Requirements for statistical safety demonstration for loss of coolant analyses

Nuclear Engineering and Design 354 (2019) 110143

Contents lists available at ScienceDirect

Nuclear Engineering and Design journal homepage: www.elsevier.com/locate/nucengdes

Requirements for statistical safety demonstration for loss of coolant analyses

T

Horst Glaeser Herbststr. 9, 85386 Eching, Germany

A R T I C LE I N FO

A B S T R A C T

Keywords: Deterministic safety analysis Statistical uncertainty analysis Regulatory acceptance criteria Number of code calculations Hot rod consideration Entire core consideration

During the recent years, an increasing interest in computational safety analysis of Nuclear Power Plants (NPPs) is to replace the conservative evaluation model calculations by best estimate calculations supplemented by uncertainty analysis of the code results. Conservative means unfavorable in the direction of regulatory acceptance limits. The evaluation of the margin to acceptance criteria, e.g. the maximum fuel rod cladding temperature, should be based on the upper limit of the calculated uncertainty range. Uncertainty analysis is needed if useful conclusions are to be obtained from “best estimate” thermal-hydraulic code calculations, otherwise single values of unknown accuracy would be presented for comparison with regulatory acceptance limits. Methods have been developed and presented to quantify the uncertainty of computer code results. The Gesellschaft für Anlagen- und Reaktorsicherheit mbH (GRS) in Germany has proposed a statistical method, propagating input uncertainties by computer code calculations to end up with output uncertainties of the calculated results. The basic techniques of that GRS-method are presented for calculating the peak cladding temperatures of the fuel rods in a reactor core and to compare with an acceptance limit to be met under any design basis accident. A comparison of necessary number of code calculations is provided using a penalized “hot rod”, or a significantly higher number of calculations when all high powered fuel rods are considered in the analysis when conditions of many fuel rods are very close to the most unfavorable fuel rod.

1. Introduction Each application for a nuclear power plant requires a safety analysis report to be presented to the Safety Authority. Different postulated events, like anticipated operational occurrences and accidents have to be addressed in such a report. In nuclear safety, this implies focusing on potential accident types, nuclear releases and consequences. A deterministic analysis does not consider the probabilities of different event sequences. The event sequences are deterministically postulated. Single numerical values for input parameters can be used in deterministic safety analysis. Such a calculation procedure leads to a single curve versus time for the result of an event. These single values for either “best estimate” or “conservative” values are based on expert judgement and knowledge of the phenomena being modelled. Conservative is a possible most unfavorable value with regard to applicable acceptance limits or acceptance criteria fixed by regulation. Different to deterministic analyses are probabilistic or stochastic assessments. Probabilistic Safety Assessment (PSA) is a comprehensive, structured approach to quantify the “chance of occurrence” of a system failure, i.e. to express probabilistically how reliable the system is. It constitutes a conceptual and mathematical tool for deriving numerical estimates of risk, e.g. of core damage.

Statistical uncertainty analysis propagates potential uncertain input parameters to uncertain output parameters by computer code calculations. The event sequences and failure assumptions, however, are deterministically fixed. Therefore, stochastic variability due to possible component failures of the power plant is not considered in such an uncertainty analysis discussed here. The single failure criterion, for example, is still taken into account in a deterministic way. This is a superior principle of deterministic safety analysis and requirements of redundancy. A single failure is defined as a failure which results in the loss of capability of an important system or component to perform its intended safety function, and any consequential failure which result from it. The single failure criterion is a requirement applied to a system such that it must be capable of performing its task in the presence of any single failure (IAEA, 2009). The probability of system failures is part of probabilistic safety analyses, not of demonstrating the effectiveness of Emergency Core Cooling (ECC) systems, for example. The demonstration of effectiveness of ECC systems has to fulfil deterministically fixed requirements. A sensitivity or importance analysis is a quantitative examination of how the behaviour of a system varies with change, usually in the values of the governing parameters. A common approach is the parameter variation, in which the variation of results is investigated for changes in

E-mail address: [email protected]. https://doi.org/10.1016/j.nucengdes.2019.06.005 Received 6 May 2019; Received in revised form 1 June 2019; Accepted 3 June 2019 Available online 18 June 2019 0029-5493/ © 2019 Published by Elsevier B.V.

Nuclear Engineering and Design 354 (2019) 110143

H. Glaeser

Symbols

m n N

fraction of fuel rods not meeting the acceptance criterion number of code calculation runs number of total fuel rods in the core, or fuel rods with the highest power or with the highest stored heat in the core p probability for no exceedance of the acceptance criterion P = m/n fraction of exceedance of the acceptance criterion Pu,95 upper 95% confidence limit for P Pl 95 lower 95% confidence limit for P Y(1…n) ordered output parameters of n calculation runs

a × 100 (%) probability (quantile) of output quantity or of the Fdistribution b × 100 (%) confidence level that the maximum code result will not be exceeded with the probability a × 100 (%) of the corresponding output distribution k1 = 2 m + 2 degree of freedom of the F-distribution k2 = 2n − 2m degree of freedom of the F-distribution

accident conditions in a simplified way only. These code models are based on experiments. Most of the experiments used for development and validation are performed in small scale compared to plant size. Uncertainty due to imprecise knowledge of parameter values in calculations are quantified by ranges and probability distributions. These distributions should be taken into account for input parameters instead of one discrete value only. A discussion came up in the German Reactor Safety Commission, panel of installations and systems, in the years 2013 through 2014 with regard to evaluate the maximum cladding temperature of the fuel rods in a core to compare with the applicable regulatory acceptance limit. The focus was on large break Loss Of Coolant Accidents (LOCA), because in such an event, the peak fuel rod cladding temperatures are getting closest to the regulatory acceptance limit which has not to be exceeded. The demonstration to meet the acceptance criterion can be performed by analysing a single penalized “hot rod” with the most unfavorable conditions of power, axial power shape and burn-up within a hot bundle. The “hot rod” shall meet the acceptance criterion, e.g. peak cladding temperature PCT ≤ 1200 °C with 95%/95% probability and statistical confidence. This demonstration takes into account that the other fuel rods have a lower probability exceeding the acceptance limit than the hot rod. Without penalty on one fuel rod, the criterion has not only to be fulfilled for the most real “unfavorable” fuel rod (without penalty) because conditions of many fuel rods can be very close to that most “unfavorable” fuel rod. The entire core fuel rods or at least a number of “unfavorable” fuel rods should be considered in the analysis. We distinguish if the population mean value or the 95% quantile value shall be

the value of one or more input parameters within a reasonable range around selected reference or mean values (IAEA, 2006). Best estimate computer codes are used to calculate postulated accidents and anticipated operational occurrences in a realistic and not in a conservative way. There is an increasing interest in computational safety analysis for nuclear power plants to replace the conservative evaluation model calculations by best estimate calculations supplemented by a quantitative uncertainty analysis. The USA Code of Federal Regulation (CFR) 10 CFR 50.46 (USNRC, 1996), for example, allows two approaches; either to use a best estimate code plus identification and quantification of uncertainties, or the conservative option using conservative assumptions and parameter values, and in the USA regulation conservative computer code models listed in Appendix K of the CFR. A number of uncertainty methodologies have been developed for best estimate and uncertainty analyses. An overview of these methods is contained in Glaeser (2017), Chapter 13.4, and comprehensive descriptions of several available methods can be found in reference IAEA (2008). The present paper describes the statistical uncertainty and sensitivity method proposed by GRS. The method is used worldwide now by many organizations, including for licensing applications. Other analysts interested to use that method are asking for more details of the statistical background, which is provided in this paper. Code predictions are uncertain due to several sources of uncertainty, like code models as well as uncertainties of plant and fuel parameters. These uncertainties, for example, come from scatter of measured values, approximations of modelling, variation and imprecise knowledge of initial and boundary conditions. Computer code models are developed which can simulate the complex behaviour of a power plant under

Fig. 1. Emergency core cooling criteria, old and new database (USNRC, 1988; Teschendorff et al., 2009). 2

Nuclear Engineering and Design 354 (2019) 110143

H. Glaeser

compared with the acceptance criterion. That decides the number of calculations to be performed which is significantly higher than using a “hot rod”. The German Reactor Safety Commission recommends that the criterion shall not be exceeded by more than one fuel rod of the core with 95% probability and 95% confidence (RSK, 2015).

central part of the method is a set of statistical techniques. The advantage of using these techniques is that the number of code calculations needed is independent of the number of uncertain input or output parameters. In each code calculation, all uncertain parameters are varied simultaneously. In order to quantify the effect of these variations on the result, statistical tools are used. Because the number of calculations is independent of the number of uncertain parameters, no a priori ranking of input parameters is necessary to reduce their number in order to cut computation cost. The ranking is a result of the analysis as described later. The probabilistic treatment of parameter uncertainties allows quantifying their state of knowledge. This means, in addition to the uncertainty range, the knowledge is expressed by probability density functions or probability distributions. This interpretation of probability is used for a parameter with a fixed but unknown or inaccurately known value. The classical interpretation of probability as the limit of a relative frequency, expressing the uncertainty due to stochastic variability, is not applicable here. The probability distribution can express that some parameter values in the uncertainty range are more likely. In the case that no preferences can be justified, uniform distribution are specified, i.e. each value between minimum and maximum is equally likely to be the appropriate parameter value. As the consequence of this specification of probability distributions of input parameters, the computer code results also show a probability distribution, from which uncertainty limits or intervals are derived. The input uncertainties should be applied for the steady state start calculation and the following transient calculation. An example for uncertainty ranges is presented now. In the frame of an international comparison of applications of uncertainty analyses, the OECD/NEA/CSNI Best Estimate Methods – Uncertainty and Sensitivity Evaluation (BEMUSE), it was agreed to provide common information about geometry, core power distribution and other data. In addition, a list of common input parameters with its uncertainty was prepared in NEA (2009). The teams of Commissariat à l’Energie Atomique, France (CEA), GRS, Germany and Universitat Politècnica de Catalunya, Spain (UPC) prepared this list of common uncertain input parameters with their distribution type and range for the nuclear power plant Zion PWR with postulated 2 × 100% cold leg break of the main coolant pipe. These parameters were strongly recommended to be used in the uncertainty analysis when a statistical approach was followed. Not all participants used all proposed parameters. On the other hand, some considered only these given parameters without any computer code model uncertainty. These model uncertainties were not provided because the participants used different codes. Table 1 shows the list. Input uncertainties of the code models can be derived inversely from output magnitudes compared with experimental results to inputs (Glaeser et al., 2001, 2005; NEA, 2017). More information is gained by validation of the codes, calculating experiments simulating specific courses of events. In order to get sufficiently representative ranges and

2. Acceptance limit 1200 °C maximum fuel cladding temperature for loss of coolant accidents The historical database from the 1960-ies years has been the basis to determine the acceptance limits in case of a loss of coolant accident for maximum fuel cladding temperature 1200 °C and maximum oxidation of fuel-cladding thickness 17%. These limits are shown in Fig. 1 (USNRC, 1988; Teschendorff et al., 2009). In spite of extensive experimental programs regarding fuel rod behaviour afterwards, these limits are still in place. With the introduction of Niobium content for corrosion persistent materials, developed especially for high burn-up and long operating time, new experiments have been performed. The results are to be considered differently but are introduced simplified in Fig. 1 to compare with the historical database. The old limits are questionable under certain conditions. Further possible changes of these criteria are described in USNRC (2018). A quantification of uncertainties or conservative bounding approaches are required in order to demonstrate that the acceptance limits are met. The quantification of uncertainties applying statistical approaches is described below. 3. Description of the statistical GRS method 3.1. Aim The aim of the GRS uncertainty analysis is at first to identify and quantify all potentially important uncertain parameters. Their propagation through computer code calculations provides probability distributions and ranges for the code results. The evaluation of the margin to acceptance criteria, e.g. the maximum fuel rod cladding temperature, should be based on the upper limit of this distribution for the calculated temperatures, for example, Fig. 2. Uncertainty analysis is needed if useful conclusions are to be obtained from “best estimate” thermalhydraulic computer code calculations, otherwise single values of unknown accuracy would be presented for comparison with limits for acceptance. 3.2. Determination of input uncertainties Among others, the GRS method (Hofer, 1993) has been developed for the determination of uncertainties and has been applied for thermalhydraulic calculations, e.g. (Glaeser, 2008; Glaeser et al., 2001, 2005; IAEA, 2008). Ranges and probability distributions, Fig. 3, describe the state of knowledge about all uncertain parameters. In order to get information about the uncertainty of computer code results, a number of code runs have to be performed. For each of these calculation runs, all identified uncertain parameters are varied simultaneously. Uncertain parameters are uncertain input values, models, initial and boundary conditions, numerical values like convergence criteria and maximum time step size, etc. Model uncertainties are expressed by adding on or multiplying correlations by corrective terms, or by a set of alternative model formulations. Uncertainties in geometric discretization (nodalization), to describe the important physical phenomena, are to be taken into account in the code validation process. However, alternative nodalization schemes can also be included in the uncertainty analysis. Code validation results are a fundamental basis to quantify parameter uncertainties of code models. The selection of parameter values according to their specified probability distributions, their combination and the evaluation of the calculation results requires a method. Following a proposal by GRS, the

Fig. 2. Margin illustration. 3

Nuclear Engineering and Design 354 (2019) 110143

H. Glaeser

Temperature

Time

System Model Parameter values

Model results Submodels

Temperature PDF

Time

System Model Parameter value distributions

Model result distributions Submodels

Fig. 3. Consideration of input parameter value range instead of discrete values in the GRS Method.

tolerance intervals the formula is:

distributions of model input parameters, a suitable number of experiments should be considered for deriving the input uncertainties. The very well-known Best Estimate Plus Uncertainty (BEPU) framework like the CSAU (Boyack et al., 1990), or the Evaluation Model Development and Assessment Process (EMDAP) (USNRC, 2005) should be taken into account in the task. Two issues are important here (Glaeser, 2017, Section 13.4.3.3):

1 − an − n(1−a)an−1 ≥ b Some minimum numbers of calculations show Table 2. 3.4. Determination of tolerance limits of calculated results The GRS uncertainty method statistically combines uncertainties for plant conditions and code models to establish, with a specified high probability, that the calculated results do not exceed the acceptance criteria. It is common practice to require that assurance be provided of a 95% or greater probability that the applicable acceptance criteria for a plant will not be exceeded (USNRC, 1989; IAEA, 2009; BMU, 2015; KTA, 2012). A probability of 100% (i.e. certainty) cannot be achieved statistically because only a limited number of calculations can be performed. The 95% probability level is selected primarily to be consistent with standard engineering practice in regulatory matters. Some parameters, such as the departure from nucleate boiling ratio in Pressurized Water Reactors (PWRs) or the critical power ratio in Boiling Water Reactors (BWRs), have been found to be acceptable at the 95% probability level. The 95% quantile (percentile) of a probability distribution states, which result will not be exceeded with a probability of 95%. The confidence level 95% denominates that the 95% quantile is over-estimated conservatively with 95% probability by the 95%/95% tolerance limit. According to Table 2, in order to achieve a 95%/95% one-sided statistical tolerance limit, at least 59 calculations are necessary. For a two-sided statistical tolerance limit or interval, at least 93 calculations are required.

• A strategy to collect experimental database for code model input uncertainty evaluation • Combine results of input uncertainty quantification from several relevant experiments.

3.3. Number of code runs The number of code calculations depends on the requested probability content and confidence level of the statistical tolerance limits used in the uncertainty statements of the results. The required minimum number n of these calculation runs gives Wilks’ formula (Wilks, 1941; Wilks, 1942), e.g. for one-sided tolerance limits:

1 − an ≥ b, where b × 100 is the confidence level (%) that the maximum code result will not be exceeded with the probability a × 100 (%) (quantile) of the corresponding output distribution, which is to be compared to the acceptance criterion. The confidence level is specified to account for the possible influence of the sampling error because the statements are obtained from a random sample of limited size. For two-sided statistical 4

Initial core power Peaking factor (power of the hot rod) Hot gap size (whole core except hot rod) Hot gap size (hot rod) Power after scram UO2 conductivity

5 [−10; +10] cm [−0.1; +0.1] MPa [0.5; 2] [0.96; 1.04] [−2; +2] K [Tcold ; Tcold + 10 K]

Initial level Initial pressure Friction form loss in the surge line

Initial intact loop mass flow rate Initial intact loop cold leg temperature

Initial upper-head mean temperature

Pressurizer

Initial conditions: primary system

[−0.2; +0.2] MPa [0.5; 2.0] [−10; +10] °C [0.95; 1.05]

Initial accumulator pressure Friction form loss in the accumulator line Accumulators initial liquid temperature Flow characteristic of LPIS

Data related to injections

[0.98; 1.0.02] [0.9; 1.1]

Rotation speed after break for intact loops Rotation speed after break for broken loop

Pump behaviour

UO2 specific heat

[0.85, 1.15]

Containment pressure

Flow rate at the break

Fuel thermal behaviour

[0.98; 1.02] [0.95; 1.05] [0.8; 1.2] [0.8; 1.2] [0.92; 1.08] [0.9, 1.1] (Tfuel < 2000 K) [0.8,1.2] (Tfuel > 2000 K) [0.98, 1.02] (Tfuel < 1800 K) [0.87, 1.13] (Tfuel > 1800 K)

Imposed range of variation

Parameter

Phenomenon

Uniform

Normal Normal

Normal Normal Log-normal

Normal Log-normal Normal Normal

Multiplier. This parameter can be changed through the pump speed or through pressure losses in the system. This parameter can be changed through the secondary pressure, heat transfer coefficient or area in the Utubes. This parameter refers to the “mean temperature” of the volumes of the upper plenum

Multiplier

Multiplier

Multiplier

Multiplier Multiplier

Multiplier. Uncertainty depends on temperature

Normal Normal Normal

Multiplier affecting both nominal power and the power after scram Multiplier Multiplier. Includes uncertainty on gap and cladding conductivities Multiplier. Includes uncertainty on gap and cladding conductivities Multiplier Multiplier. Uncertainty depends on temperature

Multiplier

Comments

Normal Normal Normal Normal Normal Normal

Uniform

Type of pdf

Table 1 Example of common input parameters associated with uncertainty, range of variation and type of probability density function for a large break loss of coolant accident, taken from NEA (2009).

H. Glaeser

Nuclear Engineering and Design 354 (2019) 110143

Nuclear Engineering and Design 354 (2019) 110143

H. Glaeser

Table 2 Minimum number of calculations n for one-sided and two-sided statistical tolerance limits. One-sided statistical tolerance limits

b = 0.90 b = 0.95 b = 0.99

Two-sided statistical tolerance limits

a = 0.90

a = 0.95

a = 0.99

a = 0.90

a = 0.95

a = 0.99

22 29 44

45 59 90

230 299 459

38 46 64

77 93 130

388 473 662

3.5. More than one acceptance limit or criterion

A total number of n code runs is performed varying simultaneously the values of all uncertain input parameters, according to their distribution. For each instant of time, the n values of the considered output parameters are ordered. Such an approach is called “order statistics”:

In order to meet more than one regulatory acceptance criterion or limit, the question arises if the number of calculations have to be increased. Wald (1943) extended Wilks’ formula for multi-dimensional joint/simultaneous tolerance limits or intervals. However, it seems that a direct and satisfactory extension of the concept of tolerance limits for safety-relevant applications in nuclear safety is difficult, and even not necessary. A slightly modified concept has therefore been proposed by Krzykacz-Hausmann from GRS, introducing a lower confidence limit for conformance with the acceptance criterion. The lower confidence limit according to Clopper-Pearson (Brown et al., 2001) for the binomial parameter is now the unknown probability that a result is lower than a regulatory acceptance limit. Instead of direct joint tolerance limits for the outputs of interest, one considers the lower confidence limit for the probability of “complying with the safety limits for all outputs”, i.e. “meeting the regulatory acceptance criteria”. Basis is that both of the following statements are equivalent:

Y(1) < Y(2)… < Y( n− 1) < Y(n) Based on that ordering and based on the number of calculations, the tolerance limits are obtained with a confidence level of 95% by selecting the values from Table 3. These selections of values of output parameters for the tolerance limits need no information about the distribution of the calculated results. Therefore, the method is also called “distribution-free”. However, the empirical distribution can be considered, like skewed or symmetric, in order to have an additional information about meeting an acceptance limit. In order to understand the 95%/95% upper tolerance limit, for example, we assume a range of values between 0 and 1 of uniform distribution. We want to determine the 95% value out of a sample of 100 values from that range between 0 and 1. These 100 values are randomly selected, not selected from equal distance. These randomly selected values are ordered according to increasing values from 0 to 1. We select the 95th value out of these 100 values between 0 and 1. The random selection of 100 values is performed 1000 times, and we pick 10,000 times the 95th value. The result is the 95% quantile of the produced empirical distribution, see Fig. 4. In this case, we know the true value of the 95% quantile. Our selected 1000 values of the 95th values are scattered around the true 95% quantile. When we want to determine the 95%/95% tolerance limit, we have to use the (n-1) value, i.e. the 99th value from 100 values instead of the 95th value. That selection follows Table 3, when we have a sample size between 93 and 124. These 1000 selections of the 99th values are shown by the yellow dots in Fig. 4. Consequently, we overestimate the true 95% quantile by 95%. That is the second 95% of a 95%/95% upper tolerance limit, defined as the confidence level. The confidence level is specified to account for the possible influence of the sampling error due to the fact that the statements are obtained from a random sample of limited size. Apart from this simple example, in the case of demonstrating if a regulatory acceptance limit is satisfied by safety analysis, we do not know the true 95% value. We need to estimate this value using validated computer codes with mathematical models to determine the 95%/95% tolerance limit of the calculated results to compare with the acceptance limit. As already stated, the 95%/ 95% tolerance limits obtained by order statistics according to Wilks’ formula, overestimate the 95% quantile or percentile conservatively by 95%. One measure to reduce that “conservatism” and the scatter of results of the tolerance limit is to increase the number of calculations, i.e. increase the order of Wilks’ formula, Fig. 5. This is a statistical convergence theorem. Another way is to assume a distribution of the output variable, e.g. normal distribution and to check such a distribution by a suitable statistical test. In these cases, one can obtain less conservative bounds with the same number of calculations, or the same “conservatism” with a lower number of calculations.

1. The Wilks’ (probability a = 95% and confidence b = 95%) limit for the results is below the regulatory acceptance limit. 2. The lower b = 95% confidence limit for the probability that the value of the result stays below the regulatory acceptance limit is greater or equal a = 95%. The regulatory acceptance limits are incorporated into the probabilistic statements. It turns out that (1) in the one-dimensional case, i.e. for a single output parameter, is this concept equivalent to the one-sided upper tolerance limit concept. (2) the necessary number of model runs is also the same in the general case, i.e. independent of the number of outputs or criteria involved and of the type of interrelationships between these outputs or criteria. Therefore, the number of necessary model runs is the same as in the one-dimensional tolerance limit case, even if several output parameters are involved. In the one-dimensional case, the lower 95% confidence limit for the probability of “complying with the regulatory limit” corresponds to the two-step procedure: (1) compute the tolerance limit as usual and (2) compare this tolerance limit with the given regulatory limit. In other words: The statement “there is a 95% confidence that the

Table 3 Selection of values out of the ordered values for a tolerance limit.

6

Number of code runs

One-sided 95% quantile tolerance limit

One sided 5% quantile tolerance limit

Two-sided 95% quantile tolerance interval

59 93 124 153 181 …

Y(n) Y(n−1) Y(n−2) Y(n−3) Y(n−4) …

Y(1) Y(2) Y(3) Y(4) Y(5) …

– Y(1) Y(1) Y(2) Y(3) …

and and and and

Y(n) Y(n) Y(n−1) Y(n−2)

Nuclear Engineering and Design 354 (2019) 110143

H. Glaeser

1000 samples of 100 runs each from uniform distribution [0,1] 1

Upper (95%/95%) tolerance limit

0,98

0,96 95%-quantile (true value) 0,94 95% quantile of empiric distribution

0,92

0,9

0,88

0,86

0,84 0

100

200

300

400

500

600

700

800

900

1000

Fig. 4. Upper (95%/95%) tolerance limit compared with true 95% quantile and 95% quantile of empiric distribution.

the ranking is a result of the analysis, and not of prior estimates and judgements. This prior set-up of a Phenomena Identification and Ranking Table (PIRT) by extensive expert staff-hours in Boyack et al. (1990) is known to be very costly. Uncertainty statements and sensitivity measures are available simultaneously for all single-valued (e.g. peak cladding temperature) as well as continuous valued (time dependent) output quantities of interest from the same variation of input parameters and code calculations. The method relies only on actual code calculations without using approximations like fitted response surfaces. The different steps of the uncertainty analysis are supported by the software system SUSA (Software System for Uncertainty and Sensitivity Analyses) developed by GRS (Kloos and Hofer, 1999). A choice of statistical tools is available during the uncertainty and sensitivity analysis. 4. GRS-method with consideration of a hot rod

Fig. 5. Statistical convergence of a 95%/95% tolerance limit, or decreasing “conservatism” with increasing number of calculation runs, shown as probability distributions.

A hot channel usually represents a fuel bundle with high power. A hot rod in that bundle bounds the fuel rods with the highest rod power or the rod with the highest stored heat. The safety demonstration uses a penalized single fuel rod with conservative conditions, especially for radial power factor, axial power shape and peak linear heat generation rate (single hot rod). When the acceptance criterion is met with 95% probability and 95% confidence for that hot rod, it is assumed that the acceptance criterion is also met for all real fuel rods in the core. That means the probability of any real fuel rod exceeding the acceptance limit is negligible. The value for the power factor of the hot rod in the hot channel is not varied in an uncertainty analysis. The total initial core power for a German PWR is varied in the GRS calculations between 100% and 106%. The upper bound of initial power is 106% that comes from 103 + 3% according to the power control system plus measurement and calibration errors of ± 3%. The 103% core power is the most unfavorable condition, which may occur under normal operation taking into account the set-points of the control system in integral power and power density. That follows a recommendation of the German Reactor Safety Commission RSK (2005). In April 2015, the RSK stated that one could deviate from the most unfavorable conditions for power and

probability of “complying with the regulatory limit xreg exceeds 95%” is equivalent to the statement “the computed 95%/95% tolerance limit xTL lies below the regulatory limit xreg”. In the multi-dimensional case, there is no such direct correspondence or equivalence. 3.6. Sensitivity or importance measures Another important feature of the method is that one can evaluate sensitivity measures of the importance of parameter uncertainties for the uncertainties of the results. These measures give a ranking of input parameters. This information provides guidance as to where to improve the state of knowledge in order to reduce the output uncertainties most effectively, or where to improve the modelling of the computer code. Sensitivity measures like Standardized Rank Regression Coefficients, Rank Correlation Coefficients and Correlation Ratios permit a ranking of uncertainties in model formulations and input data, etc. with respect to their relative contribution to code output uncertainty. The difference to other known uncertainty methods, e.g. Boyack et al. (1990), is that 7

Nuclear Engineering and Design 354 (2019) 110143

H. Glaeser

generation rate and total core power are different devices at different locations. Even when the LOCA limit will not be reached during operation, this value is supposed to be taken into account in the uncertainty range for a safety analysis (RSK, 2015). Main objective of the application of deterministic LOCA analyses using statistical methods is to quantify and assess clearly the impact of variations of uncertain parameter values and their combinations on the results of an analysis. The parameter values are different, like gap width, fuel and gap heat conductivity, power history etc. for some fuel rods, and other uncertain parameters influence the hydraulic and thermal conditions of the coolant flow. The fuel rods are filled with helium; it has the best heat conduction of noble gases. The fraction of xenon and krypton increase with burn-up and leads to a decrease of heat conduction. The gap width between fuel pellets and cladding changes with burn-up due to opposite effects, like crack formation of the fuel, post-densification of the pellets and volume increase of the pellets. Expansion due to changes of temperature during an accident or event should be calculated. Such models need the gap

power density when criteria are fulfilled for the entirety of fuel rods (RSK, 2015). Set-points for power control limits, however, shall still be considered in the distributions of parameter values. Consequently, the lower range of initial reactor power could be lowered to 94% (97% lower bound of core power due to power control system and −3% measurement error). That extension of the range to the lower side, however, would not have a significant influence on the upper bound of calculated cladding temperatures due to the procedure to evaluate the 95%/95% one sided tolerance limit, see Section 3.4. The initial power has a significant influence on the maximum cladding temperature, what was the result of earlier performed uncertainty and sensitivity analyses using the GRS Method (IAEA, 2008; Glaeser, 2008; Glaeser et al., 2005; NEA, 2009, 2011). The value for the peak linear heat generation rate in the calculation is taken from the maximum LOCA (Loss Of Coolant Accident) limit of the core detectors limiting the peak linear heat generation rate plus measurement errors, and an extra margin taking into account that the measurement device is eventually not at the location of the highest local power. The measurements of linear heat

Fig. 6. Two possible distributions of calculation results to be compared with an acceptance limit. 8

Nuclear Engineering and Design 354 (2019) 110143

H. Glaeser

unfavorable fuel rod. Not more than one fuel rod shall exceed the limit in that case. Consequently, the number of calculations is increasing. The same would apply for a conservative approach when not a single hot rod but the entire fuel rods with high power are to be considered. In order to limit the number of calculations, one can pre-select a number of high-powered fuel rods. That selection is based on calculation results of the conditions of the fuel rods before LOCA or engineering assessments. It will be shown by two cases, how meeting the acceptance criterion can be demonstrated for either a random selection out of a number of the high power fuel rods, e.g. for 5% fuel rods in the core with the highest power or with the highest stored heat. The 59 calculations for a random selection of only one not penalised high power fuel rod would not be sufficient to determine the 95%/95% upper tolerance limit and to demonstrate conformance with the acceptance criterion. One should decide if the population mean value or the 95% quantile of the hot rods should be compared with the acceptance criterion.

width at room temperature dependent on burn-up and composition of fission gas as input parameters, for example. Further uncertainties due to insufficient knowledge of different contributions sum up to the total uncertainty of computer code results:

• Uncertainties of calculation models of the computer code by ap-

•

proximations of the conservation and constitutive equations. Not all interactions between steam and water are completely described. Average values over the flow cross section instead of velocity and temperature profiles and further approximations are used. Missing information has to be provided by the code user. More model uncertainties may come through simulation of three-dimensional effects by one-dimensional calculations. These uncertainties are to be determined by comparison with experimental results. Imprecise knowledge of conditions of the plant, like initial values of pressure, temperature, mass flow rate, status of fuel rod, decay heat as well as measurement and calibration error. The size of flow paths is partly not precisely known, like bypass flows in the reactor vessel.

Case 1:. The mathematical expectation value or population mean is used to check meeting the acceptance criterion.

The one-sided 95%/95% upper tolerance limit is determined by varying the selected parameters within the determined ranges and distributions. The required number of calculations is given by Wilks’ formula, e.g. 59 calculation runs, see Sections 3.3 and 3.4. The upper tolerance limit denominates the value of the maximum cladding temperature that will not be exceeded with 95% probability and 95% confidence. The distance of the 95%/95% upper tolerance limit to the acceptance limit 1200 °C is defined as licensing margin. The demonstration of conformance to the acceptance limits applies to possible values of the maximum cladding temperature of the hot rod because that hot rod is leading with regard to the fuel parameters, and consequently, to the maximum cladding temperature. The statement does not denominate a fraction of fuel rods, e.g. 95% of the fuel rod cladding temperatures are below the acceptance limit 1200 °C. Performing a statistical demonstration to meet the acceptance limits, one should keep in mind to select parameter combinations of physical consistent data under consideration of existing dependences, e.g. on burn-up. When the upper tolerance limit approaches regulatory acceptance criteria, e.g. 1200 °C PCT, the number of code runs may be increased to 150 or 200 calculations instead of the 59 code runs needed, using Wilks’ formula at the first order for the estimation of a 95% one-sided tolerance limit with a confidence level of 95% (NEA, 2011). This would be advisable for two reasons:

The expected number of fuel rods exceeding the acceptance limit shall be not more than one fuel rod with at least 95% statistical confidence. This is similar to the requirement of the fuel rod design for normal operation (specified normal operation, undisturbed condition) and anticipated operational occurrences (specified normal operation, incident). We distinguish meeting the acceptance criterion or not. The fraction of fuel rods not meeting the criterion is m, and n is the number of samples or, in our case, calculations to determine if the acceptance criterion is satisfied or not. We define the fraction of exceedance of the acceptance criterion P = m/n, and we assume the total number of fuel rods in the core is 45500. If we use a binomial distribution, e.g. the Fdistribution, we obtain for the upper 95% confidence limit for P (Hofer, 2003):

Pu,95 = ( m+ 1) a/[( m+ 1) a+ n− m] with “a” as 95% quantile of the F-distribution with the degrees of freedom k1 = 2 m + 2 and k2 = 2n − 2m. The value for a can be obtained from tables in each statistics handbook, e.g. Hays, 1981. When the expected number of fuel rods m exceeding the acceptance limit shall be not more than one fuel rod with at least 95% statistical confidence, then is with m = 0

Pu,95 = a/( a+ n) = ! 1/45500

1) With increasing sample size the uncertainty results will be less dispersed, and consequently more converged (less conservative), and 2) The sensitivity results will be more reliable.

With a = 3 (with k1 = 2, k2 = 91100 from the table in Hays, 1981) and m = 0, one obtains for the necessary number of calculations

n= (3 × 45500) − 3 = 136497 ∼ 3 × 45500 The probability for no exceedance of the acceptance criterion for these 45,500 fuel rods is (Hofer, 2003)

On the other hand, empirical distributions of the calculation results can be obtained to assess meeting acceptance limits with regard to the tendency of these distributions. The empirical distribution is not of interest for determining the tolerance limit. However, one can observe if the distribution is symmetric, or skewed to one side, left or right, towards to or away from the acceptance limit, see for example Fig. 6. Such distributions allow to check meeting acceptance limits if the tolerance limit is approaching the acceptance limit.

p= (1 − 1/45500) 45500 = 0.368, and at most one exceedance:

p= 45500 (1/45500)(1 − 1/45500) 45499 + (1 − 1/45500) 45500 = 0.736 Even if one considers a subset of only 5% high power fuel rods of the total core, i.e. 2275 fuel rods, it is necessary to perform the calculations for these 2275 fuel rods 3 times, i.e. 6825 calculations. This number of calculations is still very high. The acceptance limit for peak cladding temperature shall be 1200 °C. The acceptance criterion exceeded by not more than one fuel rod is fulfilled for these 2300 fuel rods with only 73.6% probability or more with 95% confidence. The mathematical expectation value for the number of fuel rods fulfilling the criterion is not exceeding one fuel rod. That is approximately equivalent to the determination of the (beta %, 95%) tolerance limit for the maximum cladding temperature of the average high power

5. GRS-Method without “hot rod” In the case when not one hot rod but all fuel rods are considered in the analysis, the acceptance criterion has to be fulfilled with 95% probability and 95% confidence for the entire core fuel rods, especially with a core load of rather uniform power distribution of the fuel rods. Without penalty on one fuel rod, the criterion can no more only be fulfilled for the most real unfavorable fuel rod (without penalty) because conditions of many fuel rods can be very close to the most 9

Nuclear Engineering and Design 354 (2019) 110143

H. Glaeser

non-LOCA of pressurized water reactors (PWRs) and one accident of a boiling water reactor (BWR), as well as related experiments. For these analyses, we used the thermal-hydraulic computer code ATHLET (Lerchl and Austregesilo, 2000). All these analyses have been performed using a hot rod, described in Section 4, in order to perform a reasonable number of calculations:

fuel rod, where beta = 99.9565% for the 2300 high power fuel rods. Beta is obtained from the sum of Bernoulli values (Kloos, 2014)

p= 1/N

∑ pi =

(Πpi )1/N

with ᴨpi > = 0.368 for independent fuel rod behaviour and number of high power rods N = 2300. In order to have a homogeneous regulatory framework, we would need to fix the 95% quantile. In order to fulfil the requirement with 95% statistical confidence and 95% probability that not more than one fuel rod is above the acceptance limit, one should perform 9 × N calculation runs, see Table 4. That requirement will apply according to the last recommendation of the German Reactor Safety Commission when no hot rod is used in the analysis (RSK, 2015).

1) Separate effects experiment OMEGA Test 9 2) Integral experiment LSTF-CL-18, 5% cold leg break, accumulator injection into cold legs 3) PWR 5% cold leg break, accumulator injection into hot legs (Siemens/ KWU reactor) 4) Integral experiment LOFT L2-5, 2 × 100% cold leg break, accumulator injection into cold legs 5) PWR 2 × 100% cold leg break, combined ECC injection into cold and hot legs 6) Integral experiment ROSA/LSTF SB-PV-09 small break of upper head (scenario: NPP Davis-Besse reactor vessel head degradation at control rod drive nozzle) 7) PWR 10% steam line break 8) PSB-VVER 11% upper plenum break experiment, UP-11-08 (OECD PSB-VVER Test1) 9) Loviisa-1 VVER-440 NPP load drop transient (anticipated operational occurrence) 10) BWR-69 turbine trip, no turbine bypass, additional ATWS 11) AP1000 double ended DVI line break with one ADS-4 valve failure 12) Integral experiment ATLAS 50%-DVI-line break (ISP-50) 13) Zion PWR, 2 × 100% cold leg break (in the frame of the OECD/ NEA/CSNI BEMUSE project) 14) FEBA and PERICLES heater rod bundle tests (in the frame of the OECD/NEA/CSNI PREMIUM project).

Case 2:. The 95% quantile is used to check meeting the acceptance criterion. The request is with statistical confidence of 95% that no exceedance of the acceptance limit occurs for all 45,500 fuel rods with probability of at least 95%. The necessary number of calculations for demonstration is obtained from the lower 95% confidence limit for the probability not to calculate an exceedance of the acceptance limit (Hofer, 2003):

PL,95 = 1 − Pu,95 = [1 − ( m+ 1)a/( m+ 1) a+ n−m]45500 = [1 − 3.00/(3.00 + n)]45500 = !0.95 with a = 3 (with k1 = 2, k2 > = 91,100 from the table in Hays, 1981) and with m = 0, one obtains for the necessary number of calculations: [1–3.00/(3.00 + n)] = (0.95)1/45500 n = −3.00/[(0.95)1/45500 – 1] − 3.00 n = 2661164 = 58.5 × 45500 That means, the number of total fuel rods should be calculated 59 times. If one selects a subset of only 5% highest power fuel rods, one should perform 59 × 2275 = 134,225 calculations. The calculated maximum cladding temperature shall be below the acceptance limit of 1200 °C for each fuel rod. In that case, the probability that all 2275 high power fuel rods fulfil the acceptance criterion is at least 95% with statistical confidence 95%. That is approximately equivalent to the determination of the (beta %, 95%) tolerance limit for the maximum cladding temperature of the average high power fuel rod, where beta = 99.9978% for the 2300 high power fuel rods with ᴨpi > = 0.95. We conclude the regulatory requirements usually deal with a statistical confidence that the probability is at least 95% that not more than k fuel rods of a core are above an acceptance limit. The following Table 4 lists the minimum number of calculations to demonstrate possible requirements for the number of non-conforming fuel rods. This is valid for a statistical confidence of at least 95%. The minimum number of calculations presumes that in all calculations no fuel rod is above the acceptance limit. That is necessary for all listed requirements in Table 4. One should keep in mind that a prudent sensitivity analysis and comparison of the distance or eventual exceedance of the acceptance limit can reduce the effort of calculations even when the entire fuel rods or a subset of fuel rods is included in the calculations of the uncertainty analysis. The models in a computer code should be sufficiently validated to give reliable results varying important parameter values.

Some of these applications can be found in Annex II of reference IAEA (2008). Results of applications 2), 3), 4), and 5) are presented there, 5) also in reference Glaeser (2008). Results of application 13) are shown in references NEA (2009) and Glaeser (2017), Section 13.3.3.3.

7. Conclusions A description of the uncertainty method proposed by GRS is presented. A significant advantage of this methodology is that no a priori reduction in the number of uncertain input parameters by expert judgement or screening calculations is necessary to limit the calculation effort. All potentially important parameters may be included in the uncertainty analysis. The method accounts for the combined influence of all identified input uncertainties on the results. This would be difficult or even impossible to achieve by a priori expert judgement of postulated anticipated operational occurrences and accidents. The number of calculations needed is independent of the number of uncertain parameters accounted for in the analysis. The number does depend on the requested tolerance limits, i.e. the requested probability Table 4 Minimum number of calculations to demonstrate possible probability requirements with a statistical confidence of at least 95%.

6. Applications The GRS method for uncertainty and sensitivity evaluation of code results can be used for different codes to investigate the combined influence of all potentially important uncertainties on the calculation results. Several applications have been performed by GRS to LOCA and 10

Requirements

Minimum number of calculations: N = number of fuel rods in the core (e.g. N = 45,500), or selection of high power fuel rods N

Mathematical expectation value ≤1 95%-quantile ≤3 95%-quantile ≤2 95%-quantile ≤1 95%-quantile = 0

∼3 * N ∼ ∼ ∼ ∼

2.2 * N 3.7 * N 8.5 * N 58.5 * N

Nuclear Engineering and Design 354 (2019) 110143

H. Glaeser

and sensitivity analyses using the GRS Method (IAEA, 2008; Glaeser, 2008; Glaeser et al., 2005; NEA, 2009, 2011) or from Boyack et al. (1990), Section 2, for example. A challenge in performing uncertainty analyses is the specification of ranges and probability distributions of input parameters. All the calculations performed in an uncertainty and sensitivity analysis are based on these ranges, and therefore are highly important. Investigations are underway to transform data measured in experiments and post-test calculations into thermal-hydraulic model parameters with uncertainties. Care must be taken to select suitable experimental and analytical information to specify uncertainty distributions. This is a general experience applying different uncertainty methods. An important basis to determine code model uncertainties is the experience from code validation. Experts performing the validation mainly provide the necessary information. Appropriate experimental data are needed. More effort, specific procedures and judgement should be focused on the determination of input uncertainties. The before mentioned importance of ranges and probability distributions refer to the statistical uncertainty and sensitivity method proposed by GRS, propagating input uncertainties to end up with output uncertainties of the calculated results. A different uncertainty method developed and applied by University of Pisa, the UMAE/CIAU extrapolates output uncertainties instead of propagating input uncertainties (D'Auria and Giannotti, 2000). It is based on accuracy extrapolation and a code with the capability of internal assessment of uncertainty. The method needs available qualified experimental data to compare with calculated results and extrapolate the deviations to real plants. However, the amount of needed data for the different fuel conditions in the core are not available. Consequently, analyzing a single penalized “hot rod” with the most unfavorable conditions is necessary as described before. Without penalty on one fuel rod, this method also would require more calculations when the entire fuel rods or those with highest power or highest stored heat are considered, and acceptance limits are close.

coverage (quantile) of the combined effect of the quantified uncertainties, and on the requested confidence level of the code results. The tolerance limits can be used for quantitative statements about margins to acceptance criteria. Another important feature of the method is that it provides sensitivity measures of the influence of the identified input parameter uncertainties on the results. The measures permit an uncertainty importance ranking. This information provides guidance as to where to improve the state of knowledge in order to reduce the output uncertainties most effectively, or where to improve the modelling of the computer code. Different to other known uncertainty methods, the ranking is a result of the analysis with its input uncertainty ranges and distributions, and not of an a priori expert judgement on the ranking. Uncertainty statements and sensitivity measures are available simultaneously for all single-valued (e.g. peak cladding temperature) as well as continuous valued (time dependent) output quantities of interest. The method relies only on actual code calculations without the use of approximations like fitted response surfaces. The method proposed by GRS has been used in different applications by various international institutions including licensing. In the international comparison of applications of uncertainty methods, the OECD BEMUSE Programme “Best Estimate Methods - Uncertainty and Sensitivity Evaluation”, 10 from 11 participants used this method (NEA, 2011). Beyond that, this statistical method is used by several international organizations in licensing processes. For example, this statistical method has been licensed by USNRC in the year 2003 for the vendor Framatome ANP, now AREVA. It has been applied to fuel reloads. Westinghouse applied the statistical method under the name ASTRUM (Automatic Statistical Treatment of Uncertainty) Method, and USNRC licensed the method in the year 2004. The method has been applied in many licensing processes in several countries. The Korean utility KEPCO (Korea Electric Power Corporation) uses the same statistical method under the name Realistic Evaluation Methodology (KREM). The technical safety organization IRSN in France uses the statistical method to evaluate the uncertainty of code results similar to the GRS. The French utility EDF uses an “Extended Statistical Method” (ESM-3D) based on Wilks’ formula for licensing of the EPR large break LOCA. Usually, the demonstration to meet the acceptance criterion for PCT, e.g.1200 °C, is performed by analyzing a single penalized “hot rod” with the most unfavorable conditions of power, axial power shape and burn-up within a hot bundle. The “hot rod” shall meet the acceptance criterion, e.g. peak cladding temperature PCT ≤ 1200 °C with 95%/95% probability and statistical confidence. This demonstration takes into account that the other fuel rods have a lower probability exceeding the acceptance limit than the hot rod. Without penalty on one fuel rod, the criterion has not only to be fulfilled for the most real “unfavorable” fuel rod (without penalty) because conditions of many fuel rods can be very close to that most “unfavorable” fuel rod. The entire core fuel rods or at least a number of “unfavorable” fuel rods should be considered in the analysis. We distinguish if the population mean value or the 95% quantile value shall be compared with the acceptance criterion. That decides the number of calculations to be performed which is in both cases significantly higher than using a “hot rod”. The German Reactor Safety Commission recommends that the criterion shall be exceeded by not more than one fuel rod of the core with 95% probability and 95% confidence (RSK, 2015). One should keep in mind that a prudent sensitivity analysis and comparison of the distance or eventual exceedance of the acceptance limit can reduce the effort of calculations even when the entire fuel rods or a subset of fuel rods is included in the calculations of the uncertainty analysis. The models in a computer code should be sufficiently validated to give reliable results varying important parameter values. Important parameters can be seen from earlier performed uncertainty

Funding The German Federal Ministry for Economy funded the development and applications of the GRS uncertainty and sensitivity method under several contracts of reactor safety research. Acknowledgments The support and assistance of the statistician team of GRS, E. Hofer, M. Kloos and B. Krzykacz-Hausmann is gratefully acknowledged. Declaration of Competing Interest The authors declare no conflict of interest. The funders had no role in the design of the work; in the collection, analyses, or interpretation of data; in the writing of the manuscript, or in the decision to publish the results. References BMU, 2015. Safety Requirements for Nuclear Power Plants, Annex 5: Requirements for Safety Demonstration and Documentation, http://regelwerk.grs.de/en/node/123. Boyack, B.E., Catton, I., Duffey, R.B., Griffith, P., Katsma, K.R., Lellouche, G.S., Levy, S., May, R., Rohatgi, U.S., Shaw, R.A., Wilson, G.E., Wulff, W., Zuber, N., 1990. Quantifying reactor safety margins. Nucl. Eng. Design 119, 1–117. Brown, L.D., Cai, T.T., DasGupta, A., 2001. Interval estimation for a binomial proportion. Stat. Sci. 16 (2), 101–133. D'Auria, F., Giannotti, W., 2000. Development of code with Capability of Internal Assessment of Uncertainty“. J. Nucl. Technol. 131 (1), 159–196. Glaeser, H., Hofer, E., Hora, A., Krzykacz-Hausmann, B., Leffer, J., Skorek, T., 2001. Einfluss von Modellparametern auf die Aussagesicherheit des ThermohydraulikRechenprogramms ATHLET. GRS-A-2963. Glaeser, H., Hora, A., Krzykacz-Hausmann, B., Skorek, T., 2005. Aussagesicherheit von ATHLET-Rechenprogrammergebnissen für eine deutsche Referenz-DWR-Anlage mit

11

Nuclear Engineering and Design 354 (2019) 110143

H. Glaeser

NEA, 2011. BEMUSE phase VI report, status report on the area, classification of the methods, conclusions and recommendations. NEA/CSNI/R(2011), Paris, France, pp. 4. NEA, 2017. Post-BEMUSE Reflood Model Input Uncertainty Methods (PREMIUM) Benchmark Final Report. NEA/CSNI/R(2016), France, Paris. RSK, 2005. RSK-Recommendation “Anforderungen an die Nachweisführung bei Kühlmittelverluststörfall – Analysen”, Anlage 1 zum Ergebnisprotokoll der 385. Sitzung der Reaktor-Sicherheitskommission (RSK) am 20./21.07.2005. RSK, 2015. RSK-Recommendation “Anforderungen an die Nachweisführung bei Kühlmittelverluststörfall – Analysen”, Anlage 1 zum Ergebnisprotokoll der 475. Sitzung der Reaktor-Sicherheitskommission (RSK) am 15.04.2015. Teschendorff, V., Glaeser, H., Kliem, S.: Bedeutung von Experimenten für die Reaktorsicherheit; Jahrestagung Kerntechnik, Dresden, 12. – 14 Mai 2009. USNRC, 1988. Division of Systems Research, Office of Nuclear Regulatory Research, Compendium of ECCS Research for Realistic LOCA Analysis, Final Report, NUREG1230 R4, Washington, DC 20555, December 1988, chapter 8.1” Conservatisms in Existing ECCS rule”. USNRC, 1989. US Nuclear Regulatory Commission, Regulatory Guide 1.157, Best Estimate Calculations of Emergency Core Cooling System Performance. NRC, Washington, DC. USNRC 10 CFR 50.46, “Acceptance Criteria for Emergency Core Cooling Systems for Light Water Nuclear Power Reactors”, and Appendix K, “ECCS Evaluation Models”, to 10 CFR Part 50, Code of Federal Regulations, USA. USNRC Regulatory Guide 1.203, Transient and Accident Analysis Methods, U.S. Nuclear Regulatory Commission, Office of Nuclear Regulatory Research, 2005, Washington, DC, USA. USNRC Regulatory Guide 1.224, Preliminary Draft, Establishing Analytical Limits for Zirconium-Alloy Cladding Material, Washington (D.C., USA), 1-32. Wald, A., 1943. An extension of Wilk’s method for setting tolerance limits. Ann. Math. Statist. 14, 45–55. Wilks, S.S., 1941. Determination of sample sizes for setting tolerance limits. Ann. Math. Statist. 12, 91–96. Wilks, S.S., 1942. Statistical prediction with special reference to the problem of tolerance limits. Ann. Math. Statist. 13, 400–409.

200%-Bruch im kalten Strang. GRS-A-3279. Glaeser, H., 2008. GRS Method for uncertainty and sensitivity evaluation of code results and applications. J. Sci. Technol. Nucl. Install. 7 Article ID 798901. Glaeser, H., 2017. Verification and Validation of system thermal-hydraulic computer codes, scaling and uncertainty evaluation of calculated code results. Book ‘ThermalHydraulics of Water Cooled Nuclear Reactors. In: D’Auria, F. (Ed.), Chapter 13. Elsevier, Woodhead Publishing ISBN: 978-0-08-100662-7 (print), ISBN: 978-0-08100679-5 (online). Hays, W.L., 1981. Statistics, 3rd ed. Holt Rinehrt Winston ISBN-13: 978-0030744679. Hofer, E., 1993. Probabilistische Unsicherheitsanalyse von Ergebnissen umfangreicher Rechenmodelle. GRS-A-2002. Hofer, E., 2003. Statistik und Probabilistik in der Schadensumfangsanalyse, Note, GRS Garching, 11. Februar 2003. IAEA, 2006. IAEA Safety Glossary; Terminology used in Nuclear, Radiation, Radioactive Waste and Transport Safety, Version 2.0. Department of Nuclear Safety and Security, International Atomic Energy Agency, Vienna, Austria. IAEA, 2008. IAEA Safety Report Series No. 52, Best Estimate Safety Analysis for Power Plants: Uncertainty Evaluation. International Atomic Energy Agency, Vienna, Austria. IAEA, 2009. IAEA Safety Standards Series: Deterministic Safety Analysis for Nuclear Power Plants, Specific Safety Guide No. SSG-2. International Atomic Energy Agency, Vienna, Austria. Kloos, M., Hofer, E., 1999. SUSA – PC, A Personal Computer version of the program system for uncertainty and sensitivity analysis of results from computer models, Version 3.2. User's Guide and Tutorial, Gesellschaft für Anlagen- und Reaktorsicherheit mbH (GRS), Garching, Germany. Kloos, M., 2014. Statistischer Nachweis bei einem LOCA. GRS-Handout, AST-AG LOCA, BMUB, Bonn 23 (07), 2014. KTA Design of Reactor Cores of Pressurized Water and Boiling Water Reactors; Part 1: Principles of Thermal-hydraulic Design (in German), KTA 3101.1, Kerntechnischer Ausschuss (KTA), c/o Bundesamt fuer Strahlenschutz (BfS) 2012 Salzgitter, Germany. Lerchl, G. and Austregesilo, H., 2000. ATHLET Mod 1.2 User’s Manual. GRS-P-1 / Vol.1, Rev. 2a, GRS, Garching, Germany. NEA, 2009. BEMUSE Phase V Report, Uncertainty and sensitivity analysis of a LB-LOCA in Zion nuclear power plant. OECD/NEA/CSNI/R(2009), France, Paris.

12