The characteristics of the CANDU reactor relevant to severe accidents are set first by the inherent properties of the design, and second by the Canadian safety/licensing approach. The pressure-tube concept allows the separate, low-pressure, heavy-water moderator to act as a backup heat sink even if there is no water in the fuel channels. Should this also fail, the calandria shell itself can contain the debris, with heat being transferred to the water-filled shield tank around the core. Should the severe core damage sequence progress further, the shield tank and the concrete reactor vault significantly delay the challenge to containment. Furthermore, should core melt lead to containment overpressure, the containment behaviour is such that leaks through the concrete containment wall reduce the possibility of catastrophic structural failure. The Canadian licensing philosophy requires that each accident, together with failure of each safety system in turn, be assessed (and specified dose limits met) as part of the design and licensing basis. In response, designers have provided CANDUs with two independent dedicated shutdown systems, and the likelihood of Anticipated Transients Without Scram is negligible. Probabilistic safety assessment studies have been performed on operating CANDU plants, and on the 4 x 880 MW(e) Darlington station More>>
Snell, V G; Howieson, J Q;  Alikhan, S;  Frescura, G M; King, F;  Rogers, J T;  Tamm, H 
- Atomic Energy of Canada Ltd. (Canada)
- New Brunswick Electric Power Commission (Canada)
- Ontario Hydro (Canada)
- Carleton Univ., Ottawa, ON (Canada)
- Atomic Energy of Canada Ltd. (Canada). Whiteshell Research Lab.