1 Introduction
There is limited knowledge about some severe accident phenomena because of limitations in experimental data from both economic and technical points of view [1]. Therefore, the mathematical models, with different level of accuracy and credibility, are inevitably uncertain in predicting thermo-hydraulics and severe accident phenomena [2]. The uncertainty sources propagate through the deterministic code structure into the output results of computational codes. To account for the uncertainties in the result of deterministic codes, probabilistic safety/risk assessment (PSA/PRA) methodology quantifies the uncertainty in modeling the severe accident phenomena.
The sources of uncertainty in Level-2 PSA include: 1)uncertainties from Level 1 PSA (being accumulated to Level-2; 2)uncertainties in the model of containment event tree; 3) phenomenological uncertainties on occurrence of physical phenomena and their associated consequences; 4) partial neglecting of plant damage states (PDS) because of setting cut-off values; and 3) grouping of Level 2 sequences into so called release categories for which some details might be missed.
The present paper covers phenomenological uncertainties of Level-2 PSA which is related to MELCOR code calculations in accident progression analysis. The main objective for accident progression analysis in support of Level-2 PSA is to understand the plant response to severe accident. Concretely, the goal of such analysis is two-fold for each severe accident sequence: whether temperature induced creep rupture is possible for major RCS (Reactor Coolant System) components, and whether core damage could be arrested without vessel breach.
Uncertainties of the second task are captured through the probabilistic modeling of the severe accident management strategies in PSA model. In fact this is a PSA-related task rather than a deterministic issue. The severe accident phenomena of interest are primarily those having the potential of early large release of radioactive materials to the environment through early containment failure or bypass. Therefore, one of the critical severe accident phenomena is creep rupture as it may affect the relative timing of major RCS component failures such as surge line, hot leg, and steam generator (SG) tubes. If the SG tubes fail first, bypass of the containment will happen; if the surge line or hot leg fail first, it will cause rapid depressurization of the primary system and preclude SG tube rupture.
The other top events in the structure of accident progression event trees are associated with system performance and/or human action which areconsidered through employment of fault tree approach. Here wemainly focus on the quantification of uncertainties related to creep rupture of major RCS components in harsh severe accident environment. Once this phenomenon occurs, it opens a direct path for the radionuclides to release into the environment. This is called containment bypass and is one of the main concerns regarding the safety of PWRs (Pressurized Water Reactor).
The paper organization is as follows. First a discussion is provided in Section 2 on the creep rupture challenges for RCS components in severe accident. Section 3 explains the IDPSA (Integrated Deterministic and Probabilistic Safety Assessment) methodology for treatment of phenomenological uncertainties in Level-2 PSA. Section 4 givesdetails of the implementation of this methodology on a real case PWR. The results are given in Section 5 and finally Section 6 concludes the article.
2 Creep rupture challenges for RCS components in severe accidents
During the hypothesized station blackout in a PWR, hot steam and radioactive gases released travel through the majorRCSpiping (hot leg, surge line, and SG tubes) creating harsh thermodynamic conditions in terms of both high pressure and temperature after the reactor core uncovers and starts melting.
These conditions impose significant mechanical stress on the structural materials of the hot leg, surge line, and SG tubes, and may eventually end up with a creep rupture of a component. The significance of this scenario is that a SG tube creep rupture would cause radioactive release from the primary to the secondary system and eventually to the environment through the secondary side safety valve. The consequences are very sensitive to whether steam generator tubes fail (failure mode 1) prior to the failure of the hot leg (failure mode 2) or surge line (failure mode 3). Mode 2 and 3 failures would result in depressurization of the RCS and preclude the potential large early release of radionuclides to the environment associated with steam generator tube failure [3].
Because of its severe consequence, prediction of SG tube rupture has been an issue of great interest in the nuclear research community. The U. S. Nuclear Regulatory Commission SGTR Severe Accident Working Group addressed this issue of predicting severe accident induced SG tube ruptures in NUREG-1570[4], investigating the probability of SGTR with a risk-informed approach, and taking into account uncertainties in creep rupture models, SG tube geometry, and crack size distribution. Other sources of uncertainty arise from the use of one-dimensional computer codes to simulate multidimensional flow dynamics.
Severe accident codes have been coupled with creep rupture models (the so called Larson-Miller model) to predict failure times. Section 2.1 provides an explanation for the MELCOR model in the code structure.
2.1 Larson-Millermodel for creep rupture in MELCOR
In this model, the time to rupture (tR)of the RCS components (hot leg pipe, surge line and SG tube) are determined by:
1. The temperature that the RCS pipe is exposed to as a function of time t;
2. The difference between the pressure inside and outside the RCS pipe as a function of time t;
3. The wall thickness z and the radius r of the RCS pipe; and
4. The material characteristics of the pipe, defining its resistance with respect to pressure and temperature loads.
For tR evaluation, a function to relate tR with the above parameters is required. In deterministic modeling of creep rupture events for severe accident analysis with MELCOR, the criterion for rate-dependent creep rupture (both pressure and temperature are time-dependent) is based on the so called damage function (R) which is the time-fraction damage integral [5]. The criterion for the creep rupture is achieved when the damage function equals unity,
where, tf is the creep rupture failure time (s); tR is the time (s) to rupture;T is the temperature (K);σ is the stress; and mp stands for intensity factor (unitless, usually assumed to be a unity). The denominator tR is given by the Larsen-Miller correlation and is calculated by:
here PLM is the Larson-Miller parameter; C identifies the property of structural material; and PLM has dimensions of temperature and is fit as a function of the effective stress, σe,[5]:
where, σe=ρΔP/z with ρ and z being the pipe radius and wall thickness, respectively, and ΔP being the difference between the inside and outside pressure.
3 Methodology for integrated deterministic and probabilistic safety assessment
The simplest approach to quantify creep rupture probability distribution is to develop the fragility curves [6] by resorting to available experimental data [7].This quantifies the uncertainty by assuming a lognormal distribution with mean value and standard deviation derived from experiment. However, to be accurate enough for the development of PSA model, a plant specific analysis should be performed using integrated deterministic and probabilistic safety assessment. This approach is certainly more sophisticated than the fragility curve approach since it utilizes the plant specific data and performs required deterministic calculations.The plant specific methodology of the current work comprises three main steps as follows:
1) Severe accident analysis
2) Quantification of uncertainty in severe accident modelling
3) Monte Carlo simulation for separation of aleatory and epistemic uncertainty.
In the sequel, details of each step of the methodology will be elaborated.
3.1 Severe Accident Modeling
Since deterministic safety analysis (DSA) is not reliable without validation of the results, it is necessary to analyze the quality of the developed model. The modeling error is a proper measure for the qualification process. A model is considered qualified whenever its error is below the acceptable error suggested by the standards like IAEA SRS-23 [8].
This process is performed using power plant design data in the plant normal steady state condition. The results obtained from running the model areanalyzed in MELCOR code. By comparing the results of thermo-hydraulic parameters obtained from model with design values, the error originated from modeling is quantified.
In Section 4.1, we will elaborate the qualification process in the proposed methodology, which is also described indetail in a previous contribution of the authors [9].
Once the qualified model is developed, the next step would be accident analysis by considering best estimate assumptions. A base case scenario is selected first by considering the plant safety systems, signals and trips, and detailed definition of the accident under study. Whenever Level-1 and Level-2 PSA analyses areavailable, the process of PSA supportive accident analysis is to resort to the definition of the sequence by following the logic of the developed event trees.
3.2 Quantification of Uncertainty in Severe Accident Modelling
The next step of the methodology consists of formal uncertainty analysis for the base case scenario and its variant scenarios. For the assessment of creep rupture, this step is crucial since it provides the range of variation of the parameters of interest for performing Monte Carlo calculations of the Larson-Miller model (the next step of the methodology) to achieve at the probability of rupture in major RCS components. An uncertainty analysis considering random input variables in the code model is usually performed by using available approaches including CSAU, GRS, ITHUMA, etc. Sampling-based method for uncertainty analysis in this paper comprises the following main steps:
i) Identification of important parameters of model;
ii) Sampling from the probability distribution of the identified input variables; and
iii) Uncertainty propagation through the code structure.
Details of each step are elaborated in previous articles of the authors[1,2,6]. Interested readers may refer to themfor more explanations of each step and their development.
3.3 Monte Carlo simulation for separation of aleatory and epistemic uncertainty
Uncertainties are sometimes classified as aleatory and epistemic uncertainties. The former isassociated with random or stochastic phenomena; while the latter are related to, or involving, knowledge, also called "state-of-knowledge uncertainty", and includes parameter uncertainty, model uncertainty and completeness uncertainty[10].
Issue of mixing aleatory and epistemic uncertainties has been posed in several technical meeting in problems where both kinds of uncertainties contribute to the total uncertainty of code calculation [11]. Through distinction, oneknows which part of uncertainty is removable or at least reducible and which part due to aleatory is irreducible. Ref.[12] indicates that it is important to distinguish the two types of uncertainty, not only because it can impact the answer being given to a decision maker, and hence have an impact on the decision outcomes, but also because it is essential to truly understand the nature of the model of the world that is being incorporated in the PRA.
In this step of the methodology, a MATLAB code is developed for uncertainty evaluation accounting for both aleatory and epistemic uncertainties by using two nested Monte-Carlo loops.The MATLAB code uses results of the formal uncertainty analysis for severe accident modeling obtained by the previous step of the methodology. For modeling of the creep rupture in major RCS components, uncertainties of physical parameters are represented by epistemic uncertainty (e.g. the Larson-Miller Parameters); however, uncertainties in accident progression parameters fall into the category of “aleatory uncertainty”. These parameters are obtained through deterministic analysis of the plant response in the course of accident (by e.g. MELCOR code) which is affected by 1) temperature profile of the pipe, 2) mechanical stress on the pipe wall due to pressure difference, and 3) time when risk of partial failure ends, e.g. RPV failure[13], as discussed in Section 2.1.
Figure 1 shows the flowchart (introduced by A. Hoefer[12] for treatment of Level-2 PSA uncertainties) for developing the programming algorithm. In the outer loop (symbolized by dashed arrows representing epistemic loop), random draws of the model parametersΘare performed. In the inner loop (aleatory loop), characteristic parameters Xare randomly sampled from their joint probability distribution functionP(X,Θ), which is defined by theΘvalues drawn in the outer loop. The outer loop is passed through nout times, and each cycle of the outer loop is followed by nin cycles of the inner loop.
Steps 1 –7 are described as follows:
1. Initialization:
•Selection of distributions for the epistemic parameters.
•Drawing a set of parameters according to the epistemic distributions.
2. Aleatory loop:
•Selection of distributions for the aleatory parameters.
•Draw a set of parameters according to the aleatory distributions.
•Calculate a single value of the creep rupture time with the drawn epistemic and aleatory parameters.
•Draw a new set of aleatory parameters to finally end up with a distribution of the rupture time.
•By comparing this distribution with the time, when risk of passive rupture ends (e.g. RPV-failure) a single value for the branch probability is gained.
3. Epistemic loop:
•Select another set of epistemic parameters. Within the (repeated) aleatory loop a new branch probability is calculated, as described in Steps 3–7. Repeating the two loops several times one finally ends-up with a distribution of the branch probability that can be used for error propagation in the APET.
For implementing the Monte-Carlo algorithm, the distribution of aleatory parameters isobtained through the thermo-hydraulics analysis by MELCOR code, as described in details in Section 4.
4 Application of the methodology on a 2-Loop PWR
In this section, the methodology will be implemented on the problem of creep rupture assessment for a 2-loop PWR. The results are expected to contribute to construction of the Level-2 PSA of the plant under study.
4.1 Severe accident modelling
4.1.1 Development of Qualified MELCOR Model
Figure 2 shows the overall nodalization of the plant and detailed nodalization of the containment. In Fig.2(a), the RPV consists of 5 control volumes to calculate the hydrodynamics unique to each control volume, including the reactor core region, the lower plenum region, the upper plenum region, the core bypass region, and the down-comer region.
The secondary coolant system is modeled with two loop configurations where each loop consists of the main steam line, the main feed water (MFW), the emergency feed water, and two steam lines connected to one turbine.
SG of this power plant is of a vertical type in which a set of U-form pipes transfer thermal power (each about 565 MWth) from the first circuit to shell side of the SG. In order to model the first circuit of steam generator, two control volumes for inlet and outlet nozzles and four control volumes for the first circuit pipes ofthe same cross sections and different volumes and heights are used. The secondary region that captures the heat is composed of three control volumes of down comers, boiler, and separator-dryer. Control volumes are connected to each other through flow paths. Two control volumes as boundary conditions are used for modeling the secondary region. The conditions are consistent with the power plant design. The MELCOR containment model is provided in Fig. 2(b).
The steady state qualification of the developed model includes checks related to evaluating the geometrical data and numerical values implemented in the nodalization; or related to the capability of the nodalization to reproduce the steady state qualified conditions. Table 1 summarizesthe thermal hydraulic parameters checked against their designated values in the design. For the geometrical values, the input deck is rechecked to assure the accuracy of plant nodalization. Errorsof the thermal hydraulic parameters must be acceptable. As shown inTable 1, they are well below the acceptability criteria and confirm the credibility of steady state model. Therefore, this model truly describes the plant steady state conditions and can be the basis for the deterministic calculations in the success criteria analysis.
| Quantity | Design | Modelling | Acceptable error | MELCOR model error |
|---|---|---|---|---|
| Primary mass flow rate (kg/s) | 6938.0 | 6905.8 | 2.0 % | 0.46 % |
| Steam generator secondary side steam mass flow rate(kg/s) | 304.4 | 302.9 | 2.0 % | 0.49 % |
| Steam generator primary side mass flow rate(kg/s) | 3469.0 | 3454.8 | 2.0 % | 0.41 % |
| Core bypass mass flow rate(kg/s) | 277.0 | 273.2 | 10 % | 1.37 % |
| Heat transfer from primary to secondary side (MWth) | 1130 | 1135.2 | 2.0 % | 0.46 % |
| Hot-leg temperature at steady state (K) | 586.75 | 586.82 | 0.5 % | 0.012 % |
| Cold-leg temperature at steady state (K) | 556.95 | 556.87 | 0.5 % | 0.014 % |
| Steam generator secondary side pressure (MPa) | 5.550 | 5.548 | 0.1 % | 0.036 % |
| Pressurizer pressure(MPa) | 15.520 | 15.517 | 0.1 % | 0.021 % |
| RPV pressure loss(MPa) | 0.199 | 0.201 | 10.0 % | 1.005 % |
| Steam generator primary side pressure loss(MPa) | 0.216 | 0.207 | 10.0 % | 4.17 % |
| Pressurizer level (m) | 16.227 | 16.222 | 0.05 m | 0.005 m |
| Steam generator secondary side level (m) | 17.605 | 17.601 | 0.1 m | 0.004 m |
The TMLB severe accident sequence is analyzed by MELCOR code which is defined as station black out (SBO) scenario with the following characteristics: 1) the power-operated relief valves on the secondary side of the SG on the pressurizer loop become stuck in an open position upon first challenge; and 2) the primary system does not depressurize following creep-rupture failure of any component in order to examine the failure sequence of the RCS components.
4.1.2 Results of MELCOR severe accident modelling for base case SBO
MELCOR predictions of the primary and secondary systems (in the loop with the SG secondary-side relief valves stuck in an open position) pressures are shown in Figs. 3(a) and 3(b). Initially, the pressure decreases as the heat removal from the steam generator exceeds the decay heat power. The RCS pressure drops until it reaches an equilibrium state with the secondary pressure (~8 MPa). However, once the steam generators boil dry at ~0.5 h (Fig.3c), the vessel water heats up to boiling and pressurizes the RCS. FromFig.3(a), the RCS pressure rises until it reaches the pressurizer relief valve set point.For rate dependent creep rupture models, the time of failure is a function of the RCS component’s pressure and temperature.
Figure 3(d) shows the MELCOR prediction of the heat structure temperatures in the hot-leg nozzle, surge line, and SG average tube. Fig. 3(e) demonstrates the history of stress variation in the course of the accident which is correlated with the pressure of the RCS system. Fig. 3(f) shows that the hot leg fails at the critical value R=1, due to the high pressure and temperature in the RCS, as a result of thermo mechanical creep rupture at 7.65 h. The damage index (R) equals to unity at this time for the hot-leg piping which represents the occurrence of hot leg creep rupture under high pressure and temperature. The RCS pressure follows decreasing trend after the hot leg rupture, eventually approaching the containment pressure. The subsequent rapid depressurization causes accumulator discharge, which refloods the core.
In this scenario of SBO, the creep rupture occurs at hot leg and the subsequent depressurization of the RCS remotes the risk of failure for steam generator tubes and surgeline. In addition to the base case scenario described above, a number of extra sequences are analyzed in order to capture the variation of parameters due to the considered assumptions. For the sake of brevity, the calculation results are not reported here; thoughthey are considered in the uncertainty quantification step of the methodology.
4.2 Quantification of uncertainty in SBO severe accident modelling
In the Larson-Miller model, the criterion for creep rupture of RCS components is determined by the temperature T(t), stress σ(t), the material parameter vector β, and the time to reactor pressure vessel failure tVF (Fig.4).
The criterion for hot leg creep failure is defined as the occurrence of hot leg failure before vessel breach due to melt erosion. For the steam generator tube, the criterion is set to meet the two conditions: 1) the rupture time is less than time for vessel breach tR≤tVF, and 2) rupture occurs before the time for hot leg piping failure tR≤tHL.
This criterion is defined as the time that the risk of creep rupture diminishes for the SG tubes. The creep rupture is highly dependent on the high pressure in the RCS. Whenever hot leg rupture or RPV rupture takes place, the RCS eventually depressurizes therefore the risk of SGTR isnot a concern anymore. This is the main logic for the failure criteriondefinition.
By following formal uncertainty analysis approach,the uncertainty indicators (e.g., probability distributions) are assigned to each uncertain input parameter of MELCOR code. Input parameters distributions are sampled and propagated through the code structure to determine the probability distribution of the output results of interest. This distribution is interpreted as uncertainty in the code results.
For the calculations, the data are available for characterization of output uncertainty. Uniform distribution is fitted to the code calculation results. The final distribution of the output is obtained for temperature of the heat structures, and stress and time for the vessel failure. The results for steam generator tubes and hot-leg piping are summarized in Table 2. In the case that the data are equally likely, uniform distribution is the correct choice for changes in the parameter's value. This is the case for the accident progression parameters in Table 2. Material property parameters a, bandc experience their highest probability of occurrence for their central values with a normal distribution around their mean value.
| Parameters | Means | Distributions | |
|---|---|---|---|
| SG tubes | Hot leg pipes | ||
| a | −11333±1% | −11320±1% | Normal |
| b | 43333±1% | 54870±1% | Normal |
| c | −15±1% | −20±1% | Normal |
| T (R) | [975,2340] | [1050,2340] | Uniform |
| σ (ksi) | [7.25,16.82] | [12.25,16.50] | Uniform |
| TVF(h) | [6.5,11.64] | [6.5,11.64] | Uniform |
Figure 5 shows schematically normal and uniform PDF of the parameters in the structure of Larson-Miller model.
4.3 Results obtained by Monte Carlo simulation
The Monte Carlo simulation is performed by developing a MATLAB code. Itinput to this code is Larson-Miller parameters with their uncertainties obtained by formal uncertainty analysis for MELCOR code calculations. The code returns the calculated probability of creep rupture failure of the simulated RCS component. The methodology is implemented on "hot leg piping" and "steam generator tubes" as they are both important regarding the RCS behavior.
By following Sections 4.1 and 4.2, sufficient information is available now to calculate the probability of creep rupture and its distribution from the deterministic calculation. A MC-calculation with 1000 iterations in the outer loop and 1000 iterations in the inner loop is performed, for a total of 106 iteration steps, creating a sufficiently large sample size to approximate the PDF. The histogram, PDF resulting from the 1000 point values and its cumulative probability are shown in Fig.6(a–c) for hot-leg piping, andFig.6(d–f) for SG tubes. The horizontal axis in the figures represent the probability of failure of the component meeting the criterion mentioned earlier, while the vertical axis stands for their frequencies.
5 Conclusion
A framework is proposed for the formal quantification uncertainties in Level-2 PSA model of a PWR type nuclear power plants. The proposed methodology uses integrated deterministic and probabilistic approach by following three steps: (i)severe accident analysis; (ii) quantification of uncertainty in severe accident modelling; and (iii) Monte Carlo simulation for separation of aleatory and epistemic uncertainty. The methodology is demonstrated on creep rupture assessment for major RCS components, i.e. steam generator tubes and hot leg piping. As a final note, the conditional probabilities of the creep rupture failure on the SG tubes and the hot-leg are calculated as 0.17 and 0.75, respectively. It is needed to incorporate this uncertainty into the event tree model to be able to quantify the confidence interval for the final Level-2 PSA results.
A systematic framework for effective uncertainty assessment of severe accident calculations; Hybrid qualitative and quantitative methodology
. Reliability Engineering and System Safety.125, 5-19(2014). doi: 10.1016/j.ress.2013.06.037Model Uncertainty in Severe Accident Calcuoations; A structural Methodology with Application on LOFT-LP-FP-2 Experiment
. Nuclear Technology.193, 341-363 (2016). doi: 10.13182/NT15-47Dynamic generation of accident progression event trees
. Nuclear Engineering & Design.238, 3457-3467 (2008). doi: 10.1016/j.nucengdes.2008.08.005Effects of soil-structure interaction on fragility and seismic risk; a case study of power plant containment
. Loss Prevention in the Process Industries.32, 276-285 (2014). doi: 10.1016/j.jlp.2014.09.009Prediction of structural integrity of steam generator tubes under severe accident conditions
," Nuclear Engineering and Design.194, 31-55 (1999). doi: 10.1016/S0029-5493(99)00168-5Success criteria analysis in support of probabilistic safety assessment for nuclear power plants; Application on SGTR accident
. NUCL SCI TECH (2017) 28:33. doi: 10.1007/s41365-017-0193-z"Comprehensive Uncertainty Assessment Methodology for Probabilistic Risk Assessment (PRA),"
inWhen to separate uncertainties and when not to separate
. Reliability Engineering and System Safety, 54, 113-118 (1996). doi: 10.1016/S0951-8320(96)00068-3Uncertainty Treatment for Level-2 Probabilistic Safety Analysis
. Nuclear Science and Engineering, 166, 202-217 (2010). doi: 10.13182/NSE10-09