Quantifying reactor safety margins part 1: An overview of the code scaling, applicability, and uncertainty evaluation methodology

Nuclear Engineering and Design 119 (1990) 1-15 North-Holland

1

QUANTIFYING REACTOR SAFETY MARGINS P A R T 1: A N O V E R V I E W O F T H E C O D E S C A L I N G , A P P L I C A B I L I T Y , EVALUATION METHODOLOGY *

AND UNCERTAINTY

B.E. B O Y A C K Nuclear Technology and Engineering Division, Los Alamos National Laboratory, Los Alamos, USA

and I. C A T T O N ( U C L A ) , R.B. D U F F E Y ( I N E L ) , P. G R I F F I T H ( M I T ) , K . R . K A T S M A ( I N E L ) , G.S. L E L L O U C H E a n d S. L E V Y (S. L e v y , Inc.), U . S . R O H A T G I ( B N L ) , G . E . W I L S O N ( I N E L ) , W. W U L F F ( B N L ) , a n d N . Z U B E R ( U S N R C ) Received 12 January 1989

In August 1988, the Nuclear Regulatory Commission (NRC) approved the final version of a revised rule on the acceptance of ECCS entitled "Emergency Core Cooling System; Revision to Acceptance Criteria." The revised rule states an alternate ECCS performance analysis, based on best-estimate methods, may be used to provide more realistic estimates of plant safety margins, provided the licensee quantifies the uncertainty of the estimates and includes that uncertainty when comparing the calculated results with prescribed acceptance limits. To support the revised ECCS rule, the NRC and its contractors and consultants have developed and demonstrated a method called the Code Scaling, Applicability, and Uncertainty (CSAU) evaluation methodology. The CSAU methodology and an example application, described in this set of six papers, demonstrate that uncertainties in complex phenomena can be quantified/The methodology is structured, traceable, and practical, as is needed in the regulatory arena. It addresses in a comprehensive and systematic manner questions concerned with: (1) code capability to scale-up processes from test facility to full-scale nuclear power plant (NPP), (2) code applicability to safety studies of a postulated accident scenario in a specified NPP, and (3) quantifying uncertainties of calculated results. The methodology combines a "top-down" approach to define the dominant phenomena with a "bottom-up" approach to quantify uncertainty. The methodology is able to address both: (1) uncertainties for which bias and distribution are quantifiable, and (2) uncertainties for which only a bounding value is quantifiable. The methodology is general, and therefore applicable to a variety of scenarios, plants, and codes. This paper provides an overview of the CSAU evaluation methodology and its application to a postulated cold-leg, large-break loss-of-coolant accident in a Westinghouse four-loop pressurized water reactor with 17 × 17 fuel. The code selected for this demonstration of the CSAU methodology was TRAC-PF1/MOD1, Version 14.3.

1. Introduction In August 1988, the Nuclear Regulatory Commission ( N R C ) approved the final version of a revised rule on

* This work was funded by the US Nuclear Regulatory Commission (NRC), Office of Nuclear Regulatory Research, Division of Systems Research. 0029-5493/90/$03.50

the acceptance of ECCS entitled "Emergency Core Cooling System; Revisions to Acceptance Criteria" [1]. The revised rule contains three key features. First, the current acceptance criteria related to peak cladding temperature, clad oxidation, hydrogen generation, coolable core geometry, and long-term cooling are retained. Second, evaluation model (EM) methods based on Appendix K [1] may continue to be used as an alternative to the best-estimate (BE) methodology. Third, an alternate ECCS performance analysis, based on BE meth-

© 1990 - E l s e v i e r S c i e n c e P u b l i s h e r s B.V. ( N o r t h - H o l l a n d )

2

B.E. Boyack et al. / Quantifying reactor safety margins - Part I

ods, may be used to provide more realistic estimates of plant safety margins, provided the licensee quantifies the uncertainty of the estimates and includes that uncertainty when comparing the calculated results with prescribed acceptance limits [2]. To support the revised ECCS rule, the NRC and its contractors and consultants have develop and demonstrated a method called the Code Scaling. Applicability, and Uncertainty (CSAU) evaluation methodology. The objective of this paper is to provide an overview of this methodology and a brief summary of its application to a large-break loss-of-coolant accident (LBLOCA). More detailed descriptions of specific features of the CSAU method and its demonstration for a Westinghouse fourloop pressurized water reactor (PWR) with 17-17 fuel are presented in companion papers [3-7].

2. Background 2.1. E C C S rule

Recent review papers concerning the history and content of the ECCS rules are found in refs. 8-10. The background material provided here was summarized from these papers. The acceptance criteria for ECCS performance for light-water-cooled nuclear power plants (NPPs) are found in the Code of Federal Regulations, Title 10, Section 50.46 (10CFR50.46) [11]. Included is the requirement that analysis models used to calculate the thermal-hydraulic performance of the ECCS conform to the requirements specified in Appendix K [1] to 10CFR50. Section 50.46 and Appendix K were finalized after extensive public hearings in 1973, and the rule was implemented in January 1974. The basic criteria for evaluating ECCS performance focus on a peak cladding temperature (PCT) limit (2200 ° F or 1477 K), a limit on the maximum cladding oxidation (cannot exceed 17% of the cladding thickness before oxidation), a limit on the hydrogen generation from the chemical reaction of the cladding with water or steam (1% of potential), a requirement that a coolable core geometry be retained, and a requirement that acceptable long-term cooling be provided. These criteria were re-evaluated as part of the rule revision process and were found, in the judgment of the NRC, to be appropriate for continued use. Appendix K contains required and acceptable features of evaluation models to be used for loss-of-coolant accident (LOCA) analysis. Several features of the Appendix K requirements have been found to have a significant effect on PWR design and operation. These are requirements related to

2500-

2000-

/ BaseCase f~ ~ l - W a t e r

Reaction

1500-

~,

1000-

Best-EsUmate Deentaminment \

[-., 500-

wl[h l~llbaok

i Time

/

i After

i Break

i (s)

Fig. 1. Effect of selected conservative assumptions on PCT. initial stored energy, use of 1.2 times the 1971-73 American Nuclear Society standard decay heat, the emergency core coolant (ECC) bypass prescription, the prohibition on a return to nucleate boiling, reactor coolant pump modeling, and calculation of reflood rates [12]. Other features of Appendix K were found to have smaller impacts on plant design and operation. A summary of an early study [13] to quantify the conservatisms associated with a particular set of Appendix K requirements is provided in fig. 1. Following the base-case code calculation using EM conditions, selected conservatisms were removed one at a time and the transient recalculated. Taken in the order below, the conservatisms accounted for a reduction in the reflood PCT of about 7 0 0 ° F (390 K); the order in which the selected Appendix K conservatisms were treated was (1) metal-water reaction, (2) decay heat, (3) ECCS bypass, (4) upper-plenum de-entrainment, and (5) upper-plenum separation with faUback. The blowdown PCT was only slightly affected by treatment of the listed conservatisms. There appear to be many areas of possible benefit available to licensees as increased margin is demonstrated under the revised ECCS rule. Possible benefits for PWR plants include increased discharge burnup, low leakage loading patterns, longer fuel cycles, use of advanced fuel designs, power uprating, improved loadfollowing capabilities, more flexible burnup windows, use of axial blankets and technical specification relaxation [14]. Similar insights related to potential benefits for boiling water reactors (BWRs) are found in ref. 15. In 1985, a BE licensing approach based on the S A F E R / G E S T R codes was licenseed by the N R C for application to BWRs. This approach has subsequently

B.E. Boyack et al. / Quantifying reactor safety margins - Part l

been used to identify areas where this licenseed technology couM be used to relax ECCS performance requirements for B W R / 4 [16]. The 1974 criteria for loss-of-coolant analysis were formulated at a time when limitations in knowledge made conservative approaches necessary. Research completed in the last 15 years now provides a foundation sufficient for use of realistic and physically based analysis methods. Accordingly, the NRC has recently issued a revised rule for LOCA/ECCS analysis of light water reactors, to allow the use of BE computer codes in safety analysis as an option. A key feature of this option requires the licensee to quantify the uncertainty of the calculations and include that uncertainty when comparing the calculated results with acceptance limits provided in 10 CFR Part 50. 2.2. B E codes

BE thermal-hydraulic ( T / H ) codes are used to calculate postulated accident scenarios ranging from LBLOCAs to small-break LOCAs and operational transients with and without intervention by operators. For such calculations to be relevant to NPP safety analyses, it is necessary to address the following three questions: (1) Has the code the capability to scale up phenomena observed in small-scale test facilities to full-size NPPs? (2) Can the code be applied to safety studies of a particular scenario or a set of scenarios for a given plant design? (3) What is the uncertainty with which the code calculates important parameters, say the PCT, in a fullscale NPP? The need to examine very carefully and in some detail questions related to scaling, code applicability and code uncertainty is predicted upon the following factors: (1) All integral tests and most of the separate effects tests have been conducted in scaled-down test facilities which have scale distortion. Consequently, it is necessary to assess the effects of such distortion on processes a n d / o r parameters of interest to a NPP accident scenario or set of scenarios. (2) BE codes rely upon a large number of empirical correlations and parameters. Such empirical relations are often "tuned" to improve their agreement with certain data sets (obtained very often from scaled-down facilities). Consequently, it is important and necessary to identify the parameters which have been "tuned" and then to assess the effects of such "tuning" on the NPP calculation.

3

(3) A code can have "compensating errors" because several parameters may have been "tuned" to produce agreement with certain data sets. Consequently, it is necessary and important to determine whether or not such compensating errors exist and if so, to identify scenarios for which these compensating errors may produce nonconservative resuits. (4) BE codes are compared to a large bank of separate and integral effects test data. They will give reasonable agreement with a number of tests, but not necessarily with all of the data. Consequently, it is important to identify the reasons for such discrepancies if the code is to be apphed with confidence to a large variety of scenarios and plant conditions. (5) BE codes will show some sensitivity to noding and some of their empirical relations have had to be simplified or adjusted to improve their numerical stability. Consequently, to perform reliable NPP calculations it is necessary to assess the effects of noding and other adjustments. (6) BE codes may have some correlations or parameters which are not supported by any experimental data or are based on data which do not cover the range of interest to NPP applications. Consequently, it is very important to identify such correlations and parameters and to assess their effects on NPP safety analyses of a particular scenario or of a set of scenarios. The CSAU evaluation methodology was developed by the USNRC and its contractors and consultants to address in a unified and systematic manner, questions related to the scaling capability of a BE code, to its applicability to scenarios of interest to NPP safety studies, and to evaluate uncertainties in calculating parameters of interest when the code is used to perform a calculation for a specified scenario and NPP design. 2.3. Program management

Development and demonstration of the methodology was directed by a Technical Program Group (TPG), the membership of which was composed of individuals from the NRC, three national laboratories, academia, and industry. The members of the TPG were: (1) Dr. B. Boyack, Los Alamos National Laboratory (2) Dr. R. Duffey, Idaho National Engineering Laboratory (3) Dr. P. Griffith, Massachusetts Institute of Technology (4) Dr. G. Lellouche, S. Levy, Inc.

4

B.E. Boyack et al. / Quantifying reactor safety margins - Part I

(5) Dr. S. Levy, S. Levy, Inc. (6) Dr. U. Rohatgi, Brookhaven National Laboratory (7) Mr. G. Wilson, Idaho National Engineering Laboratory (Lead Laboratory Program Manager) (8) Dr. W. Wulff, Brookhaven National Laboratory (9) Dr. N. Zuber, US Nuclear Regulatory Commission (TPG Chairman). Consistent and timely program direction was accomplished by regular meetings of the TPG at 5- to-6-week intervals over the 15-month program duration. The Advisory Committee on Reactor Safety (ACRS) also provided continued oversight through regular participation of their consultant, Dr. I. Catton, in the TPG meetings, and through periodic ACRS thermal-hydraulic phenomena subcommittee reviews. An independent mid-course review of the CSAU evaluation methodology was provided by a Peer Review Group (PRG) composed of nationally and internationally recognized experts in reactor safety research. The membership of the PRG included: (1) Professor F. Mayinger, Lehrstuhl A fur Thermodynamik, Technische Hochschule Mtinchen, Federal Republic of Germany (2) Mr. J. Fell, AERE Winfrith, United Kingdom (3) Professor G.B. Wallis, Dartmouth College (4) Professor A.E. Dukler, University of Houston (5) Professor S. Banerjee, University of California, Santa Barbara (6) Dr. M. Ishii, Argonne National Laboratories (7) Professor N. Todreas, Massachusetts Institute of Technology (PRG Chairman) (8) Dr. L. Ybarrondo, Scientech, Inc. (9) Dr. M. Thurgood, Numerical Applications, Inc. (10) Professor B. Mikic, Massachusetts Institute of Technology. The recommendations of the PRG, provided in the P R G report [17] were factored into the development of the CSAU methodology and its application.

In its evaluation of the methodology, the ACRS has stated "The CSAU Program will provide a reasoned perspective on the accuracy of the existing codes" and the "The CSAU method, or something similar, can be used in other areas of safety analysis, that is, beyond the currently conceived purpose of assessing uncertainty associated with calculations by thermal-hydraulic codes. In particular, its application to severe accident studies and risk assessments could serve, not only to provide an improved perspective on uncertainty, but also as a guide to allocation of research resources" [18].

3. C S A U e v a l u a t i o n m e t h o d o l o g y

3.1. Objectives o f CSA U

The objectives of the CSAU evaluation methodology developed by NRC and its contractors and consultants are to: (1) provide a technical basis for quantifying uncertainties within the context of the revised ECCS rule; (2) provide an auditable, traceable, and practical method for combining quantitative analyses and expert opinion to arrive at computed values of uncertainty; and (3) provided a systematic and comprehensive approach for: • defining scenario phenomena, • evaluating code applicability, • assessing code scale-up capabilities, and • quantifying code uncertainties concerned with: - code and experiment accuracies, - code scale-up capabilities, - plant state and operating conditions. Additional objectives of the CSAU activities described in this and the companion papers were to "demonstrate feasibility of the methodology, to develop an audit tool, and to provide the necessary experience to audit licensee submittals" [1].

2.4. Results 3.2. Elements of CSA U

The desired methodology has been developed and demonstrated by the TPG in approximately 15 months with an equivalent resource expenditure of 13 manyears * * The TPG believes that any new application of the methodology could be accomplished in less than one-half of this span time and resource allocation. This assessment is justified by the amount of data and information assembled in the course of the work presented in ref. 19, which can be used in other applications.

In developing CSAU, the emphasis was placed on providing a practical engineering approach that could be used to quantify code uncertainties. Consequently, for a specified NPP and a given scenario, the CSAU method focuses only on important processes a n d / o r phenomena, assesses the code capability to scale them up, and evaluates the accuracy with which the code calculates them. The CSAU evaluation methodology consists of three primary elements as shown in fig. 2.

B.E. Boyack et al. / Quantifying reactor safety margins - Part 1

5

Element 1 Requirements and code capabilities Provide c O~oP/eteadnoculme nt ariD n Identify and rank phenomena (P RT)

User guide Progammersassessment guide Developmental Model & correlations QE

3

I

I I Determine I code 6 applicability

1

J Establish ] assessment 7 matrix

Element 2 Assessment and ranging of parameters

1 Compare calculations vs, sets using NPP nodalization 4 Document

b

Compare calculations vs. lETS using NPP nodalization Document

I

-8

I Yes

~o Determine code and experiment accuracy

....

uncertainty

t

I°

Determine effect of scale

11°

Determine effect of reactor input parameters and state

11

Perform

NPP sensitivity calculations

Element 3 Sensitivity and uncertainty analysis

Combine biases and uncertainties

r 13 I ~....,~ I L

Additional margin if warranted by limitation in data base, code, etc.

"1 I I I I ,

Total uncertainty to calculate

sl~cifi 9 scenario in a

14

specific NPP

Fig. 2. Code scaling, applicabilityand uncertainty (CSAU) evaluation methodology.

The first element, Requirements and Code Capabilities, contains steps 1-6. In this element, scenario modeling requirements are identified and compared against code capabilities to determine the code's applicability to the particular scenario in a given plant type. In ad-

dition, an effort is made to identify potential code limitations. The modeling requirements are established by identifying and ranking processes and phenomena important to the particular scenarios. The need for such a screening process arises from the fact that the re-

6

B.E. Boyack et al. / Quantifying reactor safety margins - Part 1

source required to quantify the uncertainty for every process and phenomenon occurring during the selected transient are too large. Furthermore, although many processes and phenomena occur during a given transient, the overall plant behavior is not influenced equally be each. Consequently, a sufficient and more efficient (cost-effective) approach is to rank process and phenomena by evaluating their importance relative to the primary safety criteria so that only the significant contributors need to be evaluated. A list of the processes and phenomena occurring during the selected transient is compiled following examination of experimental data and code simulations. The phenomena and processes are then ranked according to importance using one or more techniques. The evaluation of code applicability to the selected transient is based on a complete set of code documents (specified in step 5). It is conducted by reviewing the adequacy of code models to calculate the important processes and phenomena identified above. Code deficiencies a n d / o r limitations are also identified and evaluated as to their potential affects on uncertainties to calculate primary safety criteria. A more detailed description of this element and its demonstration for a LBLOCA is provided in ref. 3. The second element, Assessment and Ranging of Parameters, contains steps 7-10. In this element there

are activities to assess the capability of the code to calculate processes important to the scenario by comparing calculations against experimental data to determine code accuracy, to determine scale-up capability, and to specify ranges of parameter variations needed for sensitivity studies. In addition, bounding analyses can be performed and, in such cases, code calculations may not be required. A more detailed description of this element and its demonstration is provided in ref. 4. A focused treatment of the process of considering the effect of scale is provided in ref. 6. The third element, Sensitivity and Uncertainty Analyses, contains steps 11-14. The total uncertainty in

a safety analysis includes contributors that arise from code limitations, scaling inaccuracies embedded in the experimental data (and therefore the code), and uncertainties associated with the state of the reactors at the initiation of a transient. The ultimate objective of the CSAU process is to provide a simple and direct statement of the calculated uncertainty in the primary safety criteria (e.g., the PCT) used as the basis for assessing safety and making licensing decisions relative to the revised ECCS rule. This objective is accomplished when the magnitudes of individually important contributors are determined, collected, and subsequently combined to provide the desired summary statement. This element

contains the activities to calculate, collect, and combine individual contributors to uncertainty into the required total mean and 95% probability statements including separately identified and quantified biases. A more detailed description of this element and its demonstration is provided in ref. 5. 3.3. Prescriptive steps o f CSA U

A brief description of each of the steps (numbered to conform to fig. 2) in the CSAU evaluation methodology follows. The description of each step is also accompanied by the rationale for its inclusion in the evaluation methodology. (1) Specify scenario: Code applicability and uncertainty are transient dependent because processes and safety parameters of interest may change from one scenario to another. Consequently, it is necessary to specify the scenario in order to establish the parameters that need to be evaluated. Rationale: The transient scenario dictates the processes that must be addressed. By carefully defining the scenario and its phases, the groundwork for the identification and ranking of the processes within each component is prepared. (2) Select N P P : the Scenario definition depends on both the type of transient to be analyzed, and the particular plant in which it is postulated that it occurs. Consequently, the NPP for which the calculations are to be performed should be specified. Rationale: The various US vendors of PWR systems have individual designs. Although overall PWR systems are similar, individual components differ significantly. The selection of a particular plant is crucial to the CSAU process because the resulting uncertainty is dependent on the plant configuration and operation. (3) Identify and rank processes: The CSAU methodology focuses only on phenomena/processes that are important to the particular scenario and plant design. Consequently, physical processes need to be first identified (together with relevant plant components) and then ranked to establish process identification and then ranked to establish process identification and ranking tables (PIRT) appropriate to the particular scenario and plant design. The identification and ranking should be justified and documented. Rationale: Plant behavior is not equally influenced by all processes and phenomena that occur during a transient. The most cost-efficient yet sufficient analytical effort reduces all candidate phenomena to a manageable

B.E. Boyack et al. / Quantifying reactor safety margins - Part 1

(4)

(5)

(6)

(7)

set by identifying and ranking the phenomena with respect to their influence on the primary safety criteria. Select "'frozen" code: The methodology emphasizes the use of a "frozen" code version. Rationale: This requirement ensures that the same code version will be used throughout the CSAU process and that all results and conclusions are traceable and applicable to the single code version. This is particularly important when changes to the code are being made as a result of a continuing effort to improve its capability. Provide code documentation: Complete documentation should include: the user manual, the user guide, the model and correlations quality evaluation (MC/QE) document, assessment reports, and other relevant supporting evidence. The M C / Q E is a new kind of document that NRC's contractors have been requested to provide for each BE code. It provides detailed information on closure relations as implemented in the code, that is, information on their source, data base, accuracy, scale-up capability, and applicability to NPP conditions. Rationale: Adequate documentation allows evaluation of the codes application to a postulated scenario for a specific plant. Determine code applicability: Steps 1 through 3 establish the requirements for modeling a specific scenario, whereas steps 4 and 5 provide information on code capabilities. By comparing requirements and capabilities in step 6, one determines whether the code can be used to calculate the scenario and whether the data base, accuracy, and scale-up capabilities of closure relations are adequate to model processes important to the scenario. Rationale: Assurance is required that the code has the capability to accurately calculate the key safety parameters with a high probability. Integration of the requirements and capabilities results in an understanding of the applicability of the code to the scenario being examined. Identification of deficiencies or limitations important to the computational accuracy of the code are identified and quantified when the contribution to uncertainty is judged to be significant. Establish an assessment matrix: Test data should be selected for a) assessing code accuracy to calculate dominant phenomena/processes identified in PIRT (step 3) and b) addressing any code inadequacy identified in step 6. Both separate and integral effects tests are to be used in establishing the assessment matrix. Rationale: The assessment

7

matrix is required to provide a data base for evaluating the code accuracy in calculating phenomena important to the scenario, the code capability to scale-up the phenomena to NPP conditions, and the influence of nodalization on the calculation. (8) Define N P P nodalization: The plant model should be nodalized with enough detail to capture the important phenomena and design characteristics of the NPP. The iterative process shown in the flow diagram (fig. 2) makes use of the Assessment Matrix to support the rationale for the choice of nodalization. The same nodalization should be used in performing NPP and code assessment calculations. Rationale: In principle, nodalization can be treated as an individual contributor to uncertainty; however, experience indicates that the quantification of nodalization uncertainty can be very costly and is highly user-dependent. Thus, the preferred path is to establish a standard NPP nodalization for the subsequent analysis. This minimizes or removes nodalization, and the freedom to manipulate noding, as a contributor to uncertainty. (9) Determine code and experiment accuracy: Simulations of experiments from step 7 with the frozen code, using the nodalization defined above, should lead to a statement of code accuracy. Differences between code and experiment should be quantified for bias and uncertainty (deviation). Individual contributors to uncertainties in modeling important phenomena/processes should be identified and cast in terms of bias and distribution (to be used in step 12 for sensitivity calculations). In addition, separate biases should be evaluated as appropriate. Separate effects test data from facilities up to full scale when available should be used to evaluate code scale-up capability and accuracy in modeling important phenomena, whereas integral effects test data should be used to evaluate overall code accuracy. Rationale: Simulation of experiments from the test matrix using the selected NPP nodalization provide the results necessary to determine code accuracy. The differences between code-calculated and experimental data, when appropriately processed, provide essential information required for code uncertainty quantification. (10) Determine effect of scale: Differences for similar physical processes, but at different scales, should also be quantified for bias and deviation to establish a statement of potential scale-up effects. In addition, separate biases should be evaluated as

8

B.E. Boyack et al. / Quantifying reactor safety margins - Part 1

appropriate. The CSAU procedure to evaluate the scale-up capability of BE codes is documented in ref. 6; a detailed discussion, prescriptive steps, and schematic procedure diagram are provided. Rationale: Since the desired end result is a statement of the uncertainty in code-calculated values of key parameters for the NPP, it is necessary to evaluate the capability of the BE code to scale-up processes from reduced scale test facilities to the full-scale NPP. It is also necessary to quantify the effects of limitations on the data base used to develop models and correlations that are present in the code. (11) Determine effect o f reactor input parameters and state: The effect upon uncertainty because of an imprecise knowledge of the reactor state and operating conditions at the initiation of the transient should be quantified. A typical example of these contributors is the potential variability of the fuel state that arises from the assumed condition of the fuel as a function of the burn-up cycle and the original manufacturing-tolerances. Realistic variations are determined by examination of the most probable reactor state and the distribution around this condition using both experimental data and analytical studies. In addition, separate biases should be evaluated as appropriate. Rationale: Uncertainties in NPP simulations may result from uncertainties in the plant operating state at the initiation of the transient. These uncertainties are reflected in the input parameters selected for the calculation. (12) Perform N P P sensitivity calculations: The influence of the individual contributors to uncertainty, determined in steps 9, 10, and 11, upon the primary safety criteria should be determined by performing NPP sensitivity calculations. That is, the individual variabilities cast in terms of bias and distribution are input to the NPP model and are used to determine their effect upon the uncertainty of simulating the primary safety parameters. These results are used in combining the biases and uncertainties for a singular statement regarding total uncertainty in steps 13 and 14. Rationale: The sensitivity of key safety-related parameters to uncertainties in code and experiment accuracy, scaling, and reactor input parameters and state must be passed through the selected code to determine the sensitivity to these parameters. The results of the sensitivity studies are the input data for determining overall uncertainties. (13) Combine biases and uncertainties: Uncertainties determined in the above steps should be combined in

a statement of total uncertainty. As there are several ways of combining them (addition, root mean square, response surface, etc.), a justification should be provided for selecting a particular method. Separate biases must also be added to produce total mean and 95% probability values of the appropriate parameter(s) including combined biases. Rationale: The overall uncertainty is the outcome of combining the uncertainties of each of the key processes and phenomena identified in step 3. (14) Determine total uncertainty: A statement of total uncertainty for the code may be given as an error band or statement of confidence about the code calculation with respect to the primary safety criteria (for example, PCT during a LBLOCA). Rationale." The effect of uncertainty contributions which cannot be quantified as bias and distribution because the data are limited, or because it is not economical, can be quantified as separate biases based on bounding sensitivity calculations with the NPP model. These separate biases are then included in the total uncertainty. It is important to note that the CSAU methodology outlined above is not fully prescriptive regarding the details of its implementation. Rather, the CSAU methodology provides a complete and logical structure to which the details of alternative implementation approaches can and must be referenced and evaluated for completeness. In the following section, the approach selected by the NRC-organized TPG to demonstrate the CSAU methodology is briefly described. During the process of developing the demonstration, the TPG explored many approaches; some proved fruitful and some did not. However, valuable lessons were learned in each case. The lessons learned are documented in the CSAU final report [19] and should prove useful to those interested in alternative implementation approaches.

4. CSAU demonstration

An application of the CSAU methodology has been demonstrated by the TPG for a cold-leg LBLOCA in a Westinghouse four-loop PWR with 17 x 17 fuel. The demonstration conformed to the requirements of the revised 10CFR50.46 [1]. The BE PCT and uncertainty in predicting PCT were quantified. Only one of the acceptance criteria was evaluated, the PCT. This focus was warranted as long as the total mean PCT including combined biases at the 95% probability level remained below the initiation temperatures for cladding oxidation

B.E. Boyack et al.

/ Quantifying reactor safety margins Part 1

and hydrogen generation from chemical reaction of the cladding with water or steam. Activities and results related to this demonstration are summarized below.

The frozen code selected was TRAC-PF1/MOD1. Version 14.3. Exclusive of the many assessment reports, only one of which is cited here,the applicable code documents are refs. 21-24. These documents were reviewed and the ability of the code to simulate these key processes was confirmed. As this effort was completed, available parameters and processes within the code related to the highly ranked phenomena were identified. For example, the parameters available within the code for modeling stored energy and fuel response were the gap conductance, peaking factor, fuel conductivity, surface heat transfer, initial power, clad conductivity, fuel and clad heat capacity, and pellet power distribution. Several code-related deficiencies were identified, e.g., the code does not provide models for dissolved NCG. The processes and outcomes associated with the first CSAU evaluation methodology element, requirements, and code capability are summarized in fig. 3.

Element 1: Requirements and Code Capabilities (steps

1-6, fig. 2) For the specified scenario (LBLOCA) and selected power plant, key phenomena and processes were first identified and then ranked by expert opinion and a subjective decision-making process, the Analytical Hierarchical Process [20]. The results were then summarized in a PIRT. The key phenomena and processes identified as important during the entire LBLOCA transient were break flow, stored energy and fuel response, reactor coolant pump two-phase flow, steam binding, ECCS bypass, and noncondensable gas (NCG). The steam binding and ECCS bypass phenomena are of importance only during the reflood phase of a LBLOCA.

Ranking of LBLOCA Phenomena

Phenomena Identification

step

Comparison With Code Capability

Highly Ranked Phenomena

3

~ v

flow

Break

L v Mass flow

Code

Manual

~,~

Stored energy and fuel response

Fuel Rods Core Upper Plenum

~

Pump Cold-Leg Accumulator

It Pump two-phase flow

Downcomsr Lower Plenum Break Loop

Gap conductance Peaking factor Fuel conductivity Surface heat transfer Initial power Cladding conductivity Fuel heat capacity Cladding heat capacity Pellet power distribution

User's Guide

Experts Group

Hot Leg Pressurizer Steam Generator

Key

Code Parameters

step 6

w" Phenomena Identified For Each Of The Following Components

9

-

Analytical Hierarchill Process

II

~ Development and other Assessment Documents

Steam binding (re flood only)

Liquid mass flow Evaporation Entrainment De-entrainment

Blowdown Phenomena forty-one Identified Rafiood Phenomena

ECC bypass

forty-six identified

(refill

only)

Mass flow Pressure

~-

~

Models

t

and Correlations

E(3C bypass flow

Quality

Evaluation Document

Non-condensible gas step i

L r

.-4 O I11 ~, =1 • :~_ I~ ~, Co W O W 3 (D ~,~ :l I=. :30 9: :r (~--. ¢~

~

•

Non-condensible gas partial pressure

1

Specify S. . . . . io I

step

I

2

~I~

T

Is::::c: :r:zen I

.ndprov,d.

Cod.l

T

I O,.otv.dnonco°d.n.,b,.g

.... g

I Documentation / nitrogen: not modeled in coda (to step 13) / I Fig. 3. Illustration of Element 1, requirements and code capabilities, of the CSAU methodology as applied to a LBLOCA and !

Select

NPP

I

I

TRAC-PF1/MOD1.

10

B.E. Bqvack et al. / Quantifying reactor safety margins - Part I

Where possible, auxiliary calculations not requiring application of TRAC-PF1/MOD1 were used to further reduce the number of uncertainty parameters associated with the highly ranked phenomena identified in step 3, fig. 2. For example, a closed-form fuel-rod model was developed at Brookhaven National Laboratory (BNL) and used to further reduce the set of stored energy and fuel response related parameters requiring evaluation to quantify individual contributions to uncertainty [25]; the reduced set of parameters was the gap conductance. peaking factor, fuel conductivity, surface heat transfer coefficient, and the minimum homogeneous nucleation temperature (Tmi,). This process is illustrated in fig. 4. For these remaining parameters, uncertainty ranges were determined and used later in the NPP calculations (step 12, fig. 2), Where such simplified models could not be

Element 2: Assessment and Ranging o f Parameters (steps 7-10, fig. 2)

The processes and outcomes associated with the second CSAU evaluation methodology element, assessment and ranging of parameters, are summarized in fig. 4. A test data matrix was established to (a) assess code accuracy to calculate the important processes shown in fig. 3, and (b) address code deficiencies identified in step 6. The nodalization of the NPP was guided by past experience, by the need to capture the important phenomena and the design characteristics of the plant, and by the desire to perform NPP calculations in a timely and cost-effective manner. Subsequent assessments using separate and integral effects test data were performed using the same nodalization. Other

Code Assessment, Parameter Ranging and Separate Bias Evaluation Studies

Evaluations Important

Key

Code-Related Uncertainty

Code

Parameters

"11

Parameters

Break Discharge Coefficient

Mass flow

steps 9&10 v --4 O

3 rn

~"

-'~ ~0 (p

Cladding Conductivity Fuel Heat Capacity Cladding Heat Capacity

J~ ¢=

Pellet Power Distribution

Gap Conductance

3

Peaking Factor Fuel Conductivity Surface Heat Transfer

Auxiliary Calculations

Coefficient

v

0 0 0.

and Code

Calculations Comparisons To

Mass flow Pressure Assessments Using Separate Effects

Liquid mass flow Evaporation

Tests

Entrainment De-entrainment

0q

Data Compilations

T min

Head Curves Torque Curves

¢o ~>

um ¢p

v Gap Conductance Peaking Factor Fuel Conductivity Fuel-to-Fluid Heat Transfer Initial Power

Separate Effect and Integral Effect Data

Interracial Drag

Pool Core

Parameter

v < --°

Ranges {to step 11)

en v

Separate Biases (to step 13)

C O

Upper Plenum Hot Legs

O W O"

ECC flow diversion

Non-condensible

gas

partial pressure

v

Interfaciai Drag

=1 ~0

Downcomer Non-condensible

gas

partial pressure

step 7 ~ T I Establish Assessment Matrix J step 8 Develop NPP Nodallzstion

Fig. 4. Illustration of Element 2, assessment and ranging of parameters, of the CSAU methodology as applied to a LBLOCA and TRAC-PF1/MOD1.

11

B.E. Boyack et al. / Quantifying reactor safety margins - Part 1

identified, code assessments were performed using the separate and integral effects test data. Such assessments proved useful in two ways, one direct and one indirect. First, data were used directly to develop uncertainty ranges for the selected code parameters. The individual uncertainty contributions of previously identified parameters relative to selected data were determined (steps 9 and 10, fig. 2) and later input to the NPP model so that the effect upon the primary safety criteria (PCT in the demonstration) could be evaluated (step 12, fig. 2). F o r e x a m p l e , the scale-related bias in the TRAC-PF1/MOD1 prediction of ECC bypass as measured by the lower-plenum filling rate was examined at BNL [26]. BNL examined the data from Create 1/15 and 1/5 scale downcomer tests, the Battelle Columbus Laboratory 2/15 downcomer tests, and UPTF 1/1 scale downcomer tests. Based on these studies, it was dem-

onstrated that a scale effect exists in the code when modeling the ECC bypass. TRAC was shown to overpredict the delivery of ECC to the lower plenum at smaller scales and underpredict the delivery of liquid at full scale. The BNL work provided convincing evidence of a scale-related bias in TRAC regarding the prediction of ECC bypass phenomena. The code bias was subsequently quantified using a bounding argument and the result factored into the overall quantification of uncertainty as an additional margin (step 13). Second, the data were used in a supportive role to provide insight into the accuracy of code calculations and to confirm conclusions that were being drawn regarding specific CSAU studies. LBLOCA transients have been run in reduced-scale integral and separate effect facilities such as Semiscale, the Loss-of-Fluid Test Facility, the Cylindrical Core Test facility, and the Slab

step 11 Parameter Ranges from steps 9 & 10

), to

Determine Effect of Reactor input Parameters and State

o w w

g

(D

=_ "3

step 12 0

step 13

For Each Contributor Perform NiP Sensitivity Calculation to Determine Effect on Primary Safety Criteria e.g., PCT

.=_

,,.,go o~

J Generate Response Surface 4b v I Determine Probability Distribution Function Using Monte Carlo Techniques

"O ¢¢ g o

Full-scale steam binding effect Full.ecste ECC bypass effect

Separate Blues (Penalty or Benefit) from qepe 9 & 10 Separate Bias for Hot-Channst Effect 1

Non-Conservative Implementation of Forslund-Rohuenow

L

SeparateBias for NonCondensible Gas Effect

I-- .

. . . "l Additional Separate I I Sial Evaluation j Studies L . . . . -I ,-£

Too (mstly If node model for direct evaluation of hot-channel affect Non-Condefmible Gas Not Modeledin Code

3

i (Mean mblned by pdf endUncertaInty 95% Probability)

1 step 13 Combine Biases and I Uncertsintlea

T

!

T

¢

/

J

I

step 14

Total Uncertainty I (Mean end 95% Probability)

Fig. 5. Illustration of Element 3, sensitivity and uncertainty analysis, of the CSAU methodology as applied as applied to a LBLOCA and TRAC-PF1/MOD1.

12

B.E. Boyack et al. / Quantifying reactor safety margins - Part I

Core Test Facility. Numerous assessment calculations have been performed using the data from these tests. From such calculations it is possible to state that a given code, e.g., T R A C - P F 1 / M O D 1 , will predict a selected parameter in the sub-scale facility, such as PCT or cladding quench time, with a stated bias and within a stated uncertainty band. In addition, the level of confidence related to such calculations can be provided. Although such results provide insight into the ability of the code to calculate similar phenomena in operating plants, they do not, in themselves, transfer directly to the full-size plant. Therefore, such results are considered to be supportive within the context of the CSAU methodology. It is important to emphasize, however, that the availability of such supportive results is important. In addition to increasing confidence that the dominant phenomena are modeled in the code, the quantified uncertainty for full-size plants can be checked for both trends and magnitudes as insurance that problems in application of the CSAU method at full scale do not go unrecognized. E l e m e n t 3: Sensitioity a n d uncertainty analysis (steps 11 14, fig. 2) The approach taken to quantifying the total mean and total 95% probability PCTs, including margins, is illustrated in fig. 5. Inputs for NPP calculations come from several sources. One source of uncertainty is related to code, scale, and experimental data contributors to uncertainty (e.g., pump and break flow characterization, core heat transfer coefficient calculation, and Tmin calculation), which are evaluated as part of the second CSAU evaluation methodology element (steps 9-10, fig. 2); the ranges and distributions of these parameters were used to specify one set of NPP calculations. Another source of uncertainty is the range and distribution of plant operating conditions and process variations that arise from imprecise knowledge about the reactor state during the transient. For example, the ranges and distributions of the fuel conductivity, gap conductance, and peaking factor as a function of the burn-up cycle and the original manufacturing tolerances were determined and used to specify a second set of NPP calculations (step 11, fig. 2). The result of each NPP run was a PCT related to the particular parameters specified. To combine these individual uncertainties (step 12, fig. 2), a probability distribution function (pdf) was generated from Monte Carlo sampling of a response surface representing the code output from the NPP calculations described above. The response surface methodology requires that a pdf be specified for each of

the significant parameters; a uniform distribution was chosen because investigation of the literature does not indicate that the uncertainty of any of the parameters exhibits a particular distribution in its experimental data. Also, a uniform distribution requires the least prior knowledge [27]. For the CSAU demonstration, 184 calculated PCT total points arising from TRACP F 1 / M O D 1 calculations were used to construct response surfaces. Many of the points arose from crossproduct calculations: 22 of the 184 points were single parameter variations, 98 were double , 57 triple, and 7 quadrupole. For the blowdown peak, response surfaces were constructed for seven significant LOCA parameters: peaking factor, gap conductance, fuel conductivity, fuel-to-fluid heat transfer coefficient, break discharge coefficient, pump characteristic, and Tmin. For each response surface, a process of random sampling or Monte Carlo was used to get the values of mean PCT the standard deviation, and the PCT at the 95th percentile probability level. A 50 000 history Monte Carlo sample appears to provide an acceptable degree of convergence. The statement of combined uncertainty by pdf includes the specification of a mean PCT and the PCT at 95% probability. For the CSAU demonstration, it has been concluded that a T R A C - P F 1 / M O D I prediction of the PCT during a cold-leg LBLOCA in a Westinghouse four-loop PWR with 17 × 17 fuel will be equal to or less than 1447°F [1059 K] 95% of the time. This PCT occurs during blowdown. However, this is not a final statement of the total uncertainty (mean and 95% probability PCT) until appropriate separate biases are incorporated. As the effects of some contributors to uncertainty were not quantified by means of sensitivity calculations and response surface (because of limited data base, considerations of cost effectiveness a n d / o r scheduling, etc.), separate biases were evaluated based on bounding calculations. These separate biases are included in the total uncertainty as shown in fig. 5. For the CSAU demonstration, five separate biases were evaluated in this manner. First, a bias was quantified to account for hot channel effects that could be modeled with the code but were not modeled for economic reasons. Second, a bias was estimated for uncertainty related to modeling phenomena associated with the presence of NCG. The T R A C - P F 1 / M O D 1 code includes the capability for modeling N C G as a separate fluid component, e.g., following the movement of the accumulator cover gas before and following accumulator injection. However, the code does not include models for dissolved NCG. Because the code lacked this modeling capability, the

13

B.E. Boyack et al. / Quantifying reactor safety margins - Part 1

Table 1 Total uncertainty for the CSAU demonstration a PCT (F) b Blowdown Mean PCT (combined uncertainty by pdf) 95% probability PCT (combined uncertainty by pdf) Mean separate biases added for: Hot channel effects - NCG effect (dissolved nitrogen) Nonconservative implementation of Forsland-Rohsenow correlation in code Full-scale steam binding effects - Full-scale ECC bypass effects Combined mean biases Total mean PCT (including combined biases) Total 95% probability PCT (including combined biases) -

1162 (901) 1447 (1059) 63 N/A

(35)

Reflood 1st Peak

2nd Peak

978 (799) 1399 (1032)

758 (676) 1336 (997)

25 18

(14) (10)

-14 (-8) 18 (10)

84 (47) - 9 ( - 5) - 34 ( - 19) 84 (47) 1062 (845) 1483 (1079)

160 (89) 106 (59) - 34 ( - 19) 236 (131) 994 (807) 1572 (1129)

-

-

47 (26) N/A N/A 110 (61) 1272 (962) 1557 (1120)

a Application to a four-loop Westinghouse PWR for a cold-leg LBLOCA and using TRAC-PF1/MOD1, Version 14.3. b Numbers shown in parenthesis are PCT in K.

bias associated with dissolved NCG was analyzed and bounded. Third, a bias was taken for a code error, a nonconservative implementation of a heat transfer correlation that did not adequately represent scale effects. Fourth, a bias was taken by bounding ECC bypass effects to account for code correlations that did not adequately represent scale effects. Fifth, a bias was taken for steam binding effects because the code did not adequately model core entrainment processes. The two key contributors are the nonconservative implementation of the Forsland-Rohsenow correlation and steam binding effects. Each of these margins is related to code model and correlation defects and could be eliminated by improving the appropriate code models and correlations. The total uncertainty in PCT is obtained by adding the combined uncertainty by pdf and the additional separate biases described above. For the CSAU demonstration, the contributors to the total uncertainty are presented in table 1. From table 1 it can be seen that the mean and 95% probability PCTs, excluding separate biases, reach maximums during the blowdown, and lesser peaks are predicted for the first and second reflood peaks. After including the combined biases, the total mean PCT still occurs during blowdown. However, the total 95% probability PCT including the combined margins occurs during the second reflood peak and is 1572°F (1129 K). This shift in the peak to latter part of the LBLOCA transient is a reflection of the increasing uncertainty in PCT as time increases and the increasing

importance of several separate biases later in the transient. A related conclusion, then, is that it is important to consider the propagation of uncertainty through each phase of a transient rather than treating each phase independently.

5. Summary The commissioners of the NRC recently approved the final version of a revised rule for the acceptance of ECCS. The revised rule permits alternate ECCS performance analysis, based on BE methods, to be used provided the licensee quantifies the uncertainty of the estimates and includes that uncertainty when comparing the calculated results with prescribed acceptance limits. Under NRC sponsorship, a CSAU evaluation methodology has been defined and a demonstration completed for a Westinghouse four-loop PWR with 17 × 17 fuel. The demonstration considered a cold-leg LBLOCA and calculated the total uncertainty associated with use of the thermal-hydraulic systems code, TRACPF1/MOD1, Version 14.3. The demonstration effort showed that uncertainties in the complex phenomena occurring during accident conditions in NPPs can be quantified. The demonstrated methodology is auditable, traceable, and practical. The demonstration results confirm the existence of a significant margin in current plant operating conditions for the demonstration NPP.

14

B.E. Boyack et al. / Quantifying reactor safety margins - Part 1

Acknowledgments D e v e l o p m e n t a n d d e m o n s t r a t i o n of the C S A U evaluation m e t h o d o l o g y was a team effort b y the T P G m e m b e r a u t h o r s of this p a p e r a n d their co-workers at the participating institutions. T h e lead a u t h o r of this p a p e r wishes to acknowledge that m u c h of the i n f o r m a tion presented in this p a p e r was extracted from C S A U d o c u m e n t a t i o n p r e p a r e d b y other m e m b e r s of the T P G . In particular, the significant c o n t r i b u t i o n s by I d a h o N a t i o n a l Engineering L a b o r a t o r y staff m e m b e r s G.E. Wilson a n d K.R. K a t s m a are gratefully acknowledged.

References [1] Emergency Core Cooling Systems; Revisions to Acceptance Criteria, Federal Register 53 (180), pp. 35996-36005 (September 16, 1988). [2] B.W. Sheron and N. Zuber, Treatment of uncertainties in the regulatory process, Transactions of the American Nuclear Society, 56 (1988) 364-365. [31 G.E. Wilson et al., Quantifying reactor safety margins, Part 2: Characterization of important contributors to uncertainty, Nucl. Engrg. Des. 119 (1990) 17-31, next article in this issue. [4] W. Wulff et al., Quantifying reactor safety margin, Part 3: Assessment and ranging of parameters, Nucl. Engrg. Des. 119 (1990) 33-65, in this issue. [5] G.S. Lellouche et al., Quantifying reactor safety margins, Part 4: uncertainty evaluation of LBLOCA analysis based on TRAC-PF1/MOD1. Nucl. Engrg. Des 119 (1990) 6795, in this issue. [6] N. Zuber, G.E. Wilson et al., Quantifying reactor safety margins, Part 5: Evaluation of scale-up capabilities of best estimate codes, Nucl. Engrg. Des. 119 (1990) 97-107, in this issue. [7] I. Catton, R.B. Duffey, R.A. Shaw et al., Quantifying reactor safety margins, Part 6. A physically-based method of estimating LBLOCA PCT, Nucl. Engrg. Des. 119 (1990) 109-117, in this issue. [8] C.E. Slater and R.T. Jensen, LOCA/ECCS analysis-historical development of Appendix K and implementation of EM models, Electric Power Research Institute workshop on Appendix " K " Relief Using Best Estimate Methods: The Revised LOCA/ECCS Rule, Cambridge, Massachusetts (August 11-12, 1988). [9] R.K. House and S.P. Kalra, Interpretation of proposed LOCA/ECCS rule c h a n g e - Focus on requirements and options, Electric Power Research Institute workshop on Appendix " K " Relief Using Best Estimate Methods: The Revised L O C A / E C C S Rule, Cambridge, Massachusetts (August 11-12, 1988). [10] L.H. Sullivan, Uncertainty in LOCA analysis historical discussion, Los Alamos National, LA-UR-88-2631 (August 1988).

[11] 10 CFR Part 50, Acceptance C.riteria for Emergency Cooling Systems for Light-Water-Cooled Nuclear Power Plants, Federal Register 39 (3) (January 4, 1974). [12] R.E. Collingham, Impact of Appendix K on fuel designs. Electric Power Research Institute workshop on Appendix " K " Relief Using Best Estimate Methods: The Revised LOCA/ECCS Rule, Cambridge, Massachusetts (August 11-12, 1988). [13] R. Steiger, Extended B E / E M Study, Idaho National Engineering Laboratory letter STIG-177-77 (1977). [14] F.F. Cadek, L.E. Hochreiter, and M.Y. Young, Best estimate approach for effective plant operation and improved economy, Electric Power Research institute workshop on Appendix " K " Relief Using Best Estimate Methods: The Revised LOCA/ECCS Rule, Cambridge, Massachusetts (August 11-12, 1988). [15] G.L. Sozzi, On the development of new BWR LOCA models- Technology application and results, Electric Power Research Institute workshop on Appendix "K'" Relief Using Best Estimate Methods: The Revised LOCA/ECCS Rule, Cambridge, Massachusetts (August 11-12, 1988). [16] K. Cornwell, G. Sozzi, and B. Chexal, Basis for Relaxing ECCS Performance Requirements for BWR/4s, Electric Power Research Institute, NSAC-130 (September 1988). [17] N.E. Todreas, Chairman, CSAU Evaluation Methodology Peer Review Group, Massachusetts Institute of Technology, Private communication (February 24, 1988). [18] Advisory Committee Reactor Safeguards, Letter to L.W. Zech, USNRC (June 1988). [19] Technical Program Group, Quantifying Reactor Safety M a r g i n s - Application of CSAU Methodology to a LBLOCA, EG&G Idaho, Inc., NUREG/CR-5249 (December 1989). [20] R.A. Shaw, T.K. Larson, and R.K. Dimenna, Development of a Phenomena Identification and Ranking Table (PIRT) for Thermal-Hydraulic Phenomena During a PWR LBLOCA, EG&G Idaho, Inc., NUREG/CR-5074 (August 1988). [21] D.R. Liles, et al., TRAC-PF1/MODI: An Advanced Best Estimate Computer Program for PWR Thermal-Hydraulic Analysis, Los Alamos National Laboratory, N U R E G / CR-3858 (July 1986). [22] B.E. Boyack, H. Stumpf, and J.F. Lime, TRAC User's Guide, Los Alamos National Laboratory, N U R E G / C R 4442 (November 1985). [23] M.S. Sahota and F.L. Addessio, TRAC-PF1/MOD1 Developmental Assessment, Los Alamos National Laboratory, NUREG/CR-4278 (August 1985). [241 D.R. Liles, et al., TRAC-PF1/MOD1 Correlations and Models, Los Alamos National Laboratory, N U R E G / CR-5069 (December 1988). [25] W. Wulff, Uncertainties in Modeling and Scaling in the Prediction of Fuel Store Energy and Thermal Response, Brookhaven National Laboratory, N U R E G / C R - 5 2 3 2 (June 1988). [26] U.S. Rohatgi et al., Bias in Predicted PCT due to Uncer-

B.E. Boyack et al. / Quantifying reactor safety margins - Part 1

tainty in ECCS Bypass Modeling, Brookhaven National Laboratory, NUREG/CR-5254 (June 1989). [27] S. Levy, G. Lellouche, R, May, B.E. Boyack, R.B. Duffey, P. Griffith, K.R. Katsma, U.S. Rohatgi, G.E. Wilson, W. Wulff, and N. Zuber, Elements of uncertainty and mean-

ing of 95% probability level for Electric Power Research Institute "K" Relief Using Best Ultimate LOCA/ECCS Rule, Cambridge, 11-12, 1988).

15 LOCA/ECCS analysis, workshop on Appendix Methods: The Revised Massachusetts (August