4.124. An effective way to restrict radioactive releases to the environment is to maintain the leak rate below conservative specified limits throughout the plant’s operating lifetime[9]. As a minimum, leak rates should be small enough to ensure that the relevant dose limits are not exceeded during normal operations or in accident conditions.

4.125. At the design stage, a target leak rate should be set that is well below the safety limit leak rate, i. e. well below the leak rate assumed in the assessment of possible radioactive releases arising from accidents. This margin is useful to reduce the likelihood that unforeseen modifications made at the stage of design or construction cause an actual leak rate to approach the safety limit leak rate.

4.126. To limit the number of leak paths, the number of penetrations should be kept as low as possible. The external extensions of the penetrations should be installed in a confined building, at least until the first isolation valve, in order to collect and filter any leaks before a radioactive release occurs.

4.127. Leak rates of isolation devices, air locks and penetrations should be specified with account taken of their importance to safety and the integral leaktightness of the containment.

4.128. A reliable actuation system for containment isolation should be incor­porated, as described in paras 4.169-4.183 and 4.225-4.230, to ensure the leaktightness of the containment in the event of an accident.

4.129. Additional measures to eliminate possible leakage paths should be considered if necessary. For example, some designs use a pressurization system that injects a fluid (water or nitrogen) between isolation valves in series (in which case at least three valves are necessary to cope with a single failure).

5.39. For existing plants, the ultimate load bearing capacity (structural integrity Level III) and retention capacity (leaktightness Level II) of the containment structure should not be exceeded in severe accidents, to the extent that this can be achieved by practicable means. Furthermore, the molten core material and core debris should be stabilized within the containment.

5.40. To determine the ultimate load bearing capacity and retention capacity beyond the design pressure, it should be considered whether to make a global evaluation of the structural behaviour of the containment in order to identify the most limiting components so as to evaluate margins, and to study the failure mode of the structure. Local effects, thermal gradients and details of component design should also be considered so as to identify possible mechanisms for large leaks. In this regard, special attention should be paid to the behaviour of piping penetrations, soft sealing materials and electrical penetrations.

5.41. For new plants, the integrity and leaktightness of the containment structure should be ensured for those severe accidents that cannot be practically eliminated (para. 6.5). The long term pressurization of the containment should be limited to a pressure below the value corresponding to Level II for structural integrity.

5.42. Load combinations for severe accidents are design specific and should be considered in addition to the load combinations for design basis accidents. Appropriate combinations, including loads such as those due to the pressures, temperatures and pipe reactions resulting from the severe accidents that are considered in the design basis, should be taken into account. For these combi­nations the structural integrity criteria for Level II should be met (see para. 4.66 for the definitions of acceptance criteria). For combinations that also include local effects derived from severe accidents, the structural integrity criteria of Level III should be met. Level II criteria for leaktightness should be met for load combinations including dead loads, live loads, prestressing (if applicable), test temperatures and accident pressures.

5.43. Consideration should be given to incorporating into the plant design the

following provisions to enhance the capability to cool molten core material and

core debris, and to mitigate the effects of its interaction with concrete:

(a) A means of flooding the reactor cavity with water to assist in the cooling process or of providing enough water early in an accident to immerse the lower head of the reactor vessel and to prevent breach of the vessel;

(b) Protection for the containment liner and other structural members with concrete, if necessary;

(c) Sufficient floor space on the basemat to spread core debris and to increase the capability of cooling the debris by means of flooding with water;

(d) Design features of the containment and the reactor cavity to reduce the amount of core debris that reaches the upper containment (i. e. ledges, baffles and subcompartments);

(e) A reinforced sump or cavity to catch and retain molten core material and core debris (a core catcher);

(f) Use of a type of concrete for the containment floor that minimizes adverse effects due to interactions between molten core material and core debris and concrete.

1.95. Containment structures and appurtenances (penetrations, isolation systems, doors and hatches) should prevent unacceptable releases of radioactive material in the event of an accident. For this purpose, their structural integrity should be maintained (i. e. the structural functions of protection and support should be ensured), and it should be ensured that the leaktightness criteria are met (Ref. [1], paras 6.43-6.67).

1.96. In steel containments the load bearing and leaktightness functions are generally fulfilled by the steel structure. The metallic structure should be protected against missiles generated inside and outside the containment as a result of internal and external events that affect the plant.

1.97. All loads should be identified, quantified and properly combined in order to define the challenges to structures and components. This process should include the adoption of adequate safety margins (Ref. [1], para. 6.45).

1.98. Acceptance criteria in terms of stresses, deformations and leaktightness should be established for each load combination (Ref. [1], paras 6.48-6.50).

1.99. In choosing the design parameters and determining structural sizing, local stresses should be taken into consideration.

1.100. Design for a specific maximum leak rate is not a straightforward or purely quantitative process. A number of factors should normally be taken into account, including the limitation of stresses in accident conditions, the proper choice of components (e. g. isolation valves), the proper choice of sealing materials, limitation of the number of containment penetrations and control of the construction quality. Extant operational data, experience and practices should be used to the maximum extent practicable.

4.47. Provisions for commissioning tests and for in-service testing and inspection should be included in the design, so as to be able to demonstrate that the containment systems meet design and safety requirements.

4.185. In the mechanical design of piping penetrations, including isolation valves, the loads originating from the piping system as well as loads originating from the containment should be taken into account. Special attention should be paid to complex features like metallic bellows. For these solutions, means such as nozzles or double seals should be used to test the leaktightness of piping penetrations individually.

4.186. Piping penetrations should be accessible so that leaks from individual penetrations can be detected in the leaktightness tests.

A.22. The following factors should be taken into account in the choice of instrumentation:

(a) The adequacy and sufficiency of the measuring range, sensitivity and accuracy;

(b) The need to extend the ranges of instrumentation in special operational situations, and the procedures necessary to accomplish this;

(c) Response times;

(d) Environmental qualification.

A.23. The instrumentation should be readily identifiable (e. g. by means of colour coding). In the design for the display of information to the operator in the control room, ergonomic considerations should be taken into account.

4.84. During normal plant operation, a ventilation system should be operated to maintain the pressure, temperature and humidity in the containment atmosphere within the limits specified in the design on the basis of the assumptions and results of the safety analysis. These limits should be in compliance with the equipment qualification parameters. Appropriate monitoring of the activity of the exhausted air and appropriate filtering should be provided.

4.85. In some designs the need may arise for a periodic purging of air because of the buildup of pressure caused by leaks from instruments and service air systems. In this case, appropriate monitoring of the content of radioactive material of the exhausted air and appropriate filtering should be provided.

4.225. In the event of a significant release of radioactive material into the containment (such as in a LOCA), signals for the actuation of containment systems (such as the systems for energy management, radionuclide management and the management of combustible gases) should be derived, depending on the design, from the values of parameters such as:

— High pressure and/or high radiation levels in the containment,

— Low pressure in the reactor coolant system,

— A small subcooling margin in the reactor coolant system,

— A low water level in the reactor pressure vessel.

4.226. Many of these signals are typically used in the reactor protection system to initiate automatic containment isolation or to actuate systems important to safety (such as spray systems, ventilation systems and active igniters).

4.227. Signals for the following conditions should also be used to initiate automatic isolation or for initiating isolation by operator action in the control room:

— High levels of radiation or contamination in the containment atmosphere,

— High levels of radiation in the sump water.

4.228. The lines that penetrate the containment and that are necessary for the operation of safety systems in accident conditions should not be isolated upon the automatic isolation of the containment. Other means should be used to ensure that any release of radioactive material through the containment envelope does not exceed the limits set for plant operational states and design basis accidents.

4.229. In addition to those events for which isolation of the containment is required, there are other events for which only the individual isolation of the affected lines is necessary to limit the release of radioactive material from the containment to the environment. This is the case for a break outside the containment in a pipeline for radioactive material that penetrates the containment, or for the failure of an interface between two associated systems (such as the rupture of a heat exchanger on a water line of a component cooling system) that leads to a release of radioactive material from a system inside the containment to a system outside. The actuation of the isolation devices should be derived from the values of appropriate parameters, such as:

— Levels of radiation or of airborne contamination,

— Pressure changes,

— Temperature changes.

4.230. For all lines not associated with the operation of safety systems, the following criteria should be met:

(a) Lines that penetrate the containment envelope should be automatically isolated when process parameters indicate LOCA conditions.

(b) Lines that communicate with the containment atmosphere should be automatically isolated when a specified level of radiation in the containment atmosphere is exceeded.

(c) Lines that communicate with the containment sump and penetrate the containment should be isolated when a specified level of radiation in the sump water is exceeded.

(d) Lines that are connected to the reactor coolant system via a heat exchanger (such as the main steam lines in a pressurized water reactor) should be isolated when specified radiation levels in the lines are exceeded.

I—31. The containment of passive simplified boiling water reactors is constructed of reinforced concrete with an internal steel liner (Fig. I-10). The containment is usually subdivided into a dry well and a pressure suppression

FIG. I-9. Schematic diagram of a full pressure double wall containment system for a pressurized water reactor with provision for mitigation of the consequences of a severe accident: 1, in-containment emergency core cooling system (ECCS) water storage; 2, ECCS; 3, primary depressurization device; 4, core catcher; 5, containment heat removal system; 6, annulus filtered air extraction system.

pool, which acts as a heat sink in accident conditions and provides water for active make-up for the reactor pressure vessel.

I-32. Passive cooling and core flooding features are commonly provided by core flooding pools, which act as heat sinks for the passive emergency condensers and also for the safety relief valve system. In addition, the flooding pool water is used for passive flooding of the reactor core following depressuri­zation of the reactor pressure vessel in the event of a LOCA. Energy management in the containment is provided by passive containment cooling

FIG. I-10. Schematic diagram of a passive simplified boiling water reactor: 1, pressure suppression pool; 2, core flooding pool; 3, dryer-separator storage pool; 4, emergency condensers; 5, core flooding lines; 6, containment cooling condenser; 7, vent pipes; 8, overflow pipes; 9, H2 vent pipes; 10, safety relief valves; 11, dry well flooding line; 12, active residual heat removal system.

condensers that transfer the heat to the dryer-separator storage pool on top of the containment and transfer the condensate back into the core flooding pools.

I-33. For severe accident control, passive simplified boiling water reactors rely on external cooling of the reactor pressure vessel. The lower part of the dry well is flooded from the core flooding pools, and natural circulation inside the insulation of the reactor pressure vessel ensures the transfer of steam to the containment cooling condensers.

I-34. The containment is inerted during power operation to prevent the risk of hydrogen combustion. Hydrogen collected in the upper part of the containment is flushed through dedicated vent pipes into the wet well to avoid impairment of the function of the containment cooling condensers.

1.34. The results of the analysis of design basis accidents should be used in the determination of the critical design parameters.

1.35. The design basis accidents for the containment systems are the set of possible sequences of events selected for assessing the integrity of the containment and for verifying that the radiological consequences for operators, the public and the environment would remain below the acceptable limits. The design basis accidents relevant for the design of the containment systems should be those accidents having the potential to cause excessive mechanical loads on the containment structure and/or containment systems, or to jeopardize the capability of the containment structure and/or containment systems to limit the dispersion of radioactive substances to the environment.

1.36. All evaluations performed for design basis accidents should be made using an adequately conservative approach. In a conservative approach, the combination of assumptions, computer codes and methods chosen for evaluating the consequences of a postulated initiating event should provide reasonable confidence that there is sufficient margin to bound all possible

results. The assumption of a single failure[2] in a safety system should be part of the conservative approach, as indicated in Ref. [1], paras 5.34-5.39. Care should be taken when introducing adequate conservatism, since:

— For the same event, an approach considered conservative for designing one specific system could be non-conservative for another;

— Making assumptions that are too conservative could lead to the imposition of constraints on components that could make them unreliable.

1.37. Changes resulting from the ageing of structures, systems and components should be taken into account in the conservative approach.

1.38. All evaluations for design basis accidents should be adequately documented, indicating the parameters that have been evaluated, the assumptions that are relevant for the evaluations of parameters, and the computer codes and acceptance criteria that were used.

1.39. These evaluations should cover, but are not necessarily limited to, the following:

— The mass and energy of releases inside the containment as a function of time;

— The heat transfer to the containment structures and those to and from components;

— The mechanical loading, both static and dynamic, on the containment structure and its subcompartments;

— The releases of radionuclides inside the containment;

— The transfer of radionuclides to the environment;

— The rate of generation of combustible gases.

1.40. The time periods used in these evaluations should be sufficient to demonstrate that the safety limits have been analysed and that the subsequent evolutions of the physical parameters are known and are controllable.

1.41. Design parameters for the containment structures (e. g. design pressure and free volume) that have to be determined early in the design process, before detailed safety assessments can be made, should incorporate significant margins.[3]

1.42. The mechanical resistance of the containment structure should be assessed in relation to the expected range of events and their anticipated probability over the plant lifetime, including the effects of periodic tests.

1.43. Three types of margin should be considered:

— Safety margins, which should accommodate physical uncertainties and unknown effects;

— Design margins, which should account for uncertainties in the design process (e. g. tolerances) and for ageing, including the effects of long term exposure to radiation;

— Operating margins, which are introduced in order to allow the operator to operate the plant flexibly and also to account for operator error.

1.44. Computer codes that are used to carry out evaluations of design basis accidents should be documented, validated and, in the case of new codes, developed according to recognized standards for quality assurance. Users of the codes should be qualified and trained with respect to the operation and limits of the code and with respect to the assumptions made in the design and the safety analysis.

1.45. Computer codes should not be used beyond their identified and documented domain of validation.

1.46. In considering containment systems with double walls, the potential for high energy pipe breaks in the space between the walls should be evaluated. In the event that the possibility of such breaks cannot be eliminated by design features, the internal and external shells, as well as all systems fulfilling safety functions in the annulus between the walls, should be capable of withstanding the related pressures and thermal loads, or else qualified protective features (such as guard pipes) should be installed.

1.47. Multiple failures in redundant safety systems could lead to their complete loss, potentially resulting in beyond design basis accident conditions and significant core degradation (severe accidents) and even threatening the integrity of the containment. Although accident sequences exhibiting such characteristics have a very low probability, they should be evaluated to assess whether they need to be considered in the design of the containment. The selection process for such sequences should be based on probabilistic evalua­tions, engineering judgement or deterministic considerations, as explained in Ref. [1], para. 5.31. The selection process should be well documented and should provide convincing evidence that those sequences that were screened out do not pose undue risks to operators or the public. (See Section 6 for design considerations for severe accidents.)

General

4.130. As an application of the defence in depth concept, and in addition to the measures taken to ensure the leaktightness of the containment, measures should be taken to reduce the inventory of radionuclides in the containment atmosphere.

4.131. In general, a single system is not sufficient for reducing the concentra­tions of radionuclides, and multiple systems are usually employed. Methods used for the reduction of airborne radionuclides in water cooled reactors of extant and new designs are:

(a) Deposition on surfaces,

(b) Spray systems,

(c) Pressure suppression pools,

(d) Ventilation systems.

4.132. As long as active systems for the reduction of the concentrations of airborne radionuclides are in the standby mode in normal operation, they should be testable.