Accident conditions

For accident conditions, the following objectives¹³ need to be met:

(a) Components of the reactor core and its associated structures should be designed with account taken of the safety functions to be achieved;

13 The performance of the fundamental safety functions is considered successful, from a fuel design perspective, if the objectives (b) and (c) above are met.

(b) The plant’s fundamental safety function of removal of heat from the reactor core is performed to the degree of effectiveness required to ensure, for DBAs and DECs without significant fuel degradation, coolable core geometry and coolable bundle geometry;

(c) Fuel sheath failures are kept to a minimum¹⁴.

Maintenance of coolable core geometry implies – for accident conditions – no more than one channel failure (commonly referred to as ‘single channel events’ in the accident analysis) in a horizontal channel-type PHWR [18], and coolable bundle geometry means that the channel decay heat can be removed from the bundles in a channel, in the long term without further fuel damage, and without reliance on the moderator.

These objectives are consistent with Requirement 44 of SSR-2/1 (Rev. 1) [5] on the structural capability of the reactor core, which states:

“The fuel elements and fuel assemblies and their supporting structures for the nuclear power plant shall be designed so that, in operational states and in accident conditions other than severe accidents, a geometry that allows for adequate cooling is maintained and the insertion of control rods is not impeded.”

A key step in achieving the above objective (a) consists in identification of the safety functions performed by the reactor core and its associated structures. The safety functions performed by the fuel and the PHTS, the reactor core components of interest in this publication, are discussed in Section 3.2.1 and in Appendix III.

The fuel acceptance criteria for accident conditions reported in Section 3.2, whose key characteristics are described below, are among the defence in depth provisions introduced to ensure that the above objectives (b) and (c) are met with enough margins. These fuel acceptance criteria are related to the failure mechanisms that may challenge, under accident conditions, the integrity of the fuel matrix, fuel sheath and fuel channel. Regarding the fuel channel, only the pressure tube failure mechanisms that could be activated, as a result of fuel behaviour, are covered in this publication.

The failure mechanisms discussed in Section 3.2 and their associated fuel acceptance criteria are not organized according to accident scenarios since most of them are potentially active in more than one class of events. For instance, in CANDUs, fuel sheath embrittlement due to oxidation/hydriding is relevant to a large loss of coolant accident (LOCA) and other accident scenarios such as small LOCA, single channel events, LOCA with impairment of emergency core coolant injection, loss of regulation, and auxiliary system failures such as that of the shutdown cooling system.

For some of the failure mechanisms discussed in Section 3.2, there are no reported fuel acceptance criteria; this is not necessarily because none are used or being developed, but is probably due to the fact that, for most of them, no information about these criteria was specifically requested from the PHWR States. Given that significant research and development work has already been carried out to understand these mechanisms, and that some of those

14 The safety requirement regarding the maintenance of sheath integrity is usually more stringent for events with a higher frequency of occurrence. For instance, in Canada the current practice is that fuel sheath failures for all DBAs other than for large break loss of coolant accidents (LOCAs) and single channel events are not allowed.

failure mechanisms could also be of interest to DECs with core melt, discussions about those failure mechanisms have been included in Section 3.2.

2.2.2.2. Key characteristics

The value of each of the key parameter characterizing a specific barrier failure mechanism, and which demarcates the zone of essentially no failures from the zone where failure can occur with non-negligible likelihood, is referred to as the ‘failure point’ for that parameter. Determination, for a given key parameter, of its failure point need to be derived from experiments that identify the limitations of the material properties of the fuel (element/bundle) and, according to [19], need to:

(a) Be based on experimental data obtained under sufficiently representative conditions;

(b) Be set close to the values indicating non-failed states (rather than close to data for failed states), especially where the experimental data are limited;

(c) Account for measurement uncertainties and data scatter.

The fuel acceptance criterion associated with a barrier failure mechanism specifies bounds (limits) on the values of the key parameters that govern that failure mechanism process and which, if complied with during an accident sequence, prevent barrier failure due to that mechanism. These bounds are determined by establishing, for each of the key parameters, a margin to the key parameter’s failure point to account for the following [19]:

 Data derived from experimental conditions which are not typical for reactor operating conditions (i.e. temperature, pressure, neutron flux, burnup);

 Data derived from an experimental set-up differing from the reactor geometry (i.e.

scaling distortions);

 Effects from ageing or from differences in manufacturing of the plant components and of the experimental components;

 Incomplete knowledge (‘unknown unknowns’, i.e. unexpected or unforeseeable conditions).

These aspects, inevitably present to some extent in any experiment, cannot be quantified and the determination of the size of the margin to the failure point is by necessity based on engineering judgement.

As shown in Fig. 1, for each of the key parameters characterizing the failure mechanism of a physical barrier, there are two types of margins related to the prescribed limiting value of that key parameter:

 A so-called ‘analysis margin’ with respect to the value of this parameter calculated using deterministic safety analysis;

 A so-called ‘margin to failure point’ to the value that the key parameter has at the failure point.

The ‘analysis margin’ for a given key parameter is the difference between its prescribed limiting value and its calculated value using the design basis deterministic safety analysis methodology.

In cases where:

 The level of knowledge of a failure mechanism is low;

 The current fuel and fuel channel analysis codes cannot model the selected key parameter; or

 The codes are not validated against the range of conditions associated to the failure point,

it is a common engineering practice to make use of one or more surrogate parameters to express the fuel acceptance criterion which, if met, will prevent barrier failure due to that failure mechanism. These fuel surrogate criteria also need to be based on experimental evidence and are defined such that the margin to barrier’s failure point is more conservative.

FIG. 1. Limits and margin model. The double arrows represent the two different types of margins for each key parameter characterizing a physical barrier failure mechanism.

2.3. REGULATORY REQUIREMENTS AND PRACTICES IN STATES WITH