelled for this study.Indeed, their effect can be penalising.For example, if the chemical and volume control system is running after a SGTR, it increases the flow rate through the leak.A special attention is given to these active systems during the study, in order to ensure that only the penalising effects are considered.The diagram of the ATHLET model is showed on Fig. 10.

ICoNETS Conference Proceedings
The model considers a 2.5-second delay between the scram signal and the full insertion of control rods.Decay heat calculation is based on formulas from [11], which are extracted from standards of American Nuclear Society [12], and then conservatively increased by 20% to respect NRC guidelines [13].Fig. 11 presents the considered decay heat for the accident analyses.3.
ICoNETS Conference Proceedings

Elaboration of a New SGTR Strategy
As stated previously, the FLEXBLUE® strategy in case of a SGTR must avoid the flooding of the containment and lead to a safe shutdown state where primary system is closed (Fig. 6).The flooding of the containment is caused by the depressurisation of the primary system and the injection of the low-pressure safety tank.These two events happen only when the low-level signal is actuated in the core makeup tanks (the first tanks that inject water in the vessel after a LOCA).To avoid the flooding, it is mandatory not to trigger this signal (see red cross on the process in Fig. 11) and then to keep the CMTs filled with water -at least partially.This is possible if the amount of coolant lost through the SG tube rupture is reduced.The driving force of this leak is the difference between the primary pressure and the pressure in the affected steam generator (respectively 155 bars and 62 bars at nominal conditions).The most efficient way to reduce the loss of coolant through the leak is to eliminate as quickly as possible this difference of pressure.Two parallel actions must be implemented in the SGTR mitigation strategy: 1. Decrease the primary pressure.The opening of the depressurisation valves is not an option because the containment must not be flooded.So, the passive primary heat exchangers and the passive secondary emergency condensers will be used to remove decay heat from the primary system and decrease its pressure.
ICoNETS Conference Proceedings passively opened.During 1,000 seconds, there are several discharges of secondary steam through the safety valves.Meantime, the primary pressure strongly decreases, thanks the combined action of the two PPHXs, the EC1 and the safety valves of SG2.At t=1800s (23 minutes after the tube rupture), the balance between primary pressure and SG2 pressure is achieved: the leaks stops.This strategy fully respects the safety criteria and ends on a safe shutdown state where the primary system is closed and the containment is not flooded.But there is one major negative impact: the several discharges through the SG2 safety valves have contaminated the safety tank with 271 kg of activated steam.Indeed, the safety valves discharges are collected by the safety tank, and the fluid in SG2 is slightly activated because of the tube rupture.This consequence is not a safety issue, because the safety tank is located into the containment (the confinement is not by passed).But it is detrimental for the availability of the plant because the decontamination of a large tank is time consuming.The objective of the next options will be to handle the accident without requiring to the safety valves.

Option B
In this option, the command of the emergency condenser (EC) of the affected SG is modified.
Instead of locking its opening, the state of the emergency condenser depends on the pressure in the affected SG, as shown in Fig.

Figure 1 :
Figure 1: Artist views of a FLEXBLUE® module lifecycle: a) the subsea production site and the onshore control center; b) the ship transport; c) the support facility for refueling and maintenance; d) the transport back to the production site.

Figure 2 :
Figure 2: Cross view and profile view of FLEXBLUE® reactor.The coolant pumps (brown) are located at the outlet of SGs (green).

FLEXBLUE ® is
based on a unique safety concept: a full passivity and an unlimited grace delay.It is the greatest asset of immersion: ocean around the module forms an infinite heat sink for the passive heat removal systems in case of an accidental transient.The safety systems ICoNETS Conference Proceedings are designed in order to operate passively according to the IAEA passivity definition [5].All safety functions are fulfilled without any operator action and external electrical input.The little amount of energy needed at the beginning of a transient for actuation and monitoring is supplied by on board, redundant emergency batteries.

Figure 4 :
Figure 4: Targeted safe state when primary circuit is intact.

Figure 5 :
Figure 5: Targeted safe state when primary circuit has failed.

Figure 8 :
Figure 8: Seawater temperature field (K) around the top of the hull when hull internal surface temperature is 373K and initial seawater temperature is 308K [6].

Figure 9 :
Figure 9: Steam generator tube rupture and radioactive releases to the environment on a typical landbased Pressurized Water Reactor.

Figure 11 :
Figure 11: Logical process leading to the containment flooding.

Figure 13 :
Figure 13: Primary and secondary pressures after.

Figure 14 :
Figure 14: Option B actuation logic for the emergency condenser connected to the affected SG.

14 .
If the pressure exceeds 80 bars, the condenser is opened and the pressure decreases.When the pressure drops below 70 bars, the condenser is closed and the pressure increases again.The cycle can repeat itself several times.The safety valves are not requested because the pressure always remains below 83 bars.The leak is quickly stopped because the pressure in the affected SG remains rather high (above 70 bars).ICoNETS Conference ProceedingsIn the option C strategy as in Fig.18, the affected SG is depressurised during the first stage of the accident by the automatic opening of valves A. When the reduction of primary pressure is considered sufficient (below 80 bars), valve B is closed.The affected SG pressure increases and the balance is done with the primary pressure.This balance comes a little bit later than in previous options (28 minutes after the tube rupture).With the new layout and the new actuation logic, each valve is single-action so the management of the accident is fully passive.The transient ends on the targeted safe shutdown state where primary system is intact, without external electrical input and without operator action.There is absolutely no radioactive release to the environment, but only a limited release to the turbo-generator before the detection of the tube rupture.

Figure 16 :
Figure 16: New layout of the emergency condenser valves.

Figure 17 :
Figure 17: Diagram of FLEXBLUE® reactor and its passive cooling systems (two PPHXs and two ECs).Valve "B)" is specific to option C of the SGTR mitigation strategy.

Figure 18 :
Figure 18: Primary and secondary pressures after a SGTR in steam generator n°2 with option C strategy.