5.44. Highly energetic severe accident conditions with the potential for damaging the containment should be virtually eliminated for new plants. Reliable depressurization of the reactor coolant system to prevent the ejection of molten core material and core debris and direct containment heating should be ensured as an accident management measure for existing and new plants.

5.45. The interaction of molten core material with water can cause highly energetic events (e. g. steam explosions; see para. III-9 of Annex III). There is an international consensus that in-vessel interactions of this type are unlikely to cause a containment failure, however, and that therefore no specific provisions are necessary. The effects of ex-vessel steam explosions are plant specific and are more difficult to predict. Therefore, for a specific plant design, if it cannot be shown that the threat associated with a steam explosion is low, special care should be taken in defining accident management provisions to balance the risk of a steam explosion with the necessity to cool the molten core material.

5.46. The combustion or deflagration of hydrogen, which would be potentially damaging to the containment systems, should also be dealt with by means of prevention (see also paras 6.22-6.27).

5.47. In the course of a postulated severe accident, the residual heat must be removed to prevent damage to the containment. Since the various cooling systems may not be operable, guidelines for the management of severe accidents should be developed for existing plants to help restore adequate core cooling and to reach a controlled state (paras 6.28-6.34). To this end, all possible means should be considered, including the unconventional use of safety systems and other plant equipment. If (probabilistic) analyses show that the risk of containment overpressurization is still too high for existing plants, the installation of a filtered containment venting system to prevent irreversible damage to the containment and uncontrolled releases of radioactive material should be considered.

5.48. For new plants an energy management system should be incorporated as the primary means of meeting the Level II acceptance criteria for structural integrity for loads derived from the pressures in the containment during accidents, as discussed in para. 6.10. In severe accidents, the systems for energy management in the containment and their support systems (the cooling water systems and power supply systems) should be independent of the systems used to prevent melting of the core. If this is not the case, the design of the containment should provide a sufficient period of time for measures to recover failed systems for energy management so as to be able to guarantee the operability of the energy management system under severe accident conditions. Venting systems should not be necessary for new plants.

4.48. The design pressure and the design temperature are the two fundamental parameters used for determining the size of the containment structure (Tables 2 and 3).

4.49. The design pressure should be determined by increasing by at least 10% the peak pressure that would be generated by the design basis accident with the most severe release of mass of material and energy. The calculated peak pressure should be determined on the basis of conservative assumptions in relation to the thermohydraulic characteristics.

4.50. The strength of the containment structure, as tentatively determined on the basis of the design pressure and the design temperature, should be verified for all load combinations and should comply with the corresponding acceptance criteria for the integrity and leaktightness of the containment.

4.51. The design temperature should be specified as the maximum temperature to be anticipated in the structure of the containment, and should be determined by analysing all design basis accidents. The containment structure and systems should be able to maintain their functionality and specified performance when operating below the design temperature.

4.52. All values of pressure and temperature used in the load combinations should be determined with sufficient margins, which should take into account:

— Uncertainties in the amounts of fluids released and in the release rates in terms of both mass and energy, including chemical energy from metal- water reactions;

— Structural tolerances;

— Uncertainties in relation to the residual heat;

— The heat stored in components;

— The heat transferred in heat exchangers;

— Uncertainties in the correlations of heat transfer rates;

— Conservative initial conditions.

4.187. Penetrations through the containment for electrical power cables and instrument cables should be leaktight. Means for ensuring the leaktightness of these penetrations may be based on the following:

(a) Pressure glass penetrations. The pressure glass design consists of studs embedded in a pressurized disc of glass flanged to the containment. Cables are connected to the studs, which extend on both sides of the glass disc and provide continuity for the electric power. The glass ensures electrical isolation between the studs and acts as a sealant. The design should include double seals on the flange to ensure the leaktightness of the assembly. These penetrations should be removable and individually testable for leaktightness at the design pressure.

(b) Pressurized and continuously pressure monitored penetrations. For pressurized penetrations, the pressurization should normally be higher than the internal pressure in the containment for design basis accidents, so that leaktightness can be tested continuously. In any case, the pressure should not be lower than the pressure used in the containment leak rate test. The effects of increase in temperature on the design pressure of the fluid inside the penetrations should be assessed and taken into account in the design of the penetrations.

(c) Injected sealant penetrations. Penetrations of this type should be leak testable in integrated leak tests.

4.188. Preference should be given to designs of electrical penetrations that allow each penetration to be tested individually.

4.189. Heat produced by the electrical cables should be taken into account in selecting the materials for electrical penetrations. The materials used should be heat resistant and non-flammable. Penetrations using sealant injection should be at least flame retardant.

A.24. The hardware items necessary to perform the functions mentioned in this Safety Guide belong essentially to instrumentation systems for safety related information and protection systems. However, this hardware may be partially shared with other systems of a higher safety category. In this case, the higher safety category should be adopted for the common part, and the remaining hardware should not unacceptably reduce the reliability of instru­mentation systems classified in the higher category. Reference [17] should be used to establish the importance to safety of, and the appropriate design recom­mendations for, the monitoring instrumentation. These recommendations should cover:

— Failure rate analysis;

— Environmental qualification;

— Quality assurance;

— Checking, testing and calibration;

— In-service inspection.

4.86. Various types of energy management system are used for different types of containment (Annex I). The design performance of the systems for energy management should be established so as to be able in the event of an accident to reach a stable state, with the containment depressurized, within a reasonable period of time (typically a few days) after its onset.

4.87. The containment design should not depend on venting as a means of maintaining structural integrity in any design basis accident condition.

4.231. Instrumentation should be provided for the reliable monitoring of environmental conditions (such as pressures, temperatures, sump water levels and radiation levels) inside the containment envelope during and following an accident. This instrumentation should be qualified for the environmental

conditions to be expected. Guidance on the monitoring of hydrogen concentra­tions is given in paras 4.158, 4.159, 6.29 and 6.30.

4.232. Appropriate instrumentation should be installed to provide the information necessary to enable operators to assess the status of the containment.

4.233. Information from post-accident monitoring and information on the positions of isolation valves should be displayed in the main control room.

4.234. Provisions should be made in the design for sampling of the containment atmosphere and the sump water at suitable locations. The sampling devices used should be qualified for the expected containment conditions and should be installed so as to avoid a containment bypass in the event of their rupture. They should be designed to ensure that occupational radiation dose limits are not exceeded for the personnel who operate them.

I-35. In the passive simplified pressurized water reactor concept (Fig. I-11), the containment vessel consists of a metallic shell surrounding the nuclear steam supply system. While the operational systems rely on proven pressurized water reactor technology, the safety systems for such reactors work passively, and do not depend on active components and safety grade support systems.

I-36. In accidents, the residual heat is transferred via steam to the containment atmosphere, either through the leak or through the passive core cooling system, which uses the in-containment refuelling water storage tank as a heat sink. The in-containment refuelling water storage tank is also used as a water source to provide the safety injection in the event of a LOCA, and flooding of the reactor cavity for external cooling of the reactor pressure vessel in the event of a severe accident.

I-37. Containment energy management is provided by passive external containment cooling, either by means of passive air circulation in the annulus or supported by external gravity spraying of the containment vessel. The design features of the containment promote flooding of the containment cavity region in accidents and submersion of the lower head of the reactor pressure vessel in water. The liquid effluents released during a LOCA through the break are also directed to the reactor cavity. After collection of the water in the lower part of the containment during an accident, a water level is reached that ensures that the water is drained back via sump screens into the reactor coolant system.

FIG. 1-11. Schematic diagram of a passive simplified pressurized water reactor: 1, in­containment refuelling water storage tank; 2, primary circuit depressurization system; 3, air baffle; 4, passive containment cooling system: gravity drain water tank; 5, containment vessel gravity spray; 6, natural convection air discharge; 7, natural convection air intake.

1.48. The performance of containment systems should be assessed against a well defined and accepted set of design limits and acceptance criteria. ‘Well defined and accepted’ generally means either accepted by regulatory bodies in States having advanced nuclear power programmes or proposed by interna­tional organizations.

1.49. A set of primary design limits for the containment systems should be established to ensure achievement of the overall safety functions of the containment. These primary design limits are usually expressed in terms of:

— Overall containment leak rate at design pressure;

— Direct bypass leakage (for a double wall containment);

— Limits on radioactive releases, dose limits or dose constraints, specified for operational states, design basis accidents and severe accidents, in relation to the function of confinement of radioactive material;

— Dose limits or dose rate limits and dose constraints for personnel, specified for the biological shielding function.

1.50. Furthermore, design limits should be specified for each containment system as well as for each structure and component within each system. Limits should be applied to operating parameters (e. g. maximum coolant temperature and minimum flow rate for air coolers), performance indicators (e. g. maximum closing time for isolation valves and penetration air leakage) and availability

measures (e. g. maximum outage times and minimum numbers of certain items of equipment that must be available).

4.133. The containment structure and its internals provide the first mechanisms for the removal of airborne radioactive material, since they present a large surface area for deposition. The plate-out and desorption factors ascribed to the containment structure should be conservatively based on the best available knowledge of deposition of radionuclides on surfaces. The surfaces of the containment and its internal structures should be decontami — nable to the greatest extent possible.

Containment spray system

4.134. The radionuclide management function of the containment spray system is intended to reduce amounts of airborne radioactive substances by removing them from the containment atmosphere and retaining them in the water of the containment sump or the suppression pool. This serves to limit any radiological consequences resulting from leakage of radioactive material from the containment to the atmosphere in postulated accident conditions.

4.135. Important parameters and factors that should be considered in the design of the containment spray system include spray coverage, spray drop size, drop residence time and the chemical composition of the spray medium. Chemicals should typically be added to the spray water to enhance the removal of radionuclides from the atmosphere. Radioiodine is of particular importance, because of its potential consequences in terms of high specific doses. The chemical additive system should be designed to maximize the dissolution of radioiodine and to maintain the sump chemistry or the suppression pool chemistry such that radioiodine will not be released from solution in the long term following an accident.

4.136. Any chemicals added should be non-corrosive for the materials present in the containment, both in the short term and in the long term after an accident. Corrosion might not only reduce the strength of vital structural components and impair the operation of safety systems but might also generate combustible gases and other undesirable compounds.

4.137. The design of the containment spray systems should be such as to ensure that the probability of spurious actuation is low.

5.49. The management of radionuclides present in the containment after a severe accident is similar to the management of radionuclides in the event of a design basis accident. The aim is still to limit leakage from the containment and to avoid, as far as possible, the creation of unfiltered leakage paths to the environment. The main differences in comparison with design basis accidents are the source term (the magnitudes and physicochemical forms of the radioactive releases to the containment) and the possible unavailability of some containment systems.

5.50. An assessment of possible radioactive releases from the containment should be made for selected severe accident sequences in order to identify any potential weaknesses with regard to the leaktightness of the containment and to determine ways to eliminate them. In this assessment, a best estimate approach should be used to evaluate possible leaks from the containment and the systems that may be unavailable for each specific sequence (such as the potential loss of containment isolation in the event of a plant power blackout).

5.51. For existing plants, any release through the containment vents should be filtered. Moreover, a strategy should be adopted to optimize the effectiveness of passive features (such as the retention capacity of compartments and buildings) and of active systems (such as dynamic confinement by means of an internal filtered ventilation system, if available).