HM Nuclear Installations Inspectorate

An Investigation into the Falsification of Pellet Diameter Data in the MOX Demonstration Facility at the BNFL Sellafield Site and the Effect of this on the Safety of MOX Fuel in Use

Appendix 3 - Fuel Rod Failure Mechanisms

In designing fuel assemblies, in addition to a very low manufacturing defect rate (resulting in direct clad failure), allowance must be made for a small number of isolated failures during Conditions I and II (steady operation, start-ups, shutdowns, mild transients, etc) and also for small numbers of failures under Conditions III and IV (fault and severe accident conditions). In order to assess the potential for fuel rod failure, a number of fuel clad integrity criteria have therefore been derived covering the following processes and parameters:-

clad stress
pellet-clad interaction (PCI)
clad strain
clad wall-thinning
clad collapse
clad fatigue
fuel rod fretting
clad oxidation
clad hydriding
clad embrittlement
clad melting
fuel melting
rod power
rod internal pressure
rapid energy deposition.

These criteria cover those mechanisms which could lead to failure during the lifetime of the fuel in the reactor and which may be assessed by calculational means.

Fuel rod design calculations are performed to demonstrate that, under Conditions I and II, the criteria outlined above are not breached and hence fuel rod failures will not occur as a result of these effects. The criteria and restrictions applying are described below. For each item, the criteria are explained and justified and the fuel and clad parameters which influence the failure mechanisms are discussed.

(i) Clad Stress

Rapid local power increases can lead to an excessive rate of pellet thermal expansion which cannot be fully accommodated by creep of the clad. This leads to the generation of high circumferential stresses in the clad which can cause clad yielding and ultimately failure due to rupture.

The calculation of clad stresses against the failure criterion takes into account the influence of uncertainties in fuel and clad manufacturing parameters and material properties. All parameters which influence either fuel temperature (and hence determine pellet thermal expansion) or the mechanical response of the cladding are potentially significant. The key items assessed are fuel diameter, fuel density, fuel thermal and mechanical properties, clad diameter, clad thickness and thermal and mechanical properties. The possibility of stress intensification due to the presence of pellet chips must also be assessed.

(ii) Pellet-Clad Interaction (PCI)

During power increases, fuel temperatures rise and the fuel expands. If the fuel-clad gap is closed then this will induce high stresses in the clad. Although the possibility of failure by conventional yielding (when the clad stress exceeds the yield stress) is considered by a separate criterion (see above), under some circumstances failure may occur at stresses below the yield stress due to stress corrosion cracking. For this reason, additional criteria are required, and it is found that the magnitude of local power increase is a suitable criterion for this purpose. Clad failure is thus prevented by limiting the transient increase in local rod power to that specified by the PCI criterion at the applicable conditions.

Parameters influencing the susceptibility to PCI failure are similar to those for the clad stress failure criterion (see (i) above).

(iii) Clad Strain

Clad failure due to uniform clad strain is prevented by limiting the total tensile creep hoop strain in the clad relative to the unirradiated state, and by limiting the tensile increment of total plastic (instantaneous plus creep) hoop strain accrued during any transient event relative to the steady-state condition prior to the transient. These criteria apply to strain values averaged around the clad circumference. The criterion is based on the results of tensile and high strain rate biaxial tests on irradiated Zircaloy-4 tubing. In practice, under reactor conditions, strain will be accumulated at a slower rate, and the limit set is therefore a conservative choice as a clad integrity criterion, since it represents a value considerably below that at which failure would actually be expected to occur.

In the methodology used for calculating clad strains it is found that three parameters account for over 95% of the total creep strain uncertainty, namely fuel density, clad inner diameter and pellet outer diameter.

(iv) Clad Wall-Thinning

Short term cyclic power variations (due, for instance, to daily load following operation) can impose a large number of stress and strain cycles on a fuel rod if these variations occur over a significant fraction of the total irradiation time. If this takes place whilst the fuel is cracked and in contact with the clad, then the fuel cracks will open as the power rises, closing again as the power falls. The frictional force between fuel and clad will be greater when the pellet is expanding and pushing out the clad than when the pellet contracts allowing the clad to contract also. This can lead to the section of clad directly over a fuel crack being stretched plastically as the fuel expands and then the whole of the clad relaxing freely as the fuel contracts. Repetition of this process over a large number of cycles is known as circumferential strain ratchetting. This can lead to significant clad wall thinning directly over a fuel crack, which can cause the clad to fail due to exhaustion of ductility. Clad failure is prevented by limiting the local level of wall thinning due to circumferential strain ratchetting relative to the nominal wall thickness. Fuel clad thickness is the main parameter influencing this failure mechanism.

(v) Clad Collapse

When a newly-loaded fuel rod is being taken to full power for the first time, a large radial gap exists between the fuel and the clad. A differential pressure always exists between the coolant pressure and the rod internal pressure, and if this were to cause the clad to collapse onto the fuel pellets then "wrinkling" of the clad could result. Additionally, the possibility of clad collapse into the plenum region of the rod must be considered. Failure is prevented by ensuring that the combinations of pressure, temperature and time experienced by the clad are not sufficient to cause instantaneous collapse when the core is first pressurised or creep collapse during the anticipated in-reactor lifetime of the fuel rod.

The main manufacturing parameters which have an influence on the calculation of clad collapse probability are: the initial wall thickness of the clad and its creep resistance, the fuel-clad gap size (determined by the clad inner diameter and the pellet outer diameter), the fill gas pressure, and the densification behaviour of the fuel.

(vi) Clad Fatigue

Short term cyclic power variations due, for instance, to daily load following operation can impose a large number of plastic strain cycles on the fuel clad. A much larger number of cycles can be imposed due to grid frequency variations, although the magnitude of the stress cycles is generally lower in these cases. These modes of operation can cause failure of the clad due to fatigue if the combination of stress range and number of cycles is sufficiently onerous. In practice, the probability of fatigue failure is governed almost exclusively by reactor operating conditions, with only a very weak dependence on fuel and clad manufacturing parameters.

(vii) Fuel Rod Fretting

As irradiation proceeds, relaxation of grid springs and reduction of the clad outer diameter (due to creepdown) both occur, and act to reduce the restraining forces between the dimples and the fuel rod. This can lead to relative motion between the clad and the dimples, which in turn can cause wear damage to the clad outer surface. Failure is prevented by limiting the loss of clad thickness due to wear between grids and fuel rods relative to the nominal clad wall thickness. This limit is taken as a guide in evaluating clad imperfections at the manufacturing stage. The methodology assesses the possibility of failure through a number of distinct causes of fretting damage, including: flow-induced assembly vibration, fluid-elastic instability, debris-induced wear, and grid/rod fretting at the bottom grid.

For none of these cases do fuel or clad manufacturing parameters have any significant influence. Rather, failure probability is a function of assembly fabrication, and, for the case of debris fretting, to reactor operation and maintenance.

(viii) Clad Oxidation

The outer surface of the cladding is progressively oxidised by the primary cooling water. High levels of oxidation can reduce performance and lead to clad failure. This occurs when such a reduction in the wall thickness has taken place, due to loss of metal to the oxide phase, that the clad can no longer withstand the stresses and strains which are imposed upon it. Clad failure is prevented by limiting the clad oxide thickness. This in turn limits the loss of wall thickness due to clad oxidation and thus is consistent with the loss of wall thickness allowed for as a result of manufacturing defects.

The magnitude of clad corrosion is determined mainly by the fuel duty and by reactor primary coolant chemistry, with fuel and cladding manufacturing parameters having only minor influence.

(ix) Clad Hydriding

The waterside oxidation of Zircaloy generates hydrogen, which may either escape into the primary coolant, or else be absorbed into the clad to form platelets of zirconium hydride. Such platelets, which may also be formed by uptake of hydrogen on the inner surface of the clad, lead to embrittlement of the material, making it more susceptible to failure. A limit is set for the hydrogen uptake. A substantial amount of testing has been carried out to demonstrate that cladding mechanical properties remain acceptable with considerably higher hydrogen levels, making the criterion somewhat conservative.

In assessing hydrogen uptake against the failure criterion, the major source comes from the oxidation of the clad by the primary coolant, which, as discussed above, is insensitive to fuel and clad manufacturing parameters. An additional source comes from any moisture present in the fuel pellets which could react with the cladding inner surface. This is controlled by limiting the moisture content of the fuel rod during manufacture. It should also be noted that hydriding is observed in many cases of fuel failure but that this is secondary hydriding resulting from primary failure (due to another cause) leading to water ingress and hydrogen generation from steam reactions. Primary hydriding failure is much less common.

(x) Clad Embrittlement

When the heat flux across the clad reaches a critically high value, a thin layer of steam will be produced over areas of the clad surface. This is known as Departure from Nucleate Boiling (DNB). The steam acts as an insulating layer and has the effect of raising the clad surface temperature. Above this critical heat flux, boiling is unstable and partial film boiling or transition boiling may result. Assessment of the DNB ratio depends strongly on reactor fuel duty and on the thermal hydraulic characteristics of the plant, but only weakly on fuel and clad manufacturing parameters.

(xi) Clad Melting

The potential exists for direct clad failure to occur due to excessive clad temperatures leading to clad melting. The melting point of Zircaloy is around 1850°C and therefore a temperature criterion to prevent melting would be set at a level comparable to this value. However, by meeting the embrittlement criterion (see above) clad surface temperatures will be maintained within a few degrees of the water saturation temperature (around 345^oC at primary circuit pressure). This criterion is therefore much more restrictive than a criterion based on clad melting considerations, and no additional evaluation is necessary.

(xii) Fuel Melting

Excessive fuel temperatures can lead to fuel melting at the pellet centre (always the hottest region) which could generate large fuel strains due to the significant volume increase associated with melting. Fuel melting itself can also lead directly to clad failure as a result of interaction between molten fuel and clad. Rod power and burnup are the most important parameters determining temperature, but sensitivity analyses against a number of manufacturing parameters are included in the methodology. These are: fuel density, clad inner diameter, pellet outer diameter, fill gas composition and pressure, fuel stoichiometry, fuel plutonium content and clad creep and plasticity. Together with code modelling uncertainties, these parameters are found to account for over 95% of the overall uncertainty.

(xiii) Rod Power

In addition to the direct limit on fuel temperature, a second limit is imposed, on rod power, to prevent the possibility of fuel melting. A limit is set, in terms of kW/m, for the power, local to any position on a rod. The power distribution in a reactor is a function of its operation, assembly loading pattern and thermal hydraulics. The only manufacturing parameter of influence is the fuel fissile content (uranium or plutonium enrichment).

(xiv) Rod Internal Pressure

A third criterion which is imposed to remove the possibility of fuel melting concerns the gas pressure inside the fuel rod. Fuel temperatures are dependent to a significant extent on the size of the fuel-clad gap, since an open gap often has a large temperature drop associated with it. After some months of operation the initial fuel-clad gap is removed due to a combination of pellet swelling and clad creepdown. Normally, the gap then remains closed throughout the remainder of the irradiation. If, however, the rod internal pressure is greater than the external coolant pressure, then the clad may creep outwards rather than inwards. This could cause the size of an open gap to increase, or a closed gap to re-open. Thermal feedback can then take place, as higher fuel temperatures lead to increased fission gas release which in turn causes the rod internal pressure to rise further. Such feedback is prevented by requiring the rod internal pressure to remain below the coolant pressure.

Many fuel and clad manufacturing parameters have an influence on the fuel-clad gap size and/or the rate of fission gas release, and must therefore be assessed in relation to this criterion. Analysis has shown that the following parameters contribute over 95% of the total uncertainty arising from manufacture: plenum length, clad inner diameter, pellet outer diameter, initial fill gas pressure, total gas content, fuel density, and fuel grain size. Other uncertainties, on reactor power distributions and on code modelling are also assessed.

(xv) Rapid Energy Deposition

As the fuel enthalpy rises, so temperatures increase and the fuel expands which may lead to clad failure due to pellet-clad interaction (PCI). This process is normally covered by the PCI criterion (see above). However, in transients which are short compared to the thermal time constant of the fuel (such as rapid reactivity insertion accidents), the PCI criterion cannot be applied, since this is based on experimental power ramp data with relatively slow power increases, and has not been proven to be applicable to very fast power rises. An alternative criterion is therefore required to cover PCI failure during transients of such short duration, and a direct criterion based on the fuel specific enthalpy is the most convenient way of achieving this. Failure is prevented by limiting the Radial Average Peak Fuel Enthalpy (RAPFE) at any position along the rod. This limit is based, conservatively, on results from rapid power tests conducted in a number of facilities in the US, France and Japan. Calculation of peak enthalpy values against the failure criterion are carried out conservatively using specialised code packages.

The results are relatively insensitive to uncertainties in fuel or clad manufacturing parameters. However, the only manufacturing parameter of influence is the fuel fissile content (uranium or plutonium enrichment).

Added to HSE website 18th February 2000