Frédéric BERTRAND , Anne BASSI Dominique BARBIER, Patrick AUJOLLET et Pascal ANZIEU

1. Massive Hydrogen Production with Nuclear Heating, Safety approach for coupling a VHTR with a Iodine/Sulfur Process Cycle Frédéric BERTRAND, Anne BASSI Dominique BARBIER, Patrick AUJOLLET et Pascal ANZIEU CEA (Commissariat à l’energie atomique), DEN (Nuclear Energy Division) frederic.bertrand@cea.fr

2. Economical and technical background Presentation of the whole plant (coupled facilities) Safety approach proposed Implementation of defence in depth (DiD) to the whole plant Conclusion OUTLINE

3. Investigation on energy production without fossil energy No release of green house effect gases Thermochemical Iodine/Sulfur (IS) cycle requiring a high temperature supply possible with a VHTR  Other H2 production processes are also under investigation at CEA (HTE, Westinghouse cycle) in order to explore different solutions Safety approach taking into account nuclear safety constraints and conventional industry safety constraints as well  Main safety principles : progressiveness, homogeneity, diversity and safety architecture built to face all kind of risks in the whole plant Final objective : safety strategy for the whole plant and design of the coupling system taking into account safety constraints Economical and technical background

4. Main reference assumptions Nuclear power (600 MWth) fully devoted to H2 production Around 10 H2 units (exact number still to determine) H2 Unit 1 1000°C H2 Unit 2 IHX1 IHX2 H2 Unit 3 Core 400°C H2 Unit 4 H2 Unit 5 He circulation VHTR containment Overall coupling Partial coupling of each H2 unit Brief presentation of the whole plant (VHTR/HYPP)

5. Main VHTR features Fuel : ceramic coated particles Moderator : Graphite Coolant : helium (400/1000°C) Large thermal inertia : intrinsic featureimproving safety H2production process with IS Cycle Presentation of VHTR and of IS process

6. Nuclear safety approach Specificities Fission product accumulation and decay heat to remove Short time constant for controlling the reactivity Solutions retained Presence of successive physical barriers Main safety function to protect the barriers (scram to fast control of reactivity) Defence in depth (DiD) concept (implemented in 5 levels)  Prevention of incidents and accidents and limitation of their consequences Conventional industry approach Main features Diversity of hazardous substances Diversity of accidental effects : toxics dispersion, pressure wave, heat flux, missiles,… Solutions retained Presence of at least one barrier associated to safety distances Assessment of safety distances resulting from scenario calculations of major representative accidents ; scenarios selected according their likelihood and their severity  Prevention of incidents and accidents and limitation of their consequences (DiD implicitly applied, and eventually SEVESO II Directive) Presentation of the safety approach (nuclear and conventional)

7. Main safety functions of the coupled facility control of the nuclear reactivity and of the chemical reactivity extraction of the nuclear power, of the thermal power (heat release by chemical reactions, phase changes) and of the mechanical power (compressors, pumps, pressure wave associated to phase changes or very rapid gas expansion due to heat release) confinement of hazardous substances : fission product and chemical substances Concept of Defence in Depth (DiD) Hierarchical deployment of different levels of equipment and procedures in order to maintain the effectiveness of physical barriers  if the provisions of a level fails to control the evolution of a sequence, the subsequent level will come into play  the levels are intended to be independent as far as possible  the general objective is aimed to prevent that a single failure at a level or even combinations of failures at different levels propagate and jeopardize DiD at subsequent levels Presentation of the safety approach (VHTR/HYPP) To prevent excessive loading of barriers To protect the barriers

8. Appropriate design rules Adapted to operating conditions and to chemical substances Thermodynamical nominal conditions and possible transients Corrosive substances (H2SO4, HI) Hydrogen embrittlement Tritium and Hydrogen diffusion (purity of H2) Solutions retained Materials foreseen to resist to corrosion (tantale, glass coated steels, ceramics, steel alloys,…) Barriers and/or purification system to prevent tritium from entering HYPP Rule of the art regarding engineering sizing for nuclear and process industries Provisions regarding parameter variations transmitted via the coupling system from HYPP to VHTR and vice versa Conditions to fulfill Keeping the two facility in their normal operating domain  energy exchanges with controlled P, T, Q Controlled hot Helium T to HYPP Controlled cold Helium T to VHTR Possible solutions matching coupled system behaviour  Phase changing temperature control (steam generator of JAERI)  Cold source of variable power for normal starting and shutdown transients Level 1 : Prevention of abnormal operation and failures

9. Objective To avoid that an excursion out of normal operating domain propagate to other facility or degenerate from incident to accident Abnormal operations could occur in nominal or transient regime Protection systems of level 3 must not be triggered at level 2 Solutions envisaged Simulation of coupled facilities to assess dynamic behaviour Definition of the limits of the normal operating domain Appropriate design of control system of the whole facility Scram of VHTR must be avoided Level 2 : Control of abnormal operation

10. Control of abnormal operation occurring in HYPP Level 2 : Control of abnormal operation

11. Control of abnormal operation occurring in VHTR HYPP should be able to match fluctuations coming from VHTR Due to high thermal inertia of VHTR core such an abnormal fluctuationshould be less probable than fluctuations induced by HYPP Abnormal energy supply from Helium must be controlled to avoid : Emergency shutdown of HYPP Spontaneous stopping of H2SO4 decomposition Solution envisaged Prevention and control of fluctuations based on VHTR control system design Three-way valves associated to ternary or secondary He recirculation loop Level 2 : Control of abnormal operation

12. Objectives of level 3, assuming that despite provisions of previous level, accidents can occur Remark : the accidents assumed here should be controlled within the design basis conditions and should not induce large leakages through the ultimate barrier nor induce significant domino effects control of accidents reach of a safe withdrawal state (safety functions fulfilled durably) uncoupled state of the facilities Fulfillment of safety functions Nuclear and chemical reactivity Emergency shutdown of VHTR (Control rod insertion)  Emergency shutdown of HYPP (cutoff of reactors feedings + inerting) Power extraction  Radiative and conductive extraction (cooled screens) of DH for VHTR  Pressure venting and equipment cooling in case of reaction runaway Level 3 : Control of accidents progression and limitation of their consequences

13. Fulfillment of safety functions Confinement function protection against external aggressions  dynamic confinement and double walls  isolating procedure for leaking part of circuit Role of the coupling system regarding safety functions  plays a role of barrier between the plant and the atmosphere and between VHTR and HYPP (IHXs wall and coupling/decoupling gates)  permits to control reactivity and extract power via VHTR/HYPP interfacial control and regulation of common parameters) Coupling system contributes to fulfill safety functions and is involved at least in level 1 to 3 of DiD. Therefore it must include redundancies and high reliability (classified ?) equipments Level 3 : Control of accidents progression and limitation of their consequences

14. Accidents relating to level 3 of DiD, prevention and protection measures Main accidents considered loss of supporting systems (electric, pneumatic, products evacuation)  failure or rupture of coupling system as an initiating event  DBA in VHTR  limited leakage without ignition in HYPP Prevention and protection :  Stand-by support systems to foresee (loss prevention)  Leak detection and equipment designed to prevent ignition of mixtures  emergency shutdown of VHTR and HYPP and uncoupling of VHTR and HYPP Particular case of cumulated rupture of IHX1 and IHX2 Depressurizing wave resulting from a breach on He circuit could induce simultaneous breaches in IHX1 and IHX2 due to high temperature and pressure difference Level 3 : Control of accidents progression and limitation of their consequences

15. Accidents relating to level 3 of DiD, prevention and protection measures Particular case of cumulated rupture of IHX1 and IHX2 Breach A or A’ : risk of corrosive and flammable substances ingress in VHTR containment Breach B or B’ : risk of radioactive materials ingress in HYPP Provisions aimed to control such accidents to avoid that they degenerate in severe accidents Emergency insulation gates of the coupling system (independent from others) Simulation of those accidents as DBA to determine reliability allocation for safety systems and IHXs Inerting provisions in the containment Level 3 : Control of accidents progression and limitation of their consequences

16. Objectives and accidents relating to level 4 of DiD Despite upstream levels of DiD, severe accidents are considered here  low probability sequences including multiple failures Complementary provisions are elaborated in order to limit the consequences of severe accidents, especially regarding the integrity or the by-pass of the last barrier : containment of VHTR, last wall and safety distance for HYPP (regarding VHTR and regarding the surrounding) Provisions to limit consequences of Domino effects due to the proximity of VHTR and HYPP Level 4 : Control of severe plant conditions and mitigation of severe accidents consequences

17. Investigation required to settle level 4 provisions Support studies to perform in order to assess the consequences of severe accidents and to verify if the probabilities/consequences permit to reach safety objectives Sizing of VHTR containment to a external pressure wave (less pessimistic approach than TNT equivalent method possibly to foresee) Possible provisions Reduction of energetic ignition sources Absence of confinement and obstacles (pipe agglomerate) to avoid flame acceleration Inerting or igniting systems in containment Venting systems, physical barrier between VHTR and HYPP (deflectors, distance, etc) Grounding of coupling system and/or VHTR Training of rescue teams and internal emergency plans Level 5  off-site response still to define Level 4 : Control of severe plant conditions and mitigation of severe accidents consequences

18. A safety approach based on the DiD has been proposed for the coupling of a VHTR witha hydrogen production plant by IS thermochemical cycle Extension of main safety functions adopted in nuclear reactors to the VHTR/HYPP coupled facilities The coupling system has been identified as an essential part of the safety architecture It takes a part of successive levels of DiD It contributes to fulfill the main safety functions Investigations (simulation end tests) are needed to understand the behaviour and the accidents of the coupled facilities and to design safety systems (coupling) and barriers taking into account accidents relating to each level of DiD CONCLUSIONS