ML22242A168

Kairos Power LLC, Changes to Construction Permit Application - PSAR Chapters 3, 4, 8, and 13

ML22242A168
Person / Time
Site:	Hermes File:Kairos Power icon.png
Issue date:	08/30/2022
From:	Kairos Power
To:	Office of Nuclear Reactor Regulation
Shared Package
ML22242A166	List: ML22242A167 ML22242A168
References
KP‐NRC‐2208‐012
Download: ML22242A168 (18)

Text

KPNRC2208012

Enclosure ChangestoPSARChapters3,4,8,and13 (NonProprietary)

Preliminary Safety Analysis Report Design of Structures, Systems, and Components

Table 3.6 -1 : Structures, Systems, and Components SSC Name S afety Seismic Quality Program SAR Section Plant Area Classification Classification Reactor System Fuel Pebbles Safety -related N/A Quality -Related 4.2.1 SR area 1

Moderator Pebbles Non -safety related N / A No t Quality -Related 4.2.1 SR area

Reactivity Control and Shutdown System (RCSS)

Control Elements and Non -Safety safety - SDC -3 Local Building Not Quality -Related 4.2.2 SR area Shutdown Elements related Code Shutdown Elements, S afety -related SDC -3 Quality -Related 4.2.2 SR area including latching /release mechanism RCSS drive systems, except Non -safety related SDC -2 Local Building No t Quality -Related 4.2.2 SR area shutdown element latching Code mechanisms Neutron Startup Source Non -safety related SDC -2 No t Quality -Related 4.2.3 SR area Reactor Vessel System Safety -related SDC -3 Quality -Related 4.3 SR area Biological Shield 2 S afety related SDC -3 Quality -Related 4.4 SR area Reactor Vessel Support Safety -related SDC -3 Quality -Related 4.7.3 SR area System Reactor Thermal Management System (RTMS)

Reactor Auxiliary Heating Non -safety related SDC -2 No t Quality -Related 9.1.5 SR and NSR area s System Equipment and Structure Non -safety related SDC -2 No t Quality -Related 9.1.5 SR and NSR area s Cooling System Decay Heat Removal System (DHRS)

DHRS components 4 except Safety -related SDC -3 Quality -Related 6.3 SR area for steam vent di scharge and makeup -water components

Kairos Power Hermes Reactor 3 -34 Revision 0 Preliminary Safety Analysis Report Reactor Description

The thermal hydraulic analysis of the core (see Section 4.6) ensures that adequate coolant flow is obtained to ensure th at SARRDLs, which are discussed in Section 6.2, are met.

4.2.1.7 Testing and Inspection The cover gas and reactor coolant are monitored for circulating activity, which is an indirect measurement of TRISO failures. Circulating activity limits will be provided in the technical specifications.

Fuel p ebbles are subject to examination for damage and burnup as they exit the core. Pebbles are inspected to identify damage such as wear, cracking, missing surfaces from chipping, etc. Fuel pebbles are also examined by gamma spectrometry to determine the burnup through the measurement of gamma activity from signature fission products. Pebbles approaching or at the burnup limit are not returned to the core and instead are sent to storage. Similarly, pebbles that show indications of wear, cracking, or missing surfaces are removed from service. These inspections are described in Section 9.3.

4.2.2 Reactivity Control and Shutdown System The reactivity control and shutdown system (RCSS) provides reactivity control during normal operation and also provides shutdown of the reactor in response to abnormal conditions or postulated events.

4.2.2.1 Description The RCSS inserts and withdraws control and shutdown includes two separate system features (means) elements to control reactivity in the reactor core. The system provides two separate mean s to accomplish this function - control elements and shutdown elements.

The non -safety related control elements are used to control the reactivity for normal operations and for planned, normal startup, shutdown, and power changes in the reactor. The control elements can be positioned throughout their range of travel to support operational demands. The portion of these elements that relate s to their release and insertion on a reactor trip is safety -related.

The shutdow n elements, in combination with the control elements, are credited for shut ting down the reactor during postulated events. The shutdown elements are located to optimize reactivity worth and to meet shutdown margin requirements. These elements have two posi tions, fully withdrawn or fully inserted. These elements are safety -related.

Both the control and shutdown elements are tripped automatically by the reactor p rotection s ystem, or manually from the main control room or remote shutdown panel. The plant control system is used to withdraw and insert the control and shutdown elements during normal operation. Instrumentation and control systems are described in Chapter 7.

The shutdown and control elements have two different designs. Each control element is an assembly of segmented annular cylinders. The annular cylinder s are welded to connection plates at various points along the length of the control elements. S tainless stee l s pine s are used to connect the array of control elements together. Each shutdown element is an array of small rods arranged in a cruciform shape. The control element design is shown in Figure 4.2 -3 (cross -section) and Figure 4.2 -4 (side -view). The shutdown element design is shown in Figures 4.2 -5 (cross -section) and Figure 4.2 -6 (side -view). There are seven elements in total in the RCSS design, which is comprised of three shutdown elements and four control elements. The control elements insert into guide structure s in the upper an d side reflector, near the periphery of the core. The shutdown elements insert into guide structures in the upper reflector,

then directly into the pebble bed. The location s of the control and shutdown elements are shown in Figure 4.2 -7. The control element and shutdown element design parameters are summarized in Table 4.2 -4.

Kairos Power Hermes Reactor 4 - 9 Revision 0 Preliminary Safety Analysis Report Reactor Description

The control elements are positioned via a counter -weighted winch system (Figure 4.2 -8 ). The shutdown elements are also positioned by a counter -weighted winch, but they are typically only ful ly inserted or fully withdrawn. In the counter -weighted winch system, a wire -rope is connected to the element, and travels up around the sheave and down to a counter -weight. The counter -weight allows the wire -rope to wrap around the sheave without having t o anchor the wire rope, similar to a capstan. The shea v e, commonly known as a winch drum, is rotated by an electric motor. There is an electric clutch between the motor and the sheave. The motor allow s small and controlled movements of the element. The max imum withdrawal and insertion time for the shutdown and control elements is 100 seconds over the full range of motion for motor -driven operations.

O n a reactor trip, the electric clutch opens, which allows the sheave to rotate freely. With the sheave rotating freely, the shutdown and control elements are released from their drives and drop into the core and reflector, respectively, as a result of gravity. The control and s hutdown elements reach 90 percent insertion by gravity in no more than 10 seconds. Although both the control elements and the shutdown elements receive a reactor trip signal, The the release of the clutch for the shutdown elements provides the primary safe ty safety -related reactor trip release mechanism. A redundant and diverse means for inserting the element is through electrical isolation of the motor itself, which allows it to rotate freely, allowing the elements to gravity insert.

Element Control and shutdown e lement position is monitored using two independent and diverse methods. The motor position is measured using an absolute encoder allowing the determination of th e angle the sheave has swept from a known reference point, which directly correlates to the element position. The second position measurement device is a high -density reed switch array. Similar to existing reed switch position measurement designs, this instrument measures the position of the counterweigh t over its full range of motion. The reed switch array provides a n analog signal, and the encoder provides a digital signal and the two used together provide s the ability to determine the element positio n, while allowing real time functional checks.

The materials used in the R CSS are shown in Table 4.2 -4. The primary materials are the B 4C absorber material and the stainless steel 316 H cladding. The operating conditions are such that the control and shutdown elements are immersed in reactor coolant and experience temperatures up to 700 °C during operation. The upper portion s of the control and shutdown elemen ts are exposed to reactor cover gas above the reactor coolant free surface. The control and shutdown drive mechanisms above the vessel are maintained at temperatures below their mechanical limits. The B 4C neutron absorber material is contained in pellets, which are stacked in SS 316 H cylindrical tubes (pressurized with inert gas ). T he control and shutdown drive mechan isms are also made of stainless steel.

4.2.2.2 Design Basis Consistent with PDC 2, the safety -related portion of the RCSS perform s the shutdown function under design basis natural phenomena events.

Consistent with PDC 4, the safety -related portion of the RCSS accommodate s the effects of and to be compatible with the environmental conditions during normal plant operation as well as du ring postulated events as a result of equipment failures.

Consistent with PDC 23, the safety -related po rtion of the RCSS fail s into a safe state in the event of adverse conditions or environments.

Consistent with PDC 26, the RCSS provides an independent a nd diverse means of controlling reactivity to assure that shutdown margin is maintained and that SARRDLs are not exceeded under conditions of normal operation. In addition, the RCSS provides a means of inserting negative reactivity at a sufficient

Kairos Power Hermes Reactor 4 -10 Revision 0 Preliminary Safety Analysis Report Reactor Description

rate to a ssure wi th appropriate margi n for malfuncti ons and al so provide a me ans to maintain the re actor shutdown for fuel loadi ng, i nspecti on and repair.

Consiste nt wi th P DC 28, the RCSS has appropriate limit s on the potential am ount and rate of reactivity increa se to ensure the effe cts of postulate d reactivity eve nts can neithe r damage the safety significant-related elements of th e reactor coolant boundary or disturb th e core and internals such th e abilit y to cool the core i s impaired. The system allow s only one eleme nt to move at a give n time.

Consiste nt wi th P DC 29, the shutdown elements, in conjuncti on wit h reacto r p rotecti on system s, assure an extremel y hi gh probabili ty of accomplishi ng their safety -relate d functions.

4.2.2.3 System Evaluation The R CSS m eets the d esign bases as described below:

PDC 2 As noted in Section 4.2.2.1, th e control shutdown elements are inserted into guid e structure s i n the uppe r reflector and the n directl y i nto the pebble bed. The RCSS compone nts, guid e structures, and reflector block s ensure th e abilit y of th e control and shutdown elements to insert under conditions of reflector block misalignme nt that coul d potentiall y occur in a desig n basi s earthquake. The desig n basis earthqua ke is describe d in Secti on 3.4. Thi s seismic analysi s determine s the maximum deflecti on of the insertion path. Insertion capability will be assessed in a o ne-ti me test pri or to initial operation that deflects t he control shutdown element guide structures consistent with the expected maximum misalignment caused by such an event. The control shutdown element insertion time is measured and compared to the control element insertion time testing performed with no deflection of the upper reflector guide structures. The testing i s performed to confirm that the control shutdown element insertion time is within the insertion time assumed in the postulated event analysis in Chapter 1 3 under the condition of maximum expected misalignment of the upper reflector guide structures from a design basis earthquake. Additionally, the reflector blocks maintain the element insertion pathway as described in Section 4.3. The shutdown elements, which insert into the pebble bed, are not affected by the maximum misalignment of the graphite blocks. These control and shutdown element design features provide conformance to PDC 2.

PDC 4 The safety -relate d porti ons of the RCSS is are compatible wi th the environmental conditi ons that the y RCSS will be subjected to during normal operation, maintenance, testing, and postulate d events.

The RCSS shutdow n elements are made with stainle ss steel cladding. Wear rates due to flow induced vibration a re expected to b e low in co mparison t o thos e of t ypical operati ng reactors w ith stainless steel claddi ng give n the lowe r c ore flow rate s (<0. 13 meter/second) in the design. The ne utron absorbing material is enclosed in two stainless steel barriers to mitigate the l oss of ne utron absorbing material in the shutdo wn elements. The control eleme nts have a single thicke r stainle ss steel barrier to ensure the absorbi ng material does not come i n contact with the coolant. The control and shutdown eleme nts are qualification tested out of pile prior to operation and a conservative wear limit is established to ensure that wear during control and shutdown element movement is acceptable. The control elements and shutdown elements can be removed for inspection or replaced if necessary. In addition, t he control and shutdown elements are not adversely affected by neutron and gamma heating.

Analysis is performed on the control and shutdown elements to determine the internal gas release and swelling of the B 4 C during normal operation over their design lifeti me. The resulting increase in gas pressure is analyzed to ensure that stresses on the control shutdown element tubes are within allowable

Kairos Power HermesReactor Revision 0 4-11 Preliminary Safety Analysis Report Reactor Description

stress limits for SS 316 H. In addition, the e ffects of irradiation on SS 316 H and clad wear are accounted for in the stress analysis.

A finite element model is developed to calculate the forces on the control and shutdown element s during normal operation and postulated events. This analysis includes thermal stresses from internal heat generation, is performed under maximum heat generation conditions, and demonstrates that control and shutdown element cladding stresses are within limits and are not subject to bowing or binding due to differential thermal expansion.

There is extensive experience (References 5, 6, and 7 ) with B 4 C under irradiation. In addition, the B 4C melting temperature is more than 1000C above the Hermes operating temperatures.

The control and shutdown elements and drive mechanisms are also analyze d to meet ASME Section III,

Division V loads due to operational stepping, reactor trip, stuck element, fatigue, and shipping and handling. All stresses in the components of the reactivity elements are within limits.

Materials utilized in the RCSS shutdown elements are qualified for their operating environment.

Materials are chosen to ensure reactor coolant induced diffusion bonding does not occur at interfaces where movement or separation is necessary.

The se evaluations demonstrate conformance with PDC 4.

PDC 23 The safety -related reactor trip function of the RCSS is initiated by the r eactor p rotection s ystem through the reactor trip s ystem (RTS ) and is based on redundant trip determination signals to automat ically open the reactor trip breakers. Removal of power from the electromagnetic clutch in on the RCSS shutdown elements allow s the m control and shutdown elements to fall into the core by gravity. Normally o pen relays are utilized for this system such that during operation they are energized allowing the system to operate. When the RTS actuates, the energy holding the relays closed is removed and this loss of supply power initiate s a reactor trip. The RCSS shutdown elements accomplish es safe shutdown (i.e., reactor trip) via gravity insertion of the control and shutdown elements on a reactor trip signal ; or on a loss of normal electrical power after a short time delay to mitigate spurious trips. The electrical system design is described in Chapter 8. The reactor control and reactor protection system architecture are described in Chapter 7. These features, in conjunction with Chapter 7, demonstrate conformance to PDC 23.

PDC 26 The control and shu tdown elements meet the requirements of PDC 26. The compliance with the requirements in PDC 26 is discussed in Section 4.5.

PDC 28 The control elements traverse their full range of movement in 100 seconds. This maximum design speed is analyzed in Chapter 1 3 to ensure that the rate of reactivity addition does not impact the safety significant -related portions of the reactor coolant boundary and also does not disturb the core and internals and impair cooling of the core.

PDC 29 The RCSS supports a high probab ility of accomplishing its design function, because the trip function is safety -related and the elements are inserted via gravity. There are two means of inserting negative reactivity and these two means contain sufficient negative reactivity such that the highest worth reactivity element can fail to insert, and the safety -related function can still be achieved. The first means

Kairos Power Hermes Reactor 4 -12 Revision 0 Preliminary Safety Analysis Report Reactor Description

of inserting negative reactivity would be to use the motor to lower the element into the core region. The second means is upon a reactor trip which releases the elements, allowing them to drop into the core by gravity.

The control and shutdown element insertion versus time will be provided in the application for an Operating License. A conservative control shutdown element dr op time value is used in Chapter 13.

These features demonstrate conformance to PDC 29 for the RCSS.

4.2.2.4 Testing and Inspection The control and shutdown elements are periodically inspected to ensure that there is no unacceptable wear or other damage to the cladding that encapsulates the B 4C ab sorber material. In addition, the reactor coolant is periodically examined for an increase in boron from B 4C absorb er material, which provides an indication of control and shutdown element cladding failure.

RCSS shutdown element insertion times and shutdown margin are periodically confirmed to be within safety analysis limits by surveillance requirements provided in th e t echnical s pecifications ( see Chapter 14).

4.2.3 Neutron Startup Source A neutron startup source is used to provide an adequate neutron flux to the source range detectors during initial and subsequent plant startups. The startup neutron source allows monitoring of the change in neutron multiplication during the addition of fue l and the approach to criticality. The neutron startup source does not perform any safety -related functions.

The neutron source(s) will be located in the reflector region of the reactor near the outside edge of the core, in proximity to an ex -core source r ange detector. The source will have sufficient strength to provide a detectable count rate.

The source material is encased in a metal sheath. The neutron startup source is compatible with the chemical, thermal, and irradiation conditions expected in the r eflector. The neutron startup source can be removed and replaced during the life of the plant, if needed.

4.2.4 References

1. Electric Power Research Institute, Uranium Oxycarbide (UCO) Tristructural Isotropic (TRISO) -Coated Particle Fuel Performance, Topical Report EPRI -AR(NP) -A, 3002019978, November 2020.

2. Kairos Power, LLC, Fuel Qualification Methodology for the Kairos Power Fluoride Salt -Cooled High Temperature Reactor (KP -FHR),KP -TR -011 -P, June 2020.

3. Kairos Power, LLC, KP -FHR Fuel Performance Methodology, KP -TR -010 -P, June 2021.

4. Nuclear Regulatory Commission, Electric Power Research Institute - Safety Evaluation for Topical Report, Uranium Oxycarbide (UCO) Tristructural Isotropic (TRISO) Coated Particle Fuel Performance:

Topical Report EPRI -AR -1(NP), August 11, 2020.

5. Fryger, B., G o sset, D., & Escleine, J.M., Irradiation Performances of the Superphenix Type Absorber Element, Absorber Materials, Control Rods and Design of Backup Reactivity -Shutdown Systems for Breakeven a nd Burner Cores for Reducing Plutonium Stockpiles, 1995.

6. Pitner, A.L., & Russcher, G. E., Irradiation of Boron Carbide Pellets and Powders in Hanfo rd Thermal Reactors, 1970.

7. Demars, R.V., Dideon, C.G., Thornton, T.A., Tulenko, J.S., Pavinich, W.A., & Pa rdue, E. B. S.,

Irradiaton Behavior of Pressurized Water Reactor Control Materials, Nuclear Technology, 62(1),

75 -80, 1983.

Kairos Power Hermes Reactor 4 -13 Revision 0 Preliminary Safety Analysis Report Reactor Description

Table 4.2 -4: Reactivity Control and Shutdown Element Parameters

Parameter Control Elements Shutdown Elements

Number of Control 4 3 Elements

Location Reflector near core periphery In -bed

Drive Mechanism Counter -weighted Winch Counter -weighted Winch

Release Mechanism Electric Clutch Electric Clutch Motor Electrical Isolation Motor Electrical Isolation

Absorber Material B 4C B 4C

Absorber Clad Stainless Steel 316H Stainless Steel 316H

Element Geometry Rectangu lar Cruciform

Absorber Material 70 inches 55 96 inches Length

Kairos Power Hermes Reactor 4 -18 Revision 0 Preliminary Safety Analysis Report Reactor Description

operation and postulated event. There are no penetrations or attachments to the vessel below the coolant level. The design of the reactor vessel al lows for online monitoring, in -service inspection, and maintenance.

4.3.1.1.1 Vessel Top Head The reactor vessel top head (see Figure 4. 3 -2 ) is a flat 316H SS disc bolted and flanged to the vessel shell. This interface is designed for leak -tight ness but is not credited as being leak tight in safety analyses. The vessel top head control s the radial and circumferential positions of the reflector bloc ks to ensure a stable core configuration for all conditions ( e.g., reactor trip and core motion ). The top head conta in s penetrations, as shown in Figure 4.3 -2 and Table 4.3 -1, into and out of the vessel and provides for the attachment of supporting equipment and components (e.g., reactivity control elements, re activity shutdown elements, pebble handling and storage system components, material sampli ng port,

neutron detectors, thermocouples, etc.). The top head supports the vessel m aterial s urveillance system (MSS) which provides a remote means to insert and remove material and fuel test specimens into and from the reactor to support testing.

4.3.1.1.2 Vessel Shell The reactor vessel is a 316H SS cylindrical shell that, along with the vessel bottom head, serves to form the safety -related reactor coolant boundary within the reactor vessel. It contains and maintains the inventory of reactor coolant inside the vessel. The shell provides the geometry for coolant inlet and vessel surface for the DHRS which transfers heat from the reactor vessel during postulated events. The inside of the shell uses 316H SS tabs to maintain the core barrel in a cylindrical geom etry and has a welded connection at the top of the core barrel.

4.3.1.1.3 Vessel Bottom Head The reactor vessel bottom head is a flat 316H SS disc that is welded to the vessel shell. It contains and maintains the inventory of the reactor coolant inside the vessel, supports the vessel internals, maintains the reactor coolant boundary and provides flow geometry for low pressure reactor coolant inlet to the core. Hydrostatic, seismic and gravity loads on the vessel and vessel internals are transferred to the bottom head and are transferred to the RVSS.

4.3.1.2 Reactor Vessel Internals The reactor vessel internal structures include the graphite reflector blocks, core barrel and reflector support structure. The vessel internal structures define the flow paths of the f uel and reactor coolant, provide a heat sink, a pathway for instrumentation insertion, control and shutdown element insertion, as well as provide neutron shielding and moderation surrounding the core. The design of the structures support inspection and mai ntenance activities as well as monitoring of the reactor vessel system.

4.3.1.2.1 Reflector Blocks The reflector blocks are constructed of grade ETU -10 graphite. The reflector blocks provide a heat sink for the core and are restrained ensuring alignment of the penetrations to in sert and withdraw control elements. The reflector blocks are buoyant in the reactor coolant. The bottom reflector blocks are machined with coolant inlet channels for distribution of coolant inlet flow into the co re. T he top refle ctor blocks are machined with coolant outlet channels to direct the coolant exiting from the core into the upper plenum, from which the PSP draws suction. The top reflector blocks also form a pebble d efueling c h ute, as shown in Figure 4.3 -1, to direct the pebbles from the core to the pebble extraction machine (PEM), allow ing online defueling of the reactor (see Section 9.3). The reflector blocks also

Kairos Power Hermes Reactor 4 -29 Revision 0 Preliminary Safety Analysis Report Reactor Description

repositioning (or are very minimally engaged). These periods of core operation are depicted in Figure 4.5 -1.

The neutronic results for the equilibrium core are the limiting results for the reactor and fuel for normal power operation. When operating at 100% power, the equilibrium core will have the highest average enrichment, pebble power, fuel temperatures, average core burnup, and fast neutron flux. Therefore, neutronic results for startup and initial operation are bounded by the results for the equilibrium core.

A comparison of the neutronic parameters for the reactor and a small light water reactor is provided in Table 4.5 -1. A summary of reactor neutronic parameters is provided in Table 4.5 -2.

4.5.1.2 Reactivity Coefficients The following reactivity coefficients are important for the reactor: fuel temperature ( D oppler ),

moderator temperature (graphite in the fuel pebbles and graphite in the moderator pebbles), coolant temperature, coolant void, and reflector temperature.

The fuel temperature reactivity coefficient is the change in reactivity due to a change in fuel temperature. The moderator temperature reactivity coefficient is the change in reactivity due to the change in fuel pebble graphite and graphite pebble temperature. The coolant temperature reactivity coefficient is the change in reactivity due a change in reactor coolant temperature (including the appropriate density change). The coolant void reactivity coefficient is the change in reactivity due to coolant void frac tion. The reflector temperature reactivity coefficient is the change in reactivity due to reflector temperature change.

4.5.1.3 Power Distribution The parameters are used to characterize the core power distribution in the reactor are :

Axial Peaking Factor (F Z)

Th is is the ratio between the average power at a given elevation divided by the average power over all elevations.

Radial Peaking Factor ( F R )

This is the ratio of the average power at a radial location divided by the average power over all radial locations.

Total Peaking Factor (F Q )

This is the ratio of the maximum power anywhere in the core to the average power for the entire core.

4.5.1.4 Shutdown Margin Shutdown margin is the instantaneous amount of reactivity by which the reactor is sub critical, or would be subcritical from a given condi tion, assuming that all control and shutdown elements are inserted with the exception of the highest worth control or shutdown element, which is assumed to be fully withdrawn.

The shutdown margin calculation accounts for the following factors:

• Power Defect

• Xenon Decay

• Delayed Neutrons

• Operating Excess Reactivity

• Margin for Uncertainties

Kairos Power Hermes Reactor 4 -42 Revision 0 Preliminary Safety Analysis Report Reactor Description

includes the assumption of a single most reactive control or shutdown elemen t being fully withdrawn from the core.

The nuclear design provides confirmation that the RCSS provides two means of controlling reactivity. As described in Section 4.2.2, there are four reactivity control elements that insert in the neutron reflector and three reactivity shutdown elements that insert into the pebble bed core. In compliance with PDC 26 C ondition 1, the shutdown and control elements are solely credited to provide a means to ensure that SARRDLs are not exceeded, and that safe shutdown is achi eved and maintained during normal operation and postulated events. Condition 1 is met assuming the highest worth shutdown or control element is fully withdrawn. In compliance with C ondition 2 of PDC 26, the control elements by themselves provide the capability to control reactivity changes during planned normal power changes such that the SARRDLs are not exceeded. The control elements provide a means of reactivity control that is independent and diverse separate from the shutdown elements. Th e becau se they are located in different locations,

receive different signals to trip, and each of them have two independent and diverse release mechanisms control elements are diverse from the shutdown elements because they have a different geomet ry, insert into different locations and have different insertion mechanisms (i.e the control elements use a motor driven winch and the sh utdown elements are gravity driven ). In comp liance with C ondition 3 of PDC 26, the shutdown and control elements provide a means of inserting reactivity at a sufficient rate and amount, to ensure that the capability to cool the core is maintained and a means for shutting down the reactor and maintaining it at safe shutdown following a postulated event. Condi tion 3 is met assuming that the most reactive control or shutdown element is fully withdrawn. In compliance with Condition 4 of PDC 26, the shutdown and control elements provide a means for maintaining the reactor shutdown to allow for interventions such a s fuel loading, inspection, and repair. Although the shutdown elements are solely credited for meeting conditions 1, 3, and 4 of PDC 26, the control elements are also automatically inserted in respo nse to a reactor trip signal and provide an additional line of defense against exceeding reactivity margins. Compliance with PDC 26 is summarized in Table 4.5 -6.

Nuclear Stability The inherent nuclear characteristics of the reactor are such that uncontrolled power oscil lations are not possible. The reactor is small in size and is neutronic al ly connected due to the long diffusion length of neutrons in the core. As a result, t he reactor is inherently stable with regard to both axial and radial power oscillations. In compliance with PDC 12, the reactor is not susceptible to nuclear instability.

4.5.3.2 Nuclear Design Analysis Inputs to Other Sections Vessel Irradiation The fast neutron fluence received by the reactor vessel from the reactor core and pebble insertion and extraction lines is attenuated by the core barrel, the reflector, and by the reactor coolant. Fluence and depletion calculations are performed to confirm that the vessel is not adversely affected by this neutron fluence. The methodology for calculating vessel fluence and helium production is described in Reference 1.

Nuclear Transient Anal ysis Values for neutron generation time and delayed neutron fraction are shown during startup and equilibrium operation in Table 4.5 -7. In addition, conservative values for power distribution, reactivity coefficients, and shutdown margin are provided for the initial conditions for each of the po stulated reactivity transient events analyzed in Chapter 13.

Kairos Power Hermes Reactor 4 -45 Revision 0 Preliminary Safety Analysis Report Reactor Description

Table 4.5 -5: Shutdown Margin for Equilibrium

Parameter Value at Equilibrium

Required Shutdown Margin 1,000

Actual Shutdown Margin (pcm) 4,997 3,65 4

Required Worth for Shutdown 7,657 11,578 (pcm) 1

Worth of Control and Shutdown 11,654 14,232 Elements 1 (pcm)

Notes:

1. Worth calculated assuming highest worth Required worth considers hig hest worth shutdown element is fully withdrawn (which is 1, 661 6,266 pcm)

Kairos Power Hermes Reactor 4 -50 Revision 0 Preliminary Safety Analysis Report Reactor Description

Table 4.5 -6 : PDC 26 Compliance

PDC 26 Criteria Credited Means for Compliance

A minimum of two reactivity control systems or means shall provide:

(1) A means of inserting negative reactivity at a sufficient rate and [ 3 SE + 4 CE ]

amount to assure, with appropriate margin for malfunctions, that With maximum worth element the specified acceptable system radionuclide release design limits assumed fully withdrawn are not exceeded and safe shutdown is achieved and mainta ined during normal operation, including anticipated operational occurrences.

(2) A means which is independent and diverse from the other(s), [ 4 CE ]

shall be capable of controlling the rate of reactivity changes resulting from planned, normal power changes to assure that the specified acceptable system radionuclide release design limits are not exceeded.

(3) A means of inserting negative reactivity at a sufficient rate and [ 3 SE + 4 CE ]

amount to assure, with appropriate margin for malfunctions, that With maximum worth element the capability to cool the core is maintained and a means of assumed fully withdrawn shutting down the reactor and maintaining, at a minimum, a safe shutdown condition following a postulated even t.

(4) A means for holding the reactor shutdown under conditions [ 3 SE + 4 CE ]

which allow for interventions such as fuel loading, inspection and repair shall be provided.

CE - Control Elements SE - Shutdown Elements

Kairos Power Hermes Reactor 4 -51 Revision 0 Preliminary Safety Analysis Re port Electrical Power Systems

reactor p rotection system (RPS) block loads (as shown in Figure 8.1 -1) will fail by design to ensure proper fail -safe functions. Th is UPS is sized to provide short -term backup power to the RPS block loads, and to lose power on failure of the backup generators. The fail -safe functions are described in further detail in the following paragraphs and in Section 7.3.

To ensure fail -to -safety in the event of a complete loss of AC electrical power, the reactivity c ontrol and shutdown system (RCSS) is equipped with a safety -related clutch that requires 24 VDC to remain closed.

On a loss of power, the relay opens, and the control shutdown elements drop into the reactor by gravity.

To ensure fail -to -safety in the event of a complete loss of AC electrical power, the p rimary s alt p ump (PSP) and heat rejection subsystem power suppl y is equipped with re lay s requiring 24 VDC to remain closed. On a loss of power, the relay s open to prevent inadvertent pump and blower restart on power restoration. A manual reset is required to restart the pump s.

On activation of the d ecay h eat removal system (DHRS), the reactor p rotection s ystem will remove 24 VDC from the activation circuit relay to prevent inadvertent shut down of the DHRS by operator error.

Equipment for monitoring reactor status will be supplied by UPS until the normal power supply o r backup generator s are restored.

The BPS is provided to permit functioning of SSCs following a loss of normal power. The passive design features of the Hermes reactor, based on fundamental physics principles, do not rely on AC or DC electrical power for safety -related SSCs to perform their safety function s during postulated events. Safe shutdown of the reactor does not rely on AC electrical power from the BPS. These features demonstrate conformance with the requirements in PDC 17.

As discussed above, the BPS is not relied on for safety -related SSCs to perform their safety functions following postulated events. Therefore, there are no safety -related portions of the BPS, and no tests or inspections are required to demonstrate conformance with the requiremen t in PDC 18.

The backup power system is not safety -related, but portions of the system may cross the isolation moat discussed in Section 3.5. SSCs that cross a base -isolation moat may experience differential displacements as a result of seismic events. Th e backup power system is designed so that postulated failures of SSCs in the system from differential displacements do not preclude a safety -related SSC from performing its safety function. Design features addressing differential displacement are discussed in Section 3.5. Thes e features demonstrate conformance with the requirement in PDC 2.

The backup power system is designed in accordance with NFPA 70, National Electrical Code (Reference 8.3 -1).

8.3.4 Testing and Inspection The BPS does not perform any safety functions. Periodic inspection and testing are performed on the BPS for operational purposes.

8.3.5 References

1. National Fire Protection Association, NFPA 70, National Electrical Code. 2020.

Kairos Power Hermes Reactor 8 -8 Revision 0 Preliminary Safety Analysis Report Accident Analysis

13.1.1.1 Initial Conditions Assumptions N ormal operating parameters are discussed in Section 4.1. Conservative initial values are assumed for each operating parameter to maximize the release of radionuclides in the MHA.

The radioactive material that is at risk for release for the MHA includes radionuclides contained in the fuel, the radionuclides circulating in the Flibe, and the radioactive material at risk for release (MAR) distributed within the primary system ( i.e., steel structures andgraphite). Althoug h radionuclides could have diffused away from the tri-structural isotropic ( TRISO) fuel particles, the initial inventory of the small fraction of fuel that is defective at the initiation of the transient assumes that no diffusion has occurred. This hypothetical condition adds a bounding conservatism to the radionuclide release from the fuel a nd Flibe.

The TRISO fuel form and the basis for its radionuclide retention performance is discussed in Section 4.2.1. The methodology for determining the radionuclide behavior and retention properties of the fuel is provided in Section 3 of KP-TR- 012, KP-FHR Mechanistic Source Term Methodology T opical R eport,

( Reference 1). Fuel manufacturing and in - service performance specifications are discussed in Section 4.2.1.

The Flibe design is discussed in Section 5.1. The methodology for determining the radionuclide behavior and retention properties of the Flibe is provided in Section 4 of Reference 1. A bounding value for Flibe circulating activity is assumed as the initial condition.

A bounding value of retained tritium and activated argon available for release is assumed to encompass available volume and geometry of tritium - absorbing materials in the system.

13.1.1.2 Structures, Systems and Components Mitigation Assumptions Thi s sectio n describe s the structure s, system s, and components (SSCs) that perform a function to mitigate the dose c onsequences of the MHA.

The r eactor p rotectio n system (RPS) is credited w ith d etectin g th e system disturbance and in itiatin g a re actor trip, p rimary salt pump (PSP) trip, he at rejecti on blowe r tri p, and a pebble extraction a nd insertion trip. The RPS initiates a reactor trip to shut down th e reactor to limit th e addition of heat to the system. The pebble extracti on and inserti on tri p stops pebbles from moving i nto, out of, and through the core followi ng the re actor tri p to preclude any damage to pebbles from extracti on faul ts during the event. The PSP trip facilitates the tr ansition to d ecay heat removal through th e decay he at removal system (D HRS ) and precludes the potential for continuous entrainment of cove r gas in the F libe during the MHA. The DHRS continued operation ensure s that an adequate amount of decay he at is removed from the sy stem. The design b ases of the R PS a re discussed in Se ction 7.3. The RPS detection a nd actuati on capabilities are automatic and do not rely on manual action to perform these functions.

The shutdown elements in the reac tivity cont rol and shut down syst em (RCSS) is are c redited w ith shutting down the reactor upon receiving the reactor trip signal. The shutdown and control elements have sufficient worth to shut down the reactor and maintai n long-te rm shutdown. The design bases of the RCSS s hutdown f unction a re provided i n S ection 4.2.2.

The DHRS is credited with removing an adequate amount of decay heat from the reactor to ensure that material design temperatures are not exceeded and no incremental fuel failures occur due t o elevated temperatures. The DHRS does not rely on electrical power or manual actio ns to operate. The DHRS reje cts he at to the ultimate he at sink passively. The desi gn base s of the DHRS he at removal functi on are provide d in Secti on 6.3.

Kairos Power HermesReactor 13-3 Revision 0 Preliminary Safety Analysis Report Accident Analysis

negative pressure difference and allows air to enter the reactor system. In the reactor vessel head space, air reacts with Flibe to form volatile products and oxidizes portions of the structural graphite above the surface of the Flibe and the carbon matrix for pebbles in transit above the surface of the Flibe.

Radionuclides from the coolant circulating activity in the broken pipe are released into the facility air when aerosols are generated from the coola nt that exits the pipe. All the floor surfaces where Flibe may be spilled will have design features such as steel liner s to prevent Flibe -concrete interaction, as described in Section 3.5. The spilled Flibe spreads on top of the liner and forms a Flibe pool.

Radionuclides in the spilled Flibe is released through evaporation until the top s ur face of the Flibe pool is solidified.

The limiting salt spill postulated event bounds other salt spill events, including:

• S purious draining and smaller leaks from the primary heat transport system

• L eaks from otherFlibecontaining systems and components (e.g., IMS fill/drain tank, IMS piping, chemistry control system piping)

• L eaks up to the hypothetical double -ended guilloti ne primary salt piping break size

• M echanical impact or collision events involvingFlibeContaining SSCs (except the vessel)

• Single or multiple HRR tube(s) break These following sections describe key assumptions associated with the limiting salt spill event. The quantitative values associated with these assumptions, as well as t he methods used to evaluate the surrogate figures of merit that ensure the event consequences are bounded by the MHA are provided in Reference 2.

13.1.3.1 Initial Conditions Assumptions N ormal operating parameters are provided in Section 4.1. Conservative initial v alues are assumed for each operating parameter to ensure a bounding result for the figures of merit that demonstrate the event is bounded by the MHA.

A hypothetical double -ended guillotine break in the PHTS hot leg piping is assumed as the event initiator. The initial Flibe conditions are discussed in Section 5.1.

13.1.3.2 Structures Systems and Components Mitigation Assumptions This section describes the SSCs performing a function to mitigate the consequences of the event.

The RPS is credited w ith detecting the break on low reactor coolant level and initiating a reactor trip, PSP trip, heat rejection blower trip, and the PHSS trip. The DHRS is operating when the reactor is above a threshold power, as discussed in Section 6.3, and remains in an always on mode. The RPS initiate s a reactor trip to shut down the reactor and limit s the addition of heat to the system. The RPS trips the PSP limit the amount of spilled Flibe. The heat rejection blower is tripped to limit the amount of air ingress following postulated HRR tube breaks. The PHSS trip stops pebble extraction and insertion following the reactor trip to preclude any damage to pebbles from faults during the event. The DHRS remain s active to ensure that an adequate amount of decay heat is removed from the system. The design bases of the RPS are discussed in Section 7.3. The RPS detection and actuation capabilities are automatic and do not rely on manual operator action to perform th ese functions.

The RCSS is credited with shutting down the reactor upon receiving the reactor trip signal. The shutdown and control elements are assumed to have sufficient worth to shut down the reactor and maintain long term shutdown. The design bases of the RCSS shutdown function are provided in Section

4. 2.2.

Kairos Power Hermes Reactor 13 -7 Revision 0 Preliminary Safety Analysis Report Accident Analysis

limiting loss of forced circulation event occurs at an initial power above the DHRS threshold power discussed in Section 6.3, limiting reactor temperature and fulfilling the heat removal function.

The limiting loss of circulation postulated event bounds other loss of circulation events, including:

• B lockage of flow path external to the reactor vessel in the primary heat trans port system

• S purious pump trip signal

• S haft fracture

• B earing failure

• P ump control system errors

• S upply breaker spurious opening

• L oss of net -positive suction head (e.g., pump overspeed, low level)

• L oss of normal electrical power

• Flibe freezing inside HRR

• Loss of normal heat sink Th e following section s describe the key assumptions associated with the limiting loss of forced circulation. The quantitative values associated with these assumptions, as well as the methods used to evaluate the surrogate figur es of merit that ensure the event consequences are bounded by the MHA are provided in Reference 2.

13.1.4.1 Initial Conditions Assumptions N ormal operating parameters are provided in Section 4.1. Conservative initial values are assumed for each operating parameter to ensure a bounding result for the figures of merit that demonstrate the event is bounded by the MHA.

The loss of forced circulation event initiator is assumed to be a pump seizure, which disables the PSP.

13.1.4.2 Structures Systems and Components Mitigation Assumptions This section describes the SSCs performing a function to mitigate the consequences of the event.

The RPS is credited with initiating a reactor trip. The PHSS is trip ped to prevent damage to fuel in transit.

The DHRS is operating when the reactor is above a threshold power, as discussed in Section 6.3, and remains in an always on mode. The RPS initiate s a reactor trip to shut down the reactor and limit s the addition of heat to the system. The PHSS trip stops pebble extraction and insertion following the reactor trip to preclude any damage to pebbles from faults during the event The DHRS remain s active to ensure that an adequate amount of decay heat is removed from the system. The design bases of the RPS are discussed in Section 7.3. The RPS detection and actuation capabilities are automatic and do not rely on manual operator action to perform these functions.

The shu tdown elements in the RCSS is are credited with shutting down the reactor upon receiving the reactor trip signal. The shutdown and control elements are assumed to have sufficient worth to shut down the reactor and maintain long term shutdown. The design bases of the RCSS shutdown function are provided in Section 4.2.2.

The DHRS and natural circulation within the reactor vessel are credited with removing an adequate amount of decay heat from the reactor to ensure that material design temperatures are not exceeded and no incremental fuel failures occur due to elevated temp eratures. The DHRS does not rely on electrical power or manual operator actions to operate. Natural circulation within the core transfers heat from the fuel to the reactor vessel shell. Energy is transferred from the vessel shell to the DHRS, and the DHRS rejects the heat to the ultimate heat sink passively. The design bases of natural circulation

Kairos Power Hermes Reactor 13 -9 Revision 0 Preliminary Safety Analysis Report Accident Analysis

13.1.10.1 Recriticality or Unprotected Events Reactor Shutdown System Failure In postulated events that require a reactor trip, the safety - related portion of the RCSS, reactor shutdown system, is relied upon to shut down the reactor and maintain shutdown margin. Unprotected events, orReactor shutdown sy stem (RSS) failure events where reactor shutdown is not achievable, are excluded from the design basis. Events that would result in a recriticality event are also excluded from the design basis. The RCSS is designed (described in Section 4.2.2) with sufficient independence,

diversity, and redundancy from detection and actuation to element insertion to ensure reactor shutdown when necessary. The shutdown margin is maintained for all postulated event conditions to ensure there is no recriticality after the RCSS has initiated shutdown, as described in Section 4.5.

Additionally, the graphite reflector blocks are designed to maintain structural integrity and ensure misalignments do not prevent the insertion path of the shutdown elements, as discussed in Section 4.3.

13.1.10.2 Degraded Heat Removal or Uncooled Events In postulated events where the normal heat re jection is not available, natural circulation in the reactor vessel and the heat removal function of the DHRS are relied upon to remove heat from the reactor core.

Degraded heat removal or uncooled events are excluded from the design basis. The initiation of natura l circulation is completely passive, and the design features, including the structural integrity of the reactor vessel internals, that ensure a continued natural circulation flow path are discussed in Section 4. 6. The DHRS is aligned and operat ing when the reactor power is above a threshold power and remains in this state as described in Section 6.3, precluding the need for an actuation to occur for the DHRS to remove heat during a postulated event. The DHRS design includes sufficient redundancy to perform its safety function assuming the loss of a single train, as discussed in Section 6.3.

13.1.10.3 Flibe Spill Beyond Maximum Volume Assumed in Postulated Salt S pill s In the salt spill postulated event category, a n upper bound volume of Flibe is assumed to spill out o f the PHTS onto the floor. A volume of Flibe spilling out of the system beyond the amount assumed in the bounding salt spill event is excluded from the design basis. There are several design features ensuring the amount of Flibe available to spill is limited to an upper bound value. The PHTS is designed with anti -

siphon feature s discussed in Section 5.1. These features are designed to passively break the siphon in the event of a break. The PSP also trip s to allow the primary system to depressurize. The reliability of the RPS, which trips the PSP and heat rejection blower in the event of a salt spill, is discussed in Section 7.3.

The reactor vessel shell also maintain s integrity in postulated events to ensure the fuel in the core remains covered with Flibe. The reactor vessel shell design features that prevent leakage are discussed in Section 4.3.

13.1.10.4 In - Service TRISO Failure Rates and Burnups Above Assum ptions in Postulate d Events The in-service fuel failure rates and the burnup of pebbles assumed in the postulated events are based on the fuel qualification specifications in Section 4.2.1. In-service TRISO failure rates above the rate assumed in postulated events are exclud ed from the design basis. The insertion of pebbles with a burnup higher than the fuel qualification envelope is excluded from the design basis. As described in Section 7.3, the RPS includes a function to stop the pebble insertion and extraction functions t o ensure pebbles are not damaged in faults occurring after an event initiation. The fuel qualification program includes testing, inspection, and surveillance to ensure the fuel operating envelope is within the fuel qualification envelope. Inspection and surveillance of the fuel in service is performed in the PHSS as discussed in Section 9.3.

Kairos Power Hermes Reactor 13-15 Revision 0