ML22049B557

Kairos Power, LLC, Preliminary Safety Analysis Report

ML22049B557
Person / Time
Site:	Hermes File:Kairos Power icon.png
Issue date:	02/18/2022
From:	Kairos Power
To:	Office of Nuclear Reactor Regulation
Shared Package
ML22049B555	List: ML22049B556 ML22049B557 ML22049B558 ML22049B559
References
KP-NRC-2202-002
Download: ML22049B557 (66)

Text

Preliminary Safety Analysis Report The Facility Kairos Power Hermes Reactor 1-6 Revision 0 1.3 GENERAL DESCRIPTION OF THE FACILITY 1.3.1 Geographical Location The facility is located within the East Tennessee Technology Park (ETTP) in Oak Ridge, Tennessee. The facility latitude and longitude are provided in Section 2.1. The site location is illustrated in Figure 2.1-1.

1.3.2 Principal Characteristics of the Site The site consists of an area located in the northwestern portion of the Heritage Center within the ETTP (the ETTP consists of the Heritage Center, site of former uranium enrichment operations, and the Horizon Center Industrial Park). The property is at the site of the former Buildings K-31 and K-33 of the Oak Ridge Gaseous Diffusion Plant (ORGDP), where uranium enrichment operations occurred from 1954 until the mid-1980s. The overall site is an approximately 185 acre (74.8 hectare) parcel that had been used as farmland prior to the construction of the ORGDP. The site has since been restored to a brown field site by DOE and the former above-grade portions of the buildings were removed.

The site is entirely contained within the ETTP, Oak Ridge, Tennessee. The dominant land use in the site area is a brown field from the ORGDP site. Other operations in the site area are associated with DOE facilities, ongoing conversion of former DOE sites for commercial use, and various industrial activities.

Principal characteristics of the site are further described in Chapter 2.

1.3.3 Principal Design Criteria, Operating Characteristics, and Safety Systems 1.3.3.1 Principal Design Criteria The principal design criteria for the facility are described in Section 3.1. The principal design criteria for the facility are based on the criteria included in Kairos Power Topical Report KP-TR-003-NP-A (Reference 1).

1.3.3.2 Operating Characteristics The reactor is designed to achieve a reactor power of 35 MWth (design rated thermal power) and a planned operational lifetime of 10 years. The reactor parameters are provided in Table 4.1-1.

1.3.3.3 Safety Systems The facility is a fluoride salt-cooled, high temperature reactor. The design of the reactor and fuel are discussed in detail in Chapter 4. The primary heat transport system and primary heat rejection systemthe reactor coolant are addressed in Chapter 5. The safety-system classification is provided in Table 3.6-1.

1.3.4 Engineered Safety Features Engineered safety features (ESF) are SSCs of the facility designed to mitigate the consequences of postulated events. For the non-power reactor facility, the ESFs are related to the containment of fission products, and the passive removal of decay heat. The ESFs are described in Chapter 6.

1.3.5 Instrumentation, Control, and Electrical Systems The instrumentation and control (I&C) system monitors and controls plant operations during normal operations and planned transients. The system also monitors and actuates protection systems in the event of unplanned transients. The I&C system is comprised of the plant control system and the reactor protection system. The I&C system is discussed in Chapter 7.

The electrical system provides the normal and backup power to the facility. The electrical system is discussed in Chapter 8.

Preliminary Safety Analysis Report The Facility Kairos Power Hermes Reactor 1-8 Revision 0 1.3.9 Research and Development The requirements in 10 CFR 50.34(a) require that the PSAR identify those structures, systems or components of the facility that require additional research and development to confirm the adequacy of their design; and identification and description of the research and development program which will be conducted to resolve any safety questions associated with such structures, systems, or components; and a schedule of the research and development program showing that such safety questions will be resolved at or before the latest date stated in the application for completion of construction of the facility. Such additional development activities are described below:

Perform a laboratory testing program to confirm fuel pebble behavior (Section 4.2.1)

Develop a high temperature material surveillance sampling program for the reactor vessel and internals (Section 4.3.4)

Perform testing of high temperature material to qualify Alloy 316H and ER16-8-2 (Section 4.3)

Perform analysis related to potential oxidation in certain postulated events for the qualification of the graphite used in the reflector structure (Section 4.3)

Development and validation of computer codes for core design and analysis methodology (Section 4.5)

Develop a fluidic diode device (Section 4.6)

Justification of thermodynamic data and associated vapor pressure correlations of representative species. (Section 5.1.3)

Complete evaluations of the intermediate and reactor coolant chemical interaction (Section 5.1.3)

Develop process sensor technology for key reactor process variables (Section 7.5.3)

Develop the reactor coolant chemical monitoring instrumentation (Section 9.1.1) 1.3.10 References

1. Kairos Power LLC, Principal Design Criteria for the Kairos Power Fluoride Salt Cooled High Temperature Reactor, KP-TR-003-NP-A.

Preliminary Safety Analysis Report Site Characteristics Kairos Power Hermes Reactor 2-119 Revision 0 2.4.3 Credible Hydrological Events and Design Basis Based on the prior studies discussed above, the credible hydrological events for the siting and design of the Hermes reactor are set according to the site-specific study performed for the ETTP (Reference 2).

The credible hydrological event for the Hermes design basis is defined for a probability of 4x10-5 (25,000 year return period). This return period is appropriate for structures, systems, and components (SSCs) of Flooding Design Category 4 (FDC-4) (Reference 4). For such events, the design basis flooding level elevation at the Hermes site is El. 759.9 (5.1 feet below plant grade of 765.0 NAVD 88). The PMF is not used in the design basis of SSCs, however, a site-specific PMF analysis will be discussed with the application for an Operating License.

2.4.3.1 Design Bases for Flooding in Streams and Rivers The Hermes Design Basis Flood elevation is 759.9 ft.

2.4.3.2 Design Bases for Site Drainage The Hermes maximum flooding level for site drainage is set at El. 765.0 (plant grade), 5.1 feet above the 4x10-5 credible event flooding elevation.

2.4.3.3 Other Site Criteria Design Bases The Hermes site relies on the existing topography so that runoff water naturally drains to the east, south, and west with flow directed to the Clinch River arm of the Watts Bar Reservoir. The final grading plan of the Hermes site takes full advantage a favorable topography by employing a number of measures, including grading slopes and diversion ditches to divert runoff water to the Clinch River arm of the Watts Bar Reservoir on three sides of the plant. This results in minimal backwater effects at the safety-related portion of the Hermes reactor building during the local PMP event. Thus, no adverse impacts to the function of safety-related SSCs at the Hermes Site are expected during the design basis extreme flooding event and the local intense precipitation event. Detailed design of the site layout and facilities at the Hermes site, including the storm water drainage system will be conducted and the final site grading and site layout designed such that safety-related SSCs are able to function.

2.4.4 Groundwater As discussed in Section 2.5, subsurface investigations encountered groundwater at depths from 6.0 to 8.0 feet below the ground surface (ground surface at El. 765 NAVD 88).

2.4.5 Groundwater Contamination The primary and intermediate coolants for the Hermes reactor are is salt based and not water based.

Secondary support systems containing water (i.e., the Decay Heat Removal System and the Component Cooling Water System) could experience small amounts of tritiated water migration. Tritium contamination and the potential for liquid effluent releases from secondary support systems are monitored through periodic sampling and tritium concentration measurements in support system water inventory.

Tritium is controlled in the facility by the Tritium Management System (TMS) as described in Section 9.1.3. Total tritium inventory is monitored to comply with inventory limits set by the maximum hypothetical accident analysis assumptions and dose limits in 10 CFR 100.11. The TMS maintains a level of overall tritium capture capacity to minimize tritium releases from the plant and satisfy PDC 60.

Tritium releases in effluents are controlled within the effluent limits in 10 CFR 20.

Preliminary Safety Analysis Report Design of Structures, Systems, and Components Kairos Power Hermes Reactor 3-1 Revision 0 CHAPTER 3 DESIGN OF STRUCTURES, SYSTEMS, AND COMPONENTS

3.1 INTRODUCTION

This chapter identifies and describes the principal architectural and engineering design criteria for the structures, systems, and components (SSC) that are required to ensure reactor facility safety and protection of the public. The primary safety feature of the Hermes design is the unique combination of TRISO fuel and Flibe reactor coolant. Other safety-related systems support maintaining the fuel and coolant configuration within acceptable limits. These SSCs include the safety-related portion of the Reactor Building structure, the reactor vessel and internals, the reactor control and shutdown system, and the decay heat removal system.

3.1.1 Design Criteria Kairos Power is pursuing a construction permit and subsequent operating license for the Hermes reactor under 10 CFR 50. The NRC regulations in Title 10 to the CFR have been evaluated for applicability to this facility and the results are contained in the Regulatory Analysis for the Kairos Power Fluoride Salt-Cooled, High Temperature Reactor topical report (Reference 1). The design related regulations that that are addressed by this preliminary safety evaluation report (PSAR) are summarized in Table 3.1-1 and addressed throughout this safety analysis report. In addition, this topical report identified regulations for which exemption were needed. These exemptions are identified in this safety analysis report in their applicable sections and are summarized in Table 3.1-2.

Kairos Power has also developed a set of principal design criteria (PDC) applicable for the KP-FHR technology which has been reviewed and approved by the NRC in Principal Design Criteria for the Kairos Power Fluoride Salt-Cooled High Temperature Reactor (Reference 2). The application of these criteria to the SSCs of the test reactor are shown in Table 3.1-2. The site contains only one reactor, with no SSCs shared with another reactor unit, which satisfies PDC 5. Specific details regarding how the other PDC are met by the design are described in the individual sections throughout this safety analysis report and summarized in Table 3.1-3. PDC 73 is not applicable to the Hermes reactor because it does not use a secondary coolant fluid. As described in Section 5.1, the heat rejection pathway is directly from the primary coolant to air.

Note that several of the PDCs in KP-TR-003 contain the terms safety significant, anticipated operational occurrences, and accidents. These terms are not applicable to the Hermes reactor and are not used in this safety analysis report, which represents a departure from the approved topical report. These terms are relevant to power reactors, which use frequency to bin postulated events. In the non-power reactor licensing framework, Guidelines for Preparing and Reviewing Applications for the Licensing of Non-Power Reactors (NUREG-1537), the postulated events in the design basis are treated the same, regardless of frequency. Consistent with 10 CFR 50.2 (as modified - See Section 1.2.3), SSCs that are relied upon to mitigate the postulated events are classified as safety-related and a significance determination is not made in this framework. There are only two SSC classifications used in this safety analysis report for the Hermes reactor: safety-related and non-safety related. PDCs 1, 2, 3, 4, 5, 13, 14, 15, 16, 17, 18, 20, 28, 31, 32, 33, 34, 44, 61, 71, 73, 75, and 77 use the term safety significant. For these PDCs, the term safety significant is replaced in this safety analysis report with safety-related.

Additionally, PDCs 10, 13, 15, 17, 20, 26, 29, 34, 60, 64, and 73 use the term Anticipated Operational Occurrences. Since there is no distinction between AOOs and accidents in the non-power reactor licensing framework (NUREG-1537), the AOO terminology (including language that differentiates between AOOs and accidents) is replaced by "postulated events in this safety analysis report for the

Preliminary Safety Analysis Report Design of Structures, Systems, and Components Kairos Power Hermes Reactor 3-7 Revision 0 Principal Design Criteria SAR Section PDC 26, Reactivity control systems 4.2.2 4.5 PDC 28, Reactivity limits 4.2.2, 7.3 PDC 29, Protection against anticipated operation occurrences 4.2.2, 7.3, 7.5 PDC 30, Quality of reactor coolant boundary 4.3 PDC 31, Fracture prevention of reactor coolant boundary 4.3 PDC 32, Inspection of reactor coolant boundary 4.3 PDC 33, Reactor coolant inventory maintenance 9.1.4 PDC 34, Residual heat removal 4.6, 6.3 PDC 35, Passive residual heat removal 4.3, 4.6, 6.3 PDC 36, Inspection of passive residual heat removal system 6.3 PDC 37, Testing of passive residual heat removal system 6.3 PDC 44, Structural and equipment cooling 9.1.5, 9.7 PDC 45, Inspection of structural and equipment cooling systems 9.1.5, 9.7 PDC 46, Testing of structural and equipment cooling systems 9.1.5, 9.7 PDC 60, Control of releases of radioactive materials to the environment 5.1, 5.2, 9.1.3, 9.2, 11.2 PDC 61, Fuel storage and handling and radioactivity control 9.3 PDC 62, Prevention of criticality in fuel storage and handling 9.3 PDC 63, Monitoring fuel and waste storage 9.3, 11.2 PDC 64, Monitoring radioactivity releases 9.1.2, 9.1.3, 9.2 PDC 70, Reactor coolant purity control 5.1, 9.1.1 PDC 71, Reactor coolant heating systems 9.1.5 PDC 73, Reactor coolant system interfaces 5.2Not Applicable

Preliminary Safety Analysis Report Design of Structures, Systems, and Components Kairos Power Hermes Reactor 3-21 Revision 0 3.5 PLANT STRUCTURES 3.5.1 Description of Plant Structures Figure 2.1-3 shows the location and orientation of the Reactor Building on the site. The building is approximately 250 ft long and 100 ft wide. A portion of the Reactor Building provides protection to safety-related SSCs from the effects of natural phenomena and external event hazards discussed in Sections 3.2, 3.3, and 3.4. Figure 3.5-1 shows the principal structural elements of the Reactor Building.

The figure also shows the portion of the safety-related Reactor Building structure, which uses base isolation, and the non-safety related balance of the Reactor Building surrounding the isolated superstructure.

The foundation for the safety-related portion of the building is a below-grade mat slab. The base isolation system is supported by the foundation and is located in an accessible basement beneath the isolated superstructure. The isolators are supported concrete pedestals and interlinking shear walls in the basement. Isolators will be spring-dashpot elements (e.g., GERB base control system (BCS) isolators).

The foundation, isolation system, and associated structural elements form the substructure of the safety-related portion of the building.

The isolation substructure supports the basemat of the safety-related superstructure and the superstructure itself. The superstructure is a reinforced concrete structure that is a hybrid of cast-in-place and precast concrete structural elements. A moat provides seismic separation between the safety-related portion of the Reactor Building and the non-safety portion and is large enough to accommodate the seismic displacements of the isolators.

The safety-related portion of the Reactor Building is divided into cells. The cells contain all the safety-related SSCs in the facility and some non-safety related SSCs. One cell contains the reactor cavity, the decay heat removal system, the reactivity control and shutdown system, and the intermediate heat exchangerheat rejection radiator. Another contains the pebble handling and storage system, and other safety-related support SSCs.

The non-safety related portion of the Reactor Building is highlighted in Figure 3.5-1 and is comprised of a maintenance hall including a high-bay shell, maintenance corridors, truck bay, and auxiliary worker inhabited areas. It is a steel frame construction with an independent foundation system consisting of a mat slab with grade beams. This non-safety related portion of the Reactor Building does not contain any safety-related SSCs. This portion of the building is designed so that its failure does not interfere with safety functions of SSCs located in the safety-related portion of the building or the safety-related portion of the Reactor Building.

The top part of the Reactor Building is a high bay through which a gantry crane moves. The crane is supported by the non-safety related portion of the Reactor Building. As mentioned in Section 3.2.4, the roof of the non-safety related portion of the building is sloped using either an arch or a slant so that accumulation of water and ice does not result in significant loads. The image in Figure 3.5-1 shows an exterior roof that is slanted.

Other buildings on the site do not contain safety-related SSCs and serve no safety-related function. This includes the Main Control Building. The Main Control Building is a stand-alone building on the site that contains the plant control system and reactor protection system human system interface consoles.

There are no postulated events in the safety analyses described in Chapter 13 that rely on operator actions credited for implementing a safety function to maintain doses below limits. The Main Control Building does not serve a safety-related function, but does provide the location for operators to perform normal operational duties and to support monitoring capabilities after postulated events.

Preliminary Safety Analysis Report Design of Structures, Systems, and Components Kairos Power Hermes Reactor 3-28 Revision 0 Figure 3.5-1: Schematic of the Reactor Building

Preliminary Safety Analysis Report Design of Structures, Systems, and Components Kairos Power Hermes Reactor 3-29 Revision 0 3.6 SYSTEMS AND COMPONENTS This section describes the design bases for the systems and components required to function for safe reactor operation and shutdown. Section 3.6.1 describes the safety functions performed by safety-related SSCs and Section 3.6.2 describes how SSCs are classified.

3.6.1 General Design Basis Information The SSCs relied upon in the safety analysis to mitigate the consequences of postulated events serve one or more of the three fundamental safety functions listed below.

Prevent uncontrolled release of radionuclides Remove decay heat in the event of a postulated event Control reactivity in the reactor core Section 3.6.2 describes the safety classifications of SSCs based on performance of one of the functions in the fundamental safety functions listed above. Table 3.6-1 identifies the safety classification of SSCs within a system. Note that not all SSC within a system may be safety-related.

3.6.1.1 Prevention of Uncontrolled Release of Radionuclides The reactor design employs a high-temperature graphite-matrix coated TRISO particle fuel and a chemically stable, low-pressure, molten fluoride salt coolant. These features provide a functional containment (see Section 6.2) which is relied on as a means of retaining fission products and limiting the release of radionuclides to the environment during normal operations and postulated events. The elements of the functional containment for fuel in the reactor core include the TRISO fuel particles three layers (IPyC, SiC, and OPyC) surrounding the fuel particles, and the chemical properties of the reactor coolant (Flibe). The design of the TRISO fuel pebbles is discussed in Section 4.2 and the reactor coolant is discussed in Section 5.1.

Other SSCs support the ability of the functional containment strategy for fuel in the reactor core to limit the release of radionuclides during postulated events. These supporting safety-related systems are:

The reactor protection system (RPS) ensures that pebble extraction and insertion via the pebble handling and storage system (PHSS) is deactivated upon a reactor trip so pebbles are no longer removed from or added to the reactor core. RPS also stops operation of the primary salt pump (PSP) and intermediate salt pump (ISP) to ensure level of Flibe remains constant in the reactor core and that pebbles in the core remain covered in Flibe. See Section 7.3 for a description of the RPS.

The reactor vessel and internals provide structural support and form the reactor core region which maintains the TRISO pebbles in a coolable geometry within the core where they remain covered with Flibe. This includes the graphite reflector which contributes to providing a coolable geometry within the core. See Section 4.3 for a description of the reactor vessel and internals.

The safety-related portion of the Reactor Building is designed to provide protection for the functional containment from the effects of natural phenomena on the reactor vessel and associated safety-related SSCs. The safety-related portion of the Reactor Building is also designed to prevent interactions between Flibe and water. No portion of the Reactor Building is credited to perform a fission product containment function in the Chapter 13 safety analysis. See Section 3.5 for a description of the Reactor Building structure.

Fuel outside the reactor core is located in the PHSS. Fuel pebbles in the PHSS are not submerged in reactor coolant. Therefore, the TRISO layers in the fuel particles provide functional containment while pebbles are in the PHSS such that radionuclides are contained within the particles for postulated events.

Preliminary Safety Analysis Report Design of Structures, Systems, and Components Kairos Power Hermes Reactor 3-35 Revision 0 SSC Name Safety Classification Seismic Classification Quality Program SAR Section Plant Area DHRS Make-up Water SSCs Non-safety related SDC-2 Not Quality-Related 6.3 SR and NSR areas Pebble Handling and Storage System (PHSS)

New Pebble Insertion SSCs Non-safety related SDC-2 Not Quality-Related 9.3 SR and NSR areas Pebble Extraction Machine Non-safety related SDC-2 Not Quality-Related 9.3 SR area Pebble Processing SSCs Non-safety related SDC-2 Not Quality-Related 9.3 SR area Pebble Inspection SSCs Non-safety related SDC-2 Not Quality-Related 9.3 SR area Debris Removal SSCs Non-safety related SDC-2 Not Quality-Related 9.3 SR and NSR areas Pebble Insertion Machine Non-safety related SDC-2 Not Quality-Related 9.3 SR area Full Core Offload and Spent Fuel Storage Rack Safety-related SDC-3 Quality-Related 9.3 SR area Canister Transporter Non-safety related SDC-2 Not Quality-Related 9.3 SR area Spent Fuel Air Cooled Storage Rack Safety-related SDC-3 Quality-Related 9.3 SR area Spent Fuel Storage Canisters Non-safety related SDC-2 Not Quality-Related 9.3 SR area Primary Heat Transport System (PHTS)

Primary Salt Pump Non-safety related SDC-2 Not Quality-Related 5.1.1 SR area Primary Heat ExchangerHeat Rejection Subsystem Non-safety related SDC-2 Not Quality-Related 5.1.1 SR area Primary Loop Piping System Non-safety related SDC-2 Not Quality-Related 5.1.1 SR area Primary Loop Auxiliary HeatingThermal Management Non-safety related SDC-2 Not Quality-Related 5.1.1 SR area Reactor Coolant Safety-related N/A Quality-Related 5.1.1 SR area

Preliminary Safety Analysis Report Design of Structures, Systems, and Components Kairos Power Hermes Reactor 3-36 Revision 0 SSC Name Safety Classification Seismic Classification Quality Program SAR Section Plant Area Primary Heat Rejection System (PHRS)

Intermediate Salt Pump(s)

Non-safety related SDC-2 Not Quality-Related 5.2 NSR area Intermediate Loop Piping System Non-safety related SDC-2 Not Quality-Related 5.2 SR and NSR areas Heat Rejection System Non-safety related SDC-2 Not Quality-Related 5.2 NSR area Intermediate Loop Auxiliary Heating System Non-safety related SDC-2 Not Quality-Related 5.2 SR and NSR areas Intermediate Coolant Inventory Management SSCs Non-safety related SDC-2 Not Quality-Related 5.2 SR and NSR areas Intermediate Coolant Chemistry Control SSCs Non-safety related SDC-2 Not Quality-Related 5.2 SR and NSR areas Intermediate Coolant Non-safety related N/A Not Quality-Related 5.2 SR and NSR areas Reactor Auxiliary Systems Chemistry Control System Non-safety related SDC-2 Not Quality-Related 9.1.1 SR area Inert Gas System Non-safety related SDC-2 Not Quality-Related 9.1.2 SR and NSR areas Tritium Management System Non-safety related SDC-2 Not Quality-Related 9.1.3 SR and NSR areas Inventory Management System Non-safety related SDC-2 Not Quality-Related 9.1.4 SR area Instrumentation and Control Systems Reactor Protection System, including field sensors, cabinets and associated wiring Safety-related SDC-3 Quality-Related 7.1 7.5 SR area

Preliminary Safety Analysis Report Reactor Description Kairos Power Hermes Reactor Revision 0 4-28 4.3 REACTOR VESSEL SYSTEM 4.3.1 Description This section provides an overview of the reactor vessel system (see Figure 4.3-1) which includes the reactor vessel and the reactor vessel internals. The reactor vessel forms a major element of the reactor coolant boundary and the inert gas boundary. The reactor vessel and vessel internals define the flow path for reactor coolant and fuel into the core. The reactor vessel system contains the reactor core and provides for circulation of reactor coolant and pebbles as well as insertion of the reactivity control and shutdown elements through the reactor core.

The reactor vessel system provides a flow path for reactor coolant to transfer heat from the reactor core to the primary heat transport system (PHTS) during normal operations. The reactor coolant enters the reactor vessel through two side inlet nozzles and flows downward through a downcomer annulus formed between the metallic core barrel and the reactor vessel shell. Coolant flow moves through the reflector support structure and is distributed into the core by the design of the reflector blocks. Upon exiting the core, the coolant leaves the reactor vessel via the primary salt pump (PSP) (see Section 5.1.1) which draws suction directly from a pool of reactor coolant above the core and inside the vessel. An anti-siphon feature is provided to limit loss of vessel inventory in the event of a break in the PHTS.

The reactor vessel system also provides a flow path for pebbles to allow online refueling and defueling of the reactor core by the pebble handling and storage system (PHSS) (Section 9.3) during normal operation. The PHSS inserts pebbles into the reactor vessel and delivers them to the fueling chute below the reactor core by the pebble insertion line (Section 9.3.1). The buoyant pebbles float upward, and pebbles inserted via the insertion line will join the packed pebble-bed in the reactor core. Upon circulating through the core, the pebbles accumulate in the de-fueling chute at the top of the reactor core. The pebble extraction machine (PEM) (Section 9.3.1) at the top of the reactor core removes pebbles from the reactor vessel (see Figure 4.3-2.)

During postulated events when the PHTS and the primary heat rejection system (PHRS) areis not available, the reactor vessel provides an alternative flow path as discussed in Section 4.6.1 to allow natural circulation of the reactor coolant to remove heat from the reactor core. The reactor coolant leaving the core flows back into the downcomer annulus via fluidic diodes. The heat from the core is transferred to the reactor vessel shell which transfers the heat to the decay heat removal system (DHRS)

(Section 6.3).

The reactor vessel system interfaces with fuel (Section 4.2.1), primary heat transport system (PHTS)

(Section 5.1), reactivity control and shutdown system (RCSS) (Section 4.2.2), reactor vessel support system (RVSS) (Section 4.7), decay heat removal system (DHRS) (Section 6.3), pebble handling and storage system (PHSS) (Section 9.3), reactor thermal management system (RTMS) (Section 9.1.5), inert gas system (IGS) (Section 9.1.2), inventory management system (IMS) (Section 9.1.4), and instrumentation and controls (Chapter 7).

4.3.1.1 Reactor Vessel The reactor vessel is a vertical cylinder design with flat top and bottom heads. The vessel houses the reactor vessel internals. The reactor vessel shell and bottom head provide a major element of the reactor coolant boundary. The vessel is constructed of 316H stainless steel (SS) with ER16-8-2 weld metal and is designed and fabricated per ASME BPVC Section III, Division 5 (Reference 1). It contains the inventory of reactor coolant such that the reactor core is covered by the coolant during normal operation and postulated event. There are no penetrations or attachments to the vessel below the

Preliminary Safety Analysis Report Reactor Description Kairos Power Hermes Reactor Revision 0 4-37 4.4 BIOLOGICAL SHIELD 4.4.1 Description The biological shield forms a barrier to protect plant workers and the public from radiological exposure.

In addition, the biological shield reduces radiation damage to plant equipment and also reduces the potential for Beryllium exposure to reactor personnel. The shielding provided by the biological shield is sufficient to meet the radiation exposure goals described in Chapter 11. The biological shield accomplishes this shielding primarily using reinforced concrete.

There are two biological shields in the design, a primary biological shield and a secondary biological shield. The primary biological shield is constructed of concrete and is located just outside the reactor vessel. The secondary biological shield is located outside the primary biological shield and contains the inventory management and the primary to intermediate heat transfer systemsprimary heat transport system. A notional representation of the primary and secondary biological shields is shown in Figure 4.4-

1.

4.4.2 Design Bases The biological shield is provided for worker protection to meet 10 CFR 20 requirements and is not credited in the prevention or mitigation of postulated events. However, the primary biological shield is a safety-related structure and remains intact during normal operation and postulated events. The structural design bases are described in Chapter 3.

4.4.3 Evaluation An evaluation of the shielding performance of the biological shield to meet 10 CFR 20 will be provided with the application for an Operating License.

Preliminary Safety Analysis Report Reactor Description Kairos Power Hermes Reactor Revision 0 4-38 Figure 4.4-1: Primary and Secondary Biological Shield

Preliminary Safety Analysis Report Reactor Description Kairos Power Hermes Reactor Revision 0 4-53 4.6 THERMAL-HYDRAULIC DESIGN 4.6.1 Description The thermal hydraulic design of the reactor is a combination of design features that enable effective heat transport from the fuel pebble to the reactor coolant and eventually to the heat rejection system of the reactor, considering the effects of bypass flow and flow non-uniformity. The design features that play a key role in the thermal-hydraulic design of the reactor system include the fuel pebble (see Section 4.2.1), reactor coolant (see Section 5.1), reactor vessel and reactor vessel internal structures (see Section 4.3), and the primary heat transport system (PHTS) (see Section 5.1), and the primary heat rejection system (PHRS) (see Section 5.2).

4.6.1.1 Core Geometry The core geometry is maintained in part by the reactor vessel internals including the reflector blocks which keep the pebbles in a general cylindrical core shape. Coolant inlet channels in the graphite reflector blocks are employed to limit the core pressure drop. The use of pebbles in a packed bed configuration also creates local velocity fields that enhance pebble-to-coolant heat transfer. The reactor thermal hydraulic design uses the following heat transfer mechanisms to extract the fission heat.

Pebble-to-coolant convective heat transfer Pebble radiative heat transfer Pebble-to-pebble heat transfer by pebble contact conduction Pebble-to-pebble heat transfer by conduction through the reactor coolant Heat transfer to the graphite reflector by modes of conduction, convection, and radiation.

4.6.1.2 Coolant Flow Path During normal operation, reactor coolant at approximately 550°C enters the reactor vessel from two PHTS cold leg nozzles and flows through a downcomer formed between the metallic core barrel and the reactor vessel shell as shown in Figure 4.6-1. The coolant is distributed along the vessel bottom head through the reflector support structure, up through coolant inlet channels in the reflector blocks and the fueling chute and into the core with a portion of the coolant bypassing the core via gaps between the reflector blocks. The coolant transfers heat from fuel pebbles which are buoyant in the coolant and provides cooling to the reflector blocks and the control elements via engineered bypass flow. Coolant travels out of the active core through the upper plenum via the coolant outlet channels and exits the reactor vessel via the PHTS outlet. The maximum vessel exit temperature is 620°C and dependent on the amount of corresponding bypass flow through the reflector blocks.

During postulated events where the normal heat removal path through the PHTS is no longer available, including when the PHTS is drained, a fluidic diode (see Section 4.3), is used to create an alternate flow path. During such events, forced flow from the primary salt pump (PSP) is also not available. The fluidic diode then directs flow from the hot well to the downcomer as shown in Figure 4.6-1. This opens the path for continuous flow via natural circulation. During normal operation, while the PSP is in operation, the fluidic diode minimizes reverse flow.

4.6.2 Design Basis Consistent with PDC 10, the thermal-hydraulic design provides adequate transfer of heat from the fuel to the coolant to ensure that the specified acceptable system radionuclide release design limits (SARRDLs) will not be exceeded during normal operation and unplanned transients.

Preliminary Safety Analysis Report Reactor Description Kairos Power Hermes Reactor Revision 0 4-54 Consistent with PDC 12, the thermal hydraulic design of the reactor system ensures that power oscillations that can result in conditions exceeding SARRDLs are not possible or can be reliably and readily detected and suppressed.

Consistent with PDC 34, the thermal hydraulic design removes residual heat during normal operation and anticipated transients, such that SARRDLs and the design conditions of the safety-related elements of the reactor coolant boundary are not exceeded.

Consistent with PDC 35, the reactor transfers heat from the reactor core during anticipated transients such that fuel and reactor internal structure damage that could interfere with continued effective core cooling is prevented.

4.6.3 System Evaluation The reactor core and heat removal systems associated with the thermal hydraulic design of the reactor system have appropriate margin to ensure that SARRDLs are not exceeded during any condition. The height of the core (e.g., height of the downcomer) and the axial decay heat profile (e.g., the temperature difference between the hot leg and the cold leg) ensure there is sufficient driving force to enable natural circulation in the event of a loss of forced circulation. Pressure losses are also minimized by design to ensure that heat is transferred from the coolant in the downcomer below the fluidic diode to the vessel shell during a loss of forced circulation event. Due to buoyancy forces, hot fluid coming out from the fluidic diode path into the downcomer will flow downward as a plume, which enhances heat removal from the vessel shell above the elevation of the fluidic diode. A summary of pertinent thermal-hydraulic parameters is provided in Table 4.6-1. These features and analyses demonstrate conformance to PDC 10 with respect to thermal hydraulic design.

The thermal hydraulic design of the reactor system inherently prohibits instability phenomena that could exceed SARRDLs. The reactor is kept at atmospheric pressure; the coolant in the core does not experience two phase flow and has a high thermal inertia making the reactor restrictive to core-wide thermal-hydraulic instability events. This demonstrates compliance with PDC 12 with respect to the thermal hydraulic design. The results of analyses supporting the inherent stability of the reactor will be provided with the application for an Operating License.

The thermal hydraulic design of the reactor system provides residual heat removal during normal operations, including startup and shutdown. During normal operations, the thermal hydraulic design of the reactor in conjunction with forced flow in the PHTS and PHRS ensures the transfer and rejection of heat from the core via the coolant flow path as described in Section 4.6.1.2. The relationship between power and flow of the thermal hydraulic system as well as the thermal inertia of the coolant ensures that heat transfer can be achieved at a rate that maintains the design conditions of the core. These features demonstrate conformance to PDC 34 with respect to thermal hydraulic design.

The thermal hydraulic design of the reactor supports passive residual heat removal following postulated events. The design of the reactor hot well, downcomer and the fluidic diode provide a path for continuous flow to ensure decay heat is transferred via natural circulation from the core to the reactor vessel shell, as described in Section 4.6.1.2. These features, in part, demonstrate compliance with PDC 35. Residual heat is removed from the vessel wall by the DHRS as described in Section 6.3.

4.6.4 Testing and Inspection Reactor coolant temperatures, flow, and core power will be periodically monitored during operations to be within specified limits. Instrumentation will also be periodically calibrated.

Preliminary Safety Analysis Report Heat Transport Systems Kairos Power Hermes Reactor 5-1 Revision 0 CHAPTER 5 HEAT TRANSPORT SYSTEMS 5.1 PRIMARY HEAT TRANSPORT SYSTEM 5.1.1 Description The primary heat transport system (PHTS) transfers heat from the reactor core by circulating reactor coolant between the packed bed of fuel elements (pebbles) and reflector in the reactor core and the primary heat rejection subsystem (PHRS) (Section 5.2) during normal operations. The PHTS includes a primary salt pump (PSP), the a primary heat exchanger (PHX),heat rejection subsystem and associated piping. The heat rejection subsystem includes a heat rejection radiator (HRR), heat rejection blower, and associated ducting. The PHTS also includes capability for primary loop auxiliary heatingthermal management features to maintain the reactor coolant in the liquid phase when the reactor core is not generating heat, and capability to drain external piping and the PHX HRR to allow cooldown, inspection, and maintenance. A process flow diagram of the PHTS is provided in Figure 5.1-1. The key design parameters for the PHTS are provided in Table 5.1-1.

The primary system functions of the PHTS are non-safety related and include the following:

Transport heat from the reactor core to the PHRS ultimate heat sink (UHS - environmental air) to support nuclear heat generation and transport.

Contain and direct the reactor coolant flow between the reactor vessel and the heat rejection subsystem.

Manage thermal transients (overall thermal balance) occurring as part of normal operations.

Support residual heat removal function during normal shutdown.

Support void fraction limits in the reactor coolant flow through gas separation features, where applicable.

Accommodate thermal expansion of the system and components in transitioning between the temperature at assembly and operation, and during transients.

Circulate trace heated coolant during periods when fission heat is not sufficient to ensure minimum acceptable temperatures in the PHTS, including initial heat-up.

Provide capability to drain the PHTS to reduce parasitic heat loss during over-cooling transients.

Maintain the reactor coolant pressure in the PHX above the PHRS coolant pressure under normal operating or transient conditions until the PHX is drained.

Prevent forced air ingress by the heat rejection subsystem blower when the PSP is not operating Support reactor power level transitions (ramp up and ramp down in power).

Provide for in-service inspection, maintenance, and replacement activities.

The PHTS interfaces with the reactor thermal management system, inert gas system, tritium management system, inventory management system, and the instrumentation and control system.The PHTS interfaces with multiple systems including the reactor systems (e.g., reactor vessel, reactor startup system, and thermal management system), the reactor coolant auxiliary systems (e.g., chemistry control system, inert gas system, and inventory management system), the instrumentation and control system (e.g., reactor protection system), the plant auxiliary systems (e.g., radiation monitoring system, fire protection system, and remote maintenance and inspection system), the electrical system (e.g., backup power system and normal power system) and civil structures systems and components (e.g., plant site and reactor building). These systems are described in Chapters 4, 7, and 9.

The design of the PHTS ensures that the reactor coolant is maintained at a positive pressure differential with respect to the PHRS during normal operation or transient conditions, until the PHX is drained. This

Preliminary Safety Analysis Report Heat Transport Systems Kairos Power Hermes Reactor 5-2 Revision 0 ensures that potential reactor coolant leakage from the PHX is driven into the PHRS to maintain control of reactor coolant chemistry and physical properties.

The primary components of the PHTS are described in the following subsections.

5.1.1.1 Reactor Coolant The reactor coolant is a chemically stable, molten mixture of fluorine, lithium, and beryllium (Flibe). A description of the reactor coolant material composition, coolant quality requirements, Flibe impurities, and thermophysical properties is provided in the Reactor Coolant for the Kairos Power Fluoride Salt-Cooled High Temperature Reactor Topical Report KT-TR-005 (Reference 5.1-1). The reactor coolant performs safety functions associated with reactivity control and fission product retention. The composition of the reactor coolant also enables the reactor core to be designed with a negative coolant temperature coefficient of reactivity. This provides a safety benefit supporting reactivity control, low parasitic neutron absorption for effective fuel utilization, and minimal short-term and long-term activation of the coolant for improved operations and maintenance. The reactor coolant also serves as a fission product barrier providing retention of fission products that escape the fuel particle and fuel pebble barriers for fuel in the reactor core. This additional retention capability contributes to the functional containment and enhanced safety. The circulating activity of the reactor coolant is sampled (see Section 9.1.1) to remain within limits established in the technical specifications.

5.1.1.2 Primary Salt Pump The PSP is a variable speed, cartridge style pump located on the reactor vessel head that controls system flow rate and pressure in the PHTS under normal operation. The PSP circulates the reactor coolant between the reactor core, where the Flibe is heated as it contacts with the fuel, and the PHX HRR where the heat is transferred to the PHRSambient air. PHTS flow rates are varied based on the operating power of the reactor.maintaining a specified temperature change across the core as thermal output changes and maintaining positive pressure differential between the primary and intermediate coolants in the PHX. The design of the PSP operates continuously at full thermal power flow rates and temperatures, as well as at reduced power and flow rates.

The cantilever pump design extends the shaft down into the reactor coolant while keeping the bearings and seals in a lower temperature region above the coolant. The pump flow discharges horizontally above the reactor vessel head and has a high-point vent that is used for vacuum fill. The pump has a positive pressure inert gas space with a purge gas flow which discharges into to the reactor vessel cover gas space. The pump motor rotor is directly mounted on the shaft and operates in the cover gas environment, eliminating the need for conventional shaft seals and providing a hermetic boundary for cover gas. The inert gas system is described in Section 9.1.2.

The design of the pump suction controls and prevents entrainment of cover gas at normal submergence levels. Residual gas in the PHTS at start up is removed by de-entrainment locations in the upper reflector. The pump casing design sets the inlet elevation of the anti-siphon surface for the hot leg should a leak occur in the external portion of the PHTS, and for when the external PHTS piping is drained. The anti-siphoning function is described in Section 4.3.

5.1.1.3 Primary Heat ExchangerHeat Rejection Subsystem The heat rejection subsystem provides for heat transfer from the reactor coolant to the atmosphere.

Within the heat rejection subsystem, The the PHX HRR serves as the heat transfer interface and coolant boundary between the PHTS and PHRSfor this function. The PHX heat rejection subsystem does not perform any safety-related functions. The reactor coolant is circulated from the PSP outlet nozzle

Preliminary Safety Analysis Report Heat Transport Systems Kairos Power Hermes Reactor 5-3 Revision 0 through the primary piping before it enters the PHXHRR, where the heat is transferred from the reactor coolant to intermediate coolant on the cooling sideair.

The heat rejection subsystem consists of the HRR, heat rejection blower, and associated ducting and thermal management. The reactor coolant enters the PHX HRR at approximately 600-650°C and leaves the PHX HRR at approximately 550°C during normal, steady-state operation at full power. After transferring its heat, the reactor coolant leaves the outlet nozzle of the PHX HRR and is returned to the inlet nozzle of the reactor vessel. The air passing through the heat rejection subsystem heats up and leaves the plant via a stack.

The heat rejection subsystem blower is tripped concurrent with the PSP to prevent forced air ingress during postulated HRR tube failures.

The PHX design and location assures that a positive pressure differential is maintained between the reactor coolant and intermediate coolant under all normal operation and normal transient conditions, so that tube leakage is from the PHTS to the PHRS. The PHX is located at an intermediate elevation between the reactor vessel coolant free surface and the PHRS coolant free surface to assure positive pressure differential due to hydrostatic head under shut down conditions. PHTS and PHRS pump speeds are controlled to maintain positive pressure differential under all normal operating modes. A pressure differential measurement between the PHX intermediate coolant inlet pressure (highest intermediate coolant pressure) and reactor coolant outlet pressure (lowest reactor coolant pressure) monitors for positive pressure differential and initiates trips of the PHTS and PHRS pumps if the differential falls below a predetermined limit.The thermal management function provides non-nuclear heating to the heat rejection subsystem to keep the reactor coolant above its melting temperature during various operations, including filling, power operations, and draining.

5.1.1.4 Primary Loop Piping The primary loop piping consists of the interconnecting piping and small components not specifically allocated within the other architectural elements. This includes cross connection piping, valves, and interfaces with the inventory management system.

The primary loop piping does not perform any safety-related functions and is not credited to mitigate the consequences of postulated events.

The PHTS piping is designed to the ASME B31.3 Code and accommodatesaccommodate the reactor coolant temperature, pressure, and corrosion properties. The section of piping from the PSP discharge to the PHX inletsHRR inlet is termed the hot leg and the section of piping from the PHX outletsHRR outlet to the reactor vessel inlet is termed the cold leg. An anti-siphon feature is implemented in the design that can break the siphon from the reactor vessel if a leak in the PHTS occurs. This feature is discussed in Section 4.3.

5.1.1.5 Primary Loop Auxiliary HeatingThermal Management The auxiliary heating functionthermal management feature provides non-nuclear heating and insulation to the PHTS as needed for various operations including initial coolant melt, plant startup and shutdown, and supplemental heating during normal operation. Auxiliary This auxiliary heating maintains the PHTS piping at or and PHX above the trace heating setpoint temperature. The source of the heat depends on the subsystem or component requiring the heat. For example, electrical heating is used in some areas of the plant that would be susceptible to coolant freezing with the use of insulation alone. Sufficient heating is provided to maintain reactor coolant temperature in external piping and PHX above freezing throughout the filling, operation, and draining processes.

Preliminary Safety Analysis Report Heat Transport Systems Kairos Power Hermes Reactor 5-4 Revision 0 5.1.1.6 Normal Shutdown Cooling The PHTS provides normal shutdown cooling following plant trips. The transition from power operation to normal shutdown cooling involves a programed rundown of the PSP and intermediate salt pump speeds, to minimize the thermal transient experienced by the reactor vessel and PHTSprogrammed transition of air and reactor coolant flowrates from those required for full power operation to those required for residual heat removal. Normal shutdown cooling uses the PHRSHRR air effluent as the heat sink.

5.1.2 Design Basis Consistent with PDC 2, the safety-related SSCs located near the PHTS are protected from the adverse effects of postulated PHTS failures during a design basis earthquake.

Consistent with PDC 10, the design of the reactor coolant supports the assurance that specified acceptable system radionuclide release design limits (SARRDLs) are not exceeded during any condition of normal operation, as well as during any unplanned transients.

Consistent with PDC 12, the design of the reactor coolant, in part, ensures that power oscillations cannot result in conditions exceeding specified acceptable SARRDLs.

Consistent with PDC 16, the design of the reactor coolant, in part, provides a means to control the release of radioactive materials to the environment during postulated events as part of the functional containment design.

Consistent with PDC 60, the design of the PHTS supports the control of radioactive materials during normal reactor operation.

Consistent with PDC 70, the design of the PHTS support the purity control of the primary coolant by limiting air ingress.

Consistent with 10 CFR 20.1406, the design of the PHTS, to the extent practicable, minimizes contamination of the facility and the environment, and facilitate eventual decommissioning.

5.1.3 System Evaluation The design of the nonsafety-related PHTS is such that a failure of components of the PHTS does not affect the performance of safety-related SSCs due to a design basis earthquake. In addition to protective barriers, the PHTS pipe connections to the reactor vessel nozzles have sufficiently small wall thickness, such that if loaded beyond elastic limits, inelastic response occurs in the PHTS piping which is nonsafety-related. These features, along with the seismic design described in Section 3.5, demonstrate conformance with the requirements in PDC 2 for the PHTS.

While the primary side of the PHTS is a closed system, there are conceivable scenarios that may result in the release of radioactive effluents. The fuel design locates the fuel particles near the periphery of the fuel pebble, enhancing the ability of the fuel to transfer heat to the coolant. The thermal hydraulic analysis of the core (see Section 4.6) ensures that adequate coolant flow is maintained to ensure that SARRDLs, as discussed in Section 6.2, are not exceeded. These features demonstrate conformance with the requirements in PDC 10.

The reactor coolant is designed, in part, to ensure that power oscillations cannot result in conditions exceeding specified acceptable system radionuclide design limits. The PHTS is designed such that (1) reactor coolant inlet temperature and coolant mass flow rate oscillations are suppressed or readily detected, (2) the reactor coolant in the PHTS does not experience significant gas entrainment (to avoid unexpected coolant void reactivity feedback), (3) the reactor coolant remains within defined

Preliminary Safety Analysis Report Heat Transport Systems Kairos Power Hermes Reactor 5-5 Revision 0 specifications and addition neutron absorbers are not added to or removed from the system, and (4) the reactor coolant has high thermal inertia, making the reactor resistant to thermal-hydraulic instability events.The design of the reactor coolant, in part, ensures that power oscillations cannot result in conditions exceeding SARRDLs. The reactor is kept near ambient pressure and the reactor coolant in the PHTS does not experience two phase flow. The coolant has a high thermal inertia making the reactor resilient to thermal-hydraulic instability events. These features, in part, demonstrate conformance with the requirements in PDC 12.

The functional containment is described in Section 6.2. The design relies primarily on the multiple barriers within the TRISO fuel particles to ensure that the radiological dose at the exclusion area boundary as a consequence of postulated events meets regulatory limits. However, the reactor coolant also serves as a distinct physical barrier for fuel submerged in Flibe by providing retention of fission products that escape the fuel. The design of the reactor coolant composition provides, in part, a means to control the accidental release of radioactive materials during normal reactor operation and postulated events (PDC 60), and supports, in part, demonstration of the functional containment aspects.

The design aspects of the reactor coolant are discussed in Reference 5.1.5-1. The Flibe also accumulates radionuclides from fission products, and transmutation products from the Flibe and Flibe impurities. The retention properties of the Flibe are credited in the safety analysis as a barrier to release of radionuclides accumulated in the coolant, and radionuclide concentration is limited by technical specifications. The transport of radionuclides through Flibe is based on thermodynamic data that will be justified in the application for an Operating License. These features demonstrate conformance with the requirements in PDC 16.

Significant air ingress into the PHTS is excluded by design basis. Air ingress could affect the inventory of reactor coolant in the reactor vessel as well as affect the purity of the reactor coolant. Design features of the heat rejection subsystem and the reactor trip system will limit the quantities of air ingress during system leakage events by tripping the heat rejection blowers and tripping the PSP. These design features satisfy PDC 33 and PDC 70.

The design of the PHTS controls the release of radioactive materials in gaseous and liquid effluents in the event the PHTS working fluid is inadvertently released to the atmosphere via leaks in the piping system. The PHTS SSCs that are part of the reactor coolant boundary are designed to the ASME B31.3 Code (for the piping) and ASME BPVC Section VIII (for the PHXHRR) such that leaks are unlikely. Means are provided for detecting and, to the extent practical, identifying the location of the source of reactor coolant leakage in the PHTS SSCs. A postulated event in the PHTS would be a PHX tube failure. This event would cause Flibe to leak into the intermediate coolant, as the Flibe is maintained at a higher pressure than the intermediate coolant and would result in a spread of contamination to the PHRS. Such an event would be detected by a loss of inventory in the inventory management system (Section 9.1.4) and by detection capability in the PHRS. An evaluation of the primary-to-intermediate coolant interaction will be addressed through testing, modeling, and validation as part of the application for an Operating License.

Tritium and other radionuclides will be present in the reactor coolant as part of normal operations of the plant. Control measures will be taken to minimize the release of radioactive material and ensure that they are also below allowable limits (see Section 9.1.3). Tritium (HT, T2) in the reactor coolant will normally diffuse through the PHX heat transfer surface and is expected to be rapidly oxidized in the PHRS intermediate coolant environment to form tritiated water (See Section 5.2 and Section 9.1.3). The reactor coolant contains radionuclides as a result of releases from defective fuel particles, as well as a result of activation of impurities in the Flibe itself. The reactor coolant thermophysical properties, impurities and limitations are provided in Reference 5.1.5-1. The reactor coolant activity is sampled

Preliminary Safety Analysis Report Heat Transport Systems Kairos Power Hermes Reactor 5-6 Revision 0 during normal operations as described in Section 9.1.1. Failures in the PHTS could cause the reactor coolant or cover gas to leak into the reactor building cell gas space and be released. Such events are evaluated in Section 13.1. These features demonstrate conformance with the requirements in PDC 60.

The PHTS (reactor coolant) contains radiological contaminants. Therefore, the design of the system minimizes contamination and supports eventual decommissioning, consistent with the requirements of 10 CFR 20.1406, as described in Chapter 11.

5.1.4 Testing and Inspection Descriptions of any tests and inspections of the PHTS will be provided with the application for an Operating License.

5.1.5 References

1. Kairos Power LLC Topical Report, Reactor Coolant for the Kairos Power Fluoride Salt-Cooled High Temperature Reactor KT-TR-005-P-A (ML20219A591).

Preliminary Safety Analysis Report Heat Transport Systems Kairos Power Hermes Reactor 5-7 Revision 0 Table 5.1-1: Key Design Parameters of the Primary Heat Transport System (at nominal full power)

Parameter Value Thermal duty 35 MWth Number of PHXsHRRs 21 Number of hot legs 1

Number of cold legs 2

Primary loop line size 8-12 in nominal pipe size PHX HRR inlet coolant temperature 600-650oC PHX HRR outlet coolant temperature 550oC Nominal Flow Rate 210 kg/s PHTS Design Pressure 492 525 kPa(g)

Preliminary Safety Analysis Report Heat Transport Systems Kairos Power Hermes Reactor 5-8 Revision 0 Figure 5.1-1: Primary Heat Transport System Process Flow Diagram

Preliminary Safety Analysis Report Heat Transport Systems Kairos Power Hermes Reactor 5-9 Revision 0 5.2 PRIMARY HEAT REJECTION SYSTEM 5.2.1 Description The primary heat rejection system (PHRS) transfers heat from the primary heat exchanger (PHX) (See Section 5.1) and transports the heat to a heat rejection radiator (HRR) (normal heat sink) during normal plant operation. The PHRS utilizes an intermediate coolant through the cooling side of the PHX. The PHRS also contains an intermediate salt pump (ISP) and intermediate salt vessel (ISV), located downstream of the PHX, and associated piping which transports the heat to the HRR. A process flow diagram of the PHRS is provided in Figure 5.2-1. The key design parameters for the PHRS are provided in Table 5.2-1.

The PHRS also transports tritium from the PHX to the tritium management system (TMS) in the cover gas portion of the ISV. The TMS is described in Section 9.1. The PHRS also provides for fill/draining control of the PHRS piping, PHX, and HRR coil.

The primary system functions of the PHRS are nonsafety-related and include the following:

Reject normal operating thermal energy from the primary loop to the atmosphere Reject residual heat from the primary loop during normal operating conditions (e.g., normal shutdown)

Control PHTS thermal response during transients Maintain intermediate coolant pressure below primary coolant pressure within the PHX Direct intermediate coolant to the TMS to control tritium that diffuses through the PHX The design of the PHRS allows for on-line monitoring, in-service inspection, maintenance, and coolant replacement activities. The PHRS design includes a closed cover gas system to control intermediate coolant chemistry, to minimize corrosion and control and recover tritium. The system is designed to keep the intermediate coolant pressure in the heat exchangers lower than the pressure in the PHTS, to prevent the intrusion of intermediate salt into the primary system in the event of an internal PHX leak.

The intermediate coolant is an oxidizing salt comprised of a mixture of nitrate salts. The coolant is also called 60/40 nitrate salt or Solar Salt, in reference to its use in the concentrating solar power industry.

The ISP provides the motive force for the circulation of intermediate coolant and provides the needed pressure and flow rate in the PHRS. The pump provides forced circulation of the intermediate coolant between the PHX and the HRR. The intermediate coolant is circulated through the HRR where air is blown across tube banks to reject heat to the atmosphere.

The intermediate piping serves as the flow conduit within the PHRS. The design of the piping accommodates continuous operation at full thermal power, and operates under partial load conditions at reduced flow rate. The intermediate loop interfaces with the TMS to control tritium.

The design of the PHRS piping includes provisions for filling, draining, and high point venting, and accommodates thermal expansion between the ISP, ISV, and HRR.

The PHRS contains an auxiliary heating system to provide non-nuclear heating as needed for initial coolant melt, startup, shutdown, and supplemental heat during normal operation. A high thermal duty heater or set of heaters is used for this function. The selected heat source will be described in the application for an Operating License.

Preliminary Safety Analysis Report Heat Transport Systems Kairos Power Hermes Reactor 5-10 Revision 0 5.2.2 Design Basis Consistent with PDC 60, the PHTS includes features which support the control of radioactive materials during normal reactor operation.

Consistent with PDC 73, the PHTS includes a passive barrier (PHX) for the reactor coolant system that is chemically compatible with the PHRS coolant and PHRS features which support the control of radioactive materials during normal reactor operation.

Consistent with 10 CFR 20.1406, the design of the PHRS, to the extent practicable, is to minimize contamination of the facility and the environment, and to facilitate eventual decommissioning.

5.2.3 System Evaluation Failures could cause intermediate coolant or cover gas to leak into the reactor building cell gas space and be released. Tritium (T2), which diffuses through the PHX heat transfer surface, is expected to be rapidly oxidized in the intermediate coolant environment to form tritiated water. The tritiated water is removed from the gas phase via the TMS using desiccation, thereby minimizing tritium inventory in both cover gas and in the bulk intermediate coolant that is available for release, as described in Section 9.1.

These features demonstrate conformance with the requirements in PDC 60.

The PHRS coolant has the potential to be contaminated with Flibe if there are leaks in the PHX. A postulated event in the PHTS would be a PHX tube failure. This event would cause Flibe to leak into the intermediate coolant, as the Flibe is maintained at a higher pressure than the intermediate coolant and would result in a spread of contamination to the PHRS. As the two fluids are compatible, this would not cause a safety concern for the breach. These features demonstrate conformance with the requirements in PDC 73.

The PHRS coolant has the potential to be contaminated with tritium or other radioactive materials that may leak from the PHTS into the PHRS, via the PHX. As such, the PHRS includes features which support monitoring radioactive material releases from breaks and leaks in the piping system or via pressure relief valves. The PHRS contains radiological contaminants. Therefore, the design of the system minimizes contamination and supports eventual decommissioning, consistent with the requirements of 10 CFR 20.1406, as described in Chapter 11.

5.2.4 Testing and Inspection Descriptions of any tests and inspections of the PHRS will be provided with the application for the Operating License.

5.2.5 References None

Preliminary Safety Analysis Report Heat Transport Systems Kairos Power Hermes Reactor 5-11 Revision 0 Table 5.2-1: Key Design Parameters of the Primary Heat Rejection System Parameter Value Number of loops 1

Thermal duty per loop 35 MWth Number of HRRs 1

PHRS hot leg temperature 550 - 590C PHRS cold leg temperature 500 - 550C Coolant flow rate 100 - 400 kg/s Coolant pressures Near ambient pressure

Preliminary Safety Analysis Report Heat Transport Systems Kairos Power Hermes Reactor 5-12 Revision 0 Figure 5.2-1: Primary Heat Rejection System Process Flow Diagram

Preliminary Safety Analysis Report Instrumentation and Controls Kairos Power Hermes Reactor 7-3 Revision 0 Figure 7.1-1: Instrumentation and Controls System Architecture

Preliminary Safety Analysis Report Instrumentation and Controls Kairos Power Hermes Reactor 7-4 Revision 0

Preliminary Safety Analysis Report Instrumentation and Controls Kairos Power Hermes Reactor 7-6 Revision 0 7.2 PLANT CONTROL SYSTEM 7.2.1 Description The PCS is a non-safety related control system which controls reactor startup, changes in power levels, and shuts down the reactor. The PCS implements these functions through a series of subsystems which include:

Reactor control system (RCS)

Reactor coolant auxiliary control system (RCACS)

Primary heat transport control system (PHTCS)

Primary heat rejection control system (PHRCS)

The PCS maintains plant parameters within the normal operating envelope. This system also provides data to the control consoles located in the main control room (see Section 7.4). Figure 7.1-1 shows the elements of the PCS.

The PCS is a microprocessor-based distributed control system that individually controls plant systems using applicable inputs. The subsystems listed above are integrated into the PCS using non-safety related signal wireways which are terminated at local cabinets and using redundant, non-safety, real time data highways.

The plantwide sensor inputs are used to verify interlock and permissive rules for the various plant states.

The sensor data is also used to provide feedback and alarms to the operators via the control consoles.

The PCS is powered by AC and DC power supplies which are discussed in Chapter 8.

The PCS uses non-safety related sensor inputs as well as safety-related sensor inputs from the plant protection system via a data diode. The PCS includes the input parameters shown in Table 7.2-1. The sensors are described in Section 7.5. The instrumentation provides input signals using non-safety related signal wireways that are terminated at local cabinets.

Control outputs are generated using a control transfer function based on the sensor inputs and setpoints provided by the control system. The setpoints are adjusted automatically based on the plant operating mode, or in some cases by the operator via the main control room consoles. Plant operators do not directly control PCS outputs.

The PCS does not provide any safety-related functions during any mode of operation or postulated event. The PCS is electrically and functionally isolated from the safety-related RPS (see Section 7.3) using a safety-related isolation device as shown in Figure 7.1-1. The RPS isolation devices ensure electrical isolation between the electrical system and the non-safety related SSCs that PCS normally controls that are deactivated by the RPS when a reactor trip is demanded.

The subsystems of the PCS are described below.

7.2.1.1 Reactor Control System The RCS controls and monitors systems and components that support normal operation, planned transients, and normal shutdown of the reactor. The RCS controls the systems listed in Figure 7.1-1 and supports the following capabilities:

Reactivity control and planned transients/adjustments in power level Monitoring of core neutronics Pebble handling and storage Monitoring and control of temperature in the reactor

Preliminary Safety Analysis Report Instrumentation and Controls Kairos Power Hermes Reactor 7-7 Revision 0 The RCS controls reactivity for normal operations and normal shutdown using reactor control elements and reactor shutdown elements in the reactivity control and shutdown system (RCSS) (see Section 4.2).

The RCS is capable of incrementally changing the position of reactor control elements and of releasing the control and shutdown elements. The RCS is only capable of withdrawing elements one at a time and the RCS includes a limit on the rate at which a control element can be withdrawn, as also discussed in Section 4.2.2. In this way the design precludes, with margin, the potential for prompt criticality and rapid reactivity insertions. The RCS inputs include core average coolant temperatures sensors and source and power range neutron detectors. The RCS also provides a reactor monitoring function to monitor plant components that are associated with reactor functions. The RCS uses source and power range sensors that are located outside the reactor vessel for reactor control.

The RCS controls pebble insertion and extraction, in-vessel pebble handling, and ex-vessel pebble handling in the pebble handling and storage system (PHSS) (see Section 9.3). The RCS is capable of counting linearized pebbles external to the vessel, controlling the rate of pebble insertion and removal from the vessel, and controlling pebble distribution within the PHSS.

The RCS controls the reactor thermal management system (RTMS) (see Section 9.1.5) to monitor the temperature of the primary system to maintain it within the normal operating envelope and to implement planned transients. The RCS controls external heating elements in the RTMS to prevent overcooling.

7.2.1.2 Reactor Coolant Auxiliary Control System The RCACS controls and monitors systems and components that support normal operation in the core.

The system supports the following capabilities in the core:

Chemistry control in the primary system Inventory management system control Inert gas system control in the primary loops Tritium management system monitoring and control The RCACS controls the chemistry control system (see Section 9.1.1) to monitor reactor coolant chemistry. The monitoring systems provide information to facilitate maintaining coolant purity and circulating activity within specifications for the system.

The RCACS receives input from the inventory management system (see Section 9.1.4) which monitors primary coolant level during normal operations. The system also provides control for changes to primary inventory during planned primary filling and draining operations.

The RCACS also controls the inert gas system (see Section 9.1.2). During normal operation, the system provides control signal to maintain cover gas pressure and flow, monitors venting gas for impurities above specified limits in the gas space of the primary system. During startup, the system monitors and controls inert gas flow and temperature to support initial heating of the primary system.

The RCACS receives input from the tritium management system (see Section 9.1.3) and provides control signal to remove tritium from the cover gas in the primary system.

7.2.1.3 Primary Heat Transport Control System The PHTCS controls and monitors systems and components that support normal operation of the primary heat transport system (PHTS). The system supports the following capabilities:

Control of the flow rate through the PHTS PHTS heating thermal management

Preliminary Safety Analysis Report Instrumentation and Controls Kairos Power Hermes Reactor 7-8 Revision 0 Control of the heat rejection subsystem Primary loop draining, filling, and piping monitoring, including PHTS external piping The purpose of the PHTCS is to control the transport of primary coolant through the PHTS, to maintain the primary coolant in a liquid state, to control the rejection of heat from the PHTS, and to monitor the inventory of primary coolant in the PHTS. The PHTCS maintains the parameters in the PHTS within the normal operating envelope. The PHTCS controls the primary salt pump (PSP), and the primary loop auxiliary heating systemthermal management subsystem, and the heat rejection subsystem. The sensors used by the PHTCS are discussed in Section 7.5.

The PHTCS provides control signal for the PSP (see Chapter 5). The control system manipulates the primary coolant flow rate by variable frequency to maintain PHTS parameters within the normal operating range. The PHTCS does not provide a safety function; however, as discussed in Section 7.3, the RPS trips the PSP on a reactor trip, as a protection feature for the reactor system related to the pump.

The PHTCS maintains the primary coolant in liquid phase throughout the PHTS to prevent localized over-or under-heating. The control system uses temperature as input to provide control signal to the PHTS auxiliary heaters.

The PHTCS provides controls and monitoring of the components that support the operation of the heat rejection subsystem.

Primary Heat Rejection Control System The PHRCS controls and monitors systems and components that support normal operation of the intermediate loop which removes heat from the primary loop. The system supports the following capabilities:

Control of the flow rate through the intermediate loop Intermediate loop heating Intermediate loop draining, filling, and piping monitoring The purpose of the PHRCS is to control the transport of intermediate coolant through the intermediate loop, to maintain the intermediate coolant in a liquid state, and to monitor the inventory of intermediate coolant in the intermediate loop. The PHRCS does not perform a safety function. The PHRCS maintains the parameters in the intermediate loop within the normal operating envelope.

The PHRCS controls the intermediate salt pump (ISP), the intermediate loop auxiliary heating system, the intermediate coolant inventory system, the intermediate loop chemistry control system, the intermediate loop cover gas system, and the heat rejection blower. The PHRCS controls the ISP by changing the intermediate coolant flow rate by variable frequency to maintain intermediate loop parameters within the normal operating range. The PHRCS controls the intermediate loop auxiliary heating system to maintain the intermediate coolant in liquid phase throughout the intermediate loop to prevent localized over-or under-heating. The control system uses temperature information as input to provide control signal to the intermediate loop auxiliary heaters.

7.2.2 Design Bases Consistent with Principal Design Criteria (PDC) 13, the PCS is designed to monitor variables and systems over their anticipated ranges for normal operation, and over the range defined in postulated events.

7.2.3 System Evaluation The PCS is designed to monitor plant parameters and maintain systems within normal operating range.

The PCS is also designed to control planned transients associated with anticipated operational

Preliminary Safety Analysis Report Instrumentation and Controls Kairos Power Hermes Reactor 7-11 Revision 0 Table 7.2-1: Plant Control Variables Control Variables (Inputs)

Primary Loop PSP speed Control rod drive position Loop and vessel temperatures Inert gas pressure Air CoolingIntermediate Loop ISPBlower speed Valve positions Loop temperatures Controlled Variables (Outputs)

Primary Loop Neutron flux (self-powered neutron detectors and ion cambers)

Core inlet temperature Core outlet temperature Core mass flow rate Intermediate Loop Intermediate Loop flowrate IHX inlet/outlet temperature Heat Rejection Radiator Inlet/outlet temperature Constrained Variables (Outputs)

Primary Loop Excess reactivity margin Inlet temperature

Preliminary Safety Analysis Report Instrumentation and Controls Kairos Power Hermes Reactor 7-14 Revision 0 7.3 REACTOR PROTECTION SYSTEM 7.3.1 Description The RPS provides protection for reactor operations by initiating signals to mitigate the consequences of postulated events and to ensure safe shutdown. The RPS is the only portion of the I&C system that is safety-related and that is credited for tripping the reactor and actuating engineered safety features. The purpose of the RPS is to actuate upon receipt of a trip signal in response to out-of-normal conditions and provide automatic initiating signals to protection functions. There are three possible trip sources that can cause the RPS to actuate and three protection functions that result from RPS actuation, shown below in Figure 7.3-1. The three possible trip sources are:

Process variables reach or exceed specified setpoints, as measured by RPS sensors Manual initiation from the main control room or remote onsite shutdown panel Plant electric power is lost (with a time delay)

The three KP-FHR protection functions that result from RPS actuation are:

Activate the RCSS that inserts control and shutdown elements into the reactor core Inhibit actions from the PCS so that it does not interfere with the functioning of the RPS Ensure activation of the decay heat removal system (DHRS) that passively removes heat from the PHTS to the atmosphere Actuation of the RPS to trip the reactor includes several actuations that stop specific non-safety related SSCs, normally controlled by PCS, to ensure that those non-safety related SSCs to do not prevent a safety-related SSC from performing its safety function. The non-safety related functions that are stopped are shown in Figure 7.1-1. RCSS element withdrawal is inhibited after a loss of power, to prevent inadvertent positive reactivity insertion when power returns (see also Table 7.3-2). The PSP is stopped to maintain Flibe inventory in the core. The heat rejection subsystem blowerISP is stopped to prevent a pressure differential between the primary and intermediate systemspotential forced air ingress into the PHTS and inadvertent overcooling. Pebble extraction and insertion in the PHSS is stopped to prevent removing pebbles from the core in the event of a PHSS extraction line break. Finally, RAHS actuation is prohibited to prevent a challenge to the heat removal capability of the DHRS. These inhibitions are accomplished through safety-related trip devices as shown in Figure 7.1-1.

The RPS is built on a logic-based platform that does not utilize software or microprocessors for operation. It is composed of logic implementation using discrete components and field programmable gate array (FPGA) technology. The RPS is isolated from other I&C systems using safety-related isolation gateways. The RPS includes the following safety-related (except as noted otherwise) elements:

Separate channels of sensor electronics and input devices Redundant and separate groups of signal conditioning Redundant and separate groups of trip determination Manual reactor trip switches in the main control room Safety-related components to provide electrical isolation from the non-safety-related highly reliable DC power system power supply Power supplies for safety-related sensors and RPS components, which also provide isolation from the non-safety-related highly reliable DC power system power supply Redundant voltage sensors for detecting loss of 120 VAC to the uninterruptible power supply system Multiple reactor trip devices and associated cabling Two non-safety related RPS gateways

Preliminary Safety Analysis Report Instrumentation and Controls Kairos Power Hermes Reactor 7-15 Revision 0 Two divisions of reactor trip system (RTS) voting and actuation equipment Reactor trip functions are hardcoded into FPGA logic and are not dependent on plant operating state.

Operating conditions are compared against the trip setpoints and actuate protection functions according to established programmable logic. The RPS cabinets are located within the safety-related portion of the Reactor Building within an environmentally separated enclosure, discussed further in Section 7.3.3.

The RPS performs safety-related functions as shown in Figure 7.1-1 which include RTS actuation and ensuring actuation of the DHRS. Both functions are described in more detail in Sections 7.3.1.1 and 7.3.1.2. Operator interface for the RPS is discussed in Section 7.4. The RPS uses inputs from the reactor core temperature, reactor vessel level, and source and power range neutron detectors. The sensors that provide input to the RPS are safety-related and described further in Section 7.5.

7.3.1.1 Reactor Trip System The RTS activates the RCSS that allow for insertion of control and shutdown elements into the reactor core. Upon receipt of a trip signal, the RTS removes power from coils on the reactivity shutdown elements which drop by gravity into the reactor (See Section 4.2.2 for more information about the shutdown elements). The RTS receives trip signals generated from automatic or manual sources.

The RTS is built on a logic-based platform that does not utilize software or microprocessors for operation. It is composed of logic implementation using discrete components and FPGA technology. The RTS is isolated from other I&C systems using safety-related isolation gateways.

The RTS receives input from sensors through hardwired, analog, safety-related signal wireways that are terminated at local cabinets. Section 7.5 provides additional information about the sensors that provide input to the RTS. Using the inputs from the sensors, the RTS automatically opens the reactor trip devices when setpoints are reached. The system uses both undervoltage coils as well as shunt trip coils to provide the means to open the trip devices. The reactivity shutdown element position coils fail open on loss of power.

The main control room and the remote onsite shutdown panel each have the capability to provide a manual trip signal to the RTS. Section 7.4 includes a discussion of the human interface with the RTS.

Table 7.3-2 provides a list of interlocks implemented for RPS systems. If normal power is not available and the RPS does not detect a transfer to backup power within a defined time period, the RPS removes power from the RTS, causing the control and shutdown elements to drop into the core. The RPS includes an interlock that inhibits movement of reactivity control elements, and a manual reset is required before reactivity control elements can be withdrawn. The purpose of this interlock is to prevent inadvertent insertion of positive reactivity when normal power is lost and subsequently restored.

On activation, the RTS will trip the PSP. A manual reset prevents the pump from inadvertently restarting after power return. To prevent an inadvertent operation of the heat rejection subsystem blowerensure positive pressure between the primary and intermediate coolant loops within the heat exchangers, the ISP heat rejection subsystem blower trips concurrently with the PSP. An interlock prevents starting the ISP heat rejection subsystem blower if the PSP is not running.

7.3.1.2 Decay Heat Removal System The DHRS provides passive residual heat removal that requires no electrical power to operate, as discussed in Section 6.3. Although the DHRS is always operating above a certain threshold of fission product accumulation level, the decay heat removal portion of the RPS provides actuation signal to DHRS to ensure the DHRS is operating when there is a RPS actuation signal. The RPS actuation signal to

Preliminary Safety Analysis Report Instrumentation and Controls Kairos Power Hermes Reactor 7-21 Revision 0 Table 7.3-2: Reactor Protection System Interlocks and Inhibits Input Signal to the Reactor Protection System Interlock or Trip Fission product accumulation in the core exceeds a defined level DHRS is activated

Purpose:

ensure decay heat removal Fission product accumulation in the core exceeds a defined level Manual reset for DHRS prohibited

Purpose:

DHRS cannot be disengaged while the core generates decay heat Low power level AND a minimum defined fission product accumulation in the core is reached*

Manual reset for DHRS available

Purpose:

Prevent overcooling while shutdown DHRS manual reset is available after RPS activation NOTE: see row above for the initial conditions for DHRS manual reset availability Reactor Auxiliary Heating System activation available.

Purpose:

Allow additional thermal management capabilities following a reactor trip Loss of normal power AND No transfer to backup power within a defined time period Movement of reactivity control elements inhibited with manual reset required

Purpose:

prevent inadvertent positive reactivity addition to the core by preventing withdrawal of reactivity control elements when power returns following a reactor trip Loss of normal power AND Activation of the RTS After the RTS trips the PSP, manual reset is required to restart the PSP

Purpose:

Prevent inadvertent restart of the PSP when power is restored Activation of the RTS After the RTS trips the PSP and ISPheat rejection subsystem blower, the ISP is prevented from restarting unless the PSP is running

Purpose:

ensure positive pressure between the primary and intermediate coolant loopsprevent inadvertent operation of heat rejection subsystem blower PSP not running Trip the ISP heat rejection subsystem blower and lock out restart of the ISP heat rejection subsystem blower until the PSP is running.

Purpose:

prevent air ingress of nitrate into the primary loop above a certain threshold Detection of a break in the PHSS extraction line Trip the pebble extraction and insertion machines

• The fission product accumulation is based on the operating time and power level relationship.

Preliminary Safety Analysis Report Instrumentation and Controls Kairos Power Hermes Reactor 7-22 Revision 0 Figure 7.3-1: Reactor Protection System Trip Logic Schematic

Preliminary Safety Analysis Report Instrumentation and Controls Kairos Power Hermes Reactor 7-23 Revision 0

Preliminary Safety Analysis Report Instrumentation and Controls Kairos Power Hermes Reactor 7-29 Revision 0 7.5 SENSORS 7.5.1 Description Sensors are used to provide information about temperature, pressure, neutron count rates, level, flow of the primary coolant, flow of the intermediate coolant, and area radiation levels as input to multiple control and protection subsystems. Independent sensors are provided to the reactor protection system and the plant control system. Each section about specific I&C subsystems includes a discussion of the sensors that support that subsystem and the type of sensor used (i.e., analog or digital).

Temperature, pressure, level, and flow sensors measure and monitor plant operating process parameters and are used to control operations and initiate reactor protective actions. Neutron source range sensors provide indication of power level during the initial stages of startup. Gamma radiation monitors provide information about area radiation levels during all plant modes of operation.

7.5.2 Design Bases Consistent with PDC 1 and 10 CFR 50.55(i), safety-related sensors are designed, fabricated, erected, constructed, tested, and inspected to quality standards commensurate with the safety function to be performed.

Consistent with PDC 2, safety-related sensors are designed to be protected from adverse effects of natural phenomena.

Consistent with PDC 3, safety-related sensors are designed and located to minimize the probability and effect of fires and explosions.

Consistent with PDC 13, safety-related sensors monitor process variables and systems over their anticipated ranges for normal operation and for postulated events.

Consistent with PDC 21, RPS sensors are designed with sufficient redundancy and independence to assure that no single failure results in loss of protection function. RPS sensors are designed to permit periodic testing and individual safety-related sensors may be removed from service for testing and maintenance without loss of required minimum redundancy.

Consistent with PDC 22, the effects of natural phenomena, and of normal operating, maintenance, testing, and postulated event conditions do not result in loss of the protection function for RPS sensors.

The RPS sensors are designed with sufficient functional and component diversity to prevent the loss of function for the RPS control systems.

Consistent with PDC 24, RPS sensors are functionally independent from the non-safety related sensors.

Consistent with PDC 29, RPS sensors are designed to be redundant to assure there is a high probability of accomplishing the safety-related functions of the RPS in postulated events.

Consistent with 10 CFR 50.36, technical specifications address testing of sensors.

7.5.3 System Evaluation Safety-related sensors are those that provide input to the RPS safety functions discussed in Section 7.3.

Their safety function is to provide sensor input for those plant parameters needed by the RPS to perform its safety functions. Safety-related sensors are also used as inputs to the PCS discussed in Section 7.2, which is not a safety-related function of the sensors. Sensors that provide input to the PCS but not the RPS are classified as non-safety related. In this way the RPS sensors are functionally independent from the non-safety-related sensors, consistent with PDC 24.

Preliminary Safety Analysis Report Electrical Power Systems Kairos Power Hermes Reactor 8-2 Revision 0 Figure 8.1-1: Electrical Configuration Diagram

Preliminary Safety Analysis Report Electrical Power Systems Kairos Power Hermes Reactor 8-3 Revision 0

Preliminary Safety Analysis Report Electrical Power Systems Kairos Power Hermes Reactor 8-7 Revision 0 proper fail-safe functions. This UPS is sized to provide short-term backup power to the RPS block loads, and to lose power on failure of the backup generators. The fail-safe functions are described in further detail in the following paragraphs and in Section 7.3.

To ensure fail-to-safety in the event of a complete loss of AC electrical power, the reactivity control and shutdown system (RCSS) is equipped with a safety-related clutch that requires 24 VDC to remain closed.

On a loss of power, the relay opens, and the control elements drop into the reactor by gravity.

To ensure fail-to-safety in the event of a complete loss of AC electrical power, the primary salt pump (PSP) and heat rejection subsystemintermediate salt pump (ISP) power supplies aresupply is equipped with relays requiring 24 VDC to remain closed. On a loss of power, the relays open to prevent inadvertent pump and blower restart on power restoration. A manual reset is required to restart the pumps.

On activation of the decay heat removal system (DHRS), the reactor protection system will remove 24 VDC from the activation circuit relay to prevent inadvertent shut down of the DHRS by operator error.

Equipment for monitoring reactor status will be supplied by UPS until the normal power supply or backup generators are restored.

The BPS is provided to permit functioning of SSCs following a loss of normal power. The passive design features of the Hermes reactor, based on fundamental physics principles, do not rely on AC or DC electrical power for safety-related SSCs to perform their safety functions during postulated events. Safe shutdown of the reactor does not rely on AC electrical power from the BPS. These features demonstrate conformance with the requirements in PDC 17.

As discussed above, the BPS is not relied on for safety-related SSCs to perform their safety functions for a minimum of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> following postulated events. Therefore, there are no safety-related portions of the BPS, and no tests or inspections are required to demonstrate conformance with the requirement in PDC 18.

The backup power system is not safety-related, but portions of the system may cross the isolation moat discussed in Section 3.5. SSCs that cross a base-isolation moat may experience differential displacements as a result of seismic events. The backup power system is designed so that postulated failures of SSCs in the system from differential displacements do not preclude a safety-related SSC from performing its safety function. Design features addressing differential displacement are discussed in Section 3.5. These features demonstrate conformance with the requirement in PDC 2.

The backup power system is designed in accordance with NFPA 70, National Electrical Code (Reference 8.3-1).

8.3.4 Testing and Inspection The BPS does not perform any safety functions. Periodic inspection and testing are performed on the BPS for operational purposes.

8.3.5 References

1. National Fire Protection Association, NFPA 70, National Electrical Code. 2020.

Preliminary Safety Analysis Report Auxiliary Systems Kairos Power Hermes Reactor 9-8 Revision 0 9.1.3 Tritium Management System 9.1.3.1 Description The tritium management system (TMS) provides capture of tritium from gas streams in various plant locations in order to reduce environmental releases. Tritium is produced primarily by neutron irradiation of lithium in the salt coolant, such as from lithium-7, lithium-6 remaining after initial enrichment, and lithium-6 produced from transmutation of beryllium-9. Multiple TMS subsystems are integrated into other Hermes systems based on the expected tritium distribution among possible transport pathways and the feasibility of tritium capture in each environment. Predictions for the distribution of tritium in primary systems are made using the tritium transport methodology developed for mechanistic source term calculations for KP-TR-012, KP-FHR Mechanistic Source Term topical report, Revision 1 (Reference 1). The Tritium Management System is a non-safety related system that provides for the collection and disposition pathway.

The primary system functions include:

Tritium separation from argon in the inert gas system (IGS)

Tritium separation from dry air in the primary heat rejection system (PHRS) cover gas Tritium separation from dry air in Reactor Building cells Final collection and disposition of tritium Tritium separation from argon in the IGS Tritium can enter the argon gas in the IGS by direct evolution from the salt to the cover gas in the reactor vessel. Similar evolution phenomena exist in other systems where a Flibe-argon interface is present, such as the chemistry control system (CCS), primary salt pump (PSP), and inventory management system (IMS). Tritium can also enter argon through desorption of sorbed tritium in fuel and moderator pebbles during recirculation in the pebble handling and storage system (PHSS). The sources of tritium from the previously mentioned systems are circulated with argon from the IGS, which then routes the gas flow for tritium cleanup. The TMS subsystem in the IGS (TMS-IGS) uses getter beds to capture tritium from the argon flow.

A simplified process flow diagram for the tritium capture system in the TMS-IGS is shown in Figure 9.1.3-1. The TMS-IGS tritium capture system receives argon flow from the IGS after the gas has been treated with a salt vapor trap and particulate filters. The argon temperature is adjusted with a heat exchanger in the TMS-IGS to bring the gas stream to the getter bed operating temperature. A set of upstream instrumentation monitors the tritium activity and oxygen impurity levels in the gas stream, which are used to inform the saturation or consumption rates of the active getter alloy. Tritium is captured from the argon stream using beds with a fixed packing of getter alloy. An additional tritium measurement is taken downstream of the tritium capture beds. Active bed tritium inventory is monitored based on the difference between upstream and downstream tritium measurements. The tritium capture beds can be bypassed during operations where IGS flow is required but tritium capture is not necessary, such as initial startup sequences. Following the TMS-IGS, the argon is returned to the IGS for further gas treatment.

Tritium separation from dry air in the Primary Heat Rejection System (PHRS) cover gas The large Flibe-facing surface area in the primary heat exchanger and high mass transfer rates of tritium in Flibe are expected to result in a significant rate of tritium permeation into the intermediate coolant of the PHRS. In contrast to the primary heat transport system, where Flibe maintains a reducing chemical environment, the oxidizing conditions of the PHRS convert tritium, mainly to HTO or T2O, which influences transport behavior. Oxidation is expected to immobilize tritium against further permeation

Preliminary Safety Analysis Report Auxiliary Systems Kairos Power Hermes Reactor 9-9 Revision 0 out of the PHRS, and furthermore, oxide layers present on the PHRS piping will reduce the metals permeability towards any remaining unoxidized tritium. Reduced permeation out of the PHRS has the effect of directing tritium present in the intermediate fluid towards the cover gas of the Intermediate Salt Vessel (ISV), which contains another tritium capture system. Oxidized tritium is captured as tritiated water in the recirculating dry air of the ISV cover gas using molecular sieve capture beds. Molecular sieve is used as the baseline material for HTO and T2O capture due to a higher water loading capacity at low relative humidity levels compared to other desiccants like silica gel. Residual H2O is also captured along with tritium in the molecular sieve beds, and therefore a dry air supply is used for the PHRS cover gas to reduce the overall molecular sieve consumption and volume of tritiated capture materials produced.

The process for tritium capture in the PHRS is described in Figure 9.1.3-2. Air suction is drawn from the cover gas of the ISV and then salt vapors and particulates are removed before further treatment in the TMS tritium capture subsystem located in the PHRS (TMS-PHRS). A heat exchanger then reduces the process air temperature to the desired tritium capture temperature. Tritium is removed from the process air stream using a bed with a fixed packing of molecular sieve desiccant. Upstream and downstream tritium and moisture instrumentation are used to monitor the tritium inventory and moisture saturation of the molecular sieve beds. In contrast to the TMS-IGS, the TMS-PHRS is responsible for the gas supply and motive force for the loop, as indicated by the dry air supply and compressor in Figure 9.1.3-2. Downstream of the TMS-PHRS, air is discharged back into the cover gas of the ISV or directly into the intermediate coolant if gas sparging is used to enhance mass transfer and tritium stripping of the intermediate coolant.

Tritium separation from dry air in Reactor Building cells Tritium permeates through the structural metals of the primary heat transport system (PHTS), although at a lower overall rate than the primary heat exchanger due to the reduced Flibe-facing surface area.

Tritium capture is carried out in the environments surrounding the PHTS reactor vessel and primary loop piping to collect the permeating tritium which permeates through structural metals as well as any tritium released from limited gas leakage out of interfacing systems, such as the IGS, PHSS, CCS, and IMS, during normal operations or maintenance activities. The tritium which permeates through metallic boundaries or leaks from the inert cover gas of these systems is expected to predominantly exist in the form of HT or T2. Reactor Building environments where tritium capture occurs are isolated into building cells where favorable conditions for tritium capture can be readily maintained. Molecular sieve capture beds are used for Tritium tritium capture systems in reactor Reactor building Building cells, and are designed to accommodate additional moisture loads produced from in-leakage of ambient air. As in the PHRS, molecular sieve capture beds are used to capture tritiated water in the cells along with moisture introduced from air ingress. A means of oxidation, such as a catalyst bed, are present prior to the building cell molecular sieve beds to convert any unoxidized tritium present and increase the fraction of HTO/T2O available for capture by the sieve. To minimize tritium effluent, the exhaust flow used to maintain the cells at negative pressure is extracted from the TMS outlet flow and directed to the reactor building filter and exhaust system described in section 9.2. An example process diagram for the integration of a tritium capture system into the reactor cell HVAC system is shown in Figure 9.1.3-3; tritium capture systems integrated into Reactor Building cells other than the reactor cell follow a similar process.

Final collection and deposition of tritium The previously described tritium capture systems each produce a unique stream of tritium capture materials. Tritium capture in the IGS result in the formation of a stable metal tritide from the getter alloy, while the building cell capture systems produce tritiated water stored in a molecular sievePHRS

Preliminary Safety Analysis Report Auxiliary Systems Kairos Power Hermes Reactor 9-10 Revision 0 and building cell capture systems produce tritiated water stored in molecular sieve. The molecular sieve from the PHRS is expected to result in a higher specific tritium activity than the building cell molecular sieve due to a lower predicted level of moisture ingress, and thus lower dilution from H2O. Following their in-service duty cycles, the tritium capture materials are stored in sealed canisters which can withstand pressure increases caused by tritium decay into helium-3. For the molecular sieve vessels, a catalytic recombiner material is added to convert hydrogen or HT/T2 produced by radiolysis back to a water form to allow for re-adsorption by the sieve. Tritium capture materials which are intended to be shipped from the site will be contained in a package which meets appropriate Department of Transportation regulations. In accordance with 10 CFR 71.51, Type A and Type B packaging canisters are used. When tritium content would exceed the limit of 1,080 Ci, Type B canisters are used for temporary storage and shipping as needed. Canisters with a tritium content of less than 1,080 Ci are shipped from the site using Type A canisters.

9.1.3.2 Design Bases The TMS satisfies the following Principal Design Criteria (PDC):

Consistent with PDC 2, safety-related SSCs located near the TMS are protected from the adverse effects of TMS failures during a design basis earthquake.

Consistent with PDC 13, proper instrumentation is provided to measure tritium inventories in the TMS and demonstrate compliance with imposed inventory limits.

Consistent with PDC 60, tritium capture functions performed by the TMS assist in controlling releases of radioactive materials to the environment.

Consistent with PDC 64, the TMS is designed support the monitoring of tritium releases.

Consistent with 10 CFR 20.1406, the TMS is designed, to the extent practicable, to minimize contamination of the facility and the environment, and facilitate eventual decommissioning.

9.1.3.3 System Evaluation The TMS does not perform any safety-related functions and is not credited for the mitigation of any postulated events. The system is also not credited for performing safe shutdown functions.

Portions of the TMS may be located in proximity to SSCs that perform safety-related functions. Those safety-related SSCs will be protected from seismic induced failures of the TMS by either seismically mounting the applicable TMS components, confirming sufficient physical separation, or by the erection of barriers to preclude adverse interactions. This satisfies the requirements of PDC 2 for the TMS.

The total tritium inventory in the TMS is monitored and maintained below a specified limit. The TMS tritium inventory upper bound limit for tritium not stored inside Type B containers, is set such that dose corresponding to a full release of TMS tritium in a postulated event is bounded by the tritium release dose from reactor vessel system and PHTS tritium inventories included in the maximum hypothetical accident (MHA) analysis. By maintaining the potential tritium release doses bounded by the MHA (see Table 13.2-1), the hypothetical tritium releases from the TMS satisfy the accident dose limits of 10 CFR 100.11.

The TMS tritium inventory includes active capture beds and previously used beds stored in on-site Type A canisters. Tritium capture beds packaged in Type B canisters located on-site are not included in the total tritium inventory. Tritium inventories are maintained below a specified TMS limit, either through radioactive decay, or shipment of Type A canisters off-site for disposal or beneficial use. Shipment of used beds which include greater than 1,080 Ci of tritium requires a certified Type B canister. Tritium

Preliminary Safety Analysis Report Auxiliary Systems Kairos Power Hermes Reactor 9-11 Revision 0 stored in approved Type B canisters are excluded from the inventory limit that could be released in a postulated event. This is acceptable because credible environmental hazards associated with the canister storage location in the plant are less severe than the hypothetical transportation accident conditions required for Type B canister qualification.

The total tritium inventory in the TMS is monitored in order to comply with the inventory limits set by MHA assumptions and dose limits in 10 CFR 100.11. Quantities included as part of the TMS total tritium inventory are the tritium stored in active capture beds of TMS subsystems plus the tritium inventory of previously used beds in storage inside the plant in containers not qualified for tritium containment.

During operation of TMS capture systems, the buildup of tritium inventory is monitored over time by measuring the difference in tritium activity in process streams upstream and downstream of the active capture beds. The total tritium inventory of capture beds is also measured with a non-destructive analysis method after each beds in-service duty cycle is complete. In compliance with PDC 13, tritium monitoring sensors are selected to provide measurements over a range of anticipated tritium activities where measurements are needed.

The TMS maintains a minimum level of overall tritium capture capacity in order to minimize tritium releases from the plant and satisfy PDC 60. Tritium releases in effluents are controlled within the effluent limits in 10 CFR 20.

Radiation monitoring is provided in the TMS for the evaluation of tritium levels in TMS subsystems. This monitor supports evaluation of radioactive material releases that might occur as a result of a system failure. This design feature, in part, satisfies PDC 64.

The system contains radiological contaminants; therefore, the system is designed to minimize contamination and support eventual decommissioning, consistent with the requirements of 10 CFR 20.1406.

9.1.3.4 Testing and Inspection The TMS tritium inventory is monitored by measurement, or by bounding calculations when measuring equipment is inoperable.

Tritium capture functions performed by the TMS also assist in maintaining the quantity of tritium in the primary reactor coolant and intermediate reactor coolant below an upper bound limit set for each coolant.

9.1.3.5 References

1. Kairos Power LLC, KP-FHR Mechanistic Source Term topical report, KP-TR-012, Revision 1.

Preliminary Safety Analysis Report Auxiliary Systems Kairos Power Hermes Reactor 9-13 Revision 0 Figure 9.1.3-2: Process Flow Diagram for the Tritium Capture System in the Primary Heat Rejection SystemNot Used

Preliminary Safety Analysis Report Auxiliary Systems Kairos Power Hermes Reactor 9-16 Revision 0 9.1.4.1.2 RV Fill/Drain Tank The RV fill/drain tank provides a means of filling and draining the RV through a transfer line and a dip tube. The transfer into the RV is pump driven and the transfer out of the RV is gravity driven. The RV fill/drain tank transfer line is equipped with a passive RV isolation system to prevent unintentional draining, which is discussed in Section 9.1.4.3. The RV fill/drain tank is sized to hold the RV coolant inventory.

9.1.4.1.3 PHTS Fill/Drain Tank The PHTS fill/drain tank provides a means of filling and draining the reactor coolant from the PHTS (see Section 5.1), including the primary heat exchanger (PHX)heat rejection subsystem, through a transfer line. The PHTS drain is gravity driven and the fill is pump driven between the PHTS fill/drain tank and the PHTS.

The PHTS fill/drain tank is sized to hold the PHTS and PHX heat rejection subsystem reactor coolant inventory.

9.1.4.1.4 Solid IMS New and used reactor coolant is stored in transfer canisters used to transport reactor coolant to and from the site in solid state at ambient temperature. Within the IMS, the reactor coolant is transferred -

in liquid form - through transfer lines, driven by a cover gas pressure differential. The solid IMS function is to melt new reactor coolant in the canisters prior to a transfer into the IMS or to freeze the used reactor coolant in the canisters following a transfer from the IMS. The used reactor coolant presents a potential hazard due to radiological contamination.

The transfer canisters are constructed of stainless-steel and are designed per ASME BPVC,Section VIII.

The transfer canisters are designed and fabricated to meet the pressure, mechanical loads, corrosion, and temperature requirements of the system.

9.1.4.2 Design Bases Consistent with PDC 2, safety-related SSCs located near the IMS are protected from the adverse effects of IMS failures during a design basis earthquake.

Consistent with PDC 4, safety-related SSCs located near the IMS are protected from the adverse effects of IMS failures during dynamic events.

Consistent with PDC 15, the IMS is designed to ensure the design conditions of the reactor coolant boundarys safety-related elements are maintained during normal and accident conditions.

Consistent with PDC 33, sufficient reactor coolant inventory is provided to protect against a loss of inventory in the safety-related portions of the reactor coolant boundary.

Consistent with 10 CFR 20.1406, the IMS is designed, to the extent practicable, to minimize contamination of the facility and the environment, and facilitate eventual decommissioning.

9.1.4.3 System Evaluation The IMS does not perform safety-related functions and is not credited for the mitigation of postulated events. The system is also not credited for performing safe shutdown functions. The system is not credited to maintain the integrity of the reactor coolant pressure boundary.

Preliminary Safety Analysis Report Radiation Protection and Waste Management Kairos Power Hermes Reactor 11-3 Revision 0 11.1.5 Radiation Exposure Control and Dosimetry A summary of the controls for exposure and access control are provided below. Additional details of the dosimetry and radiation exposure control for the facility, including the locations of radiological control areas, access controls, shielding, remote handling equipment, and expected annual radiation exposures, will be provided with the application for an Operating License consistent with 10 CFR 50.34(b)(3).

Effluent Monitoring Facility effluents are monitored for radioactivity during normal operations and postulated events, and structures, systems, and components (SSCs) are designed to limit uncontrolled liquid or gaseous effluent releases to work areas or the environment, consistent with the goal of maintaining radiation exposures ALARA. Releases during postulated events are evaluated in Chapter 13.

During normal operations, liquid radioactive waste is expected to be packaged and disposed of using a licensed and qualified low-level radioactive waste disposal vendor.

The Reactor Building heating, ventilation, and air conditioning (RBHVAC) system (see Section 9.2) provides for gaseous effluent monitoring and filtration, after which gaseous effluents are generally released to the atmosphere. Other potential gaseous effluent release points include the primary heat rejection stack system (PHRS) stacks (see Section 5.21) and the spent fuel cooling system (see Section 9.3) stacks (see Section 9.3.

A screening analysis of the tritium emissions from the Hermes reactor was performed using the Environmental Protection Agency (EPA) AERMOD modelNRCs XOQDOQ and GASPAR II models.

XOQDOQ is designed to calculate the annual relative effluent concentrations and deposition due to routine releases. XOQDOQ evaluates the impacts at radial downwind distances as well as at sensitive locations specified by the user. GASPAR II is an air release radiation dose code that models the gaseous effluent pathway using the release model described in Regulatory Guide 1.109. GASPAR II requires input of released source terms (curies per year), atmospheric dispersion from the XOQDOQ model and surrounding demographics. The code was developed to analyze airborne effluents from light-water-cooled reactors during routine operations. GASPAR II considers such pathways as inhalation, plume-immersion, ground-shine, and ingestion of various contaminated media (meat, milk, vegetation, etc.).

Dose calculations can be applied to a defined population or an individual using dose conversation factors from the International Commission on Radiological Protection (ICRP). Each calculation considers multiple organs (including but not limited to bone, gastrointestinal tract, kidney, liver, lung, skin, and thyroid) as well as the whole-body dose.Two full years (2018-2019) of site-specific meteorological data from the Oak Ridge National Laboratorys (ORNL) meteorological tower L, located approximately 1.6 kilometers (km) southeast of the Project Hermes site, were used for the modeling in conjunction with concurrent upper air data from Nashville, TN. Hourly surface observations from tower L were measured at three heights - 2 meters (m), 15 m, and 30 m. Ambient temperature, dew point temperature, solar radiation, precipitation, relative humidity, and barometric pressure were measured 2 m above ground level.

Ambient temperature, sigma-theta, wind speed, and wind direction were measured at 15 and 30 m above ground level. Cloud cover data were obtained from the Oak Ridge, TN Automated Surface Observing System (ASOS) station from 2018-2019. Table 11.1-2 provides the stack parameters and annual-averaged tritium emissions assumed in the analysis (all stacks were modeled at a height of 100 feet above plant grade). A 10-km receptor grid extending in all directions from the site was generated for the study. The receptor grid covered areas of ambient air as well as the plant property so that worker exposure could be determined.

Site-specific, validated meteorological data covering a 5-year period of record from January 1, 2016 through December 31, 2020 from Tower L was used to quantitatively evaluate routine-releases at the

Preliminary Safety Analysis Report Radiation Protection and Waste Management Kairos Power Hermes Reactor 11-4 Revision 0 facility. The meteorological data needed for the X/Q and D/Q calculations in XOQDOQ included wind speed, wind direction, and atmospheric stability as joint frequency distributions.

Tritium is expected to be the dominant routine radionuclide release. The three gaseous effluent release pathways werewas modeled under normal operations from the heat rejection stack including a boundingtogether to estimate combined tritium emissions rate conservatively modeled as the tritium generation rate of 62,500 Curies per year. This bounding tritium emissions rate does not evaluate the anticipated retention of tritium from the reactor and engineered systems. These systems will reduce the effective tritium effluent rate. The stack parameters are listed in Table 11.1-2.concentration and normal-operation public dose. The AERMOD-predicted concentrations in units of micrograms per cubic meter (g/m3) were converted to doses in millirem per year (mrem/yr) by dividing the concentrations by a factor of 1.75E-8 g/m3 per mrem/yr. In Reference 1, an annual average radioactive concentration of 1 pCi/m3 of tritium in air and in drinking water, or 10-6 Ci/m3, is shown to be equivalent to 5.9E-03 mrem/yr for an average affected individual. Therefore, the activity concentration in air and water resulting in 1 mrem/yr is 1.69E-04 Ci/m3. Applying the specific activity of tritium, the mass concentration resulting in 1 mrem/yr is 1.75E-8 g/m3. Because this approximation includes both the air and drinking water pathways and assumes the predicted air concentration is equivalent to the drinking water concentration, the dose to the receptor is considered conservative.

Total body effective dose equivalents from gaseous effluents were calculated for three locations: the plant site boundary, the location of the maximally exposed individual (MEI) in an unrestricted area, and an analytical nearest resident. The maximum plant site boundary dose A dose of 0.11of 0.57 mrem/yr was calculated to be 0.2 miles northeast of the reactor. The MEI in an unrestricted area dose location was calculated to be a secondary location accessible to the public 0.5 miles to the south-southeast of the reactor with a total body dose of 1.4 mrem/yr. An analytical nearest residence dose, including ingestion pathways, of 1.2 mrem/yr was calculated located 1.1 miles east of the reactor. The calculation of dose at this location is conservative for two reasons: a) the direction analyzed (east) is different than the direction of the actual nearest resident (north-northwest), and b) the analyzed location exists inside of an industrial park, the East Tennessee Technology Park (ETTP), where future residences are not expected to be located. The analytical resident dose also included the ingestion pathway assuming consumption of meat and vegetables cultivated at the analyzed location. The milk ingestion dose pathway was not incorporated as no dairy production was identified in the area. Incorporating the ingestion dose pathways for this distance and direction is conservative because the analytical nearest resident is located inside an industrial park where there is also no identified garden or livestock production. The site boundary and MEI location doses did not include an ingestion pathway because these locations are within the ETTP and are not evaluated as residences. on the plant property near the reactor building and a peak dose of 0.10 mrem/yr was calculated in a secondary location accessible to the public to the north-northeast of the site on the first ridge in hilly terrain. Based on these results, the dosage exposure risk from emissions of tritium is considered minimal with respect to the allowable limits in 10 CFR 20. Effluent analysis corresponding to the detailed design will be discussed in the application for an Operating License.

Access Control and Shielding Radiological control areas will be established to protect against undue risks from exposure to radiation and radioactive materials, and access to high and very high radiation areas will be controlled as required by 10 CFR 20, Subpart G. Precautionary procedures will be employed in the facility consistent with the requirements in 10 CFR 20, Subpart J.

Shielding and/or remote handling equipment is provided for worker protection from high radiation areas.

Preliminary Safety Analysis Report Radiation Protection and Waste Management Kairos Power Hermes Reactor 11-6 Revision 0 Table 11.1-1: Radiation Sources Description Contents Reactor Vessel and Internals Flibe, Fuel and Moderator Pebbles, Startup Source, Circulating Activity, Tritium, Activated Structures and Components: Graphite Reflector; Stainless Steel Vessel, Internals, and Head Components Primary Heat Transport System (PHTS)

Flibe, Activated Structures and Components inside the Reactor Cavity, Circulating Activity, Tritium, Fluorine Activation Products Primary Heat Rejection System (PHRS)

Nitrate Salt, Tritium Pebble Handling and Storage System (PHSS)

Fuel and Moderator Pebbles, Pebble Wear Products, Pebble Fragments, Activated Structures and Components inside the Reactor Cavity Inert Gas System (IGS)

Circulating Activity, Tritium, Filters, Activated Solid Deposits Inventory Management System (IMS)

Flibe, Circulating Activity, Tritium, Fluorine Activation Products Tritium Management System (TMS)

Tritium Chemistry Control System (CCS)

Flibe, Circulating Activity, Tritium, Fluorine Activation Products Decay Heat Removal System (DHRS)

Activated Structures and Components inside the Reactor Cavity Liquid Radioactive Waste Handling Liquid waste and Residual Solids Solid Radioactive Waste Handling System Filters from RBHVAC, IGS, and CCS; and dry active waste (DAW)

RBHVAC System Filters, Tritium Maintenance Hot Shop DAW, Contaminated/Activated Components Undergoing Maintenance

Preliminary Safety Analysis Report Radiation Protection and Waste Management Kairos Power Hermes Reactor 11-7 Revision 0 Table 11.1-2: Stack Parameters for Tritium Emissions Stack Nominal Stack Temperature

(°K)

Nominal Stack Diameter (m)

Nominal Stack Height (m)

Nominal Stack Exit Velocity (m/s)

Tritium Emission Rate (Curies/yr)

Spent Fuel Cooling Stack 323 3

58.5 100 Reactor Building VentilationHeat Removal Stack 323473.2 16 30.5 70.910.6 100062,500 Primary Heat Rejection Stack 423 3

65.7 100

Preliminary Safety Analysis Report Accident Analysis Kairos Power Hermes Reactor 13-2 Revision 0 13.1 INITIATING EVENTS AND SCENARIOS This section provides the events postulated for the reactor design basis. The events are grouped according to type and characteristics of the events. The event categories are:

MHA Insertion of Excess Reactivity Salt Spills Loss of Forced Circulation (includes a loss of normal electric power)

Mishandling or Malfunction of Pebble Handling and Storage System Radioactive Release from a Subsystem or Component Primary Heat Exchanger Tube Break General Challenges to Normal Operation Internal and External Hazard Events The MHA is a scenario that bounds other postulated event groups. The analysis of the MHA in Section 13.2 demonstrates the safety margins of the Hermes design.

For postulated events, figures of merit for each event category provide surrogate metrics which demonstrate that the resulting dose is bounded by the dose consequences of the MHA analysis as described in KP-TR-018-P, Transient Methodology Technical Report (Reference 2). Acceptance criteria for these figures of merit represent design limits that ensure the MHA is bounding. The acceptance criteria for the postulated event figures of merit are provided in Table 13.1-1.

The consequences of postulated events presented in this chapter would normally be mitigated by non-safety related SSCs for reactivity control and heat removal (and the building for confinement if radioactive material is released). However, consistent with the guidance in NUREG 1537, only the performance of the safety-related structures, systems, and components (SSCs) are credited in the postulated events. The performance of the SSCs also assume the worst single failure of any active components. This conservative approach to safety analysis provides additional confidence that the postulated events are bounded by the MHA. The safety classifications of SSCs are provided in Section 3.6.

The discussion on preventing certain events by design is provided in Section 13.1.10.

13.1.1 Maximum Hypothetical Accident The MHA is an event where hypothesized conditions result in a conservatively analyzed release of radionuclides that bounds a potential release from other postulated events. The MHA analysis is consistent with the fission product release accident analysis required for the 10 CFR 100.11 determination of exclusion area, low population zone, and population center distances. The MHA is a bounding event with conservative radionuclide transport assumptions that challenge the important radioactive retention features of the functional containment. This section describes the key assumptions and non-physical conditions that are hypothesized to ensure that the dose consequences from the MHA analysis bounds the dose consequences from postulated events in the design basis. The details associated with these assumptions, as well as the methods used to calculate the dose consequences of the MHA are provided in Section 13.2.1.

Preliminary Safety Analysis Report Accident Analysis Kairos Power Hermes Reactor 13-3 Revision 0 13.1.1.1 Initial Conditions Assumptions Normal operating parameters are discussed in Section 4.1. Conservative initial values are assumed for each operating parameter to maximize the release of radionuclides in the MHA.

The radioactive material that is at risk for release for the MHA includes radionuclides contained in the fuel, the radionuclides circulating in the Flibe, and the radioactive material at risk for release (MAR) distributed within the primary system (i.e., steel structures and graphite). Although radionuclides could have diffused away from the tri-structural isotropic (TRISO) fuel particles, the initial inventory of the small fraction of fuel that is defective at the initiation of the transient assumes that no diffusion has occurred. This hypothetical condition adds a bounding conservatism to the radionuclide release from the fuel and Flibe.

The TRISO fuel form and the basis for its radionuclide retention performance is discussed in Section 4.2.1. The methodology for determining the radionuclide behavior and retention properties of the fuel is provided in Section 3 of KP-TR-012, KP-FHR Mechanistic Source Term Methodology Topical Report, (Reference 1). Fuel manufacturing and in-service performance specifications are discussed in Section 4.2.1.

The Flibe design is discussed in Section 5.1. The methodology for determining the radionuclide behavior and retention properties of the Flibe is provided in Section 4 of Reference 1. A bounding value for Flibe circulating activity is assumed as the initial condition.

A bounding value of retained tritium and activated argon available for release is assumed to encompass available volume and geometry of tritium-absorbing materials in the system.

13.1.1.2 Structures, Systems and Components Mitigation Assumptions This section describes the structures, systems, and components (SSCs) that perform a function to mitigate the dose consequences of the MHA.

The reactor protection system (RPS) is credited with detecting the system disturbance and initiating a reactor trip, primary coolant and intermediate coolant pumpssalt pump (PSP) trip, heat rejection blower trip, and a pebble extraction and insertion trip. The RPS initiates a reactor trip to shut down the reactor to limit the addition of heat to the system. The pebble extraction and insertion trip stops pebbles from moving into, out of, and through the core following the reactor trip to preclude any damage to pebbles from extraction faults during the event. The primary coolant pumpPSP trip facilitates the transition to decay heat removal through the decay heat removal system (DHRS) and precludes the potential for continuous entrainment of cover gas in the Flibe during the MHA. The DHRS continued operation ensures that an adequate amount of decay heat is removed from the system. The design bases of the RPS are discussed in Section 7.3. The RPS detection and actuation capabilities are automatic and do not rely on manual action to perform these functions.

The reactivity control and shutdown system (RCSS) is credited with shutting down the reactor upon receiving the reactor trip signal. The shutdown and control elements have sufficient worth to shut down the reactor and maintain long-term shutdown. The design bases of the RCSS shutdown function are provided in Section 4.2.2.

The DHRS is credited with removing an adequate amount of decay heat from the reactor to ensure that material design temperatures are not exceeded and no incremental fuel failures occur due to elevated temperatures. The DHRS does not rely on electrical power or manual actions to operate. The DHRS rejects heat to the ultimate heat sink passively. The design bases of the DHRS heat removal function are provided in Section 6.3.

Preliminary Safety Analysis Report Accident Analysis Kairos Power Hermes Reactor 13-5 Revision 0 the reactivity control function. The decay heat removal system is already running because the limiting insertion of reactivity event occurs at an initial power above the DHRS threshold power discussed in Section 6.3, limiting reactor temperature and fulfilling the heat removal function.

This postulated insertion of excess reactivity bounds other insertion of reactivity events, including:

Reactivity insertion events caused by fuel loading error (e.g., errors in rate of fresh fuel injection, incorrect order of fuel insertion)

Reactivity insertion events with concurrent pump trip Reactivity insertion events with normal heat rejection available Local phenomena leading to ramp insertion of reactivity Change in reactivity due to shifting of graphite reflector blocks Venting of gas bubbles accumulated in the active core Local phenomena leading to step insertion of reactivity Local negative reactivity anomaly (e.g.,inadvertent single element insertion, cover gas injection)

Reactivity insertion events during startup Increase in heat removal events (e.g., primary salt pump (PSP) overspeed, intermediate pump overspeedheat rejection blower overspeed)

The following sections describe the key assumptions associated with the limiting postulated insertion of excess reactivity event. The quantitative values associated with these assumptions, as well as the methods used to evaluate the surrogate figures of merit that ensure the event consequences are bounded by the MHA, are provided in Reference 2.

13.1.2.1 Initial Conditions Assumptions Normal operating parameters are provided in Section 4.1. Conservative initial values are assumed for each operating parameter to ensure a bounding result for the figures of merit that demonstrate the reactivity insertion event is bounded by the MHA.

The control element is assumed to be fully inserted as the initial condition for the event initiator.

13.1.2.2 Structures, Systems, and Components Mitigation Assumptions This section describes the SSCs performing a function to mitigate the consequences of the event.

The RPS is credited with detecting the reactivity insertion and initiating a reactor trip after sensing a high neutron flux or a high coolant temperature. The DHRS is operating when the reactor is above a threshold power, as discussed in Section 6.3, and remains in an always on mode. The RPS initiates a reactor trip to shut down the reactor and limit the addition of heat to the system. The pebble handling and storage system (PHSS) trip stops pebble extraction and insertion following the reactor trip to preclude damage to pebbles from faults during the event. The DHRS remains active to ensure that an adequate amount of decay heat is removed from the system. The design bases of the RPS are discussed in Section 7.3. The RPS detection and actuation capabilities are automatic and do not rely on manual operator action to perform these functions.

The RCSS is credited with shutting down the reactor upon receiving the reactor trip signal. The shutdown and control elements are assumed to have sufficient worth to shut down the reactor and maintain long term shutdown. The design bases of the RCSS shutdown function are provided in Section 4.2.2.

Normal heat rejection is expected to be available during this transient because those systems are not affected by the event initiator. However, normal heat rejection is conservatively assumed to not be

Preliminary Safety Analysis Report Accident Analysis Kairos Power Hermes Reactor 13-6 Revision 0 available during the transient. The DHRS and natural circulation within the reactor vessel are credited with removing an adequate amount of decay heat from the reactor to ensure that material design temperatures are not exceeded and no incremental fuel failures occur due to elevated temperatures.

The DHRS does not rely on electrical power or manual operator actions to operate. Natural circulation within the core transfers heat from the fuel to the reactor vessel shell. Energy is transferred from the vessel shell to the DHRS and the DHRS rejects the heat to the ultimate heat sink passively. The design bases of natural circulation in the vessel and the DHRS heat removal function are provided in Section 4.3 and Section 6.3, respectively.

The TRISO fuel layers and the Flibe are credited with the radionuclide retention properties described in Reference 1. For the Flibe to maintain the retention properties described in Reference 1, the portion of the reactor vessel that ensures the pebbles in the core remain covered by Flibe is credited with maintaining integrity under the postulated event conditions.

13.1.2.3 Transient Assumptions This section describes the assumptions associated with the transient and its effects on the surrogate figures of merit.

The postulated event analysis assumes conservative trip and actuation delays to account for uncertainty in the signal time associated with the RPS.

The amount of heat in the system is conservatively modeled in the postulated event by assuming bounding conditions for heat addition and heat removal. The transient initiator is a ramp insertion of reactivity that bounds the possible withdrawal speed and worth of a control element. Conservative values for reactivity feedback are assumed to limit the feedback available to reduce the severity of the reactivity insertion transient. Heat addition in the core during the transient is maximized by assuming a limiting element worth vs position curve that assumes the highest worth element is stuck out. The heat removal rate assumes a single failure in the DHRS by neglecting the heat removal capability provided by one of the four trains.

The key figures of merit for this event and the acceptance criteria are provided in Table 13.1-1.

A safe state is established when:

The core is subcritical and long term reactivity control is assured.

Decay heat is being removed and long-term cooling is assured, where figure of merit temperatures are steadily decreasing, and Flibe temperature within the reactor vessel remains above Flibe freezing temperature during the mission time of DHRS.

13.1.3 Salt Spills There are various initiators that can result in a salt spill event. These postulated events are bounded by the MHA, ensuring no salt spill results in unacceptable dose consequences. The limiting salt spill postulated event initiates when a hypothetical double-ended guillotine break in the PHTS piping during normal operation causes a Flibe spill. The salt spill is detected by the RPS due to low reactor coolant level, which initiates control and shutdown elements insertion, fulfilling the reactivity control function.

The decay heat removal system is already running because the limiting salt spill event occurs at an initial power above the DHRS threshold power discussed in Section 6.3, limiting reactor temperature and fulfilling the heat removal function. The RPS trips the PSP to limit the amount of spilled Flibe. The intermediate salt pump (ISP) is tripped concurrently to ensure a positive pressure differential between the primary and intermediate loops. The RPS trips the heat rejection blower to limit the amount of air ingress following postulated heat rejection radiator (HRR) tube breaks. The postulated break causes

Preliminary Safety Analysis Report Accident Analysis Kairos Power Hermes Reactor 13-7 Revision 0 negative pressure difference and allows air to enter the reactor system. In the reactor vessel head space, air reacts with Flibe to form volatile products and oxidizes portions of the structural graphite above the surface of the Flibe and the carbon matrix for pebbles in transit above the surface of the Flibe.

Radionuclides from the coolant circulating activity in the broken pipe are released into the facility air when aerosols are generated from the coolant that exits the pipe. All the floor surfaces where Flibe may be spilled will have design features such as steel liners to prevent Flibe-concrete interaction, as described in Section 3.5. The spilled Flibe spreads on top of the liner and forms a Flibe pool.

Radionuclides in the spilled Flibe is released through evaporation until the top surface of the Flibe pool is solidified.

The limiting salt spill postulated event bounds other salt spill events, including:

Spurious draining and smaller leaks from the primary heat transport system Leaks from otherFlibecontaining systems and components (e.g., IMS fill/drain tank, IMS piping, chemistry control system piping)

Leaks up to the hypothetical double-ended guillotine primary salt piping break size Mechanical impact or collision events involvingFlibeContaining SSCs (except the vessel)

Single or multiple HRR tube(s) break Leaks from the primary heat rejection systemthat contains a non-Flibecoolant, which may contain non-zero amount ofFlibefrom heat exchanger leaks These following sections describe key assumptions associated with the limiting salt spill event. The quantitative values associated with these assumptions, as well as the methods used to evaluate the surrogate figures of merit that ensure the event consequences are bounded by the MHA are provided in Reference 2.

13.1.3.1 Initial Conditions Assumptions Normal operating parameters are provided in Section 4.1. Conservative initial values are assumed for each operating parameter to ensure a bounding result for the figures of merit that demonstrate the event is bounded by the MHA.

A hypothetical double-ended guillotine break in the PHTS hot leg piping is assumed as the event initiator. The initial Flibe conditions are discussed in Section 5.1.

13.1.3.2 Structures Systems and Components Mitigation Assumptions This section describes the SSCs performing a function to mitigate the consequences of the event.

The RPS is credited with detecting the break on low reactor coolant level and initiating a reactor trip, PSP trip, ISP trip, heat rejection blower trip, and the PHSS trip. The DHRS is operating when the reactor is above a threshold power, as discussed in Section 6.3, and remains in an always on mode. The RPS initiates a reactor trip to shut down the reactor and limits the addition of heat to the system. The RPS trips the PSP to limit the amount of spilled Flibe. The ISP is tripped concurrently to ensure a positive pressure differential between the primary and intermediate loops. The heat rejection blower is tripped to limit the amount of air ingress following postulated HRR tube breaks. The PHSS trip stops pebble extraction and insertion following the reactor trip to preclude any damage to pebbles from faults during the event. The DHRS remains active to ensure that an adequate amount of decay heat is removed from the system. The design bases of the RPS are discussed in Section 7.3. The RPS detection and actuation capabilities are automatic and do not rely on manual operator action to perform these functions.

The RCSS is credited with shutting down the reactor upon receiving the reactor trip signal. The shutdown and control elements are assumed to have sufficient worth to shut down the reactor and

Preliminary Safety Analysis Report Accident Analysis Kairos Power Hermes Reactor 13-9 Revision 0 fulfilling the reactivity control function. The decay heat removal system is already running because the limiting loss of forced circulation event occurs at an initial power above the DHRS threshold power discussed in Section 6.3, limiting reactor temperature and fulfilling the heat removal function.

The limiting loss of circulation postulated event bounds other loss of circulation events, including:

Blockage of flow path external to the reactor vessel in the primary heat transport system Spurious pump trip signal Shaft fracture Bearing failure Pump control system errors Supply breaker spurious opening Loss of net-positive suction head (e.g., pump overspeed, low level)

Loss of normal electrical power Flibe freezing inside HRR Loss of normal heat sink The following sections describe the key assumptions associated with the limiting loss of forced circulation. The quantitative values associated with these assumptions, as well as the methods used to evaluate the surrogate figures of merit that ensure the event consequences are bounded by the MHA are provided in Reference 2.

13.1.4.1 Initial Conditions Assumptions Normal operating parameters are provided in Section 4.1. Conservative initial values are assumed for each operating parameter to ensure a bounding result for the figures of merit that demonstrate the event is bounded by the MHA.

The loss of forced circulation event initiator is assumed to be a pump seizure, which disables the PSP.

13.1.4.2 Structures Systems and Components Mitigation Assumptions This section describes the SSCs performing a function to mitigate the consequences of the event.

The RPS is credited with initiating a reactor trip. The PHSS is tripped to prevent damage to fuel in transit and the ISP is tripped to ensure a positive pressure differential between the primary and intermediate loops. The DHRS is operating when the reactor is above a threshold power, as discussed in Section 6.3, and remains in an always on mode. The RPS initiates a reactor trip to shut down the reactor and limits the addition of heat to the system. The PHSS trip stops pebble extraction and insertion following the reactor trip to preclude any damage to pebbles from faults during the event The DHRS remains active to ensure that an adequate amount of decay heat is removed from the system. The design bases of the RPS are discussed in Section 7.3. The RPS detection and actuation capabilities are automatic and do not rely on manual operator action to perform these functions.

The RCSS is credited with shutting down the reactor upon receiving the reactor trip signal. The shutdown and control elements are assumed to have sufficient worth to shut down the reactor and maintain long term shutdown. The design bases of the RCSS shutdown function are provided in Section 4.2.2.

The DHRS and natural circulation within the reactor vessel are credited with removing an adequate amount of decay heat from the reactor to ensure that material design temperatures are not exceeded and no incremental fuel failures occur due to elevated temperatures. The DHRS does not rely on electrical power or manual operator actions to operate. Natural circulation within the core transfers

Preliminary Safety Analysis Report Accident Analysis Kairos Power Hermes Reactor 13-12 Revision 0 Tritium management system Inert gas system Chemistry control system (including filters)

Inventory management system Primary heat rejection system The tritium storage strategy discussed in Section 9.1.3 ensures that the amount of MAR accumulated by this system remains below the amount of tritium assumed to be released in the MHA. Limiting the amount of MAR in subsystems and components obviates the need for a more detailed safety analysis for this category of events.

13.1.7 Primary Heat Exchanger Tube BreakNot Used The limiting event in this category is a complete break of a primary heat exchanger (PHX) tube. The positive pressure difference maintained between the primary loop and intermediate loop forces the primary Flibe coolant into the intermediate coolant loop and mixes with the secondary nitrate coolant. The tube break is detected by the reactor protection system due to a drop in the reactor coolant level, which initiates control and shutdown elements insertion, fulfilling the reactivity control function. The RPS also initiates an ISP trip and a PSP trip to limit nitrate ingress into the reactor vessel. The reactor decay heat removal system performs its function to limit reactor temperature and fulfill the heat removal function.

A grouped event in this category is a PHX tube leak.

13.1.7.1 Initial Conditions Assumptions Normal operating parameters are provided in Section 4.1. Conservative initial values are assumed for each operating parameter to ensure a bounding result for the figures of merit that demonstrate the event is bounded by the MHA.

A complete break of a single PHX tube is assumed to be the event initiator.

13.1.7.2 Structures Systems and Components Mitigation Assumptions This section describes the SSCs performing a function to mitigate the consequences of the event.

The RPS is credited with initiating a reactor trip and a PHSS trip on low reactor coolant level. The DHRS is operating when the reactor is above a threshold power, as discussed in Section 6.3, and remains in an always on mode. The RPS initiates a reactor trip to shut down the reactor and limits the addition of heat to the system. The PHSS trip ensures stops pebble extraction and insertion following the reactor trip to preclude any damage to pebbles from faults during the event. The DHRS remains active to ensure that an adequate amount of decay heat is removed from the system. The design bases of the RPS are discussed in Section 7.3. The RPS detection and actuation capabilities are automatic and do not rely on manual action to perform these functions.

The RCSS is credited with shutting down the reactor upon receiving the reactor trip signal. The shutdown and control elements are assumed to have sufficient worth to shut down the reactor and maintain long term shutdown. The design bases of the RCSS shutdown function are provided in Section 4.2.2.

The DHRS and natural circulation within the reactor vessel are credited with removing an adequate amount of decay heat from the reactor to ensure that material design temperatures are not exceeded and no incremental fuel failures occur due to elevated temperatures. The DHRS does not rely on

Preliminary Safety Analysis Report Accident Analysis Kairos Power Hermes Reactor 13-13 Revision 0 electrical power or manual actions to operate. Natural circulation within the core transfers heat from the fuel to the reactor vessel. Energy is transferred from the vessel shell to the DHRS, and the DHRS rejects the heat to the ultimate heat sink passively. The design bases of natural circulation in the vessel and the DHRS heat removal function are provided in Section 4.3 and Section 6.3, respectively.

A positive pressure differential between the PHTS and the PHRS is credited with limiting intermediate coolant ingress into the PHTS and reactor vessel.

The TRISO fuel layers and the Flibe are credited with the radionuclide retention properties described in Reference 1. For the Flibe to maintain the retention properties described in Reference 1, the integrity of the portion of the reactor vessel that ensures the pebbles in the core remain covered by Flibe is credited with maintaining integrity under the postulated event conditions.

13.1.7.3 Transient Assumptions This section describes the assumptions associated with the transient and its effects on the surrogate figures of merit.

The postulated event analysis assumes conservative trip and actuation delays to account for any uncertainty in the signal time associated with the RPS.

The amount of heat in the system is conservatively modeled in the postulated event by assuming bounding conditions for heat addition and heat removal. Conservative values for reactivity feedback are assumed to limit the feedback available prior to reactor trip. Heat addition in the core during the transient is maximized by assuming a limiting element worth vs position curve that assumes the highest worth element is stuck out. The heat removal rate assumes a single failure in the DHRS by neglecting the heat removal capability provided by one of four trains.

A conservative amount of Flibe is assumed to flow into the secondary loop to mix with the nitrate.

The key figures of merit for this event and the acceptance criteria are provided in Table 13.1-1.

A safe state is established when:

The core is subcritical andlong termreactivity control is assured.

The decay heat is being removed andlong termcooling is assured, where figure of merit temperaturesaresteadily decreasing andFlibetemperature remains aboveFlibefreezing temperature during the mission time of the decay heat removal system.

The Flibe leak into the intermediate coolant loop is contained and there is no significant intermediate coolant ingress into the reactor system 13.1.8 General Challenges to Normal Operation This category of events includes challenges to normal operation not covered by another event category that requires an automatic or manual shutdown of the plant. Disturbances, including an inadvertent operator action, are detected directly or indirectly by the RPS, which initiates control and shutdown elements insertion, fulfilling the reactivity control function. The highest worth element is assumed to be stuck out and does not insert. The DHRS performs its function to limit reactor temperature and fulfill the heat removal function.

Grouped events include spurious trips due to control system anomalies, operator errors and equipment failures. This event group also includes scenarios where operators choose to manually shutdown the plant. Also included are faults in the reactivity control and shutdown system, electrical system, primary heat rejection subsystem and other plant systems that would challenge normal operations.

Preliminary Safety Analysis Report Accident Analysis Kairos Power Hermes Reactor 13-15 Revision 0 13.1.10.1 Recriticality or Unprotected Events In postulated events that require a reactor trip, the RCSS is relied upon to shut down the reactor and maintain shutdown margin. Unprotected events, or events where reactor shutdown is not achievable, are excluded from the design basis. Events that would result in a recriticality event are also excluded from the design basis. The RCSS is designed (described in Section 4.2.2) with sufficient independence, diversity, and redundancy from detection and actuation to element insertion to ensure reactor shutdown when necessary. The shutdown margin is maintained for all postulated event conditions to ensure there is no recriticality after the RCSS has initiated shutdown, as described in Section 4.5.

Additionally, the graphite reflector blocks are designed to maintain structural integrity and ensure misalignments do not prevent the insertion path of the shutdown elements, as discussed in Section 4.3.

13.1.10.2 Degraded Heat Removal or Uncooled Events In postulated events where the normal heat rejection is not available, natural circulation in the reactor vessel and the heat removal function of the DHRS are relied upon to remove heat from the reactor core.

Degraded heat removal or uncooled events are excluded from the design basis. The initiation of natural circulation is completely passive, and the design features, including the structural integrity of the reactor vessel internals, that ensure a continued natural circulation flow path are discussed in Section 4.6. The DHRS is aligned and operating when the reactor power is above a threshold power and remains in this state as described in Section 6.3, precluding the need for an actuation to occur for the DHRS to remove heat during a postulated event. The DHRS design includes sufficient redundancy to perform its safety function assuming the loss of a single train, as discussed in Section 6.3.

13.1.10.3 Flibe Spill Beyond Maximum Volume Assumed in Postulated Salt Spills In the salt spill postulated event category, an upper bound volume of Flibe is assumed to spill out of the PHTS onto the floor. A volume of Flibe spilling out of the system beyond the amount assumed in the bounding salt spill event is excluded from the design basis. There are several design features ensuring the amount of Flibe available to spill is limited to an upper bound value. The reactor vessel is designed with anti-siphon features discussed in Section 4.3. These features are designed to passively break the siphon in the event of a break. The PSP also trips to allow the primary system to depressurize. The reliability of the RPS, which trips the PSP and ISP heat rejection blower in the event of a salt spill, is discussed in Section 7.3. The reactor vessel shell also maintains integrity in postulated events to ensure the fuel in the core remains covered with Flibe. The reactor vessel shell design features that prevent leakage are discussed in Section 4.3.

13.1.10.4 In-Service TRISO Failure Rates and Burnups Above Assumptions in Postulated Events The in-service fuel failure rates and the burnup of pebbles assumed in the postulated events are based on the fuel qualification specifications in Section 4.2.1. In-service TRISO failure rates above the rate assumed in postulated events are excluded from the design basis. The insertion of pebbles with a burnup higher than the fuel qualification envelope is excluded from the design basis. As described in Section 7.3, the RPS includes a function to stop the pebble insertion and extraction functions to ensure pebbles are not damaged in faults occurring after an event initiation. The fuel qualification program includes testing, inspection, and surveillance to ensure the fuel operating envelope is within the fuel qualification envelope. Inspection and surveillance of the fuel in service is performed in the PHSS as discussed in Section 9.3.

13.1.10.5 Significant Intermediate Coolant Ingress Into PHTSSignificant Air Ingress Into PHTS The postulated events assume a positive pressure differential between the primary and intermediate coolant systems. Events where significant quantities of intermediate coolant enter the PHTS are

Preliminary Safety Analysis Report Accident Analysis Kairos Power Hermes Reactor 13-16 Revision 0 excluded from the design basis. Chapter 5 discusses the design features of the PHTS and PHRS that maintain a positive pressure differential.

Events where significant quantities of air are entrained in the PHTS coolant during normal operation are excluded from the design basis. Operational controls are expected to monitor the quantity of air within the PHTS to prevent accumulating significant quantities. Chapter 14 discusses the expected coolant systems technical specifications that monitor significant air ingress.

Events where significant quantities of air enter the PHTS following postulated HRR tube break events are also excluded from the design basis. Chapter 5 discusses the design features of the HRR that limits the quantities of air ingress during salt spill transients.

13.1.10.6 DHRS Reactor Cavity Flooding The DHRS is a water-based system that removes heat from the reactor vessel shell. Events where the water from the DHRS leaks into the reactor cavity in quantities significant enough to wet the reactor vessel are excluded from the design basis. Leak prevention, including double walled components and leak detection, for the DHRS is described in Section 6.3.

13.1.10.7 Insertion of Excess Reactivity Beyond Rate Assumed in Postulated Events The insertion of excess reactivity postulated event category includes a limiting reactivity insertion rate based on the maximum control element drive withdrawal rate. Multiple control elements moving simultaneously is excluded from the design basis. Control element movement is limited to one element at a time, as described in Section 7.2. A control element withdrawing faster than the limit is excluded from the design basis. The maximum drive withdrawal speed is limited by the drive hardware, as described in Section 4.2.2. A rapid control element ejection is excluded from the design basis because the reactor operates at low pressures.

The insertion of reactivity due to an overcooling event is also bounded by the limiting reactivity insertion rate. Core cooling due to pump overspeed from the PSP, ISP, or PHRS blower are and heat rejection blower are limited to a maximum limit within the programmed normal operating range discussed in Section 7.2.

13.1.10.8 Criticality Occurrence External to Reactor Core Pebbles outside of the reactor core are contained in the PHSS. The PHSS includes pebbles in transit during handling, in storage, and in a transport configuration. The PHSS is designed to preclude criticality assuming postulated event conditions using design features that maintain a non-critical geometry of pebbles in each of these areas. The design features of PHSS preventing criticality are described in Section 9.3.

13.1.10.9 Excessive Radionuclide Release from Flibe The postulated events assume a release of radionuclides from the free surfaces of Flibe. The assumed release of radionuclides from Flibe could be affected by the characteristics of the cover gas such as a higher pressure affecting the cover gas flow or the purity of the cover gas affecting the radionuclides available for release. The cover gas is maintained by the inert gas system, described in Section 9.1.2.

13.1.10.10 Internal or External Events Interfering with SSCs SSCs that perform safety functions are located in a portion of the reactor building designed to preclude damage from both internal and external hazards that could interfere with those functions. Additionally, SSCs containing Flibe are protected from internal floods to preclude the potential for Flibe - water interactions. The failure of safety functions due to internal or external hazards is excluded from the

Preliminary Safety Analysis Report Accident Analysis Kairos Power Hermes Reactor 13-23 Revision 0 Table 13.1-1: Acceptance Criteria for Figures of Merit Figure of Merit Acceptance Criterion Applicable Events Peak TRISO temperature-time Generally bounded by temperature-time curves derived from the assumed MHA fuel temperature-time curve Salt Spill,Reactivity Insertion, Increase in Heat Removal, Loss of Forced Circulation, PHSS break, Seismic, PHX Tube Break Peak TRISO temperature-time Below incremental TRISO fuel failure temperature Salt Spill, Reactivity Insertion, Increase in Heat Removal, Loss of Forced Circulation, PHSS break, PHX Tube Break Peak Flibe-cover gas interfacial temperature Generally bounded by temperature-time curves derived from the assumed MHA Flibe-cover gas interfacial temperature-time curve Salt Spill, Reactivity Insertion, Increase in Heat Removal, Loss of Forced Circulation, PHSS break, PHX Tube Break Peak vessel and core barrel temperatures Bounded by both the maximum allowable temperature derived to limit excessive creep deformation and damage accumulation and by 816°C (highest temperature considered by ASME Section III Division 5 for 316H)

Salt Spill, Reactivity Insertion, Increase in Heat Removal, Loss of Forced Circulation, PHSS break, PHX Tube Break Airborne release fraction of spilled/splashed Flibe Below airborne release fraction limitderived to bound total releases of the postulated event to less than the MHA Salt Spill, Seismic, PHX Tube Break Volatile product formation from Flibe-air reaction Negligible amount of additional volatile products formed Salt Spill, PHSS break, PHX Tube Break Volatile product formation from Flibe chemical reaction with water, concrete, and/or construction materials (e.g.,

insulation, steel)

Negligible amount of additional volatile products formed Salt Spill Volatile product formation from Flibe chemical reaction with nitrate Negligible amount of additional volatile products formed PHX Tube Break

Preliminary Safety Analysis Report Accident Analysis Kairos Power Hermes Reactor 13-24 Revision 0 Figure of Merit Acceptance Criterion Applicable Events Mass loss of pebble carbon matrix due to oxidation Mass loss does not extend into the fueled zone Salt Spill, PHSS break Mass loss of structural graphite due to oxidation Bounded by the MHA release Salt Spill, PHSS break Peak structural graphite temperature-time Generally bounded by temperature-time curves derived from the assumed MHA structural graphite temperature-time curve Salt Spill, Reactivity Insertion, Increase in Heat Removal, Loss of Forced Circulation, PHSS break, PHX Tube Break Peak pebble carbon matrix temperature-time Generally bounded by temperature-time curves derived from the assumed MHA pebble carbon matrix temperature-time curve Salt Spill, Reactivity Insertion, Increase in Heat Removal, Loss of Forced Circulation, PHSS break, PHX Tube Break Peak TRISO temperature-time ex-vessel Generally bounded by temperature-time curves derived from the assumed MHA fuel temperature-time curve PHSS break Amount of materials at risk released Less than limit derived to bound total releases of the postulated event to less than the MHA PHSS break

Preliminary Safety Analysis Report Technical Specifications Kairos Power Hermes Reactor 14-4 Revision 0 Section Section Name LCO or Condition Basis 3.0 Limiting Conditions for Operation (LCOs)

LCOs are derived from the safety analysis and are implemented administratively or by control and monitoring systems to ensure safe operation of the facility.

The LCOs are the lowest functional capability or performance level required for safe operation of the facility.

The proposed subjects of LCOs are provided below.

3.1 Reactor Core Parameters Pebble wear is within acceptable limits to support pebble reinsertion.

The objective is to ensure that pebble wear is controlled within limits assumed by or associated with safety analyses, to prevent reinsertion if wear exceeds those limits.

Reactor power shall not exceed the licensed reactor power level.

The objective is to limit the maximum operating power to ensure that the safety limits will not be exceeded.

3.2 Reactor Control and Safety Systems Reactivity coefficients are within limits over the allowable range of operation.

The objective is to infer or calculate reactivity coefficients during normal plant operation to limit the severity of a reactivity transient.

Reactor protection system operability The objective is to specify the requirement to have an operable reactor protection system to ensure that the safety limits will not be exceeded.

3.3 Coolant Systems The radionuclide inventory of the reactor coolant in steady state (e.g., from transmutation of actinides) is maintained within an upper bound limit.

The objective is to limit key radionuclide inventories in the reactor coolant during steady state to ensure that any postulated event does not exceed limits.

Preliminary Safety Analysis Report Technical Specifications Kairos Power Hermes Reactor 14-5 Revision 0 Section Section Name LCO or Condition Basis Primary heat transport system pressure and flow rate are maintained within an upper bound limit.

The objective is to limit the quantity and pressure of spilled Flibe to ensure a postulated event does not exceed limits.

Inlet gas system pressure is maintained within an upper bound limit.

The objective is to limit the quantity and pressure of spilled Flibe or cover gas to ensure a postulated event does not exceed limits.

Argon purity in the cover gas is maintained within an upper bound limit.

The objective is to limit radionuclides in the Flibe below solubility limits where solute-solute interactions can be neglected.

The quantity of materials at risk in the gas space of the primary heat transport system and the primary heat rejection system is maintained within an upper bound limit.

The objective is to limit the quantity of materials at risk in the cover gas to ensure a postulated event does not exceed limits.

The quantity of air in the reactor coolant during steady state is maintained within an upper bound limit.

The objective is to limit the air ingress to the reactor coolant to prevent void accumulation and corrosion.

3.4 Engineered Safety Features Decay heat removal system operability The objective is to specify the requirement to have an operable decay heat removal system to ensure that the safety limits will not be exceeded.

Reactor vessel integrity The objective is to specify a design operating temperature limit to ensure the safety limit is not exceeded for postulated events.

3.5 Ventilation Systems N/A N/A