Candu Extreme Events - CNSC Online

Candu Extreme Events

Candu Extreme Events

Table of Contents

Candu Extreme Events

Simulation Briefing

We would never dismiss an incident as "impossible". However, as an educational exercise, we would like to show you a simulation of events that could take place in a major accident.

Canadian Nuclear power is generated by Canadian-designed CANDU reactors. Safety is designed in from the start.

A CANDU facility is designed as a multi-layered safety system first, and as a power plant second. The plant is designed to control and contain any radiological releases from an extreme event.

Candu Extreme Events

Simulation Briefing

The virtual CANDU X reactor
 

A CANDU reactor is a multi-layered safety system. Each system gives plant operators a chance to step in and stop an accident from progressing further.Safety is ongoing. When other countries learn important lessons about safety, Canada applies those lessons to our power plants. We ensure that licensees simulate and plan for various scenarios and train our nuclear operators to deal with them.

CONTROL

A CANDU has two, independent, automatic shutdown systems that control the nuclear reaction.

COOL

Reactor design ensures that there is always water present to cool the fuel. Even after shutdown, "decay heat" from radiation also needs to be cooled with circulating water.

CONTAIN

Nuclear fuel, cooling water and any radioactive dust or particles are contained within multiple barriers to prevent contamination.

Candu Extreme Events

Simulation Briefing

The virtual CANDU X reactor

In this simulation a sequence of extreme events will progressively test a CANDU power plant’s safety systems.

Extreme Event

Icon indicating the occurrence of an event in this simulation

Corrective Action

Icon indicating that a corrective action has been taken as a result of an event in this simulation

Reactor Status

Icon indicating the reactor status after event and corrective actions take place in this simulation

Candu Extreme Events

Normal Operation

The virtual CANDU X reactor
The virtual CANDU X reactor

Normal Operation

A CANDU Reactor is safe by design and safe by operation. Just like most fossil-fuel power plants, a CANDU system uses superheated steam to turn turbines, which turn electric generators; the difference is that CANDUs use nuclear fission to heat the water. The heat is absorbed by the boiler water, which turns to steam in the secondary loop. The waters in the two loops never mix.

Extreme Event Simulation

Here we follow a timeline of the most Extreme Event sequence that can occur. We have placed them in an unlikely sequence so you can explore the worst-case scenario. Even in this simulated sequence, there are many opportunities to bring the situation under control. Every step is planned for, and every worker is trained with drills and simulators to respond instantly. CNSC ensures that every plant and operator in Canada meets highly rigorous safety and operations standards.

Candu Extreme Events

Loss of off-site power

The virtual CANDU X reactor
The virtual CANDU X reactor

Event: Loss of off-site power

The station uses power from the provincial grid to run its pumps and controls. If the provincial grid is disconnected, the plant needs an alternate source of power.
The virtual CANDU X reactor

Corrective Action: On-site Power

The power plant switches to on-site power, pumps continue to operate, circulating the primary coolant through the boilers. When grid power is disconnected, the station can switch to 'house load' operating mode to sustain all of its systems. In house-load mode, the reactor operates at a reduced power level, typically 5% of full power. In a multi-unit station, one reactor can provide power to all other units.

Reactor Status: Normal Operation

The CANDU continues running on 'house load' power until external grid power is restored. Once the disturbance to the grid is eliminated, the power plant can be re-synchronized to the grid and output can be quickly raised to full power. This situation can continue until the nuclear fuel in the reactor runs out - months or even years.

Candu Extreme Events

Event: Loss of on-site power

The virtual CANDU X reactor
The virtual CANDU X reactor

Event: Loss of on-site power

As this extreme event begins, on-site (house load) power is also lost. Electric pumps lose power and the reactor needs another power source to keep the cooling water circulating.
The virtual CANDU X reactor

Corrective Action: Reactor shutdown

Shutdown systems are automatically triggered by the power loss stopping the fission reaction in less than 3 seconds. These do not require power or worker intervention to operate. Even though the reactor is shut down, the fuel continues to produce decay heat and needs to be cooled.

Corrective Action: Natural circulation

Natural circulation takes over from forced circulation when the powerful pumps that normally push the coolant through the system stop working. For natural circulation to continue, the boiler needs to stay filled with cool water.
The virtual CANDU X reactor

Corrective Action: Standby generators

Although standby generators are not strong enough to run the powerful primary coolant pumps, they do run smaller pumps in other cooling systems that can be used to remove decay heat. They also power the emergency and electrical systems. All plants have three or four standby generators. Only one or two are ever required.

Reactor Status

Reactor controlled, cooled, contained. Standby generators can operate the cooling pumps that remove residual heat in the reactor indefinitely as long as diesel fuel can be brought in. No radioactive materials have been released and all workers remain on-site.

Candu Extreme Events

Event: Loss of Standby Generators

The virtual CANDU X reactor
The virtual CANDU X reactor

Event: Loss of Standby Generators

In this scenario, all standby generators have either failed or they could not be refuelled.
The virtual CANDU X reactor

Corrective Action: Emergency generators

These generators supply sufficient electricity to power all important safety systems and instruments but are not big enough to power the primary or maintenance pumps. Like the standby generators, they power smaller pumps in other cooling systems and sumps that remove decay heat. All nuclear power plants have at least two emergency generators on-site. Only one is required.
The virtual CANDU X reactor

Corrective Action: Pressure Relief Valves

Pressure valves are opened to release steam from the boiler when the pressure exceeds preset limits. The steam released into the environment is non-radioactive. To maintain natural circulation, the water level in the boiler is maintained by adding fresh water from large, on-site water.

Reactor Status

Reactor controlled, cooled, contained. Emergency generators can operate the cooling pumps that remove residual heat in the reactor indefinitely as long as diesel fuel can be brought in. No radioactive materials have been released and all workers remain on-site.

Candu Extreme Events

Event: Total station blackout

The virtual CANDU X reactor
The virtual CANDU X reactor

Event: Total station blackout

A total station blackout occurs when all power sources used to cool the reactor, including off site power, on site power, standby power generators, emergency power generators and batteries are unavailable.
The virtual CANDU X reactor

Corrective Action: Cooling water from reserve tanks

The station is now operating in fully passive mode. To maintain the natural circulation that cools the core, passive systems supply water to the boilers from reserve tanks. During this time emergency mitigation equipment is deployed.
The virtual CANDU X reactor

Corrective Action: Emergency mitigation equipment

This equipment, such as portable pumps and power generators, is used to add water directly into the boiler. This additional layer of protection was added as part Canada's response to the accident at the Fukushima Daiichi nuclear power plant.

Reactor Status

Reactor controlled, cooled, contained – and undamaged. Up to this point no damage to the nuclear plant systems has occurred and there have been no radioactive materials released into the environment. The reactor can be returned to normal operation after safety checks.

Candu Extreme Events

Event: Boiler (steam generator) depleted

The virtual CANDU X reactor
The virtual CANDU X reactor

Event: Boiler (steam generator) depleted

Even though the plant has multiple emergency reservoirs to keep the boilers full, this scenario starts with all sources of on-site water completely depleted. Decay heat from the core continues to boil away the water in the boilers. Without water in the boilers, the temperature in the primary loop increases. The fuel starts to overheat and may be damaged.
The virtual CANDU X reactor

Corrective Action: Moderator absorbs heat

The calandria holds approximately 250,000 litres of heavy water. This large quantity of water absorbs the decay heat and allows more time for response teams to activate other sources of cooling.
The virtual CANDU X reactor

Corrective Action: Off-site emergency equipment

External water sources, such as city water, fire trucks, and lake water, can be directly connected to the boiler to replenish it. Natural circulation resumes and cools down the fuel. This stops the accident progression and prevents further fuel damage.

Reactor Status

Reactor controlled, cooled, contained. As long as water can be supplied to the boiler the decay heat from the reactor will continue to be transported safely away. Though some fuel may have been damaged by the heat, no radiation was released.

Candu Extreme Events

Event: Reactor begins to overheat

The virtual CANDU X reactor
The virtual CANDU X reactor

Event: Reactor begins to overheat

In this scenario, the boilers are completely depleted and cannot be refilled. The fuel temperature in the pressure tubes increases and the heavy water (moderator) starts to boil creating a hazardous pressure buildup.
The virtual CANDU X reactor

Corrective Action: Controlling internal pressure

Steam from the boiling calandria is automatically released through emergency vents to prevent pressure build-up. In a single-unit station, operators reduce the internal pressure by spraying water from the dousing tank into the containment. In a multi-unit station, operators reduce the pressure by evacuating steam and hot air in the reactor containment to a vacuum building. Both of these systems work without power.
The virtual CANDU X reactor

Corrective Action: Off-site emergency equipment

The calandria can be connected to emergency water sources to refill the calandria. As long as water can be supplied to the calandria, the fuel can be cooled.

Reactor Status

Reactor controlled, partially cooled, and isolated by containment. All calandria water will eventually convert to steam if no new cooling water is added. The huge volume of calandria water standing by at all times provides emergency crews with several days to respond. The accident progression is halted as long as water is supplied to the calandria.

Candu Extreme Events

Event: Loss of reactor core

The virtual CANDU X reactor
The virtual CANDU X reactor

Event: Loss of reactor core

If the moderator water in the calandria cannot be replenished, the remaining moderator boils and evaporates as it absorbs decay heat from the fuel. The fuel channels overheat and the steel begins to melt and give way under the weight of the fuel. Exposed fuel begins to melt and the core to disassemble. At this point the reactor cannot be recovered.

Corrective Action: Vault absorbs heat

The fuel debris contacts the steel wall of the calandria, and is cooled by water in the surrounding vault, which holds about 500,000 litres of additional water.
The virtual CANDU X reactor

Corrective Action: Controlling explosive gases

When nuclear fuel melts it creates hydrogen, an explosive gas. To prevent these gasses from building up in the containment building special devices called Passive Autocatalytic Recombiners (PARs) convert the hydrogen into water, reducing the risk of explosion. These devices work without power.
The virtual CANDU X reactor

Corrective Action: Controlled venting

To protect the public, health officials have by this point evacuated the area to prepare to vent the containment. Controlled, filtered venting reduces internal pressure as well as the amount of radioactivity released into the air and gases into the environment.
The virtual CANDU X reactor

Corrective Action: Off-site emergency equipment

Off-site emergency water can still be connected to the calandria to halt the progression of the event.

Reactor Status

Reactor is isolated by containment. As long as water is added to the calandria, accident progression is halted. Gases may be vented from containment periodically, requiring a local evacuation of people so that they are not exposed.

Candu Extreme Events

Event: Loss of vault water

The virtual CANDU X reactor
The virtual CANDU X reactor

Event: Loss of vault water

If the moderator water in the calandria cannot be replenished, the water in the reactor vault continues to absorb heat and evaporate. Once this is gone, molten fuel is no longer cooled. The fuel settles at the bottom of the reactor and melts through the vault wall into the concrete below.
The virtual CANDU X reactor

Corrective Action: Core Containment

The vault's reinforced concrete walls and the containment building's thick base slab are designed to contain the disassembled core.

Corrective Action: Controlling explosive gases

When nuclear fuel melts it creates hydrogen, an explosive gas. To prevent these gasses from building up in the containment building special devices called Passive Autocatalytic Recombiners (PARs) convert the hydrogen into water, reducing the risk of explosion. These devices work without power.
The virtual CANDU X reactor

Corrective Action: Off-site emergency equipment

Supplying water to the calandria and vault, using emergency equipment such as fire trucks, would stop accident progression.
The virtual CANDU X reactor

Reactor Status

Reactor is isolated by containment. As long as water is added to the calandria and vault, accident progression is halted. Gases may be vented from containment periodically. The reactor is still secured by containment until future cleanup operations commence.

Candu Extreme Events

Event: Recovery operations

The virtual CANDU X reactor
The virtual CANDU X reactor

Event: Recovery operations

Accident progression has been halted, and the site is secured for clean-up and recovery operations.

Reactor Status

Reactor is isolated by containment. The containment building continues to isolate the reactor from the environment. The vault's reinforced concrete walls and the containment building's thick base slab are designed to contain the disassembled core until recovery operations can secure the site for clean-up and decontamination. It’s important to note that this type of accident would take several days to develop and is unlikely, given the many layered safety systems in place.

Candu Extreme Events

Ready in the unlikely event of an incident

Although we would never say that a nuclear incident is “impossible” in Canada, we can say with great confidence that we have planned for every eventuality. Canada’s CANDU reactors are built as safety systems first and foremost—and as power-generation stations second.

It is our job at CNSC to keep Canadians and the environment safe. We ensure every nuclear power plant meets rigorous safety and operations standards, to prevent accidents in the first place and, should one occur, minimize its consequences.