Dynamics of passive reactor shutdown