ML22242A168

Kairos Power LLC, Changes to Construction Permit Application - PSAR Chapters 3, 4, 8, and 13

ML22242A168
Person / Time
Site:	Hermes
Issue date:	08/30/2022
From:	Kairos Power
To:	Office of Nuclear Reactor Regulation
Shared Package
ML22242A166	List: ML22242A167 ML22242A168
References
KP‐NRC‐2208‐012
Download: ML22242A168 (18)

Text

KPNRC2208012 Enclosure Changes to PSAR Chapters 3, 4, 8, and 13 (NonProprietary)

Preliminary Safety Analysis Report Design of Structures, Systems, and Components Table 3.6-1: Structures, Systems, and Components SSC Name Safety Seismic Quality Program SAR Section Plant Area Classification Classification Reactor System Fuel Pebbles Safety-related N/A Quality-Related 4.2.1 SR area1 Moderator Pebbles Non-safety related N/A Not Quality-Related 4.2.1 SR area Reactivity Control and Shutdown System (RCSS)

Control Elements and Non-Safetysafety- SDC-3Local Building Not Quality-Related 4.2.2 SR area Shutdown Elements related Code Shutdown Elements, Safety-related SDC-3 Quality-Related 4.2.2 SR area including latching/release mechanism RCSS drive systems, except Non-safety related SDC-2Local Building Not Quality-Related 4.2.2 SR area shutdown element latching Code mechanisms Neutron Startup Source Non-safety related SDC-2 Not Quality-Related 4.2.3 SR area Reactor Vessel System Safety-related SDC-3 Quality-Related 4.3 SR area Biological Shield 2 Safety related SDC-3 Quality-Related 4.4 SR area Reactor Vessel Support Safety-related SDC-3 Quality-Related 4.7.3 SR area System Reactor Thermal Management System (RTMS)

Reactor Auxiliary Heating Non-safety related SDC-2 Not Quality-Related 9.1.5 SR and NSR areas System Equipment and Structure Non-safety related SDC-2 Not Quality-Related 9.1.5 SR and NSR areas Cooling System Decay Heat Removal System (DHRS)

DHRS components4 except Safety-related SDC-3 Quality-Related 6.3 SR area for steam vent discharge and makeup-water components Kairos Power Hermes Reactor 3-34 Revision 0

Preliminary Safety Analysis Report Reactor Description The thermal hydraulic analysis of the core (see Section 4.6) ensures that adequate coolant flow is obtained to ensure that SARRDLs, which are discussed in Section 6.2, are met.

4.2.1.7 Testing and Inspection The cover gas and reactor coolant are monitored for circulating activity, which is an indirect measurement of TRISO failures. Circulating activity limits will be provided in the technical specifications.

Fuel pebbles are subject to examination for damage and burnup as they exit the core. Pebbles are inspected to identify damage such as wear, cracking, missing surfaces from chipping, etc. Fuel pebbles are also examined by gamma spectrometry to determine the burnup through the measurement of gamma activity from signature fission products. Pebbles approaching or at the burnup limit are not returned to the core and instead are sent to storage. Similarly, pebbles that show indications of wear, cracking, or missing surfaces are removed from service. These inspections are described in Section 9.3.

4.2.2 Reactivity Control and Shutdown System The reactivity control and shutdown system (RCSS) provides reactivity control during normal operation and also provides shutdown of the reactor in response to abnormal conditions or postulated events.

4.2.2.1 Description The RCSS inserts and withdraws control and shutdownincludes two separate system features (means) elements to control reactivity in the reactor core. The system provides two separate means to accomplish this function - control elements and shutdown elements.

The non-safety related control elements are used to control the reactivity for normal operations and for planned, normal startup, shutdown, and power changes in the reactor. The control elements can be positioned throughout their range of travel to support operational demands. The portion of these elements that relates to their release and insertion on a reactor trip is safety-related.

The shutdown elements, in combination with the control elements, are credited for shutting down the reactor during postulated events. The shutdown elements are located to optimize reactivity worth and to meet shutdown margin requirements. These elements have two positions, fully withdrawn or fully inserted. These elements are safety-related.

Both the control and shutdown elements are tripped automatically by the reactor protection system, or manually from the main control room or remote shutdown panel. The plant control system is used to withdraw and insert the control and shutdown elements during normal operation. Instrumentation and control systems are described in Chapter 7.

The shutdown and control elements have two different designs. Each control element is an assembly of segmented annular cylinders. The annular cylinders are welded to connection plates at various points along the length of the control elements. Stainless steel spines are used to connect the array of control elements together. Each shutdown element is an array of small rods arranged in a cruciform shape. The control element design is shown in Figure 4.2-3 (cross-section) and Figure 4.2-4 (side-view). The shutdown element design is shown in Figures 4.2-5 (cross-section) and Figure 4.2-6 (side-view). There are seven elements in total in the RCSS design, which is comprised of three shutdown elements and four control elements. The control elements insert into guide structures in the upper and side reflector, near the periphery of the core. The shutdown elements insert into guide structures in the upper reflector, then directly into the pebble bed. The locations of the control and shutdown elements are shown in Figure 4.2-7. The control element and shutdown element design parameters are summarized in Table 4.2-4.

Kairos Power Hermes Reactor 4-9 Revision 0

Preliminary Safety Analysis Report Reactor Description The control elements are positioned via a counter-weighted winch system (Figure 4.2-8). The shutdown elements are also positioned by a counter-weighted winch, but they are typically only fully inserted or fully withdrawn. In the counter-weighted winch system, a wire-rope is connected to the element, and travels up around the sheave and down to a counter-weight. The counter-weight allows the wire-rope to wrap around the sheave without having to anchor the wire rope, similar to a capstan. The sheave, commonly known as a winch drum, is rotated by an electric motor. There is an electric clutch between the motor and the sheave. The motor allows small and controlled movements of the element. The maximum withdrawal and insertion time for the shutdown and control elements is 100 seconds over the full range of motion for motor-driven operations.

On a reactor trip, the electric clutch opens, which allows the sheave to rotate freely. With the sheave rotating freely, the shutdown and control elements are released from their drives and drop into the core and reflector, respectively, as a result of gravity. The control and shutdown elements reach 90 percent insertion by gravity in no more than 10 seconds. Although both the control elements and the shutdown elements receive a reactor trip signal, The the release of the clutch for the shutdown elements provides the primary safety safety-related reactor trip release mechanism. A redundant and diverse means for inserting the element is through electrical isolation of the motor itself, which allows it to rotate freely, allowing the elements to gravity insert.

Element Control and shutdown element position is monitored using two independent and diverse methods. The motor position is measured using an absolute encoder allowing the determination of the angle the sheave has swept from a known reference point, which directly correlates to the element position. The second position measurement device is a high-density reed switch array. Similar to existing reed switch position measurement designs, this instrument measures the position of the counterweight over its full range of motion. The reed switch array provides an analog signal, and the encoder provides a digital signal and the two used together provides the ability to determine the element position, while allowing real time functional checks.

The materials used in the RCSS are shown in Table 4.2-4. The primary materials are the B4C absorber material and the stainless steel 316H cladding. The operating conditions are such that the control and shutdown elements are immersed in reactor coolant and experience temperatures up to 700°C during operation. The upper portions of the control and shutdown elements are exposed to reactor cover gas above the reactor coolant free surface. The control and shutdown drive mechanisms above the vessel are maintained at temperatures below their mechanical limits. The B4C neutron absorber material is contained in pellets, which are stacked in SS 316H cylindrical tubes (pressurized with inert gas). The control and shutdown drive mechanisms are also made of stainless steel.

4.2.2.2 Design Basis Consistent with PDC 2, the safety-related portion of the RCSS performs the shutdown function under design basis natural phenomena events.

Consistent with PDC 4, the safety-related portion of the RCSS accommodates the effects of and to be compatible with the environmental conditions during normal plant operation as well as during postulated events as a result of equipment failures.

Consistent with PDC 23, the safety-related portion of the RCSS fails into a safe state in the event of adverse conditions or environments.

Consistent with PDC 26, the RCSS provides an independent and diverse means of controlling reactivity to assure that shutdown margin is maintained and that SARRDLs are not exceeded under conditions of normal operation. In addition, the RCSS provides a means of inserting negative reactivity at a sufficient Kairos Power Hermes Reactor 4-10 Revision 0

Preliminary Safety Analysis Report Reactor Description rate to assure with appropriate margin for malfunctions and also provide a means to maintain the reactor shutdown for fuel loading, inspection and repair.

Consistent with PDC 28, the RCSS has appropriate limits on the potential amount and rate of reactivity increase to ensure the effects of postulated reactivity events can neither damage the safety significant-related elements of the reactor coolant boundary or disturb the core and internals such the ability to cool the core is impaired. The system allows only one element to move at a given time.

Consistent with PDC 29, the shutdown elements, in conjunction with reactor protection systems, assure an extremely high probability of accomplishing their safety-related functions.

4.2.2.3 System Evaluation The RCSS meets the design bases as described below:

PDC 2 As noted in Section 4.2.2.1, the control shutdown elements are inserted into guide structures in the upper reflector and then directly into the pebble bed. The RCSS components, guide structures, and reflector blocks ensure the ability of the control and shutdown elements to insert under conditions of reflector block misalignment that could potentially occur in a design basis earthquake. The design basis earthquake is described in Section 3.4. This seismic analysis determines the maximum deflection of the insertion path. Insertion capability will be assessed in a one-time test prior to initial operation that deflects the control shutdown element guide structures consistent with the expected maximum misalignment caused by such an event. The control shutdown element insertion time is measured and compared to the control element insertion time testing performed with no deflection of the upper reflector guide structures. The testing is performed to confirm that the control shutdown element insertion time is within the insertion time assumed in the postulated event analysis in Chapter 13 under the condition of maximum expected misalignment of the upper reflector guide structures from a design basis earthquake. Additionally, the reflector blocks maintain the element insertion pathway as described in Section 4.3. The shutdown elements, which insert into the pebble bed, are not affected by the maximum misalignment of the graphite blocks. These control and shutdown element design features provide conformance to PDC 2.

PDC 4 The safety-related portions of the RCSS is are compatible with the environmental conditions that they RCSS will be subjected to during normal operation, maintenance, testing, and postulated events.

The RCSS shutdown elements are made with stainless steel cladding. Wear rates due to flow induced vibration are expected to be low in comparison to those of typical operating reactors with stainless steel Highlighted text was cladding given the lower core flow rates (<0.13 meter/second) in the design. The neutron absorbing previously material is enclosed in two stainless steel barriers to mitigate the loss of neutron absorbing material in added in the shutdown elements. The control elements have a single thicker stainless steel barrier to ensure the ML22062 absorbing material does not come in contact with the coolant. The control and shutdown elements are B680 qualification tested out of pile prior to operation and a conservative wear limit is established to ensure that wear during control and shutdown element movement is acceptable. The control elements and shutdown elements can be removed for inspection or replaced if necessary. In addition, the control and shutdown elements are not adversely affected by neutron and gamma heating.

Analysis is performed on the control and shutdown elements to determine the internal gas release and swelling of the B4C during normal operation over their design lifetime. The resulting increase in gas pressure is analyzed to ensure that stresses on the control shutdown element tubes are within allowable Kairos Power Hermes Reactor 4-11 Revision 0

Preliminary Safety Analysis Report Reactor Description stress limits for SS 316H. In addition, the effects of irradiation on SS 316H and clad wear are accounted for in the stress analysis.

A finite element model is developed to calculate the forces on the control and shutdown elements during normal operation and postulated events. This analysis includes thermal stresses from internal heat generation, is performed under maximum heat generation conditions, and demonstrates that control and shutdown element cladding stresses are within limits and are not subject to bowing or binding due to differential thermal expansion.

There is extensive experience (References 5, 6, and 7) with B4C under irradiation. In addition, the B4C melting temperature is more than 1000C above the Hermes operating temperatures.

The control and shutdown elements and drive mechanisms are also analyzed to meet ASME Section III, Division V loads due to operational stepping, reactor trip, stuck element, fatigue, and shipping and handling. All stresses in the components of the reactivity elements are within limits.

Materials utilized in the RCSS shutdown elements are qualified for their operating environment.

Materials are chosen to ensure reactor coolant induced diffusion bonding does not occur at interfaces where movement or separation is necessary.

These evaluations demonstrate conformance with PDC 4.

PDC 23 The safety-related reactor trip function of the RCSS is initiated by the reactor protection system through the reactor trip system (RTS) and is based on redundant trip determination signals to automatically open the reactor trip breakers. Removal of power from the electromagnetic clutch in on the RCSS shutdown elements allows them control and shutdown elements to fall into the core by gravity. Normally open relays are utilized for this system such that during operation they are energized allowing the system to operate. When the RTS actuates, the energy holding the relays closed is removed and this loss of supply power initiates a reactor trip. The RCSS shutdown elements accomplishes safe shutdown (i.e., reactor trip) via gravity insertion of the control and shutdown elements on a reactor trip signal; or on a loss of normal electrical power after a short time delay to mitigate spurious trips. The electrical system design is described in Chapter 8. The reactor control and reactor protection system architecture are described in Chapter 7. These features, in conjunction with Chapter 7, demonstrate conformance to PDC 23.

PDC 26 The control and shutdown elements meet the requirements of PDC 26. The compliance with the requirements in PDC 26 is discussed in Section 4.5.

PDC 28 The control elements traverse their full range of movement in 100 seconds. This maximum design speed is analyzed in Chapter 13 to ensure that the rate of reactivity addition does not impact the safety significant -related portions of the reactor coolant boundary and also does not disturb the core and internals and impair cooling of the core.

PDC 29 The RCSS supports a high probability of accomplishing its design function, because the trip function is safety-related and the elements are inserted via gravity. There are two means of inserting negative reactivity and these two means contain sufficient negative reactivity such that the highest worth reactivity element can fail to insert, and the safety-related function can still be achieved. The first means Kairos Power Hermes Reactor 4-12 Revision 0

Preliminary Safety Analysis Report Reactor Description of inserting negative reactivity would be to use the motor to lower the element into the core region. The second means is upon a reactor trip which releases the elements, allowing them to drop into the core by gravity.

The control and shutdown element insertion versus time will be provided in the application for an Operating License. A conservative control shutdown element drop time value is used in Chapter 13.

These features demonstrate conformance to PDC 29 for the RCSS.

4.2.2.4 Testing and Inspection The control and shutdown elements are periodically inspected to ensure that there is no unacceptable wear or other damage to the cladding that encapsulates the B4C absorber material. In addition, the reactor coolant is periodically examined for an increase in boron from B4C absorber material, which provides an indication of control and shutdown element cladding failure.

RCSS shutdown element insertion times and shutdown margin are periodically confirmed to be within safety analysis limits by surveillance requirements provided in the technical specifications (see Chapter 14).

4.2.3 Neutron Startup Source A neutron startup source is used to provide an adequate neutron flux to the source range detectors during initial and subsequent plant startups. The startup neutron source allows monitoring of the change in neutron multiplication during the addition of fuel and the approach to criticality. The neutron startup source does not perform any safety-related functions.

The neutron source(s) will be located in the reflector region of the reactor near the outside edge of the core, in proximity to an ex-core source range detector. The source will have sufficient strength to provide a detectable count rate.

The source material is encased in a metal sheath. The neutron startup source is compatible with the chemical, thermal, and irradiation conditions expected in the reflector. The neutron startup source can be removed and replaced during the life of the plant, if needed.

4.2.4 References

1. Electric Power Research Institute, Uranium Oxycarbide (UCO) Tristructural Isotropic (TRISO)-Coated Particle Fuel Performance, Topical Report EPRI-AR(NP)-A, 3002019978, November 2020.

2. Kairos Power, LLC, Fuel Qualification Methodology for the Kairos Power Fluoride Salt-Cooled High Temperature Reactor (KP-FHR),KP-TR-011-P, June 2020.

3. Kairos Power, LLC, KP-FHR Fuel Performance Methodology, KP-TR-010-P, June 2021.

4. Nuclear Regulatory Commission, Electric Power Research Institute - Safety Evaluation for Topical Report, Uranium Oxycarbide (UCO) Tristructural Isotropic (TRISO) Coated Particle Fuel Performance:

Topical Report EPRI-AR-1(NP), August 11, 2020.

5. Fryger, B., Gosset, D., & Escleine, J.M., Irradiation Performances of the Superphenix Type Absorber Element, Absorber Materials, Control Rods and Design of Backup Reactivity-Shutdown Systems for Breakeven and Burner Cores for Reducing Plutonium Stockpiles, 1995.

6. Pitner, A.L., & Russcher, G. E., Irradiation of Boron Carbide Pellets and Powders in Hanford Thermal Reactors, 1970.

7. Demars, R.V., Dideon, C.G., Thornton, T.A., Tulenko, J.S., Pavinich, W.A., & Pardue, E. B. S.,

Irradiaton Behavior of Pressurized Water Reactor Control Materials, Nuclear Technology, 62(1),

75-80, 1983.

Kairos Power Hermes Reactor 4-13 Revision 0

Preliminary Safety Analysis Report Reactor Description Table 4.2-4: Reactivity Control and Shutdown Element Parameters Parameter Control Elements Shutdown Elements Number of Control 4 3 Elements Location Reflector near core periphery In-bed Drive Mechanism Counter-weighted Winch Counter-weighted Winch Release Mechanism Electric Clutch Electric Clutch Motor Electrical Isolation Motor Electrical Isolation Absorber Material B4C B4C Absorber Clad Stainless Steel 316H Stainless Steel 316H Element Geometry Rectangular Cruciform Absorber Material 70 inches 55 96 inches Length Kairos Power Hermes Reactor 4-18 Revision 0

Preliminary Safety Analysis Report Reactor Description operation and postulated event. There are no penetrations or attachments to the vessel below the coolant level. The design of the reactor vessel allows for online monitoring, in-service inspection, and maintenance.

4.3.1.1.1 Vessel Top Head The reactor vessel top head (see Figure 4.3-2) is a flat 316H SS disc bolted and flanged to the vessel shell. This interface is designed for leak-tightness but is not credited as being leak tight in safety analyses. The vessel top head controls the radial and circumferential positions of the reflector blocks to ensure a stable core configuration for all conditions (e.g., reactor trip and core motion). The top head contains penetrations, as shown in Figure 4.3-2 and Table 4.3-1, into and out of the vessel and provides for the attachment of supporting equipment and components (e.g., reactivity control elements, reactivity shutdown elements, pebble handling and storage system components, material sampling port, neutron detectors, thermocouples, etc.). The top head supports the vessel material surveillance system (MSS) which provides a remote means to insert and remove material and fuel test specimens into and from the reactor to support testing.

4.3.1.1.2 Vessel Shell The reactor vessel is a 316H SS cylindrical shell that, along with the vessel bottom head, serves to form the safety-related reactor coolant boundary within the reactor vessel. It contains and maintains the inventory of reactor coolant inside the vessel. The shell provides the geometry for coolant inlet and vessel surface for the DHRS which transfers heat from the reactor vessel during postulated events. The inside of the shell uses 316H SS tabs to maintain the core barrel in a cylindrical geometry and has a welded connection at the top of the core barrel.

4.3.1.1.3 Vessel Bottom Head The reactor vessel bottom head is a flat 316H SS disc that is welded to the vessel shell. It contains and maintains the inventory of the reactor coolant inside the vessel, supports the vessel internals, maintains the reactor coolant boundary and provides flow geometry for low pressure reactor coolant inlet to the core. Hydrostatic, seismic and gravity loads on the vessel and vessel internals are transferred to the bottom head and are transferred to the RVSS.

4.3.1.2 Reactor Vessel Internals The reactor vessel internal structures include the graphite reflector blocks, core barrel and reflector support structure. The vessel internal structures define the flow paths of the fuel and reactor coolant, provide a heat sink, a pathway for instrumentation insertion, control and shutdown element insertion, as well as provide neutron shielding and moderation surrounding the core. The design of the structures support inspection and maintenance activities as well as monitoring of the reactor vessel system.

4.3.1.2.1 Reflector Blocks The reflector blocks are constructed of grade ETU-10 graphite. The reflector blocks provide a heat sink for the core and are restrained ensuring alignment of the penetrations to insert and withdraw control elements. The reflector blocks are buoyant in the reactor coolant. The bottom reflector blocks are machined with coolant inlet channels for distribution of coolant inlet flow into the core. The top reflector blocks are machined with coolant outlet channels to direct the coolant exiting from the core into the upper plenum, from which the PSP draws suction. The top reflector blocks also form a pebble defueling chute, as shown in Figure 4.3-1, to direct the pebbles from the core to the pebble extraction machine (PEM), allowing online defueling of the reactor (see Section 9.3). The reflector blocks also Kairos Power Hermes Reactor 4-29 Revision 0

Preliminary Safety Analysis Report Reactor Description repositioning (or are very minimally engaged). These periods of core operation are depicted in Figure 4.5-1.

The neutronic results for the equilibrium core are the limiting results for the reactor and fuel for normal power operation. When operating at 100% power, the equilibrium core will have the highest average enrichment, pebble power, fuel temperatures, average core burnup, and fast neutron flux. Therefore, neutronic results for startup and initial operation are bounded by the results for the equilibrium core.

A comparison of the neutronic parameters for the reactor and a small light water reactor is provided in Table 4.5-1. A summary of reactor neutronic parameters is provided in Table 4.5-2.

4.5.1.2 Reactivity Coefficients The following reactivity coefficients are important for the reactor: fuel temperature (Doppler),

moderator temperature (graphite in the fuel pebbles and graphite in the moderator pebbles), coolant temperature, coolant void, and reflector temperature.

The fuel temperature reactivity coefficient is the change in reactivity due to a change in fuel temperature. The moderator temperature reactivity coefficient is the change in reactivity due to the change in fuel pebble graphite and graphite pebble temperature. The coolant temperature reactivity coefficient is the change in reactivity due a change in reactor coolant temperature (including the appropriate density change). The coolant void reactivity coefficient is the change in reactivity due to coolant void fraction. The reflector temperature reactivity coefficient is the change in reactivity due to reflector temperature change.

4.5.1.3 Power Distribution The parameters are used to characterize the core power distribution in the reactor are:

Axial Peaking Factor (FZ)

This is the ratio between the average power at a given elevation divided by the average power over all elevations.

Radial Peaking Factor (FR)

This is the ratio of the average power at a radial location divided by the average power over all radial locations.

Total Peaking Factor (FQ)

This is the ratio of the maximum power anywhere in the core to the average power for the entire core.

4.5.1.4 Shutdown Margin Shutdown margin is the instantaneous amount of reactivity by which the reactor is subcritical, or would be subcritical from a given condition, assuming that all control and shutdown elements are inserted with the exception of the highest worth control or shutdown element, which is assumed to be fully withdrawn.

The shutdown margin calculation accounts for the following factors:

• Power Defect

• Xenon Decay

• Delayed Neutrons

• Operating Excess Reactivity

• Margin for Uncertainties Kairos Power Hermes Reactor 4-42 Revision 0

Preliminary Safety Analysis Report Reactor Description includes the assumption of a single most reactive control or shutdown element being fully withdrawn from the core.

The nuclear design provides confirmation that the RCSS provides two means of controlling reactivity. As described in Section 4.2.2, there are four reactivity control elements that insert in the neutron reflector and three reactivity shutdown elements that insert into the pebble bed core. In compliance with PDC 26 Condition 1, the shutdown and control elements are solely credited to provide a means to ensure that SARRDLs are not exceeded, and that safe shutdown is achieved and maintained during normal operation and postulated events. Condition 1 is met assuming the highest worth shutdown or control element is fully withdrawn. In compliance with Condition 2 of PDC 26, the control elements by themselves provide the capability to control reactivity changes during planned normal power changes such that the SARRDLs are not exceeded. The control elements provide a means of reactivity control that is independent and diverse separate from the shutdown elements. The because they are located in different locations, receive different signals to trip, and each of them have two independent and diverse release mechanisms control elements are diverse from the shutdown elements because they have a different geometry, insert into different locations and have different insertion mechanisms (i.e the control elements use a motor driven winch and the shutdown elements are gravity driven). In compliance with Condition 3 of PDC 26, the shutdown and control elements provide a means of inserting reactivity at a sufficient rate and amount, to ensure that the capability to cool the core is maintained and a means for shutting down the reactor and maintaining it at safe shutdown following a postulated event. Condition 3 is met assuming that the most reactive control or shutdown element is fully withdrawn. In compliance with Condition 4 of PDC 26, the shutdown and control elements provide a means for maintaining the reactor shutdown to allow for interventions such as fuel loading, inspection, and repair. Although the shutdown elements are solely credited for meeting conditions 1, 3, and 4 of PDC 26, the control elements are also automatically inserted in response to a reactor trip signal and provide an additional line of defense against exceeding reactivity margins. Compliance with PDC 26 is summarized in Table 4.5-6.

Nuclear Stability The inherent nuclear characteristics of the reactor are such that uncontrolled power oscillations are not possible. The reactor is small in size and is neutronically connected due to the long diffusion length of neutrons in the core. As a result, the reactor is inherently stable with regard to both axial and radial power oscillations. In compliance with PDC 12, the reactor is not susceptible to nuclear instability.

4.5.3.2 Nuclear Design Analysis Inputs to Other Sections Vessel Irradiation The fast neutron fluence received by the reactor vessel from the reactor core and pebble insertion and extraction lines is attenuated by the core barrel, the reflector, and by the reactor coolant. Fluence and depletion calculations are performed to confirm that the vessel is not adversely affected by this neutron fluence. The methodology for calculating vessel fluence and helium production is described in Reference 1.

Nuclear Transient Analysis Values for neutron generation time and delayed neutron fraction are shown during startup and equilibrium operation in Table 4.5-7. In addition, conservative values for power distribution, reactivity coefficients, and shutdown margin are provided for the initial conditions for each of the postulated reactivity transient events analyzed in Chapter 13.

Kairos Power Hermes Reactor 4-45 Revision 0

Preliminary Safety Analysis Report Reactor Description Table 4.5-5: Shutdown Margin for Equilibrium Parameter Value at Equilibrium Required Shutdown Margin 1,000 Actual Shutdown Margin (pcm) 4,9973,654 Required Worth for Shutdown 7,65711,578 (pcm)1 Worth of Control and Shutdown 11,65414,232 Elements1 (pcm)

Notes:

1. Worth calculated assuming highest worth Required worth considers highest worth shutdown element is fully withdrawn (which is 1,6616,266 pcm)

Kairos Power Hermes Reactor 4-50 Revision 0

Preliminary Safety Analysis Report Reactor Description Table 4.5-6: PDC 26 Compliance PDC 26 Criteria Credited Means for Compliance A minimum of two reactivity control systems or means shall provide:

(1) A means of inserting negative reactivity at a sufficient rate and [ 3 SE + 4 CE ]

amount to assure, with appropriate margin for malfunctions, that With maximum worth element the specified acceptable system radionuclide release design limits assumed fully withdrawn are not exceeded and safe shutdown is achieved and maintained during normal operation, including anticipated operational occurrences.

(2) A means which is independent and diverse from the other(s), [ 4 CE ]

shall be capable of controlling the rate of reactivity changes resulting from planned, normal power changes to assure that the specified acceptable system radionuclide release design limits are not exceeded.

(3) A means of inserting negative reactivity at a sufficient rate and [ 3 SE + 4 CE ]

amount to assure, with appropriate margin for malfunctions, that With maximum worth element the capability to cool the core is maintained and a means of assumed fully withdrawn shutting down the reactor and maintaining, at a minimum, a safe shutdown condition following a postulated event.

(4) A means for holding the reactor shutdown under conditions [ 3 SE + 4 CE ]

which allow for interventions such as fuel loading, inspection and repair shall be provided.

CE - Control Elements SE - Shutdown Elements Kairos Power Hermes Reactor 4-51 Revision 0

Preliminary Safety Analysis Report Electrical Power Systems reactor protection system (RPS) block loads (as shown in Figure 8.1-1) will fail by design to ensure proper fail-safe functions. This UPS is sized to provide short-term backup power to the RPS block loads, and to lose power on failure of the backup generators. The fail-safe functions are described in further detail in the following paragraphs and in Section 7.3.

To ensure fail-to-safety in the event of a complete loss of AC electrical power, the reactivity control and shutdown system (RCSS) is equipped with a safety-related clutch that requires 24 VDC to remain closed.

On a loss of power, the relay opens, and the control shutdown elements drop into the reactor by gravity.

To ensure fail-to-safety in the event of a complete loss of AC electrical power, the primary salt pump (PSP) and heat rejection subsystem power supply is equipped with relays requiring 24 VDC to remain closed. On a loss of power, the relays open to prevent inadvertent pump and blower restart on power restoration. A manual reset is required to restart the pumps.

On activation of the decay heat removal system (DHRS), the reactor protection system will remove 24 VDC from the activation circuit relay to prevent inadvertent shut down of the DHRS by operator error.

Equipment for monitoring reactor status will be supplied by UPS until the normal power supply or backup generators are restored.

The BPS is provided to permit functioning of SSCs following a loss of normal power. The passive design features of the Hermes reactor, based on fundamental physics principles, do not rely on AC or DC electrical power for safety-related SSCs to perform their safety functions during postulated events. Safe shutdown of the reactor does not rely on AC electrical power from the BPS. These features demonstrate conformance with the requirements in PDC 17.

As discussed above, the BPS is not relied on for safety-related SSCs to perform their safety functions following postulated events. Therefore, there are no safety-related portions of the BPS, and no tests or inspections are required to demonstrate conformance with the requirement in PDC 18.

The backup power system is not safety-related, but portions of the system may cross the isolation moat discussed in Section 3.5. SSCs that cross a base-isolation moat may experience differential displacements as a result of seismic events. The backup power system is designed so that postulated failures of SSCs in the system from differential displacements do not preclude a safety-related SSC from performing its safety function. Design features addressing differential displacement are discussed in Section 3.5. These features demonstrate conformance with the requirement in PDC 2.

The backup power system is designed in accordance with NFPA 70, National Electrical Code (Reference 8.3-1).

8.3.4 Testing and Inspection The BPS does not perform any safety functions. Periodic inspection and testing are performed on the BPS for operational purposes.

8.3.5 References

1. National Fire Protection Association, NFPA 70, National Electrical Code. 2020.

Kairos Power Hermes Reactor 8-8 Revision 0

Preliminary Safety Analysis Report Accident Analysis 13.1.1.1 Initial Conditions Assumptions Normal operating parameters are discussed in Section 4.1. Conservative initial values are assumed for each operating parameter to maximize the release of radionuclides in the MHA.

The radioactive material that is at risk for release for the MHA includes radionuclides contained in the fuel, the radionuclides circulating in the Flibe, and the radioactive material at risk for release (MAR) distributed within the primary system (i.e., steel structures and graphite). Although radionuclides could have diffused away from the tri-structural isotropic (TRISO) fuel particles, the initial inventory of the small fraction of fuel that is defective at the initiation of the transient assumes that no diffusion has occurred. This hypothetical condition adds a bounding conservatism to the radionuclide release from the fuel and Flibe.

The TRISO fuel form and the basis for its radionuclide retention performance is discussed in Section 4.2.1. The methodology for determining the radionuclide behavior and retention properties of the fuel is provided in Section 3 of KP-TR-012, KP-FHR Mechanistic Source Term Methodology Topical Report, (Reference 1). Fuel manufacturing and in-service performance specifications are discussed in Section 4.2.1.

The Flibe design is discussed in Section 5.1. The methodology for determining the radionuclide behavior and retention properties of the Flibe is provided in Section 4 of Reference 1. A bounding value for Flibe circulating activity is assumed as the initial condition.

A bounding value of retained tritium and activated argon available for release is assumed to encompass available volume and geometry of tritium-absorbing materials in the system.

13.1.1.2 Structures, Systems and Components Mitigation Assumptions This section describes the structures, systems, and components (SSCs) that perform a function to mitigate the dose consequences of the MHA.

The reactor protection system (RPS) is credited with detecting the system disturbance and initiating a reactor trip, primary salt pump (PSP) trip, heat rejection blower trip, and a pebble extraction and insertion trip. The RPS initiates a reactor trip to shut down the reactor to limit the addition of heat to the system. The pebble extraction and insertion trip stops pebbles from moving into, out of, and through the core following the reactor trip to preclude any damage to pebbles from extraction faults during the event. The PSP trip facilitates the transition to decay heat removal through the decay heat removal system (DHRS) and precludes the potential for continuous entrainment of cover gas in the Flibe during the MHA. The DHRS continued operation ensures that an adequate amount of decay heat is removed from the system. The design bases of the RPS are discussed in Section 7.3. The RPS detection and actuation capabilities are automatic and do not rely on manual action to perform these functions.

The shutdown elements in the reactivity control and shutdown system (RCSS) is are credited with shutting down the reactor upon receiving the reactor trip signal. The shutdown and control elements have sufficient worth to shut down the reactor and maintain long-term shutdown. The design bases of the RCSS shutdown function are provided in Section 4.2.2.

The DHRS is credited with removing an adequate amount of decay heat from the reactor to ensure that material design temperatures are not exceeded and no incremental fuel failures occur due to elevated temperatures. The DHRS does not rely on electrical power or manual actions to operate. The DHRS rejects heat to the ultimate heat sink passively. The design bases of the DHRS heat removal function are provided in Section 6.3.

Kairos Power Hermes Reactor 13-3 Revision 0

Preliminary Safety Analysis Report Accident Analysis negative pressure difference and allows air to enter the reactor system. In the reactor vessel head space, air reacts with Flibe to form volatile products and oxidizes portions of the structural graphite above the surface of the Flibe and the carbon matrix for pebbles in transit above the surface of the Flibe.

Radionuclides from the coolant circulating activity in the broken pipe are released into the facility air when aerosols are generated from the coolant that exits the pipe. All the floor surfaces where Flibe may be spilled will have design features such as steel liners to prevent Flibe-concrete interaction, as described in Section 3.5. The spilled Flibe spreads on top of the liner and forms a Flibe pool.

Radionuclides in the spilled Flibe is released through evaporation until the top surface of the Flibe pool is solidified.

The limiting salt spill postulated event bounds other salt spill events, including:

• Spurious draining and smaller leaks from the primary heat transport system

• Leaks from other Flibe containing systems and components (e.g., IMS fill/drain tank, IMS piping, chemistry control system piping)

• Leaks up to the hypothetical double-ended guillotine primary salt piping break size

• Mechanical impact or collision events involving Flibe Containing SSCs (except the vessel)

• Single or multiple HRR tube(s) break These following sections describe key assumptions associated with the limiting salt spill event. The quantitative values associated with these assumptions, as well as the methods used to evaluate the surrogate figures of merit that ensure the event consequences are bounded by the MHA are provided in Reference 2.

13.1.3.1 Initial Conditions Assumptions Normal operating parameters are provided in Section 4.1. Conservative initial values are assumed for each operating parameter to ensure a bounding result for the figures of merit that demonstrate the event is bounded by the MHA.

A hypothetical double-ended guillotine break in the PHTS hot leg piping is assumed as the event initiator. The initial Flibe conditions are discussed in Section 5.1.

13.1.3.2 Structures Systems and Components Mitigation Assumptions This section describes the SSCs performing a function to mitigate the consequences of the event.

The RPS is credited with detecting the break on low reactor coolant level and initiating a reactor trip, PSP trip, heat rejection blower trip, and the PHSS trip. The DHRS is operating when the reactor is above a threshold power, as discussed in Section 6.3, and remains in an always on mode. The RPS initiates a reactor trip to shut down the reactor and limits the addition of heat to the system. The RPS trips the PSP limit the amount of spilled Flibe. The heat rejection blower is tripped to limit the amount of air ingress following postulated HRR tube breaks. The PHSS trip stops pebble extraction and insertion following the reactor trip to preclude any damage to pebbles from faults during the event. The DHRS remains active to ensure that an adequate amount of decay heat is removed from the system. The design bases of the RPS are discussed in Section 7.3. The RPS detection and actuation capabilities are automatic and do not rely on manual operator action to perform these functions.

The RCSS is credited with shutting down the reactor upon receiving the reactor trip signal. The shutdown and control elements are assumed to have sufficient worth to shut down the reactor and maintain long term shutdown. The design bases of the RCSS shutdown function are provided in Section 4.2.2.

Kairos Power Hermes Reactor 13-7 Revision 0

Preliminary Safety Analysis Report Accident Analysis limiting loss of forced circulation event occurs at an initial power above the DHRS threshold power discussed in Section 6.3, limiting reactor temperature and fulfilling the heat removal function.

The limiting loss of circulation postulated event bounds other loss of circulation events, including:

• Blockage of flow path external to the reactor vessel in the primary heat transport system

• Spurious pump trip signal

• Shaft fracture

• Bearing failure

• Pump control system errors

• Supply breaker spurious opening

• Loss of net-positive suction head (e.g., pump overspeed, low level)

• Loss of normal electrical power

• Flibe freezing inside HRR

• Loss of normal heat sink The following sections describe the key assumptions associated with the limiting loss of forced circulation. The quantitative values associated with these assumptions, as well as the methods used to evaluate the surrogate figures of merit that ensure the event consequences are bounded by the MHA are provided in Reference 2.

13.1.4.1 Initial Conditions Assumptions Normal operating parameters are provided in Section 4.1. Conservative initial values are assumed for each operating parameter to ensure a bounding result for the figures of merit that demonstrate the event is bounded by the MHA.

The loss of forced circulation event initiator is assumed to be a pump seizure, which disables the PSP.

13.1.4.2 Structures Systems and Components Mitigation Assumptions This section describes the SSCs performing a function to mitigate the consequences of the event.

The RPS is credited with initiating a reactor trip. The PHSS is tripped to prevent damage to fuel in transit.

The DHRS is operating when the reactor is above a threshold power, as discussed in Section 6.3, and remains in an always on mode. The RPS initiates a reactor trip to shut down the reactor and limits the addition of heat to the system. The PHSS trip stops pebble extraction and insertion following the reactor trip to preclude any damage to pebbles from faults during the event The DHRS remains active to ensure that an adequate amount of decay heat is removed from the system. The design bases of the RPS are discussed in Section 7.3. The RPS detection and actuation capabilities are automatic and do not rely on manual operator action to perform these functions.

The shutdown elements in the RCSS is are credited with shutting down the reactor upon receiving the reactor trip signal. The shutdown and control elements are assumed to have sufficient worth to shut down the reactor and maintain long term shutdown. The design bases of the RCSS shutdown function are provided in Section 4.2.2.

The DHRS and natural circulation within the reactor vessel are credited with removing an adequate amount of decay heat from the reactor to ensure that material design temperatures are not exceeded and no incremental fuel failures occur due to elevated temperatures. The DHRS does not rely on electrical power or manual operator actions to operate. Natural circulation within the core transfers heat from the fuel to the reactor vessel shell. Energy is transferred from the vessel shell to the DHRS, and the DHRS rejects the heat to the ultimate heat sink passively. The design bases of natural circulation Kairos Power Hermes Reactor 13-9 Revision 0

Preliminary Safety Analysis Report Accident Analysis 13.1.10.1 Recriticality or Unprotected EventsReactor Shutdown System Failure In postulated events that require a reactor trip, the safety-related portion of the RCSS, reactor shutdown system, is relied upon to shut down the reactor and maintain shutdown margin. Unprotected events, orReactor shutdown system (RSS) failure events where reactor shutdown is not achievable, are excluded from the design basis. Events that would result in a recriticality event are also excluded from the design basis. The RCSS is designed (described in Section 4.2.2) with sufficient independence, diversity, and redundancy from detection and actuation to element insertion to ensure reactor shutdown when necessary. The shutdown margin is maintained for all postulated event conditions to ensure there is no recriticality after the RCSS has initiated shutdown, as described in Section 4.5.

Additionally, the graphite reflector blocks are designed to maintain structural integrity and ensure misalignments do not prevent the insertion path of the shutdown elements, as discussed in Section 4.3.

13.1.10.2 Degraded Heat Removal or Uncooled Events In postulated events where the normal heat rejection is not available, natural circulation in the reactor vessel and the heat removal function of the DHRS are relied upon to remove heat from the reactor core.

Degraded heat removal or uncooled events are excluded from the design basis. The initiation of natural circulation is completely passive, and the design features, including the structural integrity of the reactor vessel internals, that ensure a continued natural circulation flow path are discussed in Section 4.6. The DHRS is aligned and operating when the reactor power is above a threshold power and remains in this state as described in Section 6.3, precluding the need for an actuation to occur for the DHRS to remove heat during a postulated event. The DHRS design includes sufficient redundancy to perform its safety function assuming the loss of a single train, as discussed in Section 6.3.

13.1.10.3 Flibe Spill Beyond Maximum Volume Assumed in Postulated Salt Spills In the salt spill postulated event category, an upper bound volume of Flibe is assumed to spill out of the PHTS onto the floor. A volume of Flibe spilling out of the system beyond the amount assumed in the bounding salt spill event is excluded from the design basis. There are several design features ensuring the amount of Flibe available to spill is limited to an upper bound value. The PHTS is designed with anti-siphon features discussed in Section 5.1. These features are designed to passively break the siphon in the event of a break. The PSP also trips to allow the primary system to depressurize. The reliability of the RPS, which trips the PSP and heat rejection blower in the event of a salt spill, is discussed in Section 7.3.

The reactor vessel shell also maintains integrity in postulated events to ensure the fuel in the core remains covered with Flibe. The reactor vessel shell design features that prevent leakage are discussed in Section 4.3.

13.1.10.4 In-Service TRISO Failure Rates and Burnups Above Assumptions in Postulated Events The in-service fuel failure rates and the burnup of pebbles assumed in the postulated events are based on the fuel qualification specifications in Section 4.2.1. In-service TRISO failure rates above the rate assumed in postulated events are excluded from the design basis. The insertion of pebbles with a burnup higher than the fuel qualification envelope is excluded from the design basis. As described in Section 7.3, the RPS includes a function to stop the pebble insertion and extraction functions to ensure pebbles are not damaged in faults occurring after an event initiation. The fuel qualification program includes testing, inspection, and surveillance to ensure the fuel operating envelope is within the fuel qualification envelope. Inspection and surveillance of the fuel in service is performed in the PHSS as discussed in Section 9.3.

Kairos Power Hermes Reactor 13-15 Revision 0