I—29. This type of containment works for control of design basis accidents largely in the same way as the double wall containment described in paras I-4 to I-6. The main differences are (Fig. I—9):

— The water storage for the emergency core cooling system at the bottom of the containment, which takes over the sump function and makes a switchover from injection to recirculation by the emergency core cooling system unnecessary;

— The location of the emergency core cooling system outside the annulus in safeguarded buildings.

I-30. Mitigation of severe accidents is achieved mainly by:

— A primary depressurization device that prevents containment bypasses via the steam generator tubes and failure of the reactor pressure vessel at high pressure, and thereby minimizes the consequences of missiles in the reactor pressure vessel and direct containment heating;

— Passive autocatalytic recombiners which prevent global detonation of hydrogen as well as local fast deflagration and the deflagration — detonation transition in combination with steam inerting, and the possibility of passive global convection within the containment;

— A core catcher in the molten core spreading compartment which stabilizes the material after temporary retention within the reactor pit by passive flooding and cooling with water from the in-containment water storage tank;

— An active containment heat removal system that ensures long term cooling of the containment atmosphere and of molten core material;

An annulus subpressure system that exhausts the filtered containment leakage.