The impact of phenomenological uncertainties on an accident management strategy

Reliability Engineeringand System Safety45 (1994)

175-194 (~) 1994 Elsevier Science Limited Printed in Northern Ireland. All rights reserved 0951-8320/94/$7.00

ELSEVIER

The impact of phenomenological uncertainties on an accident management strategy Ivan Catton & Hakkyu Lim Department of Mechanical, Aeronautical and Nuclear Engineering, School of Engineering and Applied Science University of California, Los Angeles, CA 90024-1597, USA

Using lower cavity flooding as an accident-management tool to prevent 'core-on-the floor' is evaluated. Three phenomena that impact the effectiveness of lower cavity flooding are chosen for evaluation: (1) reactor vessel lower head failure, (2) ex-vessel steam explosions in a BWR, and (3) buoyancy-driven recirculation for a PWR. The merit of the selected management strategy and the impact of uncertainties in phenomenological behavior is evaluated using the method of influence diagrams. The probability of a particular outcome can depend on the state-ofknowledge uncertainties of the model parameters. The probabilities are estimated by making many calculations with a response surface that is generated from several results of a particular model and covers the possible ranges of its parameter uncertainties, using randomly sampled values of its parameter uncertainties. This allows knowledge about uncertainties to be transformed to probabilities with a minimum of subjectivity. The approach shows the effects of uncertainties in the parameters by changing their state-of-knowledge distributions.

1 INTRODUCTION

come to rely heavily on expert opinion to develop descriptions of poorly understood accidents. In other words, severe accident management choices often depend on preconceived notions with an outcome whose probabilities are subjectively determined by the experts. As a result, the basis for assessment is often inscrutable and may be insufficient for assessment of accident management strategies. The impact of expert opinion can be seen in the following example. One boiling water reactor (BWR) owner decides to fill the lower dryweU with water because he believes that steam explosions will not occur. A second keeps out water because he believes that steam explosions will rupture the drywell. A third does nothing because he doesn't know what will happen. Each of the B W R owners relies upon his panel of experts. A better way of dealing with the results of diverging expert opinion is to determine clear probabilities of the various possible outcomes from current knowledge of phenomena and evaluate its impact using influence diagrams as a guide. Some efforts have been made to deal with the divergence of expert opinions about unresolved issues. Theofanous e t al. ~ proposed a new probabilistic framework to link the mechanistic and probabilistic

Nuclear power plants require well defined operational procedures for severe accident conditions, as well as for normal conditions in order to operate efficiently and safely. T o develop such operational procedures, the conditions being dealt with should be physically well defined and understood. In some cases, however, large uncertainties exist in the phenomena as well as in the performance of the operators and the reliability of equipment and instrumentation. Some of these uncertainties are inherent in nature, while others arise from lack of knowledge. If conditions are uncertain or poorly understood, they must be delineated by expert opinion. Emergency operating procedures (EOPs) are well defined for both pressurized and boiling water reactors (PWRs and BWRS) up to the time of inadequate core cooling, but none have been specifically developed for conditions of significant core damage. However, there are many proposed actions the operating and technical staff can take to prevent or mitigate the consequences of severe accidents. For assessment of severe accident management strategies for nuclear power plants, we have 175

176

Ivan Carton, Hakkyu Lira

aspects of the issues. Each process that has individual physical (deterministic) models is related in a probabilistic framework that allows the propagation of uncertainties in each of the physical models and quantified probabilities through a sequence of physical processes. Input probability distributions of the framework are quantified in a judgement fashion, with the associated full range of technical reasoning. This paper aims to demonstrate how subjective probabilities might be developed for certain phenomena, and how the phenomenological uncertainties impact severe accident management strategies. Because there are so many accident sequences and types of nuclear power plant (NPP), NPPs and accident sequences must be specified. In this study, the Peach Bottom station and a long-term station blackout represent BWRs. PWRs are represented by the Surry station and a short-term station blackout (TMLB). The selected accident sequences are the dominant internal events leading to core damage in the selected NPPs. A strategy involving lower cavity flooding for lower head cooling has been proposed to keep the molten core and structural debris within the vessel. This strategy is chosen for study. Three severe accident phenomena are important when evaluating the effectiveness of lower cavity flooding. The probability of a particular outcome of the phenomena will be estimated based on our current understanding of phenomena. The strategy is then assessed using the influence diagram method 2 with the calculated probabilities of the selected phenomena. In this study, the estimated probabilities of selected events will be substituted into the influence diagram that was developed for accident management decision analysis at UCLA by Kastenberg et al.3 Figures 1 and

2 are the influence diagrams for the Surry station (PWR) and for the Peach Bottom station (BWR), respectively. The remaining probabilities needed for the evaluation of the influence diagram are those used in the UCLA study. In order to determine the effectiveness of cavity flooding as a strategy, the possibility that the lower head might fail is considered. If, due to cooling from outside the lower head, the lower head does not fail, the strategy is proven to be effective to maintain lower-head integrity. Next, ex-vessel steam explosions in a BWR are considered. Peak pressure and impulse generated from steam explosions threaten to cause the failure of the pedestal and the drywell wall. Ex-vessel steam explosions are the most significant adverse effect on the strategy in a BWR. Finally, for a PWR, heating of the upper part of the primary coolant system (RCS) due to buoyancy driven recirculation is considered. If the RCS pressure boundary remains intact, hot gas in the RCS transfers heat from the core material to the more vulnerable parts of the RCS, the steam generator tubes, the pressurizer surge line and the hot leg, by natural circulation. The probabilities resulting from modeling of the various phenomena are used to assess the use of cavity flooding as an accident management strategy.

2 EXPERT OPINION A N D A SUBSTITUTE METHOD 2.1 Expert opinion It has become customary to resort to 'expert opinion' when the outcome of a particular physical process in

r; LI~

OA: Operator action WC: Water in cavity HSF: Hot leg or surge line failure CDA: Core damage arrested R: AC power recovered before VB RP: RCS pressure at VB

ESTGR: Early SGTR VB: Vessel breach LR: AC power recovered during CCI CFE: Core fraction ejected VHS: Vessel hole size EVSE: Ex-vessel steam explosion

CCI: Core concrete interaction ACCI: amount of CCI S: Sprays dudng CCI ECF: Early containment failure LCF: Late containment failure SGTR: Steam generator tube rupture

Fig. 1. Influencediagram for PWR (Kastenberg et al.3).

The impact of phenomenological uncertainties on accident management strategy

CV: Containment venting

EVSE: Ex-veesel steam explosion

R: AC recovery before core slump

ECF: Early containment failure

RP: Vessel pressure at VB

LM: Liner melt-through

WC: Water reaches vessel lower head

IF: Containment isolation failure

VB: Vessel breach

CCI: Large core concrete interaction

, HPME: High pressure melt ejection

177

LCF: Late containment failure

Fig. 2. Influence diagram for BWR (Kastenberg et al.3). reactor safety is not well known. Nevertheless, the use of expert opinion in safety studies is highly controversial. 4 Opponents argue that there have been too few severe accidents for experts to judge the results of expected phenomena for a particular hypothetical accident without analysis of phenomena. Even though they have a technical basis for their judgements, it is difficult to avoid psychological biases in the process of subjectively determining their opinions based on their basis. Proponents argue, however, that it is the only way to use expert opinion for the achievement of certain goals, given finite resources. In spite of all the criticism, Berman 4,5 noted that decision makers have come to rely more heavily on expert opinion to fill the gap between the urgent need-to-know information and the lack of scientifically defensible data and models. There are also difficulties in agreeing who is an expert and in what area. Conventional approaches using point-estimate probabilities have been used extensively for expert opinion. However, an expert may find it difficult to translate his knowledge into numerical probabilities, and existing data are neither sufficient nor defensible when he determines his subjective probabilities. Before trying to resolve the problem, it is useful to examine the several types of probability found in the literature. The two principal schools of thought are the subjectivist and the frequentist. The subjectivist view is usually interpreted as a degree of belief. The frequentist school defines probabilities as limits of long-run relative frequencies. Essential to this is the concept of a collective, which is an infinite sequence of repetitions of an experiment. Currently, the point-estimate probability given by experts has two distinct interpretations. It may represent a subjective

measure of the degree of belief or a subjective estimate of the value of frequentist probability. It is usually not clear which interpretation has been applied. Berman characterized subjective probability by two distinct interpretations in the nuclear power safety arena. 5 One is a quantitative measure of a person's subjective degree of belief (DOB), Psc, that a particular outcome will or will not occur, based on limited data. An individual's DOB that an event will or will not occur is proportional to how closely his choice of P~ approaches 1 or 0, respectively. Psc = 0.5 is interpreted as the state of maximum uncertainty concerning a Bernoulli sequence. The maximum uncertainty range, 0 to 1, for a particular P~ is an acceptable uncertainty range, since it is simply a statement that current evidence cannot rule out either the occurrence or non-occurrence of a particular outcome. The other interpretation is a prophecy of the results of some future trials, P~f, based on an implicit belief in a particular hypothesis, i.e. subjective probability interpreted as an individual's estimate of frequentist probability. In contrast to Psc, an individual can guess values of P~f and assign subjective uncertainty ranges that are less than the maximum possible. The frequentist definition of subjective probability also forces the analyst to recognize the extent of objective information that would be required to confirm his subjective probability estimate. While no PDF (probability density function) can be associated with P~, PDFs for P~f are not logically precluded. However, an analyst should not believe that he can create any PDF he wants. 5 The estimation process for the subjective DOB, Psc,

178

/van Catton, Hakkyu Lim

is highly personal. No one can trace the logic except oneself. Uncertainties in our understanding of the phenomena can, however, be classified into two groups; uncertainties in the modeling (key physical mechanisms) of a phenomenon, and in the parameters of the model. P~f can be estimated with a minimum amount of subjectivity if only the latter uncertainties are considered in p,f. If an expert uses a deterministic model of a phenomena, regardless of how correct the model is, he can avoid a good deal of the subjectivity in the selection of a probability and, instead, objectively estimate it by many calculations with models that are based on his knowledge using randomly sampled values of its parameters from the state-of-knowledge (subjective) distributions. This is a way to transform an expert's knowledge into probability with a reduced degree of subjectivity and can show the effects of model-variable uncertainties on the resulting probability. The probability obtained in this study will be interpreted as Psf. New knowledge can contribute to update the probability by revision of the model. As research produces more correct knowledge, the estimated probability becomes more accurate. Even though the resulting probability distribution is estimated using a deterministic model, it cannot completely avoid subjectivity because the model is developed by an expert based on his current view of the phenomena and the uncertainties of its parameters. A probability obtained by this means can be interpreted as the probability of a certain result for uncertain phenomena whose uncertainties come from uncertain parameters, and initial and boundary condtions in the model, not from uncertainties in the model itself. Uncertainties in the model itself and in the specification of the distributions of uncertain variables can be related by the likelihood of (or confidence in) the resulting probability. 2.2 A method for estimation of probability Elements of a method for estimating the probability of a particular outcome from uncertain phenomena are: (1) definition of the issue, (2) description of a model for the phenomena in question, (3) specification of uncertainty distributions for parameters used in the model, (4) establishing a calculational matrix for generation of a response surface, (5) generation of a response surface by regression analysis, (6) random sampling of the model parameters according to their distributions, (7) determination of probability from the results of the calculations

The first step, definition of the issue, is critical since the severe accident is physically well hypothesized so that the issue is probable. These definitions are features of the overall study and not so much a feature of the method described here. The second step, specification of a model for the phenomena in question, requires a model incorporating all of the important physical phenomena and must rely on an expert's knowledge of the issue. A number of assumptions and approximations must be used to describe the issue in an appropriate deterministic model. Poorly understood mechanisms in a model are developed by experts, based on extrapolation of existing data or analysis. These assumptions, approximations and extrapolations restrict the model validity. At the very least, a model must not violate basic physical laws--mass, momentum and energy conservation laws. The third step, specification of uncertainty distributions for parameters used in the model, requires that uncertain factors in the model, whose numerical values are assumed to be available, be assigned ranges. Uncertainties may exist in the initial and boundary conditions as a result of previous events in the accident sequence, and can be propagated by the phenomenological model into the analysis. These initial and boundary conditions can be set using results from other modeling efforts or experts. If several mechanisms are proposed for a particular physical process, then there are uncertainties in the physical mechanisms of the process as well as the parameters within a model, such as fragmentation mechanisms in steam explosions. Alternative mechanisms can be treated as different expert opinions. One can combine the probabilities from different mechanisms by using the analyst's DOB that a model is true as one combines expert opinions. Finally, one must deal with uncertainties in the model parameters. All the uncertainties mentioned above are due to inadequate knowledge, i.e. state-of-knowledge uncertainty. Expert judgement is necessary to determine the ranges for critical parameters. The complex nature of the physical processes requires that the expert be from the field that includes study of such phenomena, not necessarily from the nuclear safety field. Specification of distributions for the uncertainty factors appears to be a fairly subjective process. The state-of-knowledge distributions express one's beliefs regarding the numerical values of the factors. For parameters that have been extensively studied within or outside the nuclear safety community, arguments for the use of familiar normal distributions can be advanced. 6 But, in general, there are not enough data to support such detailed distributions. A uniform distribution or a constant distribution over the logarithm of the range is often used when objective

The impact of phenomenological uncertainties on accident management strategy data are not available. Sometimes this unattractive alternative is the only one available. If it proves to be important, the need for research can be argued. The fourth step, establishing a calculational matrix for generation of a response surface, is selfexplanatory. A response surface (RS) fits a complicated model to the output of interest, in terms of the important parameters selected above. Generally, the output of interest is a split fraction probability, i.e. whether an event will occur or not (see Section 3). However, if one can use a quantity to determine the occurrence by comparison with a criterion for an event, it can be an output of the RS (see Section 4). The output of the RS can be easily transformed to a split fraction probability. A number of underlying assumptions have to be made about the behavior of the output relative to that of input and, as we shall discuss below, the accuracy of the RS is restricted by considerations of the amount of data available and the structure of the calculational matrix. More accurate formulations of the RS require more executions. 7 However, the number of executions needed can be reduced by eliminating parameters seen to have little sensitivity. Occasionally, combinations of uncertain values can lead to extreme or even unrealistic results that may violate the constraints on the problem. A set of selected values of uncertain factors should be realistic. In order to obtain probability from a RS, the values of uncertain variables are found by statistically acceptable random sampling of the model parameters according to their distributions, such as a Monte Carlo sampler. With a RS enough results can be calculated for a meaningful probability. The sum of the probabilities coming from the various values of the uncertain factors, which are multiplied by the probability of their respective values, can be the probability of interest, corresponding to the state-ofknowledge distributions for the uncertain factors. In some simple cases, however, it is possible to analytically integrate the effects of uncertain factors on the probability without the Monte Carlo method (see Section 3). The sensitivities of the calculated probabilities to the distributions for the uncertain variables can be easily examined. Because the uncertain features considered in the model could be measured, it is relatively easy to define focused research that would reduce uncertainty in critical, uncertain features of the models and thereby reduce uncertainty in the issues. In the final step, determination of probability from the results of the calculations, everything is brought together. The determined probability can be intepreted as a mean value of the probability, i.e. the average probability of the issue weighted by the probability distributions of uncertain parameters due to lack of knowledge about their values. The results of

179

the first six steps are studied using the influence diagram from the UCLA work of Kastenberg et al. 3 Changes in state-of-knowledge are reflected as changes in the models for the phenomena and as changes in the probability distributions of uncertain factors. In general, the structure of the influence diagram should remain the same regardless of changes in states of knowledge. 8

3 VESSEL LOWER H E A D FAILURE 3.1 Issue definition If the initiated accident sequence leads to loss of core cooling, the core temperature rises and melting starts. The molten core material (corium) slumps and forms a molten pool in the vessel lower head. The cavity is flooded to enhance cooling of the vessel lower head. If the decay heat exceeds the heat loss at the corium pool boundary in the vessel lower head, the corium pool heats up. The internal heat generation due to the decay heat assures that most of the pool remains molten and also induces natural convection in the pool. If the temperature of the vessel lower head exceeds its melting temperature, or the total stresses (including thermal) in the shell exceed the ultimate stress, the vessel lower head fails. The effectiveness of the strategy depends on whether or not the cooling due to flooding is sufficient for lower head survival. If the vessel lower head does not fail because of the cooling on the outside of the lower head, the strategy is proven to be effective in maintaining the lower head integrity. Even if the lower head does not fail, the strategy may be judged to be ineffective because an adverse effect may come into play. This will be considered later. The probability of lower head failure is determined using the results of an existing analysis by Park, 9 and Park and Dhir 1° without further calculation. They did not do enough calculations to obtain probabilities leading to some subjectivity in the probability estimation procedure. 3.2 Model description Park ~° calculated the temperature distribution in the lower head shell and determined the stress distribution in the shell by examining the resulting temperature distributions. Thermal behavior: Two-dimensional axisymmetric conduction equations (steady-state and transient for PWR; steady-state for BWR) are solved to obtain the temperature distributions inside the shell using a difference method. The pool temperature is assumed initially to be 2500 K and calculated for both transient and steady-state values using radiation and convection

180

Ivan Catton, Hakkyu Lim

as the pool boundary conditions. Ranges of emissivities are chosen for a sensitivity study. The upper structure temperature is assumed to be either 800 or 1600K. Natural convection heat transfer coefficients for the boundary condition at the inner shell surface are obtained from Mayinger's method 1~ to account for azimuthal dependence and from Gabor's method for an average value. 12 Even though the temperature of a region of the shell was calculated to exceed the melting temperature, the region remains in the calculation domain without any change. For the BWR, it is assumed that the pocket formed in the vessel support skirt is filled with steam and air. Mechanical behavior: A two-dimensional finite element code ( N A S T R A N ) with roller- or clamped-type boundary conditions on the top of the vessel shell was used to calculate the stress distributions in the vessel shell by elastic theory, given the temperature distributions. The region whose temperature exceeds the melting temperature of the shell is removed from the calculation domain. Creep rupture at temperatures that are lower than the melting temperature of the shell was also considered by using the Larson-Miiler parameter ~3 and the equivalent stress. 14 3.3 Parameter uncertainties in the model and results The effects of pool volume and heat-transfer coefficient on the temperature distributions are significant. The Mayinger correlation yields higher corium pool to vessel head average downward heat transfer compared to that obtained from Gabor's correlation. This leads to higher inner-wall temperature (some melting) and lower pool temperature being predicted with Mayinger's correlation than with Gabor's. The results of B W R and PWR show that the vessel lower head will not fail due to melting alone under any conditions. The effects of emissivities of the vessel inside structures and pool surface, and of the upper structure temperature, are small. Thermal stress is strongly dependent on temperature distribution. Thus, there are higher stresses from temperature distributions calculated using Mayinger's correlation than those using Gabor's in all cases. For a PWR, the calculated stresses for the clamped boundary condition at the top of the vessel shell are predicted to exceed the ultimate stress of the steel shell over a wide region of the vessel shell for all pool volumes when the temperatures are based on Mayinger's work. For the roller boundary condition, the stresses are predicted to exceed the ultimate stress over a relatively narrow region across the vessel shell. When the temperatures are obtained using Gabor's method, the minimum stresses along the midplane of the vessel shell are predicted to be much lower than the yield stress of steel by using the roller boundary condition at the top of the shell.

The ability of the BWR vessel support skirt region to trap air makes the stresses calculated for the BWR very sensitive to pool volume. For either stress boundary condition at the top of the shell, stresses along the mid-plane of the hemispherical vessel shell calculated using the Mayinger correlation are predicted to be lower than the yield stress except in a narrow region near the support skirt for Vp (pool volume) = 2Vcore (total volume of core material). For Vp =1~Vc.... the stresses are predicted to be much higher than the yield stress across the shell. When the temperatures are obtained using Gabor's correlation and the roller boundary condition is used, the maximum stresses along the mid-plane of the vessel shell are predicted to be much lower than the yield stress of steel. The stresses in the skirt are much higher than yield stress, especially near the armpit weld region. If the skirt armpit weld fails, water can flow into the skirt region and the lower head can be cooled effectively. The system pressure does not play a dominant role in determining the stresses in the vessel shell. The temperature chosen from the distribution through the vessel head to represent the shell temperature for creep rupture can lead to creep rupture times being predicated by a matter of a few hours to a much longer time. In the estimation of the probability, creep rupture was not considered because the mechanism was too uncertain to use as a deterministic model and proper materials expertise could not be brought to bear in a timely way. This work is incomplete without its consideration. Uncertainties in the heat transfer coefficient and pool volume are selected as the most important parameters for calculating vessel lower head failure. Even though the results are sensitive to the stress boundary condition at the top of the shell, the boundary condition is not selected as a parameter for variation because the effect on whether or not the vessel fails is small. 3.4 Determination of the probability of vessel lower head failure The selection of a heat transfer correlation and the expected pool volume affect the assessment of the strategy. In order to assess the strategy, the uncertainties in the model parameters need to be translated to vessel failure probability. In the influence diagram established by Kastenberg et al. in an earlier study, 3 results were obtained for both BWRs and PWRs. For a PWR, the probability of vessel breach (VB), Pvh, is dependent on the success of flooding, whether or not core damage is arrested and the RCS pressure at VB. To determine Pvb, a set of conditions, such as success of flooding, core damage arrested and any RCS pressure, are

The impact of phenomenological uncertainties on accident management strategy needed to do a vessel head stress analysis. Pub for the remaining cases can be determined without the above analysis, i.e. the probability is either 1 or 0, or can be obtained from other sources. For a BWR, P~h depends on the success of flooding to preclude vessel breach and AC power recovery between core uncovery and core slumping. The above analysis is needed to determine Pub for a set of conditions such as success of flooding and continuous AC power failure. One can set the conditional probability, P(VB I Vp, h), of VB given the pool volume, Vp, and heat transfer coefficient, h, to be 1 or 0 according to the calculated results. If one judges how correct the heat transfer coefficients are, the conditional probability, e(Vb I Vp), of VB, given the pool volume, is determined by the total probability theorem, P(VB I Vp)= P(VB t Vp, hM)P(hm) + P(VB I Vp, hG)P(hc), where P(h) is the state-of-knowledge probability mass distribution that the values of heat transfer coefficients from Mayinger's (hM) and Gabor's (ho) are true, respectively. In this work, the values P(hM) = 0-7 and P(hG) = 0.3 are chosen because a recent experimental study by Frantz and Dhir shows that Mayinger's correlation is more probable. 16 The probability of PWR vessel lower head failure, P(VB I Vo), is chosen to be 0.7 because the calculated results show that the lower head fails when Mayinger's correlation is used but does not fail when Gabor's is used. The value of the probability is independent of Vp. For a BWR, the probability varies from 0.3 to 0.7 because Vo affects the results. Because the number of calculated cases was too small to determine P(VBIVp) from the calculated results, the distribution was subjectively specified. If the upper surface of the corium pool is located above the vessel support skirt armpit, P(VB I Vp) is assumed to be 0.3 while, otherwise, it is assumed to be 0.7. Table 1 shows P(VBIVp) for BWR, which is discretely specified. Further calculations could better define this relationship. Finally, if a distribution is given for Vp, a point estimated of the marginal probability of VB can be determined. Let the distribution of Vp be fvp(Vp), which satisfies the following equation,

fm

' .... PfVp('Op) dop = 1.0.

(1)

in.up

The probability of vessel failure, P(VB), given a set of

Table 1. Conditional probability of P(VB I Vp) for BWR

Pool volume, Vp (x Vcore)

Conditional probability

0

~

2

0-0

0-7

0-3

33

O.3

181

Table 2. Assumed probability distributions for the pool volume for BWR

Distribution (D1) Pool volume, Vp (x Vcor¢) Probability Distribution (D2) Pool volume, Vp (x Vcore) Probability Distribution (D3) Pool volume, Vp ( XVcor¢) Probability

0 0.0

l ~1

2 ~I

3

0 0-0

13 0.25

0.5

~2

3 0-25

o 0-0

~I 0.2

~2 0.35

0.45

1

3

conditions is then determined from P(VB) =

fmnaX, v p

fup(vp)P(VB I Up) d/Jp

(2)

in.Up

P(VB) in the above equation is the average probability of VB weighted by the probability distribution of Vp due to lack of knowledge. Generally, this integration can be done by a Monte Carlo sampler if it cannot be calculated analytically. The specification of fvp(lYp) is a somewhat subjective process because the data of Vp are non-existent. Levy considered several accident conditions for a Surry station blackout accident at high RPV pressure and suggested that 40-70 per cent of core weight would be accumulated in the RPV lower h e a d ) 6 Madni calculated that about 60 tones of core (25% of the core weight) would be relocated into the lower head for long-term station blackout at Peach Bottom. 17 Dingman et al. assumed that any part of the core that remains intact collapses when the relocated fraction of the core exceeds 50%. 8 For a PWR, the probability distribution of Vp is not necessary for the calculation of P(VB) because P(VB ] Vp) is not overly sensitive to Vp. Table 2 shows three assumed discrete distributions for a BWR, based on above information. Table 3 shows Pub (=P(Vb)) for a BWR, given three Vp distributions. Pub for BWR does not vary as rfiuch as the distribution of Vp varies because P(Vb] Vp) has only two levels of the value according to the pool volume. Pub for PWR can be simply determined to be 0.7. Kastenberg et al. used 0.9 and 0-4 for Pubs of PWR and BWR, respectively. 3 The probabilities are not much different from the results of the present study because the same bases are used in both studies. These vessel failure probabilities would be used for evaluation of the influence diagram, whose results are shown in Table 4.

Table3. Vessel failure probabilities for BWR depending on the distributions of Vp

V~ Distribution Pv,

D1 0-43

D2 0.40

D3 0.38

182

Ivan Canon, H a k k y u Lim

Table 4. Risk results of evaluation of influence diagram Early fatalities

Late fatalities

Do nothing

Flooding

Do nothing

Flooding

PWR Present Study

1.09 E - 2

8.46 E - 3

5.63 E + 1

4.99 E + 1

Kastenberg et al.

1.09 E - 2

9.17 E - 3

5-64 E + 1

4.86 E + 1

BWR Present Study Given D1 Distribution Given D2 Distribution Given D3 Distribution

5.68 E - 3 5.68 E - 3 5.68 E - 3

2-71 E - 3 2.55 E - 3 2.45 E - 3

1.03 E + 3 1.03 E + 3 1.03 E + 3

4.95 E + 2 4.66 E + 2 4.48 E + 2

Kastenberg et al

5-68 E - 3

2.39 E - 3

1.03 E + 3

4.40 E + 2

Where ECF = early containment failure; EVSE = ex-vessel steam explosions; and HPME = high pressure melt ejections: P(ECF I EVSE, not HPME) for the BWR is assumed to be 0.83 from the present study. The early and late fatalities due to isolation failure in a BWR when the dryweli is flooded is assumed to be reduced by factor of 50 to account for the drywell decontamination factor (DF) in comparison with 'Do-nothing' case. This will be discussed in Section 4.

JU

4 E X - V E S S E L S T E A M E X P L O S I O N S IN BWRS 4.1 Issue definition ....W:,

When a hot liquid contacts a cooler volatile liquid, the energy transfer rate under some circumstances can be so rapid and coherent that an explosion results. Such explosions have been carefully studied by the nuclear safety community, as well as by m a n y other industries, to assess the consequences of the unlikely event that, in a severe accident, molten corium contacts water and causes an explosion. ~9.20 In this study, an ex-vessel steam explosion at the Peach B o t t o m station is examined. Ex-vessel steam explosions are one of the adverse effects of the drywell flooding strategy. If the corium in the bottom head reaches a high temperature, the vessel lower head will fail. The released corium from the lower head coming into contact with the water inside the pedestal would trigger a steam explosion. The resulting pressure rise could cause the pedestal to collapse, leading to early containment failure (ECF).

Model description W h e n the corium reaches a high temperature, plastic deformation of the inner and outer wall of the R P V lower head near the corium pool free-surface will probably occur due to the large temperature gradient across the vessel shell. If the R P V fails, the molten corium in the R P V lower head flows by gravity and R P V pressure, and the f u e l - c o o l a n t interactions (FCIs) start thermally and chemically. Figure 3 is a schematic diagram of this process. T o calculate the dynamic pressure load on the

....

.........

CRORemoval I--I

°"°°-'I

~

~

i

l

:

w.:

1111 l i l

i

:

.

i

: i . ~ P~onnel

. . . . .

Fig. 3. Schematic of conditions at vessel failure.

pedestal wall due to an ex-vessel steam explosion, three separate p h e n o m e n a are considered. First, pressure wave escalation and propagation are considered, to get the pressure distribution in the melt-and-water mixture during steam explosions. Next, in order to calculate the pressure load on the pedestal wall, the pressure wave transmission through the water is considered. Finally, oxidation of zirconium with steam during steam explosions is considered. Three models are used to represent the key p h e n o m e n a needed to estimate the impact of ex-vessel steam explosions: (1) a thermal detonation model originated by Fletcher to calculate the transient

The impact of phenomenological uncertainties on accident management strategy pressure field in the mixture; ~ (2) a model for the propagation of pressure waves due to underwater explosions using the Kirkwood-Bethe theory, with 'peak approximation', 22'23 and the Gilmore equation 24 to calculate the pressure and impulse on the pedestal wall; and (3) a model for the Zr drop oxidation in flowing water developed by Epstein et al. to determine the amount of heat and hydrogen generated from oxidation during ex-vessel steam explosions. 25 Fletcher's model was developed to study the escalation and propagation states, of a vapor explosion. 26 The Kirkwood and Bethe theory was originated to calculate the propagation of the shock wave produced by an underwater explosion. The Gilmore equation was developed to determine the pressure and velocity fields in the neighborhood of a growing or collapsing gas- or vapor-filled bubble in a liquid. Epstein et al. studied the rapid oxidation of high-temperature materials immersed in water. In this study, these three models are used to calculate the pressure load on the pedestal wall. To fit this issue to the above models, one needs to carefully simplify the' problem and make some assumptions and simplifications to the above models. Thermal interactions are considered first. The released corium is fragmented into relatively large droplets and mixed with the water on a relatively slow time scale. The control rod drive mechanism assemblies under the lower head may help mixing. Before triggering, the mixture is assumed to consist of melt drops in the form of a spherical bubble in water. The structures inside the pedestal are disregarded in modeling. A steam explosion is expected to be triggered some time after the release of the corium. Whether or not the pressure pulse generated by triggering in some small region can escalate and propagate the explosion is dependent upon the strength of the triggering. To simulate triggering, Fletcher assumed a fraction of the melt to be fragmented in a small region of the solution domain at the beginning of the model calculations. 21 The pressure pulse propagates spherically until it steepens to form a shock wave. The droplets are fragmented as the shock front passes and the water is rapidly heated by energy transfer from the fragments. The fragmentation process is assumed to be by boundary layer strippingY In this region, the mixture consists of melt drop, water and fragments. To reduce the number of constitutive relations, Fletcher assumed that the steam and water were always in mechanical and thermal equilibrium, the so-called equal velocity equal temperature (EVET) assumption. We will do the same, even though the temperature of the water inside the pedestal could be highly subcooled. However, as pointed out by Magallon and Hohmann the water in the mixture probably becomes saturated before triggering, be-

183

cause a large amount of heat can be transferred to the water from the melt in the mixture. TM When the detonation wave front arrives at the boundary of the mixture, one wave is transmitted into the water and the other is reflected. Interactions between the original and reflected wave in the mixture are neglected. To determine its state, the mixture is assumed to consist of steam only. After the detonation wave hits the boundary, the pressure inside the mixture is assumed to be uniformly distributed at the level of the mixture center pressure, A shock wave transmitted into the water travels to the pedestal wall. Generally, the impulse of the shock wave on the pedestal wall is small even though the peak pressure on the wall is high. 29 After the shock wave in the water has diminished, secondary pressure waves generated due to the expansion of the mixture bubble reach the pedestal wall. It is assumed that the expansion is an adiabatic process and that the pressure wave propagation is an isentropic process. The impulse and peak pressure of these waves can be enough to threaten to collapse the pedestal wall. The reflections of these waves at the pedestal wall are neglected. There are two kinds of interactions between molten metal and water. One is a thermal interaction (steam explosion), where there is rapid vaporization of water due to the thermal energy transfer from the molten metal as described above. The other is a chemical interaction where the steam is decomposed and the molten metal is oxidized, generating heat and hydrogen. The heat from oxidation may make steam explosions worse. The chemical interaction, however, has usually been neglected because the reaction rate is assumed to be very low due to the protective oxide coating. Only the thermal energy of molten metal has been considered during its interaction with water. In experimental results, however, white zirconium oxide has been observed to have much more extensive interaction associated with explosive pressure rise. Figure 4 shows that zirconium with a high initial temperature can be considerably oxidized with explosive pressure rise. 3° If the zirconium-droplet heat loss due to the vaporization of water is smaller than the heat generation due to the zirconium oxidation, the temperature of the zirconium droplet goes up and the rate of oxidation may be maintained at a high rate. Finally, rapid, or breakaway, oxidation may occur. 31 Initial zirconium-droplet temperature and water temperature are criteria of rapid oxidation. Chemical interaction (oxidation) between metallic material in the corium and water during steam explosions is considered separately from thermal interactions. In this study, the zirconium-water (or steam) reaction is considered because of the extensive use of zirconium and zirconium-based alloys in a BWR, and the observation of Parker et al. that highly

Ivan Carton, Hakkyu Lim

184

o nuns .iv.

chemical interaction (oxidation) and thermal interaction (thermal detonation) are comparable, the amount of the heat energy liberated from oxidation during the steam explosion could be added to the thermal energy of the molten corium.

s o . ulL w~mts

aa

A

i" oO

4.2 Specification of initial conditions "

,~,T,AL ~ETA~ Tt~P[n~TUR[.C

a) in Room Temperature Water

.,TEa

r(U'tR,T~

O 90-,Z~ ¢ a ,,o- ~:oc A Ioo.~c

*

,,~s~omt R,st

•

•

*

s,

b) in Heated Water with 60-rail wires

Fig. 4. Zirconium oxidation in water (Baker and

L u s t ) . 3U

metallic melts can occur during some core-melt sequences. 32 The steam diffusion process within the steam-hydrogen film on the hot reactive surface of zirconium droplets, and the parabolic reaction rate law for zirconium developed by Baker and Just, control the chemical reaction rate, which is determined by steady-state analysis with respect to zirconium-droplet temperature. 25 Transient zirconiumdroplet temperature and oxidation history are calculated from the chemical reaction rate. In the present study, however, when rapid oxidation is considered, the protective oxide layer on the zirconium droplets is neglected and the chemical reaction rate is controlled only by the steam diffusion in the hydrogen-steam mixture film over the surface, because the protective oxide layer does maintain its integrity due to cracks inside the layer. 3] It is assumed that the ratio of zirconium droplets to total droplets is the same as the ratio of fresh zirconium to total corium. Based on steady-state values of the diffusion rate of steam in the film for a given surface temperature, the temperature and the percent reaction of the droplets (or fragments) are determined with respect to time. The amount of the heat energy and hydrogen liberated from oxidation during steam explosions can be estimated. If the time scales of

For the above models, the coarse-mixing stage of a steam explosion, which precedes the rapid escalation and propagation stage, needs to be specified as initial conditions of the model, because the mixing stage is not modeled. The initial conditions of the model depend upon the previous event of the issue, i.e. RPV failure mode and water level. If the strategy succeeds, the vessel failure mode may be totally different from the failure mode without the presence of water surrounding the vessel lower head. For simplicity, only what is thought to be the most probable RPV failure mode is considered. Park shows that plastic deformation will probably occur on the inner and outer wall of the vessel, due to a larger temperature gradient across the vessel shell near the pool free surface. 9 Even though the study ignored the circumferential direction behavior of the vessel lower head, it may not cleave uniformly along the circumference of the lower head, but a region of the vessel lower head may cleave near the corium pool free-surface at the beginning of the RPV failure. A jet of molten debris drops into the water pool due to gravity and the RPV pressure. The probability of low vessel pressure at the time of failure is 0.07 with a long-term station blackout given no AC power recovery. 33 The pressure in the RPV is assumed to remain at a high value and to be the normal operating pressure, 1020 psig (7-1 MPa). The initial release rate of the corium can be approximately evaluated to be 340 × 103 kg/s m2 (2 × pressure (7-1 MPa) × density (8000 kg/m3)) 1/2) from simple hydraulics. If the strategy succeeds, the water level in the pedestal region is 27-2 ft above the drywell sump. The probability of successful flooding is 0 " 4 5 . 33 In this study, only two cases were considered; no water and success of the strategy. Ex-vessel steam explosion is precluded if there is no water inside the pedestal. The mixing phenomena is not well understood. The effects of water subcooling and the CRD mechanism assemblies on the mixing are considered. According to E JET-series experiments at Sandia National Laboratory (SNL) the generation of steam significantly affects the breakup of the released corium. 34 Furthermore, the initial temperature of the water appears to determine the timing of the rapid expansion of the mixture region. If the water is highly subcooled, energy from the melt must first heat the surrounding water to saturated conditions before rapid steaming rates can be achieved. E JET-0, the test

The impact of phenomenological uncertainties on accident management strategy to evaluate the effect of water subcooling shows that the mixture region almost immediately grows to twice the initial jet diameter. The region then continues to grow slowly until 2.5 s into the pour, when a rapid expansion of the mixture region occurs, filling the entire water-chamber. The velocity of the leading edge of the mixture is almost constant, reducing only slightly throughout the entire process. The expansion increases the mixture void, thus affecting the detonation wave. The CRD mechanism assembly supports are located under the vessel at about 20 ft above the floor. When the melt contacts the solid structure, an explosion will likely be triggered. If there is no explosion, the structure would help divide the melt into smaller parts and mix the melt and water. Initially, for calculation with the thermal detonation model, volume fractions of each component and the void fraction in the mixture, and the velocity and particle size distribution are needed. At first, a uniform distribution for conditions is assumed for simplicity. The particle size can be obtained from experimental results find is assumed to be 28mm. m'28"35 Though all components have small velocities, the velocities do not affect the phenomena of thermal detonation. Thus, they are set at zero. The volume fraction of the corium is determined by the amount of released corium and the mixture region size. The void fraction is also affected by the mixture region size. However, the mixture size cannot be specified deterministically. It is assumed that the range of the mixture region diameter is from 2-0 to 4-0 m and that the mixture center is located near the CRD mechanism assembly supports where an explosion is assumed to be triggered. It is further assumed that 0.1 < volume fraction of melt (Vm)< 0.2 and 0.1 < void fraction (a0 < 0.3, which roughly meets the fluidization limits of mixing criteria for an explosion. 36 With these assumptions, the range of the mass of corium present in an explosion is estimated to be from 3400 to 56 x 103 kg. Zirconium is assumed to be initially oxidized, 35-65% of total zirconium in the core from WASH-1400 (1975). Of the corium mass, is assumed to be unreacted zirconium. 37 4.3 Parameter uncertainties in the models

Thermal detonation model: The heat transfer coefficients between the components are important factors that strongly impact the results. There are, however, no consistent values from analysis and experiments. 38 The values of the heat-transfer coefficients should be treated as uncertain parameters. The size of fragments (Dr) is found to be 100/zm from experimental results. 39 In this study, to investigate the effect of Df on the evaluation of the strategy, the values of Dr, 200 and 300/~m are also considered. The

185

Table 5. Uncertainty factors in the thermal detonation model and their ranges for calculations

Factor Initial melt volume fraction, Vm Initial void fraction, o: Initial particle size, Dm (mm) Heat transfer coefficient (W/m2K): vapor blanket collapsed, Htw Radius of mixture region, R (m) Size of fragment, Df (pro)

Minimum Maximum 0"1 0.1 2.0

0"2 0.3 8-0

105 1-0 100.0

10~ 2.0 300.0

fragmentation mechanism reflects the subjectivity of the model. However, it has objective experimental and physical bases. Initial melt temperature and density are assumed to be 2700 K (from steady-state temperature of the corium pool by Park 9) and 8000 kg/m a, respectively. The uncertain factors in the model and their ranges assumed in the present study ae listed in Table 5. Other uncertain factors are set to be the same value as those in Fletcher. 21 The thermal detonation model cannot be solved or have reasonable results under the values of uncertain factors beyond the ranges in Table 5. The ranges of uncertain factors listed in Table 1 are just for calculating the response surface. The specific probability distributions for the uncertain factors will be discussed later. The model for propagation of pressure waves due to underwater explosion: There are no parameters with large uncertainties in this model. All the uncertainties in the results of this model come from the previous thermal detonation model results. The zirconium oxidation model: The initial and boundary conditions for the zirconium oxidation model are the same as those for the thermal detonation model. As noted above, the water in the mixture of molten corium and water is assumed to be saturated. The ambient pressure is assumed to be 1 atm (however, the results are not sensitive to the ambient pressure). Uncertainty in the model is primarily from the assumption that parameters in the similarity equations, such as the Prandtl number (Pr), liquid Prandtl number (PRO, Schmidt number (Sc), viscosity ratio (fl), and density ratio (e), are constant. The constant Schmidt number has the greatest impact. 26 The results of interest to this study (percent oxidation during short period (-10 ms)) are fortunately not too sensitive to Sc. If Sc is assumed to be 0.4 (as for low hydrogen concentration), conservative (more oxidized) results are obtained. Table 6 shows the effect of Sc on the oxidation history. In this study, Sc is assumed to be 0-4.26 It is reasonable to assume that the remaining parameters are constant. 25 However, the physical properties which appear in the model are uncertain. The properties are evaluated at reference temperature and concentration, which are average values at the

Ivan Catton, Hakkyu Lim

186 Table6. Effect of Sc on oxidation

percent

Percent oxidation (%)

Sc = 0-4 Sc = 1.0

at 10 ms

at 50 ms

4.43 3.71

11.98 8.34

Zirconium droplet size = 2 mm; droplet relative velocity = 100 m/s. Table 7. Uncertain factors in the zirconium oxidation model

Factor Drop diameter (mm) Relative drop velocity (m/s)

Minimum

Maximum

2.0 0.50

8-0 100.0

metal surface, the gas-water interface, and the water far away. The properties, however, do not significantly affect the results as their ranges are narrow. Finally, to use the model, particle diameter and velocity are specified according to the information from the thermal detonation model. In the present study, both the melt drops and fragments are considered. The range of the relative velocity of a droplet and the water can be determined from the thermal detonation model. The droplet diameter should be the same as in the thermal detonation model, to maintain consistency. While the velocities of the water and the fragments are the same as in the thermal detonation model, the relative velocity of fragments are set to a very small value of 0-50 m/s. Fragment size is assumed to be 0.1 mm, the same as that of the thermal detonation model. 4.4 Results from the models

Whether, and to what extent, the zirconium oxidation affects steam explosions should be decided before the thermal detonation model is calculated. For this reason, the calculational results from the zirconium oxidation model are considered first. There are two effects of zirconium oxidation: one from heat generated from oxidation, the other from hydrogen liberated by oxidation. Table 8 shows that the percent oxidation at 10ms does not exceed 5% even under rapid oxidation. However, fragments (size = 0.1 mm) Table 8. Percent oxidation at different conditions

Conditions Drop size (mm) Relative velocity (m/s) Results Protective oxidation (%) Breakaway oxidation (%)

2 100 4-43 10.01

5 250 1-59 4.01

8 400

0.1 0.5

0-99 54-9 2-52 63.6

are oxidized over 50% during 10ms. Zirconium oxidation of fragments during steam explosions would affect the explosions. However, oxidation of the droplets cannot affect steam explosions because the oxidation is slower than the thermal detonation. To consider the oxidation heat during the thermal detonation process, the heat is added to the specific energy of the fragments by increasing their specific heat. The melt specific-energy, without chemical reaction heat, is assumed to be 1.2 MJ/kg at 2700 K (specific heat of corium (0-5 KJ/kgK) x corium temperature (2400°C)). If one-seventh of the corium is assumed to be unreacted zirconium, 37 the melt specific-heat with the zirconium oxidation becomes 2.1 MJ/kg (melt specific energy (1.2 M J / k g ) + heat of zirconium oxidation (588KJ/kmol)/zirconium molecular weight (91.22kg/kmol)/7). For the thermal detonation model, the specific heats of melt droplets and fragments can be determined to be 0-5 KJ/kgk and 0.9 KJ/kgk (2-1 MJ/kg/2400°C), respectively. The effects of non-condensible gas (hydrogen) on steam explosion processes are not considered in this study, however, one major effect is to hinder steam-bubble collapsing and fragmentation of the melt droplets. Because melt droplets are not oxidized much, the effects of the hydrogen from oxidation on the thermal detonation model would be small. Sample results from the thermal detonation model and impulses on the pedestal wall are shown in Table 9. To calculate the impulse, the pressure on the pedestal wall is integrated during the first 20 ms. The values of the heat transfer coefficient between the melt and the water, Hfw, and the void fraction, 0c, strongly affect the peak pressure. The peak pressure is not sensitive to the fragment size, Dr, and nor the melt drop size, Dm. Further, any of the impulses generated from the shock wave transmitted through the water that do not exceed 0-01 MPa/s cannot threaten to collapse the pedestal. The impulses due to the mixture bubble expansion are strongly sensitive to R as shown in Table 9. Dm and Df do not much influence the impulses. 4.5 Determination o f the probability o f early containment failure (ECF) due to ex-vessel steam explosions

In the influence diagram for a BWR established by Kastenberg et al., the probability of ECF is dependent on the occurrence of ex-vessel steam explosions (EVSEs), high pressure melt ejections ( H P M E s ) , and vessel pressure. 3 Ex-vessel steam explosions are mutually excluded by H P M E and are independent of vessel pressure. To determine the probability of ECF due to ex-vessel steam explosions, Pcv, the above analysis is done when H P M E does not occur. To determine whether the pedestal collapses, a

The impact of phenomenological uncertainties on accident management strategy

187

Table 9. Sample results of thermal detonation model and impulses on the pedestal wall Mixture Size, R

106W/m2K, 0: =0.3, Vm= 0"1, Dm=2mm, Dr= 100/~m) Pressure at Peak pressure Impulse" center 1.48E + 8 Pa 3.19E + 8 P a 1-77E + 5 Pas 1.73E + 8 Pa 4.54E + 8 Pa 7-26E + 5 Pa s Heat transfer coefficient Hfw ( R = 2 m , 0:=0.3, Vm=0-1, Dm=2mm, Dr= 100/~m) Heat transfer Pressure at Peak pressure Impulse coefficienlt01W/m-'K) center • 8-81E + 7 Pa 1.49E + 8 Pa 4.29E + 5 Pa s 10" 1.73E + 8 Pa 4-54E + 8 Pa 7.26E + 5 Pa s Void fraction, 0:. (R = 2 m, Hfw = 106W/mZK, Vm= 0"1, Dr, = 2 mm, Df = 100/~m) Void fraction Pressure at Peak pressure Impulse center 0.1 3-54E + 8Pa 2.03E + 9Pa 1.18E+6Pas 0.3 1-73E + 8 Pa 4.54E + 8 Pa 7.26E + 5 Pa s Volume fraction of melt, Vm. (R = 2 m, Hfw = 106W/m2K, 0: = 0.3, Dm= 2 mm, Df = 100/~m) Volume fraction Pressure at Peak pressure Impulse of melt center 0.1 1.73E + 8 P a 4.54E + 8 P a 7.26E + 5 Pas 0-2 4.12E + 8 Pa 1.04E + 9 Pa 1.42E + 6 Pa s Melt droplet size, D~. ( R = 2 m , Hfw=lO6W/m2K, 0:=0.3, Vm=O.1, O f = 100 ~ m) Pressure at Peak pressure Impulse Size of droplet (mm) center 1-73E + 8 Pa 4.54E + 8 Pa 7-26E + 5 Pa s 2.0 8.0 1-45E + 8 Pa 2.93E + 8 Pa 6.06E + 5 Pa s Melt droplet size, Df. (R = 2 m , Hfw=lOrW/m:K, 0:=0-3, Vm=0"l, Dm = 2 mm) Size of Pressure at Peak pressure Impulse fragment (/~m) center / 100.0 1.73E + 8 Pa 4.54E + 8 Pa 7.26E + 5 Pa s 300.0 1.37E + 8 Pa 3.02E + 8 Pa 5.86E + 5 Pa s (Hf,~ =

Radius of mixture (m) 1.0 2.0

Impulses generated from the mixture bubble expansion on the pedestal wall. +: Read as 1.48 x 10~Pa.

criterion for collapse of the pedestal due to impulse, ler, is assumed by Payne et al. to be 58.75 kPa/s. 4° The probability of drywell failure due to the pedestal failure, Pdf, is assumed to be 0.175. However, it is reasonable that, if the pedestal fails at higher impulses, Pdf should be higher. In the present study, it is arbitrarily assumed, based on the Pdf of Payne et al., that Pdf is 1"0 if the impulse is higher than 5 x let and Pdf is 0"175 when the impulse is l~r. This yields 0.875 Pdf = - X (Impulse - let) + 0.175. 4Xlcr

(3)

Equation (3) is for demonstration only. The value of 0.175 is based on expert opinions about the issue that the drywell fails when the pedestal collapses due to the molten core concrete interaction. In this study, Pdf is assumed to have no uncertainty. If one introduces uncertainty in Icr (generally, the failure conditions of structures are described as probability distributions due to stochastic variability), Pdf has uncertainty.

The drywell wall can also be threatened by relatively slow pressure rise due to steam generation after completion of the thermal detonation process. In the present study, however, the slow pressure rise is n~)t regarded as a p h e n o m e n o n related to steam explosions. A response surface, eqn (4), was developed with IMSL subroutines using the six uncertainty factors as first order regressors, iogl0(Impulse) = 2.744 + 0.6834R + 0-2861 logm(Hfw) - 0.3529tr + 3"098Vm - 12.82Dm - 73.30 X 10ZDr

(4) where all units are SI. Several sets of variables are tried to develop the RS. A m o n g them, the above variables are the best set. The percentage variation explained (the values of R 2 in the terminology of statistics) for the above set is 96%, which means the above equation explains 96% of the total variation

188

Ivan Catton, Hakkyu Lim Table 10. Assumed CDFs for uncertain factors in the thermal detonation model Size of mixture (m) Cumulative probability

0.0 0.0

2.0 0-1

2.5 0.2

3-0 0.5

3-5 0.8

4.0 0.9

~.(I 1.0

Heat transfer Coefficient (x 10SW/m~K) Cumulative probability

0.01 0.0

1.0 0.1

2.5 0,2

5.0 0.5

7-5 0.8

10.0 0.9

100.0 1.0

Void fraction Cumulative probability

0-0 0.0

0.1 0.1

0.15 0.2

0.2 0.3

0.25 0.6

0.3 0.9

0.5 I.{1

Volume fraction of melt Cumulative probability

0.0 0.0

0.1 0.1

0.12 0,4

0.14 0.5

0.17 0.7

0.2 0.9

(1.3 1-0

Size of droplet (mm) Cumulative probability

0-1 0.0

2.0 0.1

4.0 0.3

5.0 0.5

6.0 0.7

8-0 0.9

10.0 1.0

Size of fragment (/~m) Cumulative probability

10.0 0-0

100.0 0.1

150.0 0.3

200.0 0-6

250-0 0.8

300.0 0-9

1000.0 1-0

a b o u t the average i m p u l s e in the calculation results from the m o d e l . A s m e n t i o n e d a b o v e , specification of the p r o b a b i l ity d i s t r i b u t i o n s of the u n c e r t a i n t y factors is a s u b j e c t i v e process, d u e to lack of data. In this study, two c u m u l a t i v e d i s t r i b u t i o n f u n c t i o n s ( C D F s ) for each of the u n c e r t a i n t y factors were a s s u m e d ; u n i f o r m a n d s u b j e c t i v e l y specified d i s t r i b u t i o n s (SSDs). T h e SSDs are s h o w n at several p o i n t s for each of the u n c e r t a i n t y factors in T a b l e 10. U n i f o r m d i s t r i b u t i o n s ( U D s ) are d e f i n e d f r o m 10 to 9 0 % of the SSD ranges. If t h e r e is n o k n o w l e d g e a b o u t the p a r a m e t e r values, U D s should be used b e c a u s e they are the least i n f o r m a t i v e . In this study, SSDs a n d U D s do not differ c o n s i d e r a b l y except for the ranges, d u e to insufficient data a b o u t the p a r a m e t e r s . T h e i n t e g r a t i o n of each of the effects of u n c e r t a i n t y factors o n the

final p r o b a b i l i t i e s (pedestal collapse p r o b a b i l i t y a n d Per) is d o n e using a M o n t e C a r l o m e t h o d with 100 000 samplings. T a b l e 11 shows the m e a n values of the p r o b a b i l i t y of pedestal collapse due to E V S E (Ppf) a n d Per, a n d early a n d late fatalities according to Per, given the a s s u m e d d i s t r i b u t i o n s (see F!g. 5). T o investigate the effects of each of the u n c e r t a i n t y factors o n Pof a n d Per, M o n t e Carlo s i m u l a t i o n s are p e r f o r m e d with five u n c e r t a i n t y factors. T h e value of the o t h e r factor is fixed at a 90% or 10% value, a n d the c o m b i n e d effects of two or three u n c e r t a i n factors are also investigated. T h e results are s h o w n in T a b l e 11. T h e u n c e r t a i n factors c h o s e n for the p r e s e n t study, except the size of the m i x t u r e , do n o t greatly affect the risk results of the strategy, u n d e r the SSDs of all o t h e r u n c e r t a i n t y factors. A c c o r d i n g to the p r e s e n t study a n d the a s s u m e d C D F s , the mixing a n d

Table U . Risk results of evaluation of influence diagram for 'flooding' case Ppf P~v Early fatalities Late fatalities SSDs 9.61E - 1 8.17E - 01 2.54E - 03 4.63E + 02 UDs 1.0 9-02E - 01 2.64E - 03 4.82E + 02 Effect of each (or several) uncertain factor on evaluation of influence diagram, given SSDs R = 1-0 m 9.50E - 01 5.46E - 01 2.17E - 03 3.97E + 02 2.0 m 1.0 9.85E - 01 2-76E - 03 5.04E + 02 Hrw = 105 9.36E - 01 6-95E - 01 2.37E - 03 4-34E + 02 106 9.79E - 01 8.86E - 01 2.63E - 03 4-80E + 02 a = 0.1 9.66E - 01 8.38E - 01 2.57E - 03 4-68E + 02 0.3 9.56E - 01 7-97E - 01 2-51E - 03 4-58E + 02 Vm= 0.1 9.42E - 01 7.35E - 01 2.43E - 03 4.43E + 02 0-2 9.86E - 01 9.08E - 01 2.66E - 03 4-86E + 02 Dm= 2 mm 9-67E - 01 8.39E - 01 2.57E - 03 4.69E + 02 8 mm 9-55E - 01 7.93E - 01 2.51E - 03 4.58E + 02 Df = 100/~m 9-75E - 01 8-72E - 01 2.61E - 03 4-76E + 02 300 ~um 9.56E - 01 7-87E - 01 2.50E - 03 4.56E + 02 R = 1.0 m, Hfw = 105 9.06E - 01 3.45E - 01 1.90E - 03 3.48E + 02 R = 2-0 m, Hfw = 106 1.0 9-97E - 01 2-78E - 03 5.07E + 02 R = 1.0m, Hfw = 105, Vm=0"l 9.08E + 00 2-24E - 01 1.74E - 03 3.18E + 02 R---2.0m, Hfw=106, Vm=0"2 1.0 1.0 2.78E - 03 5-08E + 02 Kastenberg et al. 5.23E - 01 2.39E - 03 4-40E + 02

The impact of phenomenological uncertainties on accident management strategy

189

Effect of P ( E C F [ E V S E , n o t H P M E ) P(VBt not R,WC) :0.1

0.006

o oo''°" 0.005

--

pOtelnot R,WC)=O.S

°.-''°

Do Nothing

.°°..-''" **°°.-°'° ° .~"

0.004

° ..o'~''°

(n (1)

tL

.° .~''° 0.003

°o°.°°~'°~

w 0.002

0.001

..% ...... 0.2

I 0.4

I ...... 0.6

( 0.8

P(ECFIEVSE,notHPME) DF:IO.O P(ECFI not EVSE,HPME):0.001

Pig. 5. The effects of Pc, and P(VB) on the risk results. triggering phenomena of steam explosions are extremely important, as these actually decide the mixture size. However, if the effects of uncertain factors are combined, the risk results can be greatly affected by the change. The uncertainties in R, Hf,~, and Vm can increase risk by about 65% if the uncertainties are combined. The risk results of 'do-nothing' scenarios for all cases and distributions are the same as the results by Kastenberg et al.3 (See Table 4.)

5 B U O Y A N C Y DRIVEN R E C I R C U L A T I O N FOR PWRS 5.1 Issue definition During a high pressure loss of injection sequence (e.g. station blackout) in a PWR, buoyancy driven recirculation flows will lead to heat transfer from the hot gases leaving the uncovered core to cooler structures in the reactor vessel and coolant loops. The recirculation flow can manifest itself in several ways: the traditional coolant path through the coolant loops, recirculation within the vessel, recirculation between the upper plenum and the hot side-plenum of the steam generator, recirculation through the steam generator tubes from the hot to cold side-plena, and combinations of these. These complicated processes are amenable to calculation with the right tools.

Important consequence of the recirculation is creep rupture failure of the RCS loops due to the increased structure temperature. Three locations are of primary interest: the hot-leg nozzle, because it is exposed to the highest vapor temperature; the surge line, because it is one-third the hot-leg thickness, and the steam generator tubes because they are the thinnest structural boundaries of the RCS. If the seam generator tubes fail. a direct path to the atmosphere may be available through the steam line safety valves, allowing fission products to bypass the containment. 41 In this study, an RCS boundary failure at Surry station is examined. RCS boundary failures due to buoyancy driven recirculations are one of the adverse effects of cavity flooding strategy. The results of earlier UCLA work shows that if the probability of a late steam generator tube rupture is greater than about 0-6 flooding is detrimental. 3 The decision to use the strategy depends strongly on the choice of the probability. The probability of an RCS boundary failure is determined using the results of existing analyses by Bayless and Cha et al. 41.42 without further calculation in spite of their shortcomings. These analyses, however, are not enough to allow one to calculate probabilities leading to some subjectivity in the probability estimation procedure. An analysis of this issue will be performed as a part of the PhD thesis of Hakkyu Lim, using a computer code developed by Wassel et al. 4~ to calculate heat-up of the hot leg and steam generator tubes.

190

Ivan Canon, H a k k y u L i m

5.2 Model description Bayless and Cha et al. calculated the temperature distribution of RCS when buoyancy driven recirculations exist in R C S . 41-42 The model of Wassel et al. 43 is also reviewed briefly for the comparison with two previous works. Bayless: Analyses were performed using the S C D A P / R E L A P 5 computer code, which provides one-dimensional integral calculations of the system thermalhydraulics and the core behavior. The S C D A P / R E L A P 5 model includes all of the major components necessary to perform the station blackout analyses. The model for the hot leg countercurrent flow was developed using work performed by C O M M I X computer code. 42 The flow rates entering and leaving the inlet plenum of the steam generator (SG) were calibrated by changing several factors in the model and adjusted to the values of calculation results of the C O M M I X code. In the model for hot-leg countercurrent recirculation, the hot-leg flows were phyically separated. Many factors needed to run the model such as the division of SG tubes were assumed, based on Westinghouse natural circulation experiments 44 and the C O M M I X code calculation results. It should be noted, however, that S C D A P / R E L A P 5 does not treat the heat transfer correctly for countercurrent single-phase stratified flow. The calculations were performed from transient initiation until after fuel rod relocation had begun. Cha et al: Multi-dimensional calculations were performed with the C O M M I X computer code. The C O M M I X code is a generalized computer code for heat transfer and fluid flow analysis. The numerical models included the reactor vessel, a SG or SGs, and the hot-leg pipe. It was assumed that no heat is transferred from the SG tubes to the secondary side or the hot-leg pipe walls. The calculations were performed from the onset of clad heat-up until initiation of clad oxidation start. Wassel et al.: The model was developed to predict ex-vessel recirculation within the hot leg and steam generator. The timing and the location of RCS failure are special concerns. The model consists of three parts; a one-dimensional stratified flow model in the horizontal hot leg, a mixing process model in the SG inlet plenum, and a one-dimensional buoyancy driven flow model in the SG tubes. The models are based on thermal hydraulics, unlike the model in S C D A P / R E L A P 5 , and were verfied by comparison with experiments. 44

5.3 Parameter uncertainties in the model and results Unfortunately, the above studies are not complete enough for the present study. In the present study, it

is assumed that a large amount of the core is relocated into the vessel lower plenum forming a molten corium pool. If the RCS boundary does not fail until the pool is formed, the recirculation generated by heating from the corium pool should also be considered to obtain a more reasonable assessment of the strategy. The results of the above studies can, however, be used to describe the early stages of the process. In the S C D A P / R E L A P 5 model by Bayless, many parameters are used to make a one-dimensional simplified model. All of the parameters are essentially uncertain because there is no appropriate data for the model. For some important parameters, sensitivity analyses were performed. Based on the sensitivity analyses, it was concluded that steam generator tube failure would probably not occur. Hot-leg countercurrent flow led to the conclusion that creep rupture failure of the pressurizer surge line was most likely. In some cases (no mixing in the SG inlet plenum), the hot legs failed. However, if the loop seals clear, not a consideration in the Bayless study, hot-leg countercurrent flow does not occur and the SG tubes may fail first. In the new AP600 PWR design, no loop seals will occur making the steam generator tubes more vulnerable. The safeties, however, do not exhaust to the atmosphere. Cha et al., using COMMIX, concluded that the most likely failure location is either the hot leg or the surge line. The hot leg fails due to thermal stresses generated in the pipe wall. The surge line may be equally or more vulnerable to failure than the hot leg since the surge line is the thinnest part of the RCS and the velocity is very high in the surge line. It is not clear how separation and reattachment were treated at the surge line nozzle. This could make the surge line even more vulnerable. A proper analysis for hot leg recirculation must be fully three-dimensional.

5.4 Determination of the probability of RCS boundary failure due to the recirculation From the review of the above work, the probabilities of late steam generator tube rupture (LSGTR) and hot leg or surge line failure (HSF) can be determined subjectively as conventional expert opinions. However, it is difficult to argue that the resulting probabilities are more accurate or defensible than those used by Kastenberg et al. 3 To consider the effect of these probabilities on the evaluation of the strategy, sensitivity analyses over the ranges from 0.0 to 1.0 were performed and can be found in the previous work by Kastenberg et al. An effort to obtain the probabilities using the method proposed in this work is underway and results should be available in the near future.

191

The impact o f phenomenological uncertainties on accident management strategy 6 DISCUSSION AND CONCLUSIONS 6.1 Discussion

In this work, calculations were made of probabilities that certain phenomena related to severe accident progression would lead to a particular result. This allowed us to evaluate flooding the reactor cavity as a severe accident mitigation strategy. The probabilities that hot leg, surge line and late steam generator tube failure would occur were left to the future when better modeling of in-vessel hot gas recirculation and heat transfer are done. The phenomena addressed in some detail were lower head heat transfer and ex-vessel steam explosions, although much remains to be done to determine whether or not the cooled vessel will fail. Kastenberg et al. used the same consequences to calculate the risk results for both 'flooding' and 'do-nothing' cases. However, if the flooding strategy is used, the consequences should be changed compared to the 'do-nothing' case. For example, if an isolation failure (IS) occurs in a BWR when the drywell is flooded, the consequences can be significantly reduced because of the scrubbing effect of water. In the present study, when the risk results are calculated for BWR, the consequences of isolation failure is assumed to be one fiftieth of a 'do-nothing' case. This is equivalent to assuming a decontamination factor of 50 for the water in the drywell. However, it should be higher. The probability of vessel failure is strongly dependent on the corium pool volume in the vessel lower head and the commensurate heat transfer. Because too few calculations were done, the conditional probability of vessel failure, given the vessel pool volume, was simply specified to be 0-3 or 0.7 at three values of the pool volume. As a result, the vessel failure probability is not strongly sensitive to the probability distribution of the pool volume. Even though the probability is sensitive to the distribution, the impact of the uncertainties (change of the distribution) in the phenomenological factors related to a chance node on the assessment of the strategy would not be strong because the effects of other chance nodes conceal the impact. The model needs to be improved, because there is no single uncertainty factor that strongly affects the assessment of the strategy. The model could, for example, be improved to include the motion of the molten corium and solid debris in the molten pool, and to develop a better boundary melting model. Another improvement would be to include plastic deformation in the stress analysis. The present assumption is that the vessel fails when the elastic limit is reached. The probability of ECF due to EVSE, Pev, was calculated using a combination of three existing models. To our knowledge, this is the first time

Table 12. Effects of uncertainty in phenomenological parameters on the risk results

Parameters

Percent change~ of early fatalities

Percent change" of late fatalities

R H~ E, R and H~ R, H~ and Vm

27.2 11-0 9.47 46-3 59.8

27.0 10.6 9-71 45.7 59.7

a (Fatalities at maximum values-fatalities at minimum values)/fatalities at minimum values.

calculation of the impulses generated from steam explosions has been performed using three separate models: a thermal detonation model, a model for propagation of pressure waves generated from underwater explosions, and a zirconium oxidation model. Although there are many previous studies of steam explosions, there is no reliable analytic model for predicting the outcome of a steam explosion. Each of the three models combined to calculate Per has weak points that depend on subjective knowledge, including assumptions and simplifications. The need for the probability that an ex-vessel steam explosion could cause ECF led us to use imperfect models in the present study. However, these models seem to be good enough to use in scoping studies. Based on the current results, the mixture size is the most important factor among the six uncertainty factors in the thermal detonation model used to assess the cavity flooding strategy. To reduce uncertainties in the assessment, the premixing and triggering stages which determine the mixing size need to be better established. This does not mean that the three models do not need improvement. Reduction of the uncertainty in the mixing size appears to be most cost effective. The effect of a single uncertain factor on the results is not strong. The combined uncertainty of several uncertain factors may affect significantly the probabilities and the risk results. The combined uncertainty in the mixture size, heat-transfer coefficient, and initial volume fraction can result in a big change of the risk results. The calculated probabilities were substituted in the influence diagrams of Kastenberg et al. 3 The results are shown in Table 13. From the results shown in Table 13, it is clear that flooding the reactor cavity is of little benefit to PWRs. The risk results are only reduced if one can be sure that the steam generator tubes will not fail (this will be addressed in a future study). For BWRs, flooding the drywell is definitely effective as a severe accident management strategy. The comparison with the results of the study by Kastenberg et al. shows little

192

Ivan Catton, H a k k y u L i m

Table 13. Final risk results from evaluation of the influence diagram with probabilities from the present study

Early fatalities

Late fatalities

Do-nothing Flooding Do-nothing PWR Present study

Kastenberg et al. 3 BWR Present study Kastenberg et al. 3

1.09E- 2 1-09E- 2

Flooding

1.06E- 2" 5-63E + 1 9.67E + 1" 8.22E - 3h 4.47E + 1h 9-17E- 3 5-63E + 1 4.86E + 1

5.68E - 3 2.56E - 3 5.68E - 3 2-39E - 3

1.03E + 3 4.67E + 2 1.03E + 3 4.40E + 2

" PLSCTR= 1'0. b PLS~TR= 0"0. For PWR, Pvh = 0-7; for BWR, Pvb = 0.4 and Per = 0.83. change, in part because this work contributed heavily to it and to their heavy use of N U R E G 1150 data. The influence diagram developed by Kastenberg et al. 3 was made sequentially. Therefore, the probability of vessel breach affects the impact of Per on the risk results. Figure 5 shows that if the vessel breach probability, P ( V B ) , in B W R increases, the effects of Pev increase. If P ( V B ) is not high, the uncertainty in P~v does not much affect the risk results. Otherwise, the uncertainty in Per may play an important role in assessing the strategy. For a PWR, the effects of PLSOTR is affected by the vessel breach probability. In order to more precisely investigate the impact of uncertainty in the phenomenological parameters on the assessment of the strategy, the predecessors among chance nodes, i.e. vessel breach node, should have less uncertainty than the successors among chance nodes, i.e. early containment failure node. 6.2 Conclusions

Some of the necessary subjective probabilities of severe accident phenomena were determined through objective calculation. The probabilities obtained were substituted into the influence diagram for the assessment of the strategy. The risk results of the flooding strategy are not much different from the results of Kastenberg et al. 3 However, the results of the present study have less subjectivity than those of Kastenberg et al. 3 According to the results of the present study, the impact of each uncertainty factor in the models assessed is not strong because uncertain factors affect only a probability of a chance node, and because the effects o f the remaining chance nodes smear the impact. However, if the uncertainties in several factors are combined, they can affect the assessment of the strategy. In the present study, the uncertainty factors affect only the probability of their chance node. However, uncertainty factors in the phenomena (models) may affect more than one chance node in the influence

diagram. For example, the amount of molten core materials in the lower head affects the vessel failure and the ex-vessel steam explosions. The response surfaces reflect dependence on a number of variables that in turn depend on another response surface. The impact of uncertainties of phenomenological factors on the assessment may become less diffuse if the effects of the factors on all the nodes that they impact are connected. In our future work, the impact of uncertainty factors related to several chance nodes in the influence diagram will be studied. It became cle~ir as we carried out the work for this paper that all probabilities in the influence diagram must be properly balanced. It is very easy to forget a number somewhere and have it distort the results. Further, the primary chance node, which accident management strategy influences, must be subjected to very detailed and proper deterministic evaluation before one attempts to evaluate the strategy. In this case it is vessel breach. For example, in PWR, the 70% chance of vessel failure based on the roughly assigned state-of-knowledge distribution of the heattransfer coefficients is not enough to reach a clear conclusion.

REFERENCES

1. Theofanous, T. G., Najafi, B. & Rumble, E., An assessment of steam-explosion-induced containment failure. Part I: Probabilsitic Aspects. Nucl. Sci. & Engng, 97 (1987) 259-81. 2. Jae, M. & Apostolakis, E., The use of influence diagrams for evaluating severe accident management strategies. Nucl. Technol., 99 (1992) 142-57. 3. Kastenberg, W. E., Apostolakis, G., Dhir, V. K., Okrent, D., Jae, M., Lim, H., Milici, A., Yu, D., Xing, L., Swider, J. & Park, H., A framework for the assessment of severe accident management strategies. NUREG/CR 6056, 1993. 4. Berman, M., Comments on subjective probability and expert opinions. Reliab. Engng System Safety, 2,3 (1988) 263-8.

The impact o f phenomenological uncertainties on accident management strategy 5. Berman, M., A critique of three methodologies for estimating the probability of containment failure due to steam explosions. Nucl. Sci. Engng, 96 (1987) 173-91. 6. Powers, D. A., A probabilsitic method for the evaluation of severe accident source term uncertainties. Probabilistic Safety Assessment and Management, 2 (1991) 1173-8. 7. Leliouche, G. S. & Levy, S., Quantifying reactor safety margins Part 4: Uncertainty evaluation of LBLOCA analysis based on TRAC-PF1/MOD 1. Nuclear Engineering Design 119 (1990) 67-95. 8. Jae, M., Milici, A., Kastenberg, W. E. & Apostolakis, G., Sensitivity and uncertainty analysis of accident management strategies involving multiple decisions. Nucl. Technol., 104 (1993) 13-36. 9. Park, H., Effect of external cooling on the thermal and mechanical behavior of light water reactor vessel heads. PhD dissertation, University of California, Los Angeles, CA, USA, 1992. 10. Park, H. & Dhir, V. K., Effect of outside cooling on the thermal behavior of a pressurized water reactor vessel lower head. Nucl. Technol., 99 (1992). 11. Mayinger, F., Jahn, M., Reineke, H. & Steinbrenner, V., Examination of thermohydraulic process and heat transfer in a core melt. BMFI" RS 48/1, Institute fur Verfanhrenstechnic der TU, Hanover, Germany, 1976. 12. Gabor, J. D., Ellison, P. G. & Cassalo, J. C., Heat transfer from internally heated hemispherical pools. Paper presented at 19th Nat. Heat Transfer Conf., Orlando, FL, USA, 1980. 13. Larson, F. R. & Miller, J., A time-temperature relationship for rupture and creep stress. Trans. ASME (1952) 765. 14. Shah, V. N., Creep rupture failure of reactor pressure vessel lower head during severe accident. EGG-M06886, September, 1986. 15. Frantz, B. & Dhir, V. K., An experimental investigation of natural convection in spherical segments of volumetrically heated pools. Paper presented at the 28th Nat. Heat Transfer Conf., San Diego, CA, USA, August, 1992. 16. Levy, S., An integrated structure and scaling methodology for severe accident technical issue resolution, Appendix G amount of material involved in direct containment heating during a pressurized water reactor station blackout. NUREG/CR-5809, EGG-2659, 1991. 17. Mandi, I. K., MELCOR simulation of long term station blackout at Peach Bottom. Proc. 18th Water Reactor Safety Info. Meet., NUREG/CP-0114, 1 (1991). 18. Dingman, S. E., Cole, R. K., Haskin, F. E., Summers, R. M. & Webb, S., Analysis of Peach Bottom Station blackout with MELCOR, Proc. 14th Water Reactor Safety Info. Meet., NUREG/CP-0082, 1 (1987). 19. Corradini, M. L., Vapor explosions: A review of experiments for accident analysis. Nucl. Safety, 32 (1991) 337-62. 20. Corradini, M. L., Kim, B. J., & Oh, M. D., Vapor explosions in light water reactors: A review of theory and modelling. Progr. Nucl. Energy, 22 (1988) 1-117. 21. Fletcher, D. F., An improved mathematical model of melt/water detonations---l. Model formulation and example results. Int. J. Heat & Mass Transfer, 34 (1991) 2435-48. 22. Kirkwood, J. G. & Bethe, H. A., Basic Propagation Theory. OSRD 588, 1942. 23. Cole, R. H., Underwater Explosions. Dover Publications, Inc., NY (1965). 24. Gilmore, F. R., The Growth or Collapse of a Spherical

193

Bubble in a Viscous Compressible Liquid. Hydrodynamic Laboratory, California Institute of Technology, Pasadena, CA, USA (1952). 25. Epstein, M., Leung, J. C., Hauser, G. M., Henry, R. E. & Baker, Jr. L., Film boiling on a reactive surface. Int. J. Heat & Mass Transfer, 27 (1984) 1365-78. 26. Board, S. J. & Hall, R. W., Recent advances in understanding large-scale vapor explosions. 3rd Specialist Meet. Sodium Fuel Interactions, Tokyo, Japan, 1976 PNC N251, 76-12, pp. 249-83. 27. Carachalios, C., Burger, M. & Unger, H., A transient two-phase model to describe thermal detonations based on hydrodynamic fragmentation. Proc. Int. Meet. LWR Severe Accident Evaluation, Cambridge, MA, USA, August 28-September 1, 1983. 28. Magallon, D. & Hohmann, H., High pressure corium melt quenching tests in FARO. Paper presented at CSNI FCI Specialist Meet., Santa Barbara, CA, USA, January 5-8, 1993. 29. Henderson, L. F., Ma, J., Sakurai, A. & Takayama, K., Refraction of a shock wave at an air-water interface. Fluid Dynamics Res., 5 (1990) 337-50. 30. Baker, Jr. L., & Just, L. C., Studies of metal-water reactions at high temperatures III. Experimental and theoretical studies of the zirconium-water reaction. Report ANL-6548, Argonne National Laboratory, Argonne, IL, USA (1962). 31. Kofstad, Per, High-temperature Oxidation of Metals. John Wiley & Sons, Inc., New York, 1966. 32. Parker, G. W., Ott, L. J. & Hodge, S. H., Small scale BWR debris eutetics formation and melting experiment. Nucl. Engng Design, 121 (1990) 341-7. 33. Yu, D., Two Problems in Risk. PhD Dissertation, University of California, Los Angeles, CA, USA, 1992. 34. Marshall, Jr. B. W. & Berman, M., An experimental study of isothermal and boiling liquid jets. Proc. 14th Water Reactor Safety lnfo. Meet., NUREG/CP-0086, 6 (1987). 35. Fletcher, D. F. and Denham, M. K., Validation of the Chymes mixing model. Paper presented at CSNI FCI Specialist Meet., Santa Barbara, CA, USA January 5-8, 1993. 36. Corradini, M. L. & Moses, M. L., Limits to fuel/coolant mixing. Nucl. Sci. Engng, 90 (1985) 19. 37. Hodge, S. A., Cleveland, J. C., Kress, T. S. & Petek, M., Identification and assessment of BWR (in-vessel) severe accident mitigation strategies. NUREG/CR5869, ORNL/TM-12080, 1992. 38. Fletcher, D. F. & Anderson, R. P., A review of pressure induced propagation models of the vapor explosion process. Progr. Nucl. Engng, 23 (1990) 137-79. 39. Fletcher, D. F., The particle size distribution of solidified melt debris from molten fuel-coolant interaction experiments. Nucl. Engng Design, 105 (1988) 313-19. 40. Payne, A. C., Breeding, R. J., Jow, H.-N., Helton, J. C., Smith, L. N. & Shiver, A. W., Evaluation of severe accident risks: Peach Bottom, Unit 2. NUREG/CR4551, SAND86-1309, 4 Rev. 1, Parts 1 and 2, 1990. 41. Bayless, P. D., Analyses of natural circulation during a Surry station blackout using SCDAP/RELAP5. NUREG/CR-5214, EGG-2547, E G & G Idaho, Inc. (1988). 42. Cha, Y. S., Domanus, H. M., Liu, K. V., Schmit, R. C., Sha, W. T. & Shah, V. L., Numerical simulation of natural circulation phenomena in a PWR during TMLB' transient prior to core damage. NUREG/CR-5247,

194

Ivan Catton, Hakkyu Lim

ANL-88-47, Argonne National Laboratory, Argonne, IL, USA (1989). 43. Wassel, A. T., Ghiaasiaan, S. M., Denny, V. E. & Traci, R. M., Modelling of Natural Circulation in Reactor Coolant Systems, FPI R88-05-04, Fluid Physics Inc., Encinitas, CA, USA, June, 1988. 44. Stewart, W. A., Piecyznski, A. T. & Srinivas, V., Experiment on natural circulation flows in steam

generators during severe accidents. Proc. Int. ANS/ENS Topical Meet. on Thermal Reactor Safe~, San Diego, CA, USA, February 2-6, 1986. 45. WASH-1400, Reactor Safety Study, Appendix VIII, United States Nuclear Regulatory Commission (USNRC), NUREG 75/014 (WASH-1400), October, 1975.