AnsaldoEnergia

Divisione Nucleare
Progetto
project
Cliente
customer
PDS-XADS
EUROPEAN COMMISSION
Rag. Soc. Fornitore
suppliers
AnsaldoEnergia
Identificativo
document no.
Sistema
sys.
Sigla
code
XADS 20 TRIX 009
Comm.-S.comm.
job. no.
D33020
Ident. esterno / Rev.
supplier ident. / rev.
Emittente
issued by
DNU/NEA
Pagina
page
1
Cl. ris.
class
Di
of
173
Tipo doc.
doc type
Ordine attivo / Contratto
order
FIKW-CT-2001-00179 dated 30/10/2001
Titolo
title
Contractual Deliverable N° D19
TECHNICAL REPORT
Design Basis Conditions for Lead Bismuth Eutectic Cooled XADS
Identificativo Componente
equipment identif. code
Sostituisce
substitutes
G.Q.
q.a.
Cant.
site
Forn.
supplier
ITER
Ansaldo
Cliente
customer
Note
notes
B
N
/
E
ELECTRONIC FILENAME: XADS20TRIX009_1.DOC ELECTRONIC FORMAT: MSWORD97 DESCRIPTION: TEXT
Rev.
rev.
Rif. Approv. Ansaldo
Ansaldo's appr. ref.
Rif. Approv. Cliente
Customer's appr. ref.
Rev.
rev.
Rif. Approv. Ansaldo
Ansaldo's appr. ref.
Rif. Approv. Cliente
Customer's appr. ref.
1 18-02-2004 Final Issue L. Mansani R. Monti R. Monti
0 08-01-2003 First Issue L. Barucca L. Mansani R. Monti
Rev.
rev.
DNU 019/3
Data
date
Descrizione
description
Stato
validità
issue st.
Redazione
prepared by
Controllo/
approvazione
checked / approved by
Informazioni strettamente riservate di proprietà Ansaldo - Da non utilizzare per scopi diversi da quelli per cui sono state fornite
confidential information property of Ansaldo - not to be used for any purpose other than that for which is supplied
Autorizzazione
emissione
issue authorization

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
2
Cronologia e storia delle revisioni
Chronology and history of revisions
Rev. / rev. Data /
date
Descrizione /description
0
1
08-01-2003
18-02-2004
First Issue
Included Tractebel Contribution on MYRRHA; included short
description of LINAC; referenced CEA Report on LINAC
malfunctions; deleted Appendix B (Cyclotron malfunctions) and
changed the term "limiting events" with "representative events".
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
3
CONTENTS
1. SCOPE.......................................................................................................................6
2. INTRODUCTION........................................................................................................7
3. IDENTIFICATION OF ACCIDENT INITIATING EVENTS..........................................8
3.1 GENERAL ......................................................................................................................8
3.2 BRIEF DESCRIPTION OF THE MAIN COMPONENTS/SYSTEMS OF THE
XADS ..............................................................................................................................8
3.2.1 Reactor System........................................................................................................11
3.2.2 Reactor Coolant System .........................................................................................16
3.2.3 Intermediate Heat Exchangers ...............................................................................19
3.2.4 Reactor Proton Beam Target System ....................................................................19
3.2.5 Primary Cover Gas System.....................................................................................22
3.2.6 Secondary Coolant System ....................................................................................23
3.2.7 Reactor Vessel Air Cooling System.......................................................................26
3.2.8 Accelerator...............................................................................................................28
3.3 MASTER LOGIC DIAGRAM ........................................................................................42
3.4 FUEL CLADDING CHALLENGES...............................................................................43
3.4.1 Power Anomalies.....................................................................................................43
3.4.2 Decrease of fuel assembly heat removal ..............................................................45
3.5 REACTOR COOLANT SYSTEM AND TARGET UNIT COOLANT SYSTEM
CHALLENGES .............................................................................................................46
3.5.1 Reactor Coolant System Challenges .....................................................................47
3.5.2 Target Unit Coolant System Challenges ...............................................................67
3.6 CONTAINMENT CHALLENGES..................................................................................75
3.7 LIST OF ACCIDENT INITIATING EVENTS .................................................................86
4. CATEGORIZATION OF ACCIDENT INITIATING EVENTS ....................................89
4.1 CATEGORY GROUPING CRITERIA ...........................................................................89
4.2 LIST OF ACCIDENT INITIATING EVENTS CLASSIFIED IN EACH
CATEGORY..................................................................................................................90
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
4
5. LBE COOLED XADS ACCEPTANCE CRITERIA FOR SAFETY
ANALYSES..............................................................................................................93
5.1 GENERAL ACCEPTANCE CRITERIA.........................................................................96
5.1.1 Effective Multiplication Factor................................................................................96
5.1.2 Hydrodynamic Stability...........................................................................................97
5.1.3 Primary Coolant Bulk Boiling .................................................................................99
5.1.4 Secondary Coolant ................................................................................................100
5.2 ACCEPTANCE CRITERIA FOR THE PHYSICAL BARRIERS .................................104
5.2.1 Fuel cladding limits ...............................................................................................104
5.2.2 Reactor Primary System limits.............................................................................107
5.2.3 Reactor Containment. ...........................................................................................109
5.2.4 Radioactive releases to external environment ...................................................110
5.2.5 Summary of acceptance criteria for the physical barriers and the
radioactive releases .............................................................................................111
6. REPRESENTATIVE EVENTS................................................................................114
6.1 LIMITING EVENTS SELECTION CRITERIA .............................................................114
6.2 REVIEW AND DISCUSSION OF INITIATING EVENTS ............................................115
6.2.1 Generated power anomalies.................................................................................116
6.2.2 Decrease of fuel assembly heat removal ............................................................116
6.2.3 Increase in heat removal from reactor coolant system .....................................117
6.2.4 Decrease in heat removal from reactor coolant system ....................................118
6.2.5 Decrease in primary coolant flowrate..................................................................118
6.2.6 Increase in primary coolant flowrate ...................................................................119
6.2.7 Decrease of primary lead-bismuth inventory......................................................119
6.2.8 Increase of reactor coolant system pressure .....................................................119
6.2.9 Decrease in heat removal from target unit..........................................................120
6.2.10 Decrease in target unit coolant flowrate .............................................................120
6.2.11 Increase in target unit Pb-Bi inventory................................................................120
6.2.12 Increase in target unit pressure ...........................................................................121
6.2.13 Increase in target unit temperature......................................................................121
6.2.14 Leakages from high energy systems inside reactor containment....................121
6.2.15 Reactor containment pressure tests ...................................................................121
6.2.16 Inadequate reactor containment heat removal ...................................................122
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
5
6.2.17 Low energy radioactive fluid system failure inside reactor containment ........122
6.3 SUMMARY OF REPRESENTATIVE EVENTS...........................................................122
7. SUMMARY AND CONCLUSIONS.........................................................................130
8. REFERENCES.......................................................................................................132
APPENDIX A – LIST OF INCIDENTAL AND ACCIDENTAL SITUATIONS FOR
THE MYRRHA DESIGN.......................................................................................................133
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
6
1. SCOPE
Primary goal of this document is to identify and categorize, by means of a systematic
approach, all the "internal" initiating events (i.e. events that originate inside the facility) that
lead to abnormal or accident conditions in the eXperimental Accelerator Driven System
(XADS) and, subsequently, permit a selection of the representative events.
The initiating events are identified and categorized basing on the Ansaldo XADS Reference
Configuration [1]. It is underlined that, at the present time, limited technical information (or
even almost no information) is available for some Ansaldo XADS systems; the detail of the
analysis presented in the document is thus necessarily commensurate to the amount of
available information.
The representative events are defined as those that, for each category, have the most
potential to challenge the integrity of the physical barriers between the radioactive isotopes
and the external environment and hence to originate significant radioactivity releases to the
external atmosphere. They will have to be analyzed in order to assess their consequences.
The document does not address "external" events (i.e. events that originate outside the
facility).
The document includes, as Appendix A, also the MYRRHA initiating events. The initiating
event list contains the DBC, DEC and the Residual Risk Situations for the MYRRHA
concept.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
7
2. INTRODUCTION
The XADS (eXperimental Accelerator Driven System) [1] is designed to contain and limit
radioactivity releases to the external atmosphere in order to guarantee that no undue risk
occurs for the population surrounding the plant (the design of the XADS shall ensure that an
evacuation plan for the population is not necessary).
Similarly to nuclear power plants this is achieved by providing physical barriers between the
radioactive isotopes and the external environment (namely the fuel cladding, the primary
system boundary and the containment for fission products and the latter two for activation
and spallation products).
The XADS design must be able to fulfill the above goal both during Design Basis Conditions
(DBC) and Design Extension Conditions (DEC).
The Master Logic Diagram (MLD), systematically describing all the abnormal or accident
conditions resulting in potential challenges to the physical barriers is described. Based on it
the list of accident initiating events is worked out and each event is attributed to the
appropriate category.
The representative events of each category (which will have to be analyzed in order to
determine their consequences) will be identified.
It is pointed out that, at the current status of development of the XADS design, limited
technical information, or even almost no information, is available for some systems, in terms
of operating modes and parameters as well as, sometimes, operating process. While this is
inherent to the early design phase of a largely innovative concept, it implies that the depth of
the presented analyses is therefore necessarily commensurate to the amount of available
information. It will be possible to work out more details as soon as the design development
will make available additional pertinent information.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
8
3. IDENTIFICATION OF ACCIDENT INITIATING EVENTS
3.1 GENERAL
The objective of this section is to define a comprehensive set of design basis, abnormal and
accident events that encompasses both the anticipated occurrences and the conceivable
malfunctions and failures that pose challenges to the integrity of the physical barriers (fuel
cladding, reactor primary system, containment) and/or may result in radioactivity releases to
the environment.
These are the so-called "Design Basis Conditions", which are deterministically factored in
the design of a nuclear power plant and will consistently be factored in the design of the
XADS.
In addition to the Design Basis Conditions, the so called "Design Extension Conditions" are
also normally addressed in the design of a nuclear power plan, to show that probabilistic
safety objectives for core damage and for large releases of radioactivity to the external
atmosphere are met.
Design Extension Conditions for the XADS include, in principle, Anticipated Transients
Without Proton Beam Trip, Complex Sequences with multiple independent malfunctions and
Sequences of Events involving Severe Core Damage.
A comprehensive approach to Design Extension Conditions is not part of this document and
will not therefore be dealt with in this section.
Two approaches can be taken in identifying the accident initiating events. One is a
comprehensive engineering evaluation, taking into consideration information from previous
risk assessments, documentation reflecting operating histories and plant-specific design
data. The information is evaluated and a list of initiating events is compiled, based on the
engineering judgment derived from the evaluation. Another approach is to more formally
organize the search for initiating events by constructing a top-level logic model (called
Master Logic Diagram) and then deducing the appropriate set of initiating events.
Because of the peculiar characteristics of the XADS (and the resulting lack of plant specific
data as well as, even more so, of operating data) the second approach has been adopted to
define the initiating events set.
3.2 BRIEF DESCRIPTION OF THE MAIN COMPONENTS/SYSTEMS OF THE XADS
The main components/systems of the XADS, relevant for safety analyses, are listed below
with a brief description of their functions. Moreover a brief description of some relevant
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
9
XADS components/systems is provided to better understand the Master Logic Diagram
constructed in the Sections from 3.3 to 3.6.
Reactor System
Provides the generation of energy from nuclear fission, and geometry for the
thermohydraulic processes to take place. Provides neutron-shielding structures. Encloses
the reactor coolant; provides Core supporting structures; provides a cover for the Reactor
Vessel, inclusive of the mechanisms for fuel manipulation; provides a redundant barrier to
contain the primary coolant in case of leakage (Guard Vessel).
Reactor Coolant System
Provides the lead-bismuth eutectic circulation to remove the energy from nuclear fission and
beam radiation, as well as the means for transferring energy from the primary coolant to the
secondary systems.
Accelerator Beam Transport System
Provides the transportation of the proton beam inside the Reactor Vessel.
Reactor Proton Beam Target System
Provides the interface between the proton beam and lead-bismuth spallation target, along
with the related cooling functions.
Primary Cover Gas System
Provides storage, supply, circulation, confinement, and pressure control of the primary
cover gas, and the gas for the in-Vessel enhanced circulation. Provides the radiological
control and the decontamination of the primary cover gas. Provides the chemistry control of
the reactor coolant.
Target Enhanced Circulation System
Provides a constant injection of Argon directly into the mass of the target coolant, to
maintain the conditions required for sustaining the target coolant flow rate during normal
plant operations.
Reactor Integrated Purification System
Provides the in-Vessel-integrated purification of the reactor coolant.
Reactor Coolant Filling System
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
10
Provides the Reactor with liquid LBE for initial filling. Provides for refill of the target system.
Reactor Vessel Air Cooling System
Provides the means for passive decay heat removal through air convection and radiation
from the Guard Vessel in case of Secondary Coolant System unavailability.
Secondary Coolant System
The system provides the heat transport from the primary coolant to the external
environment via the Air Coolers.
Containment System
Mainly includes components that are part of the Reactor Building structure, like foundation
basemat, walls, hatches, mechanical and electric penetrations, etc. It provides a barrier
against the release of radioactive products to the environment. It includes hatches for
personnel and materials.
Reactor Building HVAC System
Provides filtration, recirculation, temperature and pressure control of the atmosphere in the
Reactor building and purification of the air from airborne radioactivity before release to the
stack.
Plant Protection and Monitoring System
Provides the acquisition of safety grade field signals, the generation of beam trip signals
and subsequent Accelerator scram, the actuation of the safeguard system logic, and drives
the operation of safety components.
Core Instrumentation System
Provides the Instrumentation and data Elaboration for an on-line evaluation of Keff.
Core (Exit) Temperatures Monitoring System
Provides Core exit temperature signals to monitor the adequacy of Core cooling functions.
Failed Fuel Detection System
Detects a fuel clad leak and provides information for locating the failed element.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
11
Neutron Flux Monitoring System
Provides Core neutrons flux monitoring during all plant conditions, and transmits signals for
use in the Plant Protection and Monitoring System.
Plant Control System
Provides the automatic control of all parameters relative to the operation of the Reactor,
Accelerator, and other systems belonging to the Nuclear Island.
Leak Detection System
Permits the detection of primary coolant leakage from the Reactor Coolant System.
Radiation Monitoring and Protection System
Provides radiation monitoring of plant effluents, process fluids, and plant areas. Provides
alarms, indications, and automatic protective actions for concerns of the Health Physics.
Radioactive Drain Network System
Provides storage of all the liquid radwaste inside the Radwaste Building (designed to house
all the equipment needed for processing solid, liquid, and gaseous wastes deriving from the
plant process).
Waste Gas System
Provides collection and temporary storage, in the Reactor Containment, of the gaseous
products deriving from the plant process and, consequently, it provides transportation and
storage of them inside the Radwaste Building.
Waste Liquid System
Provides collection and temporary storage, in the Reactor Containment, of the liquid
products deriving from the plant process and, consequently, it provides transportation and
storage of them inside the Radwaste Building.
3.2.1 Reactor System
The reactor system constitute, mainly, with the Reactor Vessels, the Reactor Pit, the
Reactor Internals, the Above Core Structure and the Reactor Roof, is shown in Figure 3.2-1
(see Ref. [1])
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
12
Reactor Vessels
The Reactor Vessels (namely primary vessel and guard vessel) are shown in Figure 3.2-2.
Primary vessel
The primary vessel consists of a cylindrical upper section and hemispherical bottom head.
The vessel is basically of plate construction in AISI 316 SPH stainless steel. The cylindrical
section of the vessel is welded to the formed periphery of the roof plate completing the
primary circuit boundary. The vessel is 40 mm thick except for the bottom strake where the
wall is increased to 60 mm. The primary Vessel accomplishes the following functions:
• Preservation of the Reactor Coolant Boundary
• Positioning and support of Core and Reactor Internals
• Reactor coolant storage
Guard vessel
The guard vessel is slightly larger but similar in layout to the primary vessel, with a
hemispherical bottom end and a cylindrical section attached to the annular support beam
via a two-strake skirt. The geometry is arranged to provide a 350 mm interspace between
vessels to widen out to 500 mm in the region of the support beam. The vessel is 40 mm
thick. Penetrations through the annular support beam are provided to allow access for inservice
equipment and to fit any instrumentation into the vessel interspace.
The guard vessel is not insulated, except for the lower, 120 degrees wide lowermost portion
of the bottom head that is lagged with a 250 mm thick layer of rock wool. The combined
effects of thermal insulation, convective air streams and the lower part of the U-pipe bundle
of the RVACS as the air cooler, keep the temperature of the reactor pit base at constant,
nearly 62 °C, a temperature that is compatible with the integrity of the concrete.
Reactor Pit
The primary vessel and guard vessel are supported from the reactor pit via the annular
support beam, which rests on the top edge of the pit. Besides the reactor, the pit houses the
RVACS U-pipe bundle, the cold legs of which keep the lined pit concrete cooled to prevent
excessive temperature due to the heat flux from the reactor. A blanked-off duct gives
access to the pit during site erection and for in service inspection by robot vehicles. The
reactor pit dimensions are 8.3 m diameter by 12 m depth. This diameter does not allow
keeping the core full covered by the coolant in case of hypothetical leakage of both reactor
vessels. Prospective design developments shall aim at the possibility to reduce the present
diameter of the pit, without affecting the needs of in-service inspection.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
13
Reactor Internals
The Reactor Internals include the following parts that are supported by the Internal Support
Structure (see Fig. 3.2-3):
• Core Diagrid. The core support system comprises the diagrid welded to a perforated
cylindrical shell, which is in turn welded to a thickened strake in the base of the primary
vessel. It will be noted that the core and all internals immersed in the LBE melt are
subjected to a net upward force. The Core Diagrid has the functions to support the fuel
elements and to assist in positioning them, to guide the fuel elements during the
loading/unloading operations, to prevent placing the fuel elements into the positions
reserved for the dummy elements, to separate the Core Inlet Plenum from the Core
zone, so as to limit the Core bypass flow and to distribute the Core flow through the
various fuel elements.
• Reactor Core. The Reactor Core (see Fig. 3.2-4 and Fig. 3.2-5) is the zone in which the
nuclear reactions occur and where are locate the Fuel Assemblies (FAs), the spallation
target and the dummy element. The spallation target is arranged as a coaxial structure
that surrounds and extends from the proton beam pipe connected to the beam supply
system. It is accommodated inside a cavity at the core vertical axis, delimited by the
surrounding pattern of fuel assemblies organized in regular rounds that are encircling the
inner region. The core shape assumes the configuration of a hollow cylinder in axis with
the proton beam pipe, whose edge is extending from the top of the vessel down to a
fixed distance to the core mid-plane, at which the center of the beam spallation spark is
focused inside the target bulk material (this corresponds to 19 FA’s positions). The
surrounding 120 fuel assemblies is arranged through a honeycomb-like array forming an
annular pattern constituted by four coaxial hexagonal full rounds of fuel assemblies for a
total of 108 loaded fuel assemblies (which are delimiting a full hexagonal area with a
two-rounds cavity inside) plus another twelve fuel assemblies, distributed in couples,
each adjacent to the mid-lines of the hexagon sides of the fourth outer round. Starting
from this round the fuel core has been surrounded by an outer region arranged as
another annular honeycomb-like array of three rounds of boxed assemblies (“dummy”)
which are essentially light, FA’s alike, empty duct structures not carrying any fuel rod
bundle and related components (the nozzling at the foot is designed in such a way to
prevent important bypass from the core flow allowing the minimum coolant needed for
maintaining the necessary structures cooling from the core neutron-gamma heating). In
total, the core buffer region accounts for 174 loading positions. The buffer zone is
accomplishing the primary duty of displacing at a distance the fixed, large, nonreplaceable
core structure internal parts of the XADS, which could undergo excessive
radiation damage due to the hardest portion of the neutron spectrum that would be
detrimental for the overall plant life. Similarly, the same precaution has been
implemented in the bottom region of the fuel core, where the fixed core grid, which is
maintaining and positioning the fuel assemblies through their lower foot fitted-in, has
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
14
been displaced at some distance from the active fuel zone by extending the lower part of
the fuel assembly duct such to keep the fuel pin bundle fairly away from the FA’s footgrid
coupling. The assemblies of both core and buffer region clusters are fastened to the
lower diagrid by means of the same mechanics housed at the assembly foot and which
is operated by the core handling machine through the driving rod passing through all the
assembly length. Both fuel and dummy assemblies, which would be quite buoyant in the
LBE coolant, are thus secured down to the core diagrid and can be only disconnected
through appropriate actions by the core fuel handling machine. Lateral and azimuthal
stiffness of the core-buffer complex is instead relying on resulting mutual mechanical
interference of the assemblies wrappers which outline, as a whole, a honeycomb bunch
structure leaning in between the outer core restraint plate and the inner target structure.
The XADS core mass is being constituted of FAs loaded with fertile Uranium and
Plutonium MOX fuel at moderately high fissile Pu concentrations (proven FBR fuel in the
line of SPX development). The buffer region also allows use of neutronic absorbers for
maintaining the core at safe shutdown during refueling conditions (they are kept far from
the core during power operation and they are moved near the core during the refueling
operations).
• Cylindrical Inner Vessel. The primary circuit high-temperature, not-removable internal
structures are limited to the cylindrical inner vessel and the riser pipes (Fig. 3.2-3). The
cylindrical inner vessel is of a simple shell and plate construction. It starts with a 20 mm
thin-walled shell welded to periphery of the diagrid, laid out vertically until the level of the
handling heads of the assemblies, where it is welded to and supports the horizontal,
thickened core upper restraint plate. The upper portion of the inner vessel is an upstand
of smaller cross section than the shell below, but equally thin, welded to upper face of
the restraint plate. Its top edge almost reaches the reactor roof. By this layout, the
outline of the inner vessel presents a horizontal re-entrance, shaped as a transition
annulus to which the riser pipes are welded. The riser pipes are arranged close to the
outside periphery of the upstand. The boundaries of the flowing hot coolant are the riser
pipes and the above core region, which is delimited by the Target Unit, the lower shell of
the inner vessel and the upper core restraint plate with the handling heads of the
assemblies. A horizontal row of holes is provided in the shell of the inner vessel just
below the level of the assembly outlet ports to allow a residual primary coolant
circulation through the core, in case the free level of the coolant is lowered so deeply as
to uncover the handling heads. The plenum inside the upstand is fed by coolant leakage
flow across the handling heads of the assemblies and by coolant flow through the Target
Unit, in case of choice of the windowless option. Because 2 out of 24 riser pipes take
suction from this quasi stagnant plenum, an equilibrium free level is maintained inside
the upstand, that is lower, but close to the coolant free level outside, so that the
difference in static head is small. This and the high-friction leakage-flow help to
hydraulically decouple the plena inside and outside the upstand with improvement of the
primary coolant flowrate stability. No thermal insulation is used. Through-wall
temperature gradients in the hot pool boundary are minimized under steady state
conditions by design. The cross section of the cylindrical inner vessel is not circular,
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
15
because it envelops the area occupied by the fixed-arm and rotor-lift handling machines,
which are both, stored off-set with respect to the centerline of the reactor (Fig. 3.2-1).
Above Core Structure (ACS)
The Above Core Structure (see Fig. 3.2-1) supports the Target and the Core
instrumentation. It is supported by the Rotating Plug and can, in turn, rotate. The ACS
rotation permits to achieve two distinct configurations:
Normal operations configuration, characterized by the complete covering of the fuel
elements
Fuel handling configuration, characterized by a 180° rotation with respect to an eccentric
axis, and by a Core disengagement sufficient to permit fuel loading and unloading by means
of the Transfer Machine
In both alignments, the ACS is fixed to the Rotating Plug. In particular, during refueling, the
Rotating Plug drags the ACS through its rotation, along with the Transfer Machine. The
various Core positions get then disengaged from the ACS, as the Transfer Machine is ready
to reach them.
Reactor Roof
The roof is basically a large annular metal plate 6.0 m diameter by 0.2 m thickness made of
AISI 304 stainless steel, with a central penetration of 2.7 m diameter to accommodate the
rotating plug. The annulus between the primary vessel and the rotating plug houses the
component penetrations. The roof is hung from the cold annular beam, which rests on the
civil structure some 2 m above, via a welded interconnecting skirt (Fig 3.2-2). The
component penetrations are welded to the roof plate and the top support flange/seal are
extended to reach a cold zone, at about the elevation of the cold annular beam.
Components are bolted to the penetration top flange. Primary containment is maintained by
sealing the component to the penetration using a double O-ring sealing system with argon
padding between. The rotating components are lifted during maintenance to allow rotation.
In this case the primary containment is maintained using the same double sealing and
argon padding principle, however with inflated seals instead of the O-rings. The working
area above the roof is not accessible during reactor operation, mainly owing to the presence
of the proton beam pipe and associated neutron radiation escaping from the core.
Provisions are being studied in order to significantly reduce the activation of the structures.
This will lead eventually to allow the restricted access to the working area at reactor
shutdown. The underside of the roof is insulated by packs of stainless steel plates and the
outside by conventional thermal insulation to keep the roof plate at about 300 °C mean
temperature.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
16
The Reactor Roof has the following functions:
• Support and positioning of Intermediate Heat Exchangers, gas injection pipes,
purification unit, Transfer Channel, Above Core Structure, Transfer Machine;
• Confinement of the cover gas (Reactor Coolant Boundary);
• Support to fuel handling operations, through rotation of the Above Core Structure and
of the Rotating Plug.
3.2.2 Reactor Coolant System
The Reactor Coolant System (RCS) provides the functions of primary Core Cooling and
secondary Target cooling, of subsequent energy storage within the bulk mass of primary
coolant, and the removal of this energy towards an external sink, in the respect of the limits
imposed on the design of the fuel assemblies and of the mechanical structures.
The RCS also provides the removal of the Core decay heat to the external environment, by
means of the Secondary Coolant System (SCS) or of the Reactor Vessel Air Cooling
System (RVAC), by operating in either natural or enhanced circulation.
The RCS also contributes to the preservation of the Reactor Coolant Boundary integrity
during any plant condition, thus limiting the potential release of radioactive products to the
external of the Reactor Vessel.
A simplified process scheme of the Reactor Coolant System is shown in Figure 3.2-6. The
RCS consists of pool-type heat transfer system, with no piping or nozzles provided under
the free surface to direct the coolant flow path. The primary coolant, made of molten Lead-
Bismuth eutectic, is entirely contained within the Reactor Vessel.
The Reactor Coolant System may be thought as made of the following functional parts:
• Core Region - It is the zone where the primary coolant removes the neutron reactions
heat, and where coolant temperature increases;
• Riser Channels - The Riser Channels are a set of distinct cylindrical volumes created
within an array of parallel tubes, where the primary coolant moves upwards, and where a
gas injection stream for enhanced circulation is practiced on a continuous basis;
• Cold Collector - It is the region of coolant at lower temperature, after heat has been
removed at the Intermediate Heat Exchangers level;
• Core Inlet Plenum - It is the zone, below the Core, that receives coolant from the Cold
Collector, and distributes the flow to the Core fuel assemblies;
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
17
In addition, there are zones of the Reactor Vessel volume that, though important for
accomplishing a number of safety and availability related functions, are not directly involved
in the thermal cycle of the reactor coolant:
• Above Core Volume - It is the annular volume comprised between the Beam Pipe Guide
and the Above Core Structure (ACS) shell, and that is normally utilized to accommodate
the nuclear instrumentation. In this volume, the primary coolant is mostly stagnating;
• Fuel Handling Operation Volume - It is the annular volume comprised between the ACS
shell and the Riser inmost shell. This volume serves for fuel handling operations. In this
zone, the primary coolant is mostly stagnating;
• Hot Pool - It is the region surrounding the Intermediate Heat Exchangers, below the
elevation of the primary coolant inlet windows. As the primary coolant coming from the
Riser Channels is forced into the Intermediate Heat Exchangers (IHXs), this volume is
practically a primary coolant stagnation volume, with a temperature stratification going
from the hot to the cold temperature;
The primary coolant enters the Core from the Core Inlet Plenum. Its temperature, during
operation at power is 300 °C, the primary coolant flowrate is 6013 kg/s. The coolant moves
axially through the Core, where it removes the energy generated by the fuel elements. A
small fraction of primary coolant (about 5%) is directed to a bypass flowpath, to ensure heat
removal from the Target cooling circuit and dummy elements. The average core outlet
temperature is 400 °C at rated power.
The primary coolant flows then in radial direction and is pushed towards the zone of the
Riser Channels. There are 24 tubes, 200 mm diameter, located on the external face of the
upper shell of the Cylindrical Inner Vessel. The Inner Vessel delimits the Fuel Handling
Operating Volume. It has an oval shape to accommodate the mechanisms for the refueling
contained in the Fuel Handling Operating Volume.
In the Riser Channels, the coolant moves upwards, until it overboards the top of the piping
channels at an elevation well below the liquid free surface, and drops down towards the Hot
Pool zone, where the four Intermediate Heat Exchangers are located. 22 Riser Channels
transport the coolant from the Core zone; the remaining two channels, instead, are
connected with the top of the Fuel Handling Operating Volume. This solution allows taking
suction from the free surface of the Fuel Handling Operating Volume, which is connected
with the two Riser Channels through two vertical ducts. Liquid from the Fuel Handling
Operating Volume free level is sucked, descends vertically to the inlet of the two Riser
Channels and then, because of the Argon injection, is forced to move upwards and to exit
into the Hot Pool. By doing this, a portion of the polluted coolant of the Fuel Handling
Operating Volume stagnating zone is continuously moved to be reprocessed in the
purification zone, located in the Hot Pool.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
18
Coolant inlet windows are made on the shell of the IHXs, at a certain distance below the
liquid free surface level. The coolant penetrates the windows and moves downwards,
coming in contact with the tubes where the secondary coolant flows. The primary-tosecondary
heat transfer process cools the reactor coolant down to the Cold Collector
temperature. The secondary coolant pressure is slightly lower than the primary coolant
pressure at the heat transfer process elevation so that, in case of a leak in one of the IHX
tubes, no secondary-to-primary leakage may occur. The coolant that does not enter the IHX
shell windows stratifies along the axial length of the IHX, in a stagnant configuration.
After the heat transfer, the primary coolant temperature is reduced to 300 °C, its density
increases, and the Lead-Bismuth is drawn down to the Core Inlet Plenum, flowing through
the open IHX bottom, the Cold Collector volume, to start a new thermal cycle.
At the Hot Pool level, a fraction of primary coolant is directed to the integrated In-Vessel
Purification System (a free-surface filter unit with a reactor lifetime capacity), for being
purged from the solid impurities present in the coolant bulk mass (iron, chromium, nickel),
and for oxygen control. At the outlet of the purification system, this fraction of coolant mixes
up with the remainder of the primary coolant bulk mass, in the Hot Pool.
As mentioned above, no Reactor Coolant Pumps are provided in the XADS to support the
primary coolant circulation function. The plant design concept foresees that all primary
coolant heat transfer processes may be achieved through natural circulation only. However,
the evidence of this feature is not vital for the demonstrating scopes of the Facility. As such,
both for economical reasons and for maintaining the temperature of the Reactor structures
below the creep range, the length of the Reactor Vessel has been minimized, and the
natural circulation, thus unable to evacuate the entire heat produced at power operations,
has been enhanced by a supplementary process.
During normal operations, the primary coolant driving force is supplied by the Primary Cover
Gas System, through a continuous, direct injection of pressurized inert gas (Argon) into the
mass of primary coolant. Scope of the Argon injection is to enhance circulation of the
primary coolant based on the creation of a differential floating force between the primary
coolant in the gas injection region and the upper region.
Over the coolant surface level, a blanket of Argon is continuously maintained to provide
primary system inertization, and to collect the discharge of the enhanced circulation gas.
The cover gas is kept slightly above the atmospheric pressure, with a large pressure control
band to avoid continuous regulation by the operating compressors of the Primary Cover
Gas System. The volume occupied by the gas also serves to accommodate primary coolant
thermal expansion when passing from the cold conditions to the nominal operating
temperature.
Potential escapes of primary coolant from the Reactor Vessel are contained within a second
barrier, the Guard Vessel. Means to detect a loss of coolant are provided in the annular
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
19
space comprised between the Reactor Vessel and the Guard Vessel. A slightly
overpressure inert gas (Argon) is contained in this volume.
3.2.3 Intermediate Heat Exchangers
There are four Intermediate Heat Exchangers (IHXs) immersed in the primary coolant,
symmetrically positioned at 90° with respect to each other, and located in the Hot Pool
annular region comprised between the outermost Riser barrel and the Reactor Vessel wall.
The IHXs are “bayonet” type, with arrays of straight tubes contained within a vertical shell,
anchored at a lower and an upper support tubesheet. A single bayonet assembly consists of
a pair of concentric tubes, the external of which is forged to allow the inversion of oil flow
from downward to upward. The heat exchangers are supported at the Roof level, from
which they hang, with penetrations through the Roof itself.
Main function of the Intermediate Heat Exchangers is to transfer heat from the primary
coolant to the Secondary Coolant System. The cold secondary coolant, coming from the
upper head, flows downward inside the inner tubes, and then rises upward through the
annular space comprised between the internal and the external tubes of each pair. The
secondary coolant outlet takes place through a nozzle located at the top head of the IHX.
The primary coolant enters the IHX radially through a set of windows arranged on the upper
part of the IHX shell, at a certain distance from the free level surface; then, it flows
downward, coming in contact with the external surface of the outer bayonet tubes. The heat
transfer takes place through a counter-current process; after that, the primary coolant exits
the IHX through the open bottom.
3.2.4 Reactor Proton Beam Target System
The spallation neutrons are generated in the liquid LBE target that constitutes the
connection of the Accelerator System to the sub-critical Core. There are four main
constraints to be complied with, while engineering this connection:
• The proton beam must travel in vacuo
• The proton beam must impinge on the target at or near the center of the Core
• The power generated by the spallation reactions must be removed, without
overheating LBE or interposed structures
• The radioactive elements produced in the LBE by the spallation reactions must be
kept confined
The LBE melt containing the spallation products is kept confined within a structure called
Target Unit (or Spallation Module), in order to prevent the contamination of the primary LBE
coolant. The Target Unit has been designed as a removable Unit, because its service life is
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
20
anticipated to be shorter than the reactor lifetime, owing to the intense irradiation and local
high thermal stresses. The Target Unit is a slim component of cylindrical shape, positioned
co-axially with the Reactor Vessel and hung from the Above Core Structure. Because it
serves also as inner radial restraint of the core, the outline of its shell fits the inner outline of
the core. Its component parts are the Proton Beam Pipe, the Heat Exchanger and the LBE
circulation System that can be designed in forced or natural circulation, depending on the
design option.
Two Target Unit options have been designed for the XADS. Both options present the Target
at the center of the core, but they differ in the Target to the Proton Beam Pipe interface
principle.
The Hot-Window Target Unit
The Hot-Window Target Unit features a thin metallic sheet, called hereinafter the Hot
Window (i.e. proton beam entrance) or more simply the Window, as a barrier between the
liquid target and the Proton Beam Vacuum Pipe (Figure 3.2-7). The Window (and by
extension also most of the Target Unit) is made of ferritic-martensitic 9Cr1Mo, a steel
chosen to withstand the severe duty cycle, that encompasses thermal and pressure loads,
aging by the intense proton/neutron irradiation and erosion/corrosion by the flowing LBE
melt. In particular this material is a good choice among the available steels, according to the
following list of favorable properties:
- Low density
- High thermal conductivity
- Low thermal expansion coefficient
- High tensile strength
- Good fracture toughness
- Low DBTT (Ductile to Brittle Transition Temperature)
- Corrosion resistance to LBE exposure
- Low susceptibility to proton/neutron radiation damage
These properties are temperature-dependent. For instance, tensile strength and corrosion
resistance decreases with temperature, while fracture toughness improves with
temperature.
The choice of 9Cr1Mo is in any case subject to confirmation by the results of the current
R&D campaign, that will address also the material behaviors of concern such as LBEembrittlement,
swelling by formation of hydrogen or helium, irradiation hardening and creep.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
21
The heat generated by the spallation reactions is removed by natural convection. The LBE
recirculates from the heat source to the heat exchanger located at a higher level; an
arrangement typical of natural-circulation cooling circuits.
A stable, properly directed natural circulation of the target LBE is possible also when the
accelerator is off, owing to the crosswise arranged flow path from inner to outer annulus and
viceversa, provided at the bottom of the Target Unit and illustrated by the arrows in Fig. 3.2-
7. With the reactor in hot shutdown and the Target Unit cooling circuit in operation, the
primary coolant at 300 °C, as a distributed heat source, heats up the LBE in the outer
annulus. The cold flow in the downcomer is diverted by baffles from the inner annulus to the
outer annulus The LBE of the Target, in turn, by mean of intermediate heat exchanger,
placed in the upper part of the Target, transfer the heat to a cooling circuit filled with organic
diathermic fluid which is back-cooled by water. The cold flow in the downcomer is diverted
by baffles from the inner annulus to the outer annulus in the bottom part of the Target Unit.
With the onset of natural circulation, effective cooling of the window takes place from the
very beginning of the spallation reactions.
The use of a diathermic fluid gives higher flexibility in the choice of the thermal cycle of the
Target LBE and allows remaining below 500 °C at the hottest spot of the window.
Several window materials are currently tested in Europe in order to assess their suitability to
withstand the severe environment conditions and lifetime expectation. The corrosion
protection LBE-side of the window by means of controlled oxygen activity in the LBE is also
given attention.
The Windowless Target Unit
In the Windowless Target Unit (Fig. 3.2-7) the proton beam impinges directly on the free
surface of the liquid LBE target. In this case a natural circulation pattern in the cooling circuit
is no longer possible, because the heat source near the free surface of the LBE is at a
higher level due to the vacuum in the proton beam pipe. Thus the hotter LBE must be driven
downwards to the heat exchanger by some means, in this case by two mechanical pumps
providing each a half of the total head required. A stream of primary LBE is diverted from
the cold plenum to the heat exchanger to serve as a cooling medium.
In the Windowless Target Unit no structural material is exposed to the direct proton
irradiation. This option has the advantage of overcoming issues related to material structural
resistance, but presents issues related to the proton beam impact area, flow stability and
evaporation of LBE.
The earlier axisymmetrical design of the free surface has been disregarded because tests in
water have substantiated the risk of stagnation about the coalescence zone so that an
alternative target design will be tested presently. In particular a full-scale test section is
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
22
planned to be constructed and used for a test campaign in the CIRCE facility with the
following main goals:
• Study of the main thermal-hydraulic phenomena
• Geometrical optimization of the target region
• Definition of the main parameters range to prevent zones of Pb-Bi stagnation in the
target region
• Definition of the requirements of the Pb-Bi flowrate control system
• Definition of the requirements of the pipe vacuum control system
3.2.5 Primary Cover Gas System
A simplified sketch of the Primary Cover Gas System is shown in Figure 3.2-8. The Primary
Cover Gas System consists of a loop through which a gas stream circulates coming from
the Reactor Vessel cover gas space and, after processing, is returned to the Reactor
Vessel. The cover gas, mainly made of Argon, is taken through a collector who penetrates
the Reactor Roof: the 4" piping transports the gas from the cover gas volume of the Reactor
Coolant System.
Downstream the Reactor Coolant Boundary isolation valve, the hot gas is processed, shell
side, through a High Temperature Gas Cooler. This cooler (the coolant, tube side, is
diathermic oil) lowers the temperature of the cover gas stream from 400 °C to about 125 °C,
thus permitting to condense most of the impurities carried over by the gas flow, like
Polonium aerosol, while preventing the formation of dusts which could remain suspended
within the main gas stream. The impurities are then collected within a leaktight trap located
just below the High Temperature Gas Cooler. This trap is cooled (using nuclear component
cooling water) due to the decay heat generated by these impurities.
The gas then enters a second quencher, the Low Temperature Gas Cooler, in which the
cooling fluid is nuclear component cooling water. This heat exchanger lowers the gas
temperature down to about 38 °C. Scope of this heat exchanger is to reduce the
temperature at which the gas stream has to further be processed (for example, the
compressors suction temperature).
A particle filter is provided downstream of the two heat exchangers, to eventually retain
condensate droplets. The gas is then sucked by two 100% capacity, redundant
reciprocating compressors, which provide the gas with the driving force for being pumped
back to the Reactor Vessel. The compressors should be two-stage type, with inter-cooler
fed by component cooling water. The sucked gas is slightly under vacuum, because of the
pressure drops through the process. A side effect of the compression is to increase the
Argon temperature to about 200°C.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
23
The Argon is pumped to the Reactor Vessel through a 2" header that is routed to the
Primary System. Downstream of the two Reactor Coolant Boundary isolation valves, the
piping turns into a circular header which parcels out into 24, ½" OD tubes, symmetrically
arranged around a circumferential configuration, to be directed to various sectors of the
Primary System. Each of these tubes is provided with a manual flow control valve, to
equalize the gas flowrate through the various pipes. After penetrating the Reactor Roof, the
tubes deeply plunge into the primary coolant at the Riser Channels level, and end up with a
gas sparger, located 500 mm above the top of Core region, and shaped so that the outlet of
the gas stream is directed upwards.
Scope of the Argon injection is to enhance circulation of the primary coolant, based on the
creation of a differential floating force between the primary coolant in the gas injection
region and the upper region. The gas, after exiting the distribution spargers, is fractionated
into a myriad of small bubbles. The resulting effect is one of swelling of the primary coolant
volume, so that the apparent density of the Lead-Bismuth eutectic lowers, and the primary
coolant is pushed upwards, creating an empty space which is immediately occupied by the
coolant from the Core. After accomplishing its mission, the Argon is delivered to the cover
gas space above the liquid metal surface.
From the above-mentioned circumferential header, another ½” OD tube provides a small
gas flow rate to the integrated purification unit (approximately 1 liter per second at normal
conditions) to develop a driving force to overcome the pressure loss through the filter unit,
allowing it to work.
At the compressors outlet the excess gas line is used to temporarily store a portion of the
cover gas, should the cover gas space pressure exceed the control band high (+ 50 mbar).
The flow to/from the Buffer Vessel is dictated by two on-off valves (one respectively),
located on the compressor discharge line. The Gas Buffer Vessel also serves to supply an
extra-pressure at the system start-up, to overcome the primary coolant hold-up contained in
the gas injection pipes, and to allow gas decay prior to routing the gas to the Waste Gas
System (WGS).
Downstream of the compressors there is a Hydrogen/Steam and Oxygen Injection Unit
which is periodically operated to adjust the concentration of Oxygen in the cover gas.
All system components are shielded against the radiation coming from the cover gas. All
effluents, gaseous and liquid, are routed to the waste systems for storage and reprocessing.
The circuit is accurately sealed to avoid external air to enter the sections under vacuum,
and gas to be released to the environment in the pressurized portion.
3.2.6 Secondary Coolant System
The Secondary Coolant System (SCS) (see Figure 3.2-9) basically consists of two
independent identical subsystems (main loops), each one feeding a couple of IHXs and
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
24
provided with a filling/drain purification section. Consequently each loop is sized to cope
with 50 % of the RCS heat duty during full power operation.
The decay heat can be rejected to the ultimate heat sink via fuel assemblies → primary
lead-bismuth coolant → intermediate heat exchangers → secondary organic diathermic oil
coolant → air coolers → external atmosphere
This flow path relies on natural circulation only, i.e. on heat transfer by natural mechanisms,
consistent with the passive-safety philosophy, which is a principle of the XADS design. It
relies on natural circulation of the primary lead-bismuth coolant inside the Primary Vessel
(which takes place also in the absence of the argon gas injection), natural circulation of the
secondary organic fluid coolant (which takes place by virtue of the secondary loops layout,
provided that atmosphere air circulation is guaranteed across the air coolers), natural
circulation of the atmospheric air.
Each independent secondary coolant loops are designed to remove 100% decay heat. This
design choice minimizes the number of accident scenario for which this decay heat removal
path is unavailable.
Each SCS loop mainly consists of:
• Two Intermediate Heat Exchangers (IHXs), arranged in parallel;
• Three Air Coolers (ACs), arranged in series;
• One recirculation pump;
• One expansion tank.
The loop cold header branches into two identical lines close to the reactor vessel, feeding
the IHXs; the flow rate to each IHX shall be balanced (mainly relying on an adequate piping
and lay out), so as to ensure the same working conditions for each component. At the outlet
of each individual IHX the oil is collected into a common hot header and routed to the AC
building to feed the three ACs arranged in series.
The portion of the system physically included between the penetration of the Reactor roof to
the sealing area close to the border of the Reactor Building is enveloped in a Guard-Pipe.
This Guard Pipe has been provided as a barrier to prevent fire associated to the oil
autoignition at high temperature in the containment due to a postulated break in the SCS
boundary, but it also performs the function of containment boundary. The SCS penetrates
the containment (guard pipe boundary) to enter into the Reactor Vessel; hence the SCS
portion outside of the Reactor Vessel is to be considered as a portion of a closed loop
outside containment whilst the reminder portion is to be considered as a portion of a closed
loop inside containment.
In the Air Coolers the reactor power is transferred from the oil to the atmosphere. By flowing
through the tubes of the Air Coolers, the oil temperature is gradually reduced down to the
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
25
cold leg temperature. The serial arrangement of the Air Coolers allows to fully exploiting
their heat transfer capability, and provides wider control flexibility.
The Air Coolers (see Figure 3.2-10) are provided with motor-operated variable speed fans,
in order to select the desired heat removal rate during each plant operating condition. At low
heat load, the air can flow on natural circulation and the flow rate can be controlled by
means of movable dampers. The air exhausts are then discharged to the external
atmosphere through a battery of stacks.
The Expansion Tank is installed after the ACs upstream of the IHXs. This tank holds the oil
volume fluctuations due to possible operating temperatures fluctuations and oil swelling
from 60°C to 320°C.
The recirculation pump, installed on the hot leg downstream of the IHXs, is sized to deliver
100% of the required loop flow rate. Each pump is connectable to the on-site power
generation bus (Diesel Generator) to be automatically actuated in case of a Loss of Off-Site
Power. Separate power buses, belonging to the Non-Class normally feed 1E AC Power
Systems (NACS the SCS pumps, loop 1 and 2, 1E AC Power Systems (NACS). This
redundancy ensures a defense-in-depth capability against the possibility of a reactor
shutdown.
On high radioactivity signal from one SCS loop the corresponding recirculation pump is
automatically stopped in order to terminate contaminated material recirculation; beside, the
ACs air path is intercepted in order to terminate the natural recirculation. The reactor shall
be shut down and the other available SCS loop shall be used to drive the plant to a
controlled state.
On low RCS temperature signal a total air coolers shutdown is automatically initiated in
order to limit primary coolant temperature decrease, to try to maintain just above the LBE
freezing point.
A safety-relief valve protects the SCS from the potential overpressure caused by secondary
coolant thermal expansion.
Before start up phase’s gas pockets shall be eliminated through adequate vent lines, on the
upper parts of the secondary circuit, connected to the Expansion Tank.
The Expansion Tank and all the main loop piping are thermally insulated. This sections; one
for each SCS loop, include the equipment necessary for filling/draining of each loop. These
sections are also utilized for a continuous feed and bleed to perform the required oil
purification. More specifically an oil drain line is provided to connect each loop to a
dedicated Storage Tank capable of containing all the drainable coolant oil.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
26
In normal operation a continuous oil flow rate is spilled from the main loop through the same
drain line and routed to the Storage Tank. At the same time, a filling pump delivers an
equivalent oil flow rate from the Storage Tank to a pipe connection upstream of the
secondary coolant pumps through a filter, in order to maintain a continuous stream of
cleaned oil to feed the main loop. This feed and bleed operation is automatically controlled
by the control loop of the expansion tank level.
The Storage Tank is provided with connections for oil make-up and disposal. An electric
heater is immersed in the tank to perform the initial heat up of the fresh oil, after tank filling,
and to maintain the proper oil temperature and consequently to ensure the adequate
viscosity for pumping.
3.2.7 Reactor Vessel Air Cooling System
The Reactor Vessel Air Cooling System (RVACS), as shown in Figure 3.2-11, mainly
consists of a number of air U tubes vertically located in the cylindrical annulus between the
wall of the Reactor Cavity and the Guard Vessel; inside each tube air flows in natural
circulation. Four equally sized stacks constitute the air inlet and outlet paths. Each stack
contains an internal duct that is the path of the heated airflow to the atmosphere and an
external annular duct connected to the intake openings.
The air intakes and the outlet openings are laid out so that the pressure drops through the
parallel pathways are balanced to the maximum extent, with no shortcuts for the exhaust air
to re-enter in cycle. The intakes and the outlets are designed to operate during extreme
weather conditions like winds, rain and dust and are protected by metal grids specially
designed for anti-intrusion, in order to prevent external bodies from entering from the
surrounding environment.
The air flows downwards into the intake openings, passing through the annular ducts, until it
gets to the level of the Reactor Building plan elevation slab, and enters the outermost of two
concentric headers (outlet header). Inside the outlet header, the air turns vertically towards
the Reactor Cavity, flowing into the U tubes, welded to the plenum itself.
The air pipes are equally distributed to form two concentric pipe walls, housed in the annular
space between the Guard Vessel and the Reactor Cavity wall. The outer rank is formed by
the tubes in which flows the fresh air, while the inner rank is formed by the tubes in which
flows the hot air that is the closest to the Guard Vessel. Each cold-side pipe is bent near the
Reactor Cavity bottom, to effectively separate the cold from the hot tubes. A cylindrical,
thermally insulated plate (Insulating Cylinder) separates the descending from the rising
tubes, thus preventing the heat from being transferred directly from the hot to the cold
tubes. Downstream of the bend, the tubes are routed vertically towards the inner duct.
Along their ascending path, they are exposed to the radiating heat from the Guard Vessel.
The ascending portion of the U tubes shall be externally black painted, to increase the
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
27
radiation heat absorption. In conclusion, the RVCS is substantially configured as a large
tubular air heat exchanger.
Heat transfer from the Reactor Vessel to the RVACS takes place through different heat
transfer modes:
1. conduction through the Reactor Vessel walls;
2. conduction, natural convection and radiation in the gap between the Reactor Vessel and
the Guard Vessel;
3. conduction through the Guard Vessel wall;
4. conduction, convection and radiation heat transfer in the stagnant air in the Reactor
Cavity;
5. conduction through the ascending hot air pipe wall facing the Guard Vessel;
6. convection inside the ascending hot pipes.
So the decay heat can be rejected to the ultimate heat sink via fuel assemblies → primary
lead-bismuth coolant → main reactor vessel → Guard Vessel → Reactor Vessel Auxiliary
Cooling System (RVACS) → external atmosphere. Also this flow path relies on natural
circulation only, i.e. on heat transfer by natural mechanisms, consistent with the passivesafety
philosophy, which is a principle of the XADS design. It relies on natural circulation of
the primary lead-bismuth coolant inside the Primary Vessel, heat conduction through the
Primary Vessel wall, heat convection and radiation between reactor vessel and guard
vessel, heat conduction through the guard vessel, heat convection and radiation from guard
vessel to the air pipes of the RVACS, heat conduction through the air pipes, natural
convection pipe-side to the atmospheric air.
The hot, exhaust air from the inlet header runs through four stacks, internal and concentric
to the annular ducts, and arrives over the roof of the Reactor Building at about 35 m
elevation, where it is discharged to the atmosphere. The internal and external annular ducts
are thermally insulated with each other in order to optimize the overall heat transfer
efficiency.
The system performance (i.e. the heat removed by the system) as well as the comparison of
the global efficiency among the various loops, is continuously monitored as the enthalpy
change in the air flowing through the system. This is calculated from the air mass flow rate,
humidity, and the temperature differential between inlet and outlet flows.
One temperature element, installed on each air intake opening, is provided with a
temperature alarm, thus revealing the abnormal ingress of hot air from the environment,
such as in case of smoke due to a fire outside of the Reactor Building. In addition the
concrete temperature of the bottom of the Reactor Cavity is continuously monitored by
means of temperature sensors.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
28
Each stack is provided with radioactivity measures installed at the exit of each of the four
RVACS stacks. These instruments provide information for the potential for being breached
or the actual breach of the containment and for assessing the release of the radioactive
materials (type C and E measurements according to the R.G. 1. 97).
3.2.8 Accelerator
The accelerator is basically a high intensity proton machine, delivering beam on a spallation
target to provide an externa neutron flux source for a sub-critical core.
Two accelerator options available: the cyclotron and the linear accelerator Linac). Although
the cyclotron could probably fulfill the demonstrator needs, the linac option has been
selected for the XADS. The main reason is that a power cyclotron will be closely
approaching its technological limits. For future industrial power ADS systems, it will
therefore be unavoidable to use linacs. Consequently, it makes more sense to favor the
demonstration of the linac accelerator that offers much more capability for future upgrade
and extension to higher energies and to higher current beams.
Any high intensity linear proton accelerator can be divided in three main parts. The one is
the injector including the source (usually delivering a continuous current) followed bunching
structure like a RadioFrequency Quadrupole (RFQ). The beam comes out from injector at
energies between 2 to 10 MeV. The second part, labeled here "Intermediate Part", brings up
the beam to energies in the vicinity of 100 MeV. At that energy, although the proton is not
yet fully relativistic (β = v/c = 0.428), its speed is high enough to use elliptical cavities. The
final (and most efficient) part of the linac using these elliptical cavities is the high-energy
section. It starts from around 100 MeV up to any desired final energy.
Both the injector section and the high-energy section are quite straightforward. The source
is usually an Electron Cyclotron Resonance (ECR) ion source based on the experience
accumulated in many laboratories around the world. ECR sources have demonstrated
delivering reliable proton beams exceeding 100 mA, an order of magnitude higher than the
requirements needed for the XADS. The source is followed by an RFQ that has two main
functions: It prepares the particles in bunches separated by the RF period (the beam is now
microscopically pulsed1 in burst of particles flowing at the rate of the RFQ frequency) and it
accelerates the beam to an energy of a few MeV while maintaining a strong confinement. In
a similar manner, there is a general agreement that the high-energy section should be made
of superconducting elliptical cavities. These have been demonstrated to be extremely
effective (accelerating fields exceeding 25 MV/m have been experimentally obtained in
many laboratories) and a lot of experience and knowledge has been accumulated.
Moreover, large size machines using Superconducting RF Cavities (SCRF) have been
constructed or are currently under construction (like the Spallation Neutron Source, SNS at
Oak Ridge, USA) that may bring some confidence in the achievable performance for a
XADS type accelerator.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
29
However, at that time, there is still no consensus in the linac community on the best
radiofrequency (RF) structures to use in the intermediate section (from 5 MeV to 100 MeV).
There is some debate still open concerning the best structure to choose. This is why many
different options are still open including a "warm option" (i.e. room temperature RF
structure) and two superconducting options (crossbar and spoke cavity). Advantages and
disadvantages of these different structure types can be compared, especially regarding the
XADS specific requirements (reliability and tuning). But it is clear at this point that no definite
solution will be firmly given for this intermediate section until some particular R&D has been
finalized, laboratory performance demonstrated and a thorough comparison performed.
Figure 3.2-12 illustrates the linac scheme.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
30
Figure 3.2-1
Reactor System – Simplified Mechanical Scheme
REACTOR C
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
31
Figure 3.2-2
Reactor Vessels and Roof Support Structure
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
32
Figure 3.2-3
Reactor Fixed Internals
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
33
Figure 3.2-4
Core Region Vertical Section
Primary coolant outlet
Target Unit
Core restraint plate
Rotor Lift Machine Pit
Fuel Zone
Cylindrical Inner
Vessel
Fuel Assemblies
Dummy Assemblies
Primary Coolant Inlet
Diagrid
Internal Support
Structure
Primary Vessel
Safety Vessel
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
34
Figure 3.2-5
Core Cross Section
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
35
Figure 3.2-6
Primary System Process Scheme
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
36
Figure 3.2-7
Target Units
Hot Window
Windowless
Asymmetric Design
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
37
Figure 3.2-8
Primary Cover Gas System Simplified Flow Diagram
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
38
Figure 3.2-9
Secondary Coolant System Simplified Flow Diagram
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
39
Figure 3.2-10
Air Coolers Simplified Flow Diagram
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
40
Figure 3.2-11
Reactor Vessel Air Cooling System (RVACS) Principle
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
41
Figure 3.2-12
Schematic layout of the XADS accelerator in the linac option
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
42
3.3 MASTER LOGIC DIAGRAM
A master logic diagram (MLD) is a helpful tool to guide the effort, to group the accident
initiating events and to ensure completeness of the analysis.
The analysis starts with three main pathways 1 , coincident with the challenges to the three
physical barriers between the fission products and the external environment, as shown in
Fig. 3.3-1:
[1] FUEL CLADDING CHALLENGES
[2] RCS (Reactor Coolant System) and TUCS (Target Unit Coolant System)
CHALLENGES
[3] CONTAINMENT CHALLENGES
Figure 3.3-1
MLD development
[1]
FUEL CLADDING CHALLENGES
[2]
RCS AND TUCS CHALLENGES
[3]
CONTAINMENT CHALLENGES
level 1
[1.1]
POWER
ANOMALIES
[1.2]
DECREASE of
FUEL ASSEMBLY
HEAT REMOVAL
[2.1]
RCS PRESSURE
AND
TEMPERATURE
VARIATION
[2.2]
TUCS PRESSURE
AND
TEMPERATURE
VARIATION
[3.1]
CONTAINMENT
PRESSURE
TEMPERATURE
TRANSIENTS
[3.2]
RADIOACTIVE
RELEASES
INSIDE
CONTAINMENT
level 2
In the following sections 3.4 to 3.6 each main path will be developed through a MLD
technique in order to find the elementary events that lead to the TOP EVENTS [1], [2] and
[3]
1 The family of events which directly release radioactive fluid outside the containment is not considered in this
document
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
43
3.4 FUEL CLADDING CHALLENGES
The first path depicted in Fig. 3.3-1 aims to identify those phenomenologies that have the
potential to affect the integrity of the first physical barrier to the release of the radioactive
fission products to the environment, namely the fuel cladding.
In particular the "FUEL CLADDING CHALLENGES", which are a level 1 of MLD, can be
originated by the following events (level 2 of the MLD):
• POWER ANOMALIES [1.1];
• DECREASE OF FUEL ASSEMBLY HEAT REMOVAL [1.2].
Event [1.1] “POWER ANOMALIES“ refer to anomalies in the power generation leading, in
particular, to an increase in the power generated in the fuel rods. The MLD for these events
will be shown in next section 3.4.1.
Events [1.2] “DECREASE of FUEL ASSEMBLY HEAT REMOVAL” refer to anomalies in the
heat removal process from the fuel cladding that correspond to a decrease of the heat
extracted from the fuel rod. The MLD for these events will be shown in next section 3.4.2.
3.4.1 Power Anomalies
In the XADS the power generated in the fission core is strictly related to the proton beam
current. In particular an almost linear dependence of the generated power from the proton
current intensity exists; thus increasing the proton beam current increases fission power
(while, similarly, decreasing the proton beam current decreases fission power). The proton
current intensity is anticipated to vary along the fuel cycle to compensate the fuel burn up.
Thus “POWER ANOMALIES” in the XADS can be mainly associated to anomalies of the
proton beam current, rather than to reactivity insertion effects which can be considered
“weak”.
The MLD branches detail the event «POWER ANOMALIES», reported in Fig. 3.4-1, identify
three scenarios that have the potential to challenge the fuel clad integrity. They represent
level 3 of the MLD.
level 2 events description
As the MLD shows, the event [1.1] "POWER ANOMALIES” can result from:
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
44
Figure 3.4-1
MLD development starting from
"POWER ANOMALIES"
[1.1]
POWER
ANOMALIES
level 2
[1.1.1]
UNCONTROLLED
PROTON BEAM
CURRENT INCREASE
[1.1.2]
STARTUP of the
PROTON BEAM with
COLD REACTOR
[1.1.3]
CORE
COMPACTION
level 3
level 3 events description
• UNCONTROLLED PROTON BEAM CURRENT INCREASE
• STARTUP of the PROTON BEAM with COLD REACTOR
• CORE COMPACTION
These accidents then represent some of the lowest level events of the tree having as Top
Event: “FUEL CHALLENGES”.
The event [1.1.1] “UNCONTROLLED PROTON BEAM CURRENT INCREASE” assumes a
malfunction that leads the proton beam current to increase to the maximum value pertaining
to the EOL condition of the core (namely 6mA) or to the maximum value allowed by suitable
interlocks (if any). Note that, with the plant at nominal power and at BOL, the nominal
current intensity is about 3 mA. The proton beam current should increase from 3mA to 6mA,
the generated power would almost double then causing a significant increase in fuel and
clad temperature (also as a consequence of the increased coolant temperature). The list of
the Accelerator Complex System malfunctions that lead to this phenomenology are
presented in Ref. [2].
The event [1.1.2] “STARTUP of the PROTON BEAM with COLD REACTOR” assumes a
malfunction that leads to an inadvertent start-up of the accelerator system when the XADS
primary system is not ready to accept and remove fission power.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
45
The event [1.1.3] “CORE COMPACTION” assumes that all the Fuel Assemblies, in the most
unlike event, can be packed together with the complete closure of the clearance between
each Fuel Assembly wrapper.
3.4.2 Decrease of fuel assembly heat removal
These subsection addresses events that affect heat removal from a single fuel assembly
and, as such may have a significant impact on the affected assembly while the effect on the
core and on the primary system as negligible. Obviously, challenges to the fuel cladding
integrity may derive also from other events discussed in next sections 3.5.
The decrease of heat removal from a single fuel assembly can be attributed to the
anomalies of the eutectic flowrate caused by fuel element failure. The MLD branch detailing
the event “DECREASE of FUEL ASSEMBLY HEAT REMOVAL” is shown in the following
Fig. 3.4-2; it identifies scenarios that represent level 3 of the MLD.
Figure 3.4-2
MLD development starting from
" DECREASE of FUEL ASSEMBLY HEAT REMOVAL "
[1.2]
DECREASE of FUEL
ASSEMBLY HEAT
REMOVAL
level 2
[1.2.1]
FUEL ASSEMBLY
PARTIAL BLOCKAGE
[1.2.2]
FUEL ASSEMBLY
MECHANICAL LOCK
FAILURE
level 3
level 2 events description
The "DECREASE of THE FUEL ASSEMBLY HEAT REMOVAL", event [1.2], can be
originated by the following causes leading to an insufficient refrigeration of a single fuel
assembly:
• FUEL ASSEMBLY PARTIAL BLOCKAGE;
• FUEL ASSEMBLY MECHANICAL LOCK FAILURE.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
46
level 3 events description
The events included in this level then represent some of the lowest level events of the tree
having as Top Event: “FUEL CHALLENGES”. In particular event [1.2.1] “FUEL ASSEMBLY
PARTIAL BLOCKAGE” assumes a partial obstruction of the fuel assembly cross sectional
flow area, the most likely location being the inlet region. The obstruction causes a coolant
flow reduction and then an increase in fuel and cladding temperature.
The event [1.2.2] “FUEL ASSEMBLY MECHANICAL LOCK FAILURE” assumes the failure
of the mechanical lock at the fuel assembly foot. Due to this occurrence the fuel assembly
moves upward, due to the buoyancy, till it hits and stops against the above core structure
plate. This relocation causes a modification of the hydraulic characteristics of the affected
fuel assembly (possibly including some degree of obstruction of both the inlet and outlet
holes located in the fuel assembly foot and head) which may reduce the fuel assembly
coolant flowrate. It is noted that there may also be a reduction in the power generated in the
affected fuel assembly, since a fraction of the active region moves upwards to a region with
significantly lower neutron flux.
3.5 REACTOR COOLANT SYSTEM AND TARGET UNIT COOLANT SYSTEM
CHALLENGES
The second path depicted in Fig. 3.3-1 aims to identify those phenomenologies that have
the potential to affect the integrity of the second physical barrier to the release of radioactive
fission products to the environment, namely the Reactor Coolant System and the Target
Unit Coolant System.
As mentioned in previous section 3.4.2, it should be kept in mind that some of the events
challenging the Reactor Coolant System or the Target Unit Coolant System integrity also
challenge the fuel cladding integrity (normally of several or all the fuel assemblies) and
hence the postulated events described in the following should be looked at from both points
of view. In particular the "REACTOR COOLANT SYSTEM CHALLENGES", which are a
level 1 of the MLD of Fig. 3.3-1, can be originated from the following events (level 2 out the
MLD):
• REACTOR COOLANT SYSTEM PRESSURE and TEMPERATURE VARIATION [2.1].
• TARGET UNIT COOLANT SYSTEM PRESSURE and TEMPERATURE VARIATION
[2.2]
Event [2.1] refers to anomalies in the Reactor Coolant System pressure and temperature
variations originate from malfunctions or failures of systems and components normally
devoted to (directly or indirectly) control the RCS pressure or temperature.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
47
Event [2.2] refers to anomalies in the Target Unit Coolant System pressure and temperature
variation originate from malfunctions or failures of systems and components normally
devoted to (directly or indirectly) control the TUCS pressure or temperature.
3.5.1 Reactor Coolant System Challenges
The phenomenologies that could result in the occurrence of event [2.1] (see Fig 3.3-1) are
listed in the level 3 MLD of the Fig. 3.5.1-1.
In the following subsections 3.5.1.1 through 3.5.1.6 a MLD will be developed for each of the
level 3 phenomenologies identified in Figure 3.5.1-1.
Figure 3.5.1-1
MLD development starting from
" RCS PRESSURE and TEMPERATURE VARIATION "
[2.1]
RCS PRESSURE or
TEMPERATURE
VARIATION
level 2
[2.1.1]
INCREASE in
HEAT
REMOVAL
from RCS
[2.1.2]
DECREASE in
HEAT
REMOVAL
from RCS
[2.1.3]
DECREASE in
PRIMARY
COOLANT
FLOWRATE
[2.1.4]
INCREASE in
PRIMARY
COOLANT
FLOWRATE
[2.1.5]
DECREASE of
PRIMARY
Pb-Bi
INVENTORY
[2.1.6]
INCREASE of
RCS
PRESSURE
level 3
3.5.1.1 Increase in Heat Removal from Reactor Coolant System
There are a number of events that could result in an increase of heat removal from the
reactor coolant system (condition 2.1.1 of Figure 3.5.1-1). They are identified through the
master logic diagram (MLD) developed for this condition, which is reported in the following
Fig. 3.5.1-2.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
48
level 3 events description
The event [2.1.1] "INCREASE IN HEAT REMOVAL FROM REACTOR COOLANT
SYSTEM" can result from the increased heat removal performance of the secondary
coolant system (SCS) and is mainly correlated to the occurrence of the event [2.1.1.1]
“DECREASE of ORGANIC FLUID TEMPERATURE”.
Note that due to the complete separation between the two SCS loops, any event can affects
only one SCS loop (no multiple failures are considered).
Figure 3.5.1-2
MLD development for the condition
"INCREASE IN HEAT REMOVAL FROM REACTOR COOLANT SYSTEM"
[2.1.1]
INCREASE IN HEAT REMOVAL
FROM RCS
level 3
[2.1.1.1]
DECREASE OF ORGANIC
FLUID TEMPERATURE
level 4
[2.1.1.1.1]
INCREASED AIR
COOLERS HEAT
REMOVAL
[2.1.1.1.2]
SECONDARY COOLANT
FEED & BLEED SYSTEM
MALFUNCTION
level 5
[2.1.1.1.1.1]
3 OUT OF 3
AIR COOLERS
MALFUNCTION
[2.1.1.1.1.2]
1 OUT OF 3
AIR COOLERS
MALFUNCTION
[2.1.1.1.2.1]
OIL STORAGE
TANK HEATERS
MALFUNCTION
level 6
[2.1.1.1.1.1.1]
AIR COOLER
CONTROL
SYSTEM
MALFUNCTION
[2.1.1.1.1.2.1]
AIR COOLER
FAN VANES
ANGLE 0 DEGREE
[2.1.1.1.1.2.2
AIR COOLER
LOUVERS
SPURIOUS OPEN
2.1.1.11.2.3
AIR COOLER
MODULATING
DAMPERS
SPURIOUS OPEN
level 7
(A SCS organic fluid flowrate increase, which would have the same effect on the primary
system, cannot occur as a consequence of a system malfunction. In fact, on the basis of the
present design, the SCS operation is characterized by a constant nominal flowrate in each
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
49
of the two loops at any reactor power level (see Fig. 3.2-9), provided by centrifugal pumps
(one per loop). Due to the constant pump speed and to the absence of flow regulating
devices no increase of the oil flowrate is can take place in the system).
level 4 events description
The event [2.1.1.1] "DECREASE OF ORGANIC FLUID TEMPERATURE" can be attributed
to:
• malfunctions of the SCS Air Coolers that lead to reject to the external air more heat than
that removed from the primary system. It should be noted that, due to the performance
of the SCS system, this phenomenology appears to have a weak impact at nominal plant
power level; its impact becomes more and more significant for decreasing plant
operating power.
• malfunctions of the SCS Feed and Bleed System that lead to the decrease of oil storage
tank temperature.
level 5 events description
Considering the event [2.1.1.1.1] "INCREASED AIR COOLERS HEAT REMOVAL", the
MLD shows that it can derive from the malfunction that affect all Air Coolers of one SCS
loop (3 out of 3 SCS AIR COOLERS MALFUNCTION) or from the malfunction that affect
only one Air Cooler (1 out of 3 SCS AIR COOLERS MALFUNCTION).
It is noted here that the XADS primary and secondary coolant temperatures control strategy
is centered on the Air Coolers System which therefore is designed with a large degree of
flexibility and provided with several regulating devices including variable speed fans,
orientable fan valves, moving inlet and outlet louvers in each fan (see Fig 3.2-10).
The drawback of this flexibility is then the large variety of malfunctions that can be
postulated.
Considering the event [2.1.1.1.2] "SECONDARY COOLANT FEED and BLEED SYSTEM
MALFUNCTION", the MLD shows that it can derive from the malfunctions of the oil storage
tank heaters. This event however is considered of small significance.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
50
level 6 events description
The events [2.1.1.1.1.1.] “3 out of 3 SCS AIR COOLERS MALFUNCTION can be attributed
to the initiating event AIR COOLERS CONTROL SYSTEM MALFUNCTION that bring the
Air Coolers at their maximum heat exchange capacity.
As the MLD shows, the event [2.1.1.1.1.2] “1 out of 3 AIR COOLER MALFUNCTION” can
be attributed to the following initiating events:
• AIR COOLER FAN VANES ANGLE AT0 DEGREE;
• AIR COOLER LOUVERS SPURIOUS OPEN;
• AIR COOLER MODULATING DAMPERS SPURIOUS OPEN.
All the events refer to faults that lead to an increase of the air flowrate through the Air
Cooler Unit with respect to the value required by the power level at which the plant is
operating.
Concerning the event [2.1.1.1.2.1] "OIL STORAGE TANK HEATERS MALFUNCTION", it
represents, in the MLD, the lowest event of this specific tree branch. If this event occurs, the
temperature of the oil stored in the tank decreases. Considering the feed and bleed system
operating, the oil returns to the SCS main circulation pipes with a lower temperature,
determining a temperature decrease in the SCS oil flowrate hot leg. However the Air Cooler
control system is able to maintain the average oil temperature to its operating value.
Nevertheless no significant variation of the oil temperature and then of the primary system
process parameters is expected due to the low feed and bleed mass flowrate with respect
the SCS oil circulation flowrate (the feed and bleed flow ranges from 1% to 5% of nominal
oil flowrate).
level 7 events description
The event [2.1.1.1.1.1.1] "AIR COOLER CONTROL SYSTEM MALFUNCTION” represents,
in the MLD, the lowest event of this specific tree branch. It refers to malfunction of the Air
Cooler Control System producing a signal that drives the Air Cooler regulating devices
(vane, louvers) to a wrong position or increases the Air Cooler fan speed with respect to the
value consistent with the power level at which the plant is operating.
It has to be noted that, on the basis of the design the Air Coolers, it seems that no
significant margins exist to the removal of the nominal plant power. This means that the
system configuration that will assure the removal of the 83 MW of generated power (80 MW
from fission’s and a maximum of approximately 3 MW deposited in the target by the proton
beam at EOL) is characterized by a louvers position close to full open, vane angle close to
zero degrees and fan speed close to the maximum value. Thus if the postulated malfunction
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
51
causing the maximum airflow through the Air Cooler occur, no significant increase on the
heat extracted from the primary system should take place. On the contrary, different impacts
on the primary system will result from these malfunctions if they occur at lower plant
operating power. In this case, in fact, due to the potentially larger Air Coolers capability than
the required performance, the potential for lead-bismuth excessive cooling exists.
The event [2.1.1.1.1.2.1] "AIR COOLER FAN VANES ANGLE 0 DEGREE” is one of lowest
events of this tree branch. It refers to a failure of the fan vanes that brings them to an
incorrect position compared to the plant power.
The event [2.1.1.1.1.2.2] "AIR COOLER LOUVERS SPURIOUS OPEN” is another of the
lowest events of this tree branch. It refers to a failure of the louvers that brings them to their
maximum open.
The event [2.1.1.1.1.2.3] “AIR COOLER MODULATING DAMPERS SPURIOUS OPEN” is
another of the lowest events of this tree branch. It refers to a failure of the modulating
dampers that brings them to their maximum open.
3.5.1.2 Decrease in Heat Removal from Reactor Coolant System
There are many events that could result in a decrease of the heat removal from the reactor
coolant system (condition 2.1.2 of Figure 3.5.1-1). They are identified through the master
logic diagram (MLD) developed for this condition, which is reported in the Figures 3.5.1-3
and 3.5.1-4.
level 3 events description
The event [2.1.2] "DECREASE IN HEAT REMOVAL FROM REACTOR COOLANT
SYSTEM" can result from a decreased capability of the secondary coolant system (SCS) to
remove the power generated in the primary system. Analyzing the heat removal path
between the core and the external air to which it is rejected, the decrease of the heat
removal from the primary system can be originated by malfunctions concerning the
secondary coolant circulation system or the air coolers system globally intended as the SCS
of the XADS.
The MLD in Fig. 3.5.1-3 shows, the malfunctions or failures leading to condition [2.1.2] are
those that induce the following scenarios:
• INCREASE of ORGANIC FLUID TEMPERATURE;
• DECREASE of ORGANIC FLUID FLOW;
• DECREASE of ORGANIC FLUID INVENTORY.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
52
Figure 3.5.1-3
MLD development starting from the condition
"DECREASE IN HEAT REMOVAL FROM REACTOR COOLANT SYSTEM"
[2.1.2]
DECREASE OF HEAT REMOVAL
FROM RCS
Level 3
level 4
[2.1.2.1]
INCREASE OF ORGANIC
FLUID TEMPERATURE
[2.1.2.2]
DECREASE OF ORGANIC
FLUID FLOW
[2.1.2.3]
DECREASE OF ORGANIC
FLUID INVENTORY
[2.1.2.4]
INCREASE In LBE
Core Inlet Temp.
See Fig. 3.5.1-4
See Fig. 3.5.1-5
[2.1.2.1.1]
DECREASE in
HEAT REMOVAL
from AIR COOLERS
[2.1.2.1.2]
SCS FEED &
BLEED SYSTEM
MALFUNCTIONS
[2.1.2.2.1]
LOSS of
ELECTRIC
POWER to 1
SCS LOOP
[2.1.2.2.2]
SCS
PUMP
FAILURE
[2.1.2.2.3]
IHX PIPE
BLOCKAGE
level 5
[2.1.2.1.1.1]
3 OUT OF 3
AIR COOLER
MALFUNCTION
[2.1.2.1.1.2]
1 OUT OF 3
AIR COOLER
MALFUNCTION
[2.1.2.1.2.1]
OIL STORAGE
TANK HEATERS
MALFUNCTION
level 6
[2.1.2.1.1.1.1]
AC
CONTROL
SYSTEM
MALFUNCTION
[2.1.2.1.1.2.1]
AC FAN
MALFUNCTION
[2.1.2.1.1.2.2]
AC LOUVERS
SPURIOUS
CLOSURE
[2.1.2.1.1.2.2]
AC MODULATING
DAMPERS
SPURIOUS
CLOSURE
[2.1.2.1.1.2.3]
AC HEATER
MAX. SUPPLIED
POWER
level 7
[2.1.2.1.1.2.1.1]
FAN VANES
SPURIOUS
CLOSURE
[2.1.2.1.1.2.1.2]
FAN
OUT OF WORK
level 8
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
53
Figure 3.5.1-4
MLD development starting from
“DECREASE OF ORGANIC FLUID INVENTORY"
[2.1.2.3]
DECREASE OF ORGANIC
FLUID INVENTORY
level 4
level 5
[2.1.2.3.1]
INADVERTED
OPENING
of a SCS
SAFETY VALVE
[2.1.2.3.2]
SCS
PIPE
BREAK
[[2.1.2.3.3]
INADVERTED
OPENING
OF SCS DRAIN
VALVES
Figure 3.5.1-5
MLD “INCREASE IN LBE INLET CORE TEMPERATURE”
[2.1.2.4]
INCREASE IN LBE CORE
INLET TEMPERATURE
level 4
[2.1.2.4.1]
IHX SHELL RUPTURE
level 5
Due to the complete separation between the two SCS loops the occurrence of these events
may involve only one SCS loops at time (no multiple failures are considered) and as a
consequence of their occurrences the heat up of the primary system is experienced.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
54
level 4 events description
Concerning the event [2.1.2.1] “INCREASE of ORGANIC FLUID TEMPERATURE” the MLD
in Fig. 3.5.1-3 shows that it can be originated by:
• DECREASE in HEAT REMOVAL from AIR COOLERS;
• SCS FEED and BLEED SYSTEM MALFUNCTIONS.
Therefore one branch of the MLD will be constructed addressing the malfunctions of the Air
Coolers that affect their capability to reject to the external air the power extracted from the
primary system by the organic oil thus causing the increase of the organic fluid temperature.
Another branch of the MLD will address the SCS Feed and Bleed system malfunctions that
cause an increase of the organic oil temperature.
Concerning the event [2.1.2.2] “DECREASE of ORGANIC FLUID FLOW” Fig. 3.5.1-3 shows
that it can be originated by:
• LOSS of ELECTRIC POWER to ONE SCS LOOP
• SCS PUMP FAILURE
• IHX PIPE BLOCKAGE
This branch of the MLD will be constructed addressing those malfunctions or failures of the
SCS that cause a decrease of the organic oil flowrate in one of the SCS loops thus leading
to a reduction of the power removed from the primary system.
Concerning the event [2.1.2.3] “DECREASE of ORGANIC FLUID INVENTORY” Fig. 3.5.1-4
shows that it can be originated by:
• INADVERTED OPENING of a SCS SAFETY VALVE;
• SCS PUMP BREAK;
• INADVERTED OPENING of SCS DRAIN VALVES.
This branch of the MLD will be constructed addressing those malfunctions or failures of the
SCS that cause a decrease of the organic oil inventory in one of the SCS loops thus leading
to a reduction of the power removed from the primary system.
Concerning the event [2.1.2.4] “INCREASE IN LBE CORE INLET TEMPERATURE” Fig.
3.5.1-5 shows that it can be originated by:
• IHX SHELL RUPTURE
This branch refers to this failure of the IHX which impacts on the performance of the
component thus leading to a reduction of the power removed by the primary coolant.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
55
level 5 events description
Considering the event [2.1.2.1.1] "DECREASE in the HEAT REMOVAL from AIR
COOLERS ", the MLD shows that it can derive from the malfunction that affect all Air
Coolers of one SCS loop (3 out of 3 SCS AIR COOLERS MALFUNCTION) or from the
malfunction that affect only one Air Cooler (1 out of 3 SCS AIR COOLERS
MALFUNCTION). This means that a malfunction or a failure that affect a single or all the 3
Air Coolers in one of the secondary coolant loops limits the loop capability to reject to the
external air the core power.
It is noted here that the XADS primary and secondary coolant temperatures control strategy
is centered on the Air Coolers System which therefore is designed with a large degree of
flexibility and provided with several regulating devices including variable speed fans,
orientable fan valves, moving inlet and outlet louvers in each fan (see Fig 3.2-10).
The drawback of this flexibility is then the large variety of malfunctions that can be
postulated.
Considering the event [2.1.2.1.2] "SECONDARY COOLANT FEED and BLEED SYSTEM
MALFUNCTIONS", the MLD shows that it can derive from the malfunctions of the oil
storage tank heaters. This event however is considered of small significance.
The event [2.1.2.2.1] “LOSS of ELECTRIC POWER to ONE SCS LOOP” refers to a failure
to the electric power system which supplies electricity to all loads of one SCS loop (oil
pump, Air Cooler Fans, feed & bleed pump, etc). Following this occurrence the affected
SCS loop rejects heat to the ultimate heat sink only by oil and air flowing in natural
circulation.
The event [2.1.2.2.2] “SCS PUMP FAILURE” refers to an occurrence that causes one SCS
recirculation pump to go out of operation (loss of electric power or mechanical failures) and
as a consequence the SCS oil flowrate of the affected loop decreases. The SCS pump
failure causes the loss of the forced oil flow, then natural circulation establishes in the
affected SCS loop while air in the Air Coolers continues to flow in forced circulation. The
consequences of this event are similar but less severe than the event [2.1.2.2.1] above.
The event [2.1.2.2.3] “IHX PIPE BLOCKAGE” [2] refers to the occurrence of a oil pipe
obstruction that causes is an increase of the hydraulic resistences in the oil circuit and then
a reduction of the circulation oil flowrate. This event has similar consequence of event
[2.1.2.2.2] which has bounding effects. Note that the pipe blockage can occur due to some
loose part in the circuit that stops in the pipe or due to the deposition of impurities that
progressively reduces the pipe flowrarea. Referring to the latter it can be noted that it
develops over long time and then it would be detectable before adverse consequence are
generated.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
56
The event [2.1.2.3.1] “INADVERTENT OPENING of a SCS SAFETY VALVE” refers to the
spurious opening of one safety valve. In this case the "break" originated in the SCS line at
the relief valve location causes the draining of the oil stored at a rate depending from the
size of the valve, eventually inducing the complete loss of inventory of one out of two SCS
loops if the safety valve remains stack open. As a consequence of the decreasing heat
removal capability of the plant secondary side the heat up of the primary system occurs till
the proton beam trip is actuated, which reduces the generated power.
The event [2.1.2.3.2] “SCS PIPE BREAK” refers to the mechanical failure of a SCS pipe
that may determine (depending on the postulated break location) the complete draining of
the affected SCS loop. The rate of loop draining depends on the size of the break. The
consequences of this event are the same as those indicated for the event [2.1.2.3.1].
The event [2.1.2.3.3] “INADVERTED OPENING OF SCS DRAIN VALVES”, derives from
inadvertent opening of both drain valves (installed in series) on the drain line which
determines the complete draining of the affected SCS loop. These events are the same
consequences as the event [2.1.2.3.2] above.
The event [2.1.2.4.1] “IHX SHELL RUPTURE” [2] refers to the failure of the IHX skirt. This
event can be postulated as a result of the chemical attack on the skirt steel by the primary
LBE at the IHX inlet location where windows are provided on the skirt in order to allow the
LBE flow inside the component. If the IHX skirt failure occurs it moves upwards due to the
buoyancy; in this case partial obstruction of the IHX shell side flow area can occur thus
reducing the primary LBE flowrate entered in the heat exchanger. The reduction of the heat
removed from the primary coolant will result in an increase of the LBE core inlet
temperature.
level 6 events description
The events [2.1.2.1.1.1] “3 out of 3 SCS AIR COOLERS MALFUNCTION can be attributed
to the initiating event AIR COOLERS CONTROL SYSTEM MALFUNCTION that bring the
Air Coolers at their minimum heat exchange capacity.
Note that the event related to a failure in the electric power system which supplies electricity
to the 3 Air Cooler Fans causes also the loss of electricity to the other loads the SCS loop
(oil pump, feed-and-bleed pump, etc). This is the same event [2.1.2.2.1] “LOSS of
ELECTRIC POWER to ONE SCS LOOP” described above. Following this occurrence the
affected SCS loop rejects heat to the ultimate heat sink only by oil and air flowing in natural
circulation.
The event [2.1.2.1.1.2] “1 out of 3 AIR COOLER MALFUNCTION” can be attributed to the
following initiating events:
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
57
• AIR COOLER FAN MALFUNCTION;
• AIR COOLER LOUVERS SPURIOUS CLOSURE;
• AIR COOLER MODULATING DAMPERS SPURIOUS CLOSURE;
• AIR COOLER HEATER MAXIMUM SUPPLIED POWER.
All the events refer to faults that lead to a decrease of the air flowrate through the Air Cooler
Unit with respect to the value required by the power level at which the plant is operating.
Concerning the event [2.1.2.1.2.1] "OIL STORAGE TANK HEATERS MALFUNCTION", it
represents, in the MLD, the lowest event of this specific tree branch. If this event occurs, the
temperature of the oil stored in the tank increases. Considering the feed and bleed system
operating, the oil returns to the SCS main circulation pipes with a higher temperature,
determining a temperature increase in the SCS oil flowrate hot leg. However the Air Cooler
control system is able to maintain the average oil temperature to its operating value.
Nevertheless no significant variation of the oil temperature and then of the primary system
process parameters is expected due to the low feed and bleed mass flowrate with respect
the SCS oil circulation flowrate (the feed and bleed flow ranges from 1% to 5% of nominal
oil flowrate).
level 7 events description
The event [2.1.2.1.1.1.1] "AIR COOLER CONTROL SYSTEM MALFUNCTION” represents,
in the MLD, the lowest event of this specific tree branch. It refers to malfunction of the Air
Cooler Control System producing a signal that drives the Air Cooler regulating devices
(vanes, louvers) to a wrong position or decreases the Air Cooler fan speed with respect to
the value consistent with the power level at which the plant is operating.
The event “AIR COOLERS CONTROL SYSTEM MALFUNCTION” refers to malfunction or
failure of a sensor or a control logic that inhibits the operation of only all the Air Coolers,
which belongs to one SCS loop. In fact, in order to avoid that a single failure (with a high
probability of occurrence) directly causes the simultaneous failure of the Air Coolers of both
SCS loops, the Air Cooler control system design features the separation of the two SCS
loops.
It is noted that the consequences of having forced circulation unavailable in all the 3 Air
Coolers depend from the plant power and the position of the Air Coolers control devices
induced by the failure. In particular two cases should be distinguished where:
a) The failure leads to the loss of both forced and natural circulation of the air through the
Air Cooler units. The loss of capability to reject heat to the ultimate heat sink of one SCS
loop is complete and the result is a rapid heat up of the primary system with the heat up
rate increasing with plant operating power.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
58
b) The failure leads to the loss of the forced airflow but allows the natural circulation
through the Air Coolers; the forced airflow is lost but natural circulation of air is allowed.
The consequence on the RCS is a mild heat up; the primary system temperature
evolution depends on the effectiveness of the air natural circulation through the Air
Coolers.
The event [2.1.2.1.1.2.1] “AIR COOLER FAN MALFUNCTION” can be attributed to one of
the following initiating events which cause a reduction or complete loss of the forced air
circulation in one Air Cooler:
• FAN VANES SPURIOUS CLOSURE;
• FAN OUT OF WORK.
The event [2.1.2.1.1.2.2] "AIR COOLER LOUVERS SPURIOUS CLOSURE” is one of the
lowest events of this tree branch. It refers to a failure of the louvers that brings them to their
closure causing a reduction or complete loss of the forced and natural air circulation in one
Air Cooler.
The event [2.1.2.1.1.2.3] "AIR COOLER MODULATING DAMPERS SPURIOUS
CLOSURE” is another of the lowest events of this tree branch. It refers to a failure of the
modulating dampers that brings them to their closure causing a reduction or complete loss
of the forced and natural air circulation in one Air Cooler.
The event [2.1.2.1.1.2.4] “AIR COOLER HEATER MAXIMUM SUPPLIED POWER” is
another of the lowest events of this tree branch. It refers to an inadvertent operation of an
Air Cooler Electric Heater that reduces the Air Cooler heat rejection capacity.
level 8 events description
The event [2.1.2.1.1.2.1.1] "FAN VANES SPURIOUS CLOSURE” is one of the lowest
events of this tree branch. It refers to a failure of the fan vanes that brings them to an
incorrect position compared to the plant power.
The event [2.1.2.1.1.2.1.2] “FAN OUT OF WORK” is another of the lowest events of this
tree branch. It refers to a loss of electric power to the fan or a mechanical failure, which
bring to a reduction or complete loss of the forced air circulation in one Air Cooler.
3.5.1.3 Decrease in Primary Coolant Flowrate
The events resulting in the decrease in primary coolant flowrate (condition 2.1.3 of Figure
3.5.1-1) are identified through the master logic diagram (MLD) developed for this condition,
which is reported in Fig. 3.5.1-5.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
59
The event [2.1.3] "DECREASE IN PRIMARY COOLANT FLOWRATE" can result either from
degradation (including the complete loss) of the gas bubbles injected flowrate or from a
generalized increase of the hydraulic resistance of the lead-bismuth circulation flow path.
Figure 3.5.1-5
MLD development for the condition
"DECREASE IN PRIMARY COOLANT FLOWRATE"
[2.1.3]
DECREASE IN
PRIMARY COOLANT
FLOWRATE
level 3
[2.1.3.1]
ENHANCED PRIMARY
COOLANT FLOW SYSTEM
MALFUNCTION OR FAILURE
[2.1.3.2]
GENERALIZED INCREASE
OF PRIMARY CIRCULATION
PATH HYDRAULIC
RESISTANCE
level 4
[2.1.3.1.1]
PARTIAL LOSS
OF
ENHANCED
PRIMARY COOLANT
FLOW
[2.1.3.1.2]
COMPLETE LOSS
OF
ENHANCED
PRIMARY COOLANT
FLOW
level 5
[2.1.3.1.1.1]
GAS
COMPRESSOR
MALFUNCTION
[2.1.3.1.1.2]
COVER GAS
PRESSURE
CONTROL
SYSTEM
MALFUNCTION
[2.1.3.1.1.3]
MINOR GAS
DELIVERY
PIPE
FAILURE
[2.1.3.1.2.1]
TOTAL
LOSS of AC
POWER
[2.1.3.1.2.2]
GAS
COMPRESSORS
TRIP
[2.1.3.1.2.3]
MAIN GAS
DELIVERY
PIPE
FAILURE
level 6
(There are no lead-bismuth circulating pumps in the Primary Vessel; argon extracted from
the cover gas region is circulated and treated through a dedicated system outside the
Primary Vessel, compressed and then injected into the lowest part of each of the 24 risers
located above the core region; see Figure 3.2-8 in which a simplified flow diagram of the
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
60
Primary Cover Gas System is reported. The lead-bismuth circulation path within the Primary
Vessel is anyway designed to allow significant natural circulation also in the absence of gas
bubbles injection).
level 4 events description
The event [2.1.3.1] "ENHANCED PRIMARY COOLANT FLOW SYSTEM MALFUNCTION
OR FAILURE" can be originated by:
• malfunctions of the gas compressors leading to a decrease in the compressed gas
flowrate, loss of electric power leading to the gas compressors shut-off, loss of cover gas
pressure control causing cover gas pressure reduction, malfunctions or failures of
components (including pipes) in the argon gas circulation system and injection system
into the Primary Vessel.
The event [2.1.3.2] "GENERALIZED INCREASE OF PRIMARY CIRCULATION PATH
HYDRAULIC RESISTANCE" can be originated by:
• reduction of flow areas or of surface roughness due to chemical (oxidation) or physical
(crud formation, deposits) processes.
It is noted that event [2.1.3.2] would anyway be the consequence of processes developing
over long times and would therefore be detectable before it can generate adverse
consequences. Therefore no specific MLD branch will be constructed for it.
level 5 events description
Considering the event [2.1.3.1.1] "PARTIAL LOSS OF ENHANCED PRIMARY COOLANT
FLOW" the MLD shows that it can derive from malfunctions of the argon gas compressing
unit, of the cover gas pressure control system, of components provided along the gas
circulation system outside the Primary Vessel or from leakages due to mechanical failures
in the gas circulation system piping (see Figure 3.2-8).
Considering the event [2.1.3.1.2] "COMPLETE LOSS OF ENHANCED PRIMARY
COOLANT FLOW", the MLD shows that it can derive from the loss of electric power to the
gas compressors, the compressors gas trip or from the mechanical failure of gas circulation
system piping (either preventing gas supply to the compressor or compressed gas supply to
the intended injection locations inside the Primary Vessel) (see Figure 3.2-8).
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
61
level 6 events description
The event [2.1.3.1.1.1] "GAS COMPRESSORS MALFUNCTION" assumes that the gas
compressors, though still operating, are no longer capable to supply the nominal gas
flowrate but only a fraction of it. (Note that similar consequences would be originated by the
high-temperature or low-temperature cover gas system heat exchanger failure to transfer
heat due to the deposition of impurities, malfunction of the circuit dedicated to the heat
removal (oil circuit in case of the high-temperature heat exchanger, water circuit in case of
the low-temperature heat exchanger)[2]. In fact this would lead to the increase of argon
temperature and pressure which, if not compensated by the cover gas control system, can
impact on the gas flowrate delivered to the RCS).
The event [2.1.3.1.1.2] "COVER GAS PRESSURE CONTROL SYSTEM MALFUNCTION"
assumes that the cover gas pressure control system misoperates in such a way to reduce
its pressure. As a consequence the pressure reduces also at the compressor inlet, at its
outlet and, finally, at the injection locations inside the Primary Vessel. This tends to reduce
the amount of primary lead-bismuth circulation enhancement.
The event [2.1.3.1.1.3] "MINOR GAS DELIVERY PIPE FAILURE" assumes that a leakage
develops somewhere along the argon gas circulation pipes; this causes the loss of a
fraction of the circulating gas. No matter where the leakage is postulated downstream of the
compressor, the consequence would be a reduced gas flowrate injection at the intended
locations inside the Primary Vessel. (Note that similar consequences would be originated
by:
- postulated obstructions in the argon gas circulating pipes and components (i. e. low
and high temperature cover gas system heat exchangers [2];
- high-temperature/low-temperature cover gas heat exchanger pipe break in case of a
design pressure value of the oil/water cooling system lower than the argon pressure.
Note that in this case the heat exchangers cooling systems should be located inside
the containment in order to prevent the release of the radioactive argon entered
inside to the external atmosphere)[2];
- cover gas system filter rupture or obstruction [2].
Note also that a postulated spurious closure of one isolation valve on one pipe delivering
gas to one riser or the mechanical failure of the pipe itself would terminate gas injection
into one riser; while the effect on the overall lead-bismuth circulation flowrate would be
small there would likely be a very significant effect on the lead-bismuth circulation in the
affected riser).
The event [2.1.3.1.2.1] “TOTAL LOSS of AC POWER” assumes that all the Alternate
Current (AC) electric power is lost. Hence the AC power is lost to any loads including Gas
Compressors, SCS oil pumps, Air Cooler Fans and Proton Accelerator. As a consequence
the Reactor trip (proton beam trip) occurs and both primary coolant flow and secondary
coolants flows (both oil and air flows) turn from forced to natural circulation to eject the
decay heat to the ultimate heat sink.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
62
The event [2.1.3.1.2.2] "GAS COMPRESSORS TRIP" assumes that the operation of the
gas compressor is spuriously (e.g. loss of electric power or mechanical failure coincident
with the standby gas compressor unavailable) or deliberately ("upon monitoring component
related problems) terminated. Gas circulation is therefore completely lost and no gas at all is
injected into the reactor vessel. The primary coolant flow turns from forced to natural
circulation while the SCS remains in forced circulation (both oil and air flows). (Note that
similar consequences would be originated by:
- the high-temperature or low-temperature cover gas system heat exchanger failure to
transfer heat (due to the deposition of impurities or malfunction of the circuit
dedicated to the heat removal (oil circuit in case of the high-temperature heat
exchanger, water circuit in case of the low-temperature heat exchanger)) leading to
an increase of argon temperature and pressure such to cause the compressor trip
[2];
- high-temperature/low-temperature cover gas heat exchanger pipe break in case of a
design pressure value of the oil/water cooling system greater than the argon
pressure. Note that this event should causes also an increase of the RCS cover gas
pressure[2];
- cover gas system filter total blockage [2]).
The event [2.1.3.1.2.3] "MAIN GAS DELIVERY PIPE FAILURE" assumes that a pipe into
which the entire gas flowrate circulates breaks. No matter where the pipe failure is
postulated, all the gas flowrate is discharged from the break and hence no gas at all is
injected into the Primary Vessel. (Note that similar or almost similar consequences would be
originated by events such as spurious opening of the cover gas safety valves, spurious
closure of gas distribution headers inlet/outlet isolation valves (downstream the compressor
unit), spurious closure of any valve upstream the compressor unit. Such events are not
explicitly reported in the MLD; they would pertain to level 7 of the MLD itself).
3.5.1.4 Increase in Primary Coolant Flowrate
The events resulting in the increase in primary coolant flowrate (condition 2.1.4 of Figure
3.5.1-1) are identified through the master logic diagram (MLD) developed for this condition,
which is reported in Figure 3.5.1-6.
The event [2.1.4] "INCREASE IN PRIMARY COOLANT FLOWRATE" basically results from
an increased gas bubbles injected flowrate. (As mentioned also in previous section 3.5.1.3,
there are no lead-bismuth circulating pumps in the Primary Vessel; argon extracted from the
cover gas region is circulated and treated through a dedicated system outside the Primary
Vessel, compressed and then injected into the lowest part of each of the 24 risers located
above the core region; see Figure 3.2-8 in which a simplified flow diagram of the Primary
Cover Gas System is reported).
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
63
Figure 3.5.1-6
MLD development for the condition
"INCREASE IN PRIMARY COOLANT FLOWRATE"
[2.1.4]
INCREASE
IN
PRIMARY COOLANT
FLOWRATE
level 3
[2.1.4.1]
ENHANCED PRIMARY
COOLANT
FLOW SYSTEM
MALFUNCTION
level 4
[2.1.4.1.1]
STANDBY
GAS COMPRESSOR
SPURIOUS STARTUP
[2.1.4.1.2]
COVER GAS
PRESSURE CONTROL
SYSTEM
MALFUNCTION
level 5
level 4 events description
The event [2.1.4.1] "ENHANCED PRIMARY COOLANT FLOW SYSTEM MALFUNCTIONS"
can be originated by:
• malfunctions of the gas compressors leading to an increase in the compressed gas
flowrate, loss of cover gas pressure control causing cover gas pressure increase,
malfunctions of components in the argon circulation system.
It is noted that, based on the analysis of the working principle of the lead-bismuth circulation
enhancement by gas bubbles injection (namely the correlation between injected gas
flowrate and extent of lead-bismuth circulation enhancement), and of the features of the gas
injecting system (namely the maximum expected increase of injected gas flowrate or
injected gas pressure), only a moderate increase of the primary coolant flowrate is
anticipated to be possible. Moreover, an increase of the lead-bismuth flowrate would pose
limited challenged to the fuel rods cladding as well as to the Primary Vessel. Thus it is
judged that the MLD associated to this condition does not need to be developed in
excessive detail.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
64
level 5 events description
The event [2.1.4.1.1] "STANDBY GAS COMPRESSOR SPURIOUS STARTUP" assumes
that the standby gas compressor, provided to allow continued plant operation in case the
normally working unit needs maintenance or repair and normally idle, inadvertently starts
operating. The joint operation of the two units would determine an increase of the circulating
argon gas flowrate (the new flowrate being determined, obviously, also by the hydraulic
resistance of the argon gas circulation loop) and hence of the argon flowrate injected at the
intended locations inside the Primary Vessel.
The event [2.1.4.1.2] "COVER GAS PRESSURE CONTROL SYSTEM MALFUNCTION"
assumes that the cover gas pressure control system misoperates in such a way to increase
its pressure. As a consequence the pressure increases also at the compressor inlet, at its
outlet and, finally, at the injection locations inside the Primary Vessel. This tends to increase
the amount of primary lead-bismuth circulation enhancement.
Note that consequences similar to the ones originated by the postulated cover gas pressure
control system malfunctions would be originated by malfunctions in the argon gas cooling
heat exchangers (determining an increase of the argon gas temperature in some regions of
the argon loop and hence a pressure increase if the pressure control is assumed
unavailable), by the spurious opening of the under pressure control valve located in the line
connecting the compressors suction with the gas buffer tank (determining the ingress of
additional gas into the argon cover gas and hence a pressure increase, again if the
pressure control is assumed unavailable).
3.5.1.5 Decrease of Primary Lead-Bismuth Inventory
Due to the XADS design features (pool configuration with main and Guard Vessel, no leadbismuth
circulation outside the Primary Vessel) there is basically only one event that can
originate the decrease of the lead-bismuth inventory in the Primary Vessel (condition 2.1.5
of Figure 3.5.1-1). The master logic diagram (MLD) developed for this condition, reported in
Figure 3.5.1-7, is therefore very simple.
The event [2.1.5] "DECREASE OF PRIMARY LEAD-BISMUTH INVENTORY" can only
result from leakages from or breaks of the Primary Vessel as a consequence of cracks or
mechanical failures. (There is no lead-bismuth circulation outside the Primary Vessel under
any plant operating condition; the lead-bismuth purification system is integrated within the
Primary Vessel).
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
65
level 4 events description
The event [2.1.5.1] "LOSS OF PRIMARY COOLANT" can be originated by:
• leakages from the Primary Vessel (at locations below the nominal lead-bismuth level)
• breaks in the Primary Vessel (at locations below the nominal lead-bismuth level).
level 5 events description
The event [2.1.5.1.1] "LEAKAGES FROM PRIMARY VESSEL" assumes that Primary
Vessel material degradation generates through-wall cracks through which a (presumably
small) flow of lead-bismuth is discharged into the gap between main and Guard Vessel
where it is collected and retained.
The event [2.1.5.1.2] "PRIMARY VESSEL BREAK" assumes that a Primary Vessel
mechanical failure quickly discharges lead-bismuth into the gap between main and Guard
Vessel where it is collected and retained. The maximum Primary Vessel break size is
assumed, as in Superphenix, of 10 cm 2 .
Figure 3.5.1-7
MLD development for the condition
"DECREASE OF PRIMARY LEAD-BISMUTH INVENTORY"
[2.1.5]
DECREASE
OF
PRIMARY LEAD-BISMUTH
INVENTORY
level 3
[2.1.5.1]
LOSS OF
PRIMARY COOLANT
level 4
[2.1.5.1.1]
LEAKAGES
FROM
PRIMARY VESSEL
[2.1.5.1.2]
PRIMARY VESSEL
BREAK
level 5
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
66
3.5.1.6 Increase of Reactor Coolant System Pressure
The events resulting in the increase of the Reactor Coolant system pressure (condition
2.1.6 of Figure 3.5.1-1) are identified through the master logic diagram (MLD) developed for
this condition, which is reported in Figure 3.5.1-8.
The event [2.1.6] "INCREASE OF REACTOR COOLANT SYSTEM PRESSURE" basically
results from a pressure increase in the cover gas region (i.e. the region above the nominal
lead-bismuth level in the Primary Vessel).
Figure 3.5.1-8
MLD development for the condition
"INCREASE OF REACTOR COOLANT SYSTEM PRESSURE"
[2.1.6]
INCREASE
OF
REACTOR COOLANT
SYSTEM PRESSURE
level 3
[2.1.6.1]
INCREASE
OF
COVER GAS PRESSURE
level 4
[2.1.6.1.1]
COVER GAS PRESSURE
CONTROL SYSTEM
MALFUNCTION
[2.1.6.1.2]
IHX
PIPE RUPTURE
level 5
level 4 events description
The event [2.1.6.1] "INCREASE OF COVER GAS PRESSURE" can be originated by:
• malfunctions of the cover gas pressure control system
• rupture of one or more pipes in an Intermediate Heat Exchanger (IHX).
It is noted that the second event may determine a pressure increase only if secondary
coolant is discharged into the primary lead-bismuth coolant. This happens only if the
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
67
secondary coolant pressure in the IHX region is higher than the corresponding lead-bismuth
pressure. As a design strategy, a secondary loop configuration is searched, for the XADS
such that the former pressure is lower that the latter. This may be true, however, only for
some operational conditions.
level 5 events description
The event [2.1.6.1.1] "COVER GAS PRESSURE CONTROL SYSTEM MALFUNCTION"
assumes that the related control system misoperates in such a way to determine an
increase of the cover gas pressure. This, in turn, determines a pressure increase at any
location inside the Primary Vessel.
The event [2.1.6.1.2] "IHX PIPE RUPTURE" has the potential to determine an increase of
primary pressure only if secondary coolant is discharged into the lead-bismuth. In fact the
secondary coolant boiling temperature (~ 360 °C at atmospheric pressure) is lower than the
maximum lead-bismuth temperature (~ 400 °C at core outlet, and hence also in the upper
portion of the IHX, at the nominal plant power of 80 MW th ), so that the secondary coolant
can boil and oil vapors can move upwards to the cover gas region and pressurize it. Since
the secondary coolant pressure in the IHX region may be different for different operating
conditions (e.g. forced and natural circulation) the analysis should cover all the anticipated
normal operating conditions.
3.5.2 Target Unit Coolant System Challenges
The phenomenologies that could result in the occurrence of event [2.2] “TARGET UNIT
COOLANT SYSTEM PRESSURE or TEMPERATURE VARIATION” (see Fig 3.3-1) are
listed in the level 3 MLD of the Fig. 3.5.2-1.
Note that both the MLD of Fig 3.5.2-1 and the event described in this section refer only to
the Windowless Target Unit option described in section 3.2.4. A similar MLD should be
constructed for the Hot-Window Target Unit option.
In the following subsections 3.5.2.1 through 3.5.2.4 a MLD will be developed for each of the
level 3 phenomenologies identified in Figure 3.5.2-1.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
68
Figure 3.5.2-1
MLD development starting from
" TUCS PRESSURE and TEMPERATURE VARIATION "
[2.2]
TUCS PRESSURE or
TEMPERATURE
VARIATION
level 2
[2.2.1]
DECREASE in
HEAT
REMOVAL
from TUCS
[2.2.2]
DECREASE in
TARGET UNIT
COOLANT
FLOWRATE
[2.2.3]
INCREASE in
TARGET UNIT
Pb-Bi
INVENTORY
[2.2.4]
INCREASE of
TARGET UNIT
PRESSURE
[2.2.5]
INCREASE of
TARGET UNIT
TEMPERATURE
level 3
3.5.2.1 Decrease in Heat Removal from Target Unit Coolant System
There are many events that could result in a decrease of the heat removal from the target
unit coolant system (condition 2.2.1 of Figure 3.5.2-1). They are identified through the
master logic diagram (MLD) developed for this condition, which is reported in the Figures
3.5.2-2. Most of these events cause also the decrease in primary coolant flowrate and they
are already considered in the section 3.5.1.3.
The event [2.2.1.1.1.3] "MINOR GAS DELIVERY PIPE FAILURE" assumes that a leakage
develops somewhere along the argon gas circulation pipes; this causes the loss of a
fraction of the circulating gas. No matter where the leakage is postulated downstream of the
compressor, the consequence would be a reduced gas flowrate injection at the intended
locations inside the Primary Vessel with a very significant effect on the lead-bismuth
circulation in the affected riser. In the occurrence that the affected riser is one of the two (U
shaped risers) that suck from the upper part of the dead volume, which are responsible for
the primary coolant flow in the target unit, there would likely be a very significant effect on
the primary lead-bismuth circulation in the Target Unit, while the effect on the primary leadbismuth
circulation flowrate would be small. (Note that similar consequences would be
originated by postulated obstructions in the argon gas circulating pipes, spurious closure of
one isolation valve on one pipe delivering gas to one riser or the mechanical failure of the
pipe itself would terminate gas injection into one riser).
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
69
Figure 3.5.2-2
MLD development starting from the condition
"DECREASE IN HEAT REMOVAL FROM TARGET UNIT COOLANT SYSTEM"
[2.2.1]
DECREASE in HEAT
REMOVAL from TUCS
level 3
[2.2.1.1]
ENHANCED PRIMARY
COOLANT FLOW SYSTEM
MALFUNCTION OR FAILURE
level 4
[2.2.1.1.1]
PARTIAL LOSS
OF
ENHANCED
PRIMARY COOLANT
FLOW
[2.2.1.1.2]
COMPLETE LOSS
OF
ENHANCED
PRIMARY COOLANT
FLOW
level 5
[2.2.1.1.1.1]
GAS
COMPRESSOR
MALFUNCTION
[2.2.1.1.1.2]
COVER GAS
PRESSURE
CONTROL
SYSTEM
MALFUNCTION
[2.2.1.1.1.3]
MINOR GAS
DELIVERY
PIPE
FAILURE
[2.2.1.1.2.1]
TOTAL
LOSS of AC
POWER
[2.2.1.1.2.2]
GAS
COMPRESSORS
TRIP
[2.2.1.1.2.3]
MAIN GAS
DELIVERY
PIPE
FAILURE
level 6
3.5.2.2 Decrease in Target Unit Coolant Flowrate
The events resulting in the decrease in target unit coolant flowrate (condition 2.2.2 of Figure
3.5.2-1) are identified through the master logic diagram (MLD) developed for this condition,
which is reported in Fig. 3.5.2-3.
level 3 events description
The event [2.2.2] "DECREASE IN TARGET UNIT COOLANT FLOWRATE" can result from
a malfunction, a degradation or failure in the Target LBE Circulation System.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
70
level 4 events description
The event [2.2.2.1] " TARGET LBE CIRCULATION SYSTEM MALFUNCTION OR
FAILURE" can be originated by:
• malfunctions of the LBE pumps leading to a decrease or total loss of the LBE flowrate,
loss of electric power leading to the pumps shut-off, failures of components (including
pipes) in the target LBE circulation system.
The event [2.2.2.2] "GENERALIZED INCREASE OF TARGET UNIT CIRCULATION PATH
HYDRAULIC RESISTANCE" can be originated by:
• reduction of flow areas or of surface roughness due to chemical (oxidation) or physical
processes (crud formation, deposits mainly inside the heat exchanger tubes).
It is noted that event [2.2.2.2] would anyway be the consequence of processes developing
over long times and would therefore be detectable before it can generate adverse
consequences. Therefore no specific MLD branch will be constructed for it.
level 5 events description
Considering the event [2.2.2.1.1] "PARTIAL LOSS OF TARGET UNIT COOLANT FLOW"
the MLD shows that it can derive from malfunctions or failure of the the circulating system.
Considering the event [2.2.2.1.2] "COMPLETE LOSS OF TARGET UNIT COOLANT
FLOW", the MLD shows that the only event which can lead to this scenario is represented
by the total loss of AC power (level 6 event). This is due to the fact that the circulating
system is composed by two distinct pump units supplied by diverse electrical power system.
level 6 events description
The event [2.2.2.1.1.1] "1/2 PUMP TRIP" assumes that one of the two mechanical pumps
responsible of the LBE circulation goes out of operation, as a consequence the LBE
flowrate reduces due to the halved total head available.
The event [2.2.2.1.1.2] “1/2 PUMP SHAFT BREAK” assumes the seizure of the shaft of one
pump. The consequences of this event are similar to those of event [2.2.2.1.1.1].
The event [2.2.2.1.1.1] “1/2 PUMP LOCKED ROTOR” assumes the mechanical failure of
one pump. As for event [2.2.2.1.1.1] and [2.2.2.1.1.2] a reduction of the LBE occurs due to
the halved head available.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
71
Figure 3.5.2-3
MLD development starting from the condition
"DECREASE IN TARGET UNIT COOLANT FLOWRATE"
[2.2.2]
DECREASE in TARGET
UNIT FLOWRATE
level 3
[2.2.2.1]
TARGET LBE CIRCULATION
SYSTEM MALFUNCTION OR
FAILURE
[2.2.2.2]
GENERALIZED INCREASE
OF T. U. CIRCULATION PATH
HYDRAULIC RESISTENCE
level 4
[2.2.2.1.1]
PARTIAL LOSS OF TARGET
UNIT COOLANT FLOW
[2.2.2.1.2]
COMPLETE LOSS OF
TARGET UNIT COOLANT
FLOW
level
5
level 6
[2.2.2.1.1.1]
1 /2 PUMP
TRIP
[2.2.2.1.1.2]
1/2 PUMP
SHAFT BREAK
[2.2.2.1.1.3]
1/ 2 PUMP
LOCKED
ROTOR
[2.2.2.1.2.1]
TOTAL LOSS
of AC
POWER
The event [2.2.2.1.2.1] “TOTAL LOSS of AC POWER” assumes that all the Alternate
Current (AC) electric power is lost. Hence the AC power is lost to any loads including the
two pumps of the target LBE circulation system. As a consequence the proton beam trip
occurs and the target unit coolant circulation stops.
3.5.2.3 Increase in Target Unit Lead-Bismuth Inventory
The events resulting in the increase in Target Unit Lead-Bismuth inventory (condition 2.2.3
of Figure 3.5.2-1) are identified through the master logic diagram (MLD) developed for this
condition, which is reported in Fig. 3.5.2-4.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
72
Since the Target Unit is fully immersed in the primary coolant and its free Pb-Bi levels are
located under the primary vessel coolant level, any cracks, mechanical failures or breaks in
the Target Unit walls in contact with the primary coolant, fill it.
Figure 3.5.2-4
MLD development starting from the condition
"INCREASE IN TARGET UNIT Pb-Bi INVENTORY"
[2.2.3]
INCREASE in TARGET
UNIT Pb-Bi
INVENTORY
level 3
[2.2.3.1]
INLEAKAGE FROM
PRIMARY COOLANT
[2.2.3.2]
TARGET UNIT
COOLANT SYSTEM
BREAK
level 4
level 3 events description
The event [2.2.3] “INCREASE IN TARGET UNIT LEAD-BISMUTH INVENTORY” results
from cracks breaks or mechanical failures of the Target Unit walls immersed in the primary
coolant.
level 4 events description
The event [2.2.3.1] “INLEAKAGE FROM PRIMARY COOLANT” assumes that Target Unit
material degradation generates through-wall cracks through which a (presumably small)
flow of primary coolant lead-bismuth fill the Target Unit vacuum space up to the primary
vessel lead-bismuth level.
The event [2.2.3.2] “TARGET UNIT COOLANT SYSTEM BREAK” assumes that a Target
Unit mechanical failure quickly refill the Target Unit vacuum space with a primary coolant
lead-bismuth flow which depend not only by the break size but also by the break location.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
73
3.5.2.4 Increase of Target Unit Pressure
The events resulting in the increase of Target Unit pressure (condition 2.2.4 of Figure 3.5.2-
1) are identified through the master logic diagram (MLD) developed for this condition, which
is reported in Fig. 3.5.2-5.
Figure 3.5.2-5
MLD development starting from the condition
"INCREASE OF TARGET UNIT PRESSURE"
[2.2.4]
INCREASE
OF
TARGET UNIT
PRESSURE
level 3
[2.2.4.1]
LOSS OF
PROTON BEAM PIPE
VACUUM
[2.2.4.2]
LOSS OF
TARGET VACUUM
level 4
[2.2.4.1.1
PROTON BEAM PIPE
VACUUM CONTROL
SYSTEM MALFUNCTION
[2.2.4.1.2]
PROTON BEAM PIPE
BREAK
[2.2.4.2.1
TARGET
VACUUM CONTROL
SYSTEM MALFUNCTION
level 5
level 3 events description
The event [2.2.4] “INCREASE OF TARGET UNIT PRESSURE” can results from either the
loss of the vacuum in the proton beam pipe or the loss of the vacuum in the target region
over the LBE level. It has to be noted in fact that, over the LBE free surface two vacuum
regions exist which are separate by a mechanical device located in the vacuum space and
connected, below the LBE level, by a hydraulic seal. In particular, one of this region
communicate with the proton beam pipe; the second with the mechanism driving the pumps.
The vacuum regions have dedicated vacuum control systems, then the loss of the vacuum
event can result from malfunctions of the vacuum pressure control systems or from proton
beam pipe failure.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
74
level 4 events description
Considering the event [2.2.4.1] “LOSS OF PROTON BEAM VACUUM” it can derive from
the proton beam vacuum control system malfunction or from cracks, breaks or mechanical
failures on the accelerator beam transport system proton beam pipe.
Considering the event [2.2.4.2] “LOSS OF TARGET VACUUM” it refers to the loss of the
vacuum in the target region external to the mechanical device. This event is associated to
the vacuum control system malfunction.
level 5 events description
The event [2.2.4.1.1] “PROTON BEAM PIPE VACUUM CONTROL SYSTEM
MALFUNCTION” assumes that the proton beam pipe vacuum control system misoperates
in such a way to increase proton beam pipe pressure. As a consequence the proton beam
is lost (see App. B)
The event [2.2.4.1.2] “PROTON BEAM PIPE BREAK” assumes that proton beam pipe
material degradation generates through-wall cracks or proton beam pipe mechanical failure
generates breaks through which the vacuum is lost. Also in this case the proton beam il lost
and the opssibility of release of radioactive material exists (See App. B).
The event [2.2.4.2.1] “TARGET VACUUM CONTROL SYSTEM MALFUNCTION” assumes
that the vacuum control system misoperates in such a way to increase the vacuum region
pressure. In case of pressure increase greater than that faced by the hydraulic seal the
vacuum results lost also in the proton beam region ; as a consequence the proton beam is
lost.
3.5.2.5 Increase of Target Unit Temperature
level 3 events description
The event [2.2.5] “INCREASE IN TARGET UNIT TEMPERATURE” results from breaks in
the ascending or descending fluid pipes of the LBE circulation system.
level 4 events description
The event [2.2.5.1] "LBE CIRCULATION PIPE BREAK" assumes that a break occours in
the pipes of the LBE circulation system. As a consequence a secondary LBE circulation
path sets which, depending on the break location, bypasses the hot window zone or the HX.
In general this causes an increase of the LBE temperature which is more significant as the
size of the break increases.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
75
Figure 3.5.2-6
MLD development starting from the condition
"INCREASE OF TARGET UNIT TEMPERATURE"
[2.2.5]
INCREASE
OF
TARGET UNIT
TEMPERATURE
level 3
[2.2.5.1]
LBE CIRCULATION PIPE
BREAK
level 4
3.6 CONTAINMENT CHALLENGES
The third path depicted in Fig. 3.3-1 aims to identify those phenomenologies that have the
potential to affect the integrity of the third physical barrier, namely the containment. The
event [3] "CONTAINMENT CHALLENGES", the last level 1 event of the MLD, can result
from:
level 2
• REACTOR CONTAINMENT PRESSURE/TEMPERATURE TRANSIENTS [3.1];
• RADIOACTIVE RELEASE INSIDE THE CONTAINMENT [3.2]
Note that event [3.1] refers to accidents that lead to pressure and/or temperature increase in
the reactor containment while event [3.2] refers to accidents that release radioactivity in the
reactor containment with no or insignificant mass and energy release.
Furthermore, other events that have the potential to originate release of radioactivity directly
outside containment (e.g. leakage of waste from storage tanks located in the waste storage
building) will not be treated in this context.
Fig. 3.6-1 shows the first three level pathways of the reactor containment MLD
development, explained in the following.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
76
Figure 3.6-1
First 3 levels of reactor containment MLD development
[3]
level 1
CONTAINMENT CHALLENGES
(INTEGRITY / LEAKTIGHTNESS)
level 2
[3.1]
REACTOR CONTAINMENT
PRESSURE / TEMPERATURE
TRANSIENTS
[3.2]
RADIOACTIVE RELEASES
INSIDE THE CONTAINMENT
[3.1.1]
[3.1.2]
[3.1.3]
[3.2.1]
level 3
LEAKAGES FROM
HIGH ENERGY SYSTEMS
INSIDE
REACTOR CONTAINMENT
REACTOR CONTAINMENT
PRESSURE TESTS
INADEQUATE
REACTOR CONTAINMENT
HEAT REMOVAL
LOW ENERGY
RADIOACTIVE FLUID
SYSTEMS FAILURE INSIDE
REACTOR CONTAINMENT
The events of group [3.1] can result from:
level 3
• leakages from High Energy Systems inside reactor containment (high pressure and/or
high temperature fluid systems failure) [3.1.1];
• reactor containment pressure tests (it is remembered that leakage tests are required at
the beginning and during the life of the plant. The purposes of the tests are to assure
that leakage through the primary containment and systems and components penetrating
primary containment shall not exceed allowable leakage rate values as specified in the
Technical Specifications. A "preoperational leakage rate test" and "periodic leakage rate
tests" are performed, during which the reactor containment pressure can reach the
design pressure or even exceed it [3.1.2];
• inadequate reactor containment Heat Removal (both accidents increasing the reactor
containment temperature or pressure and loss of any system designed to remove heat
from the reactor containment under normal or emergency conditions) [3.1.3].
The events of group [3.2] can result from:
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
77
level 3
• low-energy radioactive fluid systems failure inside reactor containment [3.2.1] (leakages
of radioactive fluid from low operating pressure or low operating temperature systems
failure with no significant reactor containment pressurization)
The failures of low-energy systems with release of non-radioactive fluid are not taken into
account in these preliminary analyses since they would not give any contribution to the
release of radioactivity from reactor containment. The failures concerning the
Fuel/Components Handling Systems are not take into account in this analysis because,
during the refueling, the containment is open and it is not considered a barrier. In particular
failures of the following systems are not considered in the analysis of the initiating events:
• Sector Magnets Cooling System (SMCS)
• Non-Radioactive Liquid Waste System (WNRLS)
• Chilled Water System (CHWS)
• Auxiliary Steam System (ASS)
• Compressed and Instrument Air System (CIAS)
• Gas Distribution System (NGDS)
• Fire Protection System (FPS)
• Component Cooling Water System (CCWS)
Fig. 3.6-2 shows the development of the lower level pathways starting from point [3.1.1] of
level 3 (leakages from high-energy systems inside reactor containment) explained in the
following.
It has to be remarked that some typical accidents occurring in the conventional nuclear
power plants and determining both high mass-and-energy and radioactive releases, in this
specific context of hybrid reactor plant do not determine any challenge to the reactor
containment integrity/leaktighness or potential pressure/temperature transient inside the
reactor containment itself. In particular:
• the postulated failure or break of the Secondary Coolant System (SCS) system does not
release either Mass and Energy or radioactive products inside the containment; this
because a "Guard Pipe" (around the SCS system inside containment) is provided in the
plant design such to direct leakages from the Secondary Coolant System outside reactor
containment (see Fig. 3.6-3).
• the postulated rupture of the reactor vessel determines a radioactive release (primary
coolant) into the safety vessel without any release to the reactor containment
atmosphere.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
78
Figure 3.6-2
MLD development starting from "leakages from high energy systems"
level 3
[3.1.1]
LEAKAGES FROM
HIGH ENERGY SYSTEMS
INSIDE
REACTOR CONTAINMENT
level 4
[3.1.1.1]
RCFS
FAILURE
[3.1.1.2]
LEAKAGE
FROM
PRIMARY REACTOR SYSTEM
[3.1.1.3]
ABTS
FAILURE
level 5
[3.1.1.2.1]
SIMULTANEOUS
REACTOR & GUARD
VESSELS RUPTURE
[3.1.1.2.2]
LEAKAGE
FROM
VESSEL TOP CLOSURE
level 3
The event " leakages from high energy systems inside reactor containment" is the initiating
event.
The initiating event can result from:
level 4
• Reactor Coolant Filling System (RCFS) failure [3.1.1.1]
• Leakage from Primary Reactor System [3.1.1.2]
• Accelerator Beam Transport System (ABTS) [3.1.1.3] (the failure of the system that
drives the proton beam inside the reactor vessel, magnetic divertor, can cause the
rupture of its confinement structure).
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
79
Figure 3.6-3
Sketch of the boundaries provided to direct leakages
from the Secondary Coolant System outside reactor containment
REACTOR
BUILDING
REACTOR
VESSEL
level 4 events description
Concerning the event [3.1.1.1], Reactor Coolant Filling System failure, the following
considerations have been done.
The Reactor Coolant Filling System is designed to operate only temporarily. The main
function of the system is to compose and melt the eutectic and load it into the reactor vessel
and the target. A secondary, but very critical, function of the system is to partially drain the
Reactor Vessel down to an eutectic level only slightly above the fuel assemblies top during
exceptional events. The RCFS systems/components, listed below, are located inside
reactor containment (see Fig. 3.6-4):
a) weighting station, where the exact quantities necessary to prepare the reactor
grade LBE are obtained (44.5% Pb, 54.5% Bi);
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
80
b) electric furnace for melting the lead and bismuth;
c) intermediate storage tanks - to store a certain quantity of eutectic before charging
it into the reactor vessel. They are also used as storage tanks during the
exceptional event of vessel partial draining;
d) target storage tank - to store the eutectic before charging it into the target. This
filling will be done at every target eutectic planned change;
e) LBE transfer pumps - to discharge the eutectic into the vessel and the target;
f) LBE purification unit - connected to the storage tanks;
g) piping connecting the various components;
h) cover gas piping;
The failure of one of the above components/systems can determine a high-energy fluid
(eventually radioactive) release inside the reactor containment. In particular the following
accidents can occur:
• LBE purification line break pipe rupture
• Storage Tank break
• Cover Gas line break
It has to be underlined that these events can initiate and hence can result in high-energy
radioactive fluid release only in two operation conditions limited in time:
• during the reactor vessel end-life draining,
• during the unlikely event of partial vessel draining
and, consequently, they have very remote probability of occurrence.
The event [3.1.1.2] " Leakage from Primary Reactor System " can result from:
level 5
• Simultaneous Reactor and Guard vessels rupture [3.1.1.2.1]
• Leakage from Vessel Top Closure [3.1.1.2.2]
Concerning the event [3.1.1.3], the failure of the system that drives the proton beam inside
the reactor vessel can cause the rupture of its confinement structure and, consequently
radioactive products can be released inside the containment (i.e. gaseous target products).
This accident is to be considered a high-energy system pipe rupture.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
81
Figure 3.6-4
RCFS simplified sketch
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
82
level 5 events description
Concerning the event [3.1.1.1.1], the simultaneous rupture of both the reactor and guard
vessels represents an event discharging a high-energy radioactive fluid inside the reactor
containment.
Concerning the event [3.1.1.1.2], a leakage from the vessel top closure can determine the
release of high radioactive cover gas.
Fig. 3.6-5 shows the development of the lower level pathways starting from point [1.2] of
level 3 (Inadequate Reactor Containment Heat Removal) explained in the following.
Figure 3.6-5
MLD development starting from
"Inadequate Reactor Containment Heat Removal"
[3.1.3]
INADEQUATE
REACTOR CONTAINMENT
HEAT REMOVAL
level 3
[3.1.3.1]
LOSS OF
REACTOR BUILDING
HVAC SYSTEM
[3.1.3.2]
LOSS
OF
ELECTRIC POWER
[3.1.3.3]
TOTAL LOSS
OF SCS SYSTEM
level 4
[3.1.3.2.1]
TOTAL LOSS
OF
AC POWER
[3.1.3.2.2]
TOTAL LOSS OF
AC POWER AND
DIESEL GENERATOR
level 5
level 3
The event " Loss of Reactor Containment Heat Removal Systems " is the initiating event.
The initiating event can result from:
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
83
level 4
• Loss of Reactor Building HVAC System [3.1.3.1]
• Loss of Electric Power [3.1.3.2]
• Total Loss of SCS System [3.1.3.3]
The event [3.1.3.2] "Loss of Electric Power" can be characterized as:
level 5
• Total Loss of AC Power [3.1.3.2.1] (it assumes that all the Alternate Current (AC) electric
power is lost.)
• Total Loss of AC Power with concomitant Diesel Generators Unavailability [3.1.3.2.2] (it
assumes that all the Alternate Current (AC) electric power is lost in concomitance with
the unavailability of the diesel generators).
level 4 events description
Concerning the event [3.1.3.1], the loss of the reactor building HVAC can determine an
increase of the reactor containment atmosphere temperature during the plant normal
operation.
Concerning the event [3.1.3.3], the total loss of the secondary coolant system can
determine an increase of the reactor containment atmosphere temperature.
level 5 events description
Concerning the event [3.1.3.2.1], the total loss of AC power can determine a limited
unavailability of electric power operating systems with consequent unavailability of the
reactor building HVAC system. This determines a temperature/pressure increase of the
reactor containment atmosphere.
Concerning the event [3.1.3.2.2], total loss of AC power with concomitant diesel generators
unavailability (loss of both the external electric net and diesel generators) determine a
severe unavailability of all the electric power operating systems inside the reactor
containment with consequent unavailability of the reactor building HVAC system. This
accident is very similar to the event of total loss of AC power ([3.1.3.2.1]) but with a more
complex plant systems operation conditions.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
84
Fig. 3.6-6 shows the development of the lower level pathways starting from point [3.2.1] of
level 3 (low energy radioactive fluid systems failure inside reactor containment) explained in
the following.
Figure 3.6-6
MLD development starting from
"Low energy radioactive fluid systems failure inside reactor containment"
level 3
[3.2.1]
LOW ENERGY
RADIOACTIVE FLUID SYSTEMS
FAILURE
INSIDE CONTAINMENT
level 4
[3.2.1.1]
RDNS
LINE BREAK
[3.2.1.2]
PCGS
FAILURE
[3.2.1.4]
LEAKAGE
from TU
[3.2.1.3]
WGS
LINE BREAK
[3.2.1.4]
WLS
LINE BREAK
level 5
[3.2.1.2.1]
PCGS
LINE BREAK
[3.2.1.2.2]
LEAKAGE FROM
PCGS COMPONENTS
STORAGING
RADIOACTIVE PRODUCTS
[3.2.1.5.1]
LEAKAGE from TU
COMPONENTS STORAGING
RADIOACTIVE PRODUCTS
level 3
The event "low energy radioactive fluid systems failure inside reactor containment" is the
initiating event.
The initiating event can result from:
level 4
• Radioactive Drain Network System (RDNS) line break [3.2.1.1]
• Primary Cover Gas System (PCGS) failure [3.2.1.2]
• Waste Gas System (WGS) line break [3.2.1.3] The pipe break of this system, determines
a release of potentially radioactive fluid (waste gas addressed to external disposal
system).
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
85
• Leakage from the Target Unit System [3.2.1.4]
• Waste Liquid System (LGS) line break [3.2.1.5] The pipe break of this system,
determines a release of radioactive fluid (waste liquid addressed to external
reprocessing or disposal system).
The system acting the circulation and purification of the argon gas of the reactor and Target
cover gas actually consists of the Primary Cover Gas System (PCGS).
The event [3.2.1.2] "Primary Cover Gas System (PCGS) failure" can consequently occur.
Each of the postulated events can therefore respectively result from:
level 5
• Primary Cover Gas System (PCGS) line break [3.2.1.2.1] (break of the PCGS lines
driving radioactive products)
• Leakage from Primary Cover Gas System (PCGS) components [3.2.1.2.2] (leakage of
PCGS system components eventually storing radioactive products deriving from the
purification process).
• Leakage from Target Unit components [3.2.1.4.1] (leakage of TU system components
eventually storing radioactive products contained in the cover gas ).
•
level 4 events description
• Radioactive Drain Network System (RDNS) line break [3.2.1.1]. The pipe break of this
system, determines a release of radioactive fluid (waste effluents addressed to external
reprocessing or disposal system). The released fluid does not challenge the integrity or
leaktightness of the reactor containment.
• Waste Gas System (WGS) line break [3.2.1.3]. The pipe break of this system,
determines a release of potentially radioactive fluid (waste gas addressed to external
disposal system). The released fluid does not challenge the integrity or leaktightness of
the reactor containment.
• Leakages from the Target Unit [3.2.1.4]. The leakage of TU system components causes
a release of a waste fluid eventually storing radioactive products. The released fluid
does not challenge the integrity or leaktightness of the reactor containment
• Waste Liquid System (LGS) line breaks [3.2.1.5]. The pipe break of this system,
determines a release of radioactive fluid (waste liquid addressed to external
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
86
reprocessing or disposal system). The released fluid does not challenge the integrity or
leaktightness of the reactor containment.
level 5 events description
• Primary Cover Gas System (PCGS) line break (break of the PCGS lines driving
radioactive products) [3.2.1.2.1]. The pipe break of this system, determines a release of
radioactive fluid (waste effluents addressed to external reprocessing or disposal
system). The released fluid does not challenge the integrity or leaktightness of the
reactor containment.
• Leakage from Primary Cover Gas System (PCGS) components [3.2.1.2.2] (leakage of
PCGS system components eventually storing radioactive products deriving from the
purification process). This leakage results in a release of radioactivity with no significant
challenge to the integrity or leaktightness of the reactor containment.
• Leakage from Target Unit components [3.2.1.4.1] (leakage of TU system components
eventually storing radioactive products deriving from the purification process). This
leakage results in a release of radioactivity with no significant challenge to the integrity
or leaktightness of the reactor containment.
3.7 LIST OF ACCIDENT INITIATING EVENTS
All the accidents identified and scrutinized in previous sections 3.3 through 3.6 are reported
in the following.
Fuel Cladding Challenges
• Uncontrolled Proton Beam Current Increase
• Fuel Assembly Partial Flow Blockage
• Proton Beam Startup With Cold Reactor
• Fuel Assembly Mechanical Lock Failure
• Core Compaction
Reactor Coolant System and Target Unit Coolant System Challenges
RCS Challenge
• Inadvertent Proton Beam Trip
• Air Cooler Control System Malfunction (increasing Air Coolers heat removal)
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
87
• Air Cooler Control System Malfunction (decreasing Air Coolers heat removal)
• Air Cooler Malfunction (1 out of 3; increasing Air Coolers heat removal)
• Air Cooler Malfunction (1 out of 3; decreasing Air Coolers heat removal)
• Secondary Coolant System Pump Failure
• Loss Of Ac Power To One Secondary Coolant System Loop
• Total Loss of AC Power
• Partial Loss Of Enhanced Primary Coolant Flow
• Primary Gas Compressors Trip
• Standby Gas Compressor Spurious Startup
• Cover Gas Pressure Control System Malfunction (increasing Primary Coolant
flowrate)
• Cover Gas Pressure Control System Malfunction (decreasing Primary Coolant
flowrate)
• Total Loss of AC Power with Concomitant Diesel Generator Unavailability
• Inadvertent Opening of a Secondary Coolant System Safety Valve
• Small Secondary Coolant System Pipe Break
• Small Primary Gas System Pipe Break
• Large Secondary Coolant System Pipe Break
• Inadvertent Opening of Secondary Coolant System Drain Valves
• Large Primary Gas System Pipe Break
• Lead-Bismuth Leakage From The Primary Vessel
• IHX Pipe Rupture (one Pipe)
TUCS Challenge 2
• Small Primary Gas System Pipe Break (affecting the U shaped risers)
• 1/ 2 Target Unit Pump Trip
• 1/ 2 Target Pump Locked Rotor
• 1/ 2 Target Pump Shaft seizure
• Target Unit Circulation Pipe Break
• Target Unit Lead-Bismuth Inleakage from Primary Coolant
• Target Unit Coolant System Break
• Proton Beam Pipe Vacuum Control System Malfunction
• Target Vacuum Control System Malfunction
• Proton Beam Pipe Break
2 It has to be noted that the events listed below refer to accidents originate inside the TUCS. Other events
exist which can cause challenge to TUCS; they are originated in the RCS. An exemple of them are
represented by such events causing the RCS enhanced primary coolant flow system malfunction or failure
(e.g. gas compressor trip failure or malfunction, cover gas pressure control system malfunction, etc..)
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
88
Containment Challenges
It has to be noted that to each incident or accident condition the symbol "I" or "R" is
associated. The symbol "I" is assigned to the events resulting primarily in potential
challenge to the integrity or leaktightness of the reactor containment. The symbol "R" is
assigned to the events resulting primarily in a potential release of radioactivity inside the
reactor containment.
• Reactor Containment Pressure Test
• Loss of Reactor Building HVAC System I
• Leakage from Vessel Top Closure R
• Total Loss of AC Power I
• Radioactive Drain Network System Line Break R
• Waste Gas System Line Break R
• Waste Liquid System Line Break R
• Primary Cover Gas System Line Break R
• Leakage from Primary Cover Gas System Components R
• Leakage from Target Unit System R
• Accelerator Beam Transport System Failure R
• Total Loss of Secondary Coolant System I
• Reactor Coolant Filling System Failure R
• Simultaneous Reactor and Guard Vessel Rupture I&R
• Total Loss of AC Power with Concomitant Diesel Generator Unavailability I
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
89
4. CATEGORIZATION OF ACCIDENT INITIATING EVENTS
4.1 CATEGORY GROUPING CRITERIA
A criterion to group the initiating events in each of the four Design Basis Conditions
categories defined in Deliverable D6 “PDS-XADS Integrated Safety Approach- Goals-Principles.
Rules for Assessment, Safety Design and Criteria” chapter 8, is reported in the following.
− Design Basis Category 1 Conditions (Normal Operations)
♦
This category mainly contains the following events:
normal operations and planned plant tests (e.g. operation at power; refueling, reactor
containment pressure tests)
− Design Basis Category 2 Conditions (Incident Conditions)
♦
This category mainly contains the following events:
operating components failure or partial loss of support systems (e.g. Secondary
Coolant System Pump Failure; Loss Of Ac Power To One Secondary Coolant System
Loop)
− Design Basis Category 3 Conditions (Accident Conditions)
♦
This category mainly contains the following events:
Small pipe ruptures or total loss of support systems (e.g. Small Secondary Coolant
System Pipe Break)
− Design Basis Category 4 Conditions (Accident Conditions)
♦
This category mainly contains the following events:
Large ruptures of high energy systems piping, main vessel or safety vessel failure (e,g.
Large Secondary Coolant System Pipe Break).
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
90
4.2 LIST OF ACCIDENT INITIATING EVENTS CLASSIFIED IN EACH CATEGORY
All the accidents identified and scrutinized in previous section 3.7 are categorized according
to the criteria defined in section 4.1, as reported in the following.
Design Basis Category 1 Conditions (Normal Operations)
• Steady-state and shutdown operation
- Operation at power.
- Hot shutdown condition.
- Cold Shutdown condition.
- Refueling.
• Operation with permissible deviations
Various deviations that occur during continued operation as permitted by the plant
Technical Specifications are considered in conjunction with other operational modes.
These deviation include the following:
- Operation with component or system out of service.
- Leakage from fuel with limited leakage defects.
- Testing.
• Operational transient
- Plant heat up and cooldown.
- Step load changes.
- Ramp load changes.
Referring to the reactor containment, the following event pertains to the present category:
• Reactor Containment Pressure Tests.
Design Basis Category 2 Conditions (Incident Conditions)
• Inadvertent Proton Beam Trip
• Uncontrolled Proton Beam Current Increase
• Air Cooler Control System Malfunction (increasing Air Coolers heat removal)
• Air Cooler Control System Malfunction (decreasing Air Coolers heat removal)
• Air Cooler Malfunction (1 out of 3; increasing Air Coolers heat removal)
• Air Cooler Malfunction (1 out of 3; decreasing Air Coolers heat removal)
• Secondary Coolant System Pump Failure
• Loss Of AC Power To One Secondary Coolant System Loop
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
91
• Total Loss of AC Power
• Partial Loss Of Enhanced Primary Coolant Flow
• Gas Compressors Trip
• Standby Gas Compressor Spurious Startup
• Cover Gas Pressure Control System Malfunction (increasing Primary Coolant flowrate)
• Cover Gas Pressure Control System Malfunction (decreasing Primary Coolant flowrate)
• 1/ 2 Target Unit Pump Trip
• Proton Beam Pipe Vacuum Control System Malfunction
• Target Vacuum Control System MAlfunction
Referring to the reactor containment to the present category pertain the events:
• Loss of Reactor Building HVAC System (VRBS)
Design Basis Category 3 Conditions (Accident Conditions)
• Fuel Assembly Partial Flow Blockage
• Total Loss of AC Power with Concomitant Diesel Generator Unavailability
• Inadvertent Opening of a Secondary Coolant System Safety Valve
• Small Secondary Coolant System Pipe Break
• Small Primary Gas System Pipe Break
• Small Primary Gas System Pipe Break (affecting the U shaped risers)
• Small Target Circulation Pipe Break
• 1/ 2 Target Pump Shaft Seizure
• Target Unit Lead-Bismuth Inleakage from Primary Coolant
Referring to the reactor containment to the present category pertain the events:
• Leakage from Vessel Top Closure
• Radioactive Drain Network System (RDNS) line break
• Waste Gas System (WGS) line break
• Waste Liquid System (WLS) line break
• Primary Cover Gas System (PCGS) Line Break
• Leakage from PCGS components
• Leakage from Target Unit
Design Basis Category 4 Conditions (Accident Conditions)
• Proton Beam Startup With Cold Reactor
• Fuel Assembly Mechanical Lock Failure
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
92
• Large Secondary Coolant System Pipe Break
• Inadvertent Opening of Secondary Coolant System Drain Valves
• Large Primary Gas System Pipe Break
• Lead-Bismuth Leakage From The Main Vessel
• IHX Pipe Rupture (one Pipe)
• Target Unit Coolant System Break
• Proton Beam Pipe Break
• 1/ 2 Target Pump Locked Rotor
Referring to the reactor containment to the present category pertains the events:
• Accelerator Beam Transport System (ABTS) failure
• Total Loss of Secondary Coolant System (SCS)3
3
Even if this event could be classified a DEC ( it is a sequence of independent events) it is included in
DBC 4 in order to demonstrate with DBC 4 limits are not exceeded when only RVACS is credited.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
93
5. LBE COOLED XADS ACCEPTANCE CRITERIA FOR SAFETY
ANALYSES
The basic principle applied in relating design requirements to each plant condition is that the
most probable occurrences should yield the least radiological risk to the public and those
extreme situations having the potential for the greatest risk to the public shall be those least
likely to occur. This is reflected in the maximum allowable radioactivity releases for a
postulated event, attributed to a given plant condition, specified later in this section.
The release of radioactivity to the external environment following abnormal or accident
events is strictly related with the ability of the physical barriers between the radioactive
isotopes and the external environment itself to perform their intended function (i.e. to
contain the radioactive isotopes). Such physical barriers, in the XADS, are the same as in
nuclear power plants, namely:
(i)
(ii)
(iii)
the fuel rods cladding (first barrier);
the primary coolant system boundary (second barrier);
the containment boundary (third barrier).
(actually all the barriers are normally interposed between fission products and external
environment while only barriers (ii) and (iii) are between activation and spallation products,
being they directly generated in the primary or target coolant; this is a peculiarity of the
XADS).
Limitation of the radioactivity releases to the external environment is thus effectively
achieved by designing the XADS with focus on maintaining, to the extent possible, the
integrity of the physical barriers (unless, obviously, it is lost as a consequence of the
postulated initiating event). This is consistent with the defense-in-depth approach,
effectively and successfully pursued in the design of nuclear power plants, all along the
development of nuclear energy.
Following this intent a set of criteria for fuel and mechanical components are established in
Deliverable D6 to ensure that the occurrence of an abnormal or accident event does not
jeopardize the integrity of the barriers to the extent to exceed the allowable safety
consequences. They are summarized in the following Tables 5.1 and 5.2, referring
respectively to the fuel limits and the mechanical components limits; Table 5.3 reports the
plant criteria associated to the design operating conditions.
With respect to the Design Extension Conditions Deliverable D6 suggests that the
acceptance of the behaviour of equipment is to be examined on a case-by-case basis taking
into account the objective to verify.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
94
Table 5.1 - Fuel limits for design basis operating conditions
Category of
operating
conditions
Safety target Fuel limits Clad limit
Normal operating
conditions
Radiological release ALARA No melting Gas leak rate ALARA and in
any case lower than the
design value.
No open clad failure.
2 Radiological release lower
than the limit
3 Radiological release lower
than the limit
4 Maintaining of the core
coolability and limitation of
core geometrical
modifications
Complex
sequences and
design extension
conditions
Severe accident
Maintaining of the core
coolability and limitation of
core geometrical
modifications
Releases lower than the
limiting release targets
No melting
No melting
Any predicted
localised
melting to be
shown to be
acceptable.
No core melting
Coolability of
the damaged
core
No recriticality
of the damaged
core
Gas leak rate lower than the
design value.
No open clad failure except
due to random effects
No systematic (i.e. large
number of) pin failures
No systematic clad melting.
Any predicted localised clad
melting may be acceptable
provided that it can be shown
that it does not lead to
material relocation
No systematic clad melting
Consistent with the above mentioned safety approach a set of specific limits (acceptance
criteria) have been tentatively defined for each physical barrier of the LBE cooled XADS
concept with respect to all plant conditions including the DEC scenarios also. They have
been derived from physical or phenomenological considerations and data, experience from
technologies exploiting the same or similar materials and/or design solutions or, in case of
unavailability of applicable technical information, they are tentative values to be confirmed
later along the project as the pertinent information will become available. This approach is
necessarily inherent to the early design phase of a largely innovative concept.
In addition to the acceptance criteria for each physical barrier and for the radioactivity
releases to the external atmosphere 4 some general criteria are then established, strictly
4
Note that maximum allowable radiation doses to an individual at the boundary of the
exclusion area and to the population are specified rather than maximum releases of
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
95
related to the most peculiar feature of the LBE cooled XADS concept (subcriticality) and to a
very important design choice (no reactivity control nor shutdown systems), to hydrodynamic
stability, to lead-bismuth eutectic bulk boiling and to secondary coolant (synthetic organic
diathermic fluid) bulk boiling and degradation.
Table 5-2 Mechanical limits for design basis operating conditions
Category of
operating
conditions
Normal operating
conditions
Safety
classified
components
Criteria level of RCC-MR 5
Components Components
which are whose
difficult to leaktightness is
requalify required
Active components
whose functional
operability is
required
A A A A
2 A A A A
3 C A C A
4 D D C A
Table 5-3 Plant criteria for design basis operating conditions
Category of operating
Plant criteria
conditions
2 Plant shall be able to return to power in short term after faults rectification
3 Plant shall be able to return to power after inspection, rectification and
requalification
4 Plant restart is not required
In addition to the acceptance criteria for each physical barrier and for the radioactivity
releases to the external atmosphere 6 some general criteria are then established, strictly
related to the most peculiar feature of the LBE cooled XADS concept (subcriticality) and to a
very important design choice (no reactivity control nor shutdown systems), to hydrodynamic
radioactivity, because of the lack of site specific data for the LBE cooled XADS
concept.
5
6
Concerning the mechanical design, the criteria are associated to a design code
adapted to the selected concept. As a working basis, the European RCC-MR code
used for the EFR project is proposed for the ADS design.
Note that maximum allowable radiation doses to an individual at the boundary of the
exclusion area and to the population are specified rather than maximum releases of
radioactivity, because of the lack of site specific data for the LBE cooled XADS
concept.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
96
stability, to lead-bismuth eutectic bulk boiling and to secondary coolant (synthetic organic
diathermic fluid) bulk boiling and degradation.
The general acceptance criteria are presented and discussed in next section 5.1 while the
tentative acceptance criteria for the physical barriers are presented in section 5.2.
5.1 GENERAL ACCEPTANCE CRITERIA
5.1.1 Effective Multiplication Factor
Expected phenomenologies
No reactivity control systems nor shutdown systems devoted to terminate (or, at least,
strongly reduce) neutron multiplication by inserting neutron absorbing devices are provided
in the LBE cooled XADS concept. However the LBE cooled ADS experiences reactivity
changes associated with:
• coolant temperature variation when going from cold shutdown (at a temperature of 200
°C) to the hot zero power operating temperature (300 °C);
• transient xenon and samarium poisoning associated with power changes;
• excess reactivity required to compensate for the effects of fissile inventory depletion
and buildup of fission products as well as breeding of new fissile;
• power level changes over the range from nominal power to zero power (the reactivity
addition resulting from power reduction consists of contributions from Doppler, varying
average coolant temperature, and axial flux redistribution);
• postulated incident and accident scenarios.
The core nuclear design must therefore ensure that criticality conditions are not attained in
any foreseeable occurrence pertaining either to DBC or to DEC.
Effective Multiplication Factor Limits
The subcriticality (shutdown) margin shall be ≥0.01 ∆K, including allowance for
measurements errors, under all plant design basis conditions (DBC), when the target is in
place and all the fuel assemblies are in the reactor vessel; a lower subcriticality margin is
allowed for design extension conditions (DEC).
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
97
When the fuel assemblies are in the reactor vessel and the target is not in place, the core
shall be largely subcritical. The k eff shall be maintained at or below 0.95, by means of
dedicated absorber devices (refueling shutdown elements), if required to meet this limit.
Rationale
In a subcritical system with external neutron source and no control/shutdown absorbers, it is
necessary to prevent by design nuclear flux divergence both in normal operating conditions
and in abnormal and accident conditions, including Design Extension Conditions.
Concerning the LBE cooled XADS concept refueling condition, keeping in mind that the
target structure (a neutron absorbing component) needs to be extracted and with the
objective to include in the design a large flexibility for the core configuration, consistent with
the nature and the intended use of the facility, it appears advisable to include significant
margins in the design.
The effective multiplication factor k eff , independent from the external neutron source, is a
meaningful measure of the actual safety characteristic of the device, that is 1 - k eff is a
gauge of the distance from criticality. Hence prevention of reactor power divergence is
achieved if the effective multiplication factor is maintained below one.
The 0.01 ∆K limit with target in place and all fuel assemblies in the reactor vessel
corresponds and is consistent with standard practice for LWR s safe shut-down conditions
(e.g. for the AP600 and EP1000 a minimum operation shutdown margin of 1% ∆k/k is
required, assuming that the highest worth control rod is stuck out upon trip. An allowance of
0.6% ∆k/k is added for measurement error. Using the same allowance for the ADS
Demonstration Facility yields a 0.016 ∆K limit which means a k eff ≤ 0.984).
The limit with extracted target and all fuel assemblies in the reactor vessel is derived from
ANSI Standard N18.2 ("Design Objectives for LWR Spent Fuel Storage Facilities at Nuclear
Power Stations") which specifies k eff not to exceed 0.95 in spent fuel storage racks and
transfer equipment flooded with pure water and not to exceed 0.98 in normally dry new fuel
storage racks, assuming optimum moderation. No criterion is given for the refueling
operation. However, a 5% margin, which is consistent with spent fuel storage and transfer,
is adequate for the controlled and continuously monitored operations involved.
5.1.2 Hydrodynamic Stability
Expected phenomenologies
In steady state, two phase, heated flow, a potential for flow instability in parallel closed
channels exists. Although such a potential may not exist in the LBE cooled XADS concept
core, due to the high boiling temperature of the Pb-Bi eutectic, in the risers, where there is a
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
98
two-phase flow, due to the argon injection for enhancing natural circulation, a potential risk
for instability exists.
Flow instability can occur also in a circuit shaped as a U tube. This is the case of the LBE
cooled XADS primary loop.
The instability may be a flow excursion from one state to another, or it may be a selfsustained
oscillation about one state. Either type is undesirable in a nuclear reactor. First,
sustained flow oscillations may cause undesirable forced mechanical vibration of
components. Second, flow oscillation may cause system control problems by varying the
temperature coefficient. Third, flow oscillations can heavily affect the heat transfer
characteristics resulting in an oscillating fuel cladding temperature.
It is necessary that the reactor be operated well below the instability threshold so that the
amplification of the inherent noise will not lead to heat transfer degradation or to difficulty in
plant control.
Hence modes of operation associated with Condition I and II events shall not lead to
hydrodynamic instability.
Hydrodynamic Stability limits
An adequate margin to instability threshold is quantified imposing the decrement of the
impulse response (defined as the ratio of successive cycle peaks) Y 2 /Y 0 ≤ 0.25.
The plant shall be operated under Condition I and II events below the instability threshold
with adequate margin.
Rationale
In the performance standards of most process systems one out of the following relations are
used as design specifications for the stability of a second order system:
Y 2 /Y 0 ≤ 0.25 [1]
ξ ≥ 0.22 [2]
where Y 2 /Y 0 is the decrement of the impulse response (defined as the ratio of successive
cycle peaks) and ξ is the dampening factor. The above characteristic parameters in a
second order linear system are equivalent and are correlated:
Y 2 /Y 0 = exp( −2πξ
/ 1−
ξ
2
)
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
99
In the LBE cooled XADS concept, which does not operate as a second order system and is
evidently non-linear, the conditions [1] and [2] are not equivalent.
The Y 2 /Y 0 parameter is however the one more directly and clearly related to the stability of
an oscillating dynamic system; in fact it is very intuitive to impose for a dynamic system the
obvious stability limit Y 2 /Y 0 = 1 since the occurrence of condition Y 2 > Y 0 clearly indicates an
amplification with the time of the oscillations. An adequate margin to instability threshold for
the LBE cooled XADS has been quantified imposing Y 2 /Y 0 ≤ 0.25 or the equivalent logdecrement:
ln Y 2 /Y 0 ≥ -1.38
5.1.3 Primary Coolant Bulk Boiling
Expected phenomena
The lead-bismuth eutectic boiling point is higher than the structural materials melting point.
Lead-bismuth eutectic bulk boiling can result in loosing the mechanical integrity of some
structural material inside the vessel.
The core thermalhydraulic design shall ensure that during modes of operation associated
with DBC and DEC events, bulk boiling shall be avoided.
Bulk Boiling limits
An adequate margin to bulk boiling is quantified imposing the lead-bismuth eutectic
temperature, at the exit of the hot fuel assembly, is less than 1500 °C.
Rationale
Bulk boiling is not expected due to the high boiling point of the Pb-Bi eutectic (1670 °C).
The bulk boiling in a liquid under equilibrium thermodynamics is considered to occur when
the quantity, defined as (H bulk - H sat ), at the exit of the hot channel, is ≥ 0, where H bulk is the
bulk coolant enthalpy; H sat is the enthalpy of saturated liquid. With stagnant flow, it would
take several seconds for coolant to evaporate. Nevertheless, differently from LWR' s , the
local coolant evaporation would not stop the fissions in the fuel, so that power release and
incipient voiding could steadily increase.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
100
5.1.4 Secondary Coolant
5.1.4.1 Bulk Boiling
Expected phenomena
The selected secondary coolant is a synthetic, organic, diathermic fluid available on the
market, the normal operating temperature of which is kept below its boiling point.
Chemically it is a mixture of partially hydrogenated terphenils. Bulk boiling of this fluid,
besides producing vapor bubbles, brings about abnormal degradation by pyrolisis and
formation of more by-products. By-products are mostly Low-Boilers (LB) and volatiles, with
some High-Boilers (HB). Vapor bubbles are entrained by the liquid and may reach the pump
suction and cause cavitation. As for the by-products, LB and volatiles bring about pressure
increase and eventually the opening of the pressure-relief valves. HB are soluble in the fluid
and harmless until a concentration of about 25%. Above this % level they are undesirable
and the excess must be removed.
Bulk Boiling limits
Bulk boiling of the diathermic fluid must be avoided for any normal and accident conditions.
The vapor pressure vs. temperature curve of a representative diathermic fluid is shown in
Figure 5.1.4.1-1 (these limiting values are reported in the following table).
θ (°C) 250 260 280 300 320 340 360 380 400
P (kPa) 8 10.5 22 30 50 75 105 157 220
Rationale
Any degree of pump cavitation results in vibration of pump and piping and decrease of
coolant flowrate. Single-phase conditions, every where, is the means to avoid pump
cavitation.
Opening of the pressure-relief valve may lead to an unacceptable loss of the secondary
coolant inventory. The excess HB cannot be removed in accident conditions with the
consequences of possible unacceptable fouling of the heat transfer surfaces
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
101
Figure 5.1.4.1-1
Vapor pressure vs Temperature of Diphyl THT
Pressure
5.1.4.2 Degradation by Pyrolysis
Expected phenomena
The diathermic fluid undergoes degradation by pyrolysis and radiolysis, whereby radiolysis
is kept low by design. Pyrolysis on the contrary is a function of the temperature and
precisely it about doubles every 10 K temperature increase. Pyrolysis results in the
formation of by-products, which are mostly LB, volatiles and few percentages of HB. The LB
must be vented. The HB are soluble in the original components of the fluid and are not
detrimental until about 25 %, because they are as diathermic as the fluid and their presence
decreases the pyrolysis rate. Above 25 to 30% HB must be removed.
Pyrolysis limits
Design Basis Conditions
Category 1:
T fluid,max ≤ 340 °C for unlimited time
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
102
Category 2:
Category 3 and 4:
T fluid,max ≤ 340 °C for unlimited time or time-at-temperature
less than limiting values of Figure 5.1.4.1-2
T fluid,max ≤ 340 °C for unlimited time or time-at-temperature
less than limiting values of Figure 5.1.4.1-3
Design Extension Conditions
As a design objective, same limits as for Categories 3 and 4 of DBC
Rationale
The choice of T fluid,max for Category 1 follows the design practice of the chemical industry as
an acceptable compromise between amount of degradation and performance. The expected
degradation, including radiolysis, is about 3 %/yr.
The limits for Category 2 have been set in order to limit the predicted degradation, for each
event, to 0.1 %. This amount of fluid degradation is considered negligible as compared to
the degradation rate during normal operating conditions.
The limits for Category 3 and 4 have been set in order to limit the predicted degradation, for
each event, to 1 %. This amount of fluid degradation makes advisable a fluid make-up after
plant recovery, but is considered not to significantly affect the secondary circuit
performance.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
103
Figure 5.1.4.1-2
Allowable Temperature-Time intervals for Category 2 DBC Events
Figure 5.1.4.1-3
Allowable Temperature-Time intervals for Category 3 and 4 DBC Events
Temperature (°C)
Temperature (°C)
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
104
5.2 ACCEPTANCE CRITERIA FOR THE PHYSICAL BARRIERS
5.2.1 Fuel cladding limits
Expected phenomenologies
The integrity of the fuel cladding is primarily related to adequate cooling, limitation of the
power generated in the fuel rod and of the mechanical challenges.
When a liquid metal with a high boiling point is employed as coolant, no film boiling
phenomenon is expected to occur with an associated marked detriment of the fuel-tocoolant
heat transfer coefficient, as is the case following thermal crisis in LWR' s .
Nevertheless, the wide temperature domain which can be potentially spanned by the
coolant may lead to excessive clad temperatures in case fuel power generation and coolant
flow do not match. These conditions can pertain to all the operational, abnormal and
accident modes, from Condition I to IV.
By preventing the above mentioned mismatch, adequate heat transfer will be assured
between the fuel clad and the reactor coolant, thereby preventing clad damage as a result
of inadequate cooling and associated excessive temperature increase.
Moreover, an excessive increase of the power generation in the fuel rod can induce a
condition of gross fuel melting which, in turn, can result in severe duty on the cladding. The
concern here is based both on the large volume increase associated with the phase change
in the fuel and the potential for loss of cladding integrity as a result of molten fuel/cladding
interaction.
It is noted that the fuel volume increase due to melting is likely to originate relocation of
fissile material inside the fuel rod with molten material slumping inside the hollow pellet; as a
consequence the distribution of the fissile material in the core would change, with an
associated effect on the subcritical system multiplication factor.
Since subcriticality is required to be always maintained with adequate margin such
relocation must be prevented.
Based on the above, acceptance criteria need to be defined for maximum allowable
cladding temperature and maximum allowable fuel temperature.
The maximum allowable cladding temperature is established in such a way that a large
margin to loss of material integrity is provided at rated power operation (Condition I) and a
significant margin is provided for frequent abnormal events (Condition II); also for Condition
III and IV events cladding integrity criteria are tentatively established though they should not
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
105
be viewed as compulsory, taking into account the low or very low expected frequency of
occurrence of the associated initiating events.
It is moreover noted that the cladding integrity criteria are expected to be beneficially
affected (i.e. higher acceptable temperatures or times-at-temperature) if the cladding will be
subjected to protective surface treatments.
The maximum allowable fuel temperature is established in such a way that a margin to
melting exists for any Design Basis Condition (plant Conditions 1 to 4); local melting is
allowed for Design Extension Conditions.
Actions provided by nuclear control and protection systems must be shown to be adequate
or properly designed to satisfy the acceptance criteria for transients and accidents
associated with Condition II events, including overpower transients as well as Condition III,
IV and DEC.
The maximum cladding temperature criterion could, in principle, be established on a set of
values depending on operating, transient and accident conditions in connection with
selected cladding material targeted endurance (reannealing, phase transition,
recristalisation, softening, reactions with coolant components and/or its additives or
impurities, etc.).
Concerning the mechanical challenge, reference is made to cladding stress and strain,
fatigue and vibration, collapse due to external pressure, outward creep and/or ballooning
due to internal pressure, grid cell force, fuel rod growth, free standingness. They are
addressed by the fuel thermomechanical design and analysis and can be quantified if a
suitable fuel design is available, together with the pertinent results from the thermohydraulic
analyses of normal, abnormal and accident conditions. It is apparent that the acceptance
criteria tentatively defined for maximum cladding temperature and maximum fuel
temperature somehow affect the output of the thermomechanical analyses and, therefore,
there might be some feedback on fuel design.
Temperature limits for cladding and fuel
Design Basis Conditions
Category 1: T clad max ≤ 550 °C; T fuel max ≤ 2000 °C
Category 2:
T clad max ≤ 650 °C with no more than 10 minutes at
temperatures between 550 °C and 600 °C and no more
than 3 minutes at temperatures between 600 °C and 650
°C;
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
106
Category 3 and 4:
T clad max ≤ 650 °C with no more than 10 minutes at
temperatures between 550 °C and 600 °C and no more
than 3 minutes at temperatures between 600 °C and 650
°C;
or
time-at-temperature less than limiting values of Figure
5.2.1-1 (these limiting values are reported in the following
table).
θ (°C) 550 570 600 650 770
T (s) 1.0E+7 3600 600 180 10
T fuel max

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
107
5.2.2 Reactor Primary System limits
Expected phenomenologies
The capability of the Reactor Primary System to adequately perform its intended function to
contain the lead-bismuth eutectic is primarily related to the material stress/strain level and
temperature (or time-at-temperature if creep phenomena cannot be neglected).
The system normally operates at low pressure (the cover gas operating pressure is only
slightly higher than atmospheric pressure and the total inventory of lead-bismuth eutectic is
constant following the initial loading so that its static head is constant) and with a leadbismuth
eutectic temperature at core exit of 400 °C at nominal power.
Moderate cover gas pressure transients are anticipated following abnormal or accident
conditions while maximum lead-bismuth eutectic temperatures may significantly increase
(primarily in case only the Reactor Vessel Auxiliary Cooling System (RVACS) is available to
remove residual decay heat).
Acceptance criteria will therefore be related to maximum cover gas pressure, maximum
main vessel wall temperature or maximum time-at-temperature if creep phenomena cannot
be neglected.
Pressure limits
Design Basis Conditions
Category 1 and 2:
Category 3:
Category 4:
maximum cover gas pressure = 130 kPa (a)
maximum cover gas pressure = 160 kPa (a)
maximum cover gas pressure = 380 kPa (a)
Design Extension Conditions:
same limits as for Category 4 of Design Basis Conditions
Temperature limits
Design Basis Conditions
Category 1: maximum main vessel wall temperature ≤ 425 °C
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
108
Figure 5.2.2-1
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
109
Category 2: maximum main vessel wall temperature ≤ 450 °C
Category 3 and 4: maximum main vessel wall temperature ≤ 450 °C
or
time-at-temperature less than limiting values of Figure
5.2.2-1(these limiting values are reported in the following
table).
θ °C 450 475 500 525 550 575 600 625 650
T (hours) 1.6E+6 1.5E+5 17000 2000 270 50 10.5 3.5 1.3
Design Extension Conditions: as a design objective, same limits as for Category 3 and 4
of Design Basis Conditions
5.2.3 Reactor Containment.
Expected phenomenologies
Challenges to containment structural integrity and leaktightness from "internal" events (i.e.
events originating inside the plant) are normally related to pressurization and temperature
increase of the internal atmosphere originating primarily from release of hot fluids following
pipe failures or, to a minor extent, from loss or malfunction of temperature control systems.
In the LBE cooled XADS concept, the adopted design solutions (no use of low boiling
temperature fluids and adoption of a guard pipe all around the secondary coolant system
piping inside containment) practically prevent significant mass and energy releases from
postulated piping failures inside containment and the associated potentially significant
pressure and temperature transients.
The latter may hence be associated either to minor mass and energy releases or to loss or
malfunction of containment atmosphere temperature control and are expected to be rather
mild.
Even in the field of Design Extension Conditions no sequence of events with the potential to
significantly pressurize the containment is currently foreseen.
On the other hand, releases of highly contaminated fluids (e.g. the cover gas) are foreseen;
the contaminants will tend to move outside containment according to its leaktightness (and
to the driving pressure differential which, though small (see above) may however exist).
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
110
Pressure limit
Design Basis Conditions
Category 1:
Category 2, 3 and 4:
Design Extension Conditions:
pressure within the range (-6 kPa ≤ p ≤ -1 kPa)
maximum pressure ≤ 150 kPa (design pressure)
maximum pressure may exceed design pressure but must
remain below the value which would originate additional
leakage paths.
Temperature limit
Design Basis Conditions
Category 1: internal temperature (except in the Reactor Cavity) 10÷50 °C
internal temperature Reactor Cavity 10÷65 °C
Category 2, 3 and 4:
Design Extension Conditions
later
later
5.2.4 Radioactive releases to external environment
The radiological limits for the public protection from radiation are set-up and discussed in
the following for each of the LBE cooled XADS concept design conditions defined in section
3.7.
As a preliminary approach the radiological limits are established in terms of doses. The
process required to determine the radiological limits in terms of radioactivity discharges, that
allows to decouple the plant design from variations between sites with respect to distances
of the population nearest to the facility and to the dose take-up pathways (site
characteristics, population habits, etc), will be performed later. The reason for this is that
very peculiar contaminants such as the spallation products originating from the interaction of
the high intensity proton beam and the Lead-Bismuth Eutectic target, the Polonium
originating mainly from Bismuth activation under neutron flux, the radioactive isotopes of the
lead itself can be potentially involved in the radiological consequences calculation. Hence a
specific detailed investigation on the chemical and physical behavior of these peculiar
radioisotopes and on their radiological relevance to the evolution of abnormal or accident
events needs to be performed.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
111
Meanwhile an evaluation of the radiological consequences in terms of population dose,
calculated with very conservative hypotheses (in particular in terms of site parameters, such
as the atmospheric dispersion factor) and complying with the limits below defined is
considered an adequate approach with respect to the early design phase of a largely
innovative concept.
Radiological limits for Design Basis Conditions Category 1 and 2
For DBC Category 1 and 2, the Effective Dose Equivalent shall not exceed 0.1 mSv (10
mRem) per year. To verify the compliance with the limit, doses from DBC Category 2 events
shall be multiplied by their annual frequency and added to DBC Category 1 annual doses.
The above limit is for individuals within population reference groups, taking into account all
sources of radiation originating from the plant (liquid and gaseous effluents as well as direct
radiation).
Radiological limits for Design Basis Conditions Category 3
For Category 3, the Effective Dose Equivalent shall not exceed 1 mSv (100 mRem) per
event at the site boundary for the entire accident duration, without credit to any public
protection measure (such as, for instance, sheltering, relocation, evacuation, etc).
Radiological limits for Design Basis Conditions Category 4
For Category 4, the Effective Dose Equivalent shall not exceed 5 mSv (500 mRem) per
event at the site boundary, without credit to any public protection measure (such as, for
instance, sheltering, relocation, evacuation, etc).
Radiological limits for Design Extension Conditions (DEC)
For Design Extension Conditions (DEC) the Effective Dose Equivalent shall not exceed 10
mSv (1 Rem) at the site boundary, without credit to any protective measure (such as, for
instance, sheltering, relocation, evacuation, etc).
5.2.5 Summary of acceptance criteria for the physical barriers and the radioactive
releases
All the above reported limits on the three physical barriers (fuel cladding, reactor primary
system reactor containment) as well as on radioactivity releases, are summarized in Table
5.2.5-1. The Table also reports the general criteria.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
112
Acceptance Criteria are the limits established for specific parameters based on known or
generally proved physical or design limits.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
113
Table 5.2.5-1
Acceptance Criteria Summary
Frequency classification General limits Fuel cladding limits Reactor Primary System
Limits
Reactor Containment
Limits
Radiological limits to
external environment
Design Basis Conditions (DBC)
DEC
Normal (Condition I) K eff ≤ 0.984
Y 2 /Y 0 ≤ 0.25
T LBE max ≤ 1500 °C
T oil < T sat (Fig. 5.1.4.1-1)
T oil max ≤ 340 °C
Moderate Frequency
(Condition II)
Infrequent
(Condition III)
Limiting
(Condition IV)
Design Extension
Conditions
K eff ≤ 0.984
Y 2 /Y 0 ≤ 0.25
T LBE max ≤ 1500 °C
T oil < T sat (Fig. 5.1.4.1-1)
T oil max ≤ 340 °C or Fig. 5.1.4.1-
2
K eff ≤ 0.984
T LBE max ≤ 1500 °C
T oil < T sat (Fig. 5.1.4.1-1)
T oil max ≤ 340 °C or Fig 5.1.4.1-3
K eff ≤ 0.984
T LBE max ≤ 1500 °C
T oil < T sat (Fig. 5.1.4.1-3)
T oil max ≤ 340 °C or Fig 5.1.4.1-1
0.984 < K eff ≤TBD < 1
T LBE max ≤ 1500 °C
T oil max ≤ 340 °C or Fig 4.1.4-3
T fuel max ≤ 2000 °C
T clad max ≤ 550 °C
T fuel max

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
114
6. REPRESENTATIVE EVENTS
The most representative events are those having the potential to challenge the physical barriers
provided to contain the radioactive products (namely the fuel rods cladding and the main vessel,
the target shell and the containment).
6.1 LIMITING EVENTS SELECTION CRITERIA
The general criteria employed to identify, for each Design Basis Category, the representative
initiating events from the point of view of:
- Reactor Primary and Secondary System response analysis,
- Target System response analysis,
- Containment response analysis,
are reported in the following.
Referring to the Reactor Coolant System and the Target Unit Coolant Systems, an initiating
event is considered a "representative event" if:
• its evolution is more likely to approach the acceptance criteria defined for the physical
barriers (namely the fuel cladding, the main vessel or the target unit shell ) or for other
safety related parameters with respect to others having the same probability to occur;
• it is expected to occur with higher probability with respect to others having similar
consequences on the physical barriers or on other safety related parameters;
• it is the only initiating event, of a specific category, that can endanger the integrity of the
physical barrier or determine the violation of any other safety related parameter.
The XADS primary and secondary and target system response to events labeled as "potentially
limiting events" will then be analyzed to quantify their consequences.
Note that there may be initiating events that, though not challenging the integrity of the fuel
cladding, of the main vessel of the target unit, nor of any other safety related parameter, can
determine radioactivity releases into the XADS containment and hence challenge the limits
imposed to the radiological consequences on the nearby population.
They do not need any detailed analysis of primary and secondary system response but only the
analysis of the radiological consequences.
Referring to the Reactor Containment System response an initiating event is considered a
"representative event":
• when it causes a larger radioactivity release and/or higher reactor containment atmosphere
pressure with respect to others having the same probability to occur;
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
115
• when it can occur with higher probability with respect to others having the same radioactivity
release and/or reactor containment atmosphere pressure increase consequences.
• when it is the only accident, of a specific category, that results in a potential release of
radioactivity (“R”).
• when it is the only accident, of a specific category, that results in a potential challenge of the
integrity or leaktighness (“I”) of the reactor containment.
6.2 REVIEW AND DISCUSSION OF INITIATING EVENTS
The initiating events identified in 3.7 will be reviewed and discussed in the following grouping
them according to their main effect on the XADS fuel cladding, main vessel, target unit and
containment.
Considering the RCS, the phenomenologies which can occur as a consequence of an initiating
event can be grouped as in the following:
(i) generated power anomalies
(ii) decrease of fuel assembly heat removal
(iii) increase in heat removal from reactor coolant system
(iv) decrease in heat removal from reactor coolant system
(v) decrease in primary coolant flowrate
(vi) increase in primary coolant flowrate
(vii) decrease of primary lead-bismuth inventory
(viii) increase of reactor coolant system pressure
Group (i) and (ii) events are characterized as challenging primarily the fuel cladding; group (iii)
to (viii) as challenging also the main vessel and, possibly, the secondary coolant maximum
allowable temperature.
The inadvertent proton beam trip event does not belong to any of the above groups and it is not
anticipate to originate challenge to the fuel cladding nor to the main vessel, however, since it is
a condition II event, it has to be analyzed to understand the plant behavior under this event.
Considering the TUCS, the phenomenologies which can occur as a consequence of an initiating
event can be grouped as in the following:
(ix) decrease in heat removal from target unit
(x) decrease in target unit coolant flowrate
(xi) increase in target unit Pb-Bi inventory
(xii) increase of target unit pressure
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
116
All the identified groups are characterized as challenging primarily the TUCS structures.
Considering the Reactor Containment the phenomenologies which can occur as a consequence
of an initiating event can be grouped as in the following:
(xiii) leakages from high energy systems inside reactor containment
(xiv) reactor containment pressure tests
(xv) inadequate reactor containment heat removal
(xvi) low energy radioactive fluid systems failure inside reactor containment.
Group (xiii) to (xv) refer to events that lead to pressure and/or temperature increase in the
containment, whilst group (xvi) refers to accident that releases radioactivity in the reactor
containment with no significant mass and energy release.
RCS challenges
6.2.1 Generated power anomalies
In the XADS, power anomalies are mainly associated to anomalies in the proton beam current.
The range of variation of the latter depends from the design requirements imposed to the proton
accelerator complex (e.g. minimum and maximum proton current) as well as from the selected
XADS control strategy (e.g. constant power, limitations in maximum proton current variation
along the fuel irradiation cycle). The anticipated consequences of a proton beam current
increase are more and more serious according to the extent of the increase and may impact
primarily fuel cladding integrity.
Since the control strategy has not yet been finalized it is suggested to use, in the analysis of the
event, a proton beam current increased with a step of 10% (no proton beam trip can occur) and
with a step of 100% (proton beam trip can occur).
Concerning the anticipated consequences of an inadvertent start-up of the accelerator system
when the XADS primary system is not ready to accept and remove the fission power, they also
will be more and more serious with increasing proton beam current.
At the current stage of the XADS design it is recommended to explore the primary and
secondary system response and relevant phenomenologies to an instantaneous proton beam
start-up from no proton current to the nominal proton current at beginning of cycle (3 mA).
6.2.2 Decrease of fuel assembly heat removal
A partial obstruction at the inlet of a fuel assembly causes a coolant flow reduction and,
consequently, an increase of the fuel cladding temperature as well as of the coolant exit
temperature from the affected fuel assembly.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
117
They are more and more significant as the extent of the postulated obstruction increases; the
event should be analyzed with a parametric approach in order to assess the maximum amount
of obstruction that can be tolerated without violating the established fuel cladding temperature
limit.
A postulated mechanical failure of the lock at the fuel assembly foot determines an upward
relocation of the fuel assembly with consequent perturbation (decrease) of the cooling flowrate
as well as of the generated power (also expected to decrease).
The consequence of such an event are mainly determined by the "new" values of lead-bismuth
flowrate and generate power; the evolution of both parameters should be investigated to
determine the most likely consequences.
6.2.3 Increase in heat removal from reactor coolant system
An increase in heat removal from the reactor coolant system can result from an increased heat
removal capacity of the secondary coolant system. The heat removal capacity of the latter can
be primarily increased by a malfunction of the Air Coolers control system; malfunctions of other
systems, such as the secondary feed and bleed system and any other auxiliary system are
likely to weakly affect its heat removal capacity.
Since the XADS primary and secondary coolant temperatures control strategy is centered on
the Air Coolers system, which is designed with a large degree of flexibility and provided with
several regulating devices (including variable speed fans, orientable fan vanes, inlet and outlet
louvers in each fan) there are in fact a large variety of malfunctions that can be postulated. It
has to point out that due to the complete separation between the two secondary coolant system
loops, they can affect only one loop at time. However a malfunction in the Air Cooler control
system affects the 3 air coolers of one SCS loop while any other malfunction affects only one Air
Cooler of one SCS loop.
It is also noted that an increased heat removal from the primary system tends to decrease
primary temperatures, possibly causing, if a significant unbalance between generated and
removed power establishes and in maintained for a long enough time, lead-bismuth freezing.
This is not considered a safety related issue. In spite of this the event will be analyzed in order
to generate quantitative information on the time span available before lead-bismuth freezing.
Note that such time span is expected to be shorter and shorter for decreasing operating power
levels (and further shorter for lower external air temperatures).
Parametric analyzed for various power levels are therefore recommended, with the lowest
external air temperature, such as:
a) plant at hot standby
b) plant at the maximum power that can be removed by the 6 air coolers in natural air
circulation
c) 50% nominal power
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
118
d) 100% nominal power.
6.2.4 Decrease in heat removal from reactor coolant system
A decrease in heat removal from the reactor coolant system results from a decreased heat
removal capacity of the secondary coolant system; the latter can be originated either by an
increase of the secondary fluid temperature due to the malfunction of the air coolers 7 , by the
decrease of the secondary coolant flowrate as a consequence of a postulated loss of electric
power to one SCS loop or circulation pump trip or failure, by the decrease of the secondary
coolant inventory due to leakages pipe breaks or inadvertent draining (opening of one SCS
safety valve or the SCS drain valves).
Malfunctions of the air coolers are attributed to category II. Malfunctions leading to the loss of ac
power to one SCS loop (loss of the circulation pump and the three air coolers fans) or trip of one
SCS circulation pump are attributed to category II. Secondary coolant leakages, small pipe
breaks and inadvertent opening of a SCS safety valve are attributed to category III. Finally
inadvertent opening of one SCS loop drain valves as well as large SCS pipe breaks are
attributed to category IV.
Based on this, air coolers control system malfunction, loss of AC power to one SCS loop and
one SCS pump failure are category II events. Since it is not obvious which one may be worse it
is necessary to analyze all of them. Moreover since the malfunction of one air cooler may or
may not cases the proton beam trip it has to be analyzed.
Among category III events inadvertent opening of one SCS safety valve will be analyzed with a
parametric approach (i.e. simulating several secondary coolant inventory loss). These is
expected also to envelope the small LOCA events.
Among category IV events parametric analyses will be performed simulating medium-large pipe
breaks of different sizes at different locations. These are expected to envelope the inadvertent
draining of one secondary loop.
6.2.5 Decrease in primary coolant flowrate
A decrease in primary coolant flowrate in the XADS can primarily results from a degradation,
including the complete loss, of the argon gas injection flowrate provided to enhance the leadbismuth
circulation. The injected argon flowrate is supplied by an electrically driven compressor
unit. Since both electrical power supply and mechanical problems can affect its performance, it
is derived that the total loss of argon gas injection is a category II event.
Moreover the total loss of electric power not only causes the complete loss of argon gas
injection but it causes the simultaneously proton beam trip and SCS pumps and fans trip. The
total loss of AC power is a category II event while the total loss of AC power with concomitant
diesel generator unavailability is category III event and the total station blackout is category IV
event.
7
malfunctions of other systems such as the secondary feed and bleed system and any other auxiliary system
are likely to weakly affect its heat removal capacity
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
119
A partial loss of argon gas supply (for example as a consequence of malfunctions in the argon
gas circulation control system) is also a category II event while it may be a category III event if it
is originated by the mechanical failure of a small pipe in the circulation system.
Based on the above it is suggested to analyze the total loss of AC power 8 , the loss of argon gas
injection to a single riser and the loss of argon gas injection to all risers events. The latter event
should be analyzed in a parametric way assuming, at least:
• total (100%) loss of gas injection
• partial (50%) loss of gas injection
6.2.6 Increase in primary coolant flowrate
An increase in primary coolant flowrate in the XADS can primarily results from a malfunction in
the cover gas pressure control system or from a spurious startup of the standby gas
compressor. Both event are category II event
Any foreseeable event determining an increase in primary coolant flowrate (a matter of fact in
the XADS it is indeed hard to identify significant events in this category) is not anticipated to
originate challenges to the fuel cladding nor to the main vessel. Hence there is no need to
perform any specific plant response analyses.
6.2.7 Decrease of primary lead-bismuth inventory
Due to the XADS design features (pool configuration with main and safety vessel, no leadbismuth
circulation outside the main vessel) a decrease of the lead-bismuth inventory in the
main vessel can be originated only by leakages from the reactor vessel or by a mechanical
failure of the reactor vessel itself. Lead-Bismuth leakage from the reactor vessel is a category III
event while Reactor vessel break is a category IV event.
The event needs to be analyzed to understand, assess and quantify the lead-bismuth circulation
patterns and the associated fuel cooling effectiveness.
6.2.8 Increase of reactor coolant system pressure
The potentially most significant event originating an increase of the reactor coolant system
pressure is the postulated rupture of one or more pipes in an Intermediate Heat Exchanger
(IHX). The cover gas pressure control system malfunctions can also affect reactor coolant
system pressure but are anticipated to be of small significance. Cover gas pressure control
system malfunction is a condition II event while IHX tube rupture is condition IV event.
It is noted that an IHX pipe rupture can determine a reactor coolant pressure increase only if the
secondary coolant is discharged into the primary lead-bismuth coolant. This happens only if the
secondary coolant pressure in the IHX region is higher than the corresponding lead-bismuth
pressure.
8 The total loss of AC power with concomitant diesel generator unavailability and the total station blackout events
have the same consequences expected for the total loss of AC power.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
120
Hence, as a first step, the pressure distribution in the IHX region needs to be assessed, for all
plant normal operating conditions, in order to determine if, and under which plant conditions, the
postulated event needs to be analyzed.
TARGET UNIT challenges
6.2.9 Decrease in heat removal from target unit
A decrease in heat removal from the target unit coolant system results from a decreased heat
removal capacity of the LBE primary coolant; the latter can be originated by a decrease in the
primary LBE coolant flowrate due to a degradation, including the complete loss, of the argon
gas injection flowrate provided to enhance the lead-bismuth circulation. These events are
already considered in the section 3.5.1.5, while in section 5.2.5 the representative events have
been selected.
The MLD reported in section 3.5.2.1 shows the event "minor gas delivery pipe failure" which
refers to failure of the pipe injecting argon in one of the two RCS U shaped risers that are
responsible for the primary coolant flow in the target unit. It is suggested to investigate the
effects of this event (category III) assuming then the total (100%) loss of gas injected to it.
6.2.10 Decrease in target unit coolant flowrate
A decrease in the target LBE coolant flowrate can primarily results from a degradation of the
performance of the target LBE circulating system. The LBE flowrate is provided by two pumps
in series driven by motors supplied by separate electric power systems. The partial loss of LBE
flowrate can occur due to mechanical failure of one pump or electrical problems. The pump
failure can derive from the pump shaft seizure is a category III event, the pump locked rotor is a
category IV event, while the pump spurious trip is a category II event; due to this the latter is
choosen as representative event.
Due to the characteristics of the LBE circulation system the total loss of LBE flowrate can occur
only in case of the total loss of electric power which in any case causes also the simultaneous
loss of argon injection in the RCS risers, the proton beam trip and SCS pumps and fans trip.
The total loss of AC power is a category II event while the total loss of AC power with
concomitant diesel generator unavailability is category III event. These event have been already
considered and selected as representative while investigating the RCS challenges.
6.2.11 Increase in target unit Pb-Bi inventory
Since the Target Unit is fully immersed in the primary coolant and its free Pb-Bi levels are
located under the primary vessel coolant level, any cracks, mechanical failures or breaks in the
Target Unit walls in contact with the primary coolant, fill it. Both events “inleakage from primary
coolant” and “target unit coolant system break” cause a flow (presumably small in the first case,
depending on the break location in the second) from RCS to the target system which bring the
target level and hence the spallation region up to the primary vessel lead-bismuth level.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
121
In this condition it is expected that the subcritical core power shut down, while the target power
is generated far from the target heat removal system.
The inleakage from primary system is a category III event, while the target coolant system break
is a category IV event. It is suggested to investigate the effects of both of them and to perform
also parametric analyses varying the break location along the axial direction.
6.2.12 Increase in target unit pressure
The event “Target vacuum control system malfunction (increasing pressure)”, category II event,
causes a motion upward of the lead-bismuth free level where the protons impinge.
The event “proton beam vacuum control system malfunction (increasing pressure)”, category II
event, causes a motion downward of the lead-bismuth free level where the protons impinge.
The consequence of their occurrence is then the change of the spallation region which can
cause variation in the power generated in the core. Also the different level position can impact
on the effectiveness of the target heat removal system. Since it is not obvious which one may
be worse it is necessary to analyze all of them.
The same phenomenology is expected even in the worst case of “proton beam pipe break”
occurrence. This is identified as a category IV event and should be analyzed.
6.2.13 Increase in target unit temperature
In case of break in the pipes ( diameter = 180 mm ) of the LBE circulation system a secondary
LBE circulation flow path sets which, depending on the break location, bypasses the hot window
zone or the HX. In general this causes an increase of the LBE temperature which is more
significant as the size of the break increases. A small break is a category III event. It is
suggested to analize the consequence of this event in a parametric way varying the size of the
postulated break.
REACTOR CONTAINMENT challenges
6.2.14 Leakages from high energy systems inside reactor containment
The failure of the Accelerator Beam Transport System (ABTS) that drives the proton beam
inside the reactor vessel, magnetic divertor is the event which can cause the higher releases to
the containment atmosphere. The ABTS is a category IV event.
6.2.15 Reactor containment pressure tests
The Reactor Containment Pressure Tests planned during the plant normal operation is an event
that imply containment pressurization; no radioactive releases are anticipated in normal
operation. This event is classified as a category I.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
122
6.2.16 Inadequate reactor containment heat removal
The Loss of Reactor Building HVAC System (VRBS), causing the containment atmosphere
temperature increase with the plant in normal operation, is more severe than the loss of offsite
power that causes also the proton beam shutoff. This VBRS is categorized as a condition II
event.
The total loss of the secondary coolant system can determine an increase of the reactor
containment atmosphere temperature. This accident, which can derive from the unavailability of
both SCS loops (multiple failures/malfunctions), is classified as a condition IV event.
6.2.17 Low energy radioactive fluid system failure inside reactor containment
Several events included in this phenomenological category result in radioactive releases,
namely:
• Leakage from Vessel Top Closure
• Leakage from PCGS components
• Waste Gas System (WGS) line break
• Leakage from TU components
• Waste Liquid System (WLS) line break
Due to lack of suitable information on Waste Gas System (WGS) and Waste Liquid System
(WLS) as well as on the Primary Cover Gas System (PCGS) and hence on the amount of stored
radioactivity it is assumed that the Primary Cover Gas System (PCGS) line break is the
representative event. It is a category III event.
6.3 SUMMARY OF REPRESENTATIVE EVENTS
The initiating events emerging as representative from the review and discussion presented in
previous section 5.2.1 to 5.2.16 are summarized in the following and also reported in Table 1.
An indication or recommendation is also provided on how the plant response analyses should
be addressed.
Fuel, RCS and TUCS Challenges
Generated power anomalies
• Uncontrolled proton beam current increase (category II):
analyses suggested (10% and 100% overpower).
• Proton beam start-up with cold reactor (category IV):
proton beam current from zero to nominal beginning of cycle current.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
123
Decrease of fuel assembly heat removal
• Fuel assembly partial flow blockage (category III):
parametric analyses suggested (10%, 25%, 50% obstruction).
• Fuel assembly mechanical lock failure (category IV)
Increase in heat removal from reactor coolant system
• Air coolers control system malfunctions which increase Air Cooler heat removal
(category II): parametric analyses suggested from different power levels (hot standby,
maximum power that can be removed under natural air circulation in the air coolers,
50%, 100%)
note: this category of events does not challenge fuel cladding or main vessel integrity since it tends to
cool the primary system, possibly leading to lead-bismuth freezing. Freezing is not regarded as a safety
issue but only as an operational concern; the analyses are therefore performed to determine the time
required to achieve freezing and hence get information on the time available to the operator to perform
corrective actions.
Decrease in heat removal from reactor coolant system
• Air cooler malfunction which decrease Air Cooler heat removal.
• Air coolers control system malfunctions which decrease Air Cooler heat removal
(category II).
• Loss of electrical power to one secondary coolant system loop (category II).
• Secondary coolant system pump failure (category II).
• Small secondary coolant system pipe break (category III).
• Large secondary coolant system pipe break (category IV).
Decrease in primary coolant flowrate
• Gas compressors trip (category II).
parametric analyses suggested (100% and 50% of injected flowrate).
• Small primary gas pipe break with loss of gas injection to a single riser (category III).
• Total loss of AC power (category II).
Increase in primary coolant flowrate
No analyses required.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
124
Decrease of primary lead-bismuth inventory
• Leakages from the reactor vessel (category III).
• Reactor vessel break (category IV).
Increase of reactor coolant system pressure
• IHX tube rupture (category IV).
only if an adverse secondary coolant / primary coolant pressure distribution in the
heat exchanger region exists.
In addition to the above events the inadvertent proton beam trip has to be included.
Decrease in heat remova from target unit
• Small Primary Gas System Break (affecting the U shaped risers - category III)
Decrease in target unit coolant flowrate
• 1 / 2 Pump Trip (category II).
Increase in target unit Pb-Bi inventory
• Inleakage from primary coolant (category III)
• Target unit coolant system break (category IV)
Increase in target unit pressure
• TU vacuum control system malfunction (category II)
• Proton beam vacuum control system malfunction (category II)
• Proton beam pipe break (category IV)
Increase in target unit temperature
• Small break in the LBE circulation system (category III)
Containment Challenges
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
125
Leakages from high energy systems
• ABTS failure (category IV)
Reactor containment pressure tests
• Pressure Tests (category I)
Inadequate Reactor Containment Heat Removal
• Loss of Reactor Building HVAC System (category II)
• Total Loss of SCS System (category IV)
Low energy radioactive fluid systems failure inside reactor containment
• PCGS line break (category III)
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
Identificativo
Document no.
XADS 20 TRIX 009
AnsaldoEnergia
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
126
TABLE 6.3-1 Summary of representative events
Primary system
Event category Event description Event classification Recommended approach to safety analyses
Generated power anomalies • Uncontrolled proton beam current
increase
Decrease of heat removal from a single fuel
assembly
Increase in heat removal from reactor
coolant system
• Proton beam start-up with cold reactor
• Fuel assembly partial flow blockage
• Fuel assembly mechanical lock failure
• Air coolers control system
malfunctions which increase Air
Cooler heat removal
category II
category IV
category III
category IV
category II
10% and 100% overpower
Proton beam current from zero to nominal
beginning of cycle current
Parametric analyses (10%, 25%, 50% obstruction)
Parametric analyses from different power levels:
• hot standby
• maximum power removed under natural air
circulation in the air coolers
• 50%
• 100%
note: these events do not challenge fuel cladding
nor main vessel integrity but may cause
lead-bismuth freezing; this is an operational
concern rather than a safety issue.
Analyses performed to determine time
available to operator to perform corrective
actions.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
Identificativo
Document no.
XADS 20 TRIX 009
AnsaldoEnergia
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
127
TABLE 6.3-1 Summary of representative events (continued)
Primary system
Event category Event description Event classification Recommended approach to safety analyses
Decrease in heat removal from reactor
coolant system
• Air cooler malfunction
• Air coolers control system malfunctions
• Loss of electrical power to one
secondary coolant system loop.
• Secondary coolant system pump failure
• Inadvertent opening of one secondary
coolant system safety valve
• Large secondary coolant system pipe
break
Decrease in primary coolant flowrate • Gas compressors trip
Increase in primary coolant flowrate
• Small primary gas system pipe break
• Total loss of AC power
category II
category II
category II
category II
category III
category IV
category II
category III
category II
Parametric analyses (100% and 50% of injected
flowrate
Loss of gas injection to a single riser
No analyses required
Decrease of primary lead-bismuth inventory • Leakage from the reactor vessel
category III
• Reactor vessel break
category IV
Increase of reactor coolant system pressure • IHX tube rupture category IV Analyze only if secondary coolant pressure higher
than lead-bismuth pressure in the IHX region
• Inadvertent proton beam trip category II
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
Identificativo
Document no.
XADS 20 TRIX 009
AnsaldoEnergia
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
128
TABLE 6.3-1 Summary of representative events (continued)
Target system
Event category Event description Event classification Recommended approach to safety analyses
Decrease in heat removal from target unit • Small gas conception system break
(affecting the U shaped risers)
Decrease in target unit coolant flowrate • 1 out of 2 target pump trip
category III
category II
• Small target circulation system pipe
break
Increase in target unit Pb-Bi inventory • Inleakage from primary coolant
• Target unit coolant system break
(excluding beam pipe)
Increase in target unit pressure • TU vacuum control system malfunction
• Proton beam pipe vacuum control
system malfunction
• Proton beam pipe break
category III
category III
category IV
category II
category II
category IV
Parametric analysis varying the size of the break
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
Identificativo
Document no.
XADS 20 TRIX 009
AnsaldoEnergia
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
129
TABLE 6.3-1 Summary of representative events (continued)
Containment system
Event category Event description Event classification Recommended approach to safety analyses
Leakages from high energy systems • ABTS failure category IV
Reactor containment pressure tests
Inadequate Reactor Containment Heat
Removal
• Loss of Reactor Building HVAC System
• Total Loss of SCS System
category I
(category II)
(category IV)
•
Low energy radioactive fluid systems failure
inside reactor containment
• PCGS line break category III
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
130
7. SUMMARY AND CONCLUSIONS
The LBE cooled XADS is designed to contain and limit radioactivity releases to the
external atmosphere in order to guarantee that no undue risk will occur for the population
surrounding the plant (the design of the LBE cooled XADS shall ensure that an evacuation
plan is not necessary).
The content of this document has been devised with the main intention to assist and
organize the safety analyses of the LBE cooled XADS, that is the set of analyses intended
to assess the plant response to abnormal and accident conditions. As such it primarily
covers the identification of normal, abnormal and accident events.
Moreover, given the very innovative features of the LBE cooled XADS (which basically
consists of a proton accelerator and a subcritical fission core coupled by means of a
spallation target where the interaction of the high energy protons with a heavy material
generates a "cascade" of neutrons which then enter the subcritical core region where they
are further multiplied), plant features relevant for safety analyses are briefly described.
The degree of detail of the contents of the document is necessarily LBE cooled
commensurate to the amount of information available at the current stage of the XADS
design which, sometimes, implies that limited technical information is available for some
XADS systems. This is however inherent to the early design phase of a largely innovative
concept.
Concerning the identification of normal, abnormal and accident events, two approaches
can be taken. One is a comprehensive engineering evaluation, taking into consideration
from previous risk assessments, documentation reflecting operating histories and plantspecific
design data. The information is evaluated and a list of initiating events is then
compiled, based on the engineering judgment derived from the evaluation. Another
approach is to more formally organize the search for initiating events by constructing a toplevel
logic model (called Master Logic Diagram, MLD), systematically describing all the
abnormal and accident conditions resulting in potential challenges to the physical barriers
and then deducing the appropriate set of initiating events. Because of the peculiar
characteristics of the LBE cooled XADS (and the resulting lack of plant specific data as
well as, even more so, of operating data) the second approach has been adopted to define
the initiating events set.
The objective to perform safety analyses imposes the definition of the rules of the analysis.
In particular acceptance criteria are to be established which shall ensure that the
occurrence of an abnormal or accident event does not jeopardize the integrity of the
barriers interposed between the radioactivity stored in the fuel as well as in the primary
and target coolant and the external environment to the extent to exceed the allowable
safety consequences. They represents the limits established for specific parameters
related to the physical barriers which are based on known or generally proved physical or
design limits.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
131
The acceptance criteria that have been tentatively established for the innovative LBE
cooled XADS have been derived from physical or phenomenological considerations and
data, experience from technologies exploiting the same or similar materials and/or design
solutions or even tentative values to be confirmed later along the project as the pertinent
information will become available. This is inherent to the early design phase of a largely
innovative concept.
In addition to the acceptance criteria for each physical barrier and for the radioactivity
releases to the external atmosphere some general criteria are also established, strictly
related to the most peculiar feature of the LBE cooled XADS (subcriticality) and to a very
important design choice (no reactivity control nor shutdown systems), to hydrodynamic
stability, to lead-bismuth eutectic bulk boiling and to secondary coolant (synthetic organic
diathermic fluid) bulk boiling and degradation.
It is noted that the planned plant safety analyses will not cover all the identified events but
will necessarily focus on the ones representative of each category. The latter are defined
as the ones that have the highest potential to challenge the physical barriers between the
radioactive fission products (or spallation products) and the external environment, that is
the fuel rods cladding, the main vessel and the containment.
The assessement of the LBE cooled XADS thermohydraulic response should concentrate
on the most representative events which have been identified and are listed in Table 6.3-1;
in this table, whenever necessary or useful, a suggestion or recommendation is also
provided on how the safety analyses should be approached.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
132
8. REFERENCES
[1] Ansaldo ADS 1 SIFX 0500, Rev. 0, Experimental Accelerator Driven System:
Reference Configuration
[2] DOC03-261, Rev. 0, Malfunctions of the LINAC Accelerator of the XADS (CEA
NT-DER/SERI/LCSI/03-4025)
[3] Tractebel R&D-NUC/4NT/0000024, Rev. 0, PDS-XADS: List of Incidental and
Accidental Situation for the MYRRHA Design
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
133
APPENDIX A – LIST OF INCIDENTAL AND ACCIDENTAL SITUATIONS
FOR THE MYRRHA DESIGN
This Appendix contains the whole Tractebel document R&D-NUC/4NT/0000024 Rev. 0
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
134
Table of contents
A1. INTRODUCTION
A2. IDENTIFICATION OF ACCIDENT INITIATING EVENTS
A2.1. ASTER LOGIC DIAGRAM
A2.2. FUEL CLADDING CHALLENGES
A2.2.1. POWER ANOMALIES
A2.2.2. FUEL ASSEMBLY HEAT REMOVAL ANOMALIES
A2.3. REACTOR COOLANT SYSTEM AND TARGET UNIT COOLANT SYSTEM
CHALLENGES
A2.3.1. REACTOR COOLANT SYSTEM CHALLENGES
A2.3.2. TARGET UNIT COOLANT SYSTEM CHALLENGES
A2.4. CONTAINMENT CHALLENGES
A2.4.1. LEAKAGES FROM HIGH ENERGY SYSTEMS INSIDE THE
CONTAINMENT
A2.4.2. INADEQUATE REACTOR CONTAINMENT HEAT REMOVAL
A2.4.3. LOW ENERGY RADIOACTIVE FLUID SYSTEMS FAILURE INSIDE
REACTOR CONTAINMENT
A3. LIST OF ACCIDENT INITIATING EVENTS
A4. CATEGORIZATION OF INITIATING EVENTS
A4.1. CATEGORIES
A4.2. CATEGORIZATION
A4.2.1. DESIGN BASIS CATEGORY 1 CONDITIONS (NORMAL OPERATION)
A4.2.2. DESIGN BASIS CATEGORY 2 CONDITIONS (INCIDENT CONDITIONS)
A4.2.3. DESIGN BASIS CATEGORY 3 CONDITIONS (ACCIDENT CONDITIONS)
A4.2.4. DESIGN BASIS CATEGORY 4 CONDITIONS (ACCIDENT CONDITIONS)
A4.2.5. INTERNAL AND EXTERNAL HAZARDS
A5. TRANSIENT TO BE ANALYSED
A6. REFERENCES
ATTACHMENT: MLD OF MYRRHA
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
135
A1
INTRODUCTION
This document contains the Tractebel contribution to Deliverable 19 of the PDS-XADS
project. More in detail: it contains the detailed identification and classification of the DBC
(Design Basis Conditions) for the MYRRHA concept. The approach is coherent with the
one used for the large scale liquid metal cooled XADS.
The application of the safety principles to the small scale concept agrees on many points
to that of the large scale concept. MYRRHA is however intended as an experimental
reactor, power generation is not an issue. As a consequence, the normal operation
conditions can be broader than for the large scale concept. Therefore additional initiating
events exist. Operation conditions that have not been considered in this study (up to now)
are: (spent) fuel handling, vessel handling, target handling. These will create their specific
situations and might be added in a later stage of the safety study.
Special attention should go towards corrosion related problems. Due to many
uncertainties regarding to corrosion in an LBE environment, and slow nature of the
process, it has not been taken into account in this study. The corrosion issue is supposed
to be 'under control' by the time of construction and general failures caused by it are
therefore more likely to be Design Extension Conditions.
It should be mentioned that all the accidental situations, which result from the identified
initiating events, have to be combined with a loss of off-site power if the consequences are
more severe. Besides of this, the loss of off-site power itself is treated as an initiating event
as well.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
136
A2
IDENTIFICATION OF ACCIDENT INITIATING EVENTS
A2.1 MASTER LOGIC DIAGRAM
The Master Logic Diagram (MLD) is a helpful tool in identifying and grouping accident
initiating events. Its systematic approach offers a good way to ensure the completeness of
the design analysis.
The analysis starts with three main pathways, coincident with the challenges to the three
physical barriers between the fission products and the external environment:
[1] FUEL CLADDING CHALLENGES
[2] REACTOR COOLING SYSTEM (RCS) AND TARGET UNIT COOLING
SYSTEM (TUCS) CHALLENGES
[3] CONTAINMENT CHALLENGES
It must be pointed out at this stage that for a windowless target ADS as MYRRHA, there
are not three, but only two barriers between the spallation products in the target and the
environment. Indeed, the free surface spallation target is in direct contact with the proton
beam vacuum. Any product evaporating from this free surface has only the beam tube
(and its vacuum system) and the containment (with an isolation valve on the beam tube)
as barriers to the environment. Although the spallation products are believed to be less
toxic than irradiated fuel, both these active barriers should be provided with sufficient
redundancy.
In the following chapters, each of these pathways will be discussed per level. A complete
overview of the 'event tree' can be found in appendix.
A2.2 FUEL CLADDING CHALLENGES
The first path of the MLD aims to identify those phenomenologies that have the potential to
affect the integrity of the first physical barrier to the release of the radioactive fission
products to the environment, namely the fuel cladding.
Fuel cladding challenges originate from two major events:
[1.1] POWER ANOMALIES
[1.2] DECREASE OF FUEL ASSEMBLY HEAT REMOVAL
Event [1.1] "POWER ANOMALIES" refers to anomalies in the power generation in the
core, thus in the fuel rods. Event [1.2] "DECREASE OF FUEL ASSEMBLY HEAT
REMOVAL" refers to anomalies in the heat removal process from the fuel cladding. Both
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
137
events can lead to temperature changes of the Primary Coolant Circuit (PCS), in which an
increase is probably the most penalising effect. Abrupt PCS temperature decrease, giving
thermal shock, should however be considered because of possible water ingress from the
primary heat exchangers.
MYRRHA is provided with in-vessel fuel storage in order to reduce the long shutdown
periods. The spent fuel in these two regions have less challenges to their fuel cladding,
than the fuel in the reactor core. Only event [1.2] applies to these fuel assemblies.
[1] FUEL CLADDING
CHALLENGES
[1.1] POWER
ANOMALIES
[1.2] FUEL ASSEMBLY HEAT
REMOVAL ANOMALIES
A2.2.1
Power Anomalies
[1.1] POWER
ANOMALIES
[1.1.1] REACTIVITY
INSERTION
[1.1.2] SPALLATION
SOURCE MALFUNCTION
level 2 events description
In an ADS the power generated in the fission core is almost linearly dependant on the
proton beam current, and in a more complex way dependent on the k eff (multiplication
factor of the core):
keff
P = I
p
⋅Yn
/ p
⋅ E
f
⋅
(1 − k ) ⋅ν
eff
with:
I p : proton beam current
Y n/p : spallation yield (number of neutrons produced per incident proton)
E f : power released per fission
ν: number of neutrons produced per fission
Following this formula, a power anomaly can result from:
[1.1.1] REACTIVITY INSERTION
The partial derivative of the power towards k eff learns us that a sudden reactivity
change will have more effect on the power when k eff becomes closer to 1. This
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
138
means that a higher reactivity insertion could lead to a proportionally bigger
temperature increase than a small reactivity insertion. This possibly strange
behaviour justifies its place in the MLD analysis.
[1.1.2] NEUTRON SOURCE MALFUNCTION
This event includes a proton beam current event, as well as an event regarding the
free surface.
level 3 events description
[1.1.1] REACTIVITY INSERTION
[1.1.1] REACTIVITY
INSERTON
[1.1.1.1]
TEMPERATURE
DECREASE IN
[1.1.1.2]
CRITICALITY
MEASUREMENT
MALFUNCTION
[1.1.1.3] CORE
LOADING FAULT
[1.1.1.4] WATER
INGRESSION IN
CORE
[1.1.1.4.1] WATER
INGRESSION
DETECTING
SYSTEM FAILURE
As the MLD shows, a reactivity insertion in the core can result from:
[1.1.1.1] TEMPERATURE DECREASE in CORE
A sudden decrease of the core temperature will, due to its negative temperature
coefficient, insert a positive reactivity. For causes of this temperature decrease we
refer to [2.1] RCS PRESSURE and TEMPERATURE VARIATION.
[1.1.1.2] CRITICALITY MEASUREMENT FAILURE
The reactivity measurement of the core is still an R&D topic, but most likely the
classical fission chambers will be adequate. A malfunction of this measuring system
might lead to an unwanted beam current increase.
[1.1.1.3] CORE LOADING FAULT
The reactor core is foreseen to be loaded with fuel rods of two different Pu
enrichments. Above that, the reactor is designed to be a flexible experimental
device. Therefore, chances of a misloading of the core are not irrelevant, and some
margins towards this human-error-based event might be necessary.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
139
[1.1.1.4] WATER INGRESSION
The outer vessel is surrounded by a water tank as biological shielding. This water
will not enter the vessel when leaking. The difference in hydrostatic pressure in LBE
and water prevents this. However, due to the review of a Belgian technical advisory
committee, this biological water shield will most likely be suppressed in the design.
The secondary coolant of the primary heat exchangers is water at approximately
15 bar. This water will enter the vessel when a HX tube breaks or leaks. However it
is very unlikely that water will enter the reactor core due to the nature of the
phenomena and the design of the heat exchanger; a water detector is present in
each HX group. This detector should cause the necessary actions to prevent
criticality of the core (e.g. beam trip, HX isolation, …). Because of this, reactivity
increase as a result of water ingression is only of importance with WATER
INGRESSION DETECTING SYSTEM FAILURE [1.1.1.1.4.1].
[1.1.2] SPALLATION SOURCE MALFUNCTION
[1.1.2] SPALLATION
SOURCE
MALFUNCTION
[1.1.2.1] LOSS OF
FREE SURFACE
CONTROL
[1.1.2.2] PROTON
BEAM
MALFUNCTION
[1.1.2.1.1] MHD
PUMP
MALFUNCTION
[1.1.2.2.1]
INADVERTENT
BEAM TRIP
[1.1.2.1.2] FREE SURFACE
MEASURING AND
CONTROL SYSTEM
MALFUNCTION
[1.1.2.1.3]
SPALLATION LOOP
BREAK
[1.1.2.2.2] INADVERTENT
BEAM CURENT INCREASE
@ PATRTIAL POWER
[1.1.2.2.3]
UNCONTROLLED BEAM
START UP
[1.1.2.2.4] BEAM
PROFILE CONTROLLER
MALFUNCTION
Both the events [1.1.2.1] and [1.1.2.2] are discussed in the level 4 description.
level 4 events description
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
140
[1.1.2.1] LOSS OF FREE SURFACE CONTROL
A loss of free surface control may result in a rising of the free surface in the beam tube.
This event is completely undesirable since it might change the spallation gain (Y n/p ) as well
as the axial power (temperature) in the core. The loss of control might be a result of:
[1.1.2.1.1] MHD PUMP MALFUNCTION
[1.1.2.1.2] FREE SURFACE MEASURING AND CONTROL SYSTEM MALFUNCTION
[1.1.2.1.3] SPALLATION LOOP BREAK
[1.1.2.2] PROTON BEAM MALFUNCTION
[1.1.2.2.1] INADVERTENT PROTON BEAM TRIP
This event is very likely to happen, since no accelerators have been build up to know
to work continuously during months. Whether this event can cause a sudden
accident or not, is disputable. On long term it might cause thermal fatigue, but this
phenomena should be eliminated by prosper design of the fuel.
The thermal transient following a beam trip depends strongly on the time interval
between the trip and the re-establishing of the beam. If this interval becomes to big,
the beam should be switched on gradually as in the normal start-up procedure.
[1.1.2.2.2] INADVERENT BEAM CURRENT INCREASE
The proton beam current is not anticipated to increase along the fuel cycle, as is the
case with the large scale XADS. The small scale machine is however intended to be
highly experimental. Therefore operation at reduced power might be possible, and
as such an inadvertent beam current increase as well.
[1.1.2.2.3] UNCONTROLLED BEAM START UP
This event refers to the situation where the beam is turned on when the ADS system
is not ready to accept and remove fission power.
[1.1.2.2.4] BEAM PROFILE CONTROLLER MALFUNCTION
Radial 'tailoring' of the beam profile is foreseen to reduce the heat input in the target
recirculation zone. Failing to do this will cause temperature increase in the reactor
target and might give rise to excessive LBE evaporation. Although this might lead to
changes in beam current and spallation yield, it is more likely to be a Target Unit
Cooling System Challenge.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
141
A2.2.2
Fuel Assembly Heat Removal Anomalies
This subsection describes events that affect heat removal from a single fuel assembly and,
as such may have a significant impact on the affected assembly while the effect on the
core and on the primary system is negligible. Obviously, challenges to the fuel cladding
integrity may derive also from events caused by problems with the cooling systems
themselves.
level 2 events description
Both decrease as increase of heat removal to a single fuel assembly might cause
accidents, as depicted in the MLD branch.
[1.2.1] DECREASE of HEAT REMOVAL
The decrease of heat removal of a single assembly can lead to an insufficient refrigeration
and failure of its cladding.
[1.2.2] INCREASE of HEAT REMOVAL
An increase of heat removal can be the result of liquid water ingression in the core which,
in contact with the cladding, can lead to thermal shock and failure of the cladding. More
likely however is the increased cooling due to an RCS anomaly [2.1].
[1.2] FUEL ASSEMBLY
HEAT REMOVAL
ANOMALIES
[1.2.2] INCREASE
of FUEL
ASSEMBLY HEAT
[1.2.1] DECREASE of
FUEL ASSEMBLY
HEAT REMOVAL
[1.2.2.1] WATER
INGRESSION
[1.2.1.1] REDUCED
FLOW in FUEL
ASSEMBLY
[1.2.1.1.1] FUEL
ASSEMBLY
BLOCAKGE
[1.2.1.1.2] CORE
CLAMPING
SYSTEM FAILURE
[1.2.1.1.1.1]
CORROSION
DEBRIS
[1.2.1.1.1.2] SOLID
LBE INSERTION
[1.2.1.1.1.1.1]
DEBRIS FILTER
MALFUNCTION
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
142
level 3 events description
The decrease of heat removal in one single assembly originates from:
[1.2.1.1] REDUCED FLOW IN FUEL ASSEMBLY
This event can be caused by either:
[1.2.1.1.1] FUEL ASSEMBLY BLOCKAGE
[1.2.1.1.2] CORE CLAMPING SYSTEM FAILURE
Event [1.2.1.1.1] assumes a (partial) blockage of the cross sectional flow area, the most
likely location being the inlet nozzle. The reduced flow will result in a fuel and cladding
temperature rise. Temperature measurement at the outlet of each assembly should make
it possible to locate a blocked assembly 9 .
Event [1.2.1.1.2] assumes the failure of the core clamping system. This might cause a fuel
assembly to 'wiggle' somewhat, resulting in higher hydraulic entrance resistance, which in
its turn reduces the flow through that assembly.
level 6 events description
[1.2.1.1.1] FUEL ASSEMBLY BLOCKAGE
The blocking of a fuel assembly may be caused by:
[1.2.1.1.1.1] CORROSION DEBRIS INSERTION
Skimmers at the HX entrance should collect any floating debris, while a bypass loop
with removable cartridges filters any non-floating debris. Any non-floating debris
should therefore either be filtered or sink to the bottom (large parts). Consequently,
only with a DEBRIS FILTER MALFUNCTION [1.2.1.1.1.1.1] the debris could cause
problems in the core.
[1.2.1.1.1.2] SOLID LBE INSERTION
This event is not likely during operation. Even with an overcooling in a HX, any solid
LBE would be liquid before reaching the core.
A2.3 REACTOR COOLANT SYSTEM AND TARGET UNIT COOLANT SYSTEM
CHALLENGES
9
Good practice in nuclear requests each temperature measurement to be provided with 3
thermocouples if the result of the measurement is used to automatically activate some safety system.
Transient calculations should clarify whether this events leads to rapid damage or not, thus proving the need
for redundant thermocouples or not.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
143
The second main pathway in the MLD aims to identify those events that have the potential
to affect the integrity of the second physical barrier to the release of radioactive products to
the environment, namely the Reactor Coolant System (RCS) and the Target Unit Coolant
System (TUCS) 10 .
As mentioned before, it should be kept in mind that some events, identified through this
pathway, also challenge the fuel cladding integrity (normally of several or all the fuel
assemblies). Therefore postulated events, described in the following, should be looked at
from both points of view.
RCS and TUCS challenges (level 1) can originate from:
[2.1] RCS PRESSURE and TEMPERATURE VARIATION
[2.2] TUCS PRESSURE and TEMPERATURE VARIATION
Event [2.1] refers to anomalies in the Reactor Coolant System pressure and temperature
variations which originate from malfunctions or failures of systems and components
normally devoted to (directly or indirectly) control the RCS pressure or temperature.
Event [2.2] refers to anomalies in the Target Unit Coolant System pressure and
temperature variation which originate from malfunctions or failures of systems and
components normally devoted to (directly or indirectly) control the TUCS pressure or
temperature.
A2.3.1
Reactor Coolant System Challenges
Pressure and temperature variations can result from six categories of events as shown in
the MLD:
[2] RCS
CHALLENGES
[2.1] RCS PRESSURE
and TEMPERATURE
VARIATION
[2.1.1]
INCREASE in
HEAT REMOVAL
by SCS
[2.1.2]
DECREASE in
HEAT REMOVAL
by SCS
[2.1.3]
DECREASE in
PRIMARY
COOLANT
FLOWRATE
[2.1.4]
DECREASE of
PRIMARY LBE
INVENTORY
[2.1.5]
INCREASE of
PCS
PRESSURE
A2.3.1.1
Increase in Heat Removal by Secondary Coolant System
10 The TUCS is in principle the first of only two barriers for spallation products towards the environment. At
the level of the beam tube, it are the vacuum systems responsible of this function.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
144
Increase in heat removal from the Primary Coolant System (PCS) by the Secondary
Coolant System (SCS) will decrease PCS's temperature.
[2.1.1] INCREASE in
HEAT REMOVAL by
SCS
[2.1.1.1] INCREASE in
SCS FLOWRATE
PARTIAL POWER
[2.1.1.2] DECREASE
of WATER
TEMPERATURE
[2.1.1.1.1] PHX
BYPASS VALVES
MALFUNCTION
[2.1.1.2.1] SCS FEED
& BLEED SYSTEM
MALFUNCTION
[2.1.1.2.2]
INCREASED SCS HX
HEAT REMOVAL
[2.1.1.2.1.1] FEED
REHEATER FAILURE
[2.1.1.2.2.1] TCS
CONTROLLER
MALFUNCTION
[2.1.1.2.2.2] SCS HX
BYPASS VALVE
MALFUNCTION
level 4 events description
An increase of the heat removal by the SCS could result from:
[2.1.1.1] INCREASE in SCS FLOWRATE
Although the secondary pumps might operate at constant speed, an increase of flow rate
through the primary heat exchangers (PHX) can originate the event [2.1.1.1.1]:
[2.1.1.1.1] PHX BYPASS VALVES MALFUNCTION (level 5)
This event should be considered because of:
1. The possibility of operating MYRRHA at reduced power,
2. The uncertainty of whether the 8 PHX will have a continuous bypass flow
or not (in order to have some cooling back-up)
[2.1.1.2] DECREASE of WATER TEMPERATURE
level 5 events description
[2.1.1.2.1] SCS FEED & BLEED SYSTEM MALFUNCTION
The Feed & Bleed system of the SCS allows for water chemistry control, water storage,
draining … The ion exchange resins have a maximal temperature of 60 °C, and therefore
the water should be cooled at the bleed side, and reheated at the feed side of this system.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
145
Failing to reheat the water at the nominal temperature of the SCS ( Event [2.1.1.2.1.1] )
before injection will result in a reduced SCS water temperature.
[2.1.1.2.2] INCREASED SCS HX HEAT REMOVAL
This is probably the greatest risk for reduced SCS water temperature. An increased heat
removal at the SCS heat exchangers may result from:
[2.1.1.2.2.1] TERTIARY COOLANT SYSTEM CONTROLLER MALFUNCTION
The heat removal by the tertiary coolant system is still under consideration in the
present design. It will most probably be a water circuit with cooling towers, fed with
lagoon water. Detailed events are not identified at this moment.
[2.1.1.2.2.2] SCS HX BYPASS VALVE MALFUNCTION
The bypass valve of the secondary heat exchangers will be used for temperature
control of the SCS water. Especially during reduced power operation, a too low
bypass rate could reduce the water temperature.
A2.3.1.2
Decrease in Heat Removal by Secondary Coolant System
Decrease in heat removal from the Primary Coolant System (PCS) by the Secondary
Coolant System (SCS) will increase PCS's temperature.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
146
[2.1.2] DECREASE in
HEAT REMOVAL by SCS
[2.1.2.1] DECREASE in
SCS FLOW RATE
DECREASE of WATER
INVENTORY
[2.1.2.2]
[2.1.2.3] INCREASE of
WATER TEMPERATURE
[2.1.2.1.1] PHX BYPASS
VALVE MALFUNCTION
[2.1.2.2.1] SCS PIPE
BREAK
[2.1.2.3.1] SCS FEED &
BLEED SYSTEM
MALFUNCTION
[2.1.2.1.2] LOSS of
ELECTRICAL POWER to
1 SCS LOOP
[2.1.2.2.2] FEED &
BLEED CONTROL
SYSTEM MALFUNCTION
[2.1.2.3.1.1] FEED
REHEATER
MALFUNCTION
[2.1.2.1.4] PHX TUBE
BLOCKAGE
[2.1.2.3.2] DECREASED
SCS HX HEAT
REMOVAL
[2.1.2.1.3]
SIMULTANEOUS
CUTTING of BOTH SCS
LOOPS
[2.1.2.3.2.1] TCS
CONTROLLER
MALFUNCTION
[2.1.2.3.2.2] SCS HX
BYPASS VALVE
MALFUNCTION
level 4 events description
A decrease in heat removal by the secondary cooling system may, according to the MLD,
result from:
[2.1.2.1] DECREASE in SCS FLOW RATE
[2.1.2.2] DECREASE of WATER INVENTORY
[2.1.2.3] INCREASE of WATER TEMPERATURE
Event [2.1.2.2] denotes a loss-of-coolant-accident for the secondary cooling circuit. Two
considerations involving this event should be mentioned.
Firstly, although two independent secondary loops are foreseen, the loss of one loop
still means the loss of 4 primary heat exchangers. The interconnection valves
between the two loops are hand-actuated and as such, no automatic switching of the
'lost' HX to the second fully operating loop can occur.
Secondly, the water storage tank (as well as the complete feed & bleed system) is
common to both secondary cooling loops. Emergency water injection one loop might
jeopardize the feed & bleed system of the second loop.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
147
Event [2.1.2.3] has the same initiating faults as event [2.1.1.2] (Decrease of water
temperature).
level 5 events description
[2.1.2.1.1] PHX BYPASS VALVES MALFUNCTION
This event can reduce the SCS flow rate as well as increase it (cfr. supra).
[2.1.2.1.2] LOSS OF ELECTRICAL POWER to 1 LOOP
The loss of power to one loop means losing that loop completely. This leaves the cooling
of the core to only the second loop, with its 4 primary heat exchangers, and the emergency
cooling.
[2.1.2.1.3] SIMULTANEOUS CUTTING of BOTH SCS LOOPS
One HX in a given group is connected to a secondary loop and the other HX to the other
secondary loop. In case of failure or non-availability of one loop, this allows to keep a
reasonably well-balanced flow and temperature pattern in the reactor. This leads however
to a more complicated piping arrangement, with pipes of both cooling loops mixed in the
same channels. So, an accident, like the drop of a weight on one of those channels, could
cut both cooling loops at the same time. This can be prevented, up to a point, by a careful
design and routing of the cooling pipes, but very close to the HX, the piping cannot be
protected.
This event is therefore a possible 'common failure' of the SCS loops, which leaves only the
emergency cooling active.
[2.1.2.1.4] PHX TUBE BLOCKAGE
A blockage at the secondary side of the PHX will reduce its effective surface and as such
decrease its heat removal.
[2.1.2.2.1] SCS PIPE BREAK
[2.1.2.2.2] FEED & BLEED CONTROL SYSTEM MALFUNCTION
The bleed system takes water from both loops for purification and the feed system reinjects
it into the loops. The feed flow is controlled by the pressuriser level measurement
system. A malfunction of this control system might cause a decrease of the water
inventory of the SCS.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
148
A2.3.1.3
Decrease in Primary Coolant System Flow rate
[2.1.3]
DECREASE in
PRIMARY
COOLANT
FLOW RATE
[2.1.3.1]
INCREASE of
PCS PATH
HYDRAULIC
RESISTANCE
[2.1.3.2] LOSS
of ELECTRICAL
POWER to 1
PUMP
[2.1.3.3]
MALFUNCTION
of NATURAL
CIRCULATION
BYPASS VALVE
[2.1.3.4]
TARGET SLOT
CLOSURE
FAILURE
[2.1.3.5.]
PRIMARY
PUMP
BLOCKED
ROTOR
The DECREASE IN PCS FLOW RATE (event [2.1.3]) can result from:
[2.1.3.1] INCREASE of PCS PATH HYDRAULIC RESISTANCE
This event is very general and it involves any (partial) blocking of the LBE flow within the
reactor vessel. The particular case of blockage within a fuel assembly is covered in
section 2.3.2. Any other part of the primary circuit as well, could suffer reduction of flow
area or increase of surface roughness due to chemical (oxidation) of physical (crud
formation, deposits) processes. These processes would be however slow and detectable
before generating accidents. As an example, one could expect the check valve at the
outflow of each HX group to become somewhat blocked. This would create a reduced
flow area.
[2.1.3.2] LOSS of ELECTRICAL POWER to 1 PUMP
This would cause 1 group of HX to fail. The present design is foreseen to be able
operating with only three groups out of four. The asymmetry of this flow pattern should still
be investigated however.
[2.1.3.3] MALFUNCTION of NATURAL CIRCULATION BYPASS VALVE
In case of pump failure, natural circulation is enhanced by opening of spring-loaded
bypass valves in the core diaphragm. This is done in order to reduce the pressure drop
caused by the primary heat exchangers and pumps. The natural circulation and
emergency cooling are designed to cope only with residual decay heat. It is plausible to
believe that after an opening of this valve, it might not close completely.
[2.1.3.4] TARGET SLOT CLOSURE FAILURE
The target penetrates the core from top to bottom. The retraction of the target requires the
presence of a slot in the core. The perfect closure of this slot at the bottom of the core is
necessary to prevent a bypass flow of the LBE along the core.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
149
[2.1.3.5] PRIMARY PUMP BLOCKED ROTOR
This event is similar to [2.1.3.2], but it differs in the fact that there is no residual inertia in
this case. Transient behaviour is expected to be more penalising.
A2.3.1.4
Decrease in Primary LBE Inventory
[2.1.4] DECREASE of
PRIMARY LBE
INVENTORY
[2.1.4.1]
CONDITIONING &
FILTERING BYPASS
LOOP MALFUNCTION
[2.1.4.2] LOSS of
PRIMARY LBE
[2.1.4.2.1] LEAKAGES
from PRIMARY VESSEL
[2.1.4.2.2] PRIMARY
VESSEL BREAK
Due to the pool type design, loss of primary coolant is not very likely to happen since no
big quantities of primary coolant circulate outside the reactor vessel. Only two reasons for
loss of coolant are present:
[2.1.5.1] CONDITIONING & FILTERING BYPASS LOOP MALFUNCTION
The in-service conditioning and filtering of the LBE is performed through a bypass loop
which penetrates the vessel cover. Any malfunction of its flow control might reduce the
inventory of LBE inside the reactor vessel. It is not so much a catastrophic loss, and the
LBE will stay contained in the conditioning loop.
[2.1.5.2] LOSS of PRIMARY LBE
This event denotes the real loss of LBE through vessel break or leakage.
level 5 events description
The event [2.1.5.2.1] "LEAKAGES from PRIMARY VESSEL" assumes that Inner Vessel
material degradation generates through-wall cracks through which a (presumably small)
flow of lead-bismuth is discharged into the gap between main and Outer Vessel where it is
collected and retained. Careful design would create leak collectors which bring the leak
into contact with the Outer Vessel. In this way, hot spots on the Outer Vessel could be
detected by Infra Red camera's at the water side. Another way of detecting a leak would
be by detecting radioactive contamination of this intermediate space.
The event [2.1.5.1.2] "PRIMARY VESSEL BREAK" assumes that a Primary Vessel
mechanical failure quickly discharges lead-bismuth into the gap between main and Guard
Vessel where it is collected and retained. It is still debated whether the gap between the
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
150
two vessels should be filled either by inert gas or thermal insulation. This thermal
insulation would be some kind of mineral bricks with a high filling factor. Filling up the gap
between the two vessels would drastically reduce the total amount possible of LBE lost
from the Inner Vessel (if the Outer Vessel would not break). Limiting this amount is crucial
to ensure the proper working of the emergency cooler which is based on natural
circulation.
Leaking of the Outer Vessel is not considered in the Design Base Conditions. The selfsealing
properties of the LBE (freezing at 123,5 °C) in contact with the cold water at the
outside of the Outer Vessel, would prevent this leaking.
A2.3.1.5
Increase of Primary Coolant System Pressure
[2.1.5] INCREASE of
PCS PRESSURE
[2.1.5.1] INCREASE of
PRIMARY LBE
INVENTORY
[2.1.5.2] INCREASE of
COVER GAS
PRESSURE
[2.1.5.1.1]
CONDITIONING &
FILTERING BYPASS
LOOP MALFUNCTION
[2.1.5.2.1] COVER GAS
PRESSURE CONTROL
SYSTEM
MALFUNCTION
[2.1.5.2.2] PHX TUBE
RUPTURE
Increase of the cover gas pressure would increase the total pressure in the inner vessel.
An increase of LBE inventory in the inner vessel would be partially compensated by the
cover gas pressure control system. This system would however only compensate the
volume reduction of the gas volume, it would not detect the pressure increase inside the
LBE because of the increase in hydrostatic height.
level 4 events description
The event [2.1.6.1] "INCREASE of PRIMARY LBE INVENTORY" can result from:
[2.1.6.1.1] CONDTIONING & FILTERING BYPASS LOOP MALFUNCTION. A
malfunction of its flow control could drain its storage tank into the reactor vessel.
The event [2.1.6.2] "INCREASE of COVER GAS PRESSURE" can result from
[2.1.6.2.1] COVER GAS PRESSURE CONTROL SYSTEM MALFUNCTION
[2.1.6.2.2] PRIMARY HX TUBE RUPTURE
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
151
It is noted that the pressure in the secondary cooling system is 15 to 20 bar, which
means that a tube rupture in a primary HX would always result in water/steam
ingression in the primary vessel. The steam would cumulate in the cover gas layer,
and overpressure should then open a safety valve towards a steam collector.
[2.1.6.2.3] REACTOR COVER LEAKAGE
A2.3.2
Target Unit Coolant System Challenges
Target Unit Coolant System (TUCS) Challenges mainly result from pressure and
temperature variations. The five possible causes for this are shown in the MLD. The
TUCS challenges form together with the RCS challenges the second main pathway of the
MLD.
[2] TUCS
CHALLENGES
[2.2] TUCS
PRESSURE and
TEMPERATURE
VARIATION
[2.2.1]
DECREASE in
HEAT REMOVAL
from TUCS
[2.2.2]
DECREASE in
TARGET UNIT
COOLANT
FLOW RATE
[2.2.3.] CHANGE
in TUCS LBE
INVENTORY
[2.2.4]
INCREASE of
TUCS
PRESSURE
[2.2.5]
INCREASE of
TUCS
TEMPERATURE
A2.3.2.1
Decrease in heat removal from Target Unit Coolant System
[2.2.1.2] DECREASE in PCS FLOWRATE
Most of the events that lead to a decrease of heat removal from the target system, also
cause a decrease in heat removal from the core and are considered in the previous
section.
[2.2.1.1] TUCS HX BLOCKED
A blocking of the target HX will lead to a decreased heat removal of the TUCS. This event
is very similar to [2.1.2.1.4] PHX TUBE BLOCKAGE.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
152
[2.2.1] DECREASE in
HEAT REMOVAL from
TUCS
[2.2.1.1] TUCS HX
BLOCKED
[2.2.1.2] DECREASE
in PCS FLOW RATE
A2.3.2.2
Decrease in Target Unit Coolant System flow rate
The events resulting in the decrease in target unit coolant flow rate are identified through
the master logic diagram (MLD).
[2.2.2] DECREASE in
TUCS FLOW RATE
[2.2.2.1] GENERALIZED
INCREASE of TUCS
HYDRAULIC
RESISTANCE
[2.2.2.2] TUCS
CIRCULATION
SYSTEM
MALFUNCTION
[2.2.2.2.1] PARTIAL
LOSS of TUCS FLOW
[2.2.2.2.2] COMPLETE
LOSS of TUCS FLOW
[2.2.2.2.1.1] LOSS of
FREE SURFACE
CONTROL
[2.2.2.2.2.1] MAIN
PUMP FAILURE
[2.2.2.2.1.1.1] MHD
PUMP FAILURE
[2.2.2.2.1.1.2] FREE
SURFACE MEASURING
& CONTROL SYSTEM
MALFUNCTION
[2.2.2.2.2.1.2] LOSS of
HYDRAULIC DRIVE
[2.2.2.2.2.1.1] PUMP
LOCKED ROTOR
[2.2.2.2.2.1.1.1]
HYDRAULIC DRIVE
LEAK
[2.2.2.2.2.1.1.2] LOSS
of ELECTRICAL
MOTOR
level 3 events description
The event [2.2.2] "DECREASE in TUCS FLOW RATE" can result from a malfunction, a
degradation or failure in the target LBE circulation system.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
153
level 4 events description
The event [2.2.2.1] "GENERALIZED INCREASE OF TUCS HYDRAULIC RESISTANCE"
can be originated by:
• reduction of flow areas or increase of surface roughness due to chemical (oxidation)
or physical processes (crud formation, deposits mainly inside the heat exchanger
tubes).
It is noted that event [2.2.2.1] would anyway be the consequence of processes developing
over long times and would therefore be detectable before it can generate adverse
consequences. Therefore no specific MLD branch will be constructed for it.
The event [2.2.2.2] "TUCS CIRCULATION SYSTEM MALFUNCTION" can be divided in
two categories:
[2.2.2.2.1] PARTIAL LOSS of TUCS FLOW
[2.2.2.2.2] COMPLETE LOSS of TUCS FLOW
level 5 events description
[2.2.2.2.1] PARTIAL LOSS of TUCS FLOW
The partial loss of the TUCS flow will result in an offset of the free surface, which will result
in an inefficient cooling of the target.
Partial loss of the TUCS flow can happen, even if the main circulation pump doesn't fail.
The fine tuning of the free surface level in the spallation target, is controlled by a
measuring system (Laser based), coupled to a MHD pump. This pump can deliver both
positive and negative pressure heads.
Loss of free surface control (level 6) can result from
• MHD PUMP FAILURE: This assumes a failure or malfunction of the MHD pump
• FREE SURFACE MEASURING & CONTROL SYSTEM MALFUNCTION: This
assumes a malfunction of the level measuring system, or the feedback of it towards
the MHD pump.
[2.2.2.2.2] COMPLETE LOSS of TUCS FLOW
The LBE in the target is recirculated by the main circulation pump from the spallation zone
back to the feed tank. The present design uses a 'turbine-pump'. This type of machine is
used to avoid long shafts. Any kind of failure on this turbine-pump will lead to a complete
loss of flow in the TUCS.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
154
A main pump failure can originate from two events:
• PUMP LOCKED ROTOR: This assumes the mechanical failure of the main pump
• LOSS of HYDRAULIC DRIVE: This assumes the loss of pumps drive. In practice
this means the loss of the electrical pump of the power fluid, or a leakage in the
piping of the power fluid.
A2.3.2.3
Change in Target Unit Coolant System LBE inventory
An increase or decrease of the LBE inventory of the TUCS is not likely to happen. The
design has a feed tank, which pours its excess of fluid into a second tank. This causes an
increase of the feed tank level to be (almost) impossible. Only a complete failure of the
second tank draining system could cause the level in this tank to rise above the level of the
feed tank after a certain delay.
The decrease of the LBE inventory is even more unlikely to happen. Only a shrinking of
the LBE (due to thermal effects) or a non-leaking of the turbine-pump drive (which is
foreseen to be around 5% of its nominal flow rate), could cause the level of the feed tank
to drop.
Nevertheless, for the completeness of the DBC list, these events will be considered in the
MLD.
[2.2.3] CHANGE in
TUCS LBE
INVENTORY
[2.2.3.1] INLEAKAGE
from PRIMARY
COOLANT
[2.2.3.2] AUXILIARY
PUMP
MALFUNCTION
level 4 events description
[2.2.3.1] INLEAKAGE from PRIMARY COOLANT
This event assumes small cracks or larger breaks in the target's vacuum confinement
vessel beneath the LBE surface in the reactor vessel. Because of the vacuum in the
target, these cracks or breaks will result in leaking LBE from the primary circuit into the
target unit. Both the amount and the speed of leaking depends on the height of the crack.
[2.2.3.2] AUXILIARY PUMP MALFUNCTION
The turbine-pump will always have a leak of the power fluid (LBE) towards the TUCS. So,
even when there is no inleakage of primary LBE, something has to be done to compensate
this. The level in the feed tank is kept constant by pouring the excess fluid in a secondary
tank, from where it is removed by the auxiliary pump and sent to the purification system
and expansion tank. This pump is started when the level in the secondary tank reaches a
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
155
pre-set level, and stopped when the level has dropped close to the cavitation limit of the
auxiliary pump.
A2.3.2.4
Increase of Target Unit pressure
The target unit is connected to the beam tube and is therefore under vacuum condition.
Any increase of the target pressure would cause loss of vacuum in the beam tube and vice
versa.
[2.2.4] INCREASE of
TUCS PRESSURE
[2.2.4.1] LOSS of
TARGET VACUUM
[2.2.4.2] LOSS of
PROTON BEAM
PIPE VACUUM
[2.2.4.1.1] LEAK of
TARGET VACUUM
CONFINEMENT VESSEL
[2.2.4.1.2] LOSS of
TARGET UNIT
VACUUM SYSTEM
[2.2.4.2.1] PROTON
BEAM PIPE BREAK
[2.2.4.2.2] PROTON
BEAM PIPE VACUUM
SYSTEM
MALFUNCTION
[2.2.4.1.2.1]
CRYOPUMP
FAILURE
[2.2.4.1.2.2] TURBO
MOLECULAR PUMP
FAILURE
[2.2.4.1.2.3]
SORPTION PUMP
& RESERVOIRS
FAILURE
level 3 events description
The event [2.2.4] "LOSS of TARGET UNIT PRESSURE" can result from either the loss of
the vacuum in the proton beam pipe or the loss of the vacuum in the target unit vessel. It
must be stressed that both have their own vacuum system, but they are interconnected.
The vacuum system of the target unit has the function of sustaining the vacuum at the
target's free surface, while the vacuum system of the proton beam pipe is designed to
ensure the vacuum during transfer of the beam from accelerator to target.
level 4 events description
[2.2.4.1] LOSS of TARGET VACUUM
The vacuum at the target unit level can be lost due to:
[2.2.4.1.1] LEAK of TARGET UNIT VACUUM CONFINEMENT VESSEL
The complete target loop is enclosed in a sealed vacuum vessel. Leaking of this vessel
at a level above the primary LBE will result in gas ingress in the target loop.
[2.2.4.1.2] LOSS of TARGET UNIT VACUUM SYSTEM
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
156
The vacuum system of the target unit consists of three stages, of which cryopumping is
the first. Because cryopumps tend to saturate, they must be regenerated. Therefore
two pumps are available, so one can regenerate while another keeps pumping. The
regeneration of those pumps will be through a turbo molecular pump with Holweg stage.
The final pumping is intended to be done by sorption pumps.
It is not likely that vacuum will be lost in a fast way due to pump failure. Only during
regeneration, the operating vacuum pump has no backup. This is a matter of minutes.
The failing of the turbo molecular or the sorption pump only poses a problem on a
longer horizon. Therefore these events should not be considered as accident initiating
events.
Failure of the sorption reservoirs will lead to spallation product release into the
containment.
[2.2.4.2] LOSS of PROTON BEAM TUBE VACUUM
The loss of vacuum in the proton beam can result from:
• The failure of the proton beam tube.
• The failure of the proton beam tube vacuum system.
A2.3.2.5
Increase of Target Unit Coolant System temperature
The target unit is cooled through its HX, designed for the nominal heat generation within
the target unit. Any event that causes an increase of this heat generation, will increase the
temperature.
It should be stated here that a conditioning heater malfunction will not lead to a significant
temperature increase. This heater is only supposed to be active when LBE is pumped
upwards by the auxiliary pump. If the heater would operate at moments without LBE flow
in its channel, it would operate in vacuum. This would cause only damage to the heater
itself.
[2.2.5] INCREASE of
TUCS TEMPERATURE
[2.2.5.1] TUCS
CIRCULATION PIPE
BREAK
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
157
level 4 events description
[2.2.5.1] TUCS CIRCULATION PIPE BREAK
This event assumes that a break occurs in the pipes of the LBE circulation system. As a
consequence a secondary LBE circulation path sets which, depending on the break
location, bypasses the target zone or the HX.
A2.4 CONTAINMENT CHALLENGES
The third path of the MLD aims to identify those phenomenologies that have the potential
to affect the integrity of the third physical barrier, namely the containment. The
identification of these events is not complete because many uncertainties are present in
the present design.
[3] CONTAINMENT
CHALLENGES
[3.1] REACTOR CONTAINMENT
PRESSURE / TEMPERATURE
VARIATION
[3.2] RADIOACTIVE RELEASE
INSIDE THE CONTAINMENT
[3.1.1] LEAKAGES from HIGH
ENERGY SYSTEMS INSIDE
THE CONTAINMENT
[3.1.2] INADEQUATE REACTOR
CONTAINMENT HEAT
REMOVAL
[3.2.1] LOW ENERGY
RADIOACTIVE FLUID
SYSTEMS FAILURE INSIDE
CONTAINMENT
level 2 events description
• REACTOR CONTAINMENT PRESSURE/TEMPERATURE TRANSIENTS [3.1];
• RADIOACTIVE RELEASE INSIDE THE CONTAINMENT [3.2]
Note that event [3.1] refers to accidents that lead to pressure and/or temperature increase
in the reactor containment while event [3.2] refers to accidents that release radioactivity in
the reactor containment with no or insignificant mass and energy release.
Furthermore, other events that have the potential to originate release of radioactivity
directly outside containment (e.g. leakage of waste from storage tanks located in the waste
storage building) will not be treated in this context.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
158
A2.4.1
Leakages from high energy systems inside the containment
[3.1.1] LEAKAGES
from HIGH ENERGY
SYSTEMS INSIDE
the CONTAINMENT
[3.1.1.1]
SECONDARY
COOLING SYSTEM
FAILURE
[3.1.1.2]
ACCELERATOR
BEAM TRANSPORT
SYSTEM FAILURE
[3.1.1.1.1]
SECONDARY
COOLING SYSTEM
COMPONENT
level 4 events description
[3.1.1.1] SECONDARY COOLING SYSTEM FAILURE can result from:
[3.1.1.1.1] SCS COMPONENT BREAK: The postulated failure or break of the
Secondary Cooling System (SCS) causes the release of mass and energy. Release
of radioactive products from the SCS should be prohibited through monitoring of the
SCS on contamination.
[3.1.1.2] ACCELERATOR BEAM TRANSPORT SYSTEM FAILURE
The failure of the system that drives the proton beam inside the reactor vessel, magnetic
divertor(s), can cause the rupture of its confinement structure.
A2.4.2
Inadequate reactor containment heat removal
The MYRRHA containment is built like a large hot cell, allowing activated and
contaminated materials to be removed from the reactor and transported without particular
shielding. The atmosphere of the containment will contain no oxygen, and therefore an
appropriate containment ventilation and filtering system is present. This system will also
have to deal with temperature / pressure control.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
159
[3.1.2] INADEQUATE
REACTOR CONTAINMENT
HEAT REMOVAL
[3.1.2.1] CONTAINMENT
ATMOSPHERE CONTROL
FAILURE
A2.4.3
Low energy radioactive fluid systems failure inside reactor containment
This event denotes leakages of radioactive fluid from low operating pressure or low
operating temperature systems, with no significant containment pressurisation.
[3.2.1] LOW ENERGY
RADIOACTIVE FLUID SYSTEMS
FAILURE INSIDE REACTOR
CONTAINMENT
[3.2.1.1]LBE
CONDITIONING
SYSTEM FAILURE
[3.2.1.2] PRIMARY
COVER GAS SYSTEM
FAILURE
[3.2.1.3] LEAKAGE
from TARGET UNIT
[3.2.1.4] EX-VESSEL
FUEL STORAGE
FAILURE
[3.2.1.1.1] LBE
CONDITIONING
SYSTEM PIPE BREAK
[3.2.1.2.1] PRIMARY
COVER GAS
SYSTEM PIPE
BREAK
[3.2.1.3.1] LEAKAGE
from SORPTION
TANKS
[3.2.1.1.2] LEAKAGE
from COND. SYS.
COMPONENTS
STORAGING
RADIOACTIVE
PRODUCTS
[3.2.1.2.2] LEAKAGE
from PCGS
COMPONENTS
STORAGING
RADIOACTIVE
PRODUCTS
level 4 events description
[3.2.1.1] LBE CONDITIONING SYSTEM FAILURE
A bypass loop penetrates the reactor vessel cover and continuously provides filtering &
conditioning of the primary LBE. A failure of this system, leading to radioactive release
into the containment can originate from:
• A pipe break outside the reactor vessel [3.2.1.1.1];
• A leakage from any component of this system storing radioactive products
[3.2.1.1.2].
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
160
[3.2.1.2] PRIMARY COVER GAS SYSTEM FAILURE
A bypass loop penetrates the reactor vessel cover and continuously provides filtering &
conditioning of the cover gas. A failure of this system, leading to radioactive release into
the containment can originate from:
• A pipe break outside the reactor vessel [3.2.1.2.1];
• A leakage from any component of this system storing radioactive products [3.2.1.2.2].
One could consider the leakage of cover gas through the penetrations in the reactor vessel
cover as a special case of this last event.
[3.2.1.3] TARGET UNIT LEAKAGE
A target unit leakage leading to radioactive release into the containment can only result
from a leakage of the adsorption pump reservoirs. A leak of the target unit vacuum
confinement vessel will result in containment gas flowing into the target unit.
[3.2.1.4] EX-VESSEL FUEL STORAGE MALFUNCTION
Spent fuel will first cool down inside the reactor itself. Only when the decay heat has
sufficiently reduced, it will be transferred to a water pool storing facility inside the MYRRHA
hall. Any malfunction of this storing facility will lead to release of radioactivity into the hall
(containment).
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
161
A3
LIST OF ACCIDENT INITIATING EVENTS
The following initiating events are selected from the MLD.
Fuel cladding challenges
• Criticality measurement malfunction
• Core loading fault
• Water ingression in core
• Inadvertent beam trip
• Inadvertent beam current increase
• Uncontrolled beam start up
• Beam profile controller malfunction
• Fuel assembly blockage
• Core clamping system failure
• Spallation loop break
Reactor coolant system and Target unit coolant system challenges
RCS challenges
• PHX bypass valve malfunction
• SCS feed reheater malfunction
• Increased / Decreased SCS HX heat removal
• SCS bypass valve malfunction
• Loss of electrical power to 1 SCS loop
• Simultaneous cutting of both SCS loops
• PHX tube blockage
• SCS pipe break
• Feed & Bleed control system malfunction
• Increase of PCS path hydraulic resistance
• Loss of electrical power to 1 pump
• Inadvertent opening of natural circulation bypass valve
• Primary pump rotor blocked
• Conditioning & filtering bypass loop malfunction
• Leakages from primary vessel
• Primary vessel break
• Cover gas pressure control system malfunction
• PHX tube rupture
• Target slot closure failure
TUCS challenges
• Generalized increase of TUCS hydraulic resistance
• MHD pump failure
• Free surface measuring & control system malfunction
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
162
• Main pump failure
• Inleakage of primary coolant
• Auxiliary pump malfunction
• Leak of target vacuum confinement vessel
• Loss of proton beam pipe vacuum
• TUCS circulation pipe break
• TUCS HX blocked
Containment challenges
• Ex-vessel fuel storage malfunction
• Leakage from target unit (ad)sorption tanks
• Primary cover gas system failure
• LBE conditioning system failure
• Containment atmosphere control failure
• Accelerator beam transport system failure
• SCS component break
Loss of electrical power
• Station blackout (loss of off-site electrical power)
• Partial failure of the electrical power distribution network
It must be stated that all accidental situations have to be combined with a loss of off-site
electrical power if consequences are more severe.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
163
A4
CATEGORIZATION OF INITIATING EVENTS
A4.1 CATEGORIES
Following four Design Basis Conditions categories are defined in Deliverable D6, Chapter
8:
Design Basis Category 1 Conditions (Normal Operations)
The normal operations are plant conditions that are planned and required. They include
special conditions such as tests, part load, shutdown states, maintenance …
Design Basis Category 2 Conditions (Incident Conditions)
These conditions are not planned but expected to occur one or more times during the life
of the plant.
Design Basis Category 3 Conditions (Accident Conditions)
These conditions are not expected to occur during the life of the plant. These events do
not prohibit the restart of the plant.
Design Basis Category 4 Conditions (Accident Conditions)
These conditions are not expected to occur and plant restart is not required.
Internal and external Hazards
A4.2 CATEGORIZATION
A4.2.1
Design Basis Category 1 conditions (normal operation)
• Operation at various power levels
• Operation with experiments running
• Operation with modified core configuration (thermal islands)
• Shutdown states:
- Maintenance shutdown
- Hot zero Power (Short term shutdown)
- Long term shutdown
• Transient states:
- Changeover from and to maintenance state
- Changeover from and to long term shutdown state
- Plant loading to and unloading from full power and HZP
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
164
• Test rig handling
• Fuel handling:
- Inside the reactor
- Outside the reactor
• Operation with permissible deviations
- Operation with component or system out of service (to be defined)
- Leakage from fuel within the limits (to be defined)
- Testing
A4.2.2
Design Basis Category 2 conditions (incident conditions)
• Criticality measurement malfunction
• Inadvertent beam trip
• Inadvertent beam current increase
• Beam profile controller malfunction
• SCS feed reheater malfunction
• Loss of electrical power to 1 SCS loop
• Feed & Bleed control system malfunction
• Loss of electrical power to 1 primary pump
• Cover gas pressure control system malfunction
• Primary pump blocked rotor
• MHD pump failure
• Free surface measuring & control system malfunction
• Loss of target unit vacuum system
• Loss of proton beam pipe vacuum
• Station blackout (loss of off-site electrical power)
• Partial failure of the electrical power distribution network
A4.2.3
Design Basis Category 3 conditions (accident conditions)
• Core loading fault
• Fuel assembly blockage
• Core clamping system failure
• PHX bypass valve malfunction
• Increased / Decreased SCS HX heat removal
• TUCS HX blocked
• SCS bypass valve malfunction
• PHX tube blockage
• small SCS pipe break
• SCS Feed & Bleed control system malfunction
• Increase of PCS path hydraulic resistance
• Malfunction of natural circulation bypass valve
• Conditioning & filtering bypass loop malfunction
• Target slot closure failure
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
165
• Generalized increase of TUCS hydraulic resistance
• Main pump failure of TUCS
• Inleakage of primary coolant
• Auxiliary pump malfunction
• Leak of target vacuum confinement vessel
• TUCS circulation pipe break
• Primary cover gas system failure
• LBE conditioning system failure
• Containment atmosphere control failure
• small SCS component break
A4.2.4
Design Basis Category 4 conditions (accident conditions)
• Water ingression in core
• Uncontrolled beam start up
• Core clamping system failure
• Simultaneous cutting of both SCS loops
• large SCS pipe break
• Leakages from primary vessel
• Primary vessel break
• PHX tube rupture
• Ex-vessel fuel storage malfunction
• Leakage from target unit (ad)sorption tanks
• Accelerator beam transport system failure
• large SCS component break
A4.2.5
Internal and external hazards
Internal Hazards
• Internal fire or explosion
• Internal flooding
• Experiments malfunctions
External Hazards
• Earthquake
• Flooding
• Extreme winds and storms
• Extreme weather conditions
External man-made hazards
• Dangerous products transport accidents
• Fire or explosion
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
166
• Toxic products spills
• Impact of adjacent facilities
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
167
A5
TRANSIENTS TO BE ANALYSED
Following the list of initiating events from the previous chapter, one can generate a list of
accidents of which the reactor's transient behaviour should be analysed. The resulting list,
including some remarks, can be found in Appendix B.
A distinction has been made between protected and unprotected transients, in which the
unprotected transients are combined with a failure of shutting the beam off.
The temperature of the reactor in the state of Cold Zero Power (CZP), is the temperature
during maintenance, above the melting temperature of LBE.
Most events with regard to the target unit (loss of vacuum, loss of flow, loss of heat sink,
…) result in a termination of the spallation process because of the evaporation of LBE.
This inherent safety feature of an ADS is felt to be a major advantage towards safety.
Transient behaviour caused by a target event should be analysed to demonstrate this.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
168
A6
REFERENCES
[1] Abderrahim H. A., and Kupschus P., "MYRRHA, A multipurpose accelerator driven
system (ADS) for research & development, a pre-design report", Mol – Belgium:
SCK•CEN, 2002.
[2] Benoit Ph. et al, "MYRRHA project: General description of the primary systems and
associated equipment, rev.1", Mol – Belgium: SCK•CEN, 2002
[3] Monti, R. et al, "D19: Design basis conditions for lead bismuth eutectic cooled XADS,
rev. 0", Italy: Ansaldo Nucleare, 2003.
[4] Rochwerger, D., "D6: PDS-XADS – Integrated safety approach – Goals – Principles.
Rules for assessment, safety design and criteria", France: Framatome ANP, 2002.
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
AnsaldoEnergia
Identificativo
Document no.
XADS 20 TRIX 009
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
169
ATTACHMENT
MLD of MYRRHA
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
Identificativo
Document no.
XADS 20 TRIX 009
AnsaldoEnergia
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
170
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
Identificativo
Document no.
XADS 20 TRIX 009
AnsaldoEnergia
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
171
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
Identificativo
Document no.
XADS 20 TRIX 009
AnsaldoEnergia
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
172
DNU 020/1

Divisione Nucleare
Progetto
Project
PDS-XADS
Identificativo
Document no.
XADS 20 TRIX 009
AnsaldoEnergia
Rev.
Rev.
1
Cl. ris.
class
Pagina
Page
173
DNU 020/1