1. Issues Associated with the Development of Severe Accident Management Guidelines for CANDU Reactors Keith Dinnie Director, Risk Management Nuclear Safety Solutions Ltd. Toronto, Canada

2. CANDU Reactor 101 Nat U fuel in horizontal pressure tubes (380/480), each with inlet and outlet feeder pipes from common headers Channels surrounded by low pressure heavy water moderator, containing vertical and horizontal reactivity control devices Calandria filled with heavy water surrounded by a light water-filled concrete shield vault or metal shield tank

3. Design Features Affecting Severe Accident Progression Total loss of cooling to fuel in the channels does not necessarily lead to severe accident progression If moderator cooling is available, decay heat can be removed by moderator HXs If there is a small quantity of residual steam flow through channels, Zr oxidation can occur leading to hydrogen and fission product release to containment

4. Severe Accident Progression (1) If moderator cooling not available, moderator system will pressurize connecting to containment atmosphere via rupture disks (>240 kPa)

5. Accident Progression (2) Flashing of moderator will uncover upper fuel channels which will rapidly fail

6. Accident Progression (3) Rubble collects at bottom of calandria vessel

7. Accident Progression (4) Shield tank fails or water evaporated Calandria vessel fails Metal shield tank may fail

8. Accident Progression (5)

9. SAMG Issues Related to Design Core thermal conditions Normally determined by header temperature and pressure, and RTDs on feeder pipes outside the core Events covered by EOPs Loss of coolant and failure of ECC (case with limited fuel failures) Transients leading to single channel failure (loss of secondary side heatsink) EOP  SAMG transition indicated by Prolonged loss of subcooling (degraded core cooling), and Increase in moderator temperature (inability of moderator to remove decay heat), or Significant release of fission products to containment

10. SAMG Issues Related to Design Transition to SAMG Measurement of channel conditions Header subcooling RTDs on outlet feeders No direct measurement Measurement of fission product release Gamma monitors in containment Definition of “significant” Moderator cooling Increasing temperature will rapidly lead to rupture discs opening and system depressurization Initially similar to single channel failure SAMG ISSUE: Simple or complex criterion for transition to SAMG?

11. SAMG Issues Related to Design Severe accident progression always occurs at low pressure (pressure tube is weak link under degraded cooling conditions) SAMG Issue: Is there any value in a SAG to depressurize RCS?

12. SAM Issues Related to Design Channel experiences much more severe conditions that SG tubes and will fail well before SG integrity challenged Even if SG tube rupture exists, release will terminate on channel failure SAMG Issue: Is there any value in a SAG to protect SG tube integrity?

13. SAM Issues Related to Multi-Unit Stations

14. Operational Common systems (ECC, Containment) Common control room Unit and common operating crews Non-incident reactors can continue to operate at full power for a limited period after an accident at one unit Actions at non-incident units can affect incident unit SAMG Issue: role of non- incident units in SAMG (e.g., unusual equipment line-ups, etc.)

15. Negative-Pressure Containment Large volume when interconnected Diverse sources of cooling Containment pressure measurement trends masked by vacuum reserve While containment is sub- atmospheric must use temperature and pressure to diagnose containment leakage (no releases while sub-atmospheric)

16. Loss of Electric Power Redundancy of electric power supplies (cross- connection between units, stand-by generators, emergency power generators) Total loss of power would affect all units simultaneously Issue: Should SAMG attempt to address multiple unit severe accidents?

17. Other Issues Tritium Issue: Should a large release of tritium be considered a ”severe accident” Security Issue: Should SAMG attempt to address plant conditions specific to security-related situations? Shut down state Issue: At what point in SAMG development should events originating from the shutdown state be considered?

18. Principles  The SAMG must remain easy to use, because the emergency technical support staff will not be trained or drilled at high frequency intervals, and therefore familiarity with the material will be limited.  Experience in developing and drilling with SAMG for the at-power state is desirable before considering extension of the scope to other plant states or conditions.  Symptom-based procedures and guidelines are capable of addressing severe accident challenges and accommodating limitations in information and equipment availability, whatever the cause.