Issues Associated with the Development of Severe Accident Management Guidelines for CANDU Reactors

Keith Dinnie Director, Risk Management Nuclear Safety Solutions Ltd.

Toronto, Canada

CANDU Reactor 101

• Nat U fuel in horizontal pressure tubes (380/480), each with inlet and outlet feeder pipes from common headers • Channels surrounded by low pressure heavy water moderator, containing vertical and horizontal reactivity control devices • Calandria filled with heavy water surrounded by a light water-filled concrete shield vault or metal shield tank

Design Features Affecting Severe Accident Progression

• Total loss of cooling to fuel in the channels does not necessarily lead to severe accident progression • If moderator cooling is available, decay heat can be removed by moderator HXs • If there is a small quantity of residual steam flow through channels, Zr oxidation can occur leading to hydrogen and fission product release to containment

Severe Accident Progression (1)

• If moderator cooling not available, moderator system will pressurize connecting to containment atmosphere via rupture disks (>240 kPa) e V u e x s x i k h u e e V C r e l

Accident Progression (2)

• Flashing of moderator will uncover upper fuel channels which will rapidly fail

Accident Progression (3)

• Rubble collects at bottom of calandria vessel

Accident Progression (4)

• Shield tank fails or water evaporated • Calandria vessel fails • Metal shield tank may fail

Accident Progression (5)

SAMG Issues Related to Design

• Core thermal conditions • Normally determined by header temperature and pressure, and RTDs on feeder pipes outside the core • Events covered by EOPs • Loss of coolant and failure of ECC (case with limited fuel failures) • Transients leading to single channel failure (loss of secondary side heatsink) • EOP  SAMG transition indicated by • Prolonged loss of subcooling (degraded core cooling), and • Increase in moderator temperature (inability of moderator to remove decay heat), or • Significant release of fission products to containment

SAMG Issues Related to Design

• Transition to SAMG • Measurement of channel conditions • Header subcooling • RTDs on outlet feeders • No direct measurement • Measurement of fission product release • Gamma monitors in containment • Definition of “significant” • Moderator cooling • Increasing temperature will rapidly lead to rupture discs opening and system depressurization • Initially similar to single channel failure • SAMG ISSUE: Simple or complex criterion for transition to SAMG?

SAMG Issues Related to Design

• Severe accident progression always occurs at low pressure (pressure tube is weak link under degraded cooling conditions) • SAMG Issue: Is there any value in a SAG to depressurize RCS?

Containment Pressurizer Headers Steam-Water Separators Coolant Pumps Calandria Fuelling Machine Fuel

Core

Fuelling Machine Moderator Pump Moderator Heat Exchanger Steam Boiler Feedwater

SAM Issues Related to Design

• Channel experiences much more severe conditions that SG tubes and will fail well before SG integrity challenged • Even if SG tube rupture exists, release will terminate on channel failure • SAMG Issue: Is there any value in a SAG to protect SG tube integrity?

CsI 3.50E-03 3.00E-03 2.50E-03 2.00E-03 1.50E-03 1.00E-03 5.00E-04 0.00E+00 0

Fission Product Release (SGTR-REF)

CsOH+RbOH CeO2 TeO2 SrO Noble Gas 20 40 60

Time (Hours)

80 0.2

0.18

0.16

0.14

0.12

0.1

0.08

0.06

0.04

100 0.02

0

SAM Issues Related to Multi-Unit Stations

Operational

• Common systems (ECC, Containment) • Common control room • Unit and common operating crews • Non-incident reactors can continue to operate at full power for a limited period after an accident at one unit • Actions at non-incident units can affect incident unit • SAMG Issue: role of non incident units in SAMG (e.g., unusual equipment line-ups, etc.)

Negative-Pressure Containment

• Large volume when interconnected • Diverse sources of cooling • Containment pressure measurement trends masked by vacuum reserve • While containment is sub atmospheric must use temperature and pressure to diagnose containment leakage (no releases while sub-atmospheric)

Pressure in Containment Compartment

0.2

0.18

0.16

0.14

0.12

0.1

0.08

0.06

0.04

0.02

0 0 RV2 (Accident Unit) VB Lower Compartment Pressure Relief Duct RV1 10 20

Time (hrs)

30 40

Pressure in Containment Compartment (CEI=0.1m^2)

0.15

0.1

0.05

0 0 4 8 12

Time (hrs)

16 20 24 Calandria Vault F/M Vault East Boiler Room VB Lower Compartment Pressure Relief Duct

Loss of Electric Power

• Redundancy of electric power supplies (cross connection between units, stand-by generators, emergency power generators) • Total loss of power would affect all units simultaneously • Issue: Should SAMG attempt to address multiple unit severe accidents?

Unit Service Transformer Class IV Class III Class I Class II System Services Transformer Even Odd Standby Generators Rectifiers AC/DC Batteries Inverters DC/AC

Other Issues

• Tritium • Issue: Should a large release of tritium be considered a ”severe accident” • Security • Issue: Should SAMG attempt to address plant conditions specific to security-related situations?

• Shut down state • Issue: At what point in SAMG development should events originating from the shutdown state be considered?

Principles

   The SAMG must remain easy to use, because the emergency technical support staff will not be trained or drilled at high frequency intervals, and therefore familiarity with the material will be limited.

Experience in developing and drilling with SAMG for the at-power state is desirable before considering extension of the scope to other plant states or conditions.

Symptom-based procedures and guidelines are capable of addressing severe accident challenges and accommodating limitations in information and equipment availability, whatever the cause.