4.53. All loads (static and dynamic) that are expected to occur over the plant lifetime or that are associated with postulated design basis accidents should be identified and grouped according to their probability of occurrence, on the basis of operating experience and engineering judgement. Such loads should be specified for each component of the containment structure.

4.54. The metallic liner of the containment (where applicable) should be able to withstand the effects of imposed loads and to accommodate relative movements of the liner and the concrete of the containment without jeopard­izing its leaktightness. The liner should not be credited in the structural evaluation for the resistance of the containment.

4.55. The containment structure should be designed to protect the primary pressure boundary and associated components from all the external events that were taken into account in the design.

4.56. The metallic structures, penetrations and isolation valves of the containment should be protected against the jet forces and missiles that could be generated in the course of design basis accidents, preferably by means of protective structures.

4.57. The primary containment together with its support systems should be designed to withstand the following events:

(a) An inadvertent drop in internal pressure below atmospheric pressure during normal operations and in accident conditions (e. g. due to the inadvertent operation of a spray system); the provision of vacuum breakers would be a means to limit subpressure loads.

(b) The pressurization of the space between the primary and the secondary containments (where applicable) in the case of a high energy line break inside that space, unless such a break is precluded by the design.

Both concerns are of particular importance for steel containments.

4.58. In Table 2 a typical set of loads on the containment that should normally be considered at the design stage is presented (its applicability to any particular design should be verified).

4.190. Penetrations (containment air locks) for access by personnel or equipment to the containment are required to have air locks equipped with doors that are interlocked to ensure that at least one of the doors is closed during reactor operations and in design basis accidents (Ref. [1], para. 6.58). In addition, they are required to be designed to prevent any undue exposure of operators to radiation in operational states of the plant.

4.191. The two air lock doors should be designed to withstand the same plant conditions as the containment. Local transient effects, such as exposure to open flames caused by hydrogen burning, need not be considered for the outer door.

4.192. The chamber between the two air lock doors should be so sized as to allow the passage of necessary maintenance equipment and a sufficient number of personnel, so as to avoid having to open the air lock too frequently during plant shutdown and maintenance.

4.193. The inner door of the air locks should be of a pressure sealing type. Double seals should be provided on each door and there should be provisions for testing the leaktightness of the doors and the inter-seal space. Low pressure alarms should be provided if inflatable seals are used.

4.194. Equipment hatches are large openings in the containment structure that are normally closed. They are usually designed with a bolted flange, whose leaktightness is ensured by means of soft elastomeric seals. Leak testable double seals should normally be provided. Loads and deformations due to temperature effects should be taken into account in the design of equipment hatches. In order to transport large components, the need may arise to open equipment hatches in certain reactor states other than full shutdown and for which the risk is sufficiently low. The containment should only be opened for such conditions if provision can be made for the rapid closure of equipment hatches, consistent with the possible kinetics of the accidents considered in the design basis for the reactor state concerned.

4.195. Containment openings (i. e. penetrations, air locks and hatches) should normally be closed in order to minimize the active measures required for containment isolation in the event of an accident. Exceptions are allowed if they are necessary for operational reasons and provided that the openings can be closed quickly and reliably to comply with established acceptance criteria that apply for the accident. Provisions for indicating the state of the containment openings should be put in place.

I-1. This annex presents short descriptions of several concepts for containment systems now in use or in an advanced stage of design. The descrip­tions are not comprehensive but are intended to provide a general overview of how certain containment subsystems have been combined to carry out the containment functions.

FULL PRESSURE DRY CONTAINMENT IN PRESSURIZED WATER REACTORS

I-2. In this concept (Fig. I-1), the primary containment envelope is a steel shell or a concrete building (cylindrical or spherical) with a steel liner that surrounds the nuclear steam supply system. The containment encompasses all components of the reactor coolant system under primary pressure. It is designed as a full pressure containment; i. e. it is able to withstand the increases in pressure and temperature that occur in the event of any design basis accident, especially a LOCA. The atmospheric pressure in the containment envelope is usually maintained at a substantial negative gauge pressure during normal operations by means of a filtered air discharge system (i. e. a fan and HEPA filter).

I-3. Energy management in the building can be accomplished by an air cooler system or by a water spray system. In addition, the free volume of the containment and the structural heat sinks (the containment envelope and the structures within it) are used to limit peak pressures and temperatures in postulated conditions for pipe rupture accidents. The initial supply of water for the spray system and for the emergency core cooling system is held in a large tank. When this water has been used, suction for both the spray system and the emergency core cooling system is switched to the containment building sump. Water that is recirculated to the reactor vessel is sometimes cooled by means of heat exchangers. In most designs the recirculation water for the spray headers — which is also used to limit contamination of the containment atmosphere — is cooled by means of heat exchangers. When pipes rupture in systems other than the reactor coolant system, only the spray system is operated in the recircu­lation mode.

(T) Pump

Blower, fan

FIG. I-1. Schematic diagram of a full pressure dry containment system for a pressurized water reactor: 1, containment; 2, containment spray system; 3, filtered air discharge system; 4, liner.

4.88. The free volume of the space within the containment envelope is the primary physical parameter determining peak pressures after postulated pipe rupture events. It can thus be used as an inherently safe and reliable design feature. If the volume of the containment is subdivided into compartments that are provided with collapsing panels or louvres that open in the event of LOCAs, these collapsing panels or louvres should be designed to open quickly at the predetermined pressure so as to achieve fast equalization of the pressures in the various compartments and to utilize the full free volume of the containment.

4.89. The containment structure and its internal structures, as well as the water stored within the containment, act as a passive heat sink. In the postulated conditions of a pipe rupture accident, the rate of transfer of heat to structures is an important parameter in determining pressures and temperatures. The primary mechanism for heat transfer is the condensation of steam on exposed surfaces, and the thermal conductivity of the structure plays an important part in determining the rate of heat transfer. All conditions that could affect the transfer of heat to the structures, such as the effects of coatings or gaps, should be considered in a conservative manner in the design, and adequate margins should be applied.

4.235. The containment systems should be designed to continue fulfilling their functions following a loss of off-site power with a single failure taken into account. Electrical isolation valves that would have to be closed using electric power in a design basis accident should be provided with non-interruptible power supplies.

Compressed air systems

4.236. Containment isolation valves with a clear safe position should be designed to move to their safe positions in the event of a loss of pneumatic pressure.

4.237. If the operation of pneumatic valves is necessary during a design basis accident, the autonomy of the compressed air system (such as by means of having reserve air tanks) should be demonstrated. Otherwise, installation of a backup compressed air system should be considered. Where reserve air supply tanks are installed inside the containment, the increased internal pressures caused by the high temperatures in the containment during design basis accidents should be taken into account in their design.

4.238. The compressed air systems should be designed in such a way as to avoid a containment bypass or pressurization of the containment. Safety systems that are needed in the long term after a design basis accident should therefore not depend on compressed air systems for fulfilling their safety functions. To avoid gradual pressurization of the containment due to the leakage of compressed air systems, consideration should be given to the instal­lation of a dedicated post-accident compressed air system to supply instruments inside the containment with air exhausted from the containment.

III—1. A severe accident is defined as one for which the accident conditions are more severe than those for a design basis accident and involve significant core degradation. Severe accidents begin with loss of cooling for the reactor core and initial heating-up of the fuel, and continue until either:

(a) The degraded core is stabilized and cooled within the reactor pressure vessel, or

(b) The fuel overheats to the point of melting, the reactor pressure vessel is breached and molten core material is released into the containment.

The potential detrimental effects of a severe accident include:

— Overheating and overpressurization of the containment due to molten core material settling into the reactor cavity,

— The generation of significant amounts of hydrogen and other non­condensable gases owing to the interaction between molten core material and concrete,

— Structural damage to metallic components of the containment due to direct contact with molten core material,

— High pressure ejection of molten core material and subsequent rapid direct heating of the containment.

III-2. The phase of progressive in-vessel heating-up and melting establishes the initial conditions for the assessment of the thermal and mechanical loads that may ultimately threaten the integrity of the containment.

III-3. The ex-vessel progression of severe accidents is affected by the mode and timing of the failure of the reactor pressure vessel, the pressure in the reactor coolant system at vessel failure, the composition, amount and nature of the molten core debris expelled, the type of concrete used in the construction of the containment, and the availability of water in the reactor cavity. Some highly energetic phenomena may be caused by severe accidents. Such phenomena could cause the ultimate load bearing capacity of containments constructed by means of existing technologies to be exceeded, and conse­quently lead to a large early release of radionuclides to the environment.

III-4. For some reactor types the risks associated with severe accidents occurring in conjunction with high pressures in the reactor coolant system would, without countermeasures, contribute significantly to the overall risks associated with severe accidents. Severe accidents occurring in conjunction with high pressures in the reactor coolant system could give rise to unacceptable challenges to the containment barrier.

III—5. At high pressures in the reactor coolant system, the molten core material from the reactor vessel could be ejected in jet form, causing fragmen­tation into small particles. It may be possible for the core debris ejected from the vessel to be swept out of the reactor cavity and into the upper containment. Finely fragmented and dispersed core debris could cause the containment atmosphere to heat up, leading to large pressure spikes. In addition, chemical reactions of the particulate core debris with oxygen and steam could add to the pressurization loads. Hydrogen, either pre-existing in the containment or produced during the direct heating of the containment, could ignite, adding to the loads on the containment. This phenomenon is known as high pressure melt ejection with direct containment heating.

III—6. Loads due to a direct containment heating event may be mitigated by using a design of reactor cavity that reduces the amount of ejected core debris that reaches the upper containment, to the extent that the features of any such design do not unduly interfere with plant operations, including refuelling, maintenance or surveillance activities. Examples of design features of the cavity that would reduce the amount of ejected core debris that reaches the upper containment include:

(a) Ledges or walls to deflect core debris,

(b) Indirect paths from the lower reactor cavity to the upper containment. CONTAINMENT BYPASS

III-7. For pressurized water reactors, the likelihood of creep failure of steam generator tubes for some severe accidents at high pressure of the reactor coolant is not negligible, with the possible consequence of a containment bypass.

III—8. To minimize the potential for containment failure or containment bypass in severe accidents at high pressures of the reactor coolant, the plant features may be enhanced, if necessary, to depressurize the reactor coolant system reliably so as to prevent this process from occurring.

1.51. For the design of the structures and systems of the containment, widely accepted codes and standards are required to be used (Ref. [1], para. 5.21). The selected codes and standards:

— should be applicable to the particular concept of the design;

— should form an integrated and comprehensive set of standards and criteria;

— should normally not use data and knowledge that are unavailable in the host State, unless such data can be analysed and shown to be relevant to the specific design, and the use of such data represents an enhancement of safety for the containment design.

1.52. Codes and standards have been developed by various national and inter­national organizations, covering areas such as:

— Materials,

— Manufacturing (e. g. welding),

— Civil structures,

— Pressure vessels and pipes,

— Instrumentation and control,

— Environmental and seismic qualification,

— Pre-service and in-service inspection and testing,

— Quality assurance,

— Fire protection.

4.138. Water pools or tanks through which the containment atmosphere is bubbled for steam condensation should be considered a valuable means for the removal of radioactive products. However, care should be taken in evaluating the efficiency of such a process, since it is dependent on the thermodynamic conditions of water and steam. For example, the degree of subcooling of the water and the consequent efficiency of steam condensation have a significant effect on the scrubbing efficiency of a suppression pool.

Ventilation and venting systems

4.139. Where ventilation systems are used for cleaning exhaust air to mitigate the consequences of an accident, filters should be so designed and maintained as to preclude any loading of the filters with pollutants beyond authorized limits prior to their use in relation to an accident.

4.140. The ventilation system should, if necessary, be provided with equipment (such as moisture separators and preheaters before the filters) to prevent the temperature from dropping below the dew point at the air filter inlet.

4.141. The efficiency of the sorption material in iodine filters should be demonstrated in laboratory tests under simulated accident conditions as deemed appropriate. Provisions should be made to test periodically the filter system in situ.

4.142. Ventilation systems are often used to collect, filter and discharge air from the interspace of double containment systems or from a secondary confinement, which may become contaminated with airborne radionuclides in accident conditions as a result of leakage from the containment. For such cases the recommendations in paras 4.139-4.141 apply.

4.143. Where containment venting systems are installed, the discharge should be filtered to control the release of radionuclides to the environment [15]. Typical filter systems include sand, multi-venturi scrubber systems, HEPA or charcoal filters, or a combination of these. HEPA, sand or charcoal filters may not be necessary if the air is scrubbed in a water pool.

4.144. Noble gases cannot be filtered out, but consideration should be given to the use of systems to delay their release until further radioactive decay has occurred.

5.52. In a severe accident, a large amount of hydrogen might be released to the atmosphere of the containment, possibly exceeding the ignition limit and jeopardizing the integrity of the containment. In the event of interactions between molten core material and concrete, carbon monoxide might also be released, contributing to the hazard. To assess the need to install special features to control combustible gases, an assessment of the threats to the containment posed by such gases should be made for selected severe accident sequences. The assessment should cover the generation, transport and mixing of combustible gases in the containment, combustion phenomena (diffusion flames, deflagrations and detonations) and the consequent thermal and mechanical loads, and the efficiency of systems for the prevention of accidents and the mitigation of their consequences.

5.53. Uncertainties remain concerning the production of hydrogen during severe accident sequences; these uncertainties are essentially linked to such phenomena as flooding of a partially damaged core at high temperatures, the late phase of core degradation, the slumping of molten core material into residual water in the lower head of the reactor pressure vessel, and the long term interactions between molten core material and concrete. For new plants, these uncertainties should be taken into account in the design and layout of the means of mitigation of the consequences of the combustion or deflagration of hydrogen, and in the design of the containment.

5.54. The efficiency of the means of mitigation of the consequences of combustion or deflagration should be such that the concentrations of hydrogen in the compartments of the containment would at all times be low enough to preclude fast global deflagration or detonation. Possible provisions in the design for achieving this goal are, for example, an enhanced natural mixing capability of the containment atmosphere coupled with a sufficiently large free volume, passive autocatalytic recombiners and/or igniters suitably distributed in the containment, and inerting. For new plants the amount of hydrogen expected to be generated should be estimated on the basis of the assumption of total oxidation of the fuel cladding.

5.55. The leaktightness of the containment for the most representative accident sequences should be ensured with sufficient margins to accommodate severe dynamic phenomena such as a fast local deflagration, if these phenomena cannot be excluded.

5.56. Even in an inerted containment, the concentrations of hydrogen and oxygen generated over a long period of time by water radiolysis may eventually exceed the ignition limit. If this is a possible threat, a hydrogen control system, passive hydrogen recombiners or other appropriate systems for mitigation and monitoring (e. g. systems for oxygen control and measurement) should be installed.

5.57. Provision should be made for hydrogen monitoring or sampling. The concentrations of other combustible gases and oxygen should also be monitored.