Understanding Heavy Water and the CANDU Design

The CANDU (CANada Deuterium Uranium) reactor is distinguished from other commercial nuclear power systems by its use of natural uranium fuel and heavy water moderator. At the core of this technology is deuterium oxide, or heavy water — a substance chemically similar to ordinary water but with profoundly different nuclear properties. While light water reactors require enriched uranium (typically 3% to 5% uranium-235), CANDU units sustain a chain reaction with naturally occurring 0.7% uranium-235. This is achieved because heavy water is an exceptionally efficient neutron moderator and a poor neutron absorber, allowing a high proportion of fission neutrons to reach thermal energies and cause subsequent fissions. Understanding how heavy water behaves during startup and shutdown reveals why CANDUs have earned a reputation for safe, flexible, and economical power generation.

Composition and Nuclear Properties of Heavy Water

In a molecule of ordinary water (H₂O), the hydrogen atom consists of a single proton and a single electron. Heavy water (D₂O) replaces the protium nucleus with deuterium, a hydrogen isotope containing one proton and one additional neutron. This extra neutron roughly doubles the mass of the hydrogen atom and dramatically reduces the probability that a colliding neutron will be captured. When a fast neutron from fission enters the moderator, it scatters off deuterium nuclei, losing kinetic energy until it reaches thermal equilibrium. Because deuterium is a loosely bound neutron-proton pair, its neutron-capture cross-section is about 600 times smaller than that of ordinary hydrogen. The result is a reactor that achieves criticality with fuel that light water reactors would consider spent before it ever generated power.

Heavy water’s low neutron absorption yields excellent neutron economy — the ratio of neutrons available for new fissions to those lost to capture or leakage. In a CANDU, the core is designed with a calandria (a horizontal cylindrical vessel housing hundreds of pressure tubes) through which fuel bundles are loaded on-power. The heavy water moderator fills the space around the tubes, while a separate heavy water cooling system flows through the fuel channels to remove reactor heat. The separation of moderator and coolant is a hallmark: the moderator remains relatively cool and dense, maximizing its slowing-down power, while the coolant operates at high temperature and pressure to produce steam.

Why the CANDU Design Depends on Heavy Water

The choice of heavy water as both moderator and coolant is not arbitrary. Light water absorbs too many neutrons to sustain a chain reaction with natural uranium. By using heavy water, CANDU reactors eliminate the need for uranium enrichment facilities, which are expensive and carry proliferation concerns. The heavy water moderator occupies the large volume of the calandria, surrounding the pressure tubes. This arrangement also provides substantial thermal inertia: the moderator acts as a heat sink that can absorb decay heat after shutdown. The dual use of heavy water — separately in the moderator and coolant circuits — requires careful isotopic purity management, but the payoff is a robust, fuel-flexible reactor design.

Heavy Water Properties Relevant to Startup and Shutdown

Before examining specific procedures, it is important to understand the thermodynamic and nuclear characteristics of heavy water that influence reactor behavior during transients. Heavy water has a slightly higher density and specific heat capacity than light water. Its moderating ratio (a measure of slowing-down power divided by absorption cross-section) is about 120 times greater than that of ordinary water, making it the premier moderator for natural uranium fuel. The temperature coefficient of reactivity for heavy water is negative: as moderator temperature rises, density decreases, which reduces the slowing-down power and introduces a small negative reactivity feedback. This inherent safety feature is especially valuable during startup when the core is being heated from cold conditions. Additionally, heavy water’s high boiling point (101.4°C at atmospheric pressure, compared to 100°C for light water) and its low vapor pressure at operating temperatures help maintain a stable coolant environment. These properties are not just academic; they directly shape every step of the startup and shutdown sequences.

Heavy Water’s Role in Reactor Startup

Starting up a CANDU reactor is a carefully sequenced procedure that relies heavily on the properties of deuterium oxide to achieve a controlled and stable chain reaction. From a cold shutdown state, the reactor must pass through several safety checks, fluid system warm-ups, and reactivity insertions that allow the neutron population to grow from source levels to full power. Heavy water is not a passive substance in this process; its temperature, purity, and level directly influence the core’s multiplication factor (keff).

Establishing Initial Reactivity Conditions

Before startup can begin, the heavy water systems must be verified for correct isotopic purity. CANDU reactors require a moderator purity of at least 99.75% D₂O by weight. Even a small ingress of light water, a strong neutron absorber, can poison the chain reaction and make startup impossible with natural uranium. Operators monitor heavy water levels in the calandria and heat transport system, while chemistry samples are analyzed to confirm that neutron-absorbing impurities such as boron, chlorine, and gadolinium (sometimes deliberately added for reactivity control) are within allowed ranges. A typical CANDU-6 plant operates with about 265 tonnes of heavy water in the moderator and 200 tonnes in the heat transport system; any deviation from the target isotopic purity is flagged immediately.

With the moderator and coolant circuits filled, primary heat transport pumps circulate heavy water coolant to warm the fuel channels in a controlled manner. As temperature rises, the moderator’s density decreases slightly, reducing its slowing-down power and introducing a small negative reactivity feedback — a feature that enhances safety. During this phase, the reactor remains deeply subcritical. Startup instrumentation, including neutron flux detectors placed around the calandria, continuously track the neutron count rate. Because a completely shut-down core has only a tiny spontaneous fission source, dedicated startup neutron sources such as californium-252 or antimony-beryllium capsules are inserted to provide a base signal for the instruments. These sources emit a known neutron yield, allowing the reactor to be brought to criticality smoothly.

Approaching Criticality with the Reactivity Control System

Reactivity control in a CANDU is exercised through several independent mechanisms: liquid zone controllers that adjust light water levels in compartments within the moderator, adjuster rods that flatten the neutron flux distribution, mechanical control absorbers, and two independent safety shutdown systems for rapid shutdown. To begin the approach to criticality, operators slowly remove neutron absorbers from the core. Typically, adjuster rods — normally inserted to shape the flux and provide reserve positive reactivity — may be partly withdrawn under strict procedural guidelines. Meanwhile, the moderator level is kept constant, and the boron concentration in the moderator (if used for long-term reactivity compensation) is maintained at a prescribed value.

As absorbers are withdrawn, the effective multiplication factor rises. The startup rate is monitored by plotting the inverse count rate ratio against reactivity addition. This classic “one-over-M” technique allows the reactor operator to predict the point of criticality precisely. Heavy water’s superior neutron economy means that the reactor reaches criticality with fewer absorber withdrawals than would be necessary in a light water reactor of comparable size. Once the neutron population is doubling at a steady positive period, the reactor is considered critical at low power, usually a few decades above the source range. At this point, control systems automatically maintain a delicate balance, and heavy water once again demonstrates its value: the small temperature coefficient of reactivity, coupled with the long prompt neutron lifetime in the well-moderated CANDU core, gives operators ample time to observe and respond to any power transient.

Power Ascent and the Role of Heavy Water Temperature

Once low-power criticality is confirmed, the reactor is gradually heated and brought to the power level required for synchronization with the electrical grid. The heat transport system’s heavy water temperature is raised in stages, expanding the calandria tubes slightly and shifting reactivity. Operators use the liquid zone control system — a network of sealed compartments inside the calandria that can be filled or drained with light water — to maintain precise reactivity control. Because heavy water is particularly sensitive to light water contamination, the zone control system is a highly effective fine-tuning tool: injecting a small volume of ordinary water into a zone locally increases neutron absorption and reduces reactivity with remarkable speed. The system can respond within seconds to a reactivity demand, allowing very tight power regulation during the ascent to full power.

During the power ascent, heavy water purification systems operate continually to remove neutron-absorbing fission products that may have leaked into the coolant or moderator. The CANDU design permits on-power refueling, but a fresh startup from cold shutdown is the only time when only completely fresh or low-burnup fuel is in the core, so the reactivity worth of heavy water is at its maximum. Careful management ensures that no fuel channel experiences a heat flux beyond design limits. Throughout startup, the moderator acts as an emergency heat sink. Should a loss-of-coolant accident occur, the heavy water surrounding the fuel channels would remove decay heat and prevent fuel damage. This defense-in-depth feature is possible precisely because the moderator and coolant are separate heavy water inventories.

Heavy Water Purity Management During Startup

The on-line heavy water upgrading plant plays a role even before the reactor reaches criticality. As the moderator warms up, any dissolved light water tends to migrate from storage tanks into the system. The upgrader continuously processes a sidestream of moderator heavy water, distilling off light water to maintain the 99.75% purity target. This is especially important because the reactivity worth of heavy water is highest at cold startup; a 0.1% drop in isotopic purity can reduce the available excess reactivity by a noticeable fraction, potentially making criticality harder to achieve. Operators also verify that neutron-absorbing poison concentrations (if any) are correctly set, as these compensate for the excess reactivity of fresh fuel.

Heavy Water in Controlled and Emergency Shutdown Procedures

Shutting down a CANDU reactor safely requires that the chain reaction be quickly terminated and that residual heat be continuously removed from the core. Heavy water is essential in both roles. Although the neutron chain reaction is stopped by independent shutdown systems, the ability to circulate heavy water coolant after shutdown is what keeps the fuel within safe temperature limits for days and weeks afterward. Additionally, the moderator’s passive heat absorption capability provides a backup cooling pathway that does not rely on active pumps or operator intervention.

Initiating the Chain Reaction Shutdown

A normal, planned shutdown begins with a gradual reduction of reactor power using reactivity control devices. Liquid zone control compartments are partially drained, adjuster rods are inserted in a predefined sequence, and the heat transport system temperature is reduced to match turbine bypass conditions. As the moderator temperature drops, heavy water density increases, adding a positive reactivity effect that must be compensated by further insertion of absorbers. Operators carefully coordinate the cool-down rate to avoid approaching critical conditions inadvertently. The heavy water in the moderator has a negative temperature coefficient of reactivity, but over the range from full-power temperatures (about 70°C in the moderator) to cold shutdown (around 30°C), the density change can add up to 2 mk (milli-k) of reactivity if not properly managed. The procedure accounts for this by inserting additional control absorbers or poison.

When an immediate shutdown is required — either by operator command or by an automatic trip signal — the reactor’s two independent shutdown systems actuate within seconds. Shut-off rods, which are neutron-absorbing cadmium or gadolinium rods held out of the core by electromagnets, drop into the calandria by gravity when the trip circuits are de-energized. Simultaneously, or as a diverse alternative, the liquid poison injection system rapidly injects a gadolinium nitrate solution into the moderator. Heavy water’s low absorption cross-section means that the poison acts primarily on the thermal neutron population, collapsing the chain reaction almost instantly. The fast shutdown response is a classic example of CANDU’s defense-in-depth: the slow-acting moderator, which normally conserves neutrons, is quickly flooded with high-cross-section absorbers that overcome its natural economy. Typical insertion times are less than two seconds for the shutoff rods, and poison injection is complete within a few seconds.

Decay Heat Removal Using Heavy Water Coolant

Even after the chain reaction has ceased, the fuel continues to generate significant heat from radioactive decay of fission products. Immediately after shutdown, decay power is about 7% of the reactor’s prior operating thermal output and declines over hours and days. The primary heat transport system, filled with heavy water, must continue to circulate through the fuel channels to carry this heat to steam generators, where it is transferred to the secondary side and ultimately rejected via condensers or shutdown cooling systems. In CANDU plants, thermosiphoning — a natural convection flow driven by the temperature difference between hot fuel channels and cool steam generator tubes — can remove decay heat without pumped flow, provided the heat transport system inventory remains full and the steam generators are supplied with feedwater. This capability is particularly valuable after a loss of pumped circulation; the heavy water coolant naturally rises from the hot fuel channels to the steam generator, where it gives up heat, then returns by gravity.

If the primary heat transport pumps are available, they maintain forced circulation at a reduced rate. The heavy water coolant, which has been heated to around 310°C during full power operation, gradually cools. Because heavy water has a slightly higher specific heat capacity than light water, it absorbs more thermal energy per degree of temperature change, though the difference is modest. More importantly, the inventory of heavy water in the moderator tank provides a massive heat sink that can accept energy from the fuel channels by radiation and convection should the normal cooling path be compromised. This is a uniquely CANDU feature: even with the coolant channels fully drained, the fuel bundles would continue to be cooled by the surrounding heavy water moderator, keeping fuel centerline temperatures below the failure threshold for several hours while operators restore normal cooling. The moderator’s thermal inertia is such that in a postulated station blackout scenario, the fuel remains intact for many hours without any active cooling, as demonstrated in several safety analyses. IAEA safety reports highlight this inherent heat sink capability as a distinguishing feature of the CANDU design.

Ensuring Deep Subcriticality During Refueling and Maintenance

For a shutdown to be considered stable enough for maintenance activities, criticality must be impossible even if the most reactive control device were inadvertently withdrawn. In CANDU reactors, operators verify this by measuring the shutdown margin using neutron flux instrumentation. Heavy water’s high purity is an ally in this verification: even slight changes in moderator level or light water ingress would be detected as changes in the subcritical neutron count rate. Before moving fuel or opening the reactor vault, the moderator is often drained to a level far below the fuel to guarantee subcriticality under all credible accidental conditions. Boron or gadolinium may be added to the remaining moderator as an additional soluble poison. Only when independent assessments confirm a shutdown depth of at least several percent delta‑k/k does the plant proceed with maintenance or refueling outage tasks.

Post-Shutdown Monitoring and Heavy Water Recovery

After the reactor is shut down, heavy water inventory management continues. Systems are depressurized and, if opened for inspection, vapor recovery systems capture evaporated heavy water. The heavy water upgrading plant may be operated to maintain purity in storage tanks. The heat transport system heavy water is often kept hot (around 60-80°C) during short outages to minimize thermal cycling of the pressure tubes, which reduces stress on the zirconium alloy components. For longer outages, the heavy water is cooled and stored in nitrogen-blanketed tanks to prevent isotopic degradation. This careful inventory management is essential not only for economic reasons — heavy water costs roughly $600-1000 per kilogram — but also to maintain the reactor’s ability to restart reliably.

The Heavy Water Upgrader and Inventory Management

A practical aspect of heavy water use in CANDU startup and shutdown is the need to maintain isotopic purity. Over time, heavy water in both the heat transport and moderator systems absorbs moisture from the air, and even microscopic leaks can allow light water to seep in. An on-site heavy water upgrading plant continuously distills or electrolyzes a sidestream of the reactor’s heavy water to remove light water contamination. During startup, the upgrader runs at full capacity to ensure the moderator’s neutron economy is at its peak. Before an extended shutdown, operators may reduce upgrader operation to conserve energy, but during the shutdown itself the heavy water is usually kept in sealed, nitrogen‑blanketed storage tanks to prevent additional degradation.

Because heavy water is expensive to produce — it is extracted from natural water through energy‑intensive processes such as the Girdler‑sulfide exchange or water distillation — inventory control is a significant economic factor. A typical CANDU‑6 unit requires about 265 tonnes of heavy water in the moderator system and another 200 tonnes in the heat transport system. Any loss through leaks or evaporation represents not only a replacement cost but also a regulatory reporting obligation. During shutdown, when systems are depressurized and opened for inspection, elaborate vapor recovery systems capture heavy water evaporated from the open calandria and return it to storage, minimizing environmental release and financial loss. The upgrader also processes heavy water recovered during maintenance, bringing it back to the required purity before reintroduction into the reactor. Research into advanced deuterium recovery techniques continues to improve efficiency, as documented in DOE technical reports.

Safety and Efficiency Benefits Unique to CANDU’s Heavy Water Core

The combination of heavy water’s nuclear properties and the reactor’s pressure‑tube design results in a safety case that is markedly different from light water reactors. The positive void coefficient of reactivity — the increase in reactivity that would occur if heavy water coolant boiled away — is mitigated by the very large moderator volume that remains intact. The shutdown systems are designed with diversity and independence so that no single failure can prevent a rapid shutdown. Furthermore, the use of natural uranium eliminates the need for enrichment facilities, which simplifies the fuel cycle and contributes to non‑proliferation objectives.

Heavy water also permits a flexible refueling strategy. Unlike light water reactors that must shut down for batch refueling every 12 to 24 months, CANDU units refuel daily on‑power by pushing fresh fuel bundles into one end of a channel and removing spent fuel from the other. Heavy water’s neutron economy makes it possible to shift the flux distribution over time without losing the ability to sustain the chain reaction during the transient. This on‑line refueling capability results in high capacity factors and less frequent thermal cycling of the reactor core, both of which confer advantages during startup after a maintenance outage — the reactor does not experience the large reactivity swing of a fresh batch core, and startup is typically smoother.

During the shutdown for defueling or channel inspection, the heavy water moderator’s thermal inertia keeps the fuel elements at a stable temperature for hours after forced cooling is lost. Several International Atomic Energy Agency publications have documented this inherent heat sink capability as a distinguishing feature. In the context of severe accident analysis, the calandria vessel filled with heavy water acts as a heat transfer barrier that can delay core damage substantially, giving operators extended time to implement accident management procedures. The heavy water also serves as a radiation shield, reducing dose rates during shutdown work.

Comparative Advantages Over Light Water Reactors

In light water reactors, the moderator and coolant are the same light water, and the core is housed in a single pressure vessel. During a loss-of-coolant accident, the moderator is quickly lost, and decay heat removal relies entirely on emergency core cooling systems. In contrast, the CANDU’s separate heavy water moderator remains in place even if the coolant channels rupture. This provides a much larger grace period for operator action. Additionally, the natural uranium fuel cycle means that spent fuel from CANDUs has a lower fissile content, simplifying long-term storage and disposal. The heavy water design also allows the use of thorium-based fuel cycles, which some countries are exploring for proliferation-resistant nuclear energy.

Regulatory Oversight and Scientific Research

The use of heavy water in power reactors is subject to rigorous oversight by national nuclear regulators. In Canada, the Canadian Nuclear Safety Commission (CNSC) sets strict requirements for heavy water isotopic purity, forced outage frequency, and shutdown system efficacy. Regular inspections and audits verify that plants comply with the documented safe operating envelope. Internationally, CANDU technology has been exported to countries including South Korea, Argentina, China, Romania, and Pakistan, where local regulators apply similar standards. Heavy water supply chains are likewise regulated to prevent diversion of materials.

Research reactors such as the NRU at Chalk River Laboratories have historically provided the experimental basis for understanding how heavy water behaves in CANDU cores during transients. Studies on moderator temperature coefficients, the effect of dissolved poisons, and the behavior of heavy water under boiling conditions have shaped the current startup and shutdown procedures. Many of these findings are available in the open literature through the American Nuclear Society journals and IAEA training documents. Operators and engineers routinely consult these resources to refine best practices. Recent research also focuses on advanced heavy water management techniques, such as deuterium recovery from contaminated effluents and improved isotopic separation methods.

Conclusion

Heavy water is far more than a simple coolant or moderator in a CANDU reactor; it is the enabling medium that defines the reactor’s startup and shutdown behavior. During startup, its exceptional neutron economy allows the core to achieve criticality with natural uranium and gives operators precise control over the power ascent. In shutdown, heavy water’s dual role as coolant and passive heat sink underpins the defense-in-depth strategy that keeps fuel safe under both planned and emergency conditions. From the first chain reaction in the calandria to the final verification of deep subcriticality, every procedural step is shaped by the thermodynamic and nuclear properties of deuterium oxide. That scientific foundation, combined with decades of operational experience and a robust regulatory framework, makes CANDU technology a compelling option for countries seeking safe, reliable, and fuel-cycle-independent nuclear power. The continued operation of CANDU reactors worldwide, along with ongoing research into heavy water applications, ensures that this unique reactor design will remain a pillar of nuclear energy production for years to come.