# Thermal-Hydraulic System Codes in Nulcear Reactor Safety and Qualification Procedures

Authors: Alessandro Petruzzi; Francesco D'Auria
Journal: Science and Technology of Nuclear Installations
 (2008)

---

## Abstract

In the last four decades, large efforts have been undertaken to provide reliable thermal-hydraulic system codes for the analyses of transients and accidents in nuclear power plants.  Whereas the first system codes, developed at the beginning of the 1970s, utilized the homogenous equilibrium model with three balance equations to describe the two-phase flow, nowadays the more advanced system codes are based on the  so-called “two-fluid model” with separation of the water and vapor phases, resulting in systems with at least six balance equations. The wide experimental campaign, constituted by the integral and separate effect tests, conducted under the umbrella of the OECD/CSNI was at the basis of the development and validation of the thermal-hydraulic system codes by which they have reached the present high degree of maturity. However, notwithstanding the huge amounts of financial and human resources invested, the results predicted by the code are still affected by errors whose origins can be attributed to several reasons as model deficiencies, approximations in the numerical solution, nodalization effects, and imperfect knowledge of boundary and initial conditions. In this context, the existence of qualified procedures for a consistent application of qualified thermal-hydraulic system code is necessary and implies the drawing up of specific criteria through which the code-user, the nodalization, and finally the transient results are qualified.


---

## Body

## 1. Introduction

Evaluation  of nuclear power
plants (NPPs) performances during accident conditions has been the main issue of
the research in nuclear fields during the last 40 years. Therefore, several
complex system thermal-hydraulic codes have been developed for simulating the
transient behavior of water-cooled reactors. In the early stage of the
development, the codes were primarily applied for the design of the engineered
safety systems. In 1978, the “appendix K requirements” [1] were issued,
defining conservative model assumptions as well as conservative initial and
boundary conditions to warrant conservative code results for critical safety
parameters. On the other hand, the development and elaboration of accident
management procedures, the application of probabilistic safety analyses (PSA)
and the operator training asked for so-called “best-estimate (BE) analysis,”
that means an accident simulation as realistic as possible. The main objective of best-estimate system codes
was to replace the “evaluation models,” which used many conservative assumptions,
by the best-estimate approach for more realistic predictions of pressurized water
reactor (PWR) or boiling water reactor (BWR) accidental transients that allow
the reduction of safety margins. Best-estimate system codes are currently used
for the following:
(i)
safety analysis of accident scenarios;(ii)
quantification of the conservative analyses margin;(iii)
licensing purposes if the code is used together with a methodology
to evaluate uncertainties;(iv)
probabilistic safety analysis (PSA);(v)
development and verification of accident management procedures;(vi)
reactors design;(vii)
analysis of operational events;(viii)
core management investigation.
Best-estimate thermal-hydraulic codes (e.g., RELAP, TRAC, CATHARE, ATHLET, …) are, in general, based on equations for two-phase flow which are typically
resolved in Eulerian coordinates. The two-phase flow field is described by
mass, momentum, and energy conservation equations for the liquid and vapour
phases separately and mass conservation equations for noncondensable gas
present in the mixture. The models are suitable for 1D system simulation even
if for some NPP component (e.g., the vessel), some code has the capability to
solve 3D system equations. Time discretization could be fully, semi or nearly
implicit. Depending on
the number of balance equations, different sets of constitutive equations are
required to close the equation system. In comparison with the homogeneous equilibrium
model (HEM), which requires only two constitutive equations, namely, the
friction loss and the heat transfer relations at the wall, at least seven
constitutive equations are required for the two fluid models with six balance
equations describing the mass, energy, and momentum transfers at the interface and the energy and momentum transfers of the water- and steam-phase at
the wall. The constitutive equations have to describe the physical phenomena in
a wide span of scale, ranging from down-scaled integral system experiments up
to full size reactor geometry. This is one of the most challenging goals in code development and code
validation.  To develop and validate the scaling laws for individual phenomena,
separate effect tests in different scale are necessary. In Figure 1, the code
development activities carried out in more than three decades are shown.Figure 1
Code development activities in more than three decades.Due  to the numerical
approximations and the empirical nature of the included models in the
thermal-hydraulic system codes, extensive activities related to validation of the codes have been pursued
during the years.   The validation has been performed using experimental data
from specially designed scaled-down test facilities. In addition, transient data from real NPPs
were also considered due to the full scale and true geometry although those
data concern only conditions under fairly mild transients (operational
transients and start-up and commissioning tests). These activities have been
planned and carried out in national and international contexts in four levels,
mainly in the independent assessment area, involving the use of the following:(a)
“fundamental” experiments [2];(b)
separate effects test facilities (SETF) [3];(c)
integral test facilities (ITF), including most of the international standard problems (ISP)
[4];(d)
real plant data.
However,
notwithstanding the huge amounts of financial and human resources invested, the
results predicted by the code are still affected by errors whose origins can be attributed to several reasons as model deficiencies,
approximations in the numerical solution, nodalization effects, and imperfect knowledge
of boundary and initial conditions. In this context, the existence of qualified
procedures for a consistent application of qualified thermal-hydraulic system
code is necessary
and implies the drawing up of specific criteria through which the code-user, the
nodalization, and finally the transient results are qualified.The current situation
related to the development, validation, and use of system codes can be
summarized as follows.(1)
A state-of-the-art report in modeling LOCA (loss-of-coolant
accident) and non-LOCA transients and the compendium on ECCS (emergency core cooling
systems). Researches have been published in 1989 [5, 6],   by Organization for Cooperation
and Development/Committee on the Safety of Nuclear Installations (OECD/CSNI)
and US NRC. These reports broadly cover topics like plant features relevant to
thermal-hydraulics, transient description, phenomena identification, code modeling capabilities and needs for experimental data and present situation in the experimental area.(2)
The CSAU (Code Scaling, Applicability and
Uncertainty), published in 1990, for example [7], constituted a pioneering
effort made by NRC in the area of code uncertainty prediction.(3)
Code validation criteria and
detailed qualification programs exist, although not fully optimized or
internationally agreed on. In particular, the following hold.(a)
The integral test
facility CSNI code validation matrix (ITF-CCVM) report was initially published
in 1987 and extensively updated in 1996, [4].  Tests for code validation were
selected based on quality of the data, variety of scaling and geometry, and
appropriateness of the range of covered conditions. The decision was taken
around 1984 to bias the validation matrix toward integral tests so that code
models were exercised and interacted in situations as similar as possible to
those of interest to PWR and BWR. This was done because of the assumption that
sufficient comparison with separate effects test data would be performed and
documented by code developers.(b)
As the last
expectation has proved unrealistic, a group of scientists was formed toward the
end of the 80s to set up the separate effect test facility CSNI code validation
matrix, SETF-CCVM, that was issued in 1994 [3]. The development of the
SETF-CCVM required an extension of the methodology employed for the ITF-CCVM [4],
both in the scope and the definition of the thermal-hydraulic phenomena and in
the categorization and description of facilities. A significant result of the
activity was the selection of sixty-seven phenomena assumed to cover all the thermal-hydraulic
situations of interest expected in PWR and BWR transients. The needed effort
suitable for a comprehensive code validation was quantified: more than one
thousand experiments should be part of a thermal-hydraulic system code
validation program. The impact of those findings in planning new researches was
also evaluated [8].(4)
The codes have reached an
acceptable degree of maturity although the reliable application is still
limited to the validation domain.(5)
The use of qualified codes is more
and more requested for assessing the safety of existing reactors, especially in
the former Soviet Union and in the Eastern countries, and for designing
advanced reactors.(6)
The codes availability is
increasingly growing especially in the countries belonging to the former Soviet Union, the Eastern countries,
Korea, China, and so forth.(7)
Special topics, like user [9] and
computer-compiler effects upon code calculation results, nodalization
qualification [10], accuracy quantification [11], relevance of international standard problems and
lesson learned, use of best estimate codes in the licensing, have been widely
discussed and main achievements are available to the international community.(8)
A special attention from the scientific community has
always been given to the quantification of code uncertainty in predicting plant
transients. Methodologies to evaluate the
“uncertainty” have been proposed [12, 13] and tested in several international activities, like
UMS (uncertainty method study, [14]) and BEMUSE (best-estimate methods–uncertainty and sensitivity
evaluation, [15, 16]) that allowed the comparison of uncertainty results
obtained from different methodologies.
This paper reviews the
main features and limitations of the thermal-hydraulic system codes and the
procedures adopted for the qualification of computational tools, that is, not
only the codes, through the ITF and SETF validation matrixes, but also the
nodalization used to simulate the transient scenario in the NPP. Finally, taking
into account the multidisciplinary nature of reactor transients and
accidents (which include thermal-hydraulics, neutronics, structural, and
radiological aspects), the needs, the status of development, and the benefits
of code coupling are pointed out.


## 2. Main Features and Limitations of Thermal-Hydraulic System Codes

The system thermal-hydraulic codes are based
upon the solution of six balance equations for liquid and steam that are
supplemented by a suitable set of constitutive equations. The balance equations
are coupled with conduction heat transfer equations and with neutron kinetics
equations (typically point kinetics). The
two-phase flow field is organized in a number of lumped volumes connected with
junctions. Thermal-hydraulic components such as valves, pumps, separators,
annulus, accumulators, and so forth, can be defined in order to represent the overall
system configuration. In the
following sections, main problematic aspects, from the point of view of the
user, of a thermal-hydraulic system code are highlighted.


### 2.1. System Nodalization

All major existing light
water reactor (LWR) safety thermal-hydraulics system codes follow the concept
of a “free nodalization,” that is, the code user has to build up a detailed
noding diagram which maps the whole system to be calculated into the frame of a
one-dimensional thermal-hydraulic network. To do this, the codes offer a number
of basic elements like single volumes, pipes, branches, junctions, heat
structures, and so forth. This approach provides not only a large flexibility with respect
to different reactor designs, but also allows predicting separate effect and
integral test facilities which might deviate considerably from the full-size
reactor.As a consequence of
this rather “open strategy,” a large responsibility is passed to the user of
the code in order to develop an adequate nodalization scheme which makes best
use of the various modules and the prediction capabilities of the specific
code. Due to the existing code limitations and to economic constraints, the
development of such a nodalization represents always a compromise between the
desired degree of resolution and an acceptable computational effort. It is not possible here to cover all the
aspects of the development of an adequate nodalization diagram, however, two
crucial problems will be briefly mentioned which illustrate the basic problem.


#### 2.1.1. Spatial Convergence

As has been quite often
misunderstood, a continuous refinement of the spatial resolution (e.g., a
reduction of the cell sizes) does not automatically improve the accuracy of the
prediction. There are two major reasons for this behavior:(1)
the large number of empirical
constitutive relations used in the codes has been developed on the basis of a
fixed (in general coarse) nodalization;(2)
the numerical schemes used in
the codes generally include a sufficient amount of artificial viscosity which
is needed in order to provide stable numerical results. A reduction of the cell
sizes below a certain threshold value might result in severe nonphysical
instabilities.
From those considerations, it can be concluded that no a priori optimal approach for the
nodalization scheme exists.


#### 2.1.2. Mapping of Multidimensional Effects

Multidimensional effects, especially with
respect to flow splitting and flow merging processes (e.g., the connection of
the main coolant pipe to the pressure vessel), exist also in relatively small
scale integral test facilities. The problem might become even more complicated
due to the presence of additional bypass flows and a large redistribution of
flow during the transient. It is left to the code user to determine how to map
these flow conditions within the frame of a one-dimensional code, using the
existing elements like branch components, multiple junction connections, or
cross-flow junctions. These two examples show how the limitations in the
physical modeling and the numerical method in the codes have to be compensated
by an “engineering judgment” of the code user which, at best, is
based on results of detailed sensitivity of assessment studies. However, in
many cases, due to lack of time or lack of appropriate experimental data, the
user is forced to make ad hoc decisions.


### 2.2. Code Options: Physical Model Parameters

Even though the number
of user options has been largely reduced in the advanced codes, various
possibilities exist about how the code can physically model specific phenomena.
Some examples are as follows.(1)
Choice between engineering type models for choking or use of code
implicit calculation of critical two-phase flow conditions.(2)
Flow multipliers for subcooled or saturated choked flow.(3)
The efficiency of separators.(4)
Two-phase flow characteristics of main coolant pumps.(5)
Pressure loss coefficient for pipes, pipe connections, valves, branches, and so forth.
Since in many cases direct measured data are not available or, at least, not complete, the user is
left to his engineering judgment to specify those parameters.


### 2.3. Input Parameter Related to Specific  System Characteristics

The assessment of LWR safety codes is mainly performed on the basis of
experimental data coming from scaled integral or separate effect test
facilities. Typically in these scaled-down facilities, specific effects, which
might be small or even negligible for the full-size reactor case, can become as
important as the major phenomena to be investigated. Examples are the release
of the heat from the structures to the coolant, heat losses to the environment,
or small bypass flows. Often, the quality of the prediction depends largely on
the correct description of those effects which needs a very detailed
representation of the structural materials and a good approximation of the
local distribution of the heat losses. However, many times the importance of
those effects is largely underestimated, and consequently, wrong conclusions
are drawn from results based on incomplete representation of a small-scale test
facility.


### 2.4. Input Parameters Needed for Specific  System Components

The general
thermal-hydraulic system behavior is described in the codes by the major code
modules based on a one-dimensional formulation of the mass, momentum, and
energy equations for the separated phases. However, for a number of system
components, this approach is not adequate and consequently additional, mainly empirical
models have to be introduced, for example, for pumps, valves, separators, and so forth.
In general, these models require a large amount of additional code input data,
which are often not known since they are largely scaling dependent.A typical example is
the input data needed for the homologous curves which describe the pump
behavior under single and two-phase flow conditions which in general are known
only for a few small-scale pumps. In all these cases, the code user has to
extrapolate from existing data obtained for different designs and scaling
factors which introduces a further uncertainty to the prediction.


### 2.5. Specification of Initial and  Boundary Conditions

Most of the existing
codes do not provide a steady-state option. In these cases pseudo-steady-state
runs have to be performed using more or less artificial control systems in
order to drive the code towards the specified initial conditions. The
specification of stable initial and boundary conditions and the setting of
related controllers require great care and detailed checking. If this is not
done correctly, a large risk, that even small imbalances in the initial data
will overwrite the following transient, exists especially for slow transients
and small break LOCA calculations.


### 2.6. Specification of State and  Transport Property Data

The calculation of state and transport properties is usually done
implicitly by the code. However, in some cases, for example, in RELAP5, the
code user can define the range of reference points for property tables, and
therefore, can influence the accuracy of the prediction. This might be of
importance especially in more “difficult regions,” for example, close to the
critical point or at conditions near atmospheric pressure. Another example is constituted by the fuel
materials property data: the specification of fuel rod gap conductance (and
thickness) is an important parameter, affecting core dryout and rewet occurrences
that must be selected by the user.


### 2.7. Selection of Parameters Determining  Time Step Sizes

All the existing codes are using automatic procedures for the selection
of time step sizes in order to provide convergence and accuracy of the
prediction. Experience shows, however, that these procedures do not always
guarantee stable numerical results, and therefore, the user might often force
the code to take very small time steps in order to pass through trouble spots.
In some cases, if this action is not taken, very large numerical errors can be
introduced in the evolution of any transient scenario and are not always
checked by the code user.


### 2.8. Code Input Errors

In order to prepare a complete input data deck for a large system, the code user has to provide a huge number of parameters (approx., 15 to 20
thousand values for an NPP nodalization) which he has to type one by one. Even if all the codes provided consistency
checks, the probability for code input errors is relatively high and can be
reduced only by extreme care following clear quality assurance guidelines.


## 2.1. System Nodalization

All major existing light
water reactor (LWR) safety thermal-hydraulics system codes follow the concept
of a “free nodalization,” that is, the code user has to build up a detailed
noding diagram which maps the whole system to be calculated into the frame of a
one-dimensional thermal-hydraulic network. To do this, the codes offer a number
of basic elements like single volumes, pipes, branches, junctions, heat
structures, and so forth. This approach provides not only a large flexibility with respect
to different reactor designs, but also allows predicting separate effect and
integral test facilities which might deviate considerably from the full-size
reactor.As a consequence of
this rather “open strategy,” a large responsibility is passed to the user of
the code in order to develop an adequate nodalization scheme which makes best
use of the various modules and the prediction capabilities of the specific
code. Due to the existing code limitations and to economic constraints, the
development of such a nodalization represents always a compromise between the
desired degree of resolution and an acceptable computational effort. It is not possible here to cover all the
aspects of the development of an adequate nodalization diagram, however, two
crucial problems will be briefly mentioned which illustrate the basic problem.


### 2.1.1. Spatial Convergence

As has been quite often
misunderstood, a continuous refinement of the spatial resolution (e.g., a
reduction of the cell sizes) does not automatically improve the accuracy of the
prediction. There are two major reasons for this behavior:(1)
the large number of empirical
constitutive relations used in the codes has been developed on the basis of a
fixed (in general coarse) nodalization;(2)
the numerical schemes used in
the codes generally include a sufficient amount of artificial viscosity which
is needed in order to provide stable numerical results. A reduction of the cell
sizes below a certain threshold value might result in severe nonphysical
instabilities.
From those considerations, it can be concluded that no a priori optimal approach for the
nodalization scheme exists.


### 2.1.2. Mapping of Multidimensional Effects

Multidimensional effects, especially with
respect to flow splitting and flow merging processes (e.g., the connection of
the main coolant pipe to the pressure vessel), exist also in relatively small
scale integral test facilities. The problem might become even more complicated
due to the presence of additional bypass flows and a large redistribution of
flow during the transient. It is left to the code user to determine how to map
these flow conditions within the frame of a one-dimensional code, using the
existing elements like branch components, multiple junction connections, or
cross-flow junctions. These two examples show how the limitations in the
physical modeling and the numerical method in the codes have to be compensated
by an “engineering judgment” of the code user which, at best, is
based on results of detailed sensitivity of assessment studies. However, in
many cases, due to lack of time or lack of appropriate experimental data, the
user is forced to make ad hoc decisions.


## 2.1.1. Spatial Convergence

As has been quite often
misunderstood, a continuous refinement of the spatial resolution (e.g., a
reduction of the cell sizes) does not automatically improve the accuracy of the
prediction. There are two major reasons for this behavior:(1)
the large number of empirical
constitutive relations used in the codes has been developed on the basis of a
fixed (in general coarse) nodalization;(2)
the numerical schemes used in
the codes generally include a sufficient amount of artificial viscosity which
is needed in order to provide stable numerical results. A reduction of the cell
sizes below a certain threshold value might result in severe nonphysical
instabilities.
From those considerations, it can be concluded that no a priori optimal approach for the
nodalization scheme exists.


## 2.1.2. Mapping of Multidimensional Effects

Multidimensional effects, especially with
respect to flow splitting and flow merging processes (e.g., the connection of
the main coolant pipe to the pressure vessel), exist also in relatively small
scale integral test facilities. The problem might become even more complicated
due to the presence of additional bypass flows and a large redistribution of
flow during the transient. It is left to the code user to determine how to map
these flow conditions within the frame of a one-dimensional code, using the
existing elements like branch components, multiple junction connections, or
cross-flow junctions. These two examples show how the limitations in the
physical modeling and the numerical method in the codes have to be compensated
by an “engineering judgment” of the code user which, at best, is
based on results of detailed sensitivity of assessment studies. However, in
many cases, due to lack of time or lack of appropriate experimental data, the
user is forced to make ad hoc decisions.


## 2.2. Code Options: Physical Model Parameters

Even though the number
of user options has been largely reduced in the advanced codes, various
possibilities exist about how the code can physically model specific phenomena.
Some examples are as follows.(1)
Choice between engineering type models for choking or use of code
implicit calculation of critical two-phase flow conditions.(2)
Flow multipliers for subcooled or saturated choked flow.(3)
The efficiency of separators.(4)
Two-phase flow characteristics of main coolant pumps.(5)
Pressure loss coefficient for pipes, pipe connections, valves, branches, and so forth.
Since in many cases direct measured data are not available or, at least, not complete, the user is
left to his engineering judgment to specify those parameters.


## 2.3. Input Parameter Related to Specific  System Characteristics

The assessment of LWR safety codes is mainly performed on the basis of
experimental data coming from scaled integral or separate effect test
facilities. Typically in these scaled-down facilities, specific effects, which
might be small or even negligible for the full-size reactor case, can become as
important as the major phenomena to be investigated. Examples are the release
of the heat from the structures to the coolant, heat losses to the environment,
or small bypass flows. Often, the quality of the prediction depends largely on
the correct description of those effects which needs a very detailed
representation of the structural materials and a good approximation of the
local distribution of the heat losses. However, many times the importance of
those effects is largely underestimated, and consequently, wrong conclusions
are drawn from results based on incomplete representation of a small-scale test
facility.


## 2.4. Input Parameters Needed for Specific  System Components

The general
thermal-hydraulic system behavior is described in the codes by the major code
modules based on a one-dimensional formulation of the mass, momentum, and
energy equations for the separated phases. However, for a number of system
components, this approach is not adequate and consequently additional, mainly empirical
models have to be introduced, for example, for pumps, valves, separators, and so forth.
In general, these models require a large amount of additional code input data,
which are often not known since they are largely scaling dependent.A typical example is
the input data needed for the homologous curves which describe the pump
behavior under single and two-phase flow conditions which in general are known
only for a few small-scale pumps. In all these cases, the code user has to
extrapolate from existing data obtained for different designs and scaling
factors which introduces a further uncertainty to the prediction.


## 2.5. Specification of Initial and  Boundary Conditions

Most of the existing
codes do not provide a steady-state option. In these cases pseudo-steady-state
runs have to be performed using more or less artificial control systems in
order to drive the code towards the specified initial conditions. The
specification of stable initial and boundary conditions and the setting of
related controllers require great care and detailed checking. If this is not
done correctly, a large risk, that even small imbalances in the initial data
will overwrite the following transient, exists especially for slow transients
and small break LOCA calculations.


## 2.6. Specification of State and  Transport Property Data

The calculation of state and transport properties is usually done
implicitly by the code. However, in some cases, for example, in RELAP5, the
code user can define the range of reference points for property tables, and
therefore, can influence the accuracy of the prediction. This might be of
importance especially in more “difficult regions,” for example, close to the
critical point or at conditions near atmospheric pressure. Another example is constituted by the fuel
materials property data: the specification of fuel rod gap conductance (and
thickness) is an important parameter, affecting core dryout and rewet occurrences
that must be selected by the user.


## 2.7. Selection of Parameters Determining  Time Step Sizes

All the existing codes are using automatic procedures for the selection
of time step sizes in order to provide convergence and accuracy of the
prediction. Experience shows, however, that these procedures do not always
guarantee stable numerical results, and therefore, the user might often force
the code to take very small time steps in order to pass through trouble spots.
In some cases, if this action is not taken, very large numerical errors can be
introduced in the evolution of any transient scenario and are not always
checked by the code user.


## 2.8. Code Input Errors

In order to prepare a complete input data deck for a large system, the code user has to provide a huge number of parameters (approx., 15 to 20
thousand values for an NPP nodalization) which he has to type one by one. Even if all the codes provided consistency
checks, the probability for code input errors is relatively high and can be
reduced only by extreme care following clear quality assurance guidelines.


## 3. Qualification of Computational Tools

A key feature of the
activities performed in nuclear reactor safety technology is constituted by the
necessity to demonstrate the qualification level of each tool adopted within an
assigned process and of each step of the concerned process. Computational tools
include (numerical) codes, nodalizations, and procedures. Furthermore, the
users of those computational tools are part of the process and need suitable
demonstration of qualification.A consistent application (development, qualification, and application) of a thermal-hydraulic system code is
depicted in Figure2. The code
development and improvement process, block 1 in Figure 2, is conducted by “code
developers” who make extensive use of assessment (block 4), typically performed
by independent users of the code (i.e., group pf experts independent from those
who developed the code). The consistent code assessment process implies the
availability of experimental data and of robust procedures for the use of the
codes, blocks 2 and 3, respectively. Once the process identified by blocks 1
and 4 is completed, a qualified code is available to the technical community,
ready to be used for NPP applications (block 5). The NPP applications still
require “consistent” procedures (block 3) for a qualified use of the code. The
results from the calculations are, whatever the qualification level achieved by
the code is, affected by errors that must be quantified through appropriate
uncertainty evaluation methodology (block 6).Figure 2
A consistent application (development, qualification and application) of a
thermalhydraulic system code.


### 3.1. Code Qualification

The code constitutes the main tool for
investigating the NPP behavior or for evaluating the efficacy of systems or
special procedures during accident transient scenarios. The following
constitutes the main requisites for a qualified use of the code [11].
(1)
Capability of the code to reproduce the relevant phenomena occurring for the selected spectrum of accidents.(2)
Capability to reproduce the peculiarities of the reference plant/facility.(3)
Capability to produce suitable results for a comparison with the acceptable criteria.(4)
Availability of qualified users.
Essentially the code must be able to reproduce two fundamental aspects [17].
(a)
The NPP and the accident conditions: all the
relevant zones, systems, procedure, and related actuation logic is to be
included in the calculation. This item also includes any external event,
boundary and initial condition necessary to identify the plant but also the
selected accident.(b)
The phenomena occurring (expected) during the accident.
In order to ensure those capabilities, the code qualification process is needed and the following two phases can be identified.
(1)
Development phase: several models are
created, developed, and improved by the code development team; many checks are
necessary to qualify each model and the global architecture of the code.(2)
Independent assessment phase: the code is ready to be used but qualified calculations performed by organizations independent from the code-development team are needed to check independently
the declared capabilities of the code.
It is relevant to note that in the development phase the code models can be changed and the code is not available to the final user. In the independent assessment phase, the final version of the code is
distributed and the user is generally forbidden to change any element of the
code models apart from the normal available options as described in the user
manual.The activities performed during the development
phase are (Figure3) as follows.
(a)
Verification: it consists in the review of the source coding relative to its description in the
documentation. In other words, code
verification involves activities that are related to software quality assurance
(SQA) practices and to activities directed toward finding and removing
deficiencies in models and in numerical algorithms used to solve partial
differential equations.  SQA procedures are needed during software development
and modification, as well as during production computing. SQA procedures are
well developed in general, but areas of improvement are needed with regard to
software operating on massively parallel computer systems. During the
verification step, the correct working of models, interfaces, and numerics is
checked to ensure that the code, in all its components, is free of errors and
produces results.(b)
Validation (or assessment): it consists in evaluating the accuracy of the values predicted by the code-nodalization against relevant experimental data for important phenomena expected to occur. In other
words, code validation emphasizes the
quantitative assessment of computational model accuracy by comparison with
high-quality validation experiments, that is, experiments that are well
characterized in terms of measurement and documentation of all the input
quantities needed for the computational model, as well as carefully estimated
and documented experimental measurement uncertainty. The validation process
ensures the consistency of the results produced by the code; that is, it proves
that the code, as a whole system, is capable to produce meaningful results: not
only the code-system works, but it also works in the right direction.
The independent code-assessment is carried out
by independent users of the code and has the aim to quantify the code accuracy,
which is the discrepancy between transient calculations and experiments performed in ITF. The independent
assessment of the code involves different aspects, like (Figure 3)
(1)
qualification of the nodalization;(2)
qualification of the user;(3)
definitions of procedures for the use of the code;(4)
evaluation of the accuracy from a qualitative and quantitative point of view.
The above items are connected with the application of the code to experimental tests performed in ITF. The procedure
for the qualification of the nodalization is described with more details in the
Section 3.4 together with acceptability criteria.Figure 3
Internal and external (independent) code assessment.Besides the demonstration of the code capability in reproducing an experiment performed in a test facility, the code
must be checked also in performing NPP calculation. This constitutes the final
step of the independent code assessment (Figure4): the demonstration of the
code capability at a different scale, that is, the full scale of the NPP. A nodalization of an NPP is prepared and qualified. The check consists in a “similarity analysis” generally involving a Kv-scaled calculation (see Section 3.3). In
this kind of calculation, the initial and boundary conditions of an experiment
performed in an ITF are properly scaled and implemented in the NPP
nodalization. The results of the NPP-scaled nodalization must reproduce the
relevant phenomena occurring in the experiment. Alternative ways to prove the
code capability at the NPP scale are constituted by the comparison with other
qualified NPP code results or, if available, with data obtained in NPP operational
transients. As the procedure followed for this part of the code assessment is
the same adopted for the qualification process of the nodalization, more
details are given in Section 3.4.Figure 4
Code independent assessment.The contemporaneous acceptability of
the accuracy (step of the process connected with experiments in ITF) and of the
similarity analysis (step of the process connected with NPP) constitutes the positive
demonstration of the code capability and the end of the code assessment. The
calculated accuracy is possibly included in the data base suitable for
uncertainty evaluation (block 6 in Figure2, [12, 13]). If the accuracy is not in the range of acceptability or the code fails the
similarity analysis, the code is considered not qualified and the
code-development team will be informed in order to develop new code models or
to improve the existing ones.As consequence, new revision or new version of
the code can be produced during the development phase: a new revision contains
a new physical modeling whereas a new version may contain new numerical
methods, new modules, new submodules, new preprocessing or post-processing or a
new code architecture. The steps
typically performed during the qualification process of a new revision or of a new
version of the code are depicted in Figure5.
The needed reference data are derived by the following sources.
(1)
Analytical experiments, with separate effect tests and component tests,
are used for the development and the validation of closure laws.(2)
System tests or integral tests used to validate the general consistency
of the revision. Successive revisions of constitutive laws are implemented in
successive versions of the code and assessed.
Constitutive relationships are developed and assessed following a general methodology hereafter summarized.Figure 5
Qualification process of a new revision or a new version of the code.Step A
Analytical experiments, including separate effect tests and component
tests, are performed and analyzed. Separate effect tests investigate a physical
process such as the interfacial friction, the wall heat transfer. Component
tests investigate physical processes which are specific to a reactor component,
such as the phase separation in a Tee junction.Step B
Development of a completerevision of constitutive laws from a large analytical experimental data base. Successive revisions are implemented in successive code versions.Step C
Qualification calculations of the analytical tests are used in order to validate each closure relationship.Step D
Verification calculations of system tests or integral tests are used in order to validate the general consistency of the revision.Step E
Delivery of the code version and revision is fully assessed (qualified and verified) and documented (description documents and assessment reports).A new revision of constitutive laws is developed using some general principles.(1)
Data are first compared with existing models; if necessary, original
models are developed.(2)
When and where data are missing, simple extrapolations of existing
qualified models are used. No mechanistic model is developed without the
experimental evidence of its relevance.(3)
In a prequalification phase, some tests of each experiment of the
qualification matrix are calculated.(4)
A systematic qualification of the frozen revision is then performed. All
tests of the qualification matrix are calculated and qualification reports are
written.
Some other additional remarks about the qualification process of the code are as follows.(1)
The qualification program has to cover the whole range of accidental transients
in LWR. As examples, the following accidents have to be considered for a PWR: large
break loss of coolant accidents (LBLOCA); small break loss of coolant accidents
(SBLOCA); steam generator tube ruptures (SGTR); loss of feed water (LOFW); main
stream line break (MSLB); loss of residual heat removal (RHR) system.(2)
The code has to be fully portable on all machines, so that a unique code
version is released to all the users.(3)
No code options for physical models, or as few as possible, have to be
proposed to the user.(4)
The users guidelines should be as precise as possible and take full
benefit of the experience gained from the code-development team.


### 3.2. Validation Activities for Thermal-Hydraulic  System Codes

The validation against experimental data is essential in the process of system codes development and
improvement as it has been discussed in the previous section. The models implemented and used in a code are
generally developed based on experimental tests performed in specific facilities. It is possible to distinguish among.(1)
Basic facilities: In these facilities the fundamental phenomena are
reproduces; the results are used to improve the equations of the single model
or to derive empirically the relation between the relevant parameters; this
kind of facilities are designed with goal to reproduce the specific phenomenon
to be investigate.(2)
Separate effect facilities: in these facilities some relevant zones of
the NPP are reproduced by a suitable scaling law to investigate the local
occurrence of a phenomenon; the results of the experiments performed in these
facilities are used to create and to validate the (several) models to be included
in a code.(3)
Integral tests facilities: these facilities are simulators of reference
NPP. All the relevant parts and systems of an NPP are reproduced by a suitable
scaling law. The whole plant is reproduced and the global plant response is obtained
as results. The results are used to realize and improve the models and to check
the code capabilities.
It will be noted that also the data from NPP
can be used, if available. However, in an NPP the data obtained are the one
recorded by the system of control of the plant while, typically, the facilities
are equipped with a large number of sensors and many detailed data are generated
making the instrumentation of the facilities more suitable for code validation.Huge effort was done by the
OECD/NEA/CSNI from 1991 to 1997 in the construction of the separate effects
test facility code validation matrix (SETF-CCVM, published in 1994) for thermal-hydraulic
system codes [3]. Integral test facility
(ITF) matrices for validation of realistic thermal-hydraulic system computer
codes were also established by CSNI focused mainly on PWRs, and BWRs. The ITF-CCVM
[4] validation matrix was issued in 1987 and updated in 1996.By
the validation matrices, the best sets of openly available experimental data
for code validation, assessment, and improvement were collected in a systematic
way. Quantitative code assessment with respect to the quantification of
uncertainties in the modeling of individual phenomena by the codes is also an
outcome of the matrix development. In addition, the construction of such
matrices is an attempt to record information of the experimental work which has
been generated around the world over the last years in the LWR safety thermal-hydraulics
field. 187 facilities covering 67 relevant phenomena for LOCA and non-LOCA
transient applications of PWRs and BWRs within a large range of useful
parameters were identified and about 2094 tests were included in the SETF-CCVM matrix. The majority of these phenomena are also relevant to advanced water-cooled
reactors. The major elements of the SETF-CCVM have been
already integrated into the validation matrices of the major best-estimate thermal-hydraulic
system codes, for example, RELAP5, CATHARE, TRACE, and ATHLET.A total number of 177 PWR and BWR integral tests have
been selected as potential source for thermal-hydraulic code validation in the
ITF-CCVM report. Counter-part tests, similar tests and OECD ISP
tests were introduced in the report. Counter-part tests and similar tests in
differently scaled facilities are considered highly important for code
validation and therefore they were included in the tables of ITF selected
experiments. Moreover, over the last
twenty-nine years, CSNI has promoted 48 ISPs [18]. The main objectives of the
ISPs are as follows: to contribute to better understanding of postulated
events, to compare and evaluate the capability of codes (mainly best estimate
codes), to suggest improvements to the code developers, to improve the ability
of code users and to address the so-called scaling effect. ISPs were performed
in different fields as in-vessel thermal-hydraulic behavior, fuel behavior
under accident conditions, fission product release and transport, core/concrete
interactions, hydrogen distribution and mixing, containment thermal-hydraulic behavior.
ISP experiments were carefully controlled, documented, and evaluated.


### 3.3. Addressing the Scaling Issue

The reason why this section has been included
in the paper directly derives from the fact that the scaling analysis is the
needed link between the experiments performed in ITF and SETF and their
utilization in the code validation process. The flow diagram in Figure6
emphasizes this relevant role of the scaling analysis (red boxes) in two
different parts of the process describing a consistent application (development, qualification, and application) of a thermal-hydraulic system code: firstly during the code assessment process (as
the code development and improvement is based on experimental data obtained in
test facilities), secondly during the demonstration of the qualification of an
NPP nodalization (which is a needed step to perform a reliable NPP calculation).Figure 6
Role of the scaling analysis in the code assessment process.An NPP is characterized by high power (up to
thousands of MW), high pressure (tens of MPa), and large geometry (hundreds of
m3), thus it is well understandable the impossibility to perform
experiments preserving all these three quantities. The term scaling is in
general understood in a broad sense covering all differences existing between a
real full size plant and a corresponding experimental facility. An experimental
facility may be characterized by geometrical dimension and shape, arrangements,
and availability of components, or by the mode of operation (e.g., nuclear versus
electrical heating). All these differences have the potential to distort an
experimental observation precluding its direct application for the design or
operation of the reference plant. Distortion can be defined as a partial or
total suppression of physical phenomena caused by only changing the size
(geometric dimension) or the shape (arrangement of components) of the facility
[19].Three main objectives can be
associated to the scaling analysis as follows:(1)
the design of a test facility;(2)
the code validation, that is, the demonstration that the code accuracy is
scale independent;(3)
the extrapolation of experimental data (obtained into an ITF) to predict
the NPP behavior.
For the test facility design, three types of scaling principles can be adopted as follows.
(a)
Time-reducing scaling:
rigorous reduction of any linear dimension of the test rig would result in a
direct proportional reduction in time scaling. This is considered to be of
advantage only for cases where body forces due to gravity acceleration are
negligible compared to the local pressure differentials.(b)
Time preserving scale: based on a scale reduction of the volume of the loop system combined with a direct proportional scaling of energy sources and sinks (keeping constant the core power to system
volume ratio).(c)
Idealized time preserving modeling procedures: based on the equivalency of the mathematical representation of the full size plant and of the test rig. It is deduced from a separated treatment of the conservation equations for all involved volume modes and flow paths assuming homogeneous fluid.
Integral test facilities are normally designed to preserve geometrical similarity with the reference reactor system. Generally all main components (e.g., rector pressure vessel, downcomer, rod bundle, loop
piping, etc.) and the engineered safety system (HPIS, LPIS, accumulators,
auxiliary feed water, etc.) are represented. ITF are used to investigate, by
direct simulation, the behavior of an NPP in case of off-normal or accident
conditions. The geometrical similarity of the hardware of the loop systems has
been abandoned in favor of a preservation of geometric elevations, which are
decisive parameters for gravity dominated scenarios (e.g., in case of natural
circulation processes). Thus the reduction of the primary system volume is
largely achieved by an equivalent reduction in vertical flow cross sections.Due to the impossibility to perform relevant
experiment at full scale (i.e., in an NPP), the use of ITF or SETF is unavoidable.
In order to address the scaling issue, different approaches have been proposed
and are available from literature. However, a comprehensive solution has not
yet been achieved and moreover, it is evident that the attempt to scale up all thermal-hydraulic phenomena that occur during an assigned transient results in a myriad
of factors which have counterfeiting values [20]. For instance, let us consider Figure 7 that
schematically reproduces a two-phase flow condition (TPFC) in a vessel of a facility
when an SBLOCA scenario is postulated. The two-phase critical flow is affected
by phenomena like the vapor pull through and the subcooled vapor formation by
the sharp edge cavitations, the heat losses, the fluid temperature
stratification, and so forth. All these phenomena cannot be scaled up and are
characterized by parameters that do appear neither in any balance equations nor
in any scalable mechanistic models. This is a typical situation in which a
scaling criterion is not applicable. Nevertheless the influence of those
phenomena is time-restricted in relation to the entire transient and thus they
can be considered as local phenomena.Figure 7
Schematic representation of a two-phase flow condition in a reactor pressure vessel of a
facility during an SBLOCA.As a consequence, the only way to solve the
scaling problem is to consider only those phenomena and parameters that have a
real impact on the whole problem under investigation. The focusing on a single
phenomenon which occurs during a limited time (compared with the entire
duration of the problem) should be avoided because it is governed by factors
that are not scalable. Therefore a
hierarchy in the definition of the scaling factors is necessary and a global
strategy is needed [21] to demonstrate that those phenomena are effectively
local and cannot affect the overall behavior of the main thermal-hydraulic
parameters selected to describe the transient. Based on the flow diagram in Figure 6, the
strategy to adopt for solving the scaling problem consists in
(a)
developing a system code;(b)
qualifying the code against experimental data;(c)
demonstrating that the code-accuracy (i.e., discrepancy
between measured and calculated trends) only depends upon boundary initial conditions
(BIC) values (within the assigned variation ranges) and is not affected by the
scale of concerned ITF;(d)
applying such code to predict the same
relevant phenomena that are expected to find in a same experiment (or
transient) performed at different scale;(e)
performing NPP Kv-scaled calculation and
explaining the discrepancies (if any) between NPP Kv-scaled calculation and
measured trends in ITF considering only BIC values and hardware differences
(i.e., distortions).


### 3.4. Nodalization Qualification

Assuming the availability of a qualified code
and of a qualified user, it is necessary to define a procedure to qualify the
nodalization in order to obtain qualified (i.e., reliable) calculation results.
In this section a procedure for the nodalization qualification is discussed.A major issue in the use of mathematical models
is constituted by the model capability to reproduce the plant or facility
behavior under steady-state and transient conditions. These aspects constitute
two main checks for which acceptability criteria have to be defined and
satisfied during the nodalization-qualification process. The first of them is
related to the geometrical fidelity of the nodalization of the reference plant;
the second one is related to the capability of the code nodalization to
reproduce the expected transient scenario.The checks about the nodalization are necessary
to take into account the effect of many different sources of approximations,
like the following.(1)
The data of the reference plant available to the user are typically non exhaustive to reproduce a perfect “schematization” of the reference plant.(2)
From the available data, the user derives an approximated nodalization of the plant reducing the level of detail.(3)
The code capability to reproduce the hardware, the plant systems and the actuation logic of the systems reduce further the level of detail of the nodalization.
The reasons for the checks about the capability
of the code nodalization to perform the transient analysis deriving from
following considerations:
(1)
the code options must be adequate;(2)
the nodalization solutions must be adequate;(3)
some systems components can be tested only during transient conditions (e.g., ECCS that are not involved in the normal operation).
A simplified scheme of a procedure that can be adopted for the qualification of the nodalization is depicted in Figure 8 [22]. In the following, it has been assumed that the code has fulfilled the validation and qualification process and a “frozen” version of the code has
been made available to the final user. This means that the code user does not
have the possibility to modify or change the physical and numerical models of
the code (only the options described in the user manual are available to the
user). With reference to Figure 8, the qualification procedure of the
nodalization is described step by step.Figure 8
Flow sheet of nodalization qualification procedure.Step “a”
This step is related to the information available by the user manual and
by the guidelines for the use of the code. This type of information takes into
account the specific limits and assumptions of the code (specific of the code
adopted for the analysis) and some guidelines deriving from the best practices for
realizing the nodalization. From a generic point of view, the following aspects
should be carefully adopted:(1)
homogeneous  nodalizations;(2)
strict observation  of the user guidelines;(3)
standard use  of the code options.Step “b”
User experience and developers recommendations are useful to set up
particular procedure to be applied for a better nodalization. These special
procedures are related to the specific code adopted for the analysis. An
example is constituted by the “slice nodalization” technique adopted with the RELAP5
code to improve the capability of the code to reproduce transients involving natural
circulation phenomena.Step “c”
The realization of the nodalization depends on several aspects:
available data, user capability and experience, code capability. The
nodalization must reproduce all the relevant parts of the reference plant; this
includes geometrical and materials fidelity and reproduction of the systems and
related logics. From a generic point of view, the following recommendations can
be done.(1)
Data must  be qualified or in other words, data has to derive from(a)
qualified data facility (if the analysis is performed for a  facility);(b)
qualified test design;(c)
qualified test data.(2)
The data  base for the realization of the nodalization should be derived from
official document and traceability of each reference should be maintained.
However three different types of data can be identified as follows:(a)
qualified  data, from official sources;(b)
data  deriving from nonofficial sources; these types of data can be derived from
similar plant data, or other qualified nodalization for the same type of  plant; the use of these data can introduces potential errors and the  effect on the calculation results must be carefully evaluated;(c)
data assumed by the user; these data constitute some assumptions of the user  (on the base of the experience or by similitude with other similar  plants). The use of this type of data should be avoided. Any special  assumptions adopted by the user or special solutions in the nodalization  must be recorded and documented.Step “d”
The “steady-state” qualification level includes different checks: one is
related to the evaluation of the geometrical data and of numerical values
implemented in the nodalization; the other one is related to the capability of
the nodalization to reproduce the steady-state qualified conditions. The first
check should be performed by a user different from the user has developed the
nodalization. In the second check a “steady-state” calculation is performed.
This activity depends on the different code peculiarities. As an example, for RELAP5,
the steady-state calculation is constituted by a “null-transient” calculation (i.e.,
the “transient” option is selected and no variation of relevant parameters
occurs during the calculation).Step “e”
The relevant geometrical values and the relevant thermal-hydraulic
parameters of the steady-state conditions are identified. The selected
geometrical values and the selected relevant parameters are derived, respectively,
from the input deck of the nodalization and from the steady-state calculation
for performing the comparison with the hardware values and the experimental
parameters.Step “f”
This is the step where the adopted acceptability criteria are applied to
evaluate the comparison between hardware and implemented geometrical values in
the nodalization (e.g., volumes, heat transfer area, etc.) and between the experimental
and calculated steady-state parameters (e.g., pressures, temperatures, mass
flow rates, etc.). Some comments can be added as follows.(1)
The experimental data are typically available with error bands which
must be considered in the comparison with the calculated values and parameters.(2)
The steadiness of the steady-state calculation must be checked.Step “g”
If one or more than one of the checks in the step “f” are not fulfilled,
a review of the nodalization (step “c”) must be performed. This process can
request more detailed data, improvement in the development of the nodalization,
different user choices. The path “g” must be repeated till all acceptability
criteria are satisfied. A list of the geometrical values and of the
thermal-hydraulic parameters to be checked is given in Table1 together with
acceptable errors.Table 1
Parameters and acceptable errors for the nodalization qualification at “steady-state” level.
QuantityAcceptable error (°)1Primary circuit volume1%2Secondary circuit volume2%3Nonactive structure heat transfer area (overall)10%4Active structure heat transfer area (overall)0.1%5Non-active structure heat transfer volume (overall)14%6Active structure heat transfer volume (overall)0.2%7Volume versus height curve (i.e., “local” primary and secondary circuit volume)10%8Component relative elevation0.01 m9Axial and radial power distribution (°°)1%10Flow area of components like valves, pumps orifices1%11Generic flow area10%(*)12Primary circuit  power balance2%13Secondary circuit  power balance2%14Absolute pressure (PRZ, SG, ACC)0.1%15Fluid temperature0.5% (**)16Rod surface temperature10 K17Pump velocity1%18Heat losses10%19Local pressure drops10% (⋀)20Mass inventory in primary circuit2% (⋀⋀)21Mass inventory in secondary circuit5% (⋀⋀)22Flow rates (primary and secondary circuit)2%23Bypass mass flow rates10%24Pressurizer level (collapsed)0.05 m25Secondary side or downcomer level0.1 m (⋀⋀)°The % error is defined as the ratio (reference or measured value—calculated value).
The “dimensional error” is the numerator of the above expression.*With reference to each of the quantities below, following a one-hundred-second “null-transient” calculation, the solution must be stable with an inherent drift <1%/100 second.**And consistent with power error.⋀Of the difference between the maximum and minimum pressure in the loop.⋀
⋀And consistent with other errors.Step “h”
This step constitutes the “On Transient” level qualification. This
activity is necessary to demonstrate the capability of the code nodalization to
reproduce the relevant thermal-hydraulic phenomena expected during the
transient. This step also permits to verify the correctness of some systems
that are in operation only during transient events. Criteria, both qualitative
and quantitative, are established to express the acceptability of the transient
calculation. Two different aspects can be identified as follows.(1)
The code input deck concerns with the nodalization of an ITF. In this case the code calculation is used for the
code assessment. Checks include the code options selected by the user, the
solutions adopted for the development of the ITF nodalization, the logic of
some systems (e.g., ECCS). Typically many experimental results are available,
thus a similar test can be adopted for performing the “On Transient” level
qualification.(2)
The objective of the code
calculation is constituted by the analysis of a transient in an NPP. In this
case, it is necessary to check the nodalization capability to reproduce the
expected thermal-hydraulic phenomena occurring during the transient, the
selected code options, the adopted solutions for the development of the NPP
nodalization, and the logic of the systems not involved in the steady-state
calculation. Typically no data exist for the transients performed in the NPP. For
this reason, data from experiments carried out in ITF can be used for
performing the so-called “Kv-scaled” calculation. The Kv-scaled calculation
consists in using the developed NPP nodalization for predicting an experimental
transient (whose kind is similar to the one under investigation in the NPP)
performed in an ITF. The NPP nodalization is prepared for the Kv-scaled
calculation by properly scaling the BICs characterizing the selected transient
in the ITF. In other words, power, mass flow rates and ECCS capacity are scaled
adopting as scaling factor the ratio between the volume of the facility and the
volume of the NPP. The capability of the nodalization to reproduce the same
transient evolution and the thermal-hydraulic relevant phenomena is the needed
request for satisfying the “On Transient” qualification level.Step “i”
In this step the relevant thermal-hydraulic phenomena and parameters
are selected and a comparison between the calculated and experimental data is
performed. The selection of the phenomena derives from the following sources:(1)
experimental data analysis (engineering judgment is request);(2)
CSNI phenomena identification;(3)
use of Relevant Thermal-hydraulic Aspects (RTA, engineering judgment is request).Step “j”
This is the step where checks are performed to evaluate the acceptability of the
calculation both from qualitative and from quantitative point of view. For the
qualitative evaluation the following aspects are involved:(1)
Visual observation. This means that a visual comparison is performed
between experimental and calculated relevant parameters time trends;(2)
Sequence of the resulting events. This means that the list of the
calculated significant events together with their timing of occurrence is compared
with the experimental events;(3)
Use of the CSNI phenomena. The relevant phenomena suitable for the code
assessment and their relevance in the selected facility and in the selected
test are identified. A judgment can be express taking into account the
characteristics of the facility, the test peculiarities and the code results;(4)
Use of the RTAs. RTAs are typically identified inside the
phenomenological windows (i.e., time windows where a unique relevant phenomenon
is occurring) and are characterized by special parameters. These parameters can
be time values, single values, integral values, gradient values and
nondimensional values.
An example of a table containing RTAs is given in Table2.   Quantitative checks
are carried out by using the Fast Fourier Transform Based Method (FFTBM). This
special tool performs the comparison between experimental and calculated time
trends in the frequency domain for a list of selected parameters and
calculates, for each of them, a numerical value by which the accuracy is
quantitatively evaluated (no engineering judgment is involved in this process).
The FFTBM makes also possible to obtain a numerical judgment of the overall
results of the calculation. Criteria based on the values attained by FFTBM had
been selected for accepting the transient calculation. A description of the
FFTBM can be found in [23].Table 2UNITEXPUNIPI 91BN1OLPSICEA c2m4_lceaJudgment UNIPI/CEARTA: pressurizer emptyingTSEEmptying time*s13146—R/-Scram times413841R/ERTA: steam generators secondary side behaviourTSEMain feed water off, turbine bypasss595542E/RSVPDifference between PS and SG 1 SS pressure at 100 sMPa0.420.330.37R/RSVPSG 1 massKg/(s)at the end of subcooled blowdown774/(82)781/(75)761/(82)E/Ewhen PS pressure equals SG 1 SS pressure869/(618)938/(408)847/(463)R/Rwhen ACC starts804/(2955)802/(3019)788/(3075)E/Rwhen LPIS starts938/(5176)1126/(6529)956/(5474)R/RSYPSG 1 pressureMPaat the end of subcooled blowdown7.157.107.05E/Ewhen PS pressure equals SS pressure6.957.047.03R/Rwhen ACC starts4.113.954.00R/Ewhen LPIS starts0.880.830.83E/ERTA: subcooled blowdownTSEUpper plenum in sat conditionss83100110R/RIPABreak flow up to 100 skg152161162R/RRTA: first dryout occurrenceTSETime of dryouts223722992444E/RRange of dryout occurrence at various core levelss2237÷24712299÷25182444÷2625R/RStep “k”
This path is actuated if any of the checks (qualitative and
quantitative) is not fulfilled. The nodalization is improved by adopting different
noding solutions, changing code options or increasing the level of detail using,
if available, more precise data. Every time the nodalization is modified a new qualification
process will be performed through the loop “c-d-e-f-h-i-j-c.”Step “l”
This is the last step of the procedure. The obtained nodalization is
used for the selected transient and the selected facility or plant. Any subsequent modification of the nodalization
(e.g., necessary to better reproduce the experimental results) requires a new
qualification process both at “steady-state” and “on transient” level.


## 3.1. Code Qualification

The code constitutes the main tool for
investigating the NPP behavior or for evaluating the efficacy of systems or
special procedures during accident transient scenarios. The following
constitutes the main requisites for a qualified use of the code [11].
(1)
Capability of the code to reproduce the relevant phenomena occurring for the selected spectrum of accidents.(2)
Capability to reproduce the peculiarities of the reference plant/facility.(3)
Capability to produce suitable results for a comparison with the acceptable criteria.(4)
Availability of qualified users.
Essentially the code must be able to reproduce two fundamental aspects [17].
(a)
The NPP and the accident conditions: all the
relevant zones, systems, procedure, and related actuation logic is to be
included in the calculation. This item also includes any external event,
boundary and initial condition necessary to identify the plant but also the
selected accident.(b)
The phenomena occurring (expected) during the accident.
In order to ensure those capabilities, the code qualification process is needed and the following two phases can be identified.
(1)
Development phase: several models are
created, developed, and improved by the code development team; many checks are
necessary to qualify each model and the global architecture of the code.(2)
Independent assessment phase: the code is ready to be used but qualified calculations performed by organizations independent from the code-development team are needed to check independently
the declared capabilities of the code.
It is relevant to note that in the development phase the code models can be changed and the code is not available to the final user. In the independent assessment phase, the final version of the code is
distributed and the user is generally forbidden to change any element of the
code models apart from the normal available options as described in the user
manual.The activities performed during the development
phase are (Figure3) as follows.
(a)
Verification: it consists in the review of the source coding relative to its description in the
documentation. In other words, code
verification involves activities that are related to software quality assurance
(SQA) practices and to activities directed toward finding and removing
deficiencies in models and in numerical algorithms used to solve partial
differential equations.  SQA procedures are needed during software development
and modification, as well as during production computing. SQA procedures are
well developed in general, but areas of improvement are needed with regard to
software operating on massively parallel computer systems. During the
verification step, the correct working of models, interfaces, and numerics is
checked to ensure that the code, in all its components, is free of errors and
produces results.(b)
Validation (or assessment): it consists in evaluating the accuracy of the values predicted by the code-nodalization against relevant experimental data for important phenomena expected to occur. In other
words, code validation emphasizes the
quantitative assessment of computational model accuracy by comparison with
high-quality validation experiments, that is, experiments that are well
characterized in terms of measurement and documentation of all the input
quantities needed for the computational model, as well as carefully estimated
and documented experimental measurement uncertainty. The validation process
ensures the consistency of the results produced by the code; that is, it proves
that the code, as a whole system, is capable to produce meaningful results: not
only the code-system works, but it also works in the right direction.
The independent code-assessment is carried out
by independent users of the code and has the aim to quantify the code accuracy,
which is the discrepancy between transient calculations and experiments performed in ITF. The independent
assessment of the code involves different aspects, like (Figure 3)
(1)
qualification of the nodalization;(2)
qualification of the user;(3)
definitions of procedures for the use of the code;(4)
evaluation of the accuracy from a qualitative and quantitative point of view.
The above items are connected with the application of the code to experimental tests performed in ITF. The procedure
for the qualification of the nodalization is described with more details in the
Section 3.4 together with acceptability criteria.Figure 3
Internal and external (independent) code assessment.Besides the demonstration of the code capability in reproducing an experiment performed in a test facility, the code
must be checked also in performing NPP calculation. This constitutes the final
step of the independent code assessment (Figure4): the demonstration of the
code capability at a different scale, that is, the full scale of the NPP. A nodalization of an NPP is prepared and qualified. The check consists in a “similarity analysis” generally involving a Kv-scaled calculation (see Section 3.3). In
this kind of calculation, the initial and boundary conditions of an experiment
performed in an ITF are properly scaled and implemented in the NPP
nodalization. The results of the NPP-scaled nodalization must reproduce the
relevant phenomena occurring in the experiment. Alternative ways to prove the
code capability at the NPP scale are constituted by the comparison with other
qualified NPP code results or, if available, with data obtained in NPP operational
transients. As the procedure followed for this part of the code assessment is
the same adopted for the qualification process of the nodalization, more
details are given in Section 3.4.Figure 4
Code independent assessment.The contemporaneous acceptability of
the accuracy (step of the process connected with experiments in ITF) and of the
similarity analysis (step of the process connected with NPP) constitutes the positive
demonstration of the code capability and the end of the code assessment. The
calculated accuracy is possibly included in the data base suitable for
uncertainty evaluation (block 6 in Figure2, [12, 13]). If the accuracy is not in the range of acceptability or the code fails the
similarity analysis, the code is considered not qualified and the
code-development team will be informed in order to develop new code models or
to improve the existing ones.As consequence, new revision or new version of
the code can be produced during the development phase: a new revision contains
a new physical modeling whereas a new version may contain new numerical
methods, new modules, new submodules, new preprocessing or post-processing or a
new code architecture. The steps
typically performed during the qualification process of a new revision or of a new
version of the code are depicted in Figure5.
The needed reference data are derived by the following sources.
(1)
Analytical experiments, with separate effect tests and component tests,
are used for the development and the validation of closure laws.(2)
System tests or integral tests used to validate the general consistency
of the revision. Successive revisions of constitutive laws are implemented in
successive versions of the code and assessed.
Constitutive relationships are developed and assessed following a general methodology hereafter summarized.Figure 5
Qualification process of a new revision or a new version of the code.Step A
Analytical experiments, including separate effect tests and component
tests, are performed and analyzed. Separate effect tests investigate a physical
process such as the interfacial friction, the wall heat transfer. Component
tests investigate physical processes which are specific to a reactor component,
such as the phase separation in a Tee junction.Step B
Development of a completerevision of constitutive laws from a large analytical experimental data base. Successive revisions are implemented in successive code versions.Step C
Qualification calculations of the analytical tests are used in order to validate each closure relationship.Step D
Verification calculations of system tests or integral tests are used in order to validate the general consistency of the revision.Step E
Delivery of the code version and revision is fully assessed (qualified and verified) and documented (description documents and assessment reports).A new revision of constitutive laws is developed using some general principles.(1)
Data are first compared with existing models; if necessary, original
models are developed.(2)
When and where data are missing, simple extrapolations of existing
qualified models are used. No mechanistic model is developed without the
experimental evidence of its relevance.(3)
In a prequalification phase, some tests of each experiment of the
qualification matrix are calculated.(4)
A systematic qualification of the frozen revision is then performed. All
tests of the qualification matrix are calculated and qualification reports are
written.
Some other additional remarks about the qualification process of the code are as follows.(1)
The qualification program has to cover the whole range of accidental transients
in LWR. As examples, the following accidents have to be considered for a PWR: large
break loss of coolant accidents (LBLOCA); small break loss of coolant accidents
(SBLOCA); steam generator tube ruptures (SGTR); loss of feed water (LOFW); main
stream line break (MSLB); loss of residual heat removal (RHR) system.(2)
The code has to be fully portable on all machines, so that a unique code
version is released to all the users.(3)
No code options for physical models, or as few as possible, have to be
proposed to the user.(4)
The users guidelines should be as precise as possible and take full
benefit of the experience gained from the code-development team.


## 3.2. Validation Activities for Thermal-Hydraulic  System Codes

The validation against experimental data is essential in the process of system codes development and
improvement as it has been discussed in the previous section. The models implemented and used in a code are
generally developed based on experimental tests performed in specific facilities. It is possible to distinguish among.(1)
Basic facilities: In these facilities the fundamental phenomena are
reproduces; the results are used to improve the equations of the single model
or to derive empirically the relation between the relevant parameters; this
kind of facilities are designed with goal to reproduce the specific phenomenon
to be investigate.(2)
Separate effect facilities: in these facilities some relevant zones of
the NPP are reproduced by a suitable scaling law to investigate the local
occurrence of a phenomenon; the results of the experiments performed in these
facilities are used to create and to validate the (several) models to be included
in a code.(3)
Integral tests facilities: these facilities are simulators of reference
NPP. All the relevant parts and systems of an NPP are reproduced by a suitable
scaling law. The whole plant is reproduced and the global plant response is obtained
as results. The results are used to realize and improve the models and to check
the code capabilities.
It will be noted that also the data from NPP
can be used, if available. However, in an NPP the data obtained are the one
recorded by the system of control of the plant while, typically, the facilities
are equipped with a large number of sensors and many detailed data are generated
making the instrumentation of the facilities more suitable for code validation.Huge effort was done by the
OECD/NEA/CSNI from 1991 to 1997 in the construction of the separate effects
test facility code validation matrix (SETF-CCVM, published in 1994) for thermal-hydraulic
system codes [3]. Integral test facility
(ITF) matrices for validation of realistic thermal-hydraulic system computer
codes were also established by CSNI focused mainly on PWRs, and BWRs. The ITF-CCVM
[4] validation matrix was issued in 1987 and updated in 1996.By
the validation matrices, the best sets of openly available experimental data
for code validation, assessment, and improvement were collected in a systematic
way. Quantitative code assessment with respect to the quantification of
uncertainties in the modeling of individual phenomena by the codes is also an
outcome of the matrix development. In addition, the construction of such
matrices is an attempt to record information of the experimental work which has
been generated around the world over the last years in the LWR safety thermal-hydraulics
field. 187 facilities covering 67 relevant phenomena for LOCA and non-LOCA
transient applications of PWRs and BWRs within a large range of useful
parameters were identified and about 2094 tests were included in the SETF-CCVM matrix. The majority of these phenomena are also relevant to advanced water-cooled
reactors. The major elements of the SETF-CCVM have been
already integrated into the validation matrices of the major best-estimate thermal-hydraulic
system codes, for example, RELAP5, CATHARE, TRACE, and ATHLET.A total number of 177 PWR and BWR integral tests have
been selected as potential source for thermal-hydraulic code validation in the
ITF-CCVM report. Counter-part tests, similar tests and OECD ISP
tests were introduced in the report. Counter-part tests and similar tests in
differently scaled facilities are considered highly important for code
validation and therefore they were included in the tables of ITF selected
experiments. Moreover, over the last
twenty-nine years, CSNI has promoted 48 ISPs [18]. The main objectives of the
ISPs are as follows: to contribute to better understanding of postulated
events, to compare and evaluate the capability of codes (mainly best estimate
codes), to suggest improvements to the code developers, to improve the ability
of code users and to address the so-called scaling effect. ISPs were performed
in different fields as in-vessel thermal-hydraulic behavior, fuel behavior
under accident conditions, fission product release and transport, core/concrete
interactions, hydrogen distribution and mixing, containment thermal-hydraulic behavior.
ISP experiments were carefully controlled, documented, and evaluated.


## 3.3. Addressing the Scaling Issue

The reason why this section has been included
in the paper directly derives from the fact that the scaling analysis is the
needed link between the experiments performed in ITF and SETF and their
utilization in the code validation process. The flow diagram in Figure6
emphasizes this relevant role of the scaling analysis (red boxes) in two
different parts of the process describing a consistent application (development, qualification, and application) of a thermal-hydraulic system code: firstly during the code assessment process (as
the code development and improvement is based on experimental data obtained in
test facilities), secondly during the demonstration of the qualification of an
NPP nodalization (which is a needed step to perform a reliable NPP calculation).Figure 6
Role of the scaling analysis in the code assessment process.An NPP is characterized by high power (up to
thousands of MW), high pressure (tens of MPa), and large geometry (hundreds of
m3), thus it is well understandable the impossibility to perform
experiments preserving all these three quantities. The term scaling is in
general understood in a broad sense covering all differences existing between a
real full size plant and a corresponding experimental facility. An experimental
facility may be characterized by geometrical dimension and shape, arrangements,
and availability of components, or by the mode of operation (e.g., nuclear versus
electrical heating). All these differences have the potential to distort an
experimental observation precluding its direct application for the design or
operation of the reference plant. Distortion can be defined as a partial or
total suppression of physical phenomena caused by only changing the size
(geometric dimension) or the shape (arrangement of components) of the facility
[19].Three main objectives can be
associated to the scaling analysis as follows:(1)
the design of a test facility;(2)
the code validation, that is, the demonstration that the code accuracy is
scale independent;(3)
the extrapolation of experimental data (obtained into an ITF) to predict
the NPP behavior.
For the test facility design, three types of scaling principles can be adopted as follows.
(a)
Time-reducing scaling:
rigorous reduction of any linear dimension of the test rig would result in a
direct proportional reduction in time scaling. This is considered to be of
advantage only for cases where body forces due to gravity acceleration are
negligible compared to the local pressure differentials.(b)
Time preserving scale: based on a scale reduction of the volume of the loop system combined with a direct proportional scaling of energy sources and sinks (keeping constant the core power to system
volume ratio).(c)
Idealized time preserving modeling procedures: based on the equivalency of the mathematical representation of the full size plant and of the test rig. It is deduced from a separated treatment of the conservation equations for all involved volume modes and flow paths assuming homogeneous fluid.
Integral test facilities are normally designed to preserve geometrical similarity with the reference reactor system. Generally all main components (e.g., rector pressure vessel, downcomer, rod bundle, loop
piping, etc.) and the engineered safety system (HPIS, LPIS, accumulators,
auxiliary feed water, etc.) are represented. ITF are used to investigate, by
direct simulation, the behavior of an NPP in case of off-normal or accident
conditions. The geometrical similarity of the hardware of the loop systems has
been abandoned in favor of a preservation of geometric elevations, which are
decisive parameters for gravity dominated scenarios (e.g., in case of natural
circulation processes). Thus the reduction of the primary system volume is
largely achieved by an equivalent reduction in vertical flow cross sections.Due to the impossibility to perform relevant
experiment at full scale (i.e., in an NPP), the use of ITF or SETF is unavoidable.
In order to address the scaling issue, different approaches have been proposed
and are available from literature. However, a comprehensive solution has not
yet been achieved and moreover, it is evident that the attempt to scale up all thermal-hydraulic phenomena that occur during an assigned transient results in a myriad
of factors which have counterfeiting values [20]. For instance, let us consider Figure 7 that
schematically reproduces a two-phase flow condition (TPFC) in a vessel of a facility
when an SBLOCA scenario is postulated. The two-phase critical flow is affected
by phenomena like the vapor pull through and the subcooled vapor formation by
the sharp edge cavitations, the heat losses, the fluid temperature
stratification, and so forth. All these phenomena cannot be scaled up and are
characterized by parameters that do appear neither in any balance equations nor
in any scalable mechanistic models. This is a typical situation in which a
scaling criterion is not applicable. Nevertheless the influence of those
phenomena is time-restricted in relation to the entire transient and thus they
can be considered as local phenomena.Figure 7
Schematic representation of a two-phase flow condition in a reactor pressure vessel of a
facility during an SBLOCA.As a consequence, the only way to solve the
scaling problem is to consider only those phenomena and parameters that have a
real impact on the whole problem under investigation. The focusing on a single
phenomenon which occurs during a limited time (compared with the entire
duration of the problem) should be avoided because it is governed by factors
that are not scalable. Therefore a
hierarchy in the definition of the scaling factors is necessary and a global
strategy is needed [21] to demonstrate that those phenomena are effectively
local and cannot affect the overall behavior of the main thermal-hydraulic
parameters selected to describe the transient. Based on the flow diagram in Figure 6, the
strategy to adopt for solving the scaling problem consists in
(a)
developing a system code;(b)
qualifying the code against experimental data;(c)
demonstrating that the code-accuracy (i.e., discrepancy
between measured and calculated trends) only depends upon boundary initial conditions
(BIC) values (within the assigned variation ranges) and is not affected by the
scale of concerned ITF;(d)
applying such code to predict the same
relevant phenomena that are expected to find in a same experiment (or
transient) performed at different scale;(e)
performing NPP Kv-scaled calculation and
explaining the discrepancies (if any) between NPP Kv-scaled calculation and
measured trends in ITF considering only BIC values and hardware differences
(i.e., distortions).


## 3.4. Nodalization Qualification

Assuming the availability of a qualified code
and of a qualified user, it is necessary to define a procedure to qualify the
nodalization in order to obtain qualified (i.e., reliable) calculation results.
In this section a procedure for the nodalization qualification is discussed.A major issue in the use of mathematical models
is constituted by the model capability to reproduce the plant or facility
behavior under steady-state and transient conditions. These aspects constitute
two main checks for which acceptability criteria have to be defined and
satisfied during the nodalization-qualification process. The first of them is
related to the geometrical fidelity of the nodalization of the reference plant;
the second one is related to the capability of the code nodalization to
reproduce the expected transient scenario.The checks about the nodalization are necessary
to take into account the effect of many different sources of approximations,
like the following.(1)
The data of the reference plant available to the user are typically non exhaustive to reproduce a perfect “schematization” of the reference plant.(2)
From the available data, the user derives an approximated nodalization of the plant reducing the level of detail.(3)
The code capability to reproduce the hardware, the plant systems and the actuation logic of the systems reduce further the level of detail of the nodalization.
The reasons for the checks about the capability
of the code nodalization to perform the transient analysis deriving from
following considerations:
(1)
the code options must be adequate;(2)
the nodalization solutions must be adequate;(3)
some systems components can be tested only during transient conditions (e.g., ECCS that are not involved in the normal operation).
A simplified scheme of a procedure that can be adopted for the qualification of the nodalization is depicted in Figure 8 [22]. In the following, it has been assumed that the code has fulfilled the validation and qualification process and a “frozen” version of the code has
been made available to the final user. This means that the code user does not
have the possibility to modify or change the physical and numerical models of
the code (only the options described in the user manual are available to the
user). With reference to Figure 8, the qualification procedure of the
nodalization is described step by step.Figure 8
Flow sheet of nodalization qualification procedure.Step “a”
This step is related to the information available by the user manual and
by the guidelines for the use of the code. This type of information takes into
account the specific limits and assumptions of the code (specific of the code
adopted for the analysis) and some guidelines deriving from the best practices for
realizing the nodalization. From a generic point of view, the following aspects
should be carefully adopted:(1)
homogeneous  nodalizations;(2)
strict observation  of the user guidelines;(3)
standard use  of the code options.Step “b”
User experience and developers recommendations are useful to set up
particular procedure to be applied for a better nodalization. These special
procedures are related to the specific code adopted for the analysis. An
example is constituted by the “slice nodalization” technique adopted with the RELAP5
code to improve the capability of the code to reproduce transients involving natural
circulation phenomena.Step “c”
The realization of the nodalization depends on several aspects:
available data, user capability and experience, code capability. The
nodalization must reproduce all the relevant parts of the reference plant; this
includes geometrical and materials fidelity and reproduction of the systems and
related logics. From a generic point of view, the following recommendations can
be done.(1)
Data must  be qualified or in other words, data has to derive from(a)
qualified data facility (if the analysis is performed for a  facility);(b)
qualified test design;(c)
qualified test data.(2)
The data  base for the realization of the nodalization should be derived from
official document and traceability of each reference should be maintained.
However three different types of data can be identified as follows:(a)
qualified  data, from official sources;(b)
data  deriving from nonofficial sources; these types of data can be derived from
similar plant data, or other qualified nodalization for the same type of  plant; the use of these data can introduces potential errors and the  effect on the calculation results must be carefully evaluated;(c)
data assumed by the user; these data constitute some assumptions of the user  (on the base of the experience or by similitude with other similar  plants). The use of this type of data should be avoided. Any special  assumptions adopted by the user or special solutions in the nodalization  must be recorded and documented.Step “d”
The “steady-state” qualification level includes different checks: one is
related to the evaluation of the geometrical data and of numerical values
implemented in the nodalization; the other one is related to the capability of
the nodalization to reproduce the steady-state qualified conditions. The first
check should be performed by a user different from the user has developed the
nodalization. In the second check a “steady-state” calculation is performed.
This activity depends on the different code peculiarities. As an example, for RELAP5,
the steady-state calculation is constituted by a “null-transient” calculation (i.e.,
the “transient” option is selected and no variation of relevant parameters
occurs during the calculation).Step “e”
The relevant geometrical values and the relevant thermal-hydraulic
parameters of the steady-state conditions are identified. The selected
geometrical values and the selected relevant parameters are derived, respectively,
from the input deck of the nodalization and from the steady-state calculation
for performing the comparison with the hardware values and the experimental
parameters.Step “f”
This is the step where the adopted acceptability criteria are applied to
evaluate the comparison between hardware and implemented geometrical values in
the nodalization (e.g., volumes, heat transfer area, etc.) and between the experimental
and calculated steady-state parameters (e.g., pressures, temperatures, mass
flow rates, etc.). Some comments can be added as follows.(1)
The experimental data are typically available with error bands which
must be considered in the comparison with the calculated values and parameters.(2)
The steadiness of the steady-state calculation must be checked.Step “g”
If one or more than one of the checks in the step “f” are not fulfilled,
a review of the nodalization (step “c”) must be performed. This process can
request more detailed data, improvement in the development of the nodalization,
different user choices. The path “g” must be repeated till all acceptability
criteria are satisfied. A list of the geometrical values and of the
thermal-hydraulic parameters to be checked is given in Table1 together with
acceptable errors.Table 1
Parameters and acceptable errors for the nodalization qualification at “steady-state” level.
QuantityAcceptable error (°)1Primary circuit volume1%2Secondary circuit volume2%3Nonactive structure heat transfer area (overall)10%4Active structure heat transfer area (overall)0.1%5Non-active structure heat transfer volume (overall)14%6Active structure heat transfer volume (overall)0.2%7Volume versus height curve (i.e., “local” primary and secondary circuit volume)10%8Component relative elevation0.01 m9Axial and radial power distribution (°°)1%10Flow area of components like valves, pumps orifices1%11Generic flow area10%(*)12Primary circuit  power balance2%13Secondary circuit  power balance2%14Absolute pressure (PRZ, SG, ACC)0.1%15Fluid temperature0.5% (**)16Rod surface temperature10 K17Pump velocity1%18Heat losses10%19Local pressure drops10% (⋀)20Mass inventory in primary circuit2% (⋀⋀)21Mass inventory in secondary circuit5% (⋀⋀)22Flow rates (primary and secondary circuit)2%23Bypass mass flow rates10%24Pressurizer level (collapsed)0.05 m25Secondary side or downcomer level0.1 m (⋀⋀)°The % error is defined as the ratio (reference or measured value—calculated value).
The “dimensional error” is the numerator of the above expression.*With reference to each of the quantities below, following a one-hundred-second “null-transient” calculation, the solution must be stable with an inherent drift <1%/100 second.**And consistent with power error.⋀Of the difference between the maximum and minimum pressure in the loop.⋀
⋀And consistent with other errors.Step “h”
This step constitutes the “On Transient” level qualification. This
activity is necessary to demonstrate the capability of the code nodalization to
reproduce the relevant thermal-hydraulic phenomena expected during the
transient. This step also permits to verify the correctness of some systems
that are in operation only during transient events. Criteria, both qualitative
and quantitative, are established to express the acceptability of the transient
calculation. Two different aspects can be identified as follows.(1)
The code input deck concerns with the nodalization of an ITF. In this case the code calculation is used for the
code assessment. Checks include the code options selected by the user, the
solutions adopted for the development of the ITF nodalization, the logic of
some systems (e.g., ECCS). Typically many experimental results are available,
thus a similar test can be adopted for performing the “On Transient” level
qualification.(2)
The objective of the code
calculation is constituted by the analysis of a transient in an NPP. In this
case, it is necessary to check the nodalization capability to reproduce the
expected thermal-hydraulic phenomena occurring during the transient, the
selected code options, the adopted solutions for the development of the NPP
nodalization, and the logic of the systems not involved in the steady-state
calculation. Typically no data exist for the transients performed in the NPP. For
this reason, data from experiments carried out in ITF can be used for
performing the so-called “Kv-scaled” calculation. The Kv-scaled calculation
consists in using the developed NPP nodalization for predicting an experimental
transient (whose kind is similar to the one under investigation in the NPP)
performed in an ITF. The NPP nodalization is prepared for the Kv-scaled
calculation by properly scaling the BICs characterizing the selected transient
in the ITF. In other words, power, mass flow rates and ECCS capacity are scaled
adopting as scaling factor the ratio between the volume of the facility and the
volume of the NPP. The capability of the nodalization to reproduce the same
transient evolution and the thermal-hydraulic relevant phenomena is the needed
request for satisfying the “On Transient” qualification level.Step “i”
In this step the relevant thermal-hydraulic phenomena and parameters
are selected and a comparison between the calculated and experimental data is
performed. The selection of the phenomena derives from the following sources:(1)
experimental data analysis (engineering judgment is request);(2)
CSNI phenomena identification;(3)
use of Relevant Thermal-hydraulic Aspects (RTA, engineering judgment is request).Step “j”
This is the step where checks are performed to evaluate the acceptability of the
calculation both from qualitative and from quantitative point of view. For the
qualitative evaluation the following aspects are involved:(1)
Visual observation. This means that a visual comparison is performed
between experimental and calculated relevant parameters time trends;(2)
Sequence of the resulting events. This means that the list of the
calculated significant events together with their timing of occurrence is compared
with the experimental events;(3)
Use of the CSNI phenomena. The relevant phenomena suitable for the code
assessment and their relevance in the selected facility and in the selected
test are identified. A judgment can be express taking into account the
characteristics of the facility, the test peculiarities and the code results;(4)
Use of the RTAs. RTAs are typically identified inside the
phenomenological windows (i.e., time windows where a unique relevant phenomenon
is occurring) and are characterized by special parameters. These parameters can
be time values, single values, integral values, gradient values and
nondimensional values.
An example of a table containing RTAs is given in Table2.   Quantitative checks
are carried out by using the Fast Fourier Transform Based Method (FFTBM). This
special tool performs the comparison between experimental and calculated time
trends in the frequency domain for a list of selected parameters and
calculates, for each of them, a numerical value by which the accuracy is
quantitatively evaluated (no engineering judgment is involved in this process).
The FFTBM makes also possible to obtain a numerical judgment of the overall
results of the calculation. Criteria based on the values attained by FFTBM had
been selected for accepting the transient calculation. A description of the
FFTBM can be found in [23].Table 2UNITEXPUNIPI 91BN1OLPSICEA c2m4_lceaJudgment UNIPI/CEARTA: pressurizer emptyingTSEEmptying time*s13146—R/-Scram times413841R/ERTA: steam generators secondary side behaviourTSEMain feed water off, turbine bypasss595542E/RSVPDifference between PS and SG 1 SS pressure at 100 sMPa0.420.330.37R/RSVPSG 1 massKg/(s)at the end of subcooled blowdown774/(82)781/(75)761/(82)E/Ewhen PS pressure equals SG 1 SS pressure869/(618)938/(408)847/(463)R/Rwhen ACC starts804/(2955)802/(3019)788/(3075)E/Rwhen LPIS starts938/(5176)1126/(6529)956/(5474)R/RSYPSG 1 pressureMPaat the end of subcooled blowdown7.157.107.05E/Ewhen PS pressure equals SS pressure6.957.047.03R/Rwhen ACC starts4.113.954.00R/Ewhen LPIS starts0.880.830.83E/ERTA: subcooled blowdownTSEUpper plenum in sat conditionss83100110R/RIPABreak flow up to 100 skg152161162R/RRTA: first dryout occurrenceTSETime of dryouts223722992444E/RRange of dryout occurrence at various core levelss2237÷24712299÷25182444÷2625R/RStep “k”
This path is actuated if any of the checks (qualitative and
quantitative) is not fulfilled. The nodalization is improved by adopting different
noding solutions, changing code options or increasing the level of detail using,
if available, more precise data. Every time the nodalization is modified a new qualification
process will be performed through the loop “c-d-e-f-h-i-j-c.”Step “l”
This is the last step of the procedure. The obtained nodalization is
used for the selected transient and the selected facility or plant. Any subsequent modification of the nodalization
(e.g., necessary to better reproduce the experimental results) requires a new
qualification process both at “steady-state” and “on transient” level.


## 4. Development and Use of Coupled Computer Codes

Complex computer codes are used for the
analysis of the performance of NPPs. They include many types of codes that can
be grouped in different categories [24] like reactor physics codes; fuel behavior
codes; thermal-hydraulic codes, including system codes, subchannel codes,
porous media codes and computational fluid dynamic (CFD) codes; containment
analysis codes; atmospheric dispersion and dose codes and structural codes.Historically, these codes have been developed
independently, but have been mainly used in combination with system
thermal-hydraulic codes. By increasing the capacity of computation technology,
safety experts thought of coupling these codes in order to reduce uncertainties
or errors associated with the transfer of interface data and to improve the accuracy
of calculation. The coupling of primary system thermal-hydraulics with
neutronics is a typical example of code coupling; other cases include coupling
of primary system thermal-hydraulics with structural mechanics, fission product
chemistry, computational fluid dynamics, nuclear fuel behavior and containment behavior.
Problems that need to be addressed in the development and use of coupled codes
include ensuring adequate computer capacity and efficient coupling procedures,
validation of coupled codes and evaluation of uncertainties, and consequently
the applicability of coupled codes for safety analyses.The major purposes of the development of
coupled code are to be capable of representing the results of interactions
between different physical phenomena in more detail. Since the calculation
method of each code is not changed, reduction of computational time or necessary
computer memory volume is not expected. Nevertheless, many additive benefits
are expected as follows.(1)
Since the interface data are easily, automatically and frequently exchanged between codes, the results of
calculation would be obtained faster than the combination of individual codes
and also be more reliable.(2)
Since the development works are limited to
the interface part, the cost and time for development can be minimized.(3)
Since the interface data between each code would be adjusted to meet the specifications (e.g., noding of the system or time increment of calculation) of each code at the development stage, additional assumptions or data averaging and reductions are not required when performing the calculation.(4)
Those that have the knowledge of the
existing codes are not necessary to study the coupled code from the beginning,
because the existing knowledge is applicable to the coupled code.
It is expected that those benefits can contribute to the improvement of activities carried out by both licensing
authorities and industries. Expectations for licensing authorities can mainly
be derived from the features of coupled codes such as more accurate calculation
than the combination of individual codes. These are summarized as follows:
(i)
improvement of the understanding of the phenomena of interest for safety;(ii)
better assessment/demonstration of the conservatisms (versus historical approaches such as the use of point kinetics or evaluation models);(iii)
extension of the capabilities of the codes for safety analysis and training/simulators;(iv)
better assessment of uncertainties associated with the use of best estimate couplet codes.
Many benefits are expected with the use of coupled codes for industries. These are as follows.
(i)
Faster turnaround of calculation allows the users to perform more precise analysis and more sensitivity or case studies. This would contribute in more detail to understand the features of the plant, systems or components.(ii)
More accurate calculation would contribute to remove unnecessary uncertainties and to identify margins available to use for the plant.(iii)
Uncertainties due to user effects would be minimized because the existing knowledge of individual codes is applicable to the coupled codes.
The request to use qualified tools in licensing calculations constitutes one of the main problems to be addressed in the
development of coupled computer codes and it is caused by the limited
availability of data, which can be obtained from operating plants. To reduce
the effort for the qualification of the coupled codes, code developers are
requested to use only validated revisions of codes. In addition, the code
developers are requested to(i)
design the coupling so that auditing is easy and feasible;(ii)
provide guidelines to minimize user effects;(iii)
allow provisions for reasonable conservatisms;(iv)
structure the code so that coupling is easy and feasible;(v)
standardize the coupling procedures;(vi)
integrate as much as possible the existing approved calculation methodologies.


## 5. Conclusions

A noticeable progress in the capabilities of system codes has been observed in
the past decades. From the design and safety engineering point of view, thermal-hydraulic
system codes are considered to have reached an acceptable level of maturity.
Most of the problems and questions that come up a couple of decades ago have
been solved or an answer has been proposed. In other words, there is more need
to synthesize the work done in the international ground than to identify new
problems. For instance, if corresponding measured and calculated trends are
given, possible research should be focused on answering whether the discrepancy
is acceptable and less on minimizing the discrepancy itself (e.g., through an
improved model). It is evident that all the progress has been made in the
recent past is a consequence of experimental researches. After 30 years of validation through basic, separate
and integral effect tests facilities and after code improvements, system codes
are able to predict main phenomena of PWR & BWR transients with reasonable
accuracy. Nowadays the attention should
be focused more on developing procedures for a consistent application of a thermal-hydraulic
system code. This need has been highlighted in the paper and implies the drawing up of specific criteria through which the code-user, the nodalization and
finally the calculated transient results can be qualified.The full exploitation of “advanced” best-estimate system codes (e.g.,
TRAC, RELAP, ATHLET, CATHARE), which are strictly based on two-fluid
representation of two-phase flow and a “best-estimate” description (in contrast
with the evaluation models which used many conservative assumptions) of complex flow and heat transfer
conditions, implies mainly their acceptability by the licensing authorities. In
fact, notwithstanding the important achievements and progresses made in the
recent years, the predictions of advanced best-estimate computer codes are not
exact but remain uncertain because of the following.(i)
The assessment process depends upon data almost always
measured in small scaled facilities and not in the full power reactors.(ii)
The models and the solution methods in the codes are
approximate: in some cases, fundamental laws of the physics are not considered.
Consequently, the results of the best estimate code calculations may not be applicable to
give “exact” information on the behavior of an NPP during postulated accident
scenarios. Therefore, best-estimate analysis must be supplemented by proper
uncertainty evaluations in order to be meaningful and conditions for their
application should be made clear for accepting the available uncertainty
methods in the licensing process.In conclusion, the present status, of system
codes development, assessment, and related uncertainty evaluation, is adequate
as far as the largest majority of design and safety problems of current
water-cooled reactors are concerned. Anyway, new scientific goals must be achieved.
To this aim, projects and programmes based on the development of system codes
with multidimensional and multifluid capability and with “open” interfaces
for an easy coupling with other codes in areas like neutronics (for implementing
presently available 3D codes), CFD, structural mechanics (e.g., for pressurized
thermal-shock studies), and containment constitute the new frontier of the
scientific and engineering community in this field. However, taking into
account that the development of such
codes with measurable increased improvements in their capabilities may need
several decades, it is an evident consequence that the existing system thermal-hydraulic
codes are going to be used for one or two decades in their present
configuration.



---

*Source: 460795-2008-01-22.xml*