KnE Energy | International Conference on Nuclear Energy Technologies and Sciences (2015) | pages: 193-211

, , and


Nowadays, most of nuclear power plants (NPPs) operating in the world or under construction are large-scale reactors with an electrical output around 1,000 MWe. This offer corresponds to the needs of large power grids like those in Europe, USA, Japan or China where electrical connections are powerful and utilities can afford a huge initial investment. However, these units are too powerful to fit in smaller grids where they would represent more than 10% of the installed capacity.

Thus, current nuclear offer does not address the needs of developing countries or archipelagos, where the grids are smaller and the investment capacities reduced. This is why many nuclear designers are developing new concepts of NPPs: Small Modular Reactors (SMRs). Electrical output of these future plants will be below 300 MWe. The financing would be eased by a more progressive capital expenditure, a shorter construction time and an accelerated return on investment [1]. The large reactors “economies of scale” are replaced by small units “economies of number” (series effect, learning effect, shared support facilities).

But the small modular reactors costs are still penalized by important civil engineering work since reactor system is sealed into large underground concrete structures. Furthermore, there is significant energy demand in areas where land is scarce, highly populated or unsuitable for the construction of NPPs - because of the threat of natural hazards for example. Based on these two ascertainments, DCNS has imagined a solution to address the energy needs of such countries, without requiring a suitable construction land and without high civil engineering cost. This solution is FLEXBLUE®, a subsea-based Small Modular Reactor.

DCNS is a French state-owned company, which has been designing, building, maintaining and dismantling ships of the French Navy and many foreign Navies for several centuries. DCNS engineering offices and shipyards have especially designed and built nuclear submarines and nuclear aircraft carriers during the last 50 years. Not less than 17 nuclear-propelled ships have been delivered by DCNS teams.

The goal of this study is to work out an innovative strategy to handle a steam generator tube rupture (SGTR) with passive systems only, without releasing any radioactive elements to the environment, and without flooding the containment. A SGTR is a major accident for Pressurized Water Reactors. Indeed, when a PWR is at power, the steam generator (SG) tubes form both the second and the third confinement barriers because the main steam lines at SG outlets bypass the containment. When a rupture occurs, possibly contaminated primary fluid flows out the containment to the secondary system.

The Flexblue® Concept

Location and lifecycle

FLEXBLUE® is a subsea and fully transportable nuclear module. Its power output is 160 MWe and is sent to the grid by submarine cables. The module is anchored on the seabed, a few kilometers away from the shore, at an immersion depth comprised between 50 and 100 meters. The module is a 150-meter long, 14-meter diameter horizontal cylinder. Several modules can be gathered into a FLEXBLUE® farm. The module is remotely operated from an onshore control center. There is not permanent staff on board, only occasional presence for light maintenance. A FLEXBLUE® module is not a submarine: it is not self-propelled; it does not use any military devices but only civilian technologies. It is designed for the single purpose of delivering electricity to the grid.

Once set up on the seabed, the reactor starts a 40-month production cycle. Then, production stops for refueling. The module is removed and transported by a ship to a coastal support facility where the spent fuel pool is located. Then the module is sent back on production site and a new cycle begins. Major maintenance and control occur every ten years (every three fuel cycles). FLEXBLUE®’s lifecycle is presented in Fig. 1 and its module main characteristics are shown in Table 1.

Figure 1

Artist views of a FLEXBLUE® module lifecycle: a) the subsea production site and the onshore control center; b) the ship transport; c) the support facility for refueling and maintenance; d) the transport back to the production site.

Table 1

FLEXBLUE® module main characteristics

Parameter Value
Unit power rating 160 MWe
Length / diameter 150 m / 14 m
Immersion depth 100 m
Cycle length 40 months
Lifetime 60 years


FLEXBLUE® will be completely manufactured in factories and then assembled in a shipyard, using naval modular construction techniques that DCNS perfectly masters. Components can be made in different places in parallel, which reduces the construction time. Then, they are mounted on modular structures named ‘skids’. The skids are finally inserted into the hull. Compared to a large outdoor construction site, this industrial process enables a very modular assembly, a reduced construction time and a better quality of the work (which eases the compliance demonstration). Thus, the industrial risk is reduced.

The construction cost of a SMR is supposed to be higher than the one of a large NPP, because of the economies of scale [2]. However, economies of scale are not the only ways to decrease the capital cost per MWe. There are many SMR specific factors that make the capital cost of a SMR close to the one of a large reactor:

  1. Co-siting: when several units are built on the same site (like a FLEXBLUE® farm), capital cost is reduced because a lot of work is shared (geological studies, site licensing process, public acceptance, grid connection).

  2. Modular design: as explained in the previous section, a modular design and a modular construction contributes to reduce the cost of a nuclear unit.

  3. Series effect: because of their small output, the scheduled number of SMRs is high. Thanks to this serial production, there will be a “learning effect”: the Nth-of-a-kind will be less expensive as N is growing.

  4. Shared facilities: SMRs will make possible an increased mutualisation of support functions which is cost efficient. In the FLEXBLUE® concept, the control centre operates an entire farm. The support facility (refuelling, waste management, maintenance) is shared between several modules and even several farms.

  5. No civil engineering: this factor is FLEXBLUE® specific. The module does not require any expensive and time-consuming large concrete building like typical NPPs and other SMRs.

By considering the beneficial of those factors, SMRs can be competitive againts the usual large NPPs, and generally in the energy market [2].

DCNS analysis leads to the same conclusion, and shows that the levelized cost of energy produced by a FLEXBLUE® module will be between 100 and 120 €/MWh. This cost is slightly higher than electricity cost from new NPPs but still very competitive in the energy market. Besides, the investment required is much more progressive and make the nuclear energy accessible for utilities which have not the capacity to finance the upfront cost of a large NPP [3]. The market that FLEXBLUE® addresses is very large. An important share of human activity and population is located near seawater, so electricity demand is high on the coastlines. FLEXBLUE® is the only nuclear solution to deliver electricity at a short distance of a coastal highly populated area without compromising safety. In addition, immersion is a great protection against many natural hazards like tsunamis or earthquakes (the module will be attached on the seabed by anti-seismic studs). FLEXBLUE® also answers to the needs of countries eager to create local qualified jobs and to reduce their reliance on fossil fuels (to be more independent energetically or to reduce their greenhouse gases emissions, or both). For a new-comer country in nuclear energy, FLEXBLUE® offers the possibility of investing at one’s own speed. This flexibility is a key asset in today’s uncertain energy market.


The FLEXBLUE® concept offers valuable differentiating advantages compared with other NPPs in terms of impact. Indeed, immersion is much more an opportunity than a risk. First, there is no visual impact: the power plant is not visible. Then, there is no population in the vicinity of the module. FLEXBLUE® is the only solution to produce high quantities of electricity without requiring a single square meter of land and without being nearby of any population. As a consequence, no relocation of the population has to be envisaged in case of a severe accident: the land is entirely preserved.

About the environmental impact, one of the objectives of FLEXBLUE® early-stage design is to reduce the generation of waste. In particular, there is no soluble boron needed to control the core. It contributes a lot to the reduction of effluents production. Thus, a module does not release any radioactive liquid effluents during the fuel cycle. Storage capacities are foreseen, and liquid effluents will be collected and treated every three years by the support facility. Another great asset of FLEXBLUE® is its removability. The installation of modules is fully reversible because there is no large concrete structure. Thus, no dismantling is needed onsite at the end of the plant lifetime. The intact site will be quickly restored to the environment. This full removability also authorizes modules to change production site along their 60-year lifetime. Dismantling of the module will take place in an appropriated shipyard, like it has already been done for several retired nuclear submarines.

Thanks to these unique features, unmatched in the nuclear field, FLEXBLUE® is respectful of the environment and more easily acceptable for the population. It makes the nuclear energy more accessible to countries eager to develop their electrical production with clean, safe, reliable and low-carbon solutions.


FLEXBLUE® uses the most reliable and proven nuclear technology both for electricity production and naval environment: a Pressurized Water Reactor (PWR). More than 60% of currently operated NPPs in the world are PWRs, and more than 90% of nuclear submarines host a PWR. Even though FLEXBLUE® is an innovative concept, it only relies on proven technologies and mostly uses offthe-shelf components. No risky development is needed. FLEXBLUE® PWR is a two-loop reactor, with a pressure vessel, two horizontal recirculating steam generators (SGs), two canned coolant pumps and a pressurizer as shown in Fig. 4. Primary loops are designed to ease natural circulation. Meanwhile, FLEXBLUE® reactor characteristics are given in Table 2 [4].Figure 2

Figure 2

Cross view and profile view of FLEXBLUE® reactor. The coolant pumps (brown) are located at the outlet of SGs (green).

Table 2

FLEXBLUE® reactor characteristics

Parameter Value
Thermal power 530 MWt
Reactor core 77 fuel assemblies
Fuel assembly 17 x 17 rods, 2.15 m high
Enrichment < 5%
Average power density 70 kW/L
Reactor coolant pressure 155 bars
ΔT core 30 0C
Steam generators 2 recirculating SGs
SGs pressure 62 bars (saturated)

The primary system and all the auxiliary and safety systems that carry primary fluid are located inside the reactor compartment of the module as shown in Fig. 3. This compartment forms the third barrier of confinement (the first one is the fuel cladding and the second one is the primary system pressure boundary). The other compartments host the turbo-generator, an on board control room, instrumentation and control panels, process auxiliaries and a living area for occasional workers.

Figure 3

view of a FLEXBLUE® module.


Safety concept and safety systems

FLEXBLUE® is based on a unique safety concept: a full passivity and an unlimited grace delay. It is the greatest asset of immersion: ocean around the module forms an infinite heat sink for the passive heat removal systems in case of an accidental transient. The safety systems are designed in order to operate passively according to the IAEA passivity definition [5]. All safety functions are fulfilled without any operator action and external electrical input. The little amount of energy needed at the beginning of a transient for actuation and monitoring is supplied by on board, redundant emergency batteries.

In addition, the onshore control center hosts emergency generators that can supply active systems in the module through submarine cables in case of abnormal transients, but none of those are safety-related. Nuclear safety is fully guaranteed by the passive devices located into the module.

This safety concept is inspired by the lessons learned from previous nuclear accidents in the world, especially the Fukushima Daiichi accident. In the FLEXBLUE® concept, safety does not depend neither on emergency diesel generators (that have been flooded by the tsunami in Fukushima) nor on human intervention (that can lead to mistaken actions). Safety only relies on some automatic operations, and mainly on permanent natural phenomena: gravity and natural circulation of water between a heat source (the core) and a heat sink (the ocean). This makes the FLEXBLUE® safety concept very robust

Reactivity control

If an emergency signal is actuated by an abnormal situation in the reactor, chain reaction can be stopped passively by two diversified devices. The first one is the control rods that drop in the core by gravity. The second one is the gravity-driven emergency boron injection system, which is actuated only in case of anticipated transient without scram. Both these devices can independently shutdown the reactor and keep it subcritical up to cold shutdown state [4].

Core cooling

The core residual heat after scram is removed by four cooling loops, each one able to transfer 50% of decay heat:

  1. Two primary chains are connected to the primary circuit: each one includes an inlet pipe connected to a hot leg, a passive primary heat exchanger (PPHX) immersed in a large safety water tank, and an outlet pipe connected to a cold leg. The intermediate heat sink formed by the safety tank is cooled by the ocean through the metallic hull.

  2. Two secondary chains are connected to the secondary circuit: each one includes an inlet pipe connected to a main steam line, an emergency condenser (EC) directly immersed in seawater and an outlet pipe connected to a feedwater line.

Thanks to the infinite heat sink - seawater - and to the elevation difference of the heat sink with respect to the heat sources, the four chains operate passively by natural circulation. In normal conditions operation, they are closed by pneumatic valves and open to their fail safe position when electrical load is lost. The targeted long-term safe state of the reactor is a shutdown state where continuous cooling of the reactor core is achieved by natural circulation as shown in Fig. 4.

Figure 4

Targeted safe state when primary circuit is intact.


Protection against loss-of-coolant accidents is ensured by two passive safety injection trains. Each one includes a direct vessel injection line fed by three injection sources: a core makeup tank (CMT) pressurized by the primary circuit, a classical accumulator (Acc) pressurized at 40 bars by nitrogen and a large safety tank which feeds the primary circuit by gravity when primary pressure has decreased to near containment pressure. In addition, a two-train automatic depressurization system (ADS) is connected to the pressurizer (PZR) and to the hot legs to generate a controlled depressurization of the primary circuit which enables faster injection. Once these systems have actuated, the long-term equilibrium state is reached when the safety tanks are empty and the reactor compartment is flooded as shown in Fig. 5. At that point, a passive recirculation path is in place: water boils off the core, is released in the containment, condensates on the containment walls, collects in the sump and is injected back into the reactor pressure vessel through sump screens and direct vessel injection lines by gravity as shown Fig. 6. Decay heat is transported and removed through the metallic hull. Thanks to the unlimited heat sink (the ocean), grace period is theoretically infinite for both targeted safe states, which is a breakthrough in nuclear safety.

Figure 5

Targeted safe state when primary circuit has failed.

Figure 6

Core cooling by sump natural circulation [5].


Radioactivity confinement

Confinement of the radioactive isotopes is guaranteed by three hermetic barriers: the fuel cladding, the primary circuit pressure boundary and the containment boundary. The latter one is formed by the hull and the reactor compartment walls and is designed to sustain a 10-bar internal pressure. To protect its sealing against over pressurization, it is equipped with a Pressure Suppression System as shown in Fig. 7. Indeed, in case of a break in the primary or secondary systems, the pressure in the reactor compartment quickly rises. The pressurized air-vapor mixture in the drywell is passively driven to the bottom of the wetwell where the vapor is condensed. It significantly reduces the pressure in the drywell.

Figure 7

Diagram of the Pressure Suppression System (PSS).



The large safety tank in the reactor compartment plays three important roles: intermediate heat sink for the passive primary heat exchangers; low-pressure injection source in case of a loss of coolant accident; suppression pool to protect the containment sealing. They also act as an efficient radiation shield to protect workers and systems located in the adjacent compartment.

The capability of the hull to reject decay heat to seawater is a key point of the safety concept. It is needed to cool the safety tank and to condense vapor in the containment. FLEXBLUE® hull heat transfers have been investigated [6]. Results show the great potential of the design to remove residual power to the heat sink as shown in Fig. 8.

Figure 8

Seawater temperature field (K) around the top of the hull when hull internal surface temperature is 373K and initial seawater temperature is 308K [6].


Severe accidents

The availability and the infinity of the ocean around the hull make the likelihoods of core damages extremely low. Still, the reactor coolant system and the containment are designed to sustain a core melting. The mitigation strategy consists in in-vessel retention of the corium. It is possible thanks to an external cooling of the vessel by water provided by the safety tank. In a review of in-vessel retention state-of-the-art [7], the French Institute for Nuclear Safety asserts that this strategy is feasible for SMRs with appropriated cooling circuit around the vessel.


FLEXBLUE® safety concept complies with latest international safety standards (Gen. III+): IAEA standards and guides, Western Nuclear Regulators Association and French Safety Authority technical guidelines, as well as French post-Fukushima requirements.

Goal of The Study


FLEXBLUE® has very ambitious safety objectives: any accidental transient must be handled by passive safety systems and must end on a safe shutdown state without external electrical input and without human action. To assess the capability of the safety features to complete these objectives, the reactor and its systems have been modeled with an advanced computer code (see description in the next section). Up to now, many accidents have been simulated thanks to this model. Accident analyses of the first studied transients are [8]:

  • Turbine trip accident

  • Small break Loss Of Coolant Accident (LOCA)

  • Large break Loss Of Coolant Accident

All of these accidents have been cumulated with a Station Black-Out (SBO), so that only the passive devices are used to mitigate the accident. The results provided by the computer code show that the systems are appropriately designed: the safety criteria are respected with significant margin and the reactor always ends on a safe shutdown state which is not limited by any given mission time. The accident analyses continued with another important transient: a steam generator tube rupture (SGTR).

Steam Generator Tube Rupture

A SGTR is a major accident for Pressurized Water Reactors. Indeed, when a PWR is at power, the SG tubes form both the second and the third confinement barriers because the main steam lines at SG outlets bypass the containment. When a rupture occurs, possibly contaminated primary fluid flows out the containment to the secondary system.

On current land-based PWRs, atmospheric steam discharge valves are used to cool down the secondary system, which is contaminated by primary water after the rupture. The affected SG is then isolated by the operator, so the radioactive leak is stopped. But one can see that radioactive elements are rejected to the environment, and their amount is highly dependent on the celerity of the operator in the control room. Regarding the safety objectives of FLEXBLUE®, this accident management is not satisfactory.

The easiest strategy to manage a SGTR in the FLEXBLUE® reactor is to consider the tube rupture as a small break LOCA as shown in Fig. 9. The accident analysis of this transient is presented in [8]. This strategy is acceptable: all the safety criteria are respected. However, the consequences on the availability of the plant are important. The reactor compartment is flooded with primary water and it would take time to restore the operability of the plant.

Figure 9

Steam generator tube rupture and radioactive releases to the environment on a typical land-based Pressurized Water Reactor.


Analysis Tool and Reactor Model


ATHLET (Analysis of Thermal-Hydraulics of Leaks and Transients) is a thermal-hydraulic system code developed by the German technical safety organization GRS. It is applicable to the analysis of light water reactors, and has already been used for the analysis of transients involving horizontal SGs, similar to the ones of Flexblue®. It is composed of four main calculation modules: thermofluid dynamics, heat transfer and heat conduction, neutron kinetics, and control & balance of plant.


FLEXBLUE® reactor is modelled with ATHLET in accordance with GRS guidelines [9, 10]. The nodalization of the circuits is performed in order to get both a sufficient accuracy and an acceptable calculation time. Two core channels are modelled: an outer ring and an inner channel where power density is higher. In this latter one, the hot fuel pin is modelled to calculate peak clad and fuel temperatures. The two loops are modelled, as well as all the safety systems with the exception of the emergency boron injection system (failure of scram is not considered in the studied transients). Pressurizer and piping are considered perfectly insulated. The injection sources (tanks and accumulators) are not borated. The active auxiliary systems and the regulations are modelled for this study.

Indeed, their effect can be penalising. For example, if the chemical and volume control system is running after a SGTR, it increases the flow rate through the leak. A special attention is given to these active systems during the study, in order to ensure that only the penalising effects are considered. The diagram of the ATHLET model is showed on Fig. 10.

Figure 10

ATHLET model. Dimensions are not representative.


The model considers a 2.5-second delay between the scram signal and the full insertion of control rods. Decay heat calculation is based on formulas from [11], which are extracted from standards of American Nuclear Society [12], and then conservatively increased by 20% to respect NRC guidelines [13]. Fig. 11 presents the considered decay heat for the accident analyses.

Figure 11

Decay heat of FLEXBLUE® core.


Reactor core is at 100% of its nominal power (530 MWth) at the beginning of the transient. A loss of electrical load is assumed just after the beginning of the transient. The only electrical sources available are the emergency batteries, able to monitor and control the safety systems, and to open or close some valves. The action of other active systems is considered only if they have a penalising effect. The opening time of the valves is 2 seconds. Pressurizer and steam generators safety valves setpoints are respectively 171 bars and 83 bars, with a one-second opening time. Even if it is planned to install flow restrictors in the pipes, their effects are not taken into account in the accident analysis, which is a conservative measure.

Heat transfer between safety tanks and seawater through the metallic hull is not modelled, which is conservative. None of the steam generators tubes is considered clogged. The actuation logic of emergency signals and passive systems with the treatment delays considered are presented in Table 3.

Table 3

Safety signals (conservative delays for actuation).

Signal Trigger(s) Delay
Reactor protection High containment pressure or low pressurizer pressure 0.9 s
Reactor scram Reactor protection or low pump speed or high pressurizer pressure 1 s
Coolant pump stop Reactor protection or reactor scram or ADS first stage opening or low pressurizer level 3 s
Feed and steam lines isolation Reactor protection or turbine trip 0.15 s
Core makeup tank injection Reactor protection or low pressurizer level 2 s
Emergency condenser actuation SG high pressure (75 bars) or passive primary cooling actuation 0.5 s
Passive primary cooling actuation CMT injection or high pressurizer level 4 s
ADS opening CMT injection and low level in both CMTs 20 s

Elaboration of A New Sgtr Strategy

As stated previously, the FLEXBLUE® strategy in case of a SGTR must avoid the flooding of the containment and lead to a safe shutdown state where primary system is closed (Fig. 6). The flooding of the containment is caused by the depressurisation of the primary system and the injection of the low-pressure safety tank. These two events happen only when the low-level signal is actuated in the core makeup tanks (the first tanks that inject water in the vessel after a LOCA). To avoid the flooding, it is mandatory not to trigger this signal (see red cross on the process in Fig. 11) and then to keep the CMTs filled with water - at least partially. This is possible if the amount of coolant lost through the SG tube rupture is reduced.

Figure 11

Logical process leading to the containment flooding.


The driving force of this leak is the difference between the primary pressure and the pressure in the affected steam generator (respectively 155 bars and 62 bars at nominal conditions). The most efficient way to reduce the loss of coolant through the leak is to eliminate as quickly as possible this difference of pressure. Two parallel actions must be implemented in the SGTR mitigation strategy:

  1. Decrease the primary pressure. The opening of the depressurisation valves is not an option because the containment must not be flooded. So, the passive primary heat exchangers and the passive secondary emergency condensers will be used to remove decay heat from the primary system and decrease its pressure.

  2. Increase the pressure in the affected SG. Usually, SG pressure is reduced by the corresponding emergency condenser (EC). If the condenser is closed, the SG pressure will increase. However, this action is limited by the SG safety valves: they will open and discharge steam in the safety tank if the pressure exceeds 83 bars.

Another concern is the detection of the accident. Unlike a large break LOCA, a SGTR is a small leak and is not easy to detect. Three signals must be closely monitored:

  1. Abnormality in the operation of the primary volume control system. This signal indicates that something is wrong in the balance of primary fluid inventory.

  2. Abnormality in the regulation of SG water level. This signal indicates that something is wrong in the balance of secondary fluid inventory.

  3. Detection of Nitrogen-16 in the secondary system. This isotope with a 7-second half-life is an activation product of primary water. It is not supposed to be present in the secondary system.

The concomitance of these three criteria (Fig. 12) points out beyond doubt that a steam generator tube rupture has occurred and that an appropriated strategy must be launched to mitigate the consequences. Three strategies are investigated in the following sections. The affected SG is always the SG number 2.

Figure 12

SGTR detection in the FLEXBLUE® reactor.


Option A

The leading idea of option A is to lock the emergency condenser of the affected SG in a closed position, as soon as the SGTR is detected.

The primary and secondary pressures are displayed in Fig. 13. The transient begins by 400 seconds of steady state at full power. Then, the computer code simulates the rupture of one tube in steam generator number 2. Fifty seconds later, the rupture is detected. It triggers automatically numerous protections measures: the chain reaction is stopped by the drop of control rods, the secondary isolation valves are closed, the CMTs injection valves are opened and the passive primary heat exchangers (PPHXs) are connected. Moreover, all the active systems (including the primary pumps) are stopped, except the ones with penalizing effect (e.g. the primary volume control system).

Figure 13

Primary and secondary pressures after.


The closing of secondary isolation valves leads to a sudden pressurization in both SGs. When SG1 pressure reaches 75 bars, the emergency condenser n°1 (EC1) is connected, and the pressure starts to decrease. SG2 pressure continues to increase, because the emergency condenser has been locked by the SGTR signal. When the pressure reaches 83 bars, the safety valves are passively opened. During 1,000 seconds, there are several discharges of secondary steam through the safety valves. Meantime, the primary pressure strongly decreases, thanks the combined action of the two PPHXs, the EC1 and the safety valves of SG2. At t=1800s (23 minutes after the tube rupture), the balance between primary pressure and SG2 pressure is achieved: the leaks stops.

This strategy fully respects the safety criteria and ends on a safe shutdown state where the primary system is closed and the containment is not flooded. But there is one major negative impact: the several discharges through the SG2 safety valves have contaminated the safety tank with 271 kg of activated steam. Indeed, the safety valves discharges are collected by the safety tank, and the fluid in SG2 is slightly activated because of the tube rupture. This consequence is not a safety issue, because the safety tank is located into the containment (the confinement is not by passed). But it is detrimental for the availability of the plant because the decontamination of a large tank is time consuming. The objective of the next options will be to handle the accident without requiring to the safety valves.

Option B

In this option, the command of the emergency condenser (EC) of the affected SG is modified. Instead of locking its opening, the state of the emergency condenser depends on the pressure in the affected SG, as shown in Fig. 14. If the pressure exceeds 80 bars, the condenser is opened and the pressure decreases. When the pressure drops below 70 bars, the condenser is closed and the pressure increases again. The cycle can repeat itself several times. The safety valves are not requested because the pressure always remains below 83 bars. The leak is quickly stopped because the pressure in the affected SG remains rather high (above 70 bars).

Figure 14

Option B actuation logic for the emergency condenser connected to the affected SG.


As shown in Fig. 15, the evolution of the pressures with the option B strategy is quite similar to option A (Fig. 13). The difference lies in the management of emergency condenser n°2. It is opened then closed three times before the balance of pressures is established. This balance comes a little bit later than in option A (27 minutes after the tube rupture). The objective of not requesting the safety valves is reached: there is no radioactive contamination outside the affected steam generator. Yet, a new issue is raised by option B strategy. The IAEA definition of passive systems presented in [5] and detailed in [14] specifies that “valves used to initiate safety systems operation must be single-action relying on stored energy”. The valves used to connect the emergency condenser to a steam generator rely on stored energy (on board batteries). But they are not single-action in option B strategy. They are opened and closed several times. The safety system forms by the emergency condenser and its valve cannot be called passive. A new challenge is to be addressed in the next option: mitigate the SGTR only with single-action valves.

Figure 15

Primary and secondary pressures after a SGTR in steam generator n°2 with option B strategy.


Option C

Option A proves that it is impossible to avoid using the emergency condenser of the affected steam generator: the safety valves would discharge activated steam. The affected SG should be cooled and slightly depressurized in the first stage of the accident. Then, the pressure can increase again to achieve the balance of pressures. But the two parallel valves that connect the condenser to the SG (valves “A” on Fig. 19 and Fig. 20) must operate only one action. To solve this problem, a new valve - “B” in Fig. 16 and Fig. 17 - is added close to valves “A”. Valve “B” is open in normal conditions and remains open in most of accidental conditions. This valve is closed only if the two following signals are actuated simultaneously:

Figure 16

New layout of the emergency condenser valves.

Figure 17

Diagram of FLEXBLUE® reactor and its passive cooling systems (two PPHXs and two ECs). Valve “B)” is specific to option C of the SGTR mitigation strategy.

  1. SGTR detection in the steam generator

  2. Low-pressure in the primary system (80 bars)

This low primary pressure value has been chosen lower than the opening set-point of the SG safety valves (83 bars). Thus, it is highly unlikely that the safety valves will be required if valve “B” is closed. Valve “B” is a pneumatic valve, just like valves A. But it is not managed by the usual compressed air system: valve B is managed by a dedicated air tank (see Fig. 19). This measure is important to prevent the closing of both emergency condensers in case of compressed air system failure.

In the option C strategy as in Fig. 18, the affected SG is depressurised during the first stage of the accident by the automatic opening of valves A. When the reduction of primary pressure is considered sufficient (below 80 bars), valve B is closed. The affected SG pressure increases and the balance is done with the primary pressure. This balance comes a little bit later than in previous options (28 minutes after the tube rupture). With the new layout and the new actuation logic, each valve is single-action so the management of the accident is fully passive. The transient ends on the targeted safe shutdown state where primary system is intact, without external electrical input and without operator action. There is absolutely no radioactive release to the environment, but only a limited release to the turbo-generator before the detection of the tube rupture.

Figure 18

Primary and secondary pressures after a SGTR in steam generator n°2 with option C strategy.



The purpose of this paper was first to present an innovative nuclear concept. FLEXBLUE® is a subsea based small modular reactor with inherent advantages in terms of siting, economics, impact and safety. In particular, the immersion of the plant is a great opportunity to protect the reactor from many hazards (storm, tsunami, earthquake, plane crash, extreme air temperature) and to provide the safety systems with an infinite heat sink. This later characteristic allows the implementation of very ambitious safety objectives. FLEXBLUE® safety concept relies on a full passivity. Every single accidental transients - including core melting - can be handled with passive systems only, without external electrical input, without operator action, and without any radioactive release to the environment. These objectives are highly relevant in the post-Fukushima context. The second goal of the paper was to work out a new strategy in case of a steam generator tube rupture. Initial strategy was safe but had an important impact on the availability of the plant. It comes out of this study that a new strategy is possible: the option C strategy presented in the previous section. With a new valve on the emergency condensers inlet lines and an appropriated automatic command, it is possible to manage a SGTR with passive devices, without radioactive releases and with a very limited impact on the plant. Neither the containment nor the safety tank is contaminated. The leak of activated primary water is mostly confined to the affected steam generator and its emergency condenser. The safe state reached at the end of the transient is not limited in time because the heat sink is infinite.


The authors would like to thank GRS for their technical support in the use of ATHLET. The authors are also grateful for the help, the comments and the review provided by other members of FLEXBLUE® development team, especially G. Haratyk and J. Masdupuy.




Automatic Depressurization System


Core Makeup Tank


Emergency Condenser


International Conference in Advances for nuclear Power Plants


Loss of Coolant Accident


Nuclear Power Plant


Nuclear Thermal-Hydraulic, Operation & Safety


Passive Primary Heat eXchanger


Pressurized Water reactor




Station Black-Out


Steam Generator


Steam Generator Tube Rupture



R. Rosner S. GoldbergSmall Modular Reactors - Key to Future Nuclear Power in the U.S.DOE technical paper, chapter 4University of Chicago Energy Policy InstituteIllinois2011


L. BoldonSensitivity Study of the Factors Affecting First-of-a-Kind and Nth-of-a-Kind SMR Investment CostsProc. of ICAPP, NiceFrance2015


G. Haratyk C. Lecomte F. X BriffodFlexblue®: a subsea and transportable small modular power plantProc. of ICAPP, CharlotteUSA2014


J. J Ingremeau M. CordiezFlexblue® core design: Optimisation of Fuel Poisoning for a Soluble Boron Free Core with Full or Half Core RefuellingProc. of ICAPP, NiceFrance2015


IAEAPassive Safety Systems and Natural Circulation in Water Cooled Nuclear Power PlantsIAEA-TECDOC-1624, ViennaAustria2009


M. SantinelloCFD investigation of Flexblue® hullProc. of conference NUTHOS-10, OkinawaJapan2014


IRSN (French Institute for Radiological Protection and Nuclear Safety)Elements of reflection concerning corium retention in the reactor vesselOpinions and experts reportsFrance2014


G. Haratyk V. GourmelPreliminary Accident Analysis of Flexblue® Underwater ReactorProc. of ICAPP, NiceFrance2015


GRSATHLET 3.0 Cycle A - User’s ManualGRSP-1162012


GRSATHLET 3.0 Cycle A - Models and MethodsGRS-P-1332012


N. Todreas M. KazimiNuclear systems ICRC Press1990


AMERICAN NUCLEAR SOCIETYAmerican National StandardDecay heat power in light water reactors, ANSI/ANS-5.1-20052005


US NRCECCS Evaluation model10 CFR Appendix K to Part 50


IAEASafety related terms for advanced nuclear plantsIAEA-TECDOC-626, ViennaAustria1991



  • Downloads 40
  • Views 126


ISSN: 2413-5453