4.69. Table 3 presents a minimum set of recommended load combinations for a typical pressurized water reactor. Their applicability should be checked and the list modified or new lists created for specific applications, with account taken of the actual features of the design. For example, design specific load tables may be needed for penetrations, air locks or hatches. Load combinations for selected severe accidents are not included in the table (for a discussion of severe accidents, see Section 6). Table 3 also shows the recommended acceptance criteria for each load combination.

4.70. Loads resulting from an SL-2[6] earthquake [14] and design basis accidents should be combined, although one cannot realistically be a consequence of the other since the pressure boundary is designed to withstand an SL-2 earthquake.[7]

4.203. Metallic materials used for containment systems, including welds, should be of high quality; qualified and certified materials that meet national safety standards should be used.

4.204. In the selection of metallic materials, the following considerations should be taken into account:

— Thermal and mechanical loads;

— Chemical interactions, including those with chemicals used in containment spray systems;

— Resistance to brittle fracture;

— Resistance to corrosion.

4.205. Metallic materials such as zinc and aluminium that have the potential to generate hydrogen on contact with water or steam should not be used inside the containment. If such materials are essential to the design, their use should be limited and the effects of hydrogen generation should be analysed.

I-7. The ice condenser containment (Fig. I-3) system in pressurized water reactors uses a concept for the pressure suppression system in which the high pressure steam-air mixture resulting from an accident conditions pipe rupture is directed through vent doors into chambers containing baskets filled with ice. The steam condenses onto the surface of the ice in the baskets.

I-8. The containment is formed by a cylindrical structure divided into three isolated compartments: the lower area, which contains all the major components of the reactor coolant system, the ice condenser chambers and the main upper containment volume. Non-condensable gases (including noble gas fission products), which are forced into the ice condenser chambers, are vented through doors into the main upper containment volume.

I-9. An active spray system is used in the lower containment volume to reduce pressures and temperatures and to remove airborne radioiodine from the containment volume. The initial source of water for this system is a water storage tank.

I-10. After exhaustion of this water supply, a recirculation mode is initiated wherein the water is pumped from the building sump through a heat exchanger and then returned to the spray headers.

FIG. I-3. Schematic diagram of an ice condenser containment system for a pressurized water reactor; 1, containment; 2, upper containment volume; 3, ice condenser; 4, lower containment volume; 5, lower containment spray system; 6, filtered air discharge system; 7, liner.

BACKGROUND

1.1. This Safety Guide was prepared under the IAEA programme for safety standards for nuclear power plants. It is a revision of the Safety Guide on Design of the Reactor Containment Systems in Nuclear Power Plants (Safety Series No. 50-SG-D12) issued in 1985 and supplements the Safety Require­ments publication on Safety of Nuclear Power Plants: Design [1]. The present Safety Guide was prepared on the basis of a systematic review of the relevant publications, including the Safety of Nuclear Power Plants: Design [1], the Safety Fundamentals publication on The Safety of Nuclear Installations [2], Safety Guides [3-5], INSAG Reports [6, 7], a Technical Report [8] and other publications covering the safety of nuclear power plants.

1.2. The confinement of radioactive material in a nuclear plant, including the control of discharges and the minimization of releases, is a fundamental safety function to be ensured in normal operational modes, for anticipated operational occurrences, in design basis accidents and, to the extent practi­cable, in selected beyond design basis accidents (see Ref. [1], para. 4.6). In accordance with the concept of defence in depth, this fundamental safety function is achieved by means of several barriers and levels of defence [6]. In most designs, the third and fourth levels of defence are achieved mainly by means of a strong structure enveloping the nuclear reactor. This structure is called the ‘containment structure’ or simply the ‘containment’. This definition also applies to double wall containments.

1.3. The containment structure also protects the reactor against external events and provides radiation shielding in operational states and accident conditions. The containment structure and its associated systems with the functions of isolation, energy management, and control of radionuclides and combustible gases are referred to as the containment systems.

4.96. In LOCA conditions, containment air cooling systems may operate largely in the condensing heat transfer mode. Appropriate analytical correla­tions of heat transfer rates with temperatures, pressures and steam content should therefore be used in the design and for the testing.

4.97. The evolution of the atmospheric density during a design basis accident should be taken into account in the design of the air cooler fans. The heat removal capacity of the cooling water supplied to the air coolers should be such as to preclude boiling on the coolant side. In addition, the cooling water system for the air coolers should be designed to allow the resumption of cooling water flow following a temporary interruption to that flow.

Pressure suppression pool systems

Bubble condenser suppression pool systems

4.98. Containments of a design with a suppression pool system are divided into two separate compartments called the dry well (which contains the reactor) and the wet well (which contains the suppression pool). The two compartments are normally isolated from one another. When the pressure in the dry well is sufficiently higher than the pressure in the wet well, steam and gases flow from the dry well to the wet well and the steam condenses into the pool of water. In some designs, communication between the dry well and the wet well can also occur if the pressure in the wet well is higher than the pressure in the dry well. In the containments of some designs the suppression pools are also used to collect the steam discharged from the safety valves or the relief valves, or to provide water for recirculation in the emergency core cooling system. Complex hydraulic and pressure transients occur when steam and gases are vented into the suppression pool water. The design of the dry and wet wells should be such that the hydraulic responses and the dynamic loads can be reliably determined by analysis and tests.

4.99. The hydraulic response and the loading function associated with various likely combinations of normal operating events and anticipated operational occurrences should be determined.

4.100. The structural design of the pressure suppression pool system should be such as to ensure that the pool, as well as the containment system as a whole and other safety systems, remains functional in all operational states and/or all postulated accident conditions.

4.101. The pressure suppression pool system should be designed in such a way that the pathway for steam and gases from the dry well to enter the wet well following a postulated LOCA is through submerged vents in the wet well water pool.

4.102. The leakage between the dry well and the wet well that bypasses the submerged venting lines should be minimized and should be taken into account in the design.

4.103. The use of the pressure suppression pool system for other functions should not impair the performance of its main function of providing a means of control in LOCAs.

4.104. The dry well should be designed to withstand, or should be protected from (e. g. by automatic vacuum breaker valves), excessive underpressure caused by operation of the spray system either inadvertently or following a LOCA.

Jet condenser suppression pool systems

4.105. Jet condensers are pressure suppression devices installed to cope with LOCAs. Condensation of steam released from the reactor cooling circuits is achieved by direct contact with and/or mixing with cold water in a mixing chamber of the condenser. The condenser is often located in a water pool that is also used for other purposes, for example as an emergency water tank. Construction of the condenser should be such as to ensure that the mixing and condensation processes take place in the upper part of the condenser, and that warm condensate is released to the top of the water pool while the cold water necessary for condensation is drawn from the bottom of the pool.

4.106. Jet condensers should have the following characteristics:

— The design should be such as to enable the containment structure to withstand thermal loads and pressure loads throughout a design basis accident, including those during the very first few seconds.

— Mixing and condensation should be localized in the condenser, without affecting the walls and equipment in the large water pool.

— The entire volume of water available for pressure suppression should be used effectively.

— The condenser should work efficiently over the wide range of mass flow rates of steam to be condensed.

— Condensation of steam should be stable, without large oscillations, as a result of needing only a low pressure differential for maintaining the flow through the condenser.

— The formation and rapid condensation of large steam bubbles, which could cause pressure waves in the water pool, should be avoided.

— The carryover of water from the water pool into the venting line should be minimized.

5.12. Leak tests should be performed to establish a baseline leakage measurement for each isolation device, air lock and penetration. The following components are the most sensitive parts of the containment envelope, and special attention should be paid to them:

(a) Isolation devices in systems open to the containment atmosphere;

(b) Isolation devices in fluid system lines penetrating the containment;

(c) Penetrations that have resilient or inflatable seals and expansion bellows, such as:

— personnel air locks,

— equipment air locks,

— equipment hatches,

— spare penetrations with bolted closures,

— cable penetrations with resilient seals,

— pipe penetrations with flexible expansion bellows in the connections to the containment.

III—12. The generation and combustion of large volumes of hydrogen and carbon monoxide are severe accident phenomena that can threaten the integrity of the containment. The major cause of the generation of hydrogen is the oxidation of zirconium metal and, to a lesser extent, the interaction of steel or any other metallic component with steam when the metal reaches tempera­tures well above normal operating temperatures.

III—13. In addition, ex-vessel hydrogen generation needs to be considered. Such hydrogen is produced mainly as a result of the reactions of ex-vessel metallic core debris with steam, and in the long term by molten core-concrete interactions (para. III-17) and by the extended radiolysis of sump water.

III-14. Molten core-concrete interactions may also produce carbon monoxide, which is also combustible under certain conditions.

III-15. Under severe accident conditions, significant hydrogen concentrations could be reached locally in a short time (of the order of some minutes to an hour, depending on the containment design, the scenario and the location) and globally in a longer period of time.

III-16. When the ignition limit is exceeded, combustion of hydrogen is possible and can take different forms, depending on the concentrations, the atmospheric conditions in the containment and the geometry: diffusion flames (which are mainly responsible for thermal loads), slow deflagrations (which are mainly responsible for quasi-static pressure loads), fast deflagrations (for which dynamic effects become important) and detonations (for which the velocity of the flame front exceeds the speed of sound in the unburnt gas, giving rise to extremely severe dynamic effects). Depending on the mode of combustion, the integrity of the containment may be threatened by stresses beyond the structural design limits.

GENERAL

Performance of containment systems

1.55. The performance parameters for containment systems should be established in accordance with the functions to be performed in the operational states or design basis accident conditions assumed in the design of the plant. In particular, performance in terms of structural behaviour and leaktightness should be established for the entire period of an accident, including recovery of the plant and establishment of safe shutdown conditions.

1.56. On the basis of the performance parameters, the analyses carried out for each postulated initiating event and each set of plant operating conditions should define a set of design parameters for each containment system. The strictest set of these parameters should become the design basis for each containment system. Examples of these design parameters include heat transfer rates, response times for the actuation of safety features, and the closing and opening times of valves.

1.57. Containment systems should be so designed that their instrumentation and control systems and electrical, structural and mechanical parts are compatible with each other and with other items important to safety.

1.58. Attention should be paid to accidents initiated in shutdown states (e. g. with the containment open and systems disabled for maintenance). In this condition the configuration of the containment systems may be different from their configuration under power, and attention should be paid to the redundancy levels and specific failure modes of systems and equipment. In some cases the containment may lose leaktightness because a hatch or a personnel lock has to remain open for a certain period of time. The time necessary for closure of the hatches or personnel locks should be compatible with the kinetics of the accidents postulated to occur in these conditions.

4.147. A double wall containment is an arrangement with the primary containment completely enclosed in a secondary containment. The purpose of the secondary containment is not to take over the functions of the primary containment should it fail but to allow for the collection of leaks in the space between the two structures and for a filtered release via the vent stack. This function is termed secondary confinement.

4.148. The systems associated with secondary confinement should be designed to collect, filter and discharge gases and liquids containing radionu­clides that have leaked from the containment in accident conditions, or to pump leaked liquids back into the containment. This is a way of reducing accidental radioactive releases (by filtering) and their impacts (by means of stack release of gases instead of releases at ground level). The merits of a complete or partial secondary confinement should be considered for new plants. A partial secondary confinement (i. e. one which does not completely enclose the primary containment) should enclose the more leakage prone areas of the primary containment (such as the penetration areas). If no secondary confinement is provided, a thorough justification for this should be made on the basis of anticipated radioactive releases or dose calculations for all relevant design basis accidents and for severe accident conditions.

4.149. To maximize the efficiency of the secondary confinement, a filtered ventilation system should be provided. This should quickly reduce the pressure in the volume between the primary and the secondary containment (the confinement volume) to a negative gauge pressure after a postulated initiating event involving a loss of coolant and should maintain it even under the assumed worst wind conditions. If a negative gauge pressure cannot be achieved and maintained in the confinement volume, account should be taken in the calculations of the radiological consequences of the unfiltered leakage to the environment that will result. The confinement volume should be kept at subatmospheric pressure in normal operation, to enable the leaktightness of the secondary containment to be monitored.

4.150. When a secondary confinement is provided, direct leaks (i. e. leak paths from the containment directly to the outside without transiting the confinement volume) should be prevented to the extent possible. Criteria should be set for the control of direct leaks and for the leaktightness of the secondary confinement envelope. It should be verified periodically by means of testing that these criteria are being met.

4.151. The following features should be incorporated into the design to limit the number of direct leaks:

— Systems that have to penetrate the primary containment should be located in the confinement volume, either entirely (if possible) or up to the isolation valves.

— Recirculation systems (e. g. safety injection systems and spray systems) should be located entirely in the confinement volume.

— Large penetrations (e. g. the containment ventilation system) should be equipped with three isolation valves (one in the containment, one in the confinement volume and one outside the containment). The space between the second and third isolation valves should be connected to the confinement volume by a small line equipped with two isolation valves in parallel that are open when the large valves are closed; this ensures that, even with a single failure of the isolation valves, leaks from the containment are collected in the confinement volume.

— Doors of the air locks penetrating both containment walls should be equipped with a double seal; the space between the seals should be connected to the confinement volume rather than to the air lock volume when the door is closed.

5.64. Guidelines for the management of severe accidents (severe accident management guidelines (SAMGs)) should be aimed primarily at maintaining or restoring the performance of the containment. SAMGs should be developed for managing accident conditions in co-ordination with on-site and off-site emergency organizations. SAMGs should be established to supplement, but not to replace, provisions in the design to prevent the failure of containment systems during or following a severe accident or to mitigate the consequences of such an accident.

Appendix