Load combination

4.59. Identified loads should be combined with account taken of:

— Load type (i. e. static or dynamic, global or local);

— Whether loads are consequential or simultaneous (e. g. LOCA pressure and temperature loads);

— Time history of each load (to avoid the unrealistic superposition of load peaks if they cannot occur coincidently);

— Probability of occurrence of each load combination.

4.60. In general, load combinations for normal operations and for design basis accidents are taken into account in the relevant design codes. The inclusion of selected severe accidents in the load combination should be considered (para. 6.8).

4.61. At the end of the analysis the number of load combinations may be reduced by grouping them appropriately. The analysis will be performed only for the most demanding cases.

Acceptance criteria

4.62. For each load combination, appropriate acceptance criteria should be determined in terms of allowable stresses, deformations and leaktightness, where applicable. Definitions of allowable stresses and deformations are specific to each design standard and to each type of containment material.

4.63. Codes for the structural design of containment systems provide allowable stress limits for the ‘design’ load combination and test stress limits for the ‘test’ load combination (Table 3). Acceptance criteria for these load combinations should be derived from the structural design code applied.

4.64. For all other load combinations, acceptance limits should be defined according to the expected performance. Design margins should be provided by either:

— Limiting stresses to some fraction of the ultimate limit for that material; or

— Use of the load factor approach (i. e. increasing the applied loads by a certain factor).

4.65. A limited number of acceptance criteria (levels) should be defined for structural integrity and leaktightness as proposed below. This approach is general and applicable to containments of all types.

4.66. For the structural integrity of the containment, the following levels should be considered:

a SL-2, seismic level 2. b DBA, design basis accident.

K>

MO

— Level I: elastic range. No permanent deformation of, or damage to, the containment structure occurs. Structural integrity is ensured with large margins.

— Level II: small permanent deformations. Local permanent deformations are possible. Structural integrity is ensured, although with margins smaller than those for Level I.

— Level III: large permanent deformations. Significant permanent deforma­tions are possible, and some local damage is also expected. Normally this level is not considered in analysing design basis accidents (see paras 6.8­6.11 for consideration of severe accidents).

4.67. For leaktightness, the following levels should be considered:

— Level I: leaktight structure. Leakages from the containment are below the design value and can be correlated with the internal pressure.

— Level II: possible limited increase of leak rate. The leak rate may exceed the design value, but the leaktightness can be adequately estimated and considered in the design.

— Level III: large or very large increase of leak rate. Leaktightness cannot be ensured owing to large deformations of the containment structure. Structural integrity may still be ensured.

4.68. Acceptance levels for structural integrity and leaktightness should be indicated for each load combination included in the design basis. The acceptance levels should be selected according to the expected performance determined by safety considerations.

Concrete

4.196. Concrete should have characteristics of quality and performance (strength, porosity and tightness) consistent with its use. The quality of the concrete used for containment structures should be correspondingly high, consistent with the safety function of the containment. Design considerations will depend on the containment concept: a concrete containment with stressed cables usually ensures both strength and leaktightness, whereas a reinforced concrete containment structure usually ensures only strength while its steel liner ensures leaktightness.

4.197. Consideration should be given to the design capacity of the concrete to cope with the loads (pressure loads and thermal loads) and environmental conditions (of heat, moisture and radiation) generated by design basis accidents. This should lead to strict specifications for the concrete in terms of strength and leaktightness.

4.198. Concrete with appropriate rigidity, thermal expansion and resistance to compression should be used for all electrical penetrations, large penetrations such as equipment hatches and the joint with the basemat.

4.199. In prestressed containments, the concrete should remain in a prestressed condition even in accident conditions. Concrete materials that would limit creep or shrinkage over the years and with low porosity should be used. The possible loss of prestress of the containment tendons over the operating lifetime of the plant should be evaluated and considered in the design.

4.200. Sleeve-concrete interfaces should be designed to minimize leaks by avoiding direct paths through the interface.

4.201. Design and construction processes should be such as to prevent the development of cracks or high leak zones.

4.202. Ageing effects are required to be evaluated in the selection and design of types of concrete (para. 4.39 and Ref. [1], para. 5.47).

I-4. A typical full pressure double wall containment (Fig. I-2) consists of:

— A steel or concrete shell, basically cylindrical or spherical in shape (the containment);

— A concrete shell surrounding this containment (the secondary confinement);

FIG. I-2. Schematic diagram of a full pressure double wall containment system for a pressurized water reactor: 1, full pressure containment; 2, secondary confinement; 3, annulus; 4, annulus evacuation system; 5, filtered air discharged system.

— An air extraction system for the annulus (the space between the containment and the secondary confinement).

I-5. The principle of the primary containment is similar to that of the full pressure dry containment in pressurized water reactors (paras I-2 and I-3). The secondary confinement fulfils the following three functions:

— In combination with the containment, it provides radiation shielding for plant personnel and the environment in normal operation and under accident conditions.

— It protects the systems and components that it contains against external postulated initiating events.

— It captures leakage from the containment in the annulus between the two shells.

I-6. Safety systems such as the emergency core cooling system and the high pressure boron injection system may be located in the annulus between the two shells if they can withstand the thermal loads and pressure loads calculated for design basis accidents. Leaks from the containment into the annulus are extracted and filtered under accident conditions by an air removal system, and their emission through the plant stack is controlled.

One of the statutory functions of the IAEA is to establish or adopt standards of safety for the protection of health, life and property in the development and application of nuclear energy for peaceful purposes, and to provide for the application of these standards to its own operations as well as to assisted operations and, at the request of the parties, to operations under any bilateral or multilateral arrangement, or, at the request of a State, to any of that State’s activities in the field of nuclear energy.

The following bodies oversee the development of safety standards: the Commission on Safety Standards (CSS); the Nuclear Safety Standards Committee (NUSSC); the Radiation Safety Standards Committee (RASSC); the Transport Safety Standards Committee (TRANSSC); and the Waste Safety Standards Committee (WASSC). Member States are widely represented on these committees.

In order to ensure the broadest international consensus, safety standards are also submitted to all Member States for comment before approval by the IAEA Board of Governors (for Safety Fundamentals and Safety Requirements) or, on behalf of the Director General, by the Publications Committee (for Safety Guides).

The IAEA’s safety standards are not legally binding on Member States but may be adopted by them, at their own discretion, for use in national regulations in respect of their own activities. The standards are binding on the IAEA in relation to its own operations and on States in relation to operations assisted by the IAEA. Any State wishing to enter into an agreement with the IAEA for its assistance in connection with the siting, design, construction, commissioning, operation or decommissioning of a nuclear facility or any other activities will be required to follow those parts of the safety standards that pertain to the activities to be covered by the agreement. However, it should be recalled that the final decisions and legal responsibilities in any licensing procedures rest with the States.

Although the safety standards establish an essential basis for safety, the incorporation of more detailed requirements, in accordance with national practice, may also be necessary. Moreover, there will generally be special aspects that need to be assessed on a case by case basis.

The physical protection of fissile and radioactive materials and of nuclear power plants as a whole is mentioned where appropriate but is not treated in detail; obligations of States in this respect should be addressed on the basis of the relevant instruments and publications developed under the auspices of the IAEA. Non-radiological aspects of industrial safety and environmental protection are also not explicitly considered; it is recognized that States should fulfil their international undertakings and obligations in relation to these.

The requirements and recommendations set forth in the IAEA safety standards might not be fully satisfied by some facilities built to earlier standards. Decisions on the way in which the safety standards are applied to such facilities will be taken by individual States.

The attention of States is drawn to the fact that the safety standards of the IAEA, while not legally binding, are developed with the aim of ensuring that the peaceful uses of nuclear energy and of radioactive materials are undertaken in a manner that enables States to meet their obligations under generally accepted principles of international law and rules such as those relating to environmental protection. According to one such general principle, the territory of a State must not be used in such a way as to cause damage in another State. States thus have an obligation of diligence and standard of care.

Civil nuclear activities conducted within the jurisdiction of States are, as any other activities, subject to obligations to which States may subscribe under international conventions, in addition to generally accepted principles of international law. States are expected to adopt within their national legal systems such legislation (including regulations) and other standards and measures as may be necessary to fulfil all of their international obligations effectively.

EDITORIAL NOTE

An appendix, when included, is considered to form an integral part of the standard and to have the same status as the main text. Annexes, footnotes and bibliographies, if included, are used to provide additional information or practical examples that might be helpful to the user.

The safety standards use the form ‘shall’ in making statements about requirements, responsibilities and obligations. Use of the form ‘should’ denotes recommendations of a desired option.

The English version of the text is the authoritative version.

4.90. The energy management function of the spray system is to remove thermal energy from the containment atmosphere in order to limit both the maximum values and the time durations of the high pressures and tempera­tures within the containment envelope following a design basis accident.

4.91. Containment spray systems should be designed so that a major fraction of the free volume of the containment envelope into which the steam may escape in an accident can be sprayed with water after a LOCA. For ice condenser containments, consideration should be given to installing spray systems in both the upper and the lower compartments (para. 4.110).

4.92. The spray headers and nozzles should be designed to provide an even distribution of water droplets, which should be small enough to reach thermal equilibrium with the containment atmosphere quickly during their fall.

4.93. The initial source of water for the containment spray system after a pipe rupture is usually a large storage tank. Later the spray system may operate in a recirculation mode and take water from appropriate collection points in the containment sump or the suppression pool. In determining the necessary capacity of these collection points, the need to protect equipment important to safety by preventing its submergence or by ensuring its operability despite its submergence should be taken into account in the design. Where this is not feasible the equipment should be relocated.

4.94. When the spray system is designed to operate in a recirculation mode, the spray nozzles should be designed against clogging by the largest postulated pieces of debris that can reach them through the intake screens. In the same way, the spray pumps should be designed to cope with cavitation or failure due to debris in the pump suction lines.

4.95. The pressure limiting effect of spray systems may depend on the time necessary for spray to be delivered after a LOCA. The delay time for spray delivery should therefore be determined for use in analyses of containment pressure and temperature transients. The actuation times of components and the time necessary to fill the spray piping, headers and nozzles should be taken into account in the analyses.

5.1. In order to demonstrate that the containment systems meet design and safety requirements, commissioning and in-service tests and inspections should be conducted as outlined in the following.

COMMISSIONING TESTS

5.2. Commissioning tests for the containment should be carried out prior to the first criticality of the reactor to demonstrate the containment’s structural integrity, to determine the leak rate of the containment envelope and to confirm the functioning of related equipment.

Structural integrity test

5.3. A pressure test should be conducted to demonstrate the structural integrity of all parts of the containment envelope (including extensions and penetrations) and of the containment systems. If the containment structure comprises two containment walls that are both subject to pressure loads, both walls should be tested.

5.4. The pressure test should be conducted at a specified pressure for which account is taken of the applicable codes for the material used, and which is at least the design pressure. The value of the test temperature should not be close to the ductile-brittle transition temperature for the metallic material.

5.5. A leak test should be conducted following the structural integrity test to demonstrate that the leak rate of the containment envelope does not exceed the specified maximum leak rate. The test should be conducted with the components of the containment in a state representative of the conditions that would prevail following an accident, to demonstrate that the specified leak rate would not be exceeded under such conditions.

5.6. To establish a point of reference for future in-service leak tests, the leak test performed during commissioning should be conducted at a test pressure or pressures consistent with the pressure selected for in-service leak tests:

(a) At values of pressures between the pressure selected for in-service leak testing and the positive design pressure, if the in-service tests are to be conducted at a pressure lower than the design pressure; or

(b) At the design pressure of the containment, if the in-service tests are to be conducted at this pressure.

5.7. The need to validate the leak rate assumed in the safety analysis reliably over the entire plant operating lifetime for the entire range of pressures calculated should be taken into consideration in the choice of test pressure(s).

5.8. The need for initial and periodic testing should be considered in the design, and all the components that might be damaged during testing should be identified. The necessary means to pressurize and depressurize the containment and appropriate instrumentation for testing should be included in the design.

5.9. One way of determining leak rates is the absolute pressure method, in which the leakage flow is determined by measuring the decrease in pressure as a function of time. In this method, the temperature and pressure of the containment atmosphere, the external atmospheric temperature and pressure, and the humidity of the containment atmosphere should be measured continuously and factored into the evaluation. Means should be provided to ensure that the temperature and humidity of the containment atmosphere are uniform.

5.10. Appropriate instrumentation should be provided in the containment, appropriately positioned and installed either permanently or as needed, to

5.11. For double wall containments, one way to determine the direct leak rate from the containment to the environment (i. e. if the leaked water or gas does not collect in the annular space between the inner and the outer containment walls) is by calculation. This calculation should determine the difference between (a) the total leak rate from the inner containment as determined by the leak test for the inner containment (this consists of both flow from the inner containment into the annulus and flow from the inner containment to the atmosphere) and (b) the leak rate from the inner containment wall to the annulus, obtained after ventilation of the annulus has been stopped (this is typically calculated by subtracting the normal flow out of the annulus vent from the flow out of the annulus vent during the leak test).

III—9. Postulated in-vessel steam explosions are generally judged not to threaten the integrity of the containment.

III-10. Failure of the reactor vessel at high or low pressures, in conjunction with the presence of water within the reactor cavity, may lead to interactions between fuel and coolant with the potential for rapid steam generation or steam explosions. Rapid steam generation may give rise to the pressurization of containment compartments beyond the capability of the containment to relieve the pressure, so that the containment fails due to local overpressuri­zation. Steam explosions may be caused by the rapid mixing of finely fragmented core material with surrounding water, resulting in the rapid vaporization and acceleration of the surrounding water, creating substantial pressure and impact loads.

III-11. The presence of water in the reactor cavity can be avoided by means of a suitable layout if important components of the containment, such as the supporting reactor cavity wall and the containment liner, are not capable of resisting these high impulse loads.

1.53. A probabilistic safety assessment should be started early in the design process. The probabilistic safety assessment should be used for identification of the core damage frequency (in a Level 1 probabilistic safety assessment) as well as for determination of plant damage states and their frequency (often called a Level 1+ probabilistic safety assessment). These probabilistic safety assessment data are significant in helping to determine the main threats to containment integrity. The probabilistic safety assessment approach is described in Ref. [1], para. 5.73.

1.54. For assessing the design of containment systems, especially with regard to mitigation of the consequences of a severe accident, the probabilistic safety assessment should be extended to Level 2 and a determination should be made of whether sufficient provision has been made to mitigate the consequences of severe accidents. The Level 2 probabilistic safety assessment would address the question of whether the containment is adequately robust and whether the mitigation systems, such as hydrogen control systems and measures for cooling a molten core, provide a sufficient level of protection to prevent a major release of radioactive material to the environment. (See Section 6 for design considerations for severe accidents.)

4.145. Containment bypass events arise when a fault sequence allows primary coolant and any accompanying fission products to escape to the outside atmosphere without being processed by containment systems for the management of energy, radionuclides and combustible gases. In interfacing system LOCAs, valves isolating the low pressure piping fail and the piping connected to the reactor coolant system fails outside the containment. Possible paths for interfacing system LOCAs should be eliminated as far as possible, either by relocating the system in the containment or by increasing the design pressure of the low pressure system above the pressure of the reactor coolant system. For any remaining possible paths for interfacing system LOCAs, the provisions for isolation between the high pressure system and the low pressure system should be as reliable as is practicable.

4.146. In pressurized water reactors, a steam generator tube rupture is a containment bypass event that could lead to significant releases of radioactive material. Preventive design features should be installed in steam generators to reduce the frequency of such events to a very low value. The design of the plant should allow isolation of the containment bypass due to the damaged steam generator to be achieved before the authorized limits on radioactive discharges to the environment are reached [15].

5.58. For the management of severe accidents, appropriate instrumentation and procedures should be available to guide operator actions to initiate preventive or mitigatory measures. The instrumentation necessary for the management of severe accidents falls into four categories:

(1) Instrumentation for monitoring the general conditions in the containment;

(2) Instrumentation for monitoring the progression in the values of parameters of interest, specifically in relation to severe accidents;

(3) Instrumentation necessary for operators to execute emergency procedures;

(4) Instrumentation for assessing radiological consequences.

5.59. During and following a severe accident, in order to follow the general conditions in the containment and to facilitate the use of guidelines for the management of severe accidents, essential parameters for the containment such as pressures, temperatures, hydrogen concentrations, water levels and radiation dose rates should be monitored.

5.60. To follow the progression in the values of parameters specific to severe accidents, consideration should be given to the installation of instrumentation to measure the following parameters:

— The status of core depressurization devices (such as relief valves) for the early indication of possible high pressure melting of the core;

— The concentration of combustible gases, in order to assess the likelihood of fast deflagration or detonation;

— Pressure and temperature signals over a wide range, in order to detect possible late failure of the containment;

— The sump water level, as an indication of the amount of water available for long term injection into the core and for containment spraying.

5.61. In order to execute emergency procedures, the operator should have available controls and instrumentation for the containment systems provided specifically for the prevention and mitigation of severe accidents. These may include, for example:

— A filtered venting system;

— A monitoring and control system for combustible gases.

5.62. An assessment of the radiological consequences of a possible severe accident should be conducted in a timely manner to assist in decisions on long term actions for the protection of the population (off-site emergency measures). Instruments for assessing radiological consequences may include:

— Dose rate meters in the containment and in peripheral buildings housing systems that have interfaces with the primary systems;

— Instruments for monitoring conditions in the containment sump water (e. g. temperature and pH);

— Activity monitors for noble gases, iodine and aerosols in the stack(s).

5.63. The larger uncertainties with regard to conditions in the containment following a severe accident should be taken into account by means of appropriate margins in the ranges of operation of the instrumentation, in the domain for which its survivability is demonstrated and/or through protective measures for the instruments (such as shielding). Owing to these uncertainties and the different parameters that it may be necessary to monitor during severe accidents, it may or may not be possible under severe accident conditions to use the instrumentation provided for use in design basis accidents. If instrumen­tation provided for use in design basis accidents is intended to be used in severe accidents, the survivability domain of the instrumentation of the containment systems should be extended as far as is practicable to cope with the containment conditions expected in severe accidents.