12.74. The sudden ejection of a control element (or control-rod cluster), as a result of a mechanical failure, is a conceivable but improbable accident. In most situations, the increase in reactivity (and thermal power) would be small and could be handled by the reactor protection system. For ex­ample, when a reactor is operating at full power, the control elements are all partly to fully withdrawn. Sudden withdrawal of one element would therefore result in only a minor reactivity excursion, at worst. At the other extreme, when a reactor is in a shutdown state, the reactivity is sufficiently negative to compensate for the ejection of a control element.

12.75. One design basis accident is the ejection of a control element from an operating reactor leading to a power excursion of sufficient mag­nitude to cause some damage to the fuel cladding. Observations made with test reactors have shown that the amount of damage resulting from the ejection of a control element would be governed mainly by the energy generated as a result of the excursion. This in turn depends on the reactivity worth of the ejected element and the power distribution attained by the remaining control-element pattern. The test data are used in assessing the consequences of control-element ejection accidents. Because of the very low probability of an ejection accident, limited fuel cladding damage is considered an acceptable consequence. For a plant design to be approved, analysis must show that several criteria are met which are intended to ensure that there is little possibility of fuel dispersal in the coolant, gross core lattice distortion, or severe shock waves.