Natural Circulation Stability in Passive Decay Heat Removal Loops of Small Modular Reactors: A Review of the Literature

1. Introduction

A reactor continues to produce heat after the chain reaction has stopped, and the removal of that decay heat is one of the fundamental safety functions of any nuclear plant. Large light water reactors of earlier generations rely mainly on pumped systems backed by diesel generators. Small modular reactors take a different route. Their low power, large surface-to-volume ratio and, in many designs, integral primary circuit make it practical to reject decay heat through closed loops in which the fluid is moved only by the density difference between a heated leg and a cooled leg (Ingersoll, 2009; IAEA, 2020).

The attraction of such loops is that they need no power supply and have few active components. Their weakness follows from the same physics. Buoyancy heads are small compared with pump heads, so the balance between driving force and friction is delicate, and the flow rate is a result of the thermal state of the loop instead of an imposed quantity. Feedback between flow, temperature and void can produce oscillations or abrupt changes of regime that a pumped system would suppress. An oscillating loop may still remove heat, but it can also degrade heat transfer, load structures cyclically and make the outcome of a transient harder to predict (IAEA, 2005).

This article reviews what the published literature says about the stability of natural circulation as it applies to passive decay heat removal loops in small modular reactors. It is written for readers who need an organised account of the mechanisms and of the state of the supporting evidence, and it reports no new experiments or calculations.

2. Scope and Approach

The review is a narrative one. It draws on the classical papers on loop stability, on the review articles that have organised the field at intervals since the 1970s, on technical documents issued by the International Atomic Energy Agency, and on experimental and analytical studies that are widely cited in connection with water-cooled designs. No formal search protocol was applied and no claim of completeness is made. Liquid-metal and gas-cooled loops are left aside, as are containment cooling systems, so that the discussion can stay with the water and steam loops attached to the primary or secondary side of integral pressurized designs. The instability types discussed are arranged in Figure 1 and their mechanisms are summarised in Table 1.

3. Single-Phase Loops

The simplest natural circulation system is a closed loop of liquid heated low down and cooled higher up. Welander (1967) analysed a one-dimensional model of such a loop, showed that its steady flow can be unstable, and gave the physical explanation that still carries his name. In a loop with a concentrated heat source at the bottom and a sink at the top, a pocket of fluid that is slightly warmer than its surroundings accelerates the flow while it rises in the hot leg. It therefore spends less time in the sink, emerges warmer than before, and returns to the source with its anomaly amplified. Because buoyancy and friction respond with different delays, the disturbance grows from one circuit to the next until the flow reverses.

Experiments confirmed the prediction. Creveling et al. (1975) observed growing oscillations and repeated flow reversals in a toroidal water loop, and found a stable region at low power, an unstable band at intermediate power and a return to steady flow in the turbulent regime. Reviews by Zvirin (1982) and Greif (1988) gathered the theory and the data that followed, and both noted that one-dimensional models reproduce the steady flow rate well while being less reliable about the stability threshold, which is sensitive to the friction law, to heat losses and to conduction in the pipe wall.

Work in rectangular loops has since shown how strongly geometry matters. Vijayan and co-workers correlated steady flow in terms of a modified Grashof number and a geometric parameter, and mapped the stability boundary in the plane of the modified Grashof and Stanton numbers (Vijayan, 2002). With a horizontal heater and a horizontal cooler the loop was unstable over a wide range of power; with both components vertical it remained steady over the whole range tested (Vijayan et al., 2007). The lesson for designers is direct. Distributed heating and cooling over vertical lengths, larger friction and thermal inertia in the walls all damp the Welander mechanism, and most reactor decay heat loops have these features. Single-phase instability is thus a limited concern for the primary circuit of an integral reactor at power, but it cannot be dismissed for small auxiliary loops with nearly point-like exchangers.

4. Two-Phase Instabilities

Boiling makes the density of the fluid depend steeply on enthalpy, and that strengthens every feedback in the loop. The classification proposed by Bouré et al. (1973) remains the common language. It separates static instabilities, in which a small disturbance moves the system to a different steady state, from dynamic instabilities, in which inertia and transport delays sustain an oscillation. Later reviews have kept the distinction while adding data and analysis (Ruspini et al., 2014), and Nayak and Vijayan (2008) applied it specifically to boiling natural circulation systems.

4.1. Static excursion

The flow excursion described by Ledinegg (1938) arises when the pressure drop across a boiling channel decreases with increasing flow over part of its range. If the characteristic of the rest of the loop is flatter than that of the channel in this region, the operating point is unstable and the flow jumps to a higher or lower value. In a natural circulation loop the supply characteristic is set by the buoyancy head, which itself depends on the void in the riser, so more than one steady state can exist for the same power. The remedy is the familiar one of adding resistance at the channel inlet, at some cost in flow rate.

4.2. Density wave oscillations

Density wave oscillations are the most studied dynamic instability. A change in inlet flow produces an enthalpy disturbance that travels through the heated section, becomes a void disturbance, and alters the pressure drop downstream after a delay comparable with the transit time. When the delayed pressure drop is out of phase with the inlet flow, the oscillation sustains itself. Ishii and Zuber (1970) expressed the stability boundary in terms of a phase change number and a subcooling number, and Saha et al. (1976) tested that plane against experiment and refined it to account for subcooled boiling.

Fukuda and Kobori (1979) distinguished two forms. In Type I the delayed quantity is the gravitational head of an unheated riser, and the oscillation appears at low power and low exit quality, where a small change in quality causes a large change in void. In Type II the delayed quantity is two-phase friction, and the oscillation appears at high power. The stable region lies between them. Forced circulation systems meet mainly Type II. Natural circulation loops with tall chimneys are exposed to Type I as well, and it is the Type I boundary that a decay heat removal loop crosses as power declines and pressure falls.

4.3. Low-pressure and start-up behaviour

At low pressure the ratio of liquid to vapour density is large, so a small mass of steam displaces much liquid and the hydrostatic pressure variation along a riser is a significant fraction of the system pressure. Studies made in support of natural circulation boiling water reactors identified several related phenomena. Aritomi et al. (1993) described geysering in parallel channels, in which vapour formed in a heated channel expands rapidly, is condensed by subcooled liquid above, and is followed by refilling. Work by the same group described a second oscillation driven by fluctuation of the hydrostatic head in the riser. Furuya et al. (2005) and Manera and van der Hagen (2003) showed that flashing in an adiabatic riser can by itself produce density wave oscillations, and mapped the conditions under which it does.

These results were obtained for start-up, but the conditions are those a passive loop meets late in a cooldown: low pressure, low power, and liquid close to saturation rising through a long unheated section. The start-up literature is therefore more relevant to decay heat removal than its original purpose suggests.

5. Passive Decay Heat Removal Loops in Small Modular Reactors

Integral pressurized water designs place the core, riser, steam generators and pressurizer inside one vessel. Several circulate the primary coolant naturally at full power, and nearly all provide a passive loop for decay heat. A common arrangement connects the secondary side of the steam generator to a condenser immersed in a large pool: steam generated in the tubes rises to the condenser, and the condensate returns by gravity. Others connect a condenser directly to the primary system, or rely on depressurisation and recirculation between the vessel and the containment (IAEA, 2020). The loop is two-phase by design, its heat sink warms and eventually boils, and the power it must remove falls by an order of magnitude over the first hours.

Three features of these loops recur in the literature. The first is the helical-coil steam generator, favoured for its compactness. Boiling inside parallel helical tubes is subject to density wave oscillations, and because curvature, tube length and inclination change both the frictional and the gravitational pressure drop, thresholds established for straight vertical tubes cannot be assumed to carry over. The second is the coupling of loops: the primary natural circulation, the secondary condensing loop and the pool are in series, so an oscillation in one changes the boundary conditions of the others. The third is the dependence of the primary flow regime on coolant inventory. D'Auria and Frogheri (2002) showed with a natural circulation flow map how a pressurized system passes from single-phase to two-phase circulation and then to reflux condensation as inventory is lost, and the stability of the decay heat loop has to be judged in each regime.

Integral test facilities provide the most direct evidence. Reyes et al. (2007) described tests of the passive safety systems of the Multi-Application Small Light Water Reactor in a scaled facility with a natural circulation primary circuit and helical-coil steam generator, and comparable facilities have been built for other integral designs. Published accounts of such tests tend to concentrate on whether the heat is removed and the core stays covered. Oscillations are usually reported descriptively, and systematic stability maps of the kind available for simple loops are rare for integral configurations.

6. Analysis Tools, Scaling and Reliability

Stability analysis proceeds along two lines. Linear analysis in the frequency domain perturbs the conservation equations about a steady state and yields the stability boundary economically, which makes it suitable for maps and parametric studies. Time-domain analysis with thermal hydraulic system codes follows the nonlinear development of an oscillation, including its limit-cycle amplitude, and can represent the whole plant. The two-fluid formulation and its closure laws are set out in standard texts (Todreas and Kazimi, 2012). The known difficulty with the codes is numerical: first-order upwind schemes and coarse nodalisation add diffusion that damps density waves, so a calculation can appear stable for reasons unrelated to the physics. IAEA assessments of natural circulation modelling list low-pressure, low-flow conditions among the areas where code predictions are least dependable (IAEA, 2012).

Scaling is the second concern. Test facilities are smaller than the reactor, usually reduced in height or pressure or both, and stability depends on precisely the quantities that such reductions distort: transit times, the ratio of gravity to friction, and wall heat capacity. Ishii and Kataoka (1984) derived scaling laws for single-phase and two-phase natural circulation that preserve the phase change and subcooling numbers, and these remain the usual starting point. Full preservation of the dynamics is seldom possible in a reduced-height model, and the transfer of a stability boundary from facility to plant then rests on a code that has been assessed against the facility.

The third line is reliability assessment. A passive loop has no pump to fail, but it can fail to deliver its function because the driving forces turn out weaker, or the resistances larger, than assumed. Burgazzi (2004) examined the uncertainties that govern passive system performance, and methodologies developed in European and IAEA projects treat such functional failure probabilistically and feed it into the plant probabilistic safety assessment (IAEA, 2005). Flow instability enters these methods as one of the phenomena that can push a loop outside its success criteria, and its contribution is only as well quantified as the stability prediction behind it.

7. Gaps and Future Work

Set against the needs of small modular reactor licensing, the literature has identifiable gaps. Most stability maps were obtained at fixed boundary conditions, whereas a decay heat loop is never steady: power, pressure and sink temperature drift for hours or days, and the loop may pass slowly through an unstable band. Whether such a passage produces oscillations of consequence depends on growth rates as well as thresholds, and published data on growth rates under drifting conditions are sparse. Coupled-loop behaviour is a second gap, since separate-effect tests by construction hold the neighbouring loops fixed.

Further gaps concern the condenser and the pool. Non-condensable gas, thermal stratification of the pool and the transition to pool boiling all alter the sink-side boundary condition, and their interaction with loop stability is treated in few open publications. On the analysis side, the practice of demonstrating that a code reproduces a measured stability boundary before it is used for plant analysis, with nodalisation and numerical options carried over unchanged, deserves to become routine. Open benchmark exercises on integral facility data, of the kind the IAEA coordinated research projects on natural circulation have organised, would allow that demonstration to be made in public.

8. Conclusion

The mechanisms that destabilise natural circulation have been known for decades and are well characterised in simple loops. Single-phase oscillation of the Welander kind is largely designed out by distributed, vertical heat exchange. Boiling loops remain exposed to Ledinegg excursions, to density waves of both types, and at low pressure to geysering and flashing. Passive decay heat removal loops in small modular reactors combine the conditions under which the low-pressure mechanisms are strongest with coupled geometries that the classical experiments did not cover. The evidence supports confidence in the physical understanding and caution about quantitative prediction, which still depends on integral testing, careful scaling and codes assessed specifically for stability.

Conflict of interest

To be declared by the author(s) before publication.

Funding

To be declared by the author(s) before publication.