A Trusted Design with Decades of Proven Performance

The CANDU (CANada Deuterium Uranium) reactor represents a distinctive and highly successful branch of nuclear power technology. Developed in Canada, it belongs to the pressurized heavy water reactor (PHWR) family. Its fundamental design choices—using heavy water as both moderator and coolant, employing horizontal pressure tubes rather than a single large pressure vessel, and enabling on-power refueling—create a suite of safety and reliability advantages that set it apart from light water reactors (LWRs). This article explores the key features that make the CANDU design inherently safe, operationally flexible, and exceptionally reliable over its long service life.

Core Architecture: How Heavy Water and Horizontal Tubes Change the Game

Heavy Water as Moderator and Coolant

The defining feature of the CANDU is its use of heavy water (deuterium oxide, D₂O) as both the neutron moderator and the primary coolant. Ordinary "light" water absorbs more neutrons, which means LWRs require enriched uranium fuel (typically 3–5% uranium-235) to sustain a chain reaction. Heavy water absorbs far fewer neutrons, allowing a CANDU to achieve criticality using natural uranium fuel (0.7% U-235). This eliminates the need for uranium enrichment facilities, reducing upfront capital costs and proliferation risks. The excellent neutron economy also means the reactor can extract more energy per tonne of mined uranium compared to LWRs, and it opens the door to advanced fuel cycles including thorium and recycled uranium.

Horizontal Pressure Tubes and the Calandria

The reactor core consists of a large, cylindrical tank called the calandria, which holds hundreds of horizontal fuel channels. Each channel contains a pressure tube that carries the high-temperature, high-pressure heavy-water coolant. The pressure tube is separated from the calandria tube by a gas-filled annulus, and the heavy-water moderator surrounds the calandria tubes at low pressure and temperature. This separation of coolant and moderator is a cornerstone of CANDU safety: the moderator acts as a large, passive heat sink that can absorb decay heat even if the primary cooling system fails. Because the moderator operates at near-atmospheric pressure, the large calandria vessel is not subjected to the extreme pressures seen in LWR pressure vessels, reducing the risk of catastrophic failure.

The horizontal pressure-tube layout also enables individual channel access. Each channel can be isolated, defueled, and inspected independently while the reactor continues to operate. This modularity is impossible in a loop-type PWR with a single vessel and internal core. The design facilitates on-power refueling and simplifies mid-life refurbishment, as entire fuel channel assemblies can be replaced without cutting the main vessel.

Inherent Safety: Negative Coefficients and Passive Heat Sinks

Negative Power and Void Coefficients

A fundamental safety characteristic of the CANDU is its strongly negative power coefficient of reactivity. As reactor power increases, fuel temperature rises, causing the Doppler effect to broaden neutron absorption resonances in uranium-238—this reduces reactivity. Simultaneously, the heavy-water moderator expands slightly, decreasing its density and further reducing reactivity. The combination provides a self-limiting mechanism that resists power excursions.

Even more critical is the void coefficient. In a CANDU, if the heavy-water coolant boils (forming voids), the reactivity change is typically negative under normal operating conditions. This means a loss-of-coolant accident (LOCA) that leads to coolant voiding will inherently reduce reactor power, rather than causing an uncontrolled power spike as can occur in some LWR designs under certain conditions. Research by the International Atomic Energy Agency has extensively analyzed this behavior, confirming its contribution to the design's safety profile. While advanced fuel cycles like thorium or slightly enriched uranium can shift the void coefficient, the overall safety margin remains robust.

Passive Decay Heat Removal

Even if all active emergency cooling systems were unavailable, the CANDU has multiple passive heat sinks. The heavy-water moderator surrounding the pressure tubes can absorb decay heat for several hours through natural convection alone, preventing fuel melting. Furthermore, the calandria vault—a large concrete structure filled with light water that houses the calandria—provides an additional heat sink. In severe accident scenarios, steam and hot coolant can be discharged into the vault, where it condenses and is cooled. This passive defense aligns with modern "practical elimination" criteria for large early releases, and it has been validated through extensive severe accident analyses by organizations such as Canadian Nuclear Laboratories.

Engineered Safety Systems: Defense in Depth

Two Independent, Fast-Acting Shutdown Systems

Every CANDU reactor is equipped with two physically and functionally independent shutdown systems (SDS1 and SDS2). SDS1 typically uses gravity-driven shutoff rods made of neutron-absorbing material (e.g., cadmium or boron). In newer designs, springs assist insertion, achieving full insertion in under two seconds. SDS2 injects a liquid neutron poison—a gadolinium nitrate solution—directly into the moderator through high-pressure nozzles. The two systems have completely separate logic circuits, power supplies, and actuation mechanisms. This redundancy ensures that no single failure—whether mechanical, electrical, or human—can prevent reactor shutdown. Both systems are designed to bring the reactor to a subcritical state under the most demanding accident conditions, including large-break LOCAs combined with the failure of one system.

Emergency Core Cooling and Multi-Stage Injection

If a primary coolant pipe ruptures, the emergency core cooling system (ECCS) provides water injection in multiple stages. High-pressure injection initially fills the fuel channels, followed by medium-pressure recovery and long-term recirculation using water from the building sump or external sources. Because the core consists of many independent horizontal channels, water can be directed precisely to affected areas. The moderator's heat sink capability extends the time available for ECCS actuation. In the unlikely event of a complete loss of ECCS, the moderator alone can absorb decay heat for several hours, giving operators time to implement alternate cooling strategies.

Vacuum Building Containment

Most multi-unit CANDU stations feature a shared vacuum building—a unique pressure suppression system. The containment envelope (reactor building) is connected to the vacuum building via large isolation valves. In an accident, steam and fission products released into the reactor building cause a pressure rise, which opens the valves, drawing the mixture into the vacuum building. There, it is sparged through water pools, condensing steam and trapping radioactive aerosols. The vacuum building maintains a negative pressure inside the containment, minimizing any unmonitored leakage. This system has been tested during commissioning and validated through severe accident simulations, contributing to the design's excellent safety record.

Low-Pressure Primary Circuit and Leak-Before-Break

Compared to PWRs (operating at ~15 MPa), the CANDU primary coolant operates at ~10 MPa, and the pressure boundary consists of hundreds of small-diameter pressure tubes rather than a single large vessel. Each pressure tube is surrounded by a calandria tube, with the gap monitored for moisture. If a pressure tube develops a crack, it will leak heavy water into the annulus before a catastrophic break occurs, providing early warning. This "leak-before-break" behavior, validated by decades of research at Canadian Nuclear Laboratories, virtually eliminates the risk of sudden, double-ended guillotine breaks. Moreover, a single channel failure represents only a tiny fraction of the total coolant inventory, limiting the rate of coolant loss and peak fuel temperatures.

Operational Reliability: On-Power Refueling and High Capacity Factors

Continuous Refueling Process

The ability to refuel while operating at full power is the CANDU's most celebrated operational feature. Two remotely operated fueling machines, one at each end of the reactor, work together. A new fuel bundle is pushed into one end of a horizontal channel while the spent bundle is extracted from the opposite end. This process occurs daily, typically replacing a few bundles in each of several channels. Consequently, the reactor never needs to be shut down for refueling—a stark contrast to LWRs, which require a 2–4 week outage every 18–24 months for refueling.

This continuous refueling capability yields outstanding capacity factors, often exceeding 90% on a lifetime basis with individual units reaching over 95% in a given year. Plants such as Bruce Power and Ontario Power Generation's Darlington station in Canada, as well as Wolsong units in South Korea, consistently rank among the world's top-performing nuclear plants. The financial impact is immense: higher capacity factors mean more electricity sold per unit of capital investment, improving economic competitiveness. Additionally, incremental refueling allows early detection and removal of defective fuel bundles, improving overall fuel reliability.

Online Maintenance and Mid-Life Refurbishment

The horizontal pressure-tube design also enables extensive online maintenance. Individual channels can be defueled, isolated, and inspected without affecting neighboring channels. This has allowed operators to undertake complete retubing campaigns—replacing all pressure tubes and calandria tubes—as part of mid-life refurbishment. For example, Bruce Power and Darlington have successfully executed multi-year retubing projects, effectively renewing their reactor cores and extending operational life by 25–30 years or more. These refurbishments incorporate improved materials (e.g., Zr-2.5Nb pressure tubes) and enhanced safety systems, making the plants even safer and more reliable.

Fuel Flexibility: Beyond Natural Uranium

The CANDU's superb neutron economy and on-power refueling allow it to utilize a wide variety of fuels. While natural uranium is the standard, the design can also operate on slightly enriched uranium (SEU, up to ~1.5% U-235), recovered uranium from reprocessing, mixed oxide (MOX), and thorium-based fuels. The thorium fuel cycle is particularly promising: thorium is abundant, produces fewer long-lived actinides, and can be bred into fissile uranium-233. CANDU's ability to use thorium without major design changes positions it as a platform for sustainable fuel cycles with reduced waste toxicity.

The CANFLEX (CANDU Flexible Fuelling) bundle, developed by Canadian Nuclear Laboratories and industry, is a 43-element fuel bundle optimized for higher burnup and improved thermal-hydraulic performance. It reduces peak fuel centerline temperatures, further enhancing safety margins. Utilities can thus respond to changes in fuel markets or national fuel-cycle policies without redesigning the core, a flexibility few reactor types offer.

Global Operating Experience and Safety Track Record

CANDU reactors have accumulated well over 400 reactor-years of operation across Canada, South Korea, Romania, China, India, Pakistan, and Argentina. No CANDU has ever experienced a core melt or a significant off-site release of radioactive material. Incidents such as a pressure tube rupture at Pickering A (1983) were contained by redundant barriers and led to fleet-wide improvements—notably, the replacement of Zircaloy-2 pressure tubes with more stable Zr-2.5Nb, and enhanced inspection programs.

The design's resilience to external hazards has been demonstrated through stress tests. Following the Fukushima Daiichi accident, CANDU units in Romania (Cernavoda) and Canada underwent comprehensive assessments by regulators including the Canadian Nuclear Safety Commission. These reviews confirmed the plants could withstand extreme seismic events, floods, and station blackouts without core damage. The CANDU Owners Group (COG) facilitates worldwide sharing of operational data and best practices, reinforcing a strong safety culture across the fleet.

Environmental and Economic Considerations

High capacity factors mean CANDU plants produce more clean electricity per unit of capital investment, reducing lifecycle carbon emissions per MWh. Because they use natural uranium without enrichment, the front-end fuel cycle has a low energy and carbon footprint. Studies by the OECD Nuclear Energy Agency show that all reactor types have lifecycle greenhouse gas emissions of about 10–15 g CO₂-equivalent per kWh, but CANDU's higher capacity factors often push it to the lower end of that range.

From an economic perspective, avoidance of enrichment facilities reduces capital and operational costs. The ability to operate continuously without refueling outages improves cash flow predictability. Mid-life refurbishments, while expensive, extend plant life for decades at a fraction of the cost of new build. Operators such as Ontario Power Generation have demonstrated the economic viability of this approach, ensuring that existing CANDU units continue to provide reliable baseload power.

Evolution of the Design: Advanced CANDU and Future Concepts

While the original CANDU 6 and its derivatives remain the workhorses, evolutionary designs like the Advanced CANDU Reactor (ACR) incorporated more passive safety features, such as enhanced moderator cooling, passive hydrogen recombiners, and simplified systems for cost reduction. Although the ACR program was paused, its lessons have informed safety upgrades across the fleet, particularly in severe accident management and beyond-design-basis event preparedness.

Research continues on using CANDU for burning plutonium from dismantled weapons and for thorium fuel cycles. The reactor's flexibility and robust safety characteristics make it an attractive candidate for future sustainable nuclear energy systems. As countries seek to decarbonize their electricity grids, the CANDU—with its proven reliability, inherent safety, and fuel flexibility—remains a valuable and enduring technology.