Most, if not all, fuel safety criteria for light water reactors (LWRs) were established during the late 1960s and early 1970s. With the development of advanced fuel and core designs, the adoption of more aggressive operational modes and more accurate design and analysis methods, concern has arisen over whether safety margins have remained adequate.

Development of criteria

Experiments carried out in the ’60s and ’70s provided information on fuel and reactor core behaviour under design basis accident (DBA) conditions. The results were used to develop the fuel safety criteria for these accidents as well as the related analytical methods.

Generally speaking, those events with a probability of occurrence between ~1 to 0.01/year were characterised as anticipated transients, while events with a probability less than 0.01/year were referred to as postulated accidents. Clearly, within these categories, there is a range of probabilities for events. These probabilities were taken into account during the development of fuel safety criteria.

At the time, high burnup was thought to occur around 40MWd/kg, but it was believed that data could be extrapolated to some extent if necessary. However, by the mid-1980s, changes in pellet microstructure had been observed at higher burnup, along with increases in the rate of cladding corrosion. Continued extrapolation of transient data from the existing database was therefore inappropriate.

During that time, reactors were being allowed to operate at higher exposures than those used in the development of fuel safety criteria. For example, the US Nuclear Regulatory Commission licensed burnup in commercial reactors up to 62MWd/kg (average exposure of the peak rod).

To address this problem, a number of experimental and analytical programmes were initiated to evaluate the effects of higher burnup on fuel behaviour, especially under LOCA (loss of coolant accident) or RIA (reactivity initiated accident) conditions. Two tests performed with highly irradiated fuel — in the French CABRI facility and the Japanese NSRR facility — demonstrated rod failure and some fuel dispersal at much lower enthalpies than the peak fuel enthalpy limits already established.

In 1996 the Committee on the Safety of Nuclear Installations (CSNI) said: “Fuel damage limits should be established for the entire range up to high burnup. Limits to ensure fuel integrity should be based upon appropriate parameters (such as enthalpy, departure from nucleate boiling and cladding oxidation), and should consider the full range of possible transients, including reactivity insertion and LOCAs.” Later that year it was decided that a task force — the Task Force on Fuel Safety Criteria (TFFSC) — should be formed to take a much broader look at fuel behaviour and requirements for appropriate safety margins of modern fuels and designs.

Effect of the new

The TFFSC reviewed the existing safety criteria and assessed the effects on these criteria by new design elements such as new fuel and core design, cladding materials, manufacturing processes, and high burnup. In order to verify whether additional efforts are required to ensure that these criteria are adequate, the Task Force also looked into the methods and codes that are currently used to verify the criteria and margins.

The table on page 39 lists the current fuel safety criteria for LWRs against those new design elements that may affect them. Due to the difficulty in doing so, the 20 safety related criteria are listed without any attempt to categorise them according to risk significance. To illustrate the difficulty in categorisation, the report gives the example of fuel cladding limits. During normal operation, cladding oxidation limits are often put in place to maintain good operational performance; however, in other instances, oxidation limits may be linked to cladding mechanical strength for performance under LOCA conditions.

The eleven new elements listed at the bottom of the Table can affect the safety margins and, in some cases, the criteria themselves.

Critical power ratio/departure from nucleate boiling ratio

The critical power ratio (CPR) for BWRs and a departure from nucleate boiling ratio (DNPR) for PWRs are the most widely used safety criteria for cladding integrity. The CPR/DNBR safety limit is derived from a statistical analysis, in which the fuel assembly specific heat flux characteristics are accounted for with a specific core loading. The safety limit depends only on fuel assembly characteristics. Nowadays, the safety limit is often re-evaluated based on the cycle specific core loading and thus becomes a cycle specific limit.

CPR/DNBR safety limits can be considered to properly reflect the modern fuel and core designs. To date, no fuel has failed due to inadequacies in establishing these safety limits. Although it appears that the safety criteria and the methods used to establish them are adequate, the report suggests that full-scale testing is needed to establish the proper thermal-hydraulic modelling of new assembly designs.

In addition, the report points out that the heavy oxide coatings that can appear on cladding at high burnup, and also heavy crud layers, may affect fuel rod heat transfer properties. CPR/DNBR correlations are generally developed from data on unoxidised, or lightly oxidised, fresh cladding tubes.

Reactivity coefficient

In general, although the reactivity coefficients may be affected by new design elements, the report concluded that the corresponding safety criteria would not be affected.

Shutdown margin

There must be enough reactivity worth of control rods and/or boron in the primary coolant to guarantee reactor subcriticality. For control rods, this subcriticality requirement becomes the so-called shutdown margin (SDM).

Highly optimised core designs (higher enrichment levels, often in conjunction with more burnable poison) have often shown a decrease in margin to the SDM criteria. In addition, fuel and core design performance is affected by operating strategies aimed at reducing fuel cycle costs. In the case of MOX fuel, for example, smaller control rod and boron worths have reduced the SDM performance.

In some cases plant changes have been made to compensate for the reduced margins:

• Use of new control rods with higher worth (more/different absorbing material).

• Higher number of installed control rods.

• Increase of boron system capacity.

• Use of enriched boron.

The report notes that the existing SDM criteria themselves are unaffected by the new design elements, but emphasised that models used to establish these criteria should be carefully verified; in particular the modelling uncertainty should be quantified to asses the margin to safety.


In the enrichment range of 5-10wt%235U, the benchmarks of code performance or the bases for extrapolating code performance have not been well established. For enrichments of around 6% and over, the physics of criticality begins to change.

Crud deposition

Safety limits on crud deposition are not clearly defined, but the amount of crud deposited and its composition can be significant to the corrosion performance of the cladding. The build-up of crud may well be influenced by new design elements such as cladding materials and their manufacturing processes.

No firm limits for crud deposition criteria are likely to be needed as criteria for the limiting phenomena (oxidation, hydriding, pellet clad interaction) are already established.

Strain level

Continuous verification of fuel design models is essential, because the properties of stress and strain depend on material composition, fabrication, fluence and hydrogen content. New design elements, in particular high burnup, will clearly affect these mechanical properties. Stress and strain analyses are performed by the fuel vendor, with models that are constantly being benchmarked against available experimental test data.

Oxidation and hydriding

Oxidation degrades material properties such as the cladding thermal conductivity, whereas hydriding leads to embrittlement. As the dependence on burnup is not linear, these phenomena become increasingly important at higher exposures. For these reasons, Zircaloy cladding materials have been highly optimised over the past 10-20 years.

As corrosion of Zircaloy is probably one of the leading parameters that limit the lifetime of fuel, the report suggests that the adequacy of the current applicable limits on maximum local oxidation and hydriding levels in the cladding should be reviewed.

Internal gas pressure

Fission gas release and the resulting fuel rod internal pressure is an important aspect of fuel behaviour. However, phenomena concerning fission gas release at high burnup, are not yet well understood, nor can existing analytical tools predict them satisfactorily.

The criteria currently used for acceptable internal gas pressure should not be affected by new design elements, although methods to demonstrate compliance will be affected.

Thermal mechanical loads

The basic safety criterion – the avoidance of mechanical fracture of the clad – is not affected by new design elements.

Pellet-to-cladding mechanical interaction (PCMI) refers to the stress on the cladding from an expanding pellet, especially during a transient. Pellet expansion mainly results from thermal expansion, and if the stress is large enough, it can result in cladding failure.

More tests focusing on PCMI directly should be performed to address the concerns that exist regarding the effect of high burnup. Fuel design and performance codes can be used for this, provided they are well benchmarked and validated.

Pellet cladding interaction

Pellet cladding interaction (PCI) failures are due to stress corrosion cracking in the cladding material. Fresh fuel rods do not fail by PCI, nor do fuel rods operated at constant power.

During the 1980s and 90s, PCI-resistant fuel types were developed, which contained a small layer of zirconium at the inner part of the clad. Also, the modern fuel assembly designs contain more fuel rods and therefore have a lower linear heat rating for each rod. This allows the fuel to permanently operate below the PCI threshold and thus not be in danger of PCI.

At present, there is a good basis for PCI limits up to about 50MWd/kg burnup. The PCI limits need to be kept up-to-date, to correspond with the respective fuel and core design.

Fuel fragmentation

To avoid the loss of coolable geometry and the generation of coolant pressure pulses, peak fuel enthalpy criteria are used as limits for reactivity-initiated accidents (RIA). Analytical verification of an enthalpy limit of around 230-280cal/g may be sufficient to ensure a coolable geometry for fresh and very low burnup fuel. At high burnups further understanding of the fragmentation process and the effects of high burnup is needed.

Fuel failure

In most countries the fuel failure limit is based on section 4.2 of the US Nuclear Regulatory Commission Standard Review Plan NUREG-0800 as a maximum radially averaged fuel enthalpy of 170cal/g for BWRs and as a DNB criterion for PWRs. Various limit values as a function of burnup have been proposed, based either on direct experimental data or relevant parameters, such as cladding oxide thickness. Technically based safety criteria and verification of the analytical models for fuel performance should be pursued. The report stresses that the CABRI facility, modified to include a PWR water-loop, could be used for the further investigation of high burnup fuel under realistic conditions.

Cladding embrittlement/PCT

The peak cladding temperature (PCT) criterion is a measure of the amount of oxidation that can take place during the transient and the related loss of ductility. Little is known about the behaviour of highly burnt fuel under this condition and should therefore be examined experimentally.

Cladding embrittlement/oxidation

Based on many laboratory quenching and ductility tests with unirradiated zircaloy tubes, it was found that cladding would not become embrittled enough to fragment if the PCT remained below 1204ºC and the total oxidation did not exceed 17% of the original cladding thickness. These embrittlement criteria (10CFR50.46) are used widely.

On the whole, LOCA safety criteria are considered adequate for modern fuels to meet the basic limitations on core coolability and radiological release.

Blowdown/seismic loads

Safety criteria in these areas are in general not directly affected by the new design elements, but the strength and ductility of high burnup cladding, guide tubes and channel boxes will not be the same as for fresh material.

Assembly holddown force

The safety criteria are not considered to be affected by new design elements. These criteria are usually defined following NUREG-0800, SRP 4.2, App A: vertical lift-off forces must not unseat the lower fuel assembly tieplate from the fuel support structure. The fuel assembly holddown force leads to compressive forces on the guide tubes, which can give high fuel assembly bow due to irradiation induced guide tube creep. Also, high compressive forces can result from excessive guide tube growth. To ensure acceptable guide tube corrosion and hydrogen pickup, guide tube design and material has to be carefully selected.

Coolant activity

Limits are usually specified for the concentration of 131I (sometimes also of 137Cs) in the primary coolant. Aside from this limitation, no fuel safety criteria on coolant activity exist.

Gap activity

During normal operation, some fission products come out of the UO2 fuel matrix and collect in the gap between the fuel pellet and the cladding. Fission product release to the gap is found to increase at high burnup. These increases in release may require the modification of assumptions about gap activity that are used in safety analyses.

Source term

The source term refers to the part of the fission products inventory released into the containment and potentially available for release to the environment during an accident. It is unlikely that high burnup will have a significant effect on source terms or core melt progression. The implementation of a revised source term could affect the dependence on new designs and materials.

Fuel cycle trends

The Task Force concluded that, in general, new design elements do not have a significant effect on the current framework of fuel safety criteria. The limits in the individual safety criteria may, in some areas, need to be changed in accordance with the particular fuel and core design features. Some of these have already been, or are being, adjusted.

For this further assessment of safety criteria the Task Force recommended the following process:

• Continue development of best estimate analysis methods.

• Continue experimental verification of best-estimate methods.

• Review and – where necessary – adjust safety criteria levels.

Last month, the NEA published “Trends in the Nuclear Fuel Cycle”, a report examining developments in the fuel cycle that may improve the competitiveness and sustainability of nuclear energy in the medium to long term. This new report gives an overview of potential nuclear system developments that aim to meet sustainability goals and address public concerns. It points out that the nuclear fuel cycle comprises an important element in the overall acceptability of nuclear power.

Current fuel safety criteria