Safety Depressurization System (SDS) and Safety Depressurization and Vent System (SDVS) — Primary Depressurization for Feed and Bleed and Severe Accidents

Principle and mechanism

Why open the primary side on purpose?

Total loss of feedwater (TLOFW) means that both main and auxiliary feedwater are lost. Without operator action it proceeds as follows.

1. Decay heat remains after the reactor trip (low steam generator level)
2. The steam generator secondary inventory boils away (dryout) → heat removal from the primary side is lost
3. Coolant expansion raises pressurizer level and pressure → the pressurizer safety valves open repeatedly at their setpoint
4. The discharges reduce inventory → the core uncovers → cladding temperature rises, with Zr–steam reaction and hydrogen generation
5. Core damage with the RCS still at high pressure → risk of HPME and DCH at vessel failure

The high-pressure safety injection (HPSI) pumps may be running, but they cannot inject because RCS pressure is above their shutoff head. The SDS opens the pressurizer steam space to bring pressure below the shutoff head. HPSI can then inject, and the discharged steam and water carry away the decay heat.

OPR1000 SDS — two dedicated valve trains

The OPR1000 is a CE-type design without pressurizer PORVs, so the bleed path is a dedicated system.

• Two nozzles on the pressurizer steam space → two independent lines
• Each train has a motor-operated gate valve (isolation) and a motor-operated globe valve in series, ending in a rupture disc → discharge to the containment atmosphere
• The globe valves are powered from the emergency diesel generators; the gate valves can also be fed with DC through inverters; on failure they stay as is
• To prevent inadvertent opening during normal operation, valve power is removed and key-locked; once power is restored the valves are operated from the main control room
• From the pressurizer nozzle to the globe valve the piping is seismic Category I and Safety Class 1; downstream it is non-safety class
• Sizing basis: the valve capacity is chosen so that, with the HPSI pumps available, opening the SDS after secondary heat removal is lost prevents core uncovery; with fewer pumps or trains available, the valves must be opened earlier

The SDS is not used to mitigate design-basis accidents such as a LOCA, nor for safe shutdown. It discharges hot, high-pressure coolant directly into containment and worsens the equipment environment, so it is used only in beyond-design-basis events.

APR1400 SDVS — the POSRV is both safety valve and depressurization valve

Instead of separate SDS valves, the APR1400 uses four pilot-operated safety relief valves (POSRVs) on top of the pressurizer. The set pressure is 2,470 psia (173.7 kg/cm²A), and the minimum relief capacity per valve is 244.9 t/h of steam (DCD Table 5.4.14-1, as cited in the NRC safety evaluation report). The POSRVs join in pairs into common discharge headers, and two main discharge lines condense the steam through spargers below the water surface of the IRWST.

• Overpressure protection (automatic): two spring-loaded pilots (one pair) + the main valve. Each pilot has a motor-operated isolation valve (normally open; closed remotely if the pilot fails to reclose), the spring pilot, a check valve and a manual isolation valve (locked open; closed for setpoint testing and maintenance)
• Rapid depressurization (operator, remote): two normally closed motor-operated pilot valves in series; the operator must open both to open the main valve. The series arrangement lets one valve isolate if the other fails to close, and they run on emergency DC

The vent function of the SDVS (RCGVS) remotely discharges non-condensable gases and steam from the reactor vessel upper head and the pressurizer steam space to the IRWST. It also controls RCS pressure when pressurizer spray is unavailable. Each path has two normally closed solenoid valves in series, powered from different 1E 125 V DC divisions.

When feed and bleed works

Two balances must close. At the depressurized equilibrium pressure, injection flow must equal discharge flow to hold inventory (mass), and the enthalpy difference between discharge and injection must carry away all the decay heat (energy). Depressurization means the operator opening the valves manually; it is separate from the automatic overpressure setpoints of the safety valves and POSRVs. For the OPR1000 (2,815 MWt), decay heat 30 minutes after shutdown following one year of operation is about 1.19 % (about 34 MW). Assuming discharge as saturated steam at 7 MPa and injection of 40 °C water, at least about 13 kg/s is needed. If the discharge is two-phase or liquid, more flow is needed. This is an idealized minimum assuming steady state (injection = discharge). A flow balance point alone does not guarantee that the core stays covered, so the inventory trend must also be checked.

Severe-accident depressurization

On entering the SAMG at a core exit temperature of 649 °C, the operator opens the POSRVs to bring the RCS to low pressure before vessel failure (the MDEP description of the original APR1400 design gives a target below 200 psig). Depressurization must also prevent creep failure of the hot legs and steam generator tubes driven by high-pressure natural circulation. In the original design this discharge also went to the IRWST. Because hydrogen could accumulate above the IRWST, later APR1400 designs, including the US-certified design, installed two 3-way valves in the discharge lines. In a severe accident the operator turns them to discharge to the steam generator compartment. Some later units added two trains of dedicated emergency reactor depressurization valves (ERDVs, 449.1 t/h per train) to remove this manual changeover. The depressurization target is a different quantity from the pressure criterion for DCH used in safety analyses.

What it means in a plant

Depressurization means by reactor type

Once-through (feed-and-bleed) cooling strategy

1. Decide to initiate: feedwater cannot be restored + steam generator level falling, or RCS pressure and temperature rising
2. Confirm HPSI running (actuate SIAS manually if needed)
3. Restore power to the SDS valves and open both trains
4. Monitor HPSI flow, core exit temperature, subcooling and pressurizer level
5. Keep trying to restore feedwater → once restored, return to steam generator cooling, close the SDS and enter shutdown cooling

The later the valves are opened, the smaller the margin to core uncovery. That is why the sizing basis is stated in terms of how early the valves are opened.

Regulatory and design criteria

For example, in the United States:

Easily confused pairs

Key points at a glance

1. Definition: a system for the operator to depressurize the RCS rapidly and remotely when secondary heat removal is lost, so that safety injection can enter (beyond-design-basis response).
2. Functions: (1) decay heat removal by feed and bleed; (2) in a severe accident, depressurization to low pressure before vessel failure → prevents HPME and DCH; (3) prevents high-pressure creep failure; (4) (SDVS) high-point venting.
3. OPR1000: two trains from the pressurizer, gate + globe MOVs, rupture disc → containment; power removed and key-locked in normal operation.
4. Sizing basis: opened early enough, the SDS together with the available HPSI pumps prevents core uncovery; fewer pumps or trains mean it must be opened earlier.
5. APR1400: four POSRVs (2,470 psia, 244.9 t/h each), two spring pilots (automatic) + two motor pilots in series (remote) → IRWST spargers.
6. Severe-accident discharge: 3-way valves → SG compartment (later APR1400 designs, US DC); two ERDV trains (some later units).
7. Other reactor types: Westinghouse type = PORVs + block valves.
8. Caution: not a DBA mitigation system; opening it worsens the containment environment.