Sensitivity and Uncertainty Analysis of the Maximum Fuel Temperature under Accident Condition of HTR-PM

-e maximum fuel temperature under accident condition is the most important parameter of inherently safe characteristics of HTR-PM, and the DLOFC accident may lead to a peak accident fuel temperature. And there are a variety of uncertainty sources in the maximum fuel temperature calculations, and thus the contributions of these uncertainty sources to the final calculated maximum fuel temperature should be quantified to check whether the peak value exceed the technological limit of 1620°C or not. Eight uncertainty input parameters are selected for inclusion in this uncertainty study, and their associated 2 standard deviation uncertainties and probability density functions are specified. -en, the DLOFC thermal analyses and uncertainty analysis are performed with the home-developed ATHENA and CUSA. -e numerical results indicate that the pebble-bed effective conductivity and the decay heat contribute the most of the uncertainty in the DLOFCmaximum fuel temperature while this peak fuel temperature is most sensitive to the initial reactor power and the decay heat. In short, uncertainties in these selected eight parameters lead to the two standard deviation (2σ) uncertainty of ±77.6°C (or 5.2%) around the mean value of 1493°C for the maximum fuel temperature under DLOFC accident of HTR-PM. At the same time, the LHS-SVDC method of CUSA is recommended to propagate uncertainties in inputs and 100–200 model simulations seem to be sufficient to get an uncertainty prediction with full confidence.


Introduction
e modular high-temperature gas-cooled reactor (MHTGR) such as the Chinese demonstration plant, named as hightemperature gas-cooled reactor-pebble bed module (HTR-PM) [1], is designed to retain its fission products inside the fuel coatings even if all active components for decay heat removal and reactivity control fail. One way to reach this goal is to make sure that the maximum fuel temperature during accident condition should not exceed the technological limit of 1620°C. e maximum fuel temperature under accident condition is the most important parameter of inherently safe characteristics of HTR-PM, which is about 900°C under normal operating conditions, far from the normal operation condition limit of 1200°C and the accident limit value of 1620°C. But during the depressurized loss of forced cooling (DLOFC) accident, the decay heat will be removed from the HTR-PM core only by physical ways such as heat conduction and radiation. Accounting for this, it may lead to a maximum accident fuel temperature. For other accidents, the fuel temperature is much lower than the fuel temperature during DLOFC because of the presence of helium with a certain pressure, which can enhance the ability of heat transfer in the HTR-PM core and flatten the temperature distribution depending on the helium natural circulation and heat conduction even if there is no forced flow [2]. e accurate prediction of maximum fuel temperature under accident condition is therefore most important to the nuclear reactor safety analysis and design. Considering that the HTR-PM is a complex nonlinear multiphysics, multiscale coupling system, the best-estimate (BE) methods with full consideration of the coupling among neutronics, thermal hydraulics, fuel performance, and structural characteristics have now become the standard for the modern simulation of HTR-PM. Moreover, there are a variety of uncertainty sources in the maximum fuel temperature calculations, and thus the prediction should involve the propagation and quantification of uncertainty in the coupling HTR-PM. More importantly, the uncertainty analysis of the maximum fuel temperature can be used to improve the reliability of the calculated maximum fuel temperature, identify the importance of uncertainty sources, and ensure appropriate design margins. en, it can be decided where additional efforts should be undertaken to reduce uncertainties in modeling and to improve the design itself. So as the researches progressed and best-estimate methods matured, a move toward the best-estimation plus uncertainty (BEPU) analysis occurs, which becomes a powerful numerical tool for the detailed analysis of the maximum fuel temperature under accident conditions.
As for the uncertainty analysis of the maximum fuel temperature under accident condition, there are a variety of uncertainty sources, such as the most unfavorable initial state, calculation methods, and uncertain input data. At the same time, the probability distribution types and variation range of each uncertainty source should be determined based on the experimental data or material characteristics or numerical simulation results. In this work, eight important uncertainty sources are selected based on some related papers [3,4], preliminary sensitivity analysis via a homedeveloped thermal-hydraulic code ATHENA for HTGR, and our previous studies [5,6]. en, the accident thermal analyses are performed with the home-developed ATHENA, and another home-developed code CUSA is applied to perform the uncertainty quantification of the maximum fuel temperature propagated from the selected uncertainty sources. e rest of the paper is organized as follows. e details of methodologies, model, and the analyzed designed basis event are described in Section 2, and then in Section 3, the selection of uncertainty sources, determination of uncertainties of these selected parameters, and sample generation are discussed. Sections 4 and 5 show a detailed analysis of the origin sensitivity and uncertainty information and uncertainty quantification of the maximum fuel temperature under accident condition. At last, conclusions drawn from this work are given in Section 6.

Description of HTR-PM and the Analyzed Designed Basis
Event. e Chinese demonstration plant HTR-PM is selected as the reference model in this work, and the axial layout of the HTR-PM design is shown in Figure 1, and the general design parameters can be found in the cited paper [7]. e HTR-PM is designed to comply with the inherently safe characteristic principles of the MHTGR, which must be able to remove the decay heat passively from the core under any designed accident conditions. And the maximum fuel temperature should not exceed the 1620°C in all cases so as to contain all fission products inside the SiC layer of the TRISO-coated fuel. At the same time, HTR-PM has a large negative temperature coefficient. erefore, it eliminates the possibility of large releases of radioactive materials into the environment for all possible accidents by far in the hypothetical regime [1].
In all design-basis accidents, only the DLOFC may lead to the highest fuel temperatures. In this design-basis accident, the core heats up following fast depressurization of the pressure vessel by the break of a tube with diameter of 65 mm (a kind of limiting accident) connected to it. Within a few minutes, the reactor losses nearly all of its coolant, helium gas, and the density of the coolant is at about 1 bar atmosphere. Hence, the natural convection in the core can be neglected and heat can then be removed from the core mainly by radiation and heat conduction. In the first hours of the accident, the radiation and heat conduction are not efficient enough to remove the decay heat so that the reactor starts to heat up. en, the maximum fuel temperature continuously increases. With the decay heat production decreasing steadily and the radial temperature gradients in the core and structures increasing, it provides better conditions for heat transfer. After about 20-30 hours, the maximum fuel temperature is predicted to a peak value around 1500°C. More details of the DLOFC accidents of HTR-PM can be found in the cited paper [8].

Description of CUSA.
e CUSA (the Code for Uncertainty and Sensitivity Analysis) was originally developed for uncertainty and sensitivity analysis of filling fraction of pebble bed and uranium loading of fuel pebble in pebble bed HTR [9]. e initial version only has some simple sampling and statistical functions based on the simple random sampling (SRS) method, Latin hypercube sampling (LHS) method, K-S test, and basic statistical theory. As the research progresses, a new version of CUSA has been developed based on some new proposed methods, such as the efficient sampling method to generate reasonable sample space for variables with different multivariate probability density function (PDF) and systematic theory analysis for uncertainty quantification to quantify the uncertainty of output and its associated error bar or confidence interval under a specific size of sample space. And some new functions, such as the user-friendly human-computer interaction platform, standardized input, code coupling, and plot, have also been developed by using QT language and C language on Windows operating system. An overview of basic functions and coupling relationship between different modules is illustrated in Figure 2. More details of the methodologies used in CUSA and some verification of the code can be found in the cited paper [10].
In this work, CUSA is used to generate sample space of input parameters according to their distribution and covariance information. en, these sets of samples will be sent into the home-developed thermal hydraulics code ATHENA to produce a set of output maximum fuel temperature. At last, the statistical function in CUSA is applied to quantify the uncertainty of outputs propagated from inputs.

Description of ATHENA.
ATHENA code is developed for high-temperature reactor thermal design by INET (Institute of Nuclear and New Energy Technology), Tsinghua University. It is based on rewriting the well-known German HTR thermal design code THERMIX [11], using modern programming style and user-friendly XML input format for better readability and maintainability. e main functionalities of ATHENA are identical to that of THERMIX, which have been well validated in HTGR steady and transient analyses. Sufficient numerical tests done in house have suggested that ATHENA code can reproduce THERMIX results very well. Besides, ATHENA has implemented several new calculation methods and functions, such as the fuel particle temperature calculation, which can extend the code's capability. ATHENA code can also be coupled with the PANGU code [12] to perform HTGR neutronics and thermal-hydraulic coupling analyses.

Uncertainty and Sensitivity Analysis Method.
Maximum fuel temperature under accident condition is the most important and interesting parameter, which represents the level of inherently safe characteristics of modular HTGR. erefore, the uncertainty in the calculated maximum fuel temperature is also one of the most important and interesting parameters. In this work, the statistical samplingbased uncertainty and sensitivity analysis method is selected to quantify the uncertainty of the maximum fuel temperature under accident condition. Using the statistical sampling method to perform uncertainty and sensitivity analysis, four challenges need to be handled reasonably. e first challenge is a building of model for uncertainty propagation and quantification. In fact, we have not and could not have an analytical model for uncertainty propagation in a nuclear system. But any physical phenomena or process in a nuclear system can be described by using mathematical models, i.e., integraldifferential/algebraic equations, and numerical tools can be used to solve these equations and then codes are developed. Indeed, we already have developed the ATHENA code, which can be used to assess the transient behavior of pebble-bed high-temperature gas-cooled reactor.
Second, the important uncertainty sources with their uncertainty information, i.e., mean, variance/covariance, and PDF, should be determined based on the experiment data or material characteristics or numerical simulation results. e problem is that the PDF is usually unknown and being replaced by approximations of normal or uniform distribution. e next important issue is the efficient sampling methods should be used to generate a reasonable input sample space based on the basic uncertainty information. Especially the correlation information between different input parameters should be represented accurately and reasonably by the sample space, while it always fails when the  Science and Technology of Nuclear Installations sample size is small if the traditional SRS or LHS method is used. In this work, an innovative LHS-SVDC method [13] built in CUSA is used to generate a reasonable sample space with a relatively small sample size. e final problem corresponding to statistics is that a systematic theory analysis for uncertainty quantification should be conducted, which can be used to quantify the uncertainty of output and its associated error bar or confidence interval under a specific size of sample space.
Here, the implementation details of the sensitivity and uncertainty analysis of the maximum fuel temperature under DLOFC accident condition by using statistical sampling method based on CUSA and ATHENA are summarized: (1) An in-depth analysis into the most unfavorable initial state, the process of decay heat production and removal of HTR-PM, is carried out firstly to determine all the uncertainty sources. en, some important input parameters are selected from these uncertainty sources based on the direct perturbation sensitivity analysis method and conclusions drawn from some published papers. For the direct perturbation sensitivity analysis, the maximum fuel temperature under DLOFC accident is computed by using the ATHENA code with the nominal values of the input quantities, then with a selected input value increased by a certain percentage, and then with the value decreased by the same percentage. en, the sensitivity coefficient of the maximum fuel temperature to some input value can be computed by using CUSA, and the uncertainty sources with a relatively small sensitivity coefficient will be excluded in this work.
(2) Determine the uncertainty information, such as the mean, covariance, and PDF of the selected uncertainty parameters, and correlation information  between different parameters based on experiment data, numerical simulations and the statistical analysis, material characteristics, the accuracy of the instrument and control (I&C) system, and so on. en, a global relative covariance matrix is built, which represents the uncertainty and correlation information of uncertainty inputs. It is worth noting that all the selected uncertainty parameters are assumed obeying normal distributions and uniform distributions, respectively, in this work to further study the effect of PDF on the uncertainty of the maximum fuel temperature.
(3) e efficient sampling function built in the CUSA is applied to generate a good sample space for all the selected inputs. If the number of uncertainty inputs is M and the sample size is N, a N × M matrix of input samples will be generated by CUSA. In this work, different sampling methods built in CUSA are used to generate different sample spaces for further comparison of these sampling methods and analysis of the effect of sampling methods on the uncertainty analysis of the maximum fuel temperature. (4) Each row of the N × M matrix is a random set of the selected uncertainty inputs, and the ATHENA code will be run N times by using each row of the input sample matrix to generate N sets of transient behaviors of HTR-PM under DLOFC accident, including the maximum fuel temperature. (5) Finally, the statistical analysis functions built in CUSA are used to quantify the distribution type and the uncertainty of the maximum fuel temperature due to these selected uncertainty sources based on the N sets of ATHENA calculations. At the same time, the associated error bar or confidence interval under a specific sample size is also quantified. Further, the correlation analysis function can be also used to perform the sensitivity analysis.

Determination of the Uncertainties of Input.
e maximum fuel temperature is mainly determined by the process of the decay heat production and removal under DLOFC accident condition of HTR-PM. To achieve a conservative value of the maximum fuel temperature, it is necessary to consider the most unfavorable initial state, including the initial core power, appearance of a higher peak power density when the operational power transients, and the inadvertently full insertion of the absorber rod. Furthermore, the basic nuclear data, the "multipass" fuel refueling scheme, spatial distribution of decay heat of the zone where the fuel temperature reaches to the maximum value, decay heat production rate, effective conductivity coefficient of the pebble bed, conductivity of graphitic matrix material, specific heat capacity of the fuel elements, effective conductivity and specific heat capacity of the reflector graphite, measurement of the initial temperature, the thermal property parameters of the core structures and outer components, and the heat transfer between pressure vessel and surface cooler all have an influence on the maximum fuel temperature, and these influences are different. In the cited paper [3], the preliminary uncertainty analysis of the maximum fuel temperature under DLOFC accident condition of the HTR-module reactor [14] due to most of the uncertainty sources mentioned above was performed and the numerical results indicate that the appearance of a higher peak power density when the operational power transients, the inadvertently full insertion of the absorber rod, the measurement of initial temperature, the thermal property parameters of the core structures and outer components, and the heat transfer between pressure vessel and surface cooler have a relatively small or only a marginal influence on the maximum fuel temperature under DLOFC accident condition. erefore, these uncertainty parameters are not considered in our work and the basic uncertainty information of some parameters is requantified based on our previous studies. e details are summarized as follows.
Based on the design of HTR-PM, the thermal power of each pebble bed reactor is 250 MW. In the normal operation, the reactor core power is monitored by using the reactor real-time monitoring system. If the operating power deviates the designed value, the reactor control system will start and then the reactor can be still run on the nominal power level imposed by the reactor control system. In fact, the monitoring system and the control system for the reactor operation and adjustment have a measurement error of 1%, respectively, based on the practical experience of HTR-PM project. is leads to a conservative 2% uncertainty of the operation power, i.e., the 2 standard deviation value of the operation power is 2%. It is different with the value used in the cited paper [3], in which 5% is too conservative, and same as the value for the PBMR analysis [4].
Another important uncertainty source is the spatial distribution of decay heat of the zone where the fuel temperature reaches to the maximum value. e uncertainty of the initial operating power of the HTR-PM, the power, and burnup history together result in a certain uncertainty of the spatial distribution of the decay heat. Uncertainties inevitably exist in the nuclear data, pebble flow, filling fraction of the pebble bed, uranium loading, and so on, which will be propagated to the power and burnup history and operating power distribution. Furthermore, these uncertainties' sources result in a certain uncertainty of the amount of fission products, actinides, which are the main components of the total decay heat production rate. At the same time, a "multipass" fuel refueling scheme is used in HTR-PM, and the movement of pebbles itself has uncertainties and also has a large influence on the burnup and power history. In our previous studies [5], the in-depth uncertainty analysis of the peak value of the power distribution due to the parameters mentioned above was performed, and the uncertainty contributions of these parameters are summarized in Table 1.
e maximum fuel temperature under accident conditions always occurs in the zone where the power Science and Technology of Nuclear Installations 5 distribution reaches to the peak value.
e conservative assumption is made that the uncertainty of the power distribution is the same as the uncertainty of the peak power, which further results in the same uncertainty of the spatial distribution of the decay heat. In this work, it is assumed very conservatively that a relative uncertainty of 5% in the operating power distribution causes the same uncertainty in the decay heat spatial distribution of the zone where the fuel temperature reaches to the maximum value, which covers the uncertainty contributions due to the calculation methods, nuclear data, filling fraction of pebble bed, uranium loading, multipass refueling scheme, and other parameters. e decay heat production is calculated based on the HTR-specific German standard DIN 25485E [15], and this rule also sets rules for calculating the standard deviation of the decay of fission products. en, a relative uncertainty of 2.85% in the decay heat production for HTR-PM is selected based on the established industry standards. e effective conductivity coefficient of the pebble bed should fully account for the conduction and radiation in the irregular pebble bed of fuel spheres. In the cited paper [16], the standard deviations of this parameter for different temperatures were quantified, and from these results, an average uncertainty of 5% was derived for the relevant temperature range of HTR-Module. In our work, the same value of 5% for HTR-PM is selected. e relative uncertainty of the conductivity of graphitic matrix material is 7%, and the associated value for the specific heat capacity of the fuel elements is 2.9% based on Kohtz's research [3]. According to Strydom's paper, the relative uncertainty is 5% for both the relative uncertainty of effective conductivity and specific heat capacity of the reflector graphite [4].
e same values are applied for the selected parameters in our research. e uncertainty information of these parameters, such as the mean, two standard deviations, and PDF, are obtained from different sources and quantified based on the different mechanism analysis. For example, the uncertainty of the most unfavorable initial operating power is obtained from the accuracy of the reactor monitoring and control systems and also based on the expert engineering judgement. e material manufacturers determine the uncertainty of the specific heat and conductivity data. However, the relative uncertainty of the decay heat production rate is quantified by the established industry standards. As a result, there are no correlations between these uncertainty parameters and these inputs are independent. e details of the uncertainty of the selected 8 inputs are summarized in Table 2.

Generation and Verification of the Sample of Uncertainty
Inputs.
e uncertainty analysis based on the statistical sampling method costs time and efforts. And the size of the sample space is crucial for the uncertainty propagation and quantification by using this method. In this work, the homedeveloped CUSA is used to generate a reasonable sample space of the selected eight parameters. ere are different sampling methods built in CUSA, such as the SRS, LHS, LHS-CDC, LHS-SVDC, and so on.
First, a global relative covariance matrix of the selected eight parameters is built, as shown in Figure 3, the diagonal elements of which represent the square of the relative standard deviation of each input, and the off-diagonal elements are equal to zero in this work due to the independence between different inputs. Based on this relative covariance matrix, three different sampling methods, SRS, LHS, and LHS-SVDC, are used to generate different sample spaces with some specific sample sizes of 100, 200, 500, and 1000, respectively, in this work. en, the K-S test function of CUSA is performed to identify the probability distribution type of the samples of each input. e process is to compare the cumulative probability density function (CDF) of the population samples of each input with a specific distribution, e.g., normal, uniform, exponent distribution, and so on. And the K-S level of the significance (about 0.5 to 1) confirms that the specific distribution type is the closest match to the samples.
e results of the level of the significance of different distribution types for samples of the different input parameters with the sample size of 100 are shown in Tables 3 and 4. e SRS and LHS are widely used for generating samples for propagating input uncertainties, and LHS-SVDC is an innovative efficient sampling method of CUSA. As shown in Tables 3 and 4, the samples obtained by all these three methods match good to the original distribution of each input, which means that the accuracy of the original distribution information is not lost by the samples. It is noteworthy that the level of the significance for the LHS method is equal to 1, which indicates that the samples completely obey the original distribution. It is due to the fact that samples are directly generated from the CDF of the input parameters. Only in this point of view, all these three methods can be used to generate a random sample space which obeys the original distribution types with a relatively small sample size.
Furthermore, for the LHS based method, one of the main advantages is that only a relatively small sample size is enough to represent the uncertainty information of one input due to its efficient stratified sampling technique based     Science and Technology of Nuclear Installations on the CDF. For the multivariate problem, samples of different inputs are randomly combined to form a random sample space in the process of generating random samples by using LHS-based methods, a more realistic random process. However, an extra statistical correlation between samples of different input parameters is inevitably introduced by using the SRS or LHS method, especially when the sample size is relatively small. Of course, increasing the sample size will decrease this introduced correlations, while the number of calculations increased drastically. To solve this problem, an innovative LHS-based method, LHS-SVDC, is proposed in our previous study and is used to generate a reasonable sample space with a relatively small sample size by using the correlation control techniques. e relative covariance matrix of the input samples generated by SRS, LHS, and LHS-SVDC with the sample sizes of 100, 200, 500, and 1000 is shown in Figures 4-7.
As illustrated in Figures 4-7, 100 samples are enough to represent a reasonable correlation information between different input parameters for the LHS-SVDC method, while more than 500 samples are needed by using the LHS method and even more for the SRS method. So, the LHS-SVDC method is recommended to perform the uncertainty propagation with a relatively small sample size and then to reduce the number of calculations dramatically. An example of the final outcome of this input preparation phase is shown in Table 5, where the random sample combination of the selected eight inputs with normal distribution is presented for the first 10 of the 100 sample population generated by using the LHS-SVDC method. And one example scatter plot for the 100 samples of the reactor power is shown in Figure 8 to be verified for conformance to the user's specifications.

Uncertainty Analysis of the Maximum Fuel
Temperature under DLOFC

K-S Test to Determine the Distribution Type.
For the uncertainty analysis of the maximum fuel temperature of HTR-PM under the DLOFC accident condition, statistical fitness tests on the calculated maximum fuel temperature are firstly performed to determine the properties of unknown distributions by using the K-S test function of CUSA. e K-S test is used to compare the cumulative probability density function of a population sample for conformance with a specific distribution, such as Normal, Uniform, Poisson, or Exponent distribution. In the K-S test, the terms "the level of significance" refer to the likelihood that the selected distribution type (for example, normal distribution) is representative of the sample population. e maximum number of the significant is equal to 1. And the lower the significance level, the more confident you can reject this fitness test. e K-S test on the 100 maximum fuel temperature under DLOFC accident condition calculated by using ATHENA is performed, and the results of the level of significance for different distribution types are shown in Table 6. e K-S test results confirm that a normal distribution is much better matched to the maximum fuel temperature under DLOFC accident condition and it is not affected by the distribution type of inputs and the sampling methods. e quality of the fit can be also visually assessed by the fitted curve, as shown in Figures 9 and 10, which also illustrate that a normal distribution is much better match to the maximum fuel temperature under DLOFC accident condition of HTR-PM.
As discussed above, the distribution type of the maximum fuel temperature is not affected by the distribution type of the inputs. However, this conclusion is established under certain conditions that are simultaneous perturbation of multiple input parameters, and in this work, the eight selected input parameters are sampled simultaneously. If only one input parameter is perturbed, then the distribution type of output is completely same as the input. Here, only the initial reactor power is sampled and 100 samples are generated. en, 100 ATHENA runs generate 100 maximum fuel temperatures, and the K-S test is performed on these results; the fitted curve is shown in Figure 11, which further indicates that the distribution type of the maximum fuel temperature is same as the type of the initial reactor power. e same conclusion can also be drawn from the test of other input parameters.

Uncertainty Quantification of the Maximum Fuel
Temperature.
e time behavior of the maximum fuel temperature under the DLOFC accident condition is illustrated in Figures 12 and 13, where 200 sets of the selected eight inputs with uniform and normal distributions are randomly generated, respectively, by using the LHS-SVDC method and then 2 groups of 200 ATHENA simulations using these input samples generate 2 sets of the maximum fuel temperatures. As shown in Figures 12 and 13, the maximum fuel temperature of HTR-PM reaches a peak value after 20-30 hours during the DLOFC transient condition. e shapes of the curves are similar but the gradients are not identical due to the difference between the rate of energy deposition and the energy removal. For example, an increase in the initial reactor power will increase the fuel temperature, while an increase in the pebble bed effective conductivity will remove heat faster from the core and therefore lead to a lower fuel temperature. In each random set of samples of these eight inputs, low, average, and high values are randomly generated, and then results in different curves of the fuel temperature and the shift in time when the peak fuel temperature values are reached. Even more importantly, the spread in the maximum fuel temperature, i.e., the uncertainty of the maximum fuel temperature, is not constant with time; it increases in the first 30 hours and then tends to be stable. For example, it starts off with less than 5°C in the first hours and increases to 151°C for the cases with normal distributed inputs and increases to 165°C for the cases with uniform distributed inputs. And the highest fuel temperatures and the largest uncertainty variations do not occur at the same time point.
However, this study only compares the bounding value fuel temperature uncertainty for the DLOFC accident, regardless of when this point is reached, since the DLOFC peak fuel temperature is of major interest in reactor design safety studies. Before the uncertainty analysis of the maximum fuel   temperature under accident condition, the superiority of the LHS-SVDC technique for the statistical sampling-based uncertainty analysis method can be further verified by the uncertainties of the maximum fuel temperature due to the uncertainty samples generated by using different sampling methods, as shown in Figure 14. At the same time, the "sandwich" rule is also used to quantify the uncertainty of the maximum fuel temperature based on the calculated sensitivity coefficients for comparison, and the sensitivity analysis will be performed in the following section. It is obviously found that the uncertainty of the maximum fuel temperature due to the selected eight input parameters tends to be stable or be very close to the results quantified by the sandwich rule when the sample size is      Science and Technology of Nuclear Installations greater than 100 for LHS-SVDC methods. When the number of samples needs to be greater than 800 or even larger, then a relatively stable uncertainty can be obtained if the LHS or SRS method is used. At the same time, the size of the sample space is crucial for the uncertainty propagation by using the statistical sampling-based uncertainty analysis method, and a relative small size for less computation burden and stable uncertainty contribution is necessary. So, the sample size of LHS-SVDC is set to 100 in this work for uncertainty propagation and quantification as discussed above.
Once the sample size and the type of distribution of the maximum fuel temperature are identified, the mean, the standard deviation, and other uncertainty information, especially the error bar, can be further determined from the empirical distribution. It is worth noting that uncertainties inevitably exist in the calculated mean value, standard deviation, and relative uncertainty of the maximum fuel temperature by using the statistical sampling-based uncertainty analysis method due to the random sampling and statistical analysis. Figures 15-17 illustrate the 10 sets of the calculated mean value, standard deviation, and the relative uncertainty of the maximum fuel temperature due to random samples of the selected eight parameters generated by using SRS, LHS, and LHS-SVDC methods. Here, 10 sets of sample space are randomly generated, respectively, by using different sampling methods, and then ATHENA is used to perform the DLOFC simulations to generate 10 sets of maximum fuel temperature population, and each set has 100 values. As shown in Figures 15-17, the mean value, standard deviation, and the relative uncertainty indeed have uncertainties due to the random process, and these uncertainties will gradually decrease with the increment of the sample size. ese uncertainties under a specific size of sample space should be also quantified if the statistical sampling-based uncertainty analysis method is used and quantified by using the error bar function built in CUSA in this work.
A summary of the uncertainty information, such as the mean with its associated error bar, the standard deviation with its associated error bar, and the relative uncertainty of the maximum fuel temperature under DLOFC accident condition of HTR-PM due to the selected eight input uncertainty parameters with normal and uniform distribution quantified by using SRS, LHS, and LHS-SVDC sampling methods when the sample size is 100, is shown in Table 7.
e following observations can be made based on the numerical results: (1) e mean values of the maximum fuel temperature for all cases are almost identical, i.e., regardless of the sampling method, distribution types of inputs, or sample size, all these designed cases predict the same mean value, 1493°C, of the maximum fuel temperature under DLOFC accident condition of HTR-PM. However, the error bar, i.e., the uncertainty band of the mean value, is quite different and the uncertainty band of the mean value due to the random sampling for SRS method is quite larger, compared to the LHS and LHS-SVDC cases, which is also visually illustrated in Figure 15. In this case, the mean value of the DLOFC maximum fuel temperature can rise up to 1505°C if the SRS method with the sample size of 100 is used, while the uncertainty band of the mean value for LHS and LHS-SVDC methods is nearly same and is also very small. Based on this point, this study recommends using LHS or LHS-SVDC to propagate the uncertainties of input parameters.
(2) e standard deviations of the maximum fuel temperature populations are also nearly same, 1°C variation on 39°C for example. Same as mean value, the uncertainty band of the standard deviation varies largely, which is directly related to the sampling method and sample size. Although this uncertainty band decreases with the increment of the sample size for all sampling methods, a nonnegligible uncertainty band still exists and a more reliable uncertainty prediction needs more simulations for LHS and SRS. So, the LHS-SVDC method is recommended to propagate uncertainties in inputs in this study.
(3) For distribution types of input parameters, using the uniform distribution could be expected to result in the sampling of high and low values more frequently for the SRS method, compared to the normal distribution. Since the probability of sampling a high, mean, or low value is same for the uniform distribution, there is relatively lower probability to sample from the low and high tails of the normal distribution if the SRS method is used. However, the probability is identical for both LHS and LHS-SVDC methods. is effect is mainly responsible for the slightly larger uncertainty band for 200 SRS uniform case, compared to the LHS and LHS-SVDC cases. However, this rule is not always successful and the uncertainty band mainly depends on the quality of samples generated by different sampling methods.
(4) Sample size, i.e., the number of model calculations, is crucial time-consuming factor for the statistical sampling-based uncertainty analysis method. 1000 is typically recommended in the typical statistical analysis [4]; indeed, the LHS and SRS methods need a relative large sample size to generate a reasonable sample space to propagate uncertainties, and then a more reliable uncertainty prediction with a small uncertainty band due to random process can be obtained. However, the numerical results indicate that 100-200 model simulations seem to be sufficient to get an uncertainty prediction with full confidence by using the LHS-SVDC method.
Overall, uncertainties in these selected eight parameters lead to a two standard deviation (2σ) uncertainty of ±77.6°C (or 5.2%) around the mean value of 1493°C for the maximum fuel temperature under DLOFC accident of HTR-PM, and the scatter plot for the maximum fuel temperature is shown in Figure 18 with the normal and uniform distributed inputs. is value mostly depends on the uncertainties of the selected input parameters, and taking into account of all known input parameters could possibly lead to a larger uncertainty bandwidth. It is worthy to note that the sampling methods and the sample size also have a nonnegligible effect on the mean value and uncertainty bandwidth, about 18°C difference for SRS 100 case.
Before a direct sensitivity study is performed to determine which of these selected eight input parameters are responsible for most of the uncertainty in the maximum fuel temperature under DLOFC accident, the individual uncertainty contribution of each parameter to the final uncertainty in the DLOFC peak fuel temperature is also quantified here by using the LHS-SVDC method with the sample size of 200, as shown in Table 8. e observation for distribution types of input is in agreement with the conclusion reached for the total uncertainty analysis, where the distribution types have little influence on the individual uncertainty contribution. e numerical results indicate that the pebble bed effective conductivity coefficient with a 2σ uncertainty of 5% contributes most to the uncertainty in the maximum fuel temperature, up to ±21.4 (1.4%), which is followed by the decay heat with an uncertainty of 2.85%, about ±20.5 (1.4%).

Sensitivity Analysis of the Maximum Fuel Temperature to Different Inputs
In order to investigate the impact of the selected eight parameters on the maximum fuel temperature, the central difference direct perturbation sensitivity technique in CUSA is applied. e peak fuel temperature is computed first with the nominal values of the selected eight parameters, then with a selected nominal input value increased by 1%, and then with this nominal value decreased by the same percentage. e direct perturbation sensitivity coefficient of the maximum fuel temperature to these inputs can be calculated as (1) Figure 19 illustrates the sensitivity coefficients of these eight input parameters to the maximum fuel temperature, and it can be found that changes in these inputs have opposite effects on the maximum fuel temperature. Here, the magnitude of these coefficients provides insight into the degree which a specific input parameter influences the maximum fuel temperature and the sign indicates a positive or negative effect on the peak fuel temperature. e initial reactor power, decay heat, and spatial distribution of decay heat have a positive effect on the maximum fuel temperature, i.e., an increase in these three parameters will lead to an increase in fuel temperature, while the other five parameters have a negative effect on the peak value. Although the pebble bed effective conductivity contributes the most to the uncertainty of the maximum fuel temperature, it is most sensitive to the initial reactor power and decay heat, followed by the pebble bed effective conductivity. According to the uncertainty analysis, the two primary drivers of uncertainty in the maximum fuel temperature are the decay heat and the pebble bed effective conductivity, and this finding is in agreement with the sensitivity study results, where these two factors are also identified as being responsible for the largest changes in the fuel temperature. And the sensitivity coefficient of the maximum fuel temperature to the graphitic matrix material conductivity is relatively small, but its uncertainty contribution is larger due to its big uncertainty.

Conclusion
e maximum fuel temperature under accident condition is the most important parameter of inherently safe characteristics of HTR-PM, and the DLOFC accident may lead to a peak accident fuel temperature. erefore, the accurate prediction of the maximum fuel temperature under accident condition is most important to the HTR-PM safety analysis and design. At the same time, there are a variety of uncertainty sources in the maximum fuel temperature calculations, and thus the contributions of these uncertainty sources to the final calculated maximum fuel temperature should be quantified to check whether the peak value exceed the technological limit of 1620°C or not.
In this work, eight uncertainty input parameters are selected for inclusion in this uncertainty study, the initial reactor power, the spatial distribution of decay heat, the decay heat, pebble bed effective conductivity, graphitic matrix material conductivity, fuel elements specific heat capacity, reflector effective conductivity, and its specific heat capacity. Even more importantly, the 2 standard deviation uncertainties and probability density functions of these inputs are specified based on the experimental data, material characteristics, expert judgements, operating experiences, some published numerical simulation results, and our previous studies. en, the accident thermal analyses are performed with a home-developed ATHENA code, and the home-developed code CUSA is applied to perform the uncertainty quantification of the maximum fuel temperature propagated from the selected uncertainty sources. Simultaneously, a direct perturbation analysis by using CUSA is performed to obtain the sensitivity coefficients and to identify the primary contributors to the uncertainty of the maximum fuel temperature under DLOFC accident condition of HTR-PM.
It is found that the pebble bed effective conductivity and the decay heat contribute the most of the uncertainty in the DLOFC maximum fuel temperature while this peak fuel temperature is most sensitive to the initial reactor power and the decay heat. Overall, uncertainties in these selected eight parameters lead to a two standard deviation (2σ) uncertainty of ±77.6°C (or 5.2%) around the mean value of 1493°C for the maximum fuel temperature under DLOFC accident of HTR-PM, which make sure that the maximum fuel temperature during DLOFC accident condition does not exceed the technological limit of 1620°C of HTR-PM design. However, this value mostly depends on the uncertainties of the selected input parameters and taking into account of all known input parameters could possibly lead to a larger uncertainty bandwidth.
It is worthy to note that the sampling methods and the sample size also have a nonnegligible effect on the mean value and uncertainty bandwidth. And the LHS-SVDC method is recommended to propagate uncertainties in inputs, and then a more reliable uncertainty prediction with a small uncertainty band due to random process can be obtained. e numerical results indicate that 100-200 model simulations seem to be sufficient to get an uncertainty prediction with full confidence for applying the LHS-SVDC method.

Data Availability
e data used to support the findings of the study are available from the corresponding author upon request.

20
Science and Technology of Nuclear Installations