In this paper we evaluate the impact of a power uprate on a pressurized water reactor (PWR) for a tsunami-induced flooding test case. This analysis is performed using the RISMC toolkit: the RELAP-7 and RAVEN codes. RELAP-7 is the new generation of system analysis codes that is responsible for simulating the thermal-hydraulic dynamics of PWR and boiling water reactor systems. RAVEN has two capabilities: to act as a controller of the RELAP-7 simulation (e.g., component/system activation) and to perform statistical analyses. In our case, the simulation of the flooding is performed by using an advanced smooth particle hydrodynamics code called NEUTRINO. The obtained results allow the user to investigate and quantify the impact of timing and sequencing of events on system safety. In addition, the impact of power uprate is determined in terms of both core damage probability and safety margins.
The Risk-Informed Safety Margin Characterization (RISMC) Pathway develops and delivers approaches to manage safety margins [ To develop and demonstrate a risk-assessment method coupled to safety margin quantification: the method can be used by decision-makers as part of their margin management strategies. To create an advanced RISMC toolkit: this RISMC toolkit would enable users to have a more accurate representation of nuclear power plant safety margins and its associated influences on operations and economics.
When evaluating the safety margin, what we want to understand is not just the frequency of an event like core damage but how close we are (or are not) to key safety-related events and how we might increase our safety margin through proper applications of Risk-Informed Margin Management (RIMM). In general terms, a “margin” is usually characterized in one of two ways: A deterministic margin, typically defined by the ratio (or, alternatively, the difference) of a capacity (i.e., strength) over the load. A probabilistic margin, defined by the probability that the load exceeds the capacity.
A probabilistic safety margin is a numerical value quantifying the probability that a safety metric (e.g., for an important process observable such as clad temperature) will be exceeded under accident scenario conditions.
The RISMC Pathway uses the probabilistic margin approach to quantify impacts on reliability and safety. As part of the quantification, we use both probabilistic (via risk simulation) and mechanistic (via physics models) approaches, as represented in Figure
The approach used to support RIMM analysis.
In order to perform advanced safety analysis, the RISMC project has a toolkit that was developed internally at INL using MOOSE [ RELAP-7 [ RAVEN [ PEACOCK [ GRIZZLY [
Overview of the RISMC toolkit.
This paper presents an analysis that evaluates the impacts of power uprates on a SBO event caused by external flooding. Due to the nature of the problem, the thermal-mechanical modeling needed to simulate component aging is not required. Thus, RELAP-7, RAVEN, and PEACOCK are being used. In this respect, Sections
The RELAP-7 code [
A real reactor system is very complex and may contain hundreds of different physical components. Therefore, it is impractical to preserve real geometry for the whole system. Instead, simplified thermal-hydraulic models are used to represent (via “nodalization”) the major physical components and describe major physical processes (such as fluid flow and heat transfer). There are three main types of components developed in RELAP-7: (1) one-dimensional (1D) components, (2) zero-dimensional (0D) components for setting a boundary, and (3) 0D components for connecting 1D components.
RAVEN (Risk Analysis and Virtual Control Environment) [
RAVEN consists of two main software components: Simulation controller. Statistical framework.
The first RAVEN component acts as controller of the RELAP-7 simulation while simulation is running. This control action is performed by using two sets of variables [ Monitored variables: the set of observable parameters that are calculated at each calculation step by RELAP-7 (e.g., average clad temperature). Controlled parameters: the set of controllable parameters that can be changed/updated at the beginning of each calculation step (e.g., status of a valve (open or closed) or pipe friction coefficient).
The manipulation of these two data sets is performed by two components of the RAVEN simulation controller (see Figure RAVEN control logic: it is the actual system control logic of the simulation where, based on the status of the system (i.e., monitored variables), it updates the status/value of the controlled parameters. RAVEN/RELAP-7 interface: it is in charge of updating and retrieving RELAP-7/MOOSE component variables according to the control logic.
RAVEN simulation controller scheme.
A third set of variables, that is, auxiliary variables, allows the user to define simulation specific variables that may be needed to control the simulation. From a mathematical point of view, auxiliary variables are the ones that guarantee the system to be Markovian [
The set of auxiliary variables also includes those that monitor the status of specific control logic set of components (e.g., diesel generators, AC buses) and simplify the construction of the overall control logic scheme of RAVEN.
The RAVEN statistical framework is a recent add-on of the RAVEN package that allows the user to perform generic statistical analysis. By statistical analysis we include the following: Sampling of codes: either stochastic (e.g., Monte Carlo [ Generation of Reduced Order Models (ROMs) [ Postprocessing of the sampled data and generation of statistical parameters (e.g., mean, variance, and covariance matrix).
Figure Model: it represents the pipeline between input and output space. It comprises both codes (e.g., RELAP-7) and also ROMs. Sampler: it is the driver for any specific sampling strategy (e.g., Monte Carlo, LHS, and DET). Database: it is the data storing entity. Postprocessing module: it is the module that performs statistical analyses and visualizes results.
Scheme of RAVEN statistical framework components.
PEACOCK is the GUI front end for the RELAP-7 code and, in general, for any generic MOOSE based application. It is a PYTHON based software interface that allows the user to interface both offline and online with the RELAP-7 simulation. The user can, in fact, both create/modify the RAVEN/RELAP-7 input file (offline) and monitor the RAVEN/RELAP-7 simulation while it is running (online). A screenshot of PEACOCK is given in Figure
Screenshot of the PEACOCK GUI for a RAVEN/RELAP-7 input file.
In the offline mode, the user has available all the blocks and components needed to build the RAVEN/RELAP-7 input file such as RELAP-7 simulation and component parameters, RAVEN variables: monitored, controlled, and auxiliary (see Section RAVEN/RELAP-7 simulation output information.
The purpose of this case study is to show the capabilities of the RISMC workflow in order to evaluate the impacts of power uprates on a PWR system during a SBO initiating event. This assessment cannot be easily performed in a classical ET/FT based environment [
We employ the RISMC toolkit (see Section
A PWR simplified model has been set up based on the parameters specified in the OECD main steam line break (MSLB) benchmark problem [
Scheme of the TMI PWR benchmark.
In order to simulate a SBO initiating event we need to consider also the following electrical systems (see Figure Primary power grid line 500 KV (connected to the 500 KV switchyard). Auxiliary power grid line 161 KV (connected to the 161 KV switchyard). Set of 2 diesel generators (DGs), DG1 and DG2, and associated emergency buses. Electrical buses: 4160 V (step-down voltage from the power grid and voltage of the electric converter connected to the DGs) and 480 V for actual reactor components (e.g., reactor cooling system). DC system which provides power to instrumentation and control components of the plant. It consists of these two subsystems: Battery charger and AC/DC converter if AC power is available. DC batteries: in case AC power is not available.
Scheme of the electrical system of the PWR model.
The scenario considered is a loss of offsite power (LOOP) initiating event caused by an earthquake followed by tsunami-induced flooding. Depending on the wave height, it causes water to enter into the air intake of the DGs and temporary disable the DGs themselves. In more detail, the scenario is the following (see Figure An external event (i.e., earthquake) causes a LOOP due to damage of both 500 KV and 161 KV lines; the reactor successfully scrams and, thus, the power generated in the core follows the characteristic exponential decay curve. The DGs successfully start and emergency cooling to the core is provided by the Emergency Core Cooling System (ECCS). A tsunami wave hits the plant causing flooding of the plant itself. Depending on its height, the wave causes the DGs to fail and may also flood the 161 KV switchyard. Hence, conditions of SBO are reached (4160 V and 480 V buses are not energized); all core cooling systems are subsequently offline (including the ECCS). Without the ability to cool the reactor core, its temperature starts to rise. In order to recover AC electric power on the 4160 V and 480 V buses, three strategies based on the Emergency Operating Procedures (EOPs) are followed: A plant recovery team is assembled in order to recover one of the two DGs. The power grid owning company is working on the restoration of the primary 161 KV line. A second plant recovery team is also assembled to recover the 161 KV switchyard in case it got flooded. Due to its lifetime limitation, the DC battery can be depleted. If this is the case, even if the DGs are repaired, DGs cannot be started. DCs power restoration (through spare batteries or emergency backup DC generators) is a necessary condition to restart the DGs. When the 4160 KV buses are energized (through the recovery of the DGs or 161 KV line), the auxiliary cooling system (i.e., ECCS) is able to cool the reactor core and, thus, core temperature decreases.
Sequence of events for the SBO scenario considered.
For the scope of this paper, the following parameters are uncertain:
For each of these parameters we will find the appropriate probability distribution function (see Section
This section shows how this PWR SBO analysis is being performed using the RISMC toolkit described in Section Initiating event modeling: it includes modeling characteristic parameters and associated probabilistic distributions of the event considered. Plant response modeling: it includes modeling of the plant system dynamics. Components failure modeling: it includes modeling of specific components/systems that may stochastically change status (e.g., fail to performs specific actions) due to the initiating event or other external/internal causes. Scenario simulation: when all modeling aspects are complete (see previous steps), a set of simulations can be run by stochastically sampling the set of uncertain parameters. Given the simulation runs generated in Step 4, a set of statistical information (e.g., CD probability) is generated. We are also interested in determining the limit surface: the boundaries in the input space between failure and success.
Overview of the RISMC approach to simulate initiating event and plant response using the RISMC toolkit.
A generic 3D facility model (see Figure turbine building, reactor building, offsite power facilities and switchyard, diesel generator (DG) building.
3D plant model developed to simulate flooding.
The 3D model is used as the collision geometry for any simulations. For this demonstration all objects are fixed rigid bodies; future analysis will explore the possibility of moving debris (caused by the flood) and possible secondary impacts due to this debris.
To mimic a tsunami entering the facility, a bounding container was added around the perimeter of the model and for the ocean floor. Then, over 12 million simulated fluid particles were added for the ocean volume. A wave simulator mechanism was constructed by having a flat planar surface that moves forward and rotates, pushing the water and creating a wave in the fluid particles.
Various wave heights can be generated by minor parameter adjustments to the movement of the wave generator. As the fluid particles are initially forced forward their movement energy is transferred and affects the particles around them using the mathematical equations for fluid physics built into the fluid solver.
There are many different approaches for simulating and optimizing fluid movement, each having different advantages and purposes. To achieve realistic and accurate results, a smooth particle hydrodynamics (SPH) based solver called NEUTRINO was used [
As the particles of a simulation move, they interact with the rigid bodies of the 3D model. The simulated fluid flows around buildings, splashes, and interacts in a similar manner to real water. Measuring tools can also be added to the simulation to determine fluid contact information, water height, and even flow rates into openings at any given time in the simulation. This information can be used in two ways, a static success or failure depending on wave height, or a dynamic result based on time could be used for more detailed analysis.
Several simulations were run at different wave heights. The fluid penetration into the site is measured for each of the simulations to determine at what height the different systems fail. For our specific case, we are monitoring the venting for the DGs and the offsite power structures.
As shown in Figure
Time spacing between failures of generators due to fluid in the air intake vents of the generator room.
The reactor vessel model consists of the Downcomers, the Lower Plenum, the Reactor Core Model, and the Upper Plenum. Three core channels (components with a flow channel and a heating structure) were used to describe the reactor core. Each core channel is representative of a region of the core (from one to thousands of real cooling channels and fuel rods).
In this analysis, the core model consists of three parallel core channels (hot, medium, and cold) and one bypass flow channel. Respectively, they represent the inner and hottest zone, the mid, and the outer and colder zone of the core. The Lower Plenum and Upper Plenum are modeled with branch models.
There are two primary loops in this model: Loop A and Loop B. Each loop consists of the Hot Leg, a heat exchanger and its secondary side pipes, the Cold Leg, and a primary Pump. A pressurizer is attached to the Loop A piping system to control the system pressure. Since a complex pressurizer model has not been implemented yet in the current version of RELAP-7 code, a Time Dependent Volume (pressure boundary conditions) has been used instead.
Figure
Screenshot of the PWR model of RELAP-7 using PEACOCK.
Core zone correspondence (a) and assembly relative power (b) [
Figure
Power distribution factors for representative channels and average pellet power.
Core channel | Power distribution factor | Average fuel pellet power density (W/m3) |
---|---|---|
Hot | 0.3337 | 3.90 108 |
Average | 0.3699 | 3.24 108 |
Cold | 0.2964 | 2.17 108 |
While Section
Regarding the time at which the tsunami wave hits the plant (i.e.,
Regarding the DG recovery time (
For the PG recovery time
For the probability distribution for the wave height (
Mean value of lambda as a function of return period.
pdf and cdf of wave height
Regarding battery life (i.e., Stress/stressors level. Task complexity.
These two parameters are used to compute the probability that an action will happen or not; the probability values are then inserted into the event trees that contain such events. However, from a simulation point of view we are not seeking if an action is performed but rather when such action is performed. Thus, we need a probability distribution function that defines the probability that an action will occur as a function of time.
Since modeling of human actions is often performed using lognormal distributions [
Correspondence table between complexity and stress/stressor level and time values.
Complexity |
|
Stress/stressors |
|
---|---|---|---|
High | 45 | Extreme | 30 |
Moderate | 15 | High | 15 |
Nominal | 5 | Nominal | 5 |
For the specific case of DC battery system restoration we assumed that the task has high complexity with extreme stress/stressors level. This leads to
As part of the analysis we consider that the initiating event, that is, the tsunami wave, affects both the sequence of events and the probabilities associated with those events (see Figure Wave height and DGs loss: DGs are intact and functional if the wave does not reach the exhaust inlet. Wave height and recovery time of PG (
Representation as ET structure of the RAVEN/RELAP-7 simulation. Note that the parameter characterizing the initiating event, that is, wave height, affects timing of the ET branches (e.g., PG recovery time).
In conclusion, Table
Probability distribution functions for sets of uncertainty parameters.
Parameter | Distribution |
---|---|
|
Uniform [0.0, 4.0] |
|
Weibull (alpha = 0.745, beta = 6.14) |
|
Lognormal (mu = 0.793, sigma = 1.982) |
|
Lognormal (mu = 1.586, sigma = 1.982) |
|
Triangular (4.0, 5.0, 6.0) |
|
Lognormal (mu = 0.75, sigma = 0.25) |
|
Exponential (lambda = 0.206) |
bIf switchyard is flooded by the wave.
This section presents in detail the series of results obtained by using the flooding simulation code NEUTRINO and the RAVEN/RELAP-7 plant response code. We focus our attention to evaluate the impact of wave height on plant response (see Section evaluate impact of power uprates on AC recovery timing (see Section evaluate impact of power uprates on CD probability (see Section
We performed a series of simulations using the NEUTRINO code on the 3D plant model in order to measure plant response for several wave heights (see Section
We found that the DGs tended to fail with smaller waves than the PG structures because the DG building is closer to the ocean shore and air intake vents face the wave directly (see Figure
Status of the two DGs (DG1 and DG2) and the PG switchyard as a function of the wave height using the NEUTRINO simulation code.
Wave height (m) | DG1 status | DG2 status | Offsite power switchyard status |
---|---|---|---|
<17 | Ok | Ok | Ok |
17-18 | Failed | Ok | Ok |
18–30 | Failed | Failed | Ok |
>30 | Failed | Failed | Failed |
Max flooding levels for several wave heights.
Note that, given the fact that the 3D plant model represents only a partial slice of the site and there is only a small opening to the backside of the facility that allows water to reach the PG switchyard, the PG switchyard may fail with smaller waves if a more complete model would be used.
As a second step, we started to evaluate how power uprates change the time to reach CD for different values of DG failure time. Two facts need to be considered: A power uprate implies that a higher energy is generated within the core and, hence, clad failure temperature is reached sooner. A late DG failure time allows the ECCS to successfully remove more heat from the RPV. Since the decay heat curve is exponential we expect that such dependency is not linear.
This reduction in time to reach CD ranges from 3200 s to 4000 s; hence, on average the core reaches CD about an hour quicker if power level increases from 100% to 120%.
While the analysis contained in Section
By using Latin Hypercube Sampling (LHS) available within the RAVEN statistical framework, we sampled ran evaluated the overall CD probability by looking at the outcome of each RAVEN/RELAP-7 simulation.
Using the RAVEN statistical framework (see Section
From the obtained results, which are shown in Table Probability of core damage Probability value associated with branch 1 (wave height does not disable DGs and, hence, AC power is always available throughout the simulation) since this value depends only on the wave height (i.e., if
Summary of the statistical analysis for 100% and 120% power levels.
Branch | Outcome | 100% | 120% | ||
---|---|---|---|---|---|
Counter | Probability | Counter | Probability | ||
1 | OK | 3657 | 0.9740 | 3657 | 0.9740 |
2 | OK | 2764 | 18.32 10−3 | 2500 | 18.17 10−3 |
3 | OK | 2403 | 7.498 10−3 | 2239 | 7.344 10−3 |
4 | CD | 1176 | 217.8 10−6 | 1604 | 522.2 10−6 |
A different way to view the
Obviously these boundaries are deterministically determined but probabilistic information can be generated by evaluating the CD probability as
In our applications, this integral is calculated using the stochastic sampling capabilities available in the RAVEN statistical framework.
Figure
Limit surface for 100% (a) and 120% (b) cases: AC recovery time versus DG failure time. Note how the failure region
When power increases it is expected that the failure region (red area) grows in the input space and, thus, also the probability of CD increases.
The value of
In this paper we have summarized the series of steps that are needed to evaluate a RISMC detailed demonstration case study for an emergent issue using RAVEN and RELAP-7. We studied the impacts of power uprates on a flooding induced SBO event using the RISMC toolkit. We started by modeling both the PWR system dynamics using the RELAP-7 code and the flooding scenario using the NEUTRINO code.
Even though the RELAP-7 and NEUTRINO codes were not tightly coupled to each other (i.e., the flooding analysis causes triggers such as a DG failure that is captured in the RELAP-7 calculation), it was possible to evaluate the overall system response on a much greater level of detail than compared to classical ET/FT based methodologies.
Our statistical analysis was performed using the RAVEN code which allowed us to evaluate the impacts of power uprates on the overall probability of core damage. We also determined how plant recovery procedures get reduced in time due to the power uprate itself.
In this paper we particularly focused on steps that are necessary to complete such statistical analysis and the information that can be generated from it. This information can be used to perform decision-making for the three possible scenarios: Power uprate is feasible since core damage probability increase Power uprate is not feasible since core damage probability increase Even though
For the third scenario, recovery procedure enhancement may include the following: Increase the height of the wave protection wall in order to reduce flooding level in the plant. This will act on the fraction of the wave height distribution that causes DG failure. Improve AC emergency recovery procedures (e.g., FLEX system). This action acts directly on either the DG or PG recovery distribution ( Move the DGs to a non-flood-prone area of the plant site. Improve the bunkering of the DG building in order to reduce the likelihood of flood-caused failures.
The authors declare that there is no conflict of interests regarding the publication of this paper.