The separation between coolant and moderator in CANDU reactors provides a backup safety system through the moderator cooling system. The moderator cooling system is used to remove heat deposited in the moderator during normal operation due to gamma and neutron heating. This heat, which is approximately 5% of reactor thermal power, is of the same order of magnitude as decay heat shortly following reactor shutdown; therefore, this system can be used to remove decay heat if the emergency core cooling (ECC) system fails.

The moderator cooling system used in existing CANDU reactors uses a pumped loop (see Figure X-2), and its role as a backup safety system can be significantly enhanced if a natural circulation loop is used. A passive moderator cooling system (PMCS) concept for CANDU reactors has been under investigation for the past several years and is described in [4]. In the PMCS concept, the moderator operates close to saturation so that two-phase flow is generated by flashing in a riser that is connected to a heat exchanger (see Figure X-3).

FIG. X-2. Current CANDU moderator cooling system.

The passive loop design in Figure X-3 ensures the following: 1) single-phase exists in the calandria (for effective neutron moderation), and 2) two-phase exists in the riser so that sufficiently high flowrates are achieved for decay heat removal following certain postulated accident scenarios. The stability of the PMCS loop was verified experimentally and compared to code predictions using a scaled loop [4]. For the CANDU-SCWR, the objective is to operate the passive moderator loop during normal operation to ensure that this loop is available following accidents without operator intervention. This is made possible by the design of the CANDU-SCWR fuel channels, which is different from the design used in existing CANDU Reactors. Existing CANDU reactors use a fuel channel design that consists of a pressure tube that is insulated from the cool heavy water moderator by a gas gap and a calandria tube (Figure X-4). In this configuration, the pressure tube operates close to the coolant temperature while the calandria tube operates close to the moderator temperature.

During normal operation, heat is deposited directly in the moderator by direct gamma and neutron heating (~5% of the total thermal power). Heat transfer from the coolant to the moderator is negligible because of the presence of the gas gap between the pressure tube and the calandria tube. The moderator heat load is of the same order of magnitude as the decay heat shortly after reactor shutdown. This makes the moderator an attractive heat sink for decay heat removal following certain postulated accident scenarios provided that heat can be efficiently transferred from the fuel channel to the moderator.

Existing CANDU reactors rely on pumps to remove heat deposited in the moderator during normal operation, and to remove decay heat during certain accident scenarios. Furthermore, existing CANDU reactors require the moderator to operate with a certain degree of subcooling to avoid film boiling on the calandria tube if the pressure tube balloons into contact with the calandria tube following a loss of coolant accident (LOCA) combined with loss of Class IV power [5]. This restriction on the moderator temperature has to be removed in order to implement the passive moderator cooling loop during normal operation. This is possible by the use of an alternate fuel channel design for the CANDU- SCWR, which is required to protect the pressure tube from the high temperature coolant. This alternate fuel channel design is shown in Figure X-5 and utilizes an internally insulated pressure tube.

FIG. X-5. CANDUSCWCR fuel channel.

The main differences between the fuel channel design shown in Figure X-4 and that shown in Figure

VIII — 5 are: 1) the insulator in Fig. X-5 is on the inside of the pressure tube to keep the pressure tube cooler (close to the moderator temperature), and 2) the calandria tube is eliminated. Elimination of the calandria tube removes the subcooling restriction on the moderator because this restriction is mandated by the design shown in Figure X-4 where the pressure tube could balloon into contact with the calandria tube following certain accident scenarios [5]. Therefore, the moderator could operate close to saturation and the PMCS concept can be used during normal reactor operation. This results in two important advantages: 1) the PMCS is demonstrated to be functional at all times, and 2) there is a potential for cost reduction because of the elimination of the moderator pumps.

The third tier has been addressed within the PRA/PSA (Probabilistic Risk Assessment/Probabilistic Safety Assessment) framework. In fact, PRA was initiated early in the IRIS design, and was used iteratively to guide and improve the design safety and reliability (thus adding ‘reliability by design’). The PRA has suggested modifications to the reactor system designs, resulting in reduction of the predicted CDF. After these modifications, the preliminary PRA level 1 analysis estimated the CDF due to internal events (including anticipated transients without scram, ATWS) to be about 2*10’8, more than one order of magnitude lower than in advanced LWRs. A subsequent evaluation of the LERF (large early release frequency) also produced a very low value, of the order of 6*10’10, which is more than one order of magnitude lower than in advanced loop LWRs, and several orders of magnitude lower than in present LWRs.

XVI-4. IRIS safety features

To complement its safety-by-design™, IRIS features limited and simplified passive systems as shown in Figure XVI-2. They include:

Figure V-6 presents a schematic of the AP600/AP1000 containment. It consists of a large steel vessel that houses the nuclear steam supply system (NSSS) and all of the passive safety injection systems. The steel containment vessel resides inside of a concrete structure with ducts that allows cool outside air to come in contact with the outside surface of the containment vessel. When steam is vented into containment via a primary system break or ADS-4 valve actuation, it rises to the containment dome where it is condensed into liquid. The energy of the steam is transferred to the air on the outside of containment via conduction through the containment wall and natural convection to the air. As the air is heated, it rises through the ducts creating a natural circulation flow path that draws cool air in from the inlet duct and vents hot air out the top of the concrete structure. The condensate inside containment is directed back into the IRWST and the containment sump where it becomes a source of cool water in the sump recirculation process. In a LOCA, cold water is sprayed by gravity draining onto the containment vessel head to enhance containment cooling. A large tank of water, located at the top of the containment structure, serves as the source of water for this operation.

FIG. V — 6. Containment and passive containment cooling system (PCCS).

The emergency core cooling system of V-407 reactor comprises three automatically initiated subsystems: (1) hydroaccumulators with nitrogen under pressure (which are traditional ECCS accumulators used for operating WWER-1000 reactors), (2) elevated hydroaccumulators open to the containment, and (3) equipment for forced emergency depressurization of the primary circuit. All these subsystems are based on the principle of passive operation providing for long term residual heat removal in case of a loss-of-coolant accident concurrent with plant blackout (i. e. AC power supply is not required for ECCS operation). Schematic diagram of emergency core cooling system is also shown in Figure XII-3.

XIX-3.1. Primary circuit and its main characteristics

The SCOR is an integrated PWR with a compact primary circuit. The reactor pressure vessel houses the main primary system components including the core, pressurizer, steam generator, reactor coolant pumps, control rod drive mechanism (CRDM) and the heat exchangers of the decay heat removal system. This design configuration eliminates large penetrations in the reactor vessel, thus excluding the possibility of large break loss of coolant accidents.

The single steam generator acts as the reactor vessel head as shown in Figure XIX-1. The flow path of the reactor coolant is illustrated in this figure. From the lower plenum, water flows upward through the core and the riser and through the centre of the pressurizer.

In the upper portion of the vessel, the fluid flows upward and then downward inside the U tubes of the steam generator. Then the fluid is collected in an annular plenum and passes to the inlet of the reactor coolant pumps. From the pump outlet, the coolant flows through a venturi and then across the tubes of the decay heat exchangers to the lower plenum.

XIX-3.2. Core andfuel features

The core is similar to the core of French 900 MW(e) PWRs with 28% lower power density than the standard French PWR. The core consists of 157 assemblies of 264 fuel rods in a 17 x 17 square array, with an active fuel height of 3.667 m. The central position in each fuel assembly may be used for in­core instrumentation, and 24 positions have guide tubes for control rods. The core thermal power is 2 000 MW.

It is a soluble boron free core. The reactivity is controlled with integrated CRDM (control rod drive mechanism).

The most effective means of describing the function of each of these passive safety systems is to relate their operation in response to a LOCA. As shown in Fig. VI-6, the GE divides the LOCA transient into three regions: 1) blowdown period, 2) GDCS period, and 3) long term PCCS period.

Throughout overall LOCA transient and ECCS operation, the long term core decay heat is removed in three steps. First, the GDCS injects water into the RPV, removing core energy by boiling and venting steam into the DW through DPVs, which remain open once activated. Heat is removed from the core by natural circulation flow within the RPV. Second, the PCCS transfers energy from the DW to the PCCS/ICS pools by condensing steam from the DW in the PCCS condensers. Third, the PCCS/ICS pools transfer their energy to the atmosphere outside the containment by vaporizing pool water and venting it. The PCCS also feeds the condensate to the GDCS pools and vents noncondensable gases to the SP which enhances condensation in the PCCS pools.

There are two natural circulation mechanisms during a LOCA event. One natural circulation mechanism is natural circulation inside the RPV. Once the core is shut down, the natural circulation flow is established inside the RPV to cool down the core. The other natural circulation mechanism is natural circulation through the RPV, DW, PCCS and GDCS. The steam ejected to the DW, is condensed in the PCCS and returned to the RPV via the GDCS.

The initial state of NPP is the operation at rated power. As a result of an initial event, loss of all sources of alternating current electrical power, all MCPs (main coolant pumps) are tripped, stop valves of a turbine generator are closed, the primary circuit makeup-blowdown system is disconnected, the power supply to pressurizer is disconnected, BRU-Ks (steam dump valve to turbine) are disconnected, and the main and auxiliary feedwater systems of secondary circuit are stopped. Besides as a result of diesel generators failure to start all active safety systems do not function.

After scram (because of three or more MCPs switching-off) the reactor power reduces down to a residual heat level. After the ending of MCPs coastdown the natural circulation of the primary coolant is established. Firstly the heat removal from the primary circuit is carried out due to BRU-A (steam dump valve to the atmosphere) operation, and then via steam generator pulse safety device. As a result of SPOT operation the part of heat from primary circuit is removed in an environment, and other heat is removed through BRU-A (loss of the boiler water from steam generator proceeds). After appropriate decreasing of residual heat, dumping devices of the second circuit are closed, and loss of boiler water from steam generator stops. The heat removal from the primary circuit is carried out due to steam generator PHRS operation under the closed circuit, steam is condensed in heat exchanger modules, and the condensate returns back in steam generator. The reliable cooling of the core is provided. Thus, results of calculation show that steam generator PHRS operation prevents any core damage in considered BDBA.

XIII-9. Conclusions

A number of relatively innovative passive safety means are used in the new Russian plant designs with V-392 reactors to fulfil the fundamental safety functions; such as reactivity control, fuel cooling, and radioactivity confinement. For example, the estimated core melt frequency for V-392 is three orders of magnitude less than the V-320 reactor. The engineering solutions using natural circulation in V-392 design increases the safety level compared to operating WWER-1000 plants.

REFERENCES TO ANNEX XIII

[1] INTERNATIONAL ATOMIC ENERGY AGENCY, Natural circulation data and methods for advanced water cooled nuclear power plant designs, IAEA-TECDOC-1281, Vienna (2000).

[2] INTERNATIONAL ATOMIC ENERGY AGENCY, Status of advanced light water reactor designs 2004, IAEA-TECDOC-1391, Vienna (2004).