The Union of Concerned Scientists has identified a potential safety hazard at nuclear power plants that operate with small cracks and holes in the metal tubing, also called cladding, containing their fuel. The fuel cladding is a vital barrier between highly radioactive materials and the environment. From a review of available documentation, UCS concludes that federal regulations require this barrier to be intact during plant operation. There is a good reason for these regulations - the public cannot be harmed as long as the fuel cladding remains intact. If it is not intact, radioactivity will be released to the plant and the environment. Such a release could affect the health of plant workers and members of the public. In addition, fuel rods with degraded cladding may break apart during an accident and prevent safety equipment from functioning. Despite these potentially serious consequences, nuclear plants routinely operate with defective fuel cladding. In fact, many, if not all, nuclear plants have operated with damaged fuel cladding.

UCS recommends that the Nuclear Regulatory Commission (NRC) enforce federal regulations which prohibit nuclear plants from operating with defective fuel cladding. These regulations allow the NRC to permit nuclear plants to operate with defective fuel cladding, but only when their owners establish acceptable boundaries based on studies of both normal operating and accident conditions. Until these safety concerns are resolved, UCS considers nuclear plants operating with fuel cladding failures to be potentially unsafe and to be violating federal regulations.

Background
The following sections discuss: design and licensing bases requirements for nuclear plants; their specific application to nuclear fuel design; the use of multiple barriers in protecting the public; the role of the fuel cladding as a barrier; the experience with fuel cladding failures, and the potential safety hazards from fuel cladding failures.

Design and Licensing Bases Requirements
Design and licensing bases requirements establish safe operating boundaries which are supported by extensive safety analyses. Operating within the boundaries provides reasonable assurance that the public will be protected if there is an accident. The safety or danger of operating outside the boundaries has not been analyzed. As a result, safety margins may be compromised when boundaries are crossed, increasing the risk to the public. Therefore, federal regulations do not permit plants to operate in unanalyzed conditions.

Fuel Design
Nuclear plant are powered by fuel rods which contain uranium dioxide pellets roughly the size and shape of a large pencil eraser stacked within 12 to 14 feet long metal tubes sealed at each end with welded metal caps.¹  A simplified drawing of a fuel rod is shown in Figure 1. The fuel tubes are also called the fuel cladding. Fuel cladding is like the gas tank in a car - if the tank is breached, highly volatile gasoline can spill out to threaten the safety of its passengers and innocent bystanders, as well as degrading the environment. When fuel cladding is breached, highly radioactive material spills out to threaten the safety of plant workers and the public.

All operating US nuclear power plants use fuel assemblies containing square arrays of fuel rods. A typical fuel assembly is illustrated in Figure 2. As shown in this figure, the fuel rods must remain intact to provide the overall structural integrity of the fuel assemblies. The fuel design bases ensure that "the fuel is not damaged as a result of normal operation and anticipated operational occurrences."²   The phrase "not damaged," as used by both the NRC and nuclear plant owners, means that the fuel rods are not damaged to the point where they would fail.³  Thus, the fuel design bases includes the explicit requirement that fuel cladding remains intact during normal operation.

Defense-in-Depth Barriers
The splitting, or fissioning, of uranium atoms in the fuel rods releases energy that heats water - nuclear energy that powers the plant. Byproducts of the fission process include radioactive gases and solids. Plutonium is also produced by the nuclear reactions. These radioactive materials emit gamma rays along with alpha and beta particles which can cause damage to the human body. The fuel cladding keeps the radioactive materials contained. If the cladding is defective, radioactive materials will leak into the water which surrounds the cladding and keeps the fuel rods cooled. This water is contained within the reactor vessel and the piping connected to it, which form a second barrier to contain the radioactive materials. If the piping fails, contaminated water spills into the reactor containment building. The reactor vessel and its piping are located within a reactor containment building which forms a third barrier. Because the reactor containment building is not leak tight, it reduces, but does not eliminate, the possibility that radioactive material would escape. Figure 3 shows a simplified drawing of these three barriers.

Three barriers between the radioactive material and the environment imply that one barrier can be breached during plant operation leaving two intact barriers to protect the public. However, the safety analyses assume that all three barriers are intact prior to any accident. Let's assume the rupture of a pipe connected to the reactor vessel breaches one of the barriers. If the pipe rupture occurs when the fuel cladding is defective, then two of the barriers are breached. The remaining barrier, the reactor containment building, only reduces the amount of radioactive material released to the environment. Thus, all three barriers must be intact during plant operation for the public to be protected.

The fuel cladding is the most important of the three barriers. If the fuel cladding remains intact, the other two barriers can completely fail and the public will still be protected. The intact fuel cladding contains the radioactive gases and solids and prevents them from being released to the atmosphere. The public cannot be harmed from a nuclear plant accident in which the fuel cladding remains intact. But, as the next section indicates, nuclear plants routinely operate with this vital barrier seriously degraded.

Fuel Cladding Failure Experience
Numerous fuel cladding failures from various causes have been reported over the years. For example, the water flowing through the reactor core has caused fuel rods to sway back and forth. In this situation, the fuel rods vibrate against the grid (shown in Figure 2) and damage the cladding. At other plants, debris in the reactor water, such as metal flakes from rusted piping, has lodged against the grid. The friction from the vibration of this debris damaged the cladding. Another failure mode results when fuel pellets expand faster than the fuel rod cladding (see Figure 1) as their temperatures increase. The expanding pellets stretch the cladding, sometimes until it cracks or splits. Finally, the welds holding the upper and lower end plugs to the fuel rod cladding (see Figure 1) have sometimes been defective, causing pinhole leaks or even cracks to form. Other failure modes have been experienced too. Many, if not all, nuclear plants have experienced fuel cladding failures during their lifetimes. Few plants have shut down early to remove failed fuel rods.

Leaking fuel rods are detected by increased radioactivity levels in the reactor vessel's liquid and gaseous releases.⁴  Not surprisingly, the radioactivity levels rise significantly when fuel cladding fails. The causes of fuel cladding failures cannot be determined until the plant is shut down and the leaking fuel rods examined.

The following reports illustrate recent fuel cladding failure incidents and include some serious events.

The Vermont Yankee plant recently operated with at least one failed fuel rod for many months.⁵  Its owners elected to operate with the leaker(s) until the plant's next scheduled refueling outage in the spring of 1998 rather than incur the cost of an unscheduled shut down.⁶  The Brunswick Unit 1 plant in North Carolina operated during 1997 with fuel cladding failures that its owners tolerated.⁷  The Surry plant in Virginia also operated in 1997 with failed fuel cladding.⁸  These incidents demonstrate that nuclear plants continue to operate with fuel cladding failures.

A few years ago, the owner of the Point Beach Nuclear Plant in Wisconsin reported a significant event in which "The fuel cladding was failed to the extent that fuel pellets could be seen through the hole in the clad. However, no pellets escaped from the rod." The fuel rod failure was detected when the radioactivity levels of the reactor water rose to a level that was "10 percent of that allowed by [Point Beach Nuclear Plant's operating license]."⁹  In other words, the plant's operating license would have allowed it to remain running with up to nine other similarly failed fuel rods. This event suggests that the restrictions on reactor water radioactivity levels are too high to prevent operation with gaping holes in fuel rod cladding.

At the Palisades plant in Michigan, three portions of a broken fuel rod were discovered in different parts of the reactor. One segment, nearly 5½ feet long, was missing about one-third of its fuel pellets. A second segment, 4½ feet long, and a third segment, 1½ feet long, appeared to contain all their fuel pellets.¹⁰  This event is disturbing because it highlights how fragile the cladding can become during normal operation. At Palisades, this fuel rod literally fell apart as it was being removed from the reactor core and radioactive material was lost, including highly toxic plutonium.

Fuel Cladding Failure Consequences
What is the safety threat from a nuclear plant operating with fuel cladding failures? The fact that many plants have operated for many years with failed fuel cladding could be taken to imply an acceptable safety record. However, that is not the case. That fact demonstrates, at most, that the public is protected with fuel cladding failures during normal plant operation. It does not provide any reason to believe that the public will be protected in the event of an accident. It also does not provide any reason to believe that nuclear workers will be protected during normal plant operation with failed fuel cladding.

What might happen if a nuclear plant with failed fuel cladding had an accident? A common accident scenario involves breaking a large pipe connected to the reactor vessel. Water and steam rush out of the reactor vessel through the broken pipe. The water flow in the reactor core, instead of flowing from the bottoms of the fuel assemblies to their tops, may flow across the fuel assemblies. This cross-flow 'pushes' the fuel rods to the side rather than towards the top. Cladding that is weakened may fail under this side force. The plant's response to the pipe break is to shut down. Control rods are automatically inserted into the reactor core to stop the fissioning process. Fuel rods which fail and shift out of their vertical alignment may prevent the insertion of control rods. The safety analyses assume that the control rods can be inserted and shut down the reactor. Can fuel cladding failures cause such problems during this accident scenario? No one knows. Pre-existing fuel cladding failures have not been considered in the safety analyses for this accident or any other accident. Yet, nuclear plants routinely operate with such fuel cladding failures.

What happens if fuel cladding failures increase the severity of nuclear plant accidents? Since plant safety analyses assume that fuel cladding is undamaged when accidents occur, the failures may cause more radioactivity to be released to the environment than has been previously considered. After all, a key barrier confining this highly radioactive material is already breached when the accident begins. Under no circumstances will less radioactivity be released. Thus, it is imperative from a public health standpoint that nuclear plants do not operate with fuel cladding failures unless safety analyses are performed which demonstrate that the consequences from accidents under these conditions are acceptable.

Summary
The fuel cladding is the most important of the three barriers between highly radioactive material and the environment. As long as the fuel cladding remains intact, no nuclear plant accident can threaten public health and safety. Yet, nuclear plants routinely operate with damaged fuel cladding.

Safety analyses assume that the fuel cladding is intact when accident scenarios begin. Operation with pre-existing fuel cladding failures may mean that a nuclear accident will have more severe consequences than predicted by the invalidated safety analyses. Thus, UCS considers a nuclear plant operating with defective fuel cladding to represent an increased risk to the public.

The fuel design bases require the fuel cladding to remain intact during normal plant operation. Federal safety regulations require that plants operate within the boundaries established by their design bases. Therefore, UCS concludes that operating a nuclear plant with failed fuel cladding violates federal safety regulations.

See Attachment 1 for details of UCS's assessment of reactor operation with failed fuel cladding.

ALARA Issue
Nuclear plant owners are required by federal regulations to keep the release of radioactive materials "as low as reasonably achievable" (ALARA).¹¹  According to the NRC, "a plant operating with 0.125 percent pin-hole fuel cladding defects showed a general five-fold increase in whole-body radiation exposure rates in some areas of the plant when compared to a sister plant with high-integrity fuel (<0.01 percent leakers). Around certain plant systems the degraded fuel may elevate radiation exposure rates even more."¹²  The "sister plants" were virtually identical because they were built at the same time by the same owner on the same site. The significant variation in radiation exposure rates is not due to thicker concrete or other design differences - it is due to the failed fuel cladding. UCS is troubled by this NRC evidence because it shows a significantly increased risk to nuclear plant workers at a facility operating with just 0.125 percent fuel cladding failures. Many plants consider it permissible to operate with eight times as many fuel cladding failures (up to 1.0% failures).

Fuel cladding defects release radioactive materials into the reactor water. The water carries them to all parts of the plant, contaminating equipment throughout the facility. Workers conducting equipment inspections and maintenance receive higher radiation exposures. Indeed, some plant workers have received radiation doses far greater than allowed by federal regulations from highly radioactive material released through fuel cladding defects.¹³

It is a well-documented fact that plant operation with defective fuel cladding significantly increases personnel exposures. Federal regulations requires nuclear plant owners to keep the release of radioactive materials as low as reasonably achievable. Therefore, it is both an illegal activity and a serious health hazard for nuclear plants to continue operating with fuel cladding damage.

Conclusions And Recommendations

Conclusions
It is UCS's considered opinion that existing design and licensing requirements do not allow plants to operate with known fuel cladding failures. In addition, federal regulations require formal NRC approval prior to any nuclear plant operating with fuel cladding failures. Such approval has neither been sought nor granted.

UCS's evaluation (see attachment 1) suggests that both the probability and consequences of postulated accidents may be increased when nuclear plants operate with pre-existing fuel cladding failures. Thus, operation with fuel cladding failures is a violation of federal regulations which represents a potential threat to public health and safety.

UCS's assessment was generic. Consequently, this conclusion does not explicitly apply to any operating plant. However, UCS's assessment identified the strong potential for operation with fuel cladding failures to be an illegal activity unless the plant's owners performed a plant-specific safety evaluation which established such operation as acceptable and the NRC has formally reviewed and approved this safety evaluation. Absent both of these conditions, it seems highly probable that any plant operating with fuel cladding failures is violating its design and licensing bases requirements, a condition not allowed by federal safety regulations. It further appears that such illegal operation may have serious safety implications. Finally, operation with fuel cladding damage also seems to violate the ALARA concept mandated by federal regulations, thus exposing plant workers to undue risk.

UCS's research for this assessment did not locate any information which suggests that operation with failed fuel cladding has been previously evaluated pursuant to federal regulations. There is considerable documentation on fuel cladding failure events, on inspections of failed fuel rods, and on various fuel damage mechanisms. Despite extensive, focused efforts, UCS was unable to find any indication that the safety implications of plant operation with failed fuel cladding have been considered by the fuel vendors, the NRC, or nuclear plant owners. This non-existent data further reinforces UCS's conclusions that operation with failed fuel cladding has not been properly analyzed by the industry, has not been approved by the NRC, and is both potentially unsafe and illegal.

Recommendations
UCS recommends that the Nuclear Regulatory Commission take appropriate steps to prohibit nuclear power plants from operating with fuel cladding damage until the safety concerns raised in this report are resolved. These appropriate steps include, but are not limited to, the following:

• Plant owners should be required to shut down their facilities upon detection of a fuel cladding failure. The plants must not restart until the failed fuel rods are removed.
• Plant owners should be required to evaluate the safety implications of operating with failed fuel cladding in accordance with federal regulations. If these safety evaluations are unable to justify continued operation, the plants should be shut down.

Unreviewed Safety Question Assessment
This attachment contains UCS's evaluation for reactor operation with failed fuel cladding. Our evaluation applied federal regulations for determining when a proposed mode of operation crosses the plant's authorized boundaries and thus requires prior NRC approval. As the results clearly indicate, reactor operation with failed fuel cladding requires NRC approval. Yet, such approval has neither been sought nor granted.

The NRC issues an operating license for a nuclear power plant after reviewing its design and procedures. The plant's owners may modify the facility and revise its procedures as long as the changes do not alter the bases for the NRC's approval of the operating license. A change which alters the operating license bases is called an unreviewed safety question (USQ). For example, a proposed change that reduces the plant's safety margin is an unreviewed safety question because the NRC may have relied on the greater margin in granting the plant's operating license. Likewise, a proposed change that maintains the existing safety margin but does so by operator actions instead of automatic equipment operation is also an USQ because the NRC's approval may have relied on the automatic protective features. When a proposed change involves an USQ, NRC approval must be obtained in advance. Federal regulations specify that a proposed change involves an USQ if:

(1)   the probability of occurrence or the consequences of an accident or malfunction of equipment important to safety previously evaluated in the safety analysis report may be increased; or
(2)   a possibility for an accident or malfunction of a different type than any evaluated previously in the safety analysis report may be created; or
(3)   the margin of safety as defined in the basis for any technical specification is reduced.¹⁴

I divided the first criterion above into the "probability" and "consequences" elements for clarity. The scope of this evaluation was limited to four types of documentation: 1) the Updated Final Safety Analysis Reports (UFSARs) for four of UCS's focus plants (the Calvert Cliffs plant in Maryland, the Oyster Creek plant in New Jersey, the River Bend plant in Louisiana, and the Millstone Unit 3 plant in Connecticut); 2) the non-proprietary version of the fuel design topical report submitted by a vendor (General Electric); 3) the standard technical specifications prepared by all four reactor manufacturers (Westinghouse, General Electric, Babcock & Wilcox, and Combustion Engineering);  and 4) NRC correspondence on fuel cladding failure events. The results from this evaluation follow.

• Criterion 1a: May the probability of occurrence of an accident or malfunction of equipment important to safety previously evaluated in the safety analysis report be increased by operation with failed fuel cladding?

The standard technical specifications are the templates from which individual plant operating licenses were derived. Since these specifications establish zero defects as the minimally acceptable standard, operation with fuel cladding failures increases the probability of "malfunction of equipment important to safety," namely the fuel itself, to 100%. For this reason alone, the answer to this question is YES.

To apply the above generic assessment to a specific plant, UCS looked at available documentation for the Oyster Creek Nuclear Generating Station in New Jersey. A design basis for Oyster Creek is "to ensure that no fuel damage will occur in normal operation or operational transients caused by reasonable expected single operator error or equipment malfunction."¹⁷  Fuel rod damage "is defined as a perforation of the cladding which would permit the release of fission product to the reactor coolant."¹⁸  Thus, the detection of failed fuel rod(s) at Oyster Creek would be an equipment malfunction placing the plant outside its design basis. Again, the answer to this question is YES.

A fuel cladding defect may allow gases within a fuel rod to leak out. A defect may also allow water to leak in. It appears that leakage in either direction may also increase the probability that the fuel cladding will not perform its necessary safety function.

A fuel cladding defect which allows gases to leak out of a fuel rod has at least two potentially adverse consequences. The fuel rods are pressurized with helium during their fabrication to minimize a problem called cladding creep-collapse. The pressure inside a nuclear plant ranges from 960 to 2,100 pounds per square inch at full power. The difference between a fuel rod's external pressure and internal pressure can exert sufficient inward force to cause the cladding to fill the gaps between fuel pellets.¹⁹  The stress on the cladding can cause it to break. The leakage of helium from a fuel rod reduces its internal pressure, thus potentially increasing the probability of fuel rod damage from cladding creep-collapse.

Inadequate cooling of the fuel is another potential consequence from gases leaking out of a fuel rod. Helium is used to pressurize fuel rods because of its high thermal conductivity.²⁰  The leakage of helium through a fuel cladding defect may slow down the transfer of heat from the fuel to the water. When heat cannot be dissipated from the fuel as quickly as assumed, the fuel temperature will increase and may reach the point at which it begins to melt. The leakage of helium from a fuel rod may reduce heat transfer rates, thus potentially increasing the probability that the fuel is seriously damaged during a loss-of-coolant accident.

A fuel cladding defect which allows water to leak into a fuel rod also has at least two potentially adverse consequences. During plant operation, high fuel temperatures prevent water from leaking in through a cladding defect. However, water can enter defects when the plant is shut down and cause fuel rods to become waterlogged. If the plant increases power quickly, the rising fuel temperature may cause the water inside the fuel rods to evaporate and perhaps even boil. The water vapor and steam produced inside the fuel rods, unless it is able to leak out through the defects, increase their pressure. This pressure buildup is suspected to have caused the "bursting" of fuel rods at the Point Beach plant in Wisconsin. Sections of the cladding and several fuel pellets could not be located when the damaged assemblies were later inspected.²¹

There is another potential adverse consequence from water leaking into fuel rods. The high operating temperature dissociates the water into hydrogen and oxygen gases. The hydrogen gas interacts with the cladding to form blisters. The blisters embrittle the cladding, leading to perforations.²²  To minimize the moisture content, the fuel pellets are dried prior to being loaded into the fuel rods.²³  Thus, water leaking into a fuel rod may increase the probability that fuel cladding suffers this type of damage, which is called hydriding.

In fact, failure propagation due to hydriding has already been identified. Recent inspections of failed fuel rods at the Salem plant in New Jersey, the Beaver Valley plant in Pennsylvania, and the Wolf Creek plant in Kansas revealed that, "In some of the affected assemblies, secondary hydriding also was evident."²⁴  A fuel rod at the Perry Nuclear plant in Ohio experienced a cladding crack measuring 20 inches long, or nearly 13% of the fuel rod's length, caused by secondary hydriding.²⁵  In these events, the initial fuel cladding failures were caused by other mechanisms. These failures later propagated due to hydriding.

Thus, operation with fuel cladding failures has the potential for increasing the probability that an important barrier protecting the public, namely the fuel cladding itself, fails to adequately confine radioactive materials during a postulated accident. The fuel cladding is considered "equipment important to safety." A fuel cladding failure is therefore a malfunction of equipment important to safety. For this reason, too, the answer to this criterion is YES.

Finally, the NRC's Standard Review Plan states that the fuel design bases ensure that "fuel damage is never so severe as to prevent control rod insertion when it is required."²⁶   Nuclear plant operation with failed fuel cladding has caused individual fuel rods to break into segments during fuel handling evolutions. If degraded fuel cladding were to similarly break during an accident, the fuel rod segments might interfere with control rod insertion. Thus, for this additional reason, the answer to this criterion is YES.

• Criterion 1b: May the consequences of an accident or malfunction of equipment important to safety previously evaluated in the safety analysis report be increased by operation with failed fuel cladding?

The safety analysis for the recirculation flow control failure with increasing flow event²⁸  at the River Bend Station in Louisiana concluded that "An evaluation of the radiological consequences is not required for this event since no radioactive material is released from the fuel."²⁹  If this event were to occur with pre-existing fuel cladding failures, this analysis would be rendered invalid. Since this analysis assumes that the fuel cladding remains intact, its conclusions are invalidated when there are fuel cladding failures.

The safety analysis for the feedwater controller failure maximum demand event³⁰ at River Bend concludes that fuel and pressure vessel "barriers maintain their integrity and function as designed."³¹  Obviously, this analysis's conclusion is invalidated when the plant operates with pre-existing fuel cladding failures.

The safety analysis for the rod withdrawal error event³² at River Bend specifies that "An evaluation of the barrier performance was not made for this event since this is a localized event with very little change in the gross core characteristics."³³  Fuel cladding damage is a localized event. The failed fuel rod has a pinhole leak or a hairline split in its cladding or a cracked weld at its end cap. If the rod withdrawal error occurs in the vicinity of the fuel cladding defect, the big change in local characteristics could propagate that defect. Thus, this analysis's conclusion is invalidated when the plant operates with a fuel rod defect.

The safety analysis for a control element assembly ejection event³⁴ at the Calvert Cliffs Nuclear Plant concluded that "the site boundary [radiological] dose guidelines will be approached."³⁵   The analysis found the postulated event acceptable because the plant's design features "will prevent fuel clad failure, will prevent exceeding the [reactor coolant system] Pressure Upset Limit, and will therefore limit the radiological site boundary dose [i.e., the radiation levels experienced by a member of the public at the plant's fence] to below the criteria in 10 CFR 100 guidelines."³⁶  Since this analysis assumes that fuel cladding failures are prevented, its conclusions are invalidated when there are pre-existing fuel cladding failures.

The NRC's Standard Review Plan states that the fuel design bases ensure that "the number of fuel rod failures is not underestimated for postulated accidents."³⁷   Yet, the previous accident analyses underestimated the number of fuel rod failures if those plants operated with fuel cladding failures. Thus, the answer to this criterion is YES.

The Wolf Creek plant recently experienced fuel cladding failures affecting 44 fuel rods in three fuel assemblies. According to an NRC report on the problem, "The most severely degraded fuel rod fragmented into three segments during fuel handling operations while offloading the core."³⁸  Fuel handling operations include removing a fuel assembly from the reactor core, placing it in a device called an upender, lowering the assembly to a horizontal position, transferring it through the reactor containment wall into the fuel handling building, raising the assembly to a vertical position, and moving it to a storage location in the spent fuel pool. These manipulations put dead load force (i.e., gravity) on the fuel assembly and its fuel rods. Fuel assemblies are designed to withstand the force associated with these handling evolutions, at least when their fuel cladding is undamaged. Apparently at Wolf Creek, the force of gravity was sufficient to cause the structural failure of a fuel rod with previously damaged cladding.

What if an accident occurred when the fuel assemblies with the damaged cladding still resided in the reactor core? For example, consider the hydrodynamic forces inside the reactor vessel following a break of a large pipe connected to it. The high energy water escaping through the break exerts considerable force. The side force on the fuel rods may approach, or even exceed, the dead load force during fuel handling. The weakened fuel cladding may experience structural failure as was encountered during fuel handling. Fuel rod structural failure could have very serious consequences during an accident. The dislodged fuel rod segments could interfere with the insertion of control elements attempting to shut down the reactor. Fuel assemblies are tightly packed into the reactor vessel. The clearance between fuel assemblies and control elements is fractions of an inch at most. Fuel rod segments would not have to move much in order to interfere with control elements. Thus, the consequences of previously analyzed accidents could be increased by operation with fuel cladding failures. The answer to this criterion is YES.

• Criterion 2: May the possibility for an accident or malfunction of a different type than any evaluated previously in the safety analysis report be created by operation with failed fuel cladding?

Some spent fuel pool accident analyses take credit for operation of the spent fuel building's ventilation system. This system routes the building's exhaust air through filters, thus lowering the radiological dose to the public. At many plants, the ventilation system only performs this safety function when fuel handling operations are underway.

Spent fuel assemblies with cladding failures may have those failures propagate when subjected to earthquake forces. Radioactive gases released from spent fuel assemblies following an earthquake may cause radiological consequences which exceed those for the fuel handing event if (a) the inventory from more than the fuel rods in two assemblies is released, or (b) credit is taken in the fuel handling event analysis for operation of the spent fuel building's ventilation system but the system is unavailable. Consequently, the answer to this criterion is MAYBE.

• Criterion 3: May the margin of safety as defined in the basis for any technical specification be reduced by operation with failed fuel cladding?

The standard technical specifications are the templates from which individual plant operating licenses are derived. Since these specifications establish zero defects as the minimally acceptable standard, operation with fuel cladding failures clearly represents a safety margin reduction. Consequently, the answer to this question appears is YES.

Conclusion
Federal regulations specify that an unreviewed safety question is indicated when the answer to any one of the criteria is non-negative. UCS's assessment determined that none of the answers is negative. Three of the answers are unequivocally YES and a fourth is MAYBE. Thus, nuclear power plant operation with failed fuel cladding is clearly an unreviewed safety question. NRC approval is required for a plant to continue operating with fuel cladding failures.

Performed by: _____________________________
    David A. Lochbaum
   Nuclear Safety Engineer

(We will post the following figures as soon as we obtain copies of them.)
Figure 1
Fuel Rod Schematic
Figure 2
Fuel Assembly Schematic
Figure 3
Defense-in-Depth Barriers

¹ Baltimore Gas & Electric Company, Calvert Cliffs Nuclear Plant Updated Final Safety Analysis Report, Section 3.3.2.1, "Fuel Rod Mechanical Design," and General Electric Company, "Licensing Topical Report / General Electric Standard Application for Reactor Fuel," NEDO-24011-A-4, January 1982.
² Nuclear Regulatory Commission, NUREG-0800, Standard Review Plan, Section 4.2, Fuel System Design.
³ Nuclear Regulatory Commission, NUREG-0800, Standard Review Plan, Section 4.2, Fuel System Design, and GPU Nuclear Corporation, Oyster Creek Nuclear Generating Station Updated Final Safety Analysis Report, Section 4.4.2, "Description of Thermal and Hydraulic Design of the Reactor Core."
⁴ Entergy Operations, River Bend Station Updated Final Safety Analysis Report, Section 4.2.4.2, "Online Fuel System Monitoring," and Section 11.5.2.2.1, "Main Steam Line Radiation Monitoring System."
⁵ Nuclear Regulatory Commission, Daily Event Report, DER No. 33152, October 28, 1997.
⁶ Vermont Yankee Nuclear Power Corporation, Presentation to Vermont State Nuclear Advisory Panel, December 3, 1997.
⁷ Johan Blok and Roger Asay, Centec XXI, "Pinpoint fuel leaks to improve nuclear economics," Power, January/February 1998.
⁸ Nuclear Regulatory Commission, Inspection Report 50-280/97-10, December 15, 1997.
⁹ Wisconsin Electric Power Company, Licensee Event Report No. 85-002-01, "Failed Fuel Rod in Assembly H14, Point Beach Nuclear Plant Unit 1," May 19, 1986.
¹⁰ United States Nuclear Regulatory Commission, Information Notice 93-82, "Recent Fuel And Core Performance Problems In Operating Reactors," October 12, 1993.
¹¹ Title 10 of the Code of Federal Regulations, Sections 50.34a, "Design objectives for equipment to control releases of radioactive material in effluents - nuclear power reactors," and 50.36, "Technical specifications," and Title 10 of the Code of Federal Regulations, Part 50, Appendix I, "Numerical Guides for Design Objectives and Limiting Conditions for Operation to Meet the Criterion "As Low As Reasonably Achievable" for Radioactive Material in Light-Water-Cooled Nuclear Power Reactor Effluents."
¹² United States Nuclear Regulatory Commission, Information Notice No. 87-39, "Control Of Hot Particle Contamination At Nuclear plants," August 21, 1987.
¹³ United States Nuclear Regulatory Commission, Information Notice No. 87-39, "Control Of Hot Particle Contamination At Nuclear plants," August 21, 1987.
¹⁴ Title 10, "Energy," of the Code of Federal Regulations, Section 50.59, "Changes, tests and experiments,"
¹⁵ Babcock & Wilcox Company, Standard Technical Specifications, Section B 2.1.1., "Reactor Core SLs," Combustion Engineering, Standard Technical Specifications, Section B 2.1.1, "Reactor Core SLs," General Electric Company, BWR/4 Standard Technical Specifications, Section B 2.1.1, "Reactor Core SLs," and Westinghouse Electric Corporation, Standard Technical Specifications, Section B 2.1.1, "Reactor Core SLs."
¹⁶ Nuclear Regulatory Commission, NUREG-0800, Standard Review Plan, Section 4.2, "Fuel System Design."
¹⁷ GPU Nuclear Corporation, Oyster Creek Nuclear Generating Station Updated Final Safety Analysis Report, Section 4.4.1, "[Thermal and Hydraulic Design] Design Basis."
¹⁸ GPU Nuclear Corporation, Oyster Creek Nuclear Generating Station Updated Final Safety Analysis Report, Section 4.4.2, "Description of Thermal and Hydraulic Design of the Reactor Core."
¹⁹ Baltimore Gas & Electric Company, Calvert Cliffs Nuclear Plant Updated Final Safety Analysis Report, Section 3.7.1.1.a, "Clad Creepdown/Creep-Collapse."
²⁰ Baltimore Gas & Electric Company, Calvert Cliffs Nuclear Plant Updated Final Safety Analysis Report, Section 3.3.2.1, "Fuel Rod Mechanical Design."
²¹ B. Siegel, Nuclear Regulatory Commission, "Evaluation of the Behavior of Waterlogged Fuel Rod Failures in LWRs," NUREG-0303, March 1978.
²² Baltimore Gas & Electric Company, Calvert Cliffs Nuclear Plant Updated Final Safety Analysis Report, Section 3.7.2.1, "Burnable Poison Rod Design Evaluation."
²³ Baltimore Gas & Electric Company, Calvert Cliffs Nuclear Plant Updated Final Safety Analysis Report, Section 3.3.2.1, "Fuel Rod Mechanical Design, and Nuclear Regulatory Commission, NUREG-0800, Standard Review Plan, Section 4.2, "Fuel System Design."
²⁴ United States Nuclear Regulatory Commission, Information Notice 93-82, "Recent Fuel And Core Performance Problems In Operating Reactors," October 12, 1993.
²⁵ United States Nuclear Regulatory Commission, Information Notice 93-82, "Recent Fuel And Core Performance Problems In Operating Reactors," October 12, 1993.
²⁶ Nuclear Regulatory Commission, NUREG-0800, Standard Review Plan, Section 4.2, Fuel System Design.
²⁷ Nuclear Regulatory Commission, NUREG-0800, Standard Review Plan, Section 4.2, "Fuel System Design."
²⁸ This potential accident is comparable to a mistake using a bellows to flame a wood fire. If too much air is supplied, the fire may blaze up out of control. Likewise, putting too much water through the River Bend reactor core can cause it to run out of control.
²⁹ Entergy Operations, River Bend Station Updated Final Safety Analysis Report, Section 15.4.5.5, "[Recirculation Flow Control Failure with Increasing Flow] Radiological Consequences."
³⁰ This potential accident is similar to the recirculation flow control failure with increasing flow event in that too much water to the reactor core results in an uncontrolled power increase.
³¹ Entergy Operations, River Bend Station Updated Final Safety Analysis Report, Section 15.1.2.4, "[Feedwater Controller Failure Maximum Demand] Barrier Performance."
³² This potential accident involves the inadvertent withdrawal of a control rod causing the power produced by the adjacent fuel assemblies to increase significantly.
³³ Entergy Operations, River Bend Station Updated Final Safety Analysis Report, Section 15.4.2.4, "[Rod Withdrawal Error] Barrier Performance."
³⁴ This potential accident is comparable to car engine throwing one of its pistons. The piston may break the engine casing. Likewise, the ejected control element assembly may break the reactor coolant pressure boundary and allow reactor water to leak out.
³⁵ Baltimore Gas & Electric Company, Calvert Cliffs Nuclear Plant Updated Final Safety Analysis Report, Section 14.13.2, "Sequence of Events [Control Element Assembly Ejection]."
³⁶ Baltimore Gas & Electric Company, Calvert Cliffs Nuclear Plant Updated Final Safety Analysis Report, Section 14.13.4, "Conclusion [Control Element Assembly Ejection]."
³⁷ Nuclear Regulatory Commission, NUREG-0800, Standard Review Plan, Section 4.2, Fuel System Design.
³⁸ United States Nuclear Regulatory Commission, Information Notice 93-82, "Recent Fuel And Core Performance Problems In Operating Reactors," October 12, 1993.
³⁹ Baltimore Gas & Electric Company, Calvert Cliffs Nuclear Plant Updated Final Safety Analysis Report, Section 14.18.2, "Method of Analysis [Fuel Handling Accident]."
⁴⁰ Babcock & Wilcox Company, Standard Technical Specifications, Section B 2.1.1., "Reactor Core SLs," Combustion Engineering, Standard Technical Specifications, Section B 2.1.1, "Reactor Core SLs," General Electric Company, BWR/4 Standard Technical Specifications, Section B 2.1.1, "Reactor Core SLs," and Westinghouse Electric Corporation, Standard Technical Specifications, Section B 2.1.1, "Reactor Core SLs."
⁴¹ Nuclear Regulatory Commission, NUREG-0800, Standard Review Plan, Section 4.2, "Fuel System Design."