On the example of domestic fast reactors BN-350, BN-600, BN-800, the evolution of technical solutions for the automatic protection system of sodium-water steam generators (SG APS) is analyzed. The structural diagrams and main characteristics of the SG APS equipment of listed reactors are presented. The effectiveness of the SG APS in conditions of real leaks in steam generators of BN reactors is analyzed. The issues of development and creation of the SG APS of designed BN-1200 and INU MBIR are considered.

sodium coolant, sodium-water steam generator, steam generator protection system, water leaks into sodium, inter-circuit leakeness, control system for “small” leaks, “large” leak

The evolution of fast reactors worldwide encompasses a period of about 70 years. The most elaborate and consistent program for the fast reactor evolution was implemented in our country, with priority given from the very beginning to sodium cooled fast reactors (Poplavskii 2004).

The purpose of the steam generator emergency (automatic) protection system (SG APS) is to ensure safe operation of fast neutron (BN) reactor facilities in the event the integrity of the sodium-water steam generator heat-exchange surface is lost.

The key functions of the SG APS are to:

• detect and localize water leakage into sodium;
• deactivation of the damaged steam generator or steam generator section;
• protection of the steam generator or the secondary sodium circuit components or pipelines against overpressure.

The BN-350 includes SGs of two types with natural coolant circulation in the tertiary circuit (Antufyev et al. 1982; Bakluschin et al. 1982; Poplavskii and Kozlov 1990; Bakluschin 2012; Kuznetsov and Poplavskii 2012):

• SGs with Field heat-exchange tubes (FSG);
• Czech-made modular-type Nadezhnost SGs (NSG).

The FSG consists of two sections connected in parallel to the sodium and steam-water circuits, a separator tank and connecting pipelines (Fig. 1). Each section includes one superheater module and one evaporator module. The evaporator is designed as a vertical vessel with natural circulation of water inside the Field tubes.

Figure 1. 

Flow diagram of the Field-tube SG APS: 1 – evaporator; 2 –superheater; 3 – gas space; 4 – stage I separator; 5 – gas space rupture disk; 6 – stage II separator; 7 – fast-acting steam-water valves; 8 – emergen- cy water discharge line; 9 – expansion tank; 10 – hydrogen-in-gas detector; 11 – hydrogen-in-sodium detector; 12 – gas space pressure gage.

The NSG is a symmetrical modular steam generator consisting of two sections, each section including an evaporator module and a superheater module (Fig. 2). Each module comprises 16 micromodules. The NSG includes a buffer tank (BT).

Figure 2. 

Flow diagram of the Nadezhnost SG and arrangement of the water-into-sodium leakage detection system devices.

The BN-350 steam generators can be classified as integral-type steam generators since of all of the BN-350 each sodium lines and steam-water lines are integrated as a single volume with no dividing valves between them.

Cases of water leakage into sodium that took place in 1973–1975 in the BN-350 NPP steam generators have made it possible to obtain unique data on the behavior of all systems in emergencies, specifically, on the operation of the heat-exchange surface integrity monitoring and emergency protection systems (SG APS).

The most important result of the BN-350 steam generator operation is a conclusion that no operation is possible with a water leakage into sodium since a small leakage, which is detected only by monitoring systems, progresses fast enough (in several minutes or hours depending on the conditions) to a large leakage leading to a fast pressure and temperature growth in the secondary circuit and emergency disconnection of the steam generators. This result had severe effects since the BN-350 design, specifically the selection of the inertia and sensitivity of the systems for detection of hydrogen in sodium and gas and the throughput of the emergency discharge valves, was based on the equipment capability to operate for some time with a small water leakage into sodium.

The BN-350 steam generator protection system is designed based on the principle that the whole of the steam generator is disconnected and deactivated in the event of an emergency in any evaporator or superheater module. The protection system consists of three main subsystems:

• an emergency signal generation subsystem;
• a steam-water circuit protection subsystem;
• a sodium circuit protection subsystem.

The emergency signal is generated in the steam generator protection system depending on the leakage rate using one of the following methods:

1. in the event of a large leakage, when extensive hydrodynamic effects are observed in the sodium circuit, the emergency signal is generated in response to the pressure increase in the steam generator gas cavity; since the emergency processes are very rapid in the event of a large leakage, the cutoff and safety valves respond automatically.
2. in the event of a small water leakage into sodium, the emergency signal is generated in response to a change in the concentration of hydrogen in sodium or the secondary circuit gas cavities; in this case, the time point for the emergency protection system to respond is defined by operating personnel.

The purpose of the steam generator protection system as applied to the steam-water circuit is to drain the steam-water space as fast as possible in response to the emergency signal and prevent sodium from entering the steam-water circuit.

The function of the steam generator protection system as applied to the sodium circuit is to localize the accident and keep its parameters in the allowable limits and to provide for the discharge and separation of the reaction products to beyond the steam generator.

The emergency protection system for the two steam generator types is practically identical.

The following devices are used for the small leakage detection in the steam generators:

• IVA-1 – measurement of the hydrogen concentration in sodium (FSG and NSG) in the limits of 0.05 to 1.0 ppm;
• KAV-7 – measurement of the hydrogen concentration in the evaporator (FSG) and buffer tank (NSG) gas cavity in the limits of 0.001 to 50 vol. %;
• ZEUS-75 – monitoring of the relative change in the sodium flow rate through the section (only for NSGs), and of the sensitivity to the water leakage into sodium of 0.1 g/s.

In the event of a small leakage, when the content of hydrogen in sodium or in the gas space reaches a particular value:

• pressing the ‘steam generator drainage’ button opens the fast-acting valve on the steam-water space emergency drainage line;
• cutoff valves close on the feedwater, superheated steam and continuous blowdown lines;
• the secondary pump disconnection time is selected from the condition of the fastest possible water evaporation from the steam generator.

Pressure sensors are used for the large leakage detection which are installed in the gas cavities in:

• stage I separator (FSG);
• the buffer tank (NSG).

In the event of a large leakage, when the pressure in the steam generator gas space increases to a particular value (emergency setpoint), an emergency signal is generated in response to which:

• the rupture disks for the secondary circuit fail forcibly (downstream of the gas cavity);
• the fast-acting valve opens on the steam-water space emergency drainage line;
• the fast-acting valve closes on the feedwater supply line;
• the secondary pump is disconnected.

The above devices are connected to the FSG and the NSG as shown in Figs 1, 2 respectively.

Rupture disks with a forced-burst diaphragm (Fig. 3) were used in the FSG (for stage I separator) and in the NSG (for the buffer tank) for overpressure protection in the secondary sodium circuit.

Figure 3. 

Rupture disk (RD): 1 – diaphragm; 2 – body; 3 – knife; 4 – spring; 5 – rod; 6 – bellows; 7 – piston.

As the result of the commissioning activities, the rupture disks was redesigned substantially (the diaphragm attachment assembly was altered). The four-way distributor that feeds nitrogen to the rupture disk air-operated drive was replaced for a more reliable explosive valve.

To discharge and separate the sodium-water reaction products, a two-stage system was used for the two SG types including two tanks, the products in which are separated based on the change in the flow direction and velocity.

A hydraulic gate valve, jointly with a back action valve, is used to discharge gaseous reaction products into the atmosphere.

Emergency drain into a single shared expansion tank is used in the steam-water circuit protection subsystem. Electrically operated fast-acting valves are used for emergency drain. The valves are manually controlled by personnel.

Altogether, there have been 12 water-into-sodium leakage incidents recorded in the operating period of the BN-350 FSG steam generators (Tashlykov and Beltyukov 2019). The emergency protection system processed the ‘large leakage’ signal automatically as the pressure value, equal to the emergency setpoint, was reached (Artemikhin 1979). The post-accident examinations showed that the emergency process was localized within the reaction flare action area of the first defective tube. The exclusion was one incident (SG-5, 16.02.1975) when the defective evaporator’s tube bundle was damaged severely due to the long-term water entry into the secondary circuit through the water drains after the SG APS actuation.

Small leaks occurred in the FSG evaporators in conditions of rather low sodium temperatures when the leakage was observed for several hours with the hydrogen concentration growing slowly in the evaporator gas cavities. An analysis of such modes showed that the system for the hydrogen detection in gas with a KAV-7 detector coped satisfactorily with the leakage detection.

Two cases of the small leakage occurrence in NSG-1 and NSG-2 in January 1989 are known (Trojanov and Rinejsky 1992) which were caused by deviations in the feedwater preparation. In one case, there was a sustainable growth observed for 30 to 35 minutes in the IVA-1 detector readings, after which a decision was made to disconnect the steam generator (Conceptual designs of advanced fast reactors 1996). In the other case, the evaporator shell’s external wall was damaged with up to 1000 kg of sodium having poured into the SG duct (Tashlykov and Beltyukov 2019).

In both cases, there were no small leaks detected in the event of through-the-thickness failures of adjoining tubes.

The experience of operating the BN-350 emergency protection system shows that the existing system is enough to protect reliably the steam generator shells and the whole of the secondary circuit against overpressure. In all cases, even if the diaphragm forced action devices fail and the diaphragms burst spontaneously, the pressure in the secondary circuit cavity was not outside the permissible limits. The secondary circuit pressure is thus below the calculated value (0.8 MPa) and does not exceed 0.3 MPa during normal operation of RDs.

One of the key requirements to the SG APS is reliability and safety of its operation. In 1973–1975, there were 3 cases of the BN-350 SG APS component failures in emergencies. The causes for such number of failures were design and circuitry drawbacks, as well as insufficiently regular inspections of emergency devices. The measures taken, in particular, the development of the RD powder charge chain testing setup, and the arrangement of the sequences and frequencies for testing the SG APS circuitry and devices, made it possible to exclude the recurrence of failures.

A drawback of the BN-350 SG APS layout is that it does not include fully backed up emergency protection systems and devices, and the backup devices, if any, have much longer times of response than the main devices (Bakluschin et al. 1982).

A key function of the BOR-60 reactor facility is to test large-scale (30MW+) SG modules of different designs in actual conditions of the NPP operation. The following was tested during the operation period: a shell-type coiled steam generator, a micromodular steam generator (the Czech Republic), a steam generator model (for the BN-600 reactor) (Tsikanov et al. 1982; Fast reactor database 1996).

Fig. 4 presents the BOR-60 thermal circuit with a coiled SG and a micromodular SG which shows the SG APS key components.

Figure 4. 

BOR-60 thermal circuit: 1 – reactor; 2 – sodium-sodium heat exchanger; 3 – pump; 4 – sodium- air heat exchanger (AHX); 5 – AHX fans; 6 – AHX buffer tank; 7 – steam generator (SG); 8 – SG buffer tank; 9 – separator; 10 – turbine generator; 11 – turbine condenser; 12 – ejector; 13 – low-pressure preheater; 14 – feedwater pump; 15 – high-pressure preheater; 16 – process condenser; 17 – deaerator.

Currently, Czech-made reverse steam generators (RSG) of two types are used in the BOR-60 reactor facility (Tsikanov et al. 1982):

• sectional modular RSG-1 installed in loop 1;
• modular RSG-2 installed in loop 2.

Inter-circuit breaks are monitored for in RSG-1 using such instruments as SOVA-3 (the system for detection of hydrogen in the buffer tank argon) и ZEUS (the signal from the flow meters installed at the sodium inlet of each of the eight sections and at their respective outlets, the flow meters being connected differentially). Annunciators of the tube welded joint integrity loss in double tube plates on the sodium and water sides are used additionally (there is a pressure gage that triggers an alarm in the event of a water or steam leakage, and a plug-type sensor triggers the sodium leakage alarm).

Inter-circuit breaks are monitored for in RSG-2 using SOVA-3 instruments installed on the buffer tank, an IVA-IV hydrogen-in-sodium detector and a DN200 flow meter installed at the module’s sodium outlet.

The argon pressure is monitored on the buffer tank in each loop, and RDs are installed for the secondary circuit protection against overpressure.

The sodium-water reaction products are discharged into the separator tank and the receivers installed downstream of it.

No loss of the heat-exchange surface integrity has occurred in RSG-1 and RSG-2 since the start of the operation.

The experience in building and operating the BN-350 SG APS was used to develop the SG APS for the BN-600 and BN-800 reactor facilities. The fundamental changes in the SG APS layouts for these facilities consist primarily in the sectional design of the N-200M and N-272 steam generators (Bakluschin 2012; Kuznetsov and Poplavskii 2012).

The BN-600 and BN-800 facilities use sectional-type once-through steam generators: there are eight sections in the BN-600 and 10 sections in the BN-800. Each section comprises three (BN-600) or two (BN-800) heat-exchange modules. Any section can be isolated independently both on the sodium side and the water (steam) side. Accordingly, there are much more water/steam cutoff valves as compared with the BN-350 steam generators, and sectional fastacting sodium valves have been added.

The BN-600 SG APS water-into-sodium leakage monitoring subsystem includes hydrogen-in-sodium detectors (IVA-1) and hydrogen-in-cover-gas detectors (KAV-7). Inductive leak detectors (ITI) and pilot-type noise leak detectors (IShIT) have also been added, which record gas inclusions in the sodium flow. Each steam generator section is fitted with IVA-1, ITI and IShIT detectors. Cover gas pressure sensors and, additionally, sectional flow meters are used for the large leakage detection. The damaged loop is disconnected automatically as the Large Leakage signal is generated. The decision to disconnect the section or the loop in the event of a large leakage is made by operating personnel.

The BN-600 SG APS layout is presented in Fig. 5.

Figure 5. 

Flow diagram of the BN-600 N-200M SG APS: 1 – evaporator; 2 –superheater; 3 – intermedi- ate superheater; 4 – buffer tank; 5 – safety diaphragm; 6 – reaction product discharge line; 7 – stage I and II separa- tors; 8 – safety valve; 9 – fast-acting valves; 10 – emergency water discharge line; 11 – expansion tank; 12 – sodium valves; 13 – hydrogen-in-sodium detector; 14 – hydrogen-in-gas detector; 15 – gas pressure sensor; 16 – detector of hydrogen bubbles in sodium; 17 – small sodium leakage line; 18 – sodium flow meter; 19 – emergency water (steam) discharge safety valve.

The IVA-1 and KAV-7 detectors in the BN-800 SG APS have been replaced for ECHS-S and ECHS-G (electrochemical hydrogen sensors in sodium and in gas respectively). IRIS/TARAN instruments (installed in place of the ITIs and the IShITs) are used to detect gas inclusions in the sodium flow. Cover gas pressure sensors and sectional flow meters are used for the large leakage monitoring as well as in the BN-600. The damaged section is disconnected as the Small Leakage signal is generated, and the loop is disconnected as the Large Leakage signal is generated.

The BN-800 SG APS layout is presented in Fig. 6.

Figure 6. 

Flow diagram of the BN-800 SG APS: 1 – evaporator; 2 – superheater; 3 – fast-acting sodium valves; 4 – reaction product discharge line; 5 – discharge header; 6 – stage I and II separators; 7 – sodium diaphragm; 8 – gas diaphragm; 9 – backup discharge line; 10 – fast-acting water (steam) valves; 11 – sectional gas cavity; 12 – pilot water (steam) safety valve; 13 – buffer tank; 14 – monitoring of hydrogen in gas; 15 – monitoring of hydrogen in sodium; 16 – sodium flow meters; 17 – detectors of gas bubbles in sodium.

Forced-burst rupture disks, similar to the BN-350 rupture disks, were installed on the SBT (sodium buffer tank) for the overpressure protection in the secondary sodium circuit in the initial period of the BN-600 operation. These devices were later replaced for devices with fully passive buckling membranes (UPM) that have been found to perform well.

Each of the BN-800 SBT safety devices comprise two serially installed buckling membranes used to eliminate the backpressure effects from the emergency discharge tank of stage I on the actuation pressure value of these devices. Besides, sodium UPMs have been installed in the evaporator modules of each section on the N-272 SGs.

The sodium-water reaction products are discharged and separated in the BN-600 and BN-800 reactor facilities using a two-stage separation system with two tanks, similarly to the BN-350 discharge and separation system, but with modified characteristics:

• for the BN-600, the volumes of stage I and II emergency discharge tanks have been increased substantially (to 50 m ³);
• for the BN-800, stage I emergency discharge tank is used additionally as the sodi- um receiver, and the volume of stage II emergency discharge tank has been reduced to 10 m ³.

A rupture disk is installed downstream of stage II tank.

Apart from sectional cutoff valves, pilot-operated safety valves (IPU), installed in series for low-superheated steam in each section, are used in the BN-800 tertiary circuit for the rapid pressure relief in the isolated section.

There were 12 cases of water leakage into sodium recorded in the BN-600 steam generators in the initial period of operation (Tashlykov and Beltyukov 2019). In all cases, the steam generators were successfully decommissioned. However, there were two cases with the initial leakage having enough time for developing into a large leakage leading to the SBT rupture disk response.

No incidents involving water leakage into sodium have occurred in the BN-800 since the start of the operation.

The BN-1200M steam generators, consisting of two modules connected in parallel, can be classified as integral-type steam generators since all of their sodium lines are integrated to form a single volume with no dividing valves between them.

Instrument packages based on solid electrolyte electrochemical detectors of oxygen (IKN) and hydrogen (IVN) in sodium and IRIS/Taran-Tm instruments, which detect gas inclusions in the sodium flow, are expected to be used in the BN-1200M SG APS small leakage monitoring subsystem. One of the options under consideration is to use a differential circuit for the “Steam Generator Inter-circuit Leakage” signal generation that increases the subsystem sensitivity to the leakage rate. However, the use of the N-532 steam generator with a relatively low sodium velocity in the tube space, as compared with the N-485M design, reduces the small leakage monitoring efficiency.

DN40 flow meters installed in dedicated sodium vent and bleed line, and/or the IRIS/Taran-Tm instrument flow metering line are expected to be used for the large leakage monitoring. It is possible to use pressure sensors in the gas pressurizers. The sensitivity of these monitoring methods to the leakage rate has yet to be explored.

Hydraulically, the BN-1200M secondary sodium circuit differs greatly from the BN-600 and BN-800 circuits: the circulation circuit does not include a serially connected gas pressurizer volume (Ershov and Shepelev 2018; Vasyaev et al. 2022). To protect the secondary circuit components and pipelines against overpressure and make up for the coolant temperature expansion, a relatively small tank with a sodium level and a gas cavity is connected as a bypass for the primary circuit via dedicated pipelines. In terms of gas, the tank is connected to the gas cavity of stage I emergency discharge tank (SAS-1). Besides, gas pressurizers are installed at the SG module inlets and outlets, and sodium rupture disks (UPM) are installed on the SG modules. Such solution, though providing for overpressure protection, complicates both the SG APS layout and operation.

There are drawbacks to be noted in the layout solutions for the secondary sodium circuit: the pressure at the IHX lower point during rated power operation is close to the maximum permissible pressure value.

The influence of the technology used to seal off tubes in the tube plate on the SG reliability has yet to be assessed. Still, reducing the barriers at the tube and tube plate contact points between sodium and water does not lead to improved reliability. It should be noted that the overwhelming majority of water leaks into sodium in the steam generators in Russian-designed BN reactors took place at the points where tubes are sealed off in the tube plates. It will not be possible to refer to the fail-safe operation of the BN-600 SG since the material and the fabrication technologies differ greatly.

The number of the steam-water cutoff valves has been reduced (as compared with sectional SGs) since the whole of the damaged loop needs to be disconnected as an inter-circuit break occurs and is detected in one of the SG modules.

There is a two-stage circuit with SAS-1 and SAS-2 used to discharge and separate the sodium-water reaction products. In accordance with regulatory requirements, rupture disks (UPM) are installed on the pipeline between these two tanks.

The MBIR research reactor facility is expected to use integral-type reverse steam generators (RSG), each of which comprises three modules similar to the BOR-60 RSG-2 modules.

It is planned that the following will be used for one loop in the RSG inter-circuit break monitoring system (IBMS):

• 1 sensor for monitoring hydrogen dissolved in sodium (ECHS-S);
• IRIS/Taran-Tm sensors for monitoring gaseous hydrogen in the sodium flow (1 for each module);
• 1 sensor for monitoring gaseous hydrogen in the SBT cover gas (ECHS-G) with a convective loop;
• 3 sensors for monitoring pressure in the SBT cover gas;
• 3 devices for monitoring the sodium flow rate at the RSG module outlets (DN300).

To protect the secondary circuit and the RSGs against overpressure, gas rupture disks (UPM) are installed on the SBT and SAS-1, and sodium UPMs are installed at the sodium inlet of each RSG module.

To discharge and separate sodium-water reaction products, a two-stage system is used as part of SAS-1 and SAS-2 with UPMs on the pipeline between them.

Steam-water valves are used to cut off each RSG from the tertiary circuit.

The MBIR RSG automatic protection system is expected to be fully automatic.

Table 1 presents generalized data on the engineering solutions for the SG APS of the Russian-designed fast reactors described above.

The report describes the concept of building the BN-type reactor SG automatic protection systems (SG APS), the key aspects of which were tested in the course of the BN-350 reactor design and operation. A large-scale description of the SG APS evolution trends is provided based on the example of Russian-designed BN-350, BN-600, BN-800, BOR-60, MBIR and BN-1200M reactors.