The Unique Engineering of CANDU Reactors

The CANDU (Canada Deuterium Uranium) reactor embodies a distinctive approach to nuclear power generation, built on adaptability, neutron economy, and modular construction. Developed by Atomic Energy of Canada Limited (AECL), this pressurized heavy-water reactor (PHWR) entered commercial service in 1962 and has since been exported to nations including South Korea, Romania, Argentina, and China. Its defining characteristic is the use of heavy water (deuterium oxide) as both moderator and primary coolant. Heavy water’s exceptionally low neutron absorption cross-section allows the reactor to sustain a chain reaction using natural, unenriched uranium fuel, eliminating the need for enrichment facilities and enabling flexible fuel cycles involving thorium or recycled uranium from light-water reactors.

The reactor core consists of a large cylindrical vessel called the calandria, filled with heavy water moderator and penetrated by hundreds of horizontal pressure tubes. Each tube contains a string of fuel bundles—typically 37-element assemblies of uranium dioxide pellets clad in Zircaloy. This layout enables on-power refueling: robotic fueling machines connect to individual channels, insert fresh fuel from one end, and remove spent bundles from the other while the reactor operates at full capacity. This capability dramatically improves capacity factor and avoids the extended downtime associated with batch refueling in other reactor designs.

The calandria is an austenitic stainless steel vessel operating at near-atmospheric pressure and moderate temperature, while the pressure tubes handle the high-temperature, high-pressure primary coolant. This “tube-in-tube” design creates a robust boundary between the moderator and coolant loops. The primary heat transport system circulates heavy water coolant through the pressure tubes, extracting heat from the fuel and transferring it to steam generators, where ordinary light water boils to drive conventional turbine-generators.

These features confer significant operational advantages, but they also introduce maintenance challenges that demand rigorous, specialized practices. The integrity of thousands of pressure tubes, the purity of the heavy water inventory, the performance of on-power refueling machinery, and the proper functioning of control and safety systems are all essential to safe operation. Neglect in any area can lead to forced outages, reduced efficiency, or even compromised safety. Understanding this intricate interplay is the foundation for establishing best maintenance practices.

The Safety Imperative in Nuclear Maintenance

Nuclear safety is grounded in a defense-in-depth philosophy that layers multiple physical and administrative barriers to prevent the release of radioactive materials. Maintenance is not merely a support function; it is a cornerstone of this philosophy. In CANDU reactors, the heavy water inventory, fuel channel condition, shutdown system reliability, and containment integrity all depend on a meticulous maintenance program. Regulatory bodies like the Canadian Nuclear Safety Commission (CNSC) mandate strict adherence to codes and standards, while utilities such as Ontario Power Generation (OPG), Bruce Power, and Nuclearelectrica have developed comprehensive maintenance frameworks that meet and exceed these requirements.

The consequences of maintenance deficiencies have been demonstrated globally. The 1983 Pickering A pressure tube rupture—caused by delayed hydride cracking in a rolled joint—triggered extensive safety reviews and eventual pressure tube replacement across the fleet. Although no radiation was released, the incident highlighted the critical importance of material aging management, inspection frequency, and operational limits. Similarly, undetected heavy water leaks not only incur massive financial costs—heavy water is extraordinarily expensive—but also create tritium hazards that must be carefully controlled. Every maintenance activity, from a simple valve packing to a full pressure tube inspection, must be treated as a safety-significant action.

Effective maintenance safeguards workers, the public, and the environment while protecting the substantial investment in the plant. It is a continuous, data-driven process that requires integrating operational experience, engineering analysis, and a questioning attitude at every organizational level.

Key Maintenance Domains and Their Best Practices

Fuel Channel Integrity and Pressure Tube Life Management

Fuel channels are the heart of the CANDU design. Each channel comprises a zirconium-niobium pressure tube, a thinner calandria tube, and an insulating gas annulus between them. Pressure tubes operate at approximately 300°C and 10 MPa, experiencing significant irradiation, corrosion, and mechanical stress. Over time, they absorb deuterium, which can precipitate as brittle zirconium hydride, and they elongate due to irradiation creep and growth. The maintenance challenge is to detect degradation early, predict remaining life, and plan replacement before safety margins are reduced.

Best practices begin with a comprehensive periodic inspection program using in-service inspection (ISI) techniques. Ultrasonic testing measures wall thickness, detects hydride blisters, and sizes flaws. Eddy current inspection characterizes axial and radial crack indications. Slug tests or spool piece analyses monitor corrosion and deuterium pickup rates. Remote visual inspection using cameras deployed by fueling machines can identify debris, scratches, or fretting marks inside pressure tubes. All inspection data feed into probabilistic fracture mechanics models that assess the risk of delayed hydride cracking or rupture.

A standout practice is the fitness-for-service assessment, which considers actual operating conditions rather than original design assumptions. This allows plants to safely extend pressure tube operating life, provided periodic re-assessments confirm compliance with CNSC regulatory documents such as CSA N285.4. When degradation approaches limits, pressure tube replacement or large-scale retubing occurs during planned outages. Advanced planning, specialized tooling, and rigorous quality control are vital during such campaigns; a single defective weld or improperly installed end fitting can lead to future operational problems.

Operators must also strictly manage primary coolant chemistry to minimize corrosion. Maintaining a slightly alkaline pH, controlling dissolved oxygen, and monitoring for fluoride or chloride ingress are all part of the chemical control program. Deviations can accelerate corrosion or increase the risk of stress corrosion cracking.

Heavy Water Management and Leak Prevention

Heavy water is the lifeblood of CANDU reactors. The primary heat transport system and moderator contain hundreds of tonnes of D2O, each kilogram worth thousands of dollars. A heavy water leak presents a triple threat: direct economic loss, tritium exposure risk, and reduced neutron efficiency if the moderator inventory drops. Maintenance activities must therefore prioritize detecting and repairing leaks.

Best practices include a dedicated heavy water leak detection system using dew point sensors or tritium monitors in accessible areas. Pressure decay tests and helium leak detection are employed during outages to pinpoint even micro-leaks at gaskets, flanges, and pump seals. The moderator cover gas system is continuously monitored for moisture content. When a leak is identified, a root cause analysis determines whether it stems from a design weakness, material incompatibility, or maintenance error.

Upgrades to flanges and seals using improved gasket materials—such as spiral-wound metallic gaskets with flexible graphite filler—have substantially reduced leak rates in many plants. Valve packing and pump mechanical seals are selected based on operating experience and manufacturer testing to ensure long life under radiation and thermal cycling.

Heavy water recovery and purification systems also require careful upkeep. The cleanup system removes impurities and recovers D2O from light water infiltrations via isotopic separation columns. If these systems degrade, the purity of moderator and coolant can fall, potentially increasing fuel temperature margins or causing moderator reactivity effects. Regular regeneration of ion exchange resins and calibration of separation columns are part of routine maintenance.

On-Power Refueling and Fuel Handling Systems

The ability to refuel while at full power is one of CANDU’s signature strengths, but the fueling machines are complex electro-mechanical systems that must lock onto pressurized fuel channels, balance pressures, transfer fuel bundles, and seal again without leaking radioactive coolant. A failure during refueling can cause a forced outage or even a loss-of-coolant accident (LOCA).

Rigorous preventive maintenance of fueling machines is non-negotiable. This includes overhauls of ram heads, ball screw actuators, magazine rotors, and pressure boundary valves at intervals defined by manufacturer specifications and operating history. All critical fasteners and seals undergo ultrasonic or liquid penetrant inspection during each major maintenance window. Lubrication must use radiation-resistant greases that do not degrade and cause sticking or galling.

Testing after maintenance is equally important. Full operational tests simulating remote fuel handling sequences are conducted before the machines return to service, verifying that all interlock logic works correctly and that the fueling machine can complete a channel cycle without inducing excessive vibration or pressure transients. Training for fuel handling operators now heavily incorporates high-fidelity simulators that mirror actual control consoles, allowing crews to rehearse abnormal scenarios.

Control Systems, Shutdown Systems, and Instrumentation

CANDU reactors have two physically and functionally independent shutdown systems: Shutdown System 1 (SDS1), consisting of cadmium absorber rods that drop vertically into the core, and Shutdown System 2 (SDS2), which injects gadolinium nitrate poison solution into the moderator. These systems must be available and capable of rapid action at all times, and their maintenance is governed by the CNSC’s strict requirements for special safety systems.

Calibration and functional testing are conducted on a defined schedule aligned with the reactor’s operating license. For SDS1, each rod drop time is measured and compared against acceptance criteria to ensure adequate insertion speed. Mechanical linkage wear, dashpot condition, and electrical continuity are all checked. For SDS2, the poison injection nozzles, high-pressure helium system, and valve actuation sequence require periodic stroking and leak testing. Maintenance of the associated trip logic—software, relay contacts, sensor channels—must be performed with zero tolerance for error.

Process instrumentation demands similar rigor. Neutron flux detectors (ion chambers and self-powered detectors), reactor regulating system algorithms, and liquid zone control units (which manage fine reactivity adjustments) are calibrated against reference standards. Modern CANDU stations have undergone digital control system upgrades, implementing triple-redundant programmable logic controllers. Their maintenance involves periodic self-diagnostics, software patch management, and hardware life-cycle planning.

Radiation Protection and Contamination Control

Maintenance activities invariably bring workers into contact with radiation fields and potential contamination. Best practices in this domain go beyond regulatory compliance to create a proactive ALARA (As Low As Reasonably Achievable) culture. This means designing tasks to minimize dose, using temporary shielding, sequencing work to reduce multiple exposures, and employing remote tooling where feasible.

Prior to any intrusive work, radiation surveys and source term predictions are conducted. Airborne contamination monitoring is essential when opening systems containing tritiated heavy water. Workers wear appropriate personal protective equipment and use supplied-air respirators if necessary. Real-time electronic dosimeters with alarm setpoints provide instant feedback, and administrative dose limits often fall below legal maximums to provide additional safety margins.

Decontamination of tools, components, and work areas is systematically performed. Chemical decontamination of piping before major outages can significantly reduce dose fields. Waste management—dry active waste, spent resins, and spent filters—must comply with integrated waste strategies that minimize volume and ensure safe interim storage or disposal. Maintenance planners explicitly identify radiation risks in work packages, and every job is reviewed by health physics personnel before execution.

Building a Comprehensive Maintenance Program

Best practices are embedded in a living maintenance program that integrates reliability-centered maintenance (RCM), risk-informed decision-making, and continuous improvement. The Canadian Standards Association standard CSA N286-12, “Management system requirements for nuclear facilities,” provides a framework for ensuring all activities are planned, executed, and reviewed systematically.

Preventive and Predictive Maintenance Strategies

A robust preventive maintenance (PM) program uses a combination of time-based and condition-based tasks. Time-based tasks—such as periodic replacement of compressor bearings or relay cleaning—ensure components do not operate beyond their proven service life. Condition-based tasks rely on surveillance data: vibration monitoring of pumps and motors can identify bearing wear months before failure; thermography detects hot spots in electrical switchgear; oil analysis reveals internal contamination in hydraulic systems. CANDU plants have embraced predictive maintenance technologies, installing online condition monitoring systems that feed data to centralized diagnostic centers where engineers analyze trends and recommend corrective actions.

The criticality ranking of equipment is determined through RCM analysis, evaluating failure consequences on safety, production, and environmental impact. High-criticality items—such as emergency core cooling system pumps or shutdown cooling valves—receive more frequent and detailed attention. Non-critical components, such as building ventilation fans not associated with containment, may be assigned a lower interval or run-to-failure strategy, ensuring no single failure can propagate to a safety system.

Outage Management and Planning

CANDU reactors refuel on power, but they still require planned outages for activities that cannot be done while at pressure and temperature—pressure tube inspections, steam generator maintenance, turbine overhauls, and major digital control system upgrades. A well-executed outage is a model of precision planning. A dedicated outage management organization begins work years in advance, sequencing tens of thousands of tasks to the hour, ensuring each activity has the required permits, materials, and qualified personnel.

During the outage, a “safety pause” culture is promoted: no task begins until the crew validates that isolation, tag-out, and radiation work permits are in place. Daily coordination meetings, progress dashboards, and real-time video monitoring in high-risk areas ensure any deviation from plan is immediately escalated. Post-outage lessons learned are captured and fed back into the planning cycle, making each outage an opportunity for improvement.

Workforce Competence and Safety Culture

No maintenance program can succeed without a highly competent workforce. CANDU operators invest heavily in initial and continuing training for maintenance technicians, engineers, and managers. System engineers become specialists who know the design basis, operating history, and degradation mechanisms of their assigned systems. They are empowered to initiate condition reports when they see something anomalous. Maintenance technicians receive hands-on training in mock-up facilities that simulate the tight quarters and radiation fields of the actual plant.

A strong safety culture means anyone can stop a job if they feel it is unsafe. Pre-job briefings review the procedure, hazards, and expected outcomes. Post-job reviews capture near-misses and suggestions. The nuclear industry has adopted principles from the Institute of Nuclear Power Operations (INPO) and the World Association of Nuclear Operators (WANO) to benchmark performance and share operating experience globally. CANDU-specific events are logged in the IAEA/OECD-NEA Incident Reporting System, and utilities analyze these reports to ensure a lesson learned in Romania prevents a problem in Canada.

Regulatory Framework and External Oversight

The Canadian Nuclear Safety Commission is the independent nuclear regulator in Canada, and its licensing process requires demonstration of a comprehensive maintenance program. Licensees submit regular performance reports and are subject to both planned and unannounced inspections. Regulatory document REGDOC-2.6.1, “Maintenance Programs for Nuclear Power Plants,” sets out explicit expectations for maintenance policies, preventive maintenance optimization, and equipment qualification. In Romania, Nuclearelectrica operates under the oversight of the National Commission for Nuclear Activities Control (CNCAN), which has similar requirements tailored to local conditions.

External peer reviews conducted by WANO provide another layer of oversight. Every CANDU station undergoes periodic WANO peer reviews where international experts assess areas including maintenance, operations, engineering, and emergency preparedness. The findings drive plant improvement plans. Public transparency through community liaison committees and publicly accessible regulatory hearings also adds accountability.

Technology Innovations Enhancing Maintenance

Advancements in robotics and digitalization are reshaping CANDU maintenance. In-reactor inspection robots can now traverse fuel channels autonomously, collecting dimensional data, visual imagery, and non-destructive test results. Advanced phased-array ultrasonic probes provide high-resolution 3D maps of pressure tube integrity. Machine learning algorithms are being trained on decades of inspection data to predict future degradation more accurately, enabling more targeted and less frequent inspections.

Digital twin technology is under active development. A digital twin of a CANDU reactor incorporates real-time sensor data, thermal-hydraulic models, and structural analysis to run “what-if” scenarios, helping maintenance engineers plan interventions with minimal impact on operations. Augmented reality headsets are being trialed to overlay step-by-step instructions and radiation maps onto a technician’s field of view, improving accuracy and reducing human error.

In heavy water management, optical spectroscopy and mass spectrometry provide near-real-time isotopic analysis, enabling immediate detection of light water in-leakage. Automated leak detection algorithms analyze thousands of data points per second, alerting operators to the smallest anomalies. As noted in an overview of heavy water reactor technology, proper handling of deuterium oxide is critical for both safety and economics, and these new tools reinforce that objective.

The integration of enterprise asset management (EAM) software allows real-time tracking of maintenance work orders, spares inventory, and equipment history. Trend analysis of corrective maintenance notifications can reveal hidden systemic issues, leading to proactive design modifications. Combined with a strong learning culture, technology multiplies the effectiveness of human expertise.

Case in Point: The Refurbishment of the CANDU Fleet

Between 2016 and projected 2033, OPG and Bruce Power are undertaking refurbishment of multiple CANDU reactors at Darlington and Bruce nuclear generating stations. These projects entail complete replacement of pressure tubes, calandria tubes, and feeder pipes, along with upgrades to steam generators and digital control systems. They represent the largest single investment in Canadian infrastructure and serve as a masterclass in maintenance planning and execution.

The refurbishment process demonstrates best practices at an unprecedented scale. All pressure tube removal and installation is performed by highly specialized tooling under cleanroom conditions in the calandria vault. Every feeder weld is inspected by phased-array ultrasonics. Lessons from the earlier Point Lepreau refurbishment—where first-of-a-kind delays occurred—were systematically incorporated into subsequent projects. Detailed work planning, collaborative contract models, and innovative supply chain management have kept later projects on time and on budget. As detailed by the Canadian Nuclear Safety Commission, these projects require rigorous safety assessments and ongoing oversight to ensure that the plant returns to operation with enhanced safety margins.

Integrated Management System and Continuous Improvement

Top-tier maintenance organizations employ an integrated management system that aligns policy, processes, and performance indicators. Key maintenance metrics—such as schedule adherence, corrective maintenance backlog, forced loss rate, and worker dose—are tracked monthly at the executive level. Deviations trigger deep-dive analyses. Trending of precursor events—minor leaks, equipment misalignments, procedural non-conformances—is used to identify weak signals before they become significant.

Corrective action programs ensure every identified problem is documented, analyzed, and resolved according to its significance. Minor issues may be fixed on the spot, while more complex ones undergo rigorous root cause analysis using techniques like the “5 Whys,” cause-and-effect diagrams, or MORT (Management Oversight and Risk Tree). The resulting corrective actions are tracked to completion and verified for effectiveness.

External operating experience sharing remains a pillar of continuous improvement. CANDU utilities participate in the CANDU Owners Group (COG), which facilitates joint research, benchmarking, and information exchange. Topics such as pressure tube life management, steam generator degradation, and fire risk assessment are addressed collectively, leveraging the expertise of multiple operating organizations. This collaboration implements the industry principle that “an incident anywhere is an incident everywhere.” Resources from the International Atomic Energy Agency complement this effort by providing guidance documents and safety standards applicable to PHWRs.

Challenges and How Best Practices Evolve

The maintenance environment for CANDU reactors is not static. As plants age beyond original design life, new degradation mechanisms may emerge. Feeder piping, for example, has shown flow-accelerated corrosion that was unanticipated during initial design, leading to costly inspections and replacements. Best practices have evolved to include predictive wear modeling based on water chemistry and hydraulic parameters. The industry’s openness to scientific research—such as studies on deuterium ingress in zirconium alloys—fuels the continuous update of inspection codes.

Supply chain risks have come to the forefront, particularly for components originally manufactured by companies that no longer exist. Maintenance organizations now maintain proactive obsolescence management programs, qualifying alternative suppliers and, in some cases, reverse-engineering critical parts to modern standards using advanced manufacturing techniques like 3D printing for certain non-safety-class items. The qualification process includes environmental and seismic testing to ensure equivalence to the original equipment.

Climate change considerations are also being integrated. More frequent extreme weather events test the robustness of cooling systems and electrical grids. Maintenance plans now incorporate increased surveillance of intake structures, emergency diesel generators, and transmission line corridors to ensure resilience against flooding, ice storms, or high winds.

Conclusion

The safe operation of CANDU reactors rests on a foundation of meticulous, science-based maintenance. The unique design features that give these reactors their economic and flexibility advantages—heavy water moderator, horizontal pressure tubes, on-power refueling—also demand specialized maintenance strategies. Best practices span from the micro-level, such as the exact torque applied to a pressure tube end-fitting, to the macro-level, including integrated management systems and regulatory oversight.

By systematically managing fuel channel integrity, heavy water purity, control system reliability, and radiation protection, operators ensure CANDU plants run at high capacity factors with an excellent safety record. The ongoing refurbishment projects attest to the industry’s commitment to extending the life of these valuable assets safely and economically. As technology advances, the integration of digital tools, robotics, and data analytics will further enhance maintenance effectiveness, reducing worker dose and identifying problems before they materialize. The continuous learning culture embedded in CANDU organizations, supported by international cooperation and a strong regulator, guarantees that best practices will continue to evolve. The end goal remains unchanged: to protect people and the environment while delivering clean, reliable electricity for decades to come.

For further reading on the operational performance and safety record of CANDU reactors, refer to the World Nuclear Association’s profile on nuclear power in Canada and the technical publications available through the CANDU Owners Group.