Thanks Rainer. It has been a lot of years since I have thought about this stuff.  I'll just add that the CANDU safety systems have multiple redundancy.

Power is controlled (balanced) across the reactor using light water zones and neutron absorbing rods. Control rods are driven from the top so gravity alone can shut down the reactor when the shut down rods are released. And in an emergency boron can flood the reactor vessel (calandria) to immediately absorb all neutrons (again gravity release). And the Candu reactors have a final zone of defense. The vacuum building which connects to the reactor building  to contain any event where the calandria is breached to reduce pressure and douse and again it does not rely on any power supply to do this. It's been a lot of years since I thought about this stuff…4 classes of power which are all backed up multiple times. 

The other point that should be made is that the reactors operate at very low temperature and very low pressure when compared with fossil unit steam generators.

Again Rainer good insights!

When we talk of Chernobyl the Russian built reactors do not provide that final zone of defense. They told their citizens it was safe and they did not need the extra zone. It is absolutely bonkers what they did at Chernobyl. A real crime. That whole event started out as a test which the experts said would not work…That is what we were told when our people analyzed the event.