IAEA-SM-353/50 XA0053581

CANDU 9 DESIGN

S.K.W. YU
Atomic Energy of Canada Ltd,
Mississauga, Ontario, Canada

Abstract

AECL has made significant design improvements in the latest CANDU nuclear power plant (NPP) - the CANDU 9.
The CANDU 9 operates with the energy efficient heavy water moderated reactor and natural uranium fuel and
utilizes proven technology. The CANDU 9 NPP design is similar to the world leading CANDU 6 but is based upon
the single unit adaptation of the 900MWe class reactors currently operating in Canada as in integrated four-unit
configurations. The evolution of the CANDU® family of heavy water reactors (HWR) is based on a continuous
product improvement approach. Proven equipment and systems from operating stations are standardized and used in
new products. As a result of the flexibility of the technology, evolution of the current design will ensure that any new
requirements can be met, and there is no need to change the basic concept. This paper will provide an overview for
some of the key features of the CANDU 9 NPP such as nuclear systems and equipment, advanced control and
computer systems, safety design and protection features, and plant layout. The safety enhancements and operability
improvements implemented in this design are described and some of the advantages that can be expected by the
operating utility are highlighted.

1. Introduction
Building on the success of the 4 unit station at Bruce B which began commercial operation in
1980s, four additional 900 MW(e) class units were commissioned at Darlington in the early 1990s. The
CANDU 9 is a 935 MW(e) reactor based on the multi-unit Darlington and Bruce B designs with some
additional enhancements from our ongoing engineering and research programs [1,2,3]. The CANDU 9
reactor continues the evolutionary improvement approach adopted for the CANDU 6. In addition to the
advantages of using proven systems and components, CANDU 9 offers improvement features with
enhanced safety, a control centre with better operability and improved project delivery in both
engineering and construction.
Enhanced competitiveness of the CANDU product is assured by incorporating improvements based
on updated technologies, including safety technology, the rapidly advancing information technology and
modern construction methodology. Reduced project implementation risk for CANDU 9 is assured by up-
front engineering and licensing prior to contract start.
A cutaway view of the CANDU 9 plant is shown in Figure 1-1.
The principal CANDU 9 requirements include:
a. A CANDU plant with a gross electrical output of over 935 MWe, utilising proven systems
components and concepts.
b. Reduce specific capital cost, construction schedule by minimizing equipment installation time, and
unit energy cost.
c. The enhancement of traditional CANDU advantages including real safety, low radiation exposure,
high capacity factor, ease of maintenance, and low operating cost.
d. Specific design targets include a reduction in occupational doses to below 1 person Sv per year and a
90 percent or greater lifetime capacity factor.
e. Human factors considerations in the design of systems, facilities, equipment and procedures. Human
factors driven design considerations are applied plant-wide consistently where there is an interface
with plant personnel.
f. The plant component shall be designed to operate for up to 60 years with allowance for expeditious
replacement. The provision for "easy" replacement means quick, simple and without complex

552
 I

I i, .

! !:
I- '" '•• '

Figure 1-1. Cutaway view ofCANDU9plant.

tooling, thereby minimising radiation exposure. Such work may be necessary to extend operating life
after more than 30 years of operation for pressure tubes, and more than 40 years for replaceable
equipment such as steam generators.
g. Provision for improved plant capability from a maintenance/in-service inspection viewpoint
1. a total of 28 days over a two year period of station operation required for scheduled maintenance
outages, and
2. accommodation of any major maintenance outages that may become necessary, including large
component replacement, major systems modernisation, or equipment refurbishing, lasting up to
180 days every 10 years.

2. Description of the nuclear systems

2.1 Primary circuit

The coolant flow in the CANDU 9 heat transport system is in the "figure-of-eight" pattern
employed in all CANDU reactors, with the heat transport pumps in series and the coolant making two
core passes per cycle. The equipment arrangement results in bi-directional coolant flow through the core
Improvements were made to the CANDU 9 heat transport system (HTS), relative to the reference
configuration at Bruce B by interlacing the feeders so that adjacent channels are alternatively connected
to separate inlet and outlet headers. In this way the fuel channels served by each inlet header (25% of
total) are uniformly distributed throughout the core. This arrangement minimises the positive reactivity
insertion from a large pipe break in the HTS.
Another improvement is the provision of a larger pressurizer capable of accommodating changes in
volume of the reactor coolant in the HTS from full power to shutdown condition at 100°C. This
additional inventory will allow the heat transport system to remain filled with water to enhance stable
thermosyphoning after events such as a loss of forced circulation, a loss of main heat sinks, or a spurious
cooldown.

2.2 Reactor core and systems

The design and the neutronic characterics of the CANDU 9 reactor core closely follows that of
operating CANDU reactors. The core incorporates the standard CANDU geometrical arrangement of
horizontal fuel channels in a square lattice.

553
 Standard CANDU fuel consists of 37 elements of uranium dioxide sheathed in Zircaloy and held
together as a bundle by end-plates. There are 12 fuel bundles in each fuel channel.
The reactor fuel is changed on a routine basis with the reactor operating at full load using two
fuelling machines, one located at each end of the reactor. Each CANDU 9 fuelling machine is mounted
on a fuelling machine carriage, which travels on a track that runs between the fuel ports at the
containment building wall and the fuelling machine vault.
On-power fuel changing is normally performed under automatic remote control. One fuelling
machine clamps on to the new fuel port and accepts new fuel bundles. The machine is then connected to
a fuel channel for refuelling. The other fuelling machine, having discharged all irradiated fuel bundles to
an irradiated fuel bay via the irradiated fuel port, similarly moves to the opposite end of the fuel channel
selected for refuelling.
Space, handling and lifting facilities are provided in the irradiated fuel bay areas for transferring
irradiated fuel to transport equipment for shipping to on-site dry fuel storage facilities.

2,3 Primary components

Reactor Assembly

The reactor vessel consists of a cylindrical calandria (Figure 2-1), and end shield assembly,
enclosed and supported by the cylindrical shield tank and its end walls. The calandria shell is closed and
supported by the end shields at each end, filled with heavy water moderator. The shield tank is filled with

REACTOR VAULT
^ ROOF
SHIELD TANK OVER
PRESSURE RUPTURE
DISC AND PIPING
VERTICAL REACTIVITY
CONTROL UNITS
LIQUID ZONE
CONTROL TRENCHES

SEMI-FLEXIBLE JOINT -
SHIELD TANK END WALL
TO VAULT END WALL
EMBEOMENT

X
Figure 2-1. Reactor assembly.

554
light water and the spaces between the two tubesheets of both end shields are filled with steel balls and
water. This shielding allows personnel access to the reactor face during reactor shutdown. The effect of
integrated flux, or fluence, on the calandria assembly for operation up to 60 years has been included in
the reactor assembly design.

Fuel Channels
The horizontal fuel channel assemblies are of the same design as those of CANDU 6. Each
pressure tube is thermally insulated from the low temperature, low pressure moderator by the carbon
dioxide filled gas annulus formed between the pressure tube and the calandria tube. Provision is made to
promptly detect leakage from the moderator or heat transport system into the annulus of any fuel channel
by continuously monitoring the moisture content of the gas in the annulus gas system.
The pressure tubes are made of a cold-worked, zirconium-2.5% niobium alloy, which offers high
strength, low neutron absorption and high corrosion resistance. The pressure tubes which are the only
components in a CANDU reactor subjected to a combination of high radiation, high stress, and high
temperature, have a minimum service life of 30 years and are readily replaceable.
Steam generators
The CANDU 9 steam generators, which are of the same design as those of Darlington, consist of
an inverted vertical U-tube bundle in a cylindrical shell.
High recirculation ratios and relatively low heat flux, in combination with comprehensive
chemistry control, careful material specification and detailed attention to design assure long life and low
maintenance requirements for CANDU steam generators. An all-welded primary head divider plate is
incorporated to minimize leakage during normal operation. For CANDU 9, additional inspection ports
are added near the tubesheet and at tube support plates on the secondary side to provide increased access
for cleaning, inspection and water lancing.
Reactor coolant pumps
The CANDU 9 heat transport pumps are of the same design as those of the Bruce B and
Darlington Nuclear Generating Stations. Each pump is driven by a vertical, totally enclosed, air-water
cooled squirrel cage induction motor. The pump seals and bearings can be removed without removing the
motor. The pump shaft sealing arrangement consists of three mechanical seals and one back-up seal in
series. Each mechanical seal is designed to withstand the full differential pressure.

2.4 Reactor auxiliary systems

Moderator System
The heavy water moderator in the calandria is used to thermalize fast neutrons produced by fission
and is circulated through the calandria and moderator heat exchangers to remove the heat generated in the
moderator during reactor operation.
The moderator system is fully independent of the heat transport system. The moderator system
includes two pumps and four plate-type heat exchangers. The heavy water in the calandria functions as a
heat sink in the unlikely event of a loss of coolant accident coincident with failure of emergency core
cooling. The capability of this heat sink is assured by controlling the heavy water temperature in the
calandria within specified limits and providing the means for inventory make-up from the reserve water
system.
Shutdown Cooling System
After shutdown and during maintenance, the shutdown cooling system removes decay heat and
cools the heat transport system to a temperature suitable for maintenance of the heat transport and
auxiliary systems components. For CANDU 9, design specifications for the system and components are
enhanced so that the system can be placed into service under zero power, full pressure, hot conditions
(265 deg C) to cooldown the heat transport system, and is therefore a backup to the steam generators for
emergencies. This additional capability enhances the overall heat sink reliability for CANDU 9.

555
 Reserve Water System
The reserve water tank provides an emergency water supply for emergency core cooling, backup
feedwater supply as well as providing a make-up source for the shield tank, moderator and heat transport
systems.

The reserve water tank is also connected to the normal end shield cooling circuit. During normal
reactor operation, the reserve water tank acts as the head tank for the end shield cooling circulation
pumps. However, in the event of process failures such as a loss of forced circulation in the end shield
cooling circuit or a loss of cooling water to the end shield heat exchanger, the reserve water tank with its
large water inventory acts as a passive heat sink. The layout of the equipment and the piping connection
between the end shield of the reactor core and the reserve water tank are designed to facilitate enhanced
thermosyphoning for heat removal from the end shield. [4]
Steam and Feedwater Systems
Steam produced in the steam generators is fed by separate steam mains to the turbine steam chest.
The steam pressure is normally controlled to a constant value by varying reactor power to match the
turbine-generator demand.
The Group 1 feedwater system comprises three 50 percent capacity main feedwater pumps on Class
IV power that take suction from the deaerator storage tank, and a diesel driven auxiliary feedwater pump.
Feedwater from the regenerative feed heating system is supplied to the steam generators through two
separate feedwater mains.
A Group 2 Feedwater System provides emergency water to the steam generators automatically for
decay heat removal for approximately 10 hours, providing back-up to the Group 1 Feedwater Systems.
This new system is seismically qualified and can operate at full steam generator pressure so as to cope
with all the possible operating conditions in the steam generators. The available operator response time,
generally 8 hours, has been attained for accident conditions requiring steam generator heat sinks.

HVAC
The reactor building cooling system controls air temperatures in both accessible and inaccessible
areas of the reactor building during reactor operation. The system also remains functional during a loss-
of-coolant accident or a steam main failure. The system consists of vault cooling units and local cooling
units for the shutdown cooling and moderator rooms and the accessible areas. Each cooling unit
comprises air coolers, dampers and fans as well as piping and instrumentation.
The reactor building ventilation system provides air exchange and air distribution, maintains the
reactor building at a slightly lower than atmospheric pressure, and provides filtration of activity.

2.5 Operating characteristics

CANDU 9 can operate continuously in the reactor-following-turbine mode and is capable of load
following cycles that typically involve a rapid reduction of power from 100% to 60%, steady-state
operation at 60% power for 6 hours, and a return to near full power over the following four hour period.
For reactor power increases, the nuclear steam plant portion of the plant is capable of manoeuvring
at the following rates:

Power Range Maximum Rate

0 - 2 0 percent of full power 4 percent of actual power per second
20 - 80 percent of full power 0.8 percent of full power per second
80-100 percent of full power 0.17 percent of full power per second

556
The overall plant power manoeuvring rate is a function of turbine design, and is typically limited to 5 to
10 percent of full power per minute.
The turbine bypass system to the condenser is capable of accepting the entire steam flow during a
reactor power setback following loss of line or turbine trip, thereby avoiding any steam discharge to the
atmosphere. The steam flow is initially 100 percent, but decreases to a steady state value in the range of
60 percent after several minutes.

3. Description of turbine generator plant system

The turbine-generator, feedwater and condensate plant is of conventional design. Requirements
are specified, however, to assure performance and integrity of the nuclear steam plant. These include, for
example, materials requirements (titanium condenser, absence of copper alloys in the feed train), feed
train reliability requirements, feedwater inventory requirements and turbine bypass capability.

4. Instrumentation and control systems

4.1 Control centre design and operational interface

The design strategy for the CANDU 9 advanced control centre is to build upon the proven
accomplishments of the control centre features of operating CANDU stations, and to improve operational
tasks based on operations feedback, with a systematic and rigorous design process. The design focus for
advanced features [5] is to improve the operability of the station, decrease the likelihood of operator or
maintainer errors and to facilitate the achievement of higher production capacity factors while
maintaining safety standards and providing improved maintenance/diagnostic capabilities.
Human factors principles are used in the design of the operator interfacing functions. The CANDU
9 control centre is consistent with current and emerging Canadian Standards Association (CSA) standards
and with accepted international practices for nuclear plant control room design. Consideration of
emergency operating procedures, critical safety parameters and post accident management standards are
included in the control centre design process. Verification and validation activities ensure a functional
control centre human system interface.
The main control room contains the main operator console, the fuel handling console, the safety
system console, a shift interrogation console, and the main control room panels (Figure 4-1).
From the main operator console, the operator can perform supervisory and device control of the
plant as it manoeuvres from zero power cold to full power. An annunciation interrogation workstation is
provided at the main operator console. The consoles are arranged to give the operator an unobstructed
view of alarm message video display units and central overview display. The main operator console has
function based keyboards which allow interactive control and display commands.
The operator has comprehensive access to current and recorded data on all plant systems. Alarm
annunciation follows existing CANDU practice, with improvements in the interactive use of "alarm
filters", priority and system classification, etc. Automatic identification of the entry conditions to key
procedures, enhanced alarm status review features, and the creation of high level alarms to aid operator
diagnosis of plant fault conditions, are major improvements over past practice.
From the safety systems console the operator performs (computer-aided) testing and monitoring of
the four special safety systems. Computer based displays available for the safety systems follow the plant
conventions for video display unit interaction and format. Seismically qualified cabinets and
instrumentation are used for all special safety systems in the main control room. The CANDU 9 main
control room structure is seismically qualified for a design basis earthquake.
The human-system interface in the secondary control area is a duplication of the corresponding
Group 2 control locations, layouts and capabilities present in the main control room, except safety system
testing. This will ease the operator's task in relocating from one control area to the other. The design
basis requires that the operator leaves for the secondary control area if the main control room becomes
uninhabitable.

557
 Figure 4-1. Main control room.

The control centre layout makes space provision for a technical support centre. For utilities which
are required to comply in specific detail with NRC NUREG 696, this facility provides for the required
staff complement and safety parameter display facilities and related emergency support documentation.

Distributed Control System

Most of the Group 1 control functions are implemented by the Distributed Control System. The
Distributed Control System also provides some control related data acquisition for the monitoring, alarm
annunciation, display and data recording functions performed by the Plant Display System. The
Distributed Control System also receives and executes operator commands entered via the Plant Display
System.
The Distributed Control System is a modular digital control system which uses a number of
programmable digital controllers connected to data highways. The data highways data transmission
method provides very high data security. The system includes comprehensive fault detection,
redundancy, and switchover features, to provide a very high degree of immunity to random component
failures.
All control functions are implemented by programs in small powerful processor modules which are
used in redundant pairs. The processors are programmed using control function block diagrams.
The distributed control system is partitioned into five independent functional segments, one for
each of the major groups of plant systems. This functional partitioning provides a defence against
common-mode faults (Figure 4-2).

Plant Display System and Safety System Monitor

The plant display system provides the monitoring, supervisory control and data handling facilities
for the normal power production systems and also has the ability to monitor the Group 1 special safety
systems and Group 2 systems. Some control related Group 1 information from the plant is fed to the plant
display system via the distributed control system in addition to the facilities existing to receive
information from other devices not involved in the distributed control system operation. This provides a
complete plant status database of the normal power production systems information accessible to the
operator. Operator setpoints and commands for the control functions are input to the distributed control
system via the plant display system.

558
 MAIN CONTROL ROOM i SECONDARY CONTROL ROOM
DATA LINK
GROUP I PROCESS SAFETY SYSTEMS
GROW 2 INTERFACES SIGNAL WUUNO
SYSTEMS INTERFACES INTERFACES
c w I rut Jt-Jwi* Coma* I Hsntannd
AUXILIARY
SYSTEMS
WtHfc I W o * I F*M1 Wo* 1 PsmF
SMioni I SMkc* 1 Device* Stationi I Devise. CONTROL
LOOK

CONTAINMENT
ISOLATION

CONVENTIONAL
PLANT
LOGIC
CONTROL
ECC EMERGENCY
CORECOOUNQ
HTS HEAT
TRANSPORT
SYSTEM
CONTOL
LOOK

WELHANDUNO
SIONAL ISOLATION
OR BUFFERING
PLANT DISPLAY
SYSTEMS
REACTOR
REQULATINa
SYSTEM
CONTROL
LOOK
SHUTDOWN
SYSTEM

STEAM
GENERATOR
CONTROL
LOOK

SAFETY SUPPORT
SYSTEMS
GROUP 1 SAFETY
SYSTEM* SENSORS SAFETY SYSTEM
CONTROtSENSORS AND ACTUATORS <OROUP1)
ANDACTVATORS MONITOR

Figure 4-2. CANDU 9 instrumentation and control overview.

The two safety system monitors provide the monitoring, testing and data handling for the Group 1
special safety system and for the Group 2 systems. The information is fed to the safety system monitors
from the channellized computers in the individual special safety systems.
The plant display system and the safety system monitors are the logical evolution of the successful
application of digital computers in other CANDU plants. Each is highly redundant and modularised so as
to maintain function availability in excess of 99 percent. High availability is achieved by ensuring that
each of the major subsystems is either duplicated or provided with modular redundancy. All subsystems
except for the graphic operator stations are duplicated. The number and arrangement of operator stations
provides sufficient system redundancy. With their open architecture it is possible to expand the systems
to meet future requirements.
CANDU 9 Post Accident monitoring is a conventional hardwired system made of discrete panel
mounted devices located in both the main control room and the secondary control area. All PAM
information will be clearly and uniquely distinguishable from other systems.

4.2 Power supply systems

The station service distribution supplies process and instrumentation loads within the plant. Group
1 provides power to production related equipment and to safety support systems. Group 2 is seismically
and environmentally qualified and supplies power to all special safety systems and safety support
systems, and to the secondary control area.
Standby power is supplied from both Group 1 as well as Group 2 for high reliability. The Group 1
Class III standby power supply system is provided by two diesel-generator units. The Class III shutdown
loads are duplicated, one complete system being fed from each diesel-generator. There are two
additional diesel-generator sets providing Group 2 Class III emergency power supply system. Each of
these diesel-generators can supply the total safe shutdown load of the unit.
In the event of failure of the normal Class IV power sources, all four standby generators start
automatically. The diesel-generators come up to speed and accept key loads within 30 seconds, and full
load within two minutes. The fuel system has the capacity to supply the diesel generators for seven days
of continuous operation at nominal load.

559
 The reactor protective and safety systems, control logic, instrumentation, computers, critical motor
loads, essential and emergency lighting and switchgear operation are supplied with uninterruptible power.
The uninterruptible power supplies provide AC and DC power as required to the Class II and Class I
systems. The Group 1 batteries are sized to support all the loads connected for up to 60 minutes
following an interruption to the normal (Class III) source. AC power is obtained through static inverters.
The Group 2 batteries are utilised for the emergency generators control logic and switchgear operation,
and power the safety systems detection and initiation functions.

5. Safety Design

5. / Safety requirements and design philosophy

CANDU design practice places emphasis on both inherent and engineered safety features to ensure
that the plant can be safely operated and can respond to transients and accidents without causing undue
risk to the plant personnel, the public and the environment.
Furthermore, accidents must be shown to have acceptable consequences, not only when the safety
systems work, but also if a safety system is unavailable or impaired. This overall safety approach is
achievable because there are at least two independent ways of providing the safety functions of shutdown
and decay heat removal.
The concept of grouping and separation of safety related systems has been an integral component
of CANDU plant designs for many years. For hazards such as earthquakes, fires, floods, missiles, etc.,
the plant is protected through implementation of a two-group approach. All plant systems are assigned to
one of two Groups (Group 1 or Group 2). The systems of each Group are capable of shutting down the
reactor, maintaining cooling of the fuel and providing plant monitoring capability, even if all of the other
Group of systems is unavailable. For the CANDU 9 design, this concept has been enhanced through
additional redundancy and diversity in the provision of cooling water, power supplies, and plant
monitoring devices to maintain the controlled shutdown and cooldown condition. In particular, separate,
seismically qualified Group 2 cooling water system, Group 2 power distribution system and Group 2 feed
water system have been provided to assure heat removal after common mode events including an
earthquake.

5.2 Safety systems features

The primary engineered safety features include the special safety systems: two shutdown systems
(SDS1 and SDS2), the emergency core cooling system (ECCS) and the containment system. These
systems have the dedicated role of mitigating the effects of postulated accidents, and are designed to be:
• Independent,
• Separated physically,
• Redundant,
• Testable during service, to meet a reliability target of 999 times out of 1000 tries, and
• Diverse in design and operation.

Shutdown Systems
The CANDU 9 reactor incorporates two diverse, passive, shutdown systems which are independent
of each other and from the reactor regulating system.
Shutdown system No. 1 (SDS1) consists of mechanical shutdown rods.
Shutdown system No. 2 (SDS2) injects a concentrated solution of gadolinium nitrate into the low
pressure moderator to quickly render the core subcritical.
The trip decision logic for each shutdown system is implemented through triplicated digital "trip
computers" using rigorous software development methodologies and mathematical software verification
techniques.

560
 A computerized monitoring and test system in CANDU 9 provides the operator with indications of
all shutdown system parameters and assists the operator in testing. The system prompts the operator,
executes the testing, and records the test results. The test frequency depends on the unavailability
requirement and the equipment failure rate for each trip variable. A test is automatically terminated if
another trip channel goes into a tripped state.

Emergency Core Cooling System

The emergency core cooling system (ECCS) supplies light water coolant to the reactor and
maintains fuel cooling in the event of a loss-of-coolant accident.
The design of the emergency core cooling system (ECCS) has been simplified by reducing the
number of valves and using passive one-way rupture disks to separate the HTS from the ECCS. This
improves the reliability of system operation in the event of a loss of coolant accident (LOCA). These
improvements also reduce the capital cost as well as significantly reducing the operating and maintenance
costs for testing, inspection, maintenance and repair over the lifetime of the NPP.

Containment System
The CANDU 9 reactor building is a steel-lined, pre-stressed concrete structure which provides
biological shielding and the containment boundary. A representative reactor building section view is
shown in Figure 5-1.

MAM tlCAM

HT StS

950328-4T

Figure 5-1. Reactor building sectional view.

561
 The improved CANDU 9 containment system uses a 'large dry' cylindrical steel lined containment
without a dousing system to achieve enhanced containment integrity with increased simplicity. The
design leak rate is 0.2 % volume/day at design pressure. Because of the lower design leak rate from
containment, the exclusion area radius for the siting of CANDU 9 can be as small as 500 meters,
significantly reducing site area requirements for CANDU 9 plants. This is an important advantage in the
context of siting requirements and land availability.
The free volume inside the containment is sufficiently large such that a pressure suppression
system is not required in the short term to reduce the peak pressure after a LOCA below the design
pressure. The long-term containment atmosphere heat sink is provided by the reactor building air coolers.
Judicious layout of equipment inside containment results in large, open volumes, with good potential for
natural circulation and no hydrogen traps.
The containment system automatically closes (i.e. buttons-up) all reactor building penetrations
open to the containment atmosphere when an increase in containment pressure or radioactivity level is
detected. Automatic isolation of the ventilation lines penetrating the containment structure has been
enhanced and is provided by two separate and independent systems for increased reliability. The
containment ventilation system provides enhanced atmospheric mixing with higher flow rates within the
reactor building following a postulated loss-of-coolant-accident (LOCA). Passive catalytic recombiners
are provided to control hydrogen concentration in the long term period after a LOCA; short-term control
is accomplished by igniters.

5.3 Severe accidents (Beyond-design-basis accidents)

Probabilistic analysis has been a hallmark of CANDU safety philosophy since its inception;
Canada remains one of the few countries whose regulations are based largely on probabilistic
considerations.
For a loss of coolant accompanied by total failure of emergency core cooling system flow, the
pressure tube will overheat, then sag or strain into contact with its surrounding calandria tube.
Consequently, the fuel decay heat is transferred to the calandria tube through the pressure tube, and
removed by the moderator. The surface finish of the calandria tube has been improved for CANDU 9 to
enhance this heat transfer. A roughened surface is produced by shot-peening on the outside to promote
nucleate boiling and a black oxide surface finish was added to the inside to increase radioactive heat
transfer from the overheated fuel and pressure tube. Because of the cooling capability of the moderator,
damaged fuel would remain within the pressure tubes, without UO2 melting, so that the core geometry
would be retained.
Should the moderator heat removal system subsequently fail, the CANDU 9 shield tank
surrounding the calandria vessel provides an additional line of defence under severe accident situations.
This will retain the debris inside the calandria, by keeping the outside of the calandria shell cool for a
minimum period of 24 hours. This allows time for fission products to decay further, for decay heat to
reduce, and for emergency planning. The role of the shield tank/end shield cooling system in severe
accidents has been strengthened on CANDU 9 by provision of passive heat rejection to the reserve water
tank.
Consistent with the targets for summed accident frequencies in the Electric Power Research
Institute (EPRI) requirements document for Advanced Light Water Reactors, the following design
requirements have been adopted for individual events during the CANDU 9 design process:
- A severe core damage accident shall be less frequent than 10'Vyear, and
- Any accident which causes a large radioactivity release shall be less frequent than lOVyear.
Compliance is confirmed by a comprehensive probabilistic safety assessment (PSA). High level
accident management procedures are provided as part of the PSA, and accounted for in the event
frequencies. The completed plant design is analysed to demonstrate that systems are capable of
performing their assigned safety functions and that the radiation dose criteria are satisfied.

562
 6. Plant buildings and layout
The conceptual plant arrangement, which includes the nuclear steam plant (NSP), and balance of
plant (BOP), is designed as a stand alone, self-sufficient, single unit plant containing all facilities required
for day-to-day operation. The basic building block consists of the reactor building (RB), the reactor
auxiliary building (RAB), a maintenance building (MB), and the turbine building (TB).
Multiple unit CANDU 9 stations are achieved using the single unit design as a building block. The
improved layout which features a narrow 110m wide "footprint" allows several units to be constructed
adjacent to each other to form a very compact mult-unit station. A station services building (SSB) houses
common services which are shared between units such as access control and security, change rooms,
laundry services, central stores, overhaul facilities and large shops, heavy water management facilities,
liquid waste management, engineering, maintenance and administrative services, and cafeteria facilities.
The basic SSB is capable of serving a two unit station, and is easily expandable through the addition of
floors and bays, to service additional units.
A typical two unit CANDU 9 station layout is shown in Figure 6-1.

KACTdt MU01NC
K K W MffllUin MflUIMa
nmm WHOM
KMMTtHMCt WIL01W
STATIOI KttfCt WILfiINC

Figure 6-1. 2 unit CANDU 9 plant layout.

The reactor building comprises a cylindrical perimeter structure with a domed top and internal
structures all on a common base slab. The reactor building houses the major nuclear steam plant systems
and equipment. The major internal structures are reinforced concrete. The layout of the internal concrete
structure walls, floors, active equipment and components are arranged to minimise personnel exposure to
radiation while maximising access for testing and maintenance of components, and to minimise
construction costs and schedule.
The reactor auxiliary building is a four storey structure consisting of a reinforced concrete
substructure and a braced steel frame superstructure. The reactor auxiliary building is seismically
qualified to design basis earthquake, and tornado protection is provided in accordance with the site
requirements. Internally, it is divided into Group 1 and Group 2 areas.

563
 The Group 1 area of the reactor auxiliary building accommodates umbilicals which run between the
principal structures, the main control room, the irradiated fuel storage bays and associated fuel handling
facilities, the irradiated fuel bays cooling and purification system, and the Group 1 recirculated cooling
water system.
The Group 2 areas of the building house two of the special safety systems, safety support systems,
the secondary control area, the Group 2 feedwater storage tank and pumps, the Group 2 electrical, control
and monitoring systems, the Group 2 raw service water valve stations, and the ECC system recovery
pumps. The secondary control area provides control and monitoring capability for all the systems
required for the safe shutdown and monitoring of the plant and the maintenance of a long term heat sink
should the main control room become uninhabitable or non-functional.
The turbine building is located on the 'D' side of the maintenance building with the turbine shaft
alignment perpendicular to the reactor building thus assuring that any turbine generated missiles will not
impact on containment or on the areas of the reactor auxiliary building which contains the main control
room and secondary control area. This is also the optimum location with respect to ease of access to the
control room, and the cost of piping and cable tray runs.

564
7. Technical data

General Plant Data Fuel design (rod array) circular array

Power plant output, gross 935 MWe Number of Fuel Bundles 5760
Power Plant output, net 875 MWe Number of fuel rods ( pins) /assembly 37-element
Reactor thermal output 2 716 MW Enrichment of fuel 0.7 Wt%
Power plant efficiency, net 32.2% % Average discharge burnup of fuel 8 520 MWd/t
Cooling Water temperature 25.5 °C Cladding tube material zirconium alloy
Cladding tube wall thickness 0.42 mm
Nuclear Steam Supply System Outer diameter of fuel rods 13.08 mm
Number of coolant loops 1 Overall weight of fuel bundle 24.1 kg
Primary circuit volume 220 m3 Number of shutdown/control units - vertical 58
Steam flow rate at nominal conditions 1 328.4 kg/s Number of shutdown units - horizontal 8
Feedwater flow rate at nominal conditions 1 329.6 kg/s Reactivity control material - out of core stainless steel
Steam temperature 265 °C - in core zircaloy/stainless
Steam pressure (gauge) 5.0 MPa steel/cadmium
Feedwater Temperature 177 °C
Reactor Vessel
Reactor Coolant System Calandria shield tank assembly (CSTA) diameter 13.38 m
Primary coolant flow rate 11000 kg/s Wall thickness of cylindrical shell - calandria 32 mm
Reactor outlet header operating pressure 9.9 MPa - shield tank 38.1 mm
Reactor inlet header operating temperature 267 °C CSTA overall length 8.2 m
Reactor outlet header operating temperature 310 °C Base material - Calandria 304L Stainless Steel
Specific Enthalpy Change Across Core (average) 246 kJ/kg Base material - shield tank carbon steel
Design pressure/temperature 1.2/105 MPa/°C
Reactor Core Transport weight (CSTA) 552 t
Active core length 5.944 m
Core Radius, Effective 3.532 m Fuel Channels
Number of Lattice Cells 480 Pressure tube inside diameter 103.4 mm
Cell array square Number of pressure tubes 480
Lattice pitch 285.75 mm Flow in maximum power channel 26 kg/s
Fuel inventory 110 tU Est. pressure drop across 12 bundles 830 kPa

Steam Generators
Steam generator type vertical U-tube with
integral preheaters
No. of steam generators 4
Fuel material Sintered U2O Heat transfer surface each 5 138 m2
Fuel assembly(fuel bundle) total length 495.3 mm Tube dimensions (outer diaVthickness) 15.9/1.13 mm
Maximum outer diameter 4410 mm Material (shell side) carbon steel
Total height 20 822 mm
Transport weight 340.7 t Primary Containment
Shell and tube sheet material carbon steel Containment type prestressed concrete
Tube material Incoloy 800 with steel liner
Overall form (spherical/cyl.) cylindrical
Reactor Coolant Pump Inside Diameter 57 m
Number 4 Wall thickness 1.5 m
Design pressure (gauge) 12.7 MPa Height (top of base slab to top of dome) 71.5 m
Design temperature 279 °C Free volume 124 000 m3
Design flow rate(at operating conditions) 3.2 nrVs Normal operating temperature range 15-50 °C
Operating Temperature 267 °C Design pressure (LOCA) (gauge) 210 kPa
Pump Head 247.6 m Steam main break design condition (gauge) 450 kPa
Power Demand at Coupling, hot 7 640 kWe Design leakage rate per day 0.2 vol%/day
Pump casing material carbon steel Is secondary containment provided? No
Pump speed 1800 rpm
Reactor Auxiliary Svstents
Pressurizer Reactor water cleanup - (purification) 14.3 kg/s
Total volume 130 m3 Reactor water cleanup - filter type disposable cartridge
Steam volume: full / zero power 30/60 m3
Design Pressure (gauge) 11 MPa Residual heat removal - at high pressure 48 kg/s
Design Temperature 316 °C Residual heat removal - at low pressure 580 kg/s
Heating power of heater rods 2.1 MWe
Inner diameter 3 000 mm Coolant injection - at high pressure from accumulator 3 900 kg/s
Total height 20 819 mm Coolant injection - at low pressure 1200 kg/s
Material carbon steel
Transport weight 187.7 t

Pressurizer Relief Tank Power Supply Systems

Bleed Condenser Tank - total volume 25 m3 Main Output Transformer -rated voltage 345/24 kV
Design pressure/temperature 12.65/310 MPa/°C Main Output Transformer -rated capacity 1 050/1 150 MVA
Inner diameter (vessel) 2 496 mm Unit Service Transformer - rated voltage 24/13.8/13.8 kV
Total height 7 620 mm Unit Service Transformer - rated capacity 60/80/100 MVA
System Service Transformer -rated voltage 345/13.8/13.8 kV Feedwater Tank
System Service Transformer -rated capacity 60/80/100 MVA Volume 400 m3
Medium voltage busbars (13.8kV & 4.16kV)) 10 Pressure/temperature 0.75/154 MP/°C
Number of low voltage busbar systems (480V)
- Group 1 (non-safety) 3 Feedwater Pumas
- Group 2 (safety) 2 Number of main pumps 3 x 50%
Standby diesel generating units Flow rate 665.8 kg/s
- Group 1 (non-safety) number/rated power 2/9.5 MWe Feedwater temperature 177 °C
- Group 2 (safety) - number/rated power 2/4.5 MWe Number of auxiliary pumps 1 x 4%
Number of diesel-backed busbar systems 2 Flow rate 53 kg/s
Voltage level of these 4.16/0.48 kVac Number of Group 2 auxiliary pumps 2 x 4%
A
Number of battery-backed busbar systems
Voltage level of these 480/208/120 Vac

Turbine Plant Condensate Feedwater Heaters

Number of turbines per reactor 1 Number of heating stages 6
Type of turbine Tandem Compound Redundancies 2 parallel paths
Number of turbine sections per unit HP/LP/LP/LP
Turbine speed 1800 rpm

Generator
Type 4poleH 2 cooled
Rated power 1 100 MVA
Active power 935 MWe
Voltage level of these 24 kV
Frequency 60 Hz

Condenser
Cooling water flow rate 46 000 L/s
Cooling water temperature 22 °C
Condenser pressure 47 mmHg

Condensate Pumps
Number 2x100%
Flow rate 947.3 kg/s
 8. Project Status And Planned Schedule
The Basic Engineering Program (BEP) followed the CANDU 9 product design
requirement definition work and conceptual studies. The BEP was a 39 month program started
in January, 1995. The scope included performing up-front design engineering and carrying out a
licensability review of CANDU 9 by the Atomic Energy Control Board (AECB).
During the basic engineering program, emphasis was put on the detailed design for the
special safety systems and the associated key safety related systems. Sufficient engineering has
been completed such that we can successfully meet the target schedule duration for construction
with minimal technical and licensing risks. All space allocation has been completed for the
plant buildings. Major systems have had their complete 3-D layouts incorporated into the plant
CADD model. This work provided an up-front definition of improvements or enhanced features
that are different from the reference plants, systems and components.
The CANDU 9 has undergone a thorough review by the AECB staff to obtain assurance
that the CANDU 9 design is licensable in Canada. In 1997 January, the two year licensing
review by the AECB was completed [6] and the results can be summarized by the following
words from the AECB report: "AECB staff conclude that there are no fundamental barriers to
CANDU 9 licensability in Canada."
With the Basic Engineering Program (BEP) objectives met in 1998 March, AECL
continues to prepare for the delivery of the first CANDU 9 project. The current pre-project work
includes further detailed engineering, safety analysis and equipment design engineering. In
addition, this work will have the added benefit of keeping the team working with the advanced
engineering tools and work processes so that we are ready to launch the first CANDU 9 project.

REFERENCES

[1] "Next Generation CANDU Plants", K.R. Hedges and S.K.W. Yu, 6th International
Conference on Nuclear Engineering, ICONE-6, 1998 May 10 to 15, San Diego,
California, USA.
[2] "CANDU 9 Technical Outline", AECL Document 69-013 72-TED-001, 1997 June.
[3] "Design Features of CANDU 9" K.R. Hedges and S.K.W. Yu, Internationale Zeitschrift
fur Kernenergie, 1996 November, Volume II.
[4] "Analysis of the CANDU 9 Shield Cooling in the Event of Loss of Forced Circulation
Using the CATHENA Thermalhydraulic Code", Popov, L.A. Morris and D.N. Padhi,
1997 September, Nuclear Simulation Symposium, Niagara-on-the-Lake, Ontario,
Canada.
[5] "Advanced CANDU Control Centre" by M.J.MacBeth, N.M. Ichiyen, The 5th
International Topical Meeting on Nuclear Thermal Hydraulics, Operations & Safety,
Beijing China 1997, April 14-18.
[6] "CANDU 9 - the CANDU Product to Meet Customer and Regulator Requirements Now
and in the Future", V.G. Snell, J.R. Webb, The 11th Pacific Basin Nuclear Conference,
Banff, Canada 1998 May 3-7.

568