DERIVATION OF THE DESIGN BASIS

1.27. The design basis for containment systems should be derived primarily from the results of the analysis of relevant postulated initiating events, which are defined in Appendix I of Ref. [1]. The postulated initiating events that should be considered include those of internal and external origin that could necessitate the performance by the containment of its intended functions and those that could jeopardize the capability of the containment to perform its intended safety functions.

1.28. Relevant elements of the design basis for normal operation (power operation, refuelling and shutdown) should be derived from the following requirements:

— To confine the radioactive substances produced by neutron or gamma radiation,

— To remove the heat generated,

— To provide for the necessary access and egress of personnel and materials,

— To perform containment pressure tests and leak tests,

— To contribute to biological shielding.

Internal events

1.29. Internal events that should be considered in the design of the containment systems are those events that result from faults occurring within the plant and that may necessitate the performance by the containment of its functions or that may jeopardize the performance of its safety functions. They fall essentially into five categories:

(1) Breaks in high energy systems located in the containment: The containment should be able to withstand high pressures and tempera­tures, as well as pipe whips and fluid jet impacts.

(2) Breaks in systems or components containing radioactive material located in the containment: The containment should be able to confine the radioactive material.

(3) System transients causing representative limiting loads (e. g. pressure, temperature and dynamic loads) on the containment systems: The containment should be able to withstand these loads.

(4) Containment bypass events such as loss of coolant accidents (LOCAs) in interfacing systems or steam generator tube ruptures: Appropriate provisions for isolation should be in place.

(5) Internal hazards: It should be verified that internal hazards will not impair the containment functions.

1.30. Typical internal events that should be considered in the design of containment systems are as follows:

— LOCAs;

— Various failures in the steam system piping;

— Breaks in the feedwater piping;

— Steam generator tube ruptures in a pressurized water reactor;

— Inadvertent opening of a pressurizer safety valve or relief valve in a pressurized water reactor, or of a safety relief valve in a boiling water reactor;

— Condensation oscillations and ‘chugging’ of liquid-gas mixtures during blowdown in a boiling water reactor;

— Breaks in lines connected to the reactor coolant pressure boundary, inside or outside the containment;

— Leakage or failure of a system carrying radioactive liquid or gas within the containment;

— Fuel handling accidents in the containment;

— Internal missiles;

— Internal fires;

— Internal flooding.

4.121. To assess the overall containment performance and in particular the measures for radionuclide management, the amount and isotopic composition of the radionuclides postulated to be released from the containment (the source term) should be assessed for the various accidents to be considered. For design basis accidents, this should be done by means of a conservative analysis of the expected behaviour of the core and of the safety systems. Consideration should be given to the most pessimistic initial conditions for the relevant parameters (e. g. for the inventory of radionuclides in systems and for leak rates) within the framework of the allowable limits specified in the technical specifications for the plant.

4.122. The anticipated evolution of the physicochemical forms of the radionu­clides in the containment should be assessed, with account taken of the latest knowledge (e. g. it is known that certain paints enhance the production of organic iodine).

4.123. Once iodine is trapped in water pools inside the containment, it may revolatilize in the medium to long term if appropriate pH conditions are not maintained. It is therefore necessary to assess all conditions that could change the pH of the water pools during an accident and, if necessary, provide the necessary means to keep the water pools alkaline.

GENERAL

5.32. Safety of Nuclear Power Plants: Design [1] states in para. 5.31 that “Consideration shall be given to… severe accident sequences, using a combination of engineering judgement and probabilistic methods, to determine those sequences for which reasonably practicable preventive or mitigatory measures can be identified”. The occurrence of accidents with severe

environmental consequences should be made extremely unlikely by means of preventive and mitigatory measures.

5.33. Severe accidents should be evaluated by means of the best estimate approach[13]. In a best estimate approach, the combination of assumptions, computer codes and methods chosen for evaluating the consequences of a sequence should be such as to provide reasonable confidence that the results will reflect the probable occurrence of phenomena. In adopting best estimate approaches, special attention should be paid to ensuring that:

— Input parameters are in the range of what might be expected on the basis of present knowledge.

— Computer codes reflect an internationally accepted state of knowledge based on accepted research and development (in particular, the modelling of phenomena should not be controversial).

— All relevant aspects of the severe accident are considered (e. g. by the application of integral computer codes covering the hydraulics of the containment and the behaviour of fission products).

— The uncertainties in the values calculated are taken into consideration.

5.34. The validation domain of the computer codes used for evaluating all pertinent parameters should be verified to cover their expected range of variation adequately. Computer codes should not be used beyond their validation domain. As an exception, the use of computer codes beyond their range of validation might possibly be acceptable in areas for which it is widely recognized that there is a lack of coherent data. Such exceptions should be allowed only on the following conditions:

— The exception is clearly specified.

— A comprehensive sensitivity analysis is carried out to evaluate the effects of variations in the assumptions and in the modelling.

— An independent assessment is made of the credibility of the results.

— Appropriate margins are introduced if knowledge is limited.

5.35. For existing plants, the phenomena relating to possible severe accidents and their consequences should be carefully analysed to identify design margins and measures for accident management that can be carried out to prevent or mitigate the consequences of severe accidents. For these accident management measures, full use should be made of all available equipment, including alternative or diverse equipment, as well as of external equipment for the temporary replacement of design basis components. Furthermore, the intro­duction of complementary equipment should be considered in order to improve the capabilities of the containment systems for preventing or mitigating the consequences of severe accidents.

5.36. For new plants, possible severe accidents should be considered at the design stage of the containment systems. The consideration of severe accidents should be aimed at practically eliminating[14] the following conditions:

— Severe accident conditions that could damage the containment in an early phase as a result of direct containment heating, steam explosion or hydrogen detonation;

— Severe accident conditions that could damage the containment in a late phase as a result of basemat melt-through or containment overpressuri­zation;

— Severe accident conditions with an open containment — notably in shutdown states;

— Severe accident conditions with containment bypass, such as conditions relating to the rupture of a steam generator tube or an interfacing system LOCA.

5.37. For severe accidents that cannot be practically eliminated, the containment systems should be capable of contributing to the reduction of the radioactive releases to such a level that the extent of any necessary off-site emergency measures needed is minimal.

5.38. Severe accident conditions may pose a threat to the survivability of equipment inside the containment owing to the high pressures, high tempera­tures, high levels of radiation (the effects of deposition of aerosols should be taken into account in estimating the values of temperatures and levels of radiation) and hazardous concentrations of combustible gases. Furthermore, the larger uncertainties in relation to the conditions in the containment following severe accidents should be taken into account by using appropriate margins in the survivability demonstration or in specifying protective measures (such as shielding). These factors should be taken into account in verifying the necessary survivability of equipment and instrumentation.

1.93. The containment may be subject to several ageing phenomena such as the corrosion of metallic components, the creep of tendons and the reduction of prestressing (in prestressed containments), the reduction of resilience in elastomeric seals, and the shrinkage and cracking of concrete. The detrimental effects of ageing cannot easily be identified during the plant lifetime. All ageing mechanisms are required to be identified and taken into account in the design. Provision should be made for monitoring the ageing of the containment, for testing and inspection of components where possible, and for periodically replacing items that are susceptible to degradation through ageing (Ref. [1], para. 5.47).

Decommissioning

1.94. As established in Ref. [1], para. 5.68, attention is required to be paid to features that would assist in the final decommissioning of the plant (such as by selecting construction materials so as to reduce radioactivation during operation,

by ensuring access and by providing facilities for waste storage). In general, features intended to facilitate decommissioning will also improve plant operations and maintenance, and they should therefore be carefully assessed at the design stage (Ref. [1], para. 5.68). Guidance on these aspects is given in Ref. [11].

4.167. The mechanical features of the containment comprise the mechanical components of the outermost barrier and the mechanical parts of the extensions of this barrier (i. e. piping, valves, ducts and penetrations). Together with the containment structure, these features comprise the containment envelope.

4.168. The leaktightness criteria for mechanical features of the containment and its extensions should be consistent with the assumptions used in the radio­logical analyses for design basis accidents.

Provisions for containment isolation of piping and ducting systems

4.169. To ensure containment isolation, piping and ducting systems that penetrate the containment envelope should have appropriate provisions for isolation (i. e. valves and dampers). Requirements for containment isolation are established in Ref. [1], paras 6.55-6.57.

4.170. In the provisions for containment isolation, two barriers should be provided for each penetration. Annex II elaborates on means of isolation for piping and ducting systems.

4.171. Each line penetrating the containment that is not part of a closed loop[10] and that either (a) directly communicates with the reactor coolant during normal operation or in accident conditions or (b) directly communicates with the containment atmosphere during normal operation or in accident conditions should be provided with two isolation valves in series. Each valve either should be normally closed or should have provisions to close automatically. Where the line communicates directly with the reactor coolant or the containment atmosphere, one valve should be provided inside the containment and one valve outside. If two valves either inside or outside the containment structure can provide an equivalent barrier (i. e. can meet all the design requirements) in certain applications, then this may also be an acceptable arrangement. Each valve should be reliably and independently actuated. Isolation valves should be located as close as practicable to the structural boundary of the containment.

4.172. Loops that are closed either inside or outside the containment should have at least one isolation valve outside the containment at each penetration. This valve should be an automatic valve, a normally closed valve or a remotely operated valve[11]. Where the failure of a closed loop is assumed as a postulated initiating event or as a consequence of a postulated initiating event, the recom­mendations in the previous paragraph will apply to each line of the closed loop.

4.173. Loops that are closed both inside and outside the containment envelope should have at least one isolation valve, an automatic valve, a normally closed valve or a remotely operated valve outside the containment envelope at each penetration.

4.174. Exceptions to the above recommendations are permitted for small dead-ended instrumentation lines that penetrate the containment. For these lines a single manually operated valve outside the containment is sufficient. Instrumentation lines that are closed (i. e. not in communication with the atmosphere) both inside and outside the containment are acceptable without isolation valves provided that they are designed to withstand design basis accidents for the containment. The rooms where these lines emerge should be equipped with a filtration-ventilation system to maintain subatmospheric pressure. Such rooms and the equipment within them should be designed to withstand increased levels of temperature and humidity due to possible leakage from these lines.

4.175. The need for isolation of the containment in accident conditions and the need for operation of the safety systems that penetrate the containment envelope may result in contradictory design requirements. In such cases, consideration of the isolation provisions should be balanced against the need for the availability of safety systems and the need to avoid escalation of the accident conditions. Check valves may be used for the inner isolation barrier to resolve this issue, but the use of two check valves in series should not be considered an acceptable method of isolation.

4.176. Overpressure protection should be provided for closed systems that penetrate the containment and for isolated parts of piping that might be overpressurized by the raised temperature of the containment atmosphere during design basis accidents.

4.177. The extensions of the containment envelope should be designed and constructed to levels of performance that are at least equivalent to those for the containment barrier itself.

4.178. For the systems or piping that are normally closed to the containment atmosphere, but which might be opened in some reactor shutdown states (i. e. opening of the steam generator envelope in shutdown states or of the fuel transfer tube when the spent fuel pool is located outside the containment), and for which isolation can be provided by only one means,

— The leaktightness of the existing means of isolation should be demonstrated.

— A qualified mobile device should be used as a means of isolation.

— The system concerned should be opened only when the risk to safety is sufficiently low.

4.179. Particular consideration should be given to the containment isolation features of the following systems:

— Those systems, such as safety injection lines and emergency cooling lines, that are connected with the primary circuit and that can transport radio­nuclides outside the containment in design basis accidents;

— Those systems that can transport airborne radionuclides from the containment atmosphere to outside the containment in design basis accidents (i. e. systems used in some designs to mix the atmosphere inside the containment in order to prevent the ignition of hydrogen);

— Those systems that support systems important to safety (inside the containment) for which, in the event of leakage, fluids with a high activity might be released outside the containment (i. e. in some designs the component cooling water system, the containment sump purge system or the sampling systems).

4.180. Systems connected to the primary circuit in normal operations (i. e. primary circuit filtration systems or in some designs the chemical and volume control system) and systems connected to the containment atmosphere should be automatically isolated in accident conditions when they are not necessary for safety.

4.181. If valves used for normal operations are also used for containment isolation, they should meet the same design requirements as the containment isolation system.

Isolation valves

4.182. To achieve the objective of limiting any radioactive release outside the containment, the isolation devices should be designed with a specified leaktightness and closure time. In specifying the leaktightness and closure time, the amounts of potential radioactive releases should be taken into account. In making the choice between motorized and pneumatic valve operators, the requirement for the valve to reach a safe position in the event of loss of its motive force and the required closure time of the valve should be taken into account. It may be necessary to limit the closing speed of valves or dampers, particularly for larger penetrations, to ensure their proper functioning and tight sealing.

4.183. Design provisions for leakage tests (such as nozzles and instrumen­tation test lines) should be made such that each isolation valve may be tested. Any possible exceptions should be fully justified.

Penetrations

4.184. Containment penetrations should be designed for the same loads and load combinations as the containment structure, and for the forces stemming from pipe movements or accidental loads (Ref. [1], paras 6.51-6.54).

A.16. Sampling from the drain sumps should be possible from outside the containment building so that leak sources can be identified by measurements of activity and of the concentrations of boron, lithium, potassium or other chemical elements or compounds.

A.17. Provision should be made for sampling and analysis of the drain waters outside the containment building.

Visible abnormalities

A.18. Video cameras, to facilitate visual inspection, should be installed at locations where leaks or other malfunctions can be expected and/or where personnel access is difficult. Mobile cameras should be available for use if and when the demand for them arises.

Noise and vibration

A.19. Acoustic analyses of noise should be performed to detect loose parts or abnormal behaviour of operating equipment.

A.20. The use of audio signals from the containment building for the detection of abnormalities should be considered. In addition, the use of spectral and Fourier transform analyses for acoustic noise signals may be considered.

A.21. Sensors to detect heat, smoke and/or flames should be installed in each compartment where there may be a risk of fire.

4.82. Energy management is a term used to describe the management of those design features of the containment that affect the energy balance within the containment and thereby play a part in maintaining pressure and temperature within acceptable limits. The elements for energy management used in water cooled reactors of extant and new designs are as follows:

(a) Inherent energy management features (e. g. the free volume of the containment and structural heat sinks),

(b) Spray systems,

(c) Air cooler systems,

(d) Suppression pool systems,

(e) Ice condenser systems,

(f) Vacuum pressure reduction systems,

(g) External recirculation cooling systems,

(h) Passive containment cooling systems.

4.83. Active components of the systems for energy management that are normally in the standby mode during normal operation should be testable.

4.223. Appropriate instrumentation should be used to monitor the availability of the containment systems used for energy management or for the management of radionuclides.

4.224. The availability of the containment systems should be verified by means of the following:

— By continuous monitoring and display in the main control room of the main parameters important to safety (a single integrated monitor for critical safety parameters is used in many reactor designs);

— For the systems for energy management, by monitoring the positions of valves, the status of components in operational states and flow rates;

— For the systems for radionuclide management, by monitoring the positions of isolation valves and doors, the pressure of inflatable airlock seals and water levels in spray water tanks;

— By testing, for example, the flow rates of some systems, the leaktightness of containment systems and the efficiency of aerosol filters or iodine filters.

I—29. This type of containment works for control of design basis accidents largely in the same way as the double wall containment described in paras I-4 to I-6. The main differences are (Fig. I—9):

— The water storage for the emergency core cooling system at the bottom of the containment, which takes over the sump function and makes a switchover from injection to recirculation by the emergency core cooling system unnecessary;

— The location of the emergency core cooling system outside the annulus in safeguarded buildings.

I-30. Mitigation of severe accidents is achieved mainly by:

— A primary depressurization device that prevents containment bypasses via the steam generator tubes and failure of the reactor pressure vessel at high pressure, and thereby minimizes the consequences of missiles in the reactor pressure vessel and direct containment heating;

— Passive autocatalytic recombiners which prevent global detonation of hydrogen as well as local fast deflagration and the deflagration — detonation transition in combination with steam inerting, and the possibility of passive global convection within the containment;

— A core catcher in the molten core spreading compartment which stabilizes the material after temporary retention within the reactor pit by passive flooding and cooling with water from the in-containment water storage tank;

— An active containment heat removal system that ensures long term cooling of the containment atmosphere and of molten core material;

An annulus subpressure system that exhausts the filtered containment leakage.

1.31. External events that should be considered in the design of containment systems are those events arising from human activities in the vicinity of the plant, as well as natural hazards, that may jeopardize the integrity and the functions of the containment. All the events that are to be addressed in the design should be clearly identified and documented on the basis of historical and physical data or, if such data are unavailable, on the basis of sound engineering judgement.

1.32. All relevant external events should be evaluated to determine their possible effects, to determine the safety systems needed for prevention or mitigation, and to assist in designing the systems to withstand the expected effects.

1.33. Typical external events that should be considered in the design of containment systems are given in Table 1. Additional guidance is provided in Ref. [4].

TABLE 1. TYPICAL EXTERNAL EVENTS TO BE CONSIDERED IN THE DESIGN OF CONTAINMENT SYSTEMS

Human origin hazards Natural hazards

Earthquake

Hurricane and/or tropical cyclone

Flood

Tornado

Wind

Impact of an external missile Blizzard

Tsunami (tidal wave)

Seiche (fluctuation in water level of a lake or body of water)

Volcanic eruption

Extreme temperature (high and low)