The Chinese Shidaowan nuclear power plant recently made the headlines in Germany: According to a paper published in the scientific journal Joule, tests are said to have proven that a core meltdown accident in the world's first commercially operated pebble bed reactor has been ruled out and that it is therefore ‘inherently safe’. This article describes how this type of reactor works, what follows from the experiment, and what safety challenges may nevertheless arise.

As the name suggests, high-temperature reactors (HTR) are characterised by their high operating temperatures that allow higher efficiency and the use of process heat. While the temperature of the coolant in conventional light-water reactors does not rise above 330 degrees Celsius, temperatures of up to 750 degrees Celsius are reached in HTRs. These high temperatures are made possible in particular by two properties that distinguish an HTR from typical light-water reactors: Helium is used as a coolant in the HTR and graphite is used as a moderator.

Fuel spheres instead of fuel rods

The world's only commercially operated plant is located on the Shidaowan NPP site in the Chinese province of Shandong, opposite the Korean peninsula. The HTR-PM is a so-called pebble bed reactor, a type of HTR that uses fuel spheres instead of fuel rods, which are piled up in large numbers in a reactor vessel. This allows the fuel to be exchanged during operation.

The first pebble bed reactors were built in Germany: after the AVR Jülich experimental nuclear power plant with a capacity of 13 MWe was operated from 1966 to 1988, the commercial THTR-300 in Hamm was to follow in the 1980s. However, this was shut down in September 1989 for technical, safety and economic reasons after only 423 days of full-load operation.

Core meltdown physically ruled out

However, the basis for the Chinese HTR-PM is the concept of the HTR modular reactor, which was developed in Germany but never realised. In both cases, a core meltdown should be physically impossible: even under accident conditions, the maximum achievable fuel temperature should never exceed the design values, even if no safety systems such as core cooling systems, shutdown systems etc. are used (more on this below in the section ‘Negative reactivity coefficient, low power density and heat-resistant fuel spheres’).

China is building more nuclear power plants than any other country - 45 reactor units have gone into commercial operation here since 2010, 27 more are currently under construction and Beijing approved a further eleven new build projects at the end of August. In addition, the NPP fleet in China is comparatively diverse: in addition to the high-temperature reactor and the pressurised-water reactors, which are by far the most frequently operated in the world, heavy-water-moderated CANDU reactors and a sodium-cooled fast reactor are also in operation here as demonstration plants. China is also systematically researching other Gen IV reactor concepts, such as lead-cooled fast reactors or molten-salt-cooled reactors.

HTR-PM in commercial operation since December 2023

The predecessor and test reactor of the HTR-PM was the HTR-10 with an output of 10 MWth. The HTR-PM went into commercial operation at the end of 2023 after around eleven years of construction; it has two reactor modules with a capacity of 250 MWth each.

The reactor and the steam generator are located in two separate and vertically offset pressure vessels. Both vessels are connected via a concentric connecting vessel, through which the heated primary coolant (750 °C) flows into the steam generator and then cools down (250 °C) and flows back into the reactor pressure vessel (RPV). The helium blower is mounted on the top of the steam generator.

In the interior of the RPV, the fuel element spheres are piled up. During operation, the fuel element spheres pass through the core several times from top to bottom, whereby fuel element spheres that have reached the maximum desired burn-up or are damaged are sorted out.

Loss of residual-heat removal initiated

In a study published in the scientific journal Joule in July, Chinese scientists described a test to check the inherent safety characteristics of the HTR-PM plant. In the two identical tests carried out, a loss of residual-heat removal was initiated in one of the two reactors at the Shidaowan NPP at an output of 200 MWth by completely switching off the power supply.

This meant that the helium blowers and feedwater pumps were not available. In addition, the steam generators were isolated during the tests so that secondary-side heat removal was not available. As a result, the reactor scram was triggered. Only the helium pressure was controlled in order to protect the equipment. The aim of the tests was to experimentally confirm the sufficient purely passive removal of decay heat.

Negative reactivity coefficient, low power density and heat-resistant fuel spheres

The temperature in the reactor core rises due to the failure of the helium blower and the isolation of the steam generators. Due to the insertion of the shutdown rods, but also due to the very negative reactivity coefficient in the HTR, the reactivity in the core and the heat production drop significantly. Furthermore, the power density of the HTR-PM, as with other HTR concepts, is significantly lower compared to typical pressurised-water reactors, which means that passive residual-heat removal is sufficient.

The spherical fuel elements have an outer diameter of 60 mm and consist of an inner fuel zone with a nominal diameter of 50 mm, which contains around 10,000 to 20,000 fuel particles (coated particles), and an outer, fuel-free shell with a thickness of 5 mm.

The TRISO fuel particles have an outer diameter of around 1 mm. They consist of a fuel core of uranium dioxide and several cladding layers surrounding the core: first, a buffer layer (buffer) of pyrolytic carbon with high porosity and low density surrounds the core. This is followed by an inner pyrolitic carbon layer (IPyC) with high density. This layer is followed by a silicon carbide (SiC) layer, and finally an outer layer of high-density pyrolitic carbon (OPyC) surrounds the entire particle. These fuel spheres are very heat-resistant, so that a core meltdown will not occur under the prevailing temperature boundary conditions.

First-ever proof of inherent safety characteristics of a nuclear reactor on a commercial scale

In their study, the Chinese experts came to the conclusion that the reactor cools itself down without active intervention if the residual-heat removal system fails. The results therefore demonstrated the inherent safety characteristics of a nuclear reactor on a commercial scale for the first time. Even in the event of a loss-of-coolant accident, simple calculations can show that purely passive heat removal is sufficient.

In line with the title of this article, it should be emphasised at this point that the HTR-PM is not an inherently safe reactor, but a reactor with inherently safe characteristics. In a document published in the early 1990s, the IAEA already advised against describing a nuclear power plant or its reactor as inherently safe: “[...] Therefore the unqualified use of “inherently safe” should be avoided for an entire nuclear power plant or its reactor.” If a reactor is designed in such a way that a certain accident scenario can be ruled out, the reactor has inherently safe characteristics in this respect.

Other scenarios conceivable

As with light-water reactors (LWRs), the three fundamental safety functions for an HTR are

1. reactivity control,
2. control of heat removal and
3. control of the confinement of radioactive materials

have to be ensured. The specific safety function ‘control of chemical processes’ (in this case fires and corrosion) derived from the fundamental safety functions is of particular importance for the HTR. Relevant here is the ingress of air and water into the core, which can lead to oxidation of the graphite surfaces.

Accidents with air ingress can lead to considerable damage in the core under certain circumstances, depending on the size and location of the leaks. However, it can be shown that significant premature air ingress only occurs in the event of two simultaneous leaks (stack effect), which is relatively unlikely (beyond-design-basis accident).

Water ingress into the reactor core has various effects:

1. reactivity rise,
2. oxidation of the graphite surfaces and
3. opening of the primary safety valves.

In concepts with steam generators (such as the HTR-PM), the pressure on the secondary side is higher than on the primary side, meaning that water or steam could penetrate into the reactor core. For this reason, precautions are taken (lower position and possible isolation of the steam generator, pressure relief on the secondary side) to minimise the effects of water ingress as far as possible.

In contrast to typical light-water reactor concepts, the HTR does not have a pressure-tight containment. The concept of a functional containment is used here. In the initial phase of an accident with a loss of coolant or the opening of the primary-side safety valves, the fission products are retained by the TRISO particles. This means that only small quantities of fission products will be released into the environment via filters. In a later phase of the accident, the pressure in the containment will be low, making it easy to filter the fission products.

Regulatory issues and dismantling

As part of the licensing of HTRs, there are various international activities, particularly in the USA, Japan and China, to develop safety guidelines for this type of reactor. In particular, the different implementation of the defence-in-depth concept for HTRs compared to conventional LWRs should be emphasised. One point is the use of a functional containment, so that a release of small quantities of fission products is possible in the event of an accident (Level of Defence 3) and therefore the containment does not represent a real barrier. Furthermore, requirements relating to core meltdown and the ultimate heat sink are not directly applicable to HTRs. To analyse the applicability of IAEA safety guidelines to innovative reactor concepts such as the HTR, activities are currently underway at the IAEA and as part of the EU’s HARMONISE project, in which GRS is also involved.

The dismantling of HTRs with graphite poses a number of challenges due to the specific properties of this material. These include, for example, the change in the lattice structure due to irradiation and the handling of activated graphite dust that can arise during dismantling. The challenges posed by the disposal of radioactive graphite waste are currently complex. There are currently no generally accepted decisions on treatment and conditioning methods, so the concept of safe enclosure has been chosen in the past for graphite-moderated reactors (not necessarily HTR). However, efforts are being made to dismantle graphite-moderated reactors in the coming years. From the perspective of current dismantling experience in Germany, direct dismantling would be favoured for German HTRs.