Issues Associated with the Development of Severe Accident Management Guidelines for CANDU Reactors

Keith Dinnie

Director, Risk Management

Nuclear Safety Solutions Ltd.

Toronto, Canada

CANDU Reactor 101

• Nat U fuel in horizontal pressure tubes (380/480), each with inlet and outlet feeder pipes from common headers

• Channels surrounded by low pressure heavy water moderator, containing vertical and horizontal reactivity control devices

• Calandria filled with heavy water surrounded by a light water-filled concrete shield vault or metal shield tank

Design Features Affecting Severe Accident Progression

• Total loss of cooling to fuel in the channels does not necessarily lead to severe accident progression

• If moderator cooling is available, decay heat can be removed by moderator HXs

• If there is a small quantity of residual steam flow through channels, Zr oxidation can occur leading to hydrogen and fission product release to containment

Severe Accident Progression (1)

• If moderator cooling not available, moderator system will pressurize connecting to containment atmosphere via rupture disks (>240 kPa)

Expansion Tank

Relief Valve

Rupture DiskRupture Disk

Relief Valve

Extension Tank

Shield Tank

Calandria Vessel

Accident Progression (2)

• Flashing of moderator will uncover upper fuel channels which will rapidly fail

Accident Progression (3)

• Rubble collects at bottom of calandria vessel

Accident Progression (4)

• Shield tank fails or water evaporated

• Calandria vessel fails• Metal shield tank may fail

Accident Progression (5)

SAMG Issues Related to Design

• Core thermal conditions • Normally determined by header temperature and pressure, and

RTDs on feeder pipes outside the core

• Events covered by EOPs• Loss of coolant and failure of ECC (case with limited fuel

failures)• Transients leading to single channel failure (loss of secondary

side heatsink)

• EOPSAMG transition indicated by• Prolonged loss of subcooling (degraded core cooling), and• Increase in moderator temperature (inability of moderator to

remove decay heat), or• Significant release of fission products to containment

SAMG Issues Related to Design

• Transition to SAMG• Measurement of channel

conditions• Header subcooling• RTDs on outlet feeders• No direct measurement

• Measurement of fission product release

• Gamma monitors in containment • Definition of “significant”

• Moderator cooling• Increasing temperature will rapidly

lead to rupture discs opening and system depressurization

• Initially similar to single channel failure

• SAMG ISSUE: Simple or complex criterion for transition to SAMG?

SAMG Issues Related to Design

• Severe accident progression always occurs at low pressure (pressure tube is weak link under degraded cooling conditions)

• SAMG Issue: Is there any value in a SAG to depressurize RCS?

Steam

Calandria

Headers

Coolant Pumps

Steam-Water Separators

Boiler Feedwater

Pressurizer

Core

Fuel

Moderator Pump

Moderator Heat Exchanger

Fuelling Machine

Fuelling Machine

Containment

SAM Issues Related to Design

• Channel experiences much more severe conditions that SG tubes and will fail well before SG integrity challenged

• Even if SG tube rupture exists, release will terminate on channel failure

• SAMG Issue: Is there any value in a SAG to protect SG tube integrity?

Fission Product Release (SGTR-REF)

0.00E+00

5.00E-04

1.00E-03

1.50E-03

2.00E-03

2.50E-03

3.00E-03

3.50E-03

0 20 40 60 80 100

Time (Hours)

Ma

ss

Fra

cti

on

of

Co

re

Inv

en

tory

0

0.02

0.04

0.06

0.08

0.1

0.12

0.14

0.16

0.18

0.2

No

ble

Ga

s F

rac

tio

n

CsI CsOH+RbOH CeO2 TeO2 SrO Noble Gas

SAM Issues Related to Multi-Unit Stations

Operational

• Common systems (ECC, Containment)

• Common control room• Unit and common operating

crews• Non-incident reactors can

continue to operate at full power for a limited period after an accident at one unit

• Actions at non-incident units can affect incident unit

• SAMG Issue: role of non-incident units in SAMG (e.g., unusual equipment line-ups, etc.)

Negative-Pressure Containment

• Large volume when interconnected

• Diverse sources of cooling• Containment pressure

measurement trends masked by vacuum reserve

• While containment is sub-atmospheric must use temperature and pressure to diagnose containment leakage (no releases while sub-atmospheric)

Pressure in Containment Compartment

0

0.020.04

0.06

0.08

0.1

0.120.14

0.16

0.180.2

0 10 20 30 40

Time (hrs)

Pre

ssu

re in

Co

nta

inm

ent

(MP

a)

RV2 (Accident Unit)

VB Lower Compartment

Pressure Relief Duct

RV1

Pressure in Containment Compartment (CEI=0.1m^2)

0

0.05

0.1

0.15

0 4 8 12 16 20 24

Time (hrs)

Pre

ssu

re i

n C

on

tain

me

nt

(MP

a)Calandria Vault

F/M Vault EastBoiler Room

VB Lower Compartment

Pressure Relief Duct

Loss of Electric Power

• Redundancy of electric power supplies (cross-connection between units, stand-by generators, emergency power generators)

• Total loss of power would affect all units simultaneously

• Issue: Should SAMG attempt to address multiple unit severe accidents?

UnitServiceTransformer

SystemServicesTransformer

StandbyGenerators

OddEvenClass IV

Class III

Class II

Class I

Inverters DC/AC

Batteries

Rectifiers AC/DC

Other Issues

• Tritium• Issue: Should a large release of tritium be considered a ”severe

accident”

• Security• Issue: Should SAMG attempt to address plant conditions specific

to security-related situations?

• Shut down state• Issue: At what point in SAMG development should events

originating from the shutdown state be considered?

Principles

The SAMG must remain easy to use, because the emergency technical support staff will not be trained or drilled at high frequency intervals, and therefore familiarity with the material will be limited.

Experience in developing and drilling with SAMG for the at-power state is desirable before considering extension of the scope to other plant states or conditions.

Symptom-based procedures and guidelines are capable of addressing severe accident challenges and accommodating limitations in information and equipment availability, whatever the cause.