The reactor physics of the CANDU^®1 safety case are characterized by a high level of defence in depth based on a combination of inherent characteristics and engineered safety features. In particular, CANDU 6 reactors are equipped with two independent, highly reliable shutdown systems, each of which includes two signals triggering shutdown for all initiating events. These engineered systems complement the inherent reactor characteristics of small reactivity coefficients and long neutron lifetime. CANDU reactor operating characteristics are relatively stable during operating life. However, the range of operating conditions, and uncertainties in reactor physics models, mean that variations in reactor physics basic parameters should be considered. This paper considers safety analysis sensitivity for LORC and LBLOCA events to variations in reactivity coefficients reflected in the Power Coefficient of Reactivity, and, in particular, demonstrates that variations in PCR are not safety-significant for a reactor based on the CANDU design.

Reactivity characteristics must be considered in the context of the overall safety characteristics of the plant. Without considering the interdependent effects of reactivity characteristics and their interaction with engineered safety systems, the measure of any one reactivity characteristic is an insufficient measure of the reactor safety. Taking an integrated approach is fundamental to understanding the overall reactor safety case. Reactor designs take advantage of their favourable inherent characteristics and compensate for their unfavourable ones. Hence it is important to look at variations in reactor characteristics, such as reactivity coefficients, by studying the overall reactor behaviour in operation, transients, and accidents.

1 Registered trademark of Atomic Energy of Canada Limited, used under exclusive license by Candu Energy Inc. (Candu).

As with other reactor designs, the CANDU 6 design has established a balanced set of inherent reactor physics characteristics, combined with engineered safety systems, to comprise a comprehensive safety case [1].

The main characteristics of the CANDU 6 core are:

Small values of reactivity coefficients

Relatively small changes in core conditions with time

Low excess reactivity

Long neutron lifetime

To complement the above characteristics, the CANDU 6 design includes control and safety systems which manage the reactor response to the range of reactor conditions, namely for normal operation, abnormal operating occurrences (AOO’s), design basis accidents (DBA), and severe accident scenarios.

CANDUs are refuelled routinely at power. This is a continuous process that obviates the need to carry excess reactivity to compensate for fuel depletion. On-power refueling also ensures a stable core condition over life, and overall axial symmetry of both fuel and coolant neutronic properties, minimizing the required worth of local control absorbers. CANDU control devices are used mainly for routine power operation rather than reactivity compensation. The control devices therefore have low total and individual reactivity worth. This is facilitated by the large core size, allowing for numerous control devices, with any individual device worth less than 2.5mk. In this way it is impossible for the adverse movement of any individual device to lead to reactivity insertion greater than the total delayed neutron fraction, β (in range of 5.5mk under equilibrium conditions). Furthermore, the location of all reactivity devices in the low-temperature, low-pressure moderator (they do not penetrate the coolant pressure boundary) rules out the possibility of a control-rod ejection.

The CANDU 6 core has very low values of reactivity coefficients. This means that the neutronic characteristics of the core do not change significantly since operating parameters, such as moderator temperature or neutron poison concentration, very little during normal reactor operation. In particular, the fuel temperature reactivity coefficient (FTC) is negative for the range of burnups in an operating core at nominal conditions. This provides an inherent negative fast feedback for any events which lead to increases in fuel temperature, such as a power rise, or accidents which interrupt fuel cooling. The overall power coefficient of reactivity (PCR) has a very low value, so that power maneuvering from 0 to 100% full power requires very little adjustment of reactivity devices. This also simplifies shutdown management. The major reactivity change during power maneuvers or for a period of shutdown after normal operation arises from Xenon-135 buildup and decay, similar to that in PWR reactor types. The low absolute values of reactivity coefficients also lead to low values of uncertainties and variations in these coefficients, as discussed in section 5 below. Due to the use of heavy water D2O as a moderator and the separation of fuel in individual fuel channels, the CANDU 6 core has a long neutron lifetime, in the order of 900μs ？ about 30 to 45 times longer than that of typical PWRs.

The significance of the long neutron lifetime for CANDU 6 is that, for hypothetical increases in reactivity near or beyond β, the reactor period (a measure of the length of time for reactor flux to increase by a factor e) does not decrease sharply as the reactivity increases. This means that CANDU reactors have an inherent degree of mitigation against sudden reactivity insertions. The reactor period for all conditions stays in a range where either of the two engineered shutdown systems (based on familiar and well-proven technology) readily terminate any reactivity transient before any prolonged overpower can occur.

The safety importance of individual reactivity coefficients is a function of speed, size, and sign. As noted above, for CANDU reactors, the reactivity coefficients lead to relatively small changes in core condition. The result is a reactor which has characteristics that do not change significantly over the operating range, that has a relatively low speed of change due to the long neutron lifetime, and that has small absolute values of reactivity coefficients.

The small power coefficient and long neutron lifetime also contribute to a stable, readily controlled core. Stability analysis demonstrates ample control system margins for normal operations and the range of power maneuvering.

The IAEA does not prescribe specific requirements for the power coefficient of reactivity. Instead, the IAEA approach is to set out high level requirements [2], which lead to a set of safety objectives. For all nuclear power plant designs, the safety objectives are ensured by fulfilling the three fundamental safety functions, namely; i) controlling the reactivity, ii) cooling the fuel (removal of heat from the core), and iii) confinement of radioactive materials and control of operational discharges, as well as limitation of accident releases. The fundamental safety functions are further subdivided into safety functions, applicable to all reactor designs. Specifically, the safety functions applicable to ‘Controlling the Reactivity’ include:

Preventing unacceptable reactivity transients

Maintaining the reactor in a safe shutdown condition after all shutdown actions

Shutting down the reactor as necessary to prevent anticipated operational occurrences (AOO) from leading to design basis accidents (DBA) and shutting down the reactor to mitigate the consequences of DBAs

Maintaining sufficient sub-criticality of fuel stored outside the reactor coolant system but within the site

The primary means for the principle of prevention and mitigation of accidents is the defence-in-depth strategy, which is achieved by the incorporation of good design and an appropriate combination of inherent and engineered safety features that provide safety margins, diversity, and redundancy [2]:

‘ The design shall provide for control of the plant behaviour during and following a PIE, using inherent and engineered features, i.e. uncontrolled transients shall be

minimized or excluded by design to the extent possible’

The requirements pertaining to the design of the core and control of reactivity are expected to demonstrate reactor control in all operating conditions [2]:

‘The maximum degree of positive reactivity and its maximum rate of increase by insertion in operational states and design basis accidents shall be limited so that no resultant failure of the reactor pressure boundary will occur, cooling capability will be maintained and no significant damage will occur to the reactor core’

These safety requirements outlined in IAEA’s top requirements document for the design of nuclear power plants, founded on the fundamental safety objectives through the implementation of the concept of defence-in-depth, has influenced and subsequently been adopted by various national regulatory agencies, such as the Canadian Nuclear Safety Commission (CNSC). The IAEA requirements recognize the combination of inherent features and engineered systems providing assurance of safety.

As described above, the overall features of the CANDU 6 design are consistent with and meet the IAEA safety objectives.

Licensing of CANDU-type reactors was initiated in Canada, where licensing approaches applicable to CANDU reactor characteristics were first developed. In Canada, nuclear power is regulated by the Canadian Nuclear Safety Commission (CNSC). From the beginning the basic tenet of the Canadian reactor safety philosophy was one of defence-in-depth [3]:

‘One of the most important aspects of a defence-in-depth philosophy is the prevention of upset conditions and accidents which threaten the integrity of the fuel sheath and the primary coolant system pressure boundary’

This approach is further reflected in CNSC’s latest requirements document for new-build water-cooled nuclear power plants, RD-337 “Design of New Nuclear Power Plants” [4]. RD-337 identifies safety objectives and safety goals for nuclear power plants, which are based on the principles set forth by the IAEA in NS-R-1. The requirement of RD-337 on the design of the reactor is design neutral. The demonstration of reactor control in all operating conditions and a sufficient safety margin for all shutdown states is required (Section 8.1 of [4]):

“The maximum degree of positive reactivity and its maximum rate of increase by insertion in normal operation, AOO, and DBAs are limited so that no resultant failure of the reactor of the reactor pressure boundary will occur, cooling capability will be maintained, and no significant damage will occur to the reactor core,” and

“The shutdown margin for all shutdown states is such that the core will remain subcritical for any credible changes in the core configuration and reactivity addition.”

Specifically on the topic of PCR, the CNSC has acknowledged that this topic has been reviewed and addressed by CNSC’s regulatory and safety regime; [5]:

“A reactor design that has a positive power coefficient of reactivity is quite acceptable provided that the reactor is stable against power fluctuations, and that the probability and consequences of any potential accidents that would be aggravated by a positive reactivity feedback are maintained within CNSCprescribed limits. These are known safety issues that have long been addressed by the CNSC’s regulatory and safety regime.”

In June 2009, IRRS (Integrated Regulatory Review Service) reviewed Canada’s regulatory framework.

This review confirmed that the Canadian regulator is diligent in ensuring that Canadian nuclear plants are following internationally recognized standards. The following was noted:

‘the CNSC takes into account internationally recognized safety standards and recommendations and adopts or adapts them in the extent possible… As an example, the CNSC regulatory document RD-337, “Design of New Nuclear Power Plants”, adopted the principles set forth by the IAEA in NS-R-1, Safety of Nuclear Plants: Design, regarding design, the interfaces between NPP design and other topics, such as environmental protection, radiation protection, ageing, human factors, security, safeguards, transportation, and accident and emergency response planning.’

This recent IRRS review confirms the CNSC’s alignment with IAEA requirements.

The regulatory bodies of other countries have accepted the Canadian licensing criteria and documents equivalent to those submitted for a reference plant in Canada. An integral part of CANDU’s licensing acceptability is its approach to safety. CANDU’s defence-in-depth approach has been supported by many years of CANDU 6 reliability data that reflect the importance of safety in design.

With the IAEA set of internationally recognized and technology neutral high-level standards and guides as a backdrop, regulators in individual countries have adapted and reflected these guidelines in their specific regulations and in the practices and interpretations used to assess reactor safety. For example, for LWRs, where a control rod ejection accident can introduce a very rapid, large positive reactivity insertion beyond the capability of engineered shutdown systems, a large negative reactivity response is both necessary and is accomplished in the design. Interpretation of requirements depends on the overall safety case and in particular on the probability of events representing a reactivity challenge. For example, in some reactor licensing a timeat- risk argument is used to support variations from normal operating reactivity characteristics. In other cases, the low probability of an accident coupled with failure of engineered safety systems provides a basis for the safety case.

A range of regulatory expressions of reactor design safety are used by regulators in different jurisdictions; many countries that have adopted CANDU reactors have used technology-neutral statements following IAEA practice or based on the Canadian (CNSC) approach, including countries such as China that operate both CANDU and LWRs. Safety cases are kept up to date in each country; for example, in Canada, the Point Lepreau CANDU 6 unit has been licensed for continued life-extended operation following its restart after the current outage.

In recent years, emphasis is being placed on harmonizing regulatory requirements and adopting technology-neutral approaches that measure reactor safety through the implementation of the defence-in-depth concept. Although there are many international initiatives to align nuclear regulations and hence eliminate nation specific requirements, some design-specific elements occur in specific cases.

From the beginning, Canada’s licensing philosophy has been founded on the defence-in-depth concept. In the recent review of the Canadian regulatory framework by the IAEA, the IRRS review mission was clear to identify CNSC’s alignment with the international IAEA standards. Canadian regulations do not preclude the acceptability of a positive reactivity coefficient; rather they establish requirements that demonstrate reactor control for all operating conditions, with a sufficient safety margin. An integral part of CANDU’s licensing acceptability is its approach to safety. Extensive operating experience has demonstrated high standards for CANDU reactors in terms of reliability and safe performance.

A comparison of the reactor characteristics and engineered safety systems response of CANDUs and LWRs [6] shows that in each case, reactivity insertion events are part of the design basis, and that engineered safety systems must be called upon to ensure that fuel is not damaged. Therefore, safety cases are made based on the same overall principles, to show that initiating events covering operating transients and accidents are safely mitigated.

As noted in section 2 above, the role of reactivity coefficients in reactor safety is part of the overall context of safety design, with the combination of the reactor basic characteristics and engineered safety systems. The power coefficient is an overall measure of the reactivity change per unit increase in reactor power, typically in mk/% power. It can be evaluated over any power level, but tends to be of greater interest at high power operation. It is a combination of all other coefficients for parameters that change with power. However, the contributions from coolant void /temperature (for CANDU), fuel temperature, and coolant temperature (for PWR reactors) are of most interest.

For LWR designs, given the large negative values of fuel temperature and coolant temperature coefficients, the power coefficient is likewise negative. Typical PWR values for the power coefficient are -0.11mk/% power at BOC and -0.23mk/% power at EOC in the power operating range.

The main components of PCR in CANDU include the fuel temperature coefficient, which is the immediate, short-timescale reactivity parameter that changes in response to a change in conditions, the coolant void coefficient, which responds to changes in coolant density over a somewhat longer timescale, and the moderator temperature coefficient, which responds in long timescales to reactor changes due to the separate low temperature heavy water moderator circuit in CANDU.

In CANDU, coolant conditions vary with reactor power level and with age, as boiler and coolant system conditions evolve. This study uses the licensing-basis condition leading to the limiting value of PCR; an assumed end-of-life full-power condition with significant boiler fouling and coolant system aging considered. This represents an extreme to the range of conditions encountered in normal reactor operation. In the study reported here, a range of values of PCR has been included, covering both small negative and small positive values around this starting condition. This ensures a full range of effects is covered, and acts to confirm the large safety margins and absence of cliff-edge effects. It is worth noting the connection of these values to reactor design and safety. A PWR requires, and possesses, large negative values of fuel temperature and moderator temperature coefficients to ensure that control rod ejection accidents can be compensated, and to stabilize reactivity transients from the operating state, which would otherwise be fairly rapid. In CANDU, given the small values of the coefficients around the operating point and the low reactivity worth of the control devices, strong negative feedback is not relied upon in the safety case. The immediate inherent reactivity feedback is via the fuel temperature coefficient; as noted at Reference [1] recent studies have established the small but negative value of this coefficient. Under accident conditions, the limiting fast and large positive reactivity event in CANDU is caused by a large LOCA, and the rate of power rise is inherently limited by the reactor control system design and the long prompt neutron lifetime. CANDU does not depend on negative feedback to arrest the reactivity transient ？ reliable shutdown systems have time to act, as the power rise before shutdown is inherently slower than for the limiting accidents in light water reactors. The second reactivity-addition accident of concern is a loss of reactor regulation, assumed to be, for example, an uncontrolled removal of absorber rods.

The sensitivity to the range of power coefficient values is assessed here for the Loss of Regulation Control (LORC) event for CANDU-6.

The safety analysis has used the physics lattice code WIMS [7], neutron diffusion code RFSP [8], and the thermal hydraulics code CATHENA [9].

Analysis has shown that the major contribution to power coefficient is the coefficient related to changes in coolant density. Because PCR is not an independent input parameter into reactor computer models, the effect of variation in overall PCR is evaluated by varying the value of the coolant void reactivity coefficient by ± 15% from the best estimate value in the sensitivity study. The 15% variation envelopes the 95% percentile value in the WIMS calculation. This methodology will be applied to the loss of regulation control event (LORC) for three cases.

During normal operation, reactivity is mainly controlled by liquid zone controllers, adjuster rods, mechanical control absorbers, and moderator poison. In a loss of regulation control event, the maximum physical reactivity insertion rate is 0.35mk/s assuming that all reactivity control mechanisms malfunction simultaneously in the same direction at their maximum speeds.

The analysis shows similar system response for the three cases simulated. At a high power level of 103%FP with 0.1mk/s reactivity insertion, ROP is the primary trip signal followed by the high heat transport system pressure trip. It was found that the timing of the ROP trip and HTSHP trip is very similar for all three cases (-15%, 0%, and 15% variation in CVR). It should be noted that in the event of a loss of regulation control accident that the ROP trip would occur for each shutdown system at an early stage in the transient, limiting the level of overpower below that considered in this analysis, and limiting any degradation of fuel conditions.

For the reference case (nominal CVR), the 15% CVR case, and the -15% CVR case, the first trip was from the ROP signal (SDS1). The trip time for all three cases was 4.24 seconds. For the reference case the second trip was from the high power signal (SDS1); the trip time for this was 8.67 seconds. For the 15% CVR case the second

trip was from the high log rate signal (SDS1); the trip time for this was 8.44 seconds. For the -15% CVR case the second trip was from the high power signal (SDS1); the trip time for this case was 8.71 seconds.

The transient behaviour of the normalized core fission power and outlet header pressure, crediting the second SDS1 trip, is presented in Fig. 1. The peak reactor power ranges from 1.75 to 1.79, while the peak pressure ranges from 11.160MPa to 11.223MPa for the three cases. The small difference in trip time, peak reactor power, and peak ROH pressure supports the idea that the effect of a 15% variation in coolant density reactivity feedback, which reflects the power coefficient, is insignificant.

The three cases with the reactor operating at high power 103%FP and a reactivity insertion rate of 0.0002mk/s also show similar system responses.

The analysis showed that the high heat transport system pressure trip and high neutron power trip (ROP) are the first two trip signals called upon. While the credited backup trip is HTSHP for the +15% case, the trip time is very similar between ROP and HTSHP with only a 0.47 second difference between the two trips. Among the three cases, the time when the SDS1 backup trip is called upon ranges from 67.78 seconds to 76.62 seconds. Although the difference in backup trip time is larger than the 0.1mk/s reactivity insertion case, it reflects the speed of the transient. While the SDS1 backup trip time varies by approximately 9 seconds, the peak power and peak pressure are very similar between the three cases, as shown in Fig. 2. The peak reactor power varies between 1.16 and 1.17, while the peak ROH pressure varies between 10.385MPa and 10.394MPa.

For the reference case (nominal CVR) the first trip was from the high power signal (SDS1); the trip time for this case was 71.06 seconds. For the +15% CVR case the

first trip was from the ROP signal (SDS1); the trip time for this case was 67.31 seconds. For the -15% CVR case the first trip was from the high power signal (SDS1); the trip time for this case was 74.41 seconds. For the reference case the second trip was from the ROP signal (SDS1); the trip time for this was 71.58 seconds. For the +15% CVR case the second trip was from the high power signal (SDS1); the trip time for this was 67.68 seconds. For the -15% CVR case the second trip was from the ROP signal (SDS1); the trip time for this case was 76.62 seconds.

The small difference in peak reactor power and peak ROH pressure shows that the 15% variation in coolant density reactivity feedback, which reflects the power coefficient, is insignificant.

At a low power level of 40%FP and a reactivity insertion rate of 0.1mk/s, trip coverage is provided by the high rate log neutron power trip, high neutron power trip, and high heat transport system pressure trip.

For the reference case (nominal CVR) the first trip was from the high log rate signal (SDS1); the trip time for this case was 14.45 seconds. For the +15% CVR case the first trip was from the high log rate signal (SDS1); the trip time for this case was 14.43 seconds. For the -15% CVR case the first trip was from the high log rate signal (SDS1); the trip time for this case was 14.87 seconds. For the reference case the second trip was from the ROP signal (SDS1); the trip time for this was 16.06 seconds. For the +15% CVR case the second trip was from the ROP signal (SDS1); the trip time for this was 15.99 seconds. For the -15% CVR case the second trip was from the ROP signal (SDS1); the trip time for this case was 16.13 seconds.

The normalized core fission power and outlet header pressure transient evolution after the second trip is credited is presented in Fig. 3. Again, the analysis results show that

the trip time for all three trip parameters are very similar in the three cases. The peak reactor power ranges from 1.40 to 1.48 while the peak ROH pressure ranges from 10.412MPa to 10.462MPa.

The small difference in trip time, peak reactor power, and peak ROH pressure shows that the 15% variation in coolant density reactivity feedback, which reflects the power coefficient, is insignificant.

Analysis has shown that the major contribution to power coefficient is the coefficient related to changes in coolant density. Because PCR is not an independent input parameter into reactor models, the effect of variation in overall PCR was evaluated by varying the value of the coolant void reactivity coefficient. A 95% percentile variation on the CVR uncertainty for a full-voided core is considered in this assessment, in other words WIMS + 0.21, rather than WIMS-1.6mk which was considered in the reference case of Reference [10]. The 95% case was in fact considered in Reference [10] as part of a 2 parameter modelling sensitivity study. The other varied parameter was CHF. The current assessment examines only the impact of varying the CVR. The initial power and loop-loop tilt of the initial core state are 94% FP and 4%, respectively.

This section presents the impact on large LOCA of increasing the full core void reactivity (CVR) for the Wolsong-1 reactor to a value corresponding to the 95th percentile. For a fully-voided core this translates to a CVR of WIMS+0.21mk [10]).

Reference [10] analyzed a best-estimate uncertainty on a full-core CVR of -1.6mk. This is the best estimate value of CVR bias for WIMS-AECL as recommended in Reference [11] for all burn-ups. The -1.6mk bias resulted in a full-core CVR of 16.11mk. Reference [10] also analyzed a modeling sensitivity case for the 35% RIH break where

the CVR was increased to the 95th percentile value and CHF increased by 2 sigma. In the current analysis, the modeling sensitivity case is revisited for the 100% RIH case but without the additional parameter study on CHF. For this case (as per the modeling sensitivity study in [10]), the full-core CVR is increased to 17.92mk (i.e., 16.11 + 1.645*1.1). This increase in the full-core CVR to 17.92mk is performed via adjustment of the density scaling parameter (“densc”), which is a direct input to RFSP. A re-simulation of the steady state was not required since the setting of the CHF in steady state does not affect the initial thermalhydraulic conditions. As such, the initial core state for the current analysis is the same as that for the modeling sensitivity case in [10]. In other words the same 4% loop-loop tilt was maintained with reactor power at 94% FP. Moreover, the thermalhydraulic conditions (coolant density, temperature, and fuel temperature) are the same as those in the modeling sensitivity case of [10].

The simulation of the 100% RIH break is performed using the coupled physics code RFSP-IST version REL_3- 04-04 with the thermalhydraulic code CATHENA MOD 3.5d/Revision 2 on a PC environment, exactly as in [10].

The power pulse is terminated on the backup neutronic trip, that being high rate of log power (HLR). The reactor power and core-wide reactivity transients are presented in the figures below.

Fig. 4 and Fig. 5 show a marked increase in both the relative core-wide reactor power and reactivity. For example, for the 100% RIH break the peak relative power increases from 3.4 to 4.6 whereas peak core-wide reactivity increases from 4.1 to 4.8mk. However, this is still below the prompt criticality level of 5.22. Reactor trip on high rate of log power occurs at 0.379 seconds in the reference case and 0.367 seconds in the CVR+15% sensitivity case.

Deposited energy at 10 seconds increases from 279.6J/g to 345.5J/g. Given an initial enthalpy for fuel of 400J/g, the total fuel enthalpy remains well below the threshold for fuel breakup (or 840J/g). The threshold for fuel break

(840J/g) is very conservative for CANDU fuel under large LOCA conditions due to the relative long overpower (a few seconds) and significant coolant blow-down heat removal effect. In the experiments [11,12], fuel heat up and heat removal conditions are more severe than in a LOCA power pulse, in terms of the power seconds during overpower phases. Although most of the samples experienced centreline melting, no phenomena were detected that indicate extensive fuel breakup or release of noble gases greater than the grain-boundary inventory fraction [11,12]. Therefore, the CANDU fuel is not expected to have breakup. With fuel enthalpy below 840J/g, fuel centreline melting and fuel breakup are not expected.

For consequence during post overpower pulse period prior to design Emergency Core Cooling Systems filled all the channels, the fuel failure is expected, however, dose releases due to such fuel failure are well below the licensing limit for large LOCAs such as the reference case and this sensitive case.

It must be remembered that CANDU-6 has two independent fast acting shutdown systems, the rod-based SDS-1 system (modeled in the sensitivity study above), plus a faster acting SDS-2 system (poison injection system). In reality, each shutdown system would act, and the reactor trip time would be earlier, with significantly reduced transient conditions. More specifically, the analysis results above were simulated taking credit for the backup SDS-1 neutronic trip parameter, i.e., high rate of log power. While the trip setpoint on SDS-2 HRLP is typically set higher than that of SDS-1, a trip on the Regional Overpower Protection System (ROP) of either shutdown system would occur nearly 158ms earlier, i.e. around 0.210 seconds. The analysis results above thus constitute a very conservative code bias assumption compounded with the conservative application of the slower of two fast-acting shutdown systems. In summary, the 100% RIH break sensitivity analysis therefore demonstrates that safety margins, while reduced as a result of the conservative assessment, are adequate, despite the overpower increase due to the very conservative approach imposed on the CVR and marked increase in peak reactor power simulations.

This paper has discussed the power coefficient of reactivity for CANDU 6 reactors, as it pertains to safety and licensability, in the context of a wider nuclear industry. The reactor physics of the CANDU safety case are characterized by a high level of defence in depth based on a combination of inherent characteristics and engineered safety features. As the PCR in CANDU 6 is small, it plays little role in the performance or safety of the reactor.

The regulatory framework in a number of countries, together with the broader framework in the IAEA, was reviewed. For those countries with only, or predominantly, light water reactor technology deployed, it was found that regulations tend to include references to negative reactivity feedback characteristics. In contrast, international regulatory approaches, such as those of the IAEA, which encompass a range of reactor technologies, do not emphasize negative reactivity feedback requirements, but rather emphasize defence in depth, and the requirement to show that all initiating events covering operating transients and accidents are safely mitigated. The Canadian regulator states that a reactor design that has a positive power coefficient of reactivity is quite acceptable provided that the reactor is stable against power fluctuations, and that the probability and consequences of any potential accidents that would be aggravated by a positive reactivity feedback are maintained within prescribed limits. The accident analysis results presented in this paper then proceed to demonstrate, for the loss regulation control event as well as large loss of coolant accident, that the CANDU-6 reactor certainly meets such requirements, even in the face of the most conservative assumptions relating to the power coefficient of reactivity.

Specifically, both the sensitivity results for the LORC and large LOCA cases demsonstrate that safety margins are maintained, despite a very conservative approach to incorporating a larger CVR code bias (as part of allowance for a large variability in PCR). In conclusion, the CANDU design provides an appropriate balance between inherent safety characteristics and engineered safety features that renders the design robust to variations in reactor parameters.