Start-up, operation and thermal-hydraulic analysis of a self-propelling supercritical CO 2 heat removal system coupled to a pressurized water reactor

. The supercritical carbon dioxide (sCO 21 ) heat removal system, which is based on a closed Brayton cycle with sCO 2 as a working ﬂuid, is an innovative, self-propelling and modular heat removal system for existing and future nuclear power plants. By changing the number of CO 2 cycles, the heat removal capacity can be adapted. In this paper, up to four sCO 2 cycles are analyzed in interaction with a pressurized water reactor, using the thermal-hydraulic system code ATHLET and considering a long-term station blackout and loss of ultimate heat sink scenario with conservatively high and low decay heat curves. The presented start-up procedure for the heat removal system might require further optimization due to the non-linear thermal gradients. Independent from the start-up, a heat removal system with three or four CO 2 cycles keeps the primary loop temperatures suﬃciently low. However, with only three cycles, the core is almost uncovered, and the danger of recriticality may occur due to cold leg deboration. Controlling the turbine inlet temperature via the turbomachinery speed and subsequent shutdown of single cycles successfully adapts the operation of the heat removal system to the declining decay heat. This enables reliable decay heat removal for more than 72 h.


Introduction
In case of a station blackout and loss of ultimate heat sink accident in a nuclear power plant, the plant accident management strongly depends on the recovery of electricity. If not available, core integrity will be violated, like in the Fukushima Daiichi accident. Such scenarios inspire the development of advanced decay heat removal systems. Since space is a limitation in existing power plants, the supercritical carbon dioxide (sCO 2 ) heat removal system "sCO 2 -HeRo" was proposed because of its compactness and self-propelling features [1,2]. Such a system could be incorporated in newly-built nuclear power plants as well as retrofitted to existing nuclear power plants due to its compactness. The system is not only self-propelling but, its excess electricity can even be used to support other accident measures, e.g. recharging batteries. Moreover, no cooling water is required because the decay heat is transferred to the ambient air. To assess the benefits for nuclear * e-mail: hofer@ike.uni-stuttgart.de 1 sCO2 is defined as carbon dioxide at supercritical conditions with p > 73.8 bar and T > 31 • C safety, the sCO 2 -HeRo system needs to be analyzed in interaction with different nuclear power plants. Figure 1 shows the scheme of the sCO 2 -HeRo system attached to the steam generator (SG) of a pressurized water reactor (PWR). For better visualization, only one primary loop, which is connected to the pressurizer (PRZ), the corresponding steam generator (SG), and one attached CO 2 cycle of the sCO 2 -HeRo system are displayed. In the case of a station blackout and loss of ultimate heat sink accident, the main coolant pumps stop, and the containment is isolated. In the following, natural circulation develops on the primary side via the hot (HL) and cold legs (CL), and the heat is transferred to the steam generators (SG) on the secondary side. Natural circulation also builds up on the secondary side via the compact heat exchangers (CHX) of the sCO 2 -HeRo system. After the start of the accident, all CO 2 cycles are ramped up to their design heat removal capacity simultaneously. Later, when the decay power is lower than the total heat removal capacity, the operation of the cycles is adapted to the declining decay heat by control and successive shutdown of single cycles, as shown later in Figure 8. In the CHX, the steam condenses and heats the sCO 2 . The pressurized and heated sCO 2 is expanded in the turbine, which drives the compressor and generates power for the fans of the gas cooler (UHS). The compressor and the turbine are mounted on a common shaft together with the alternator and are referred to as turbo-alternatorcompressor (TAC) or turbomachinery. After the turbine, the remaining heat of the CO 2 is removed from the gas cooler to the ambient air, which serves as the diverse ultimate heat sink. For simplicity, the heat exchanger to the diverse ultimate heat sink will be called "UHS" in the following. Finally, the sCO 2 is compressed and flows to the CHX. Similarly, the sCO 2 -HeRo system can be directly attached to the reactor pressure vessel (RPV) of a boiling water reactor [1].
A comprehensive review of all kinds of sCO 2 power generation applications as well as cycle, component, and control aspects was given by White et al. [3]. Wu et al. [4] provided an extensive review of the sCO 2 Brayton cycle for nuclear applications, considering experimental and numerical work, the application as a power conversion system as well as a heat removal system. Among other things, they highlight the need for further safety analysis and dynamic simulations. The safety and thermalhydraulics of water-cooled nuclear power plants are discussed in detail by D'Auria et al. [5]. For the simulation of the thermo-hydraulic behavior, different system codes are used, e.g. CATHARE, RELAP, TRACE, ATHLET, SCTRAN, and SAS4A/SASSYS-1 [5][6][7][8]. Because sCO 2 is considered a working fluid for 4th generation reactor concepts as well as for the proposed heat removal system, work is in progress to extend or couple these system codes for the simulation of sCO 2 power cycles [1,[7][8][9][10][11][12][13][14].
The thermal-hydraulic system code ATHLET [6,15,16], which is used for this study, is applied to analyze the whole spectrum of leaks and transients in nuclear power plants of Generation II-IV as well as Small Modular Reactors. The highly modular code structure of ATHLET includes advanced thermal-hydraulics as well as physical and numerical models. The main modules are thermo-fluid dynamics, heat transfer and heat conduction, neutron kinetics, control, and balance-of-plant, and the numerical time integration method. For a detailed study of the code features, the ATHLET "Models and Methods" manual [15] can be used. Bestion [6] compares different thermal-hydraulic system codes regarding their models, capabilities, and limitations. A short introduction to ATHLET is provided in [1,17].
Venker [1] investigated the feasibility of the sCO 2 -HeRo approach for a boiling water reactor in detail by implementing the first extensions to simulate the heat removal system in ATHLET. The successive shutdown of single cycles enabled the decay heat removal for more than 72 h. However, the component models, design, and control of this system should be improved, and different ambient temperatures and decay heat curves need to be considered in the future. Within the project sCO 2 -HeRo, Hajek et al. [18] and Vojacek et al. [19] described the basic principles for integrating the sCO 2 -HeRo system into the European PWR fleet including safety, reliability, and thermodynamic design considerations and first simulations with Modelica. As part of the project sCO 2 -4-NPP, the validation status for modeling sCO 2 cycles was provided for the codes CATHARE, Modelica, and ATHLET, including a blind benchmark [13]. Successful simulations were performed, but it was also found that component models need further improvement and some numerical issues need to be solved in the future. Hofer et al. [12] presented improved models for ATHLET, including heat exchanger and turbomachinery models. The turbomachinery models are performance map based and use a real gas similarity approach [20] to account for changes in the inlet conditions. They also provided a design approach for the sCO 2 -HeRo system and analyzed the sCO 2 cycle with varying decay heat [21] and at different ambient temperatures [17,22]. The cycle was successfully operated in part-load by adapting the rotational speed of the turbomachinery, keeping the compressor inlet temperature constant and without the need for inventory control. In [17,22], the modeling and design were improved, including new sCO 2 turbomachinery performance maps with a higher surge margin, and the start-up from an operational readiness state (ORS) was considered. Using Modelica coupled with ATHLET, Frýbort et al. [23] presented a first analysis of the challenging push-start from shutdown conditions and an alternative control strategy for low ambient temperatures, a combination of inventory control and UHS bypassing. Future analysis is required to analyze the feasibility of the push start, e.g. start at low ambient temperatures or determination of an appropriate heating procedure. The sCO 2 -HeRo system was integrated and simulated coupled to an EPR, VVER 1000, and Konvoi PWR with CATHARE, ATHLET/Modelica, and ATHLET, respectively [17,24]. In all power plants, the same modular sCO 2 -HeRo system with a heat removal capacity of 10 MW per sCO 2 cycle was installed, and successfully coupled simulations with a different number of systems were performed.
In the field of sCO 2 cycles for power generation, various dynamic analyses were conducted. Despite the focus on power generation, many findings are also relevant for the considered heat removal system. Hexemer et al. [11,25] presented a detailed TRACE model of a recuperated sCO 2 cycle with two turbines. They highlighted the importance of performing a detailed transient analysis before the system design is finalized. Moreover, attention is drawn to the problem of compressor surge and turbine flow reversal. Nathan [26] investigated control strategies for an indirect sCO 2 recompression cycle. The major control strategies are high and low-temperature control, turbine bypass, and inventory control. These strategies enable successful cycle operation for different transients, like start-up and shutdown, part-load operation, loss-of-load, loss of heat sink, and over-power. Liese et al. [27] demonstrated load following with fast ramp rates of 7.5%/min of full load, warm start-up, and shut down for a sCO 2 recompression cycle by applying PI-controllers with gain scheduling while considering the equipment constraints. Furthermore, they highlighted the need for a one-dimensional cooler model to capture the oscillatory control interaction between the cooler outlet and inventory control. Moisseytsev and Sienicki [28] performed extensive steady-state and transient studies with the Plant Dynamics Code, including validation with data from Sandia National Laboratories and the sCO 2 Integrated System Test facility. Moreover, the Plant Dynamics Code was coupled to SAS4A/SASSYS-1, e.g. to analyze the thermal transients in the sodium-CO 2 reactor heat exchanger [29].
In this study, the coupled ATHLET simulations of the sCO 2 -HeRo system with a generic Konvoi PWR are discussed in detail. First, the most important findings regarding the design, layout, and control of the CO 2 cycle are summarized. Secondly, the integration of the sCO 2 -HeRo system into the PWR is presented. Thirdly, the start-up of the system from its operational readiness state is discussed. Fourthly, the required number of CO 2 cycles is determined, and the need for a control strategy to adapt to the declining decay heat is highlighted. Finally, the successfully controlled simulation is presented. Overall, the ATHLET simulations show that a sCO 2 -HeRo system with four controlled CO 2 cycles can safely remove the decay heat for more than 72 h.

The sCO heat removal system
The design, layout, and control of the CO 2 cycle were already presented in [17,22]. Therefore, only the most important points are summarized here. In case of an accident, the task of the sCO 2 -HeRo system is to remove the declining decay heat reliably over several days at any ambient condition. To follow the decay heat curve, the system consists of several CO 2 cycles, which are shut down step by step. At the beginning of the accident, the maximum thermal capacity of all cycles together can be lower than the initial decay heat because an inventory loss in the reactor for a limited time span can be tolerated as long as the cooling of the core can be guaranteed [1,21]. Assuming that other safety systems, as well as electricity supply, are unavailable, the system has to be self-propelling. This means that the power of the turbine P turb must be higher than the power consumption of the compressor P comp and the fans P fan of the UHS. To quantify the margin to zero, the excess power is defined as The basic cycle layout is provided in Figure 1. Additional bypasses, like a turbine bypass, are only required for special operating conditions, e.g., for the start-up. At the design point, which is located at the highest ambient temperature of 45 • C, the heat removal capacity of one cycle is set to 10 MW. The design point performance of the turbomachinery is specified conservatively with isentropic efficiencies of 0.7 and a pressure ratio of 1.7. With a turbine inlet temperature of about 287 • C and a compressor inlet temperature of 55 • C, the design point optimization yields a compressor inlet pressure of 126.3 bar and an excess power of 283 kW. Altogether, the cycle does not focus on efficient power generation but selfpropelling heat removal over the whole range of considered boundary conditions. On the CO 2 side, the compressor and turbine inlet temperature are controlled via the fan speed of the UHS and the turbomachinery shaft speed, respectively.
The performance maps of the sCO 2 turbomachine employed in this study were generated by mean-line analysis codes for the compressor [30] and turbine [31]. These maps are provided as the input of a recently developed turbomachinery model in ATHLET, which considers real gas effects [12,20]. The CHX and UHS are modeled with the standard approach of modeling just one representative channel or pipe in ATHLET [13,32]. The upscaled CHX consists of 9000 channels with a size of 2 × 1 mm 2 per fluid with a length of 1.1 m, and the UHS consists of 732 pipes on the CO 2 side with an inner diameter of 10 mm and a length of 22 m. The UHS is by far the largest component and thermal inertia of the cycle, with a total structural mass of 18.1 t, containing 56.8% of the total CO 2 mass in design conditions. 3 Integration of the sCO 2 heat removal system into the PWR In this paper, the sCO 2 -HeRo system is attached to a generic four-loop Konvoi PWR [33]. The CHX of the first CO 2 cycle is attached to the main steam line (MSL) of the first steam generator, as shown in Figure 2. Valves in the inlet and outlet pipe of the CHX enable disconnection and control of the new line. During the normal operation of the NPP, the valve in the outlet pipe is closed. However, a small amount of steam flows to the CHX to keep the CO 2 cycles in an ORS. The condensate is led to the steam generator blowdown system (LCQ) downstream of the trim valve. This is modeled in a simplified manner in the simulation by the "ORS outlet" sink. Due to the higher pressure losses in the main steam line and the higher water level in the steam generator during normal operation, the condensate cannot be injected into the part of the LCQ before the trim valve. Approximately 1% of the feedwater mass flow rate is discharged via this pipe to demineralize the coolant. In the case of the station blackout, the trim valve and the "ORS outlet" line is closed in the same way as the feedwater line and the main steam line to isolate the steam generator. At the same time, the valve in the outlet pipe of the CHX is opened, and a natural condensationdriven circulation develops over the CHX.
In a parameter study, the inner diameter of the piping before the CHX is set to 0.1 m and after the CHX to 0.05 m, and the lower end of the CHX to the height of 18 m. For comparison, the water level in the steam generator 60 s after the start of the accident is approximately at a height of 10 m. Under accident conditions, this results in a CHX water outlet temperature of 165 • C at the design point of the CO 2 cycle. During the simulation, the target value of 150 • C for T H2O,out can be reached by controlling the valve opening in the outlet pipe of the CHX. This is required to avoid the thermal stress limitation in the CHX. During the progress of the accident, the valve opening must be adjusted continuously due to the changing water level in the steam generator and the changing CO 2 side conditions. The first tests revealed that the outlet valve should be controlled instead of the inlet valve because the reverse flow and flow oscillation may occur if the pressure drop in the inlet pipe is too high.

Start-up of the heat removal system
In the following, the start-up of the sCO 2 -HeRo system from an operational readiness state (ORS) is described. The goal of the ORS is to enable a fast start-up in case of an accident at any ambient temperature. Therefore, the ORS should fulfill the following criteria: • preheated components to reduce thermal stress during start-up. • Low thermal and electrical power consumption to minimize the impact on the NPP plant efficiency. • Self-propelling operation (preferred but not required) to allow the start-up without battery support in case of an SBO.
In Table 1, the operation conditions of one selected ORS are presented. To keep the thermal power consumption in the CHX low, the turbomachinery is operated at only 20% of the speed compared to the cycle design point. In addition, the H 2 O mass flow rate has to be throttled to limit the heat transfer. This results in a temperature difference of almost 0 K between the CHX inlet temperature on the CO 2 side and the CHX outlet temperature on the H 2 O side. The CO 2 side outlet temperature of the CHX is already at 150 • C, and the compressor inlet temperature is controlled to its design value of 55 • C. Despite the partload operation with a low speed and very low-pressure ratio, the isentropic efficiencies of the turbomachinery are close to their design point. Altogether, it can be observed from the total power of the system that it might be possible to achieve a selfpropelling operational readiness state at only 11% of the design thermal power input. The results in Table 1 are preliminary because the operating points are located far from the design point, where the accuracy of the models and the input needs to be analyzed and improved further. Moreover, the conservative assumption of the turbomachinery isentropic efficiencies, and the ORS condition may be adapted in the future. More details regarding the ORS can be found in [22].
In the following simulation, all CO 2 cycles are started identically, and the conservatively high decay heat curve [24] is considered together with the highest ambient temperature, which is 45 • C. In Figure 3, the parameters of the start-up procedure are presented over time, with t = 0   Fig. 2). An active control strategy is applied, i.e. controllers and valves are powered by batteries (Fig. 1), which are constantly recharged with the excess electricity produced by the cycles. First, 2.5 s after the start of the accident, the ORS outlet is closed to isolate the steam generator in the same way as it is done in the feedwater and main steam line. Therefore, at the same time, the valve in the pipe after the CHX is opened partially, as shown in Figure 3, and the condensate flows into the bottom of the downcomer via the LCQ (Fig. 2). It is important to open this valve only to a predetermined value because fully opening this valve would lead to rapidly increasing temperatures on the water as well as on the CO 2 side resulting in high thermal stresses for the components. To limit the stress in the CHX, the mentioned valve is kept at its predetermined value for the first 100 s. Then, this valve is opened slowly within the next 20 min to allow an increase in the H 2 O mass flow rate. At the same time, the turbomachinery speed is increased linearly to its design value. Finally, in the last 100 s, before the valve reaches a second predefined opening value, the control of the CHX condensate outlet temperature is activated. After the procedure is finished, the valve opening is controlled to keep the condensate temperature constant at 150 • C, and the CO 2 cycle has reached its design performance.
Averaged over the 20 min lasting start-up procedure, the gradient of the CHX condensate outlet temperature is only 4.7 K/min. For the CHX outlet temperature on the CO 2 side, the average gradient is 6.5 K/min, and for the UHS inlet temperature, 4.5 K/min, respectively. However, the temperatures are not increasing linearly, as shown in Figure 3. First, all temperatures except the condensate outlet temperature show a small peak at the beginning of the start-up procedure. This is due to the heat-up of the secondary side and the following cooldown, which is caused by the partial depressurization to 7.5 MPa. The maximum CO 2 side temperature peak is reached when the shaft speed increase is started. Increasing the shaft speed earlier damps this peak. However, depending on the considered battery capacity for the start-up procedure, care must be taken because the excess power of the system will drop below zero if the shaft speed is increased too early.
While the increase of the CO 2 side temperatures is stretched almost over the complete ramp-up period, the major increase of the CHX outlet temperature occurs during the last 300 s, where the average heat-up is 21 K/min. A detailed CHX design and thermal stress analysis are required to investigate the effects of the non-uniform heatup. A reduction of thermal stresses can be achieved by simply extending the start-up time. Furthermore, the ORS or the start-up procedure may be optimized, e.g. by implementing an advanced control strategy to limit the thermal gradients.
5 Variation of the number of sCO 2 cycles without a control strategy to adapt to the declining decay heat In this chapter, simulations of the sCO 2 -HeRo system with different numbers of CO 2 cycles are compared to each other. A conservatively high decay heat curve [24] and the maximum ambient temperature of 45 • C are applied to conservatively determine the required minimum heat removal capacity, corresponding to a minimum number of CO 2 cycles, to keep the PWR in a safe condition. Start-up of the cycles and control of the CHX outlet temperature on the H 2 O side were conducted as described in the previous chapters.
On the CO 2 side, the compressor inlet temperature is controlled to its design value of 55 • C by varying the speed of the UHS fans. At lower ambient temperatures, the compressor inlet temperature may still be controlled to 55 • C, mainly resulting in lower fan power and a slightly higher heat removal capacity [17]. Therefore, the conclusions drawn regarding the required number of CO 2 cycles are valid over the whole range of ambient temperatures. Furthermore, the turbomachinery shaft speed is kept constant at its design value after start-up, and no shutdown of single CO 2 cycles is considered. This allows showing the long-term effects of a missing control strategy to adapt to the declining decay heat. These effects are discussed in the second part of this chapter.
The simulations were performed with zero (Ref. case [24]), two, three, and four CO 2 cycles available, labeled with "0", "2", "3", and "4" respectively, in Figure 4. This figure shows different parameters of the accident during the first 24 h, beginning at the top left with the balance between decay power (dashed green curve) and the heat removal capacity of the available CO 2 cycles combined. Only in cases 3 and 4 the equilibrium between the decay heat and the heat removal capacity is reached. In the other cases, the heat removal capacity is not sufficient, resulting in steeply increasing temperatures, as indicated by the temperature at the nozzle of hot leg 1 at the top right. In case 2, the temperature reaches 650 • C after about 3.45 h. This is about 1.5 h later than in the reference case. In all figures, the simulations are only shown up to a hot leg temperature of 1000 • C because no core degradation is simulated. In case 3, the hot leg temperature is kept at about 351 • C, determined by the saturation temperature regarding the setpoint of pressurizer safety valves. From about 10.5 h on, after passing the break-even of heat removal and decay heat, the decreasing temperature on the secondary side causes a decrease of pressure and temperature on the primary side, too. Due to the higher heat removal of case 4, almost no temperature increase can be observed in this case, and the temperature decrease starts earlier. A lower heat removal capacity due to a delayed start-up or failure of one of the CO 2 cycles would also lead to a subsequent primary side temperature and pressure increase towards the setpoint of pressurizer safety valves.
With four CO 2 cycles (case 4), heat removal from the primary to the secondary side of the steam generators was effective in keeping the primary temperature low enough to avoid pressure increase and action of the pressurizer safety valves. This can be verified from the primary mass content at the lower right in Figure 4. In contrast, 32% of the primary loop inventory is lost in case 3 before the blow-off from the primary side stops. The initial rapid mass loss on the primary side is determined by subcooled water from the solid-filled pressurizer.
In the bottom left of Figure 4, the water level in steam generator 1 is shown. For all simulations, it decreases to practically zero at a certain time. However, this does not limit the heat transfer from the primary to the secondary side and further to the CO 2 cycles. Even in case 3, in the period when the steam generator is practically dried out, the resulting heat transfer coefficient on the secondary side between 65 W/m 2 K at the top and 105 W/m 2 K at the bottom of the riser proved sufficient together with the increased temperature on the primary side. When the temperature decreases, the water level increases again, as can be observed in cases 3 and 4 at the right end of the time axis. These cases do not end after 24 h, which is the right end of the diagrams, but they face several other problems. These are discussed in the following, starting with case 3.
The following discussion of case 3 is almost independent of the control strategy regarding the declining decay heat because the observed problems occur due to insufficient heat removal in the time before the equilibrium of the decay heat and the removed thermal power is reached. Figure 5 shows the water level in the reactor pressure vessel (PRV) and pressurizer (PRZ) on the left side for the simulation with three CO 2 cycles. Initially, the pressurizer level drops from the shrinking of the coolant in the primary circuit after scram. The following increase is related to the described heat-up. In the following, the filled pressurizer spills out the liquid until the evolving head bubble in the reactor pressure vessel reaches the upper end of the hot leg after 3.4 h, thus, sending vapor through the pressurizer. The plateau of the reactor level results from the separation of liquid and steam in the legs, providing a certain source of liquid mass flow towards evaporation in the reactor. This liquid source can be considered exhausted when the hot leg nozzles are uncovered after 6.7 h, about 5.1 h later than in a reference case [24]. Until the equilibrium between the decay power and the heat removal capacity has been reached after around 10 h, the reactor boils off further just to a few centimeters above the top of the core. Afterwards, the cooldown of the primary circuit results in backflow from the pressurizer to the hot leg and back into the reactor.
Before, the several hours lasting reflux condenser mode combined with a stagnation of the core internal circulation resulted in a nearly total dilution of the boron in the cold leg and the bottom of the reactor core, as to be seen on the right of Figure 5. Since neutron kinetics had not been simulated, the impact of boron and void for subcritical cannot be judged, but such a situation has to be avoided, either by using a sufficient number of CO 2 cycles beforehand or by using the excess electricity of the cycles to power boron injection.
After the thermal power equilibrium is reached around 10 h, the decreasing pressure and resulting flow oscillation in the reactor cause a fast decrease and following increase of the boron concentration. Finally, after 13 h, the concentrated boron from the upper part of the core is purged downwards due to the refilling of the reactor pressure vessel from the pressurizer via the hot leg. In addition, internal circulation in the core builds up again and decreases the gradient in the boron concentration. Nevertheless, the downcomer, which is not involved in this circulation, is still almost completely unborated, posing a serious risk for recriticality at sudden fill-up from the cold leg side.  Thus, in the long term, filling from the hot leg side only should be advised, e.g., from the hot leg side borated pressure accumulators, resembling the demonstrated purging down. With the total mass reduced by blowing out boronreduced steam and mixture via the pressurizer, the final boron concentration stabilizes at around 1000 ppm.
The mentioned thermal-hydraulic effects in the hot and cold leg of the first primary loop, which is connected to the pressurizer, can be verified in Figure 6. In this figure, the flow velocities of the liquid and vapor phases are presented. After the stop of the main coolant pumps, the liquid flow stabilizes at about 0.55 m/s. At around 1.4 h, the heavily oscillating liquid phase flow marks the spill out of the water through the pressurizer safety valves. As mentioned above, the two-phase flow starts around 3.4 h. After 4.5 h, the reversal of the liquid flow marks the beginning of reflux condenser mode. Due to the lost liquid flow over the top of the U-tubes, the boron concentration in the bottom of the core starts to decrease as presented in Figure 5. In the following, positive liquid flow velocities in the hot leg are only caused by the actuation of the pressurizer safety valves. Finally, the blowout from the pressurizer gradually stops as the decay power approaches the heat removal capacity, as shown in Figure 4 for case 3.
After the onset of the two-phase flow, both legs are only partially filled with liquid. Therefore, changing phase velocities do not necessarily reflect a change in the phase mass flow rate but may be related to a change in the respective phase flow area. This is mainly the case for the change of the velocities in the hot leg around 13 h when the leg is refilled with liquid from the pressurizer. Before, the unborated liquid mass flow rate in the cold leg of approximately 6 kg/s gradually mixes the boron concentration in the bottom of the core down to zero, as shown in Figure 5.
Other long-term effects related to the decreasing temperatures in the PWR will be discussed together with case 4 because the cooldown in case 3 sets in, too, nevertheless, later. According to the left of Figure 7, the primary and secondary temperatures start to decrease for case 4 after a few hours. After 13.7 h, a temperature of 260 • C is reached. At this temperature, the boron injection should be started to prepare the primary loop for the cold shutdown. Temperatures below 200 • C are only allowed when the boron injection is finished, and a concentration of approximately 800 ppm is reached.
Furthermore, the decreasing temperatures on the NPP side lead to a decreasing turbine inlet temperature on the CO 2 side, as displayed at the left of Figure 7. That, in  turn, results in a decreasing turbine power, as shown at the right of Figure 7. The required compressor power stays nearly constant due to the constant shaft speed and the almost constant pressure ratio and cycle mass flow rate. The required fan power is also decreasing due to the lower turbine exit temperatures, but this hardly affects the overall power balance. After 39.7 h, the excess power reaches zero, which means that the cycle is not self-propelling anymore. In conclusion, a self-propelling operation without a strategy to adapt to the declining decay heat is possible for quite some time, but, finally, active control is required to keep the sCO 2 -HeRo system self-propelling.

A control strategy to adapt to the declining decay heat
In this chapter, four CO 2 cycles, one attached to each steam generator to keep symmetry, and a control strategy to adapt to the declining decay heat curve are investigated. According to the previous chapter, the four cycles without such a strategy failed because they removed too much heat from the NPP. Moreover, the cycles fail ear-lier if less decay heat is available. Therefore, in contrast to the previous chapter, a conservatively low decay heat curve [24] is applied in this chapter to analyze the longterm operation of the sCO 2 -HeRo system. The control methods regarding CO 2 compressor inlet temperature and H 2 O CHX outlet temperature from the previous chapter are also applied in this chapter. The additional strategy to cope with the declining decay heat is explained together with the presentation of the results.
In Figure 8, the decay power and the total thermal power removed by the CO 2 cycles are shown on the left, and the turbomachinery shaft speed of each cycle is on the right. As in the last chapter, the CO 2 cycles are started from the ORS and ramped up to their design speed, and then the speed is kept constant, resulting in a heat removal capacity of approximately 10 MW per cycle. Due to conservatively low decay heat, the break-even between the heat removal capacity and the decay power is reached already after 38 min. This initiates the decrease of the temperatures on the primary and secondary sides in the NPP and the turbine inlet temperatures of the CO 2 cycles. As mentioned in the previous chapter, this decrease should be limited because below a primary  temperature of 260 • C, the boron injection should start, and ultimately the decreasing temperatures also would render the CO 2 cycles inoperable. However, slightly decreasing the primary and secondary temperatures is also beneficial because this increases the thermal buffer if something unexpected happens, like a technical failure in one of the CO 2 cycles. Therefore, a target value of 260 • C was specified for the CO 2 turbine inlet temperatures. After 2.4 h, the target value is reached, as shown later in Figure 10, and the shaft speed control is activated to keep the turbine inlet temperature at 260 • C. In addition to the shaft speed control, the subsequent shutdown of single CO 2 cycles is required to avoid a decrease of ∆P to zero due to very low shaft speeds, as shown later in this chapter. In the simulation, relative switch-off speeds in relation to the cycle design point speed of 50%, 35%, and 30% were specified for the first, second, and third cycles, respectively. The switch-off speeds were selected to be relatively low to be able to buffer the unexpected failure of another operating cycle. This results in the successive shutdown of three cycles after 3.8 h, 9.3 h, and 25.9 h. At each switch-off point, the removed thermal power drops below the decay heat curve and then gradually adapts to the curve as the shaft speed increases again, as shown in Figure 8. In the end, only cycle 4 is still under operation. As long as the cycles are under operation, they run almost at the same shaft speed, and all other operating conditions are also very similar since all running cycles are controlled in the same way.
The temperatures and mass flow rates in the hot and cold legs, as shown in Figure 9, decrease until the thermal power balance has been established, which occurs approximately at the same time as the switch-off of the first cycle. As long as all CO 2 cycles are running, the cold leg temperatures and mass flow rates are equal in the different legs. When one of the cycles is switched off, the heat transferred to the corresponding steam generator decreases rapidly toward zero. This leads to a considerable reduction of the mass flow rate in this leg, and the cold leg temperature increases to the temperature of the hot leg. The reduced mass flow rate results from the loss of the natural circulation driving density difference over the elevation of the steam generator U-tubes since the heat removal is stopped in this leg. After 2 h, the temperature difference between the hot leg and the corresponding cold leg never exceeds 10 K. In a leg with an operating CO 2 cycle, the difference also does not drop below 6.5 K. The lowest difference occurs before the second last cycle is switched off because, at this point, the heat removal per cycle is at its lowest value. The heat produced in the reactor always builds up the required driving force in the form of a temperature and density difference, respectively, to overcome the pressure losses in the legs. Altogether, the cold leg temperature never drops below 260 • C.
In the following, the operation of the CO 2 cycles is analyzed, illustrated by cycle 4, which is still running in the end. The shaft speed of the turbomachinery and the sum of the thermal power of all CHX were already displayed in Figure 8. The thermal power of one CHX is the current power divided by the number of operating cycles. In Figure 10, the turbine inlet temperature and the power production of the turbine compared to the requirement of the compressor and the fans and the excess power are shown. For better visualization, the y-axis is cut-off at 0.4 MW. The power at the maximum speed is almost the same as in Figure 7. After a short period of almost constant power, the shaft speed control is activated to keep the turbine inlet temperature constant at 260 • C, as described before. The decrease in the shaft speed leads to a steep decrease in the mass flow rate, the compressor outlet pressure, and the power levels. Compared to Figure 7 also, the compressor power decreases, enabling a self-propelling operation. Even at its lowest point, the excess power still exceeds 12.8 kW. If a higher margin to zero is preferred, the control strategy could easily be adapted by specifying higher switch-off speeds for the second and third cycles. After 72 h, at the end of the simulation, the excess power of the last cycle running is 32 kW.

Conclusions
In this study, a long-term station blackout and loss of ultimate heat sink scenario in a PWR was analyzed with the thermal-hydraulic system code ATHLET. For the mitigation of the accident, the self-propelling sCO 2 -HeRo system was considered. After summarizing the most important points regarding the design, layout, and control of the CO 2 cycle, the integration of the CHX to the secondary side of the PWR was presented. Stable control of the CHX outlet temperature on the H 2 O side was achieved by adapting the valve opening in the condensate pipe after the CHX. During the relatively fast start-up from the operational readiness state, non-linear thermal gradients were observed in the CHX outlet temperature on the H 2 O side, which require further investigation in terms of component stress.
A sCO 2 -HeRo system with four CO 2 cycles with a heat removal capacity of 10 MW per cycle provided sufficient heat removal from a generic Konvoi PWR with thermal power of 3840 MW even under consideration of a conservatively high decay heat curve. With three cycles, the core could still be cooled but was almost uncovered. In addition, the impact of the deboration in the cold legs in the simulation with three cycles remains open and would require coupling to a neutronic model for further analysis. Therefore, the use of only three sCO 2 cycles is not recom-mended. Furthermore, the unavailability of one cycle due to a failure or maintenance should be taken into account by installing two additional cycles as a backup. Independent of the number of CO 2 cycles, a control strategy is required to adapt to the declining decay heat, otherwise the cycles remove too much heat in the long term. This leads to decreasing temperatures and finally also stops the self-propelling operation.
This paper demonstrates the adaption to the declining decay heat by controlling the turbine inlet temperature of the CO 2 cycles to a constant value of 260 • C via the shaft speed of the turbomachinery. In addition, the subsequent shutdown of single CO 2 cycles is required. These strategies are enforced when the decay heat is lower than the total heat removal capacity of the cycles. In the beginning, the cycles are operated at their design speed to maximize the heat removal and to keep the inventory loss of the reactor to a minimum. When one cycle is switched off, the control ramps up the remaining cycles automatically to match the decay heat again. The switch-off also affects the flow distribution and temperatures in the PWR. During the whole simulation, a self-propelling operation can be maintained and, in the end, the last one of the four cycles is still under operation with a remaining excess power of 32 kW. Generally, it can be recommended that all CO 2 cycles should be operated to the lowest feasible excess power before one cycle is switched off because this provides the highest operational flexibility in case of an unexpected event, e.g. failure of one or even multiple cycles. Considering the proposed strategies and findings, this heat removal system can also be applied to other types of existing and future nuclear power plants in order to increase the level of safety.
In the future, the response of the system to various transients should be analyzed in more detail. These include the failure of the control systems, the valves or a complete cycle, fast shutdown and restart, and the blowdown of the steam generators via the safety valves when the batteries for the relief valves are not available. During these transients, the thermal stress on the components needs to be investigated, and advanced control strategies might be required to minimize the stress. Moreover, the system may be further optimized and used for operational tasks in the NPP.