# Application of REPAS Methodology to Assess the Reliability of Passive Safety Systems

Authors: Franco Pierro; Dino Araneo; Giorgio Galassi; Francesco D'Auria
Journal: Science and Technology of Nuclear Installations
 (2009)

---

## Abstract

The paper deals with the presentation of the Reliability Evaluation of Passive Safety System (REPAS) methodology developed by University of Pisa. The general objective of the REPAS is to characterize in an analytical way the performance of a passive system in order to increase the confidence toward its operation and to compare the performances of active and passive systems and the performances of different passive systems. The REPAS can be used in the design of the passive safety systems to assess their goodness and to optimize their costs. It may also provide numerical values that can be used in more complex safety assessment studies and it can be seen as a support to Probabilistic Safety Analysis studies. With regard to this, some examples in the application of the methodology are reported in the paper. A best-estimate thermal-hydraulic code, RELAP5, has been used to support the analyses and to model the selected systems. Probability distributions have been assigned to the uncertain input parameters through engineering judgment. Monte Carlo method has been used to propagate uncertainties and Wilks' formula has been taken into account to select sample size. Failure criterions are defined in terms of nonfulfillment of the defined design targets.


---

## Body

## 1. Introduction

Passive systems deserve a special attention within the nuclear technology owing to their potential to increase the safety level of the power plants and to reduce the cost for the energy production. The intensive use of passive systems in the new nuclear technology needs a robust assessment of their reliability. The passive safety systems for their nature, because their functioning depends only on natural physical laws and not on an external source of supplied energy, are more reliable than the active ones. Nevertheless the passive systems may fail their mission as consequence of components failure, deviation of physical phenomena, boundary and initial conditions.The extensive use of passive safety systems, mainly in advanced reactors design, makes necessary to deeply study the approach to their reliability assessment. This implies not only the consideration of mechanical components, evaluated through classical risk assessment tools (e.g., Failure Mode and Effects Analysis (FMEA), FTA, Hazard Operational Analysis (HAZOP), etc.), but also the consideration of the associated TH phenomena in terms of the deviation from expected system behavior due to “alterations” in the environmental conditions.In the present paper an overview of the REPAS methodology is reported with its application and its effectiveness is briefly shown. It is also shown how it can be used to support the design of the passive systems.The reliability evaluation of passive system needs a suitable methodology aiming to determine the passive system reliability function, which is the failure probability of the physical principle upon which the system operation is relying [1].A pioneering activity aimed to evaluate the reliability of passive systems was proposed in mid-1990s within the framework of bilateral contacts between CEA and ENEA. In 2000 this issue was studied by the University of Pisa (UNIPI) [2]. Later on, cooperation between ENEA, UNIPI, Polytechnic of Milan, and University of Rome leads to the proposal of a methodology called REPAS. The methodology was applied to evaluate the reliability of an existing passive system design where two-phase Natural Circulation (NC) takes place.The  methodology was embedded in the Reliability Methods for Passive Safety (RMPS) methodology, developed within the framework of a project called RMPS functions, under the European 5th Framework program [3, 4].Actually the methodology is in the setting up phase for an absolute evaluation of the reliability of passive safety system function.It is important to give the following definition to understand the proposed issueThe Accuracy
Is the known bias (or difference) between a code prediction and the actual (measured) transient performance of a real facility.The Uncertainty
Analysis(of a code prediction) implies a procedure to evaluate the precision (or the error) that characterizes the application of a best-estimate code.The Reliability
Analysis(of a system)aims at characterizing the ability of a system “to operate satisfactorily,” following assigned specifications, over a period of time.


## 2. REPAS Methodology Overview

The REPAS methodology can be subdivided in the following main steps ([1, 5–9]):(a)
characterization of design/operational status of the system (identification of relevant parameters connected with the TH phenomenon: design and critical parameters),(b)
definition of nominal values, range of variation and assigned probability distributions to design and critical parameters,(c)
deterministic (based on engineering judgment) and statistic (e.g., through Monte Carlo procedure) selection of system status,(d)
definition of failure criteria for the system performance (starting from the knowledge of the system mission and the identification of the accident scenario and allowing the definition of design targets for passive system); the failure criteria are established as single targets (e.g., the system shall deliver a specific quantity of liquid within a fixed time) or as a function of time targets or integral values over a mission time (e.g., the system shall reject at least a mean value of thermal power all along the system actuation); in some cases, it can be better to define a global Failure Criterion (FC) of the complete system instead of a specific criterion concerning the passive system; for instance, the FC can be based on the maximal clad temperature during a specified period; in this case, it is necessary to model the complete system and not only the passive system,(e)
detailed code modeling; once the system mission, accident scenario, and FC are established, a system model has to be developed by means of a best-estimate TH code (e.g., RELAP5),(f)
direct Monte Carlo simulation applied to TH code; it involves the propagation of the uncertain selected parameters through the considered TH code obtaining a model response (i.e., output variable) which allows, by means of statistic methods, to estimate the probability of failure of the passive function,(g)
sensitivity analysis,(h)
quantitative reliability evaluation.


## 3. Description of Analyzed Systems

The REPAS methodology has been applied to three NC systems. The three systems are(i)
a prototypical integrated system: the related analysis can be considered as an exercise scope calculation;(ii)
the scaled Isolation Condenser (IC) of a Simplified Boiling Water Reactor (SBWR) [2];(iii)
the TTL-1 experimental apparatus [6].In the first case the analyzed system is a typical “pool heat removal system.” The heat source, the steam generator and the primary recirculation loop, are contained inside the Reactor Pressure Vessel [10].The simplified layout of this prototypical reactor is shown in Figure1, where there is also evidenced the external passive safety system. The performance of that system is the main objective of the analysis.Figure 1
Passive pool heat removal system for a prototypical integrated system.The second analyzed system is the IC, which is part of the SBWR design. A sketch of the system is given in Figure2.Figure 2
Standard IC of an SBWR.The third analyzed system, the TTL-1 experimental apparatus [6, 11], is a separate effect test facility that has been designed at the Atomic Energy Organization of Iran (AEOI), in the context of research programs in the NC field. The sketch of the loop is given in Figure 3. The maximum pressure and power at which the loop can operate are 1 MPa and 50 kW, respectively. More details about the system configuration are given in [6].Figure 3
Sketch of TTL-1 loop.


## 4. REPAS Application

In the following subsections are reported the application steps of the methodology above briefly described. In particular is deeply described the application and the results obtained of the REPAS methodology  to a pool heat removal system of a prototypical integrated system (case a) while for the other two systems (cases b and c) are outlined only the main outcomes of the application (see Section5).


### 4.1. Characterization of Design/Operational Status for the System

The first step is the characterization of the system, in particular the identification of relevant parameters connected with the TH phenomenon. The relevant parameters are defined design and critical parameters.Design Parameters
are mainly related to the nominal system configuration, for example, nominal power, pressure, level, and may include also geometrical parameters.Critical Parameters
are physical quantities that may affect the mission of the passive system like presence of noncondensable gas in an NC system.In Tables1 and 2 are reported the design and critical parameters; for each of them are defined nominal values, range of variation, and an assigned probability distributions. The full characterization of a thermal-hydraulic system may need a very large number of such parameters. Therefore, a bounded number of parameters should be selected deterministically (based on engineering judgment) and statistically (e.g., through a Monte Carlo procedure).Table 1
Design parameters case a.
Design parameter IDDescriptionOPNominal PowerSDSRAM delayDFDecay power factorP1Reactor nominal pressureSPSCRAM: pressure set pointP2PHRS: pressure set pointL1RPV: dome water levelMPCS: mass flow rateT1PHRS: valves opening timePTPHRS: pool temperatureTTPHRS: tube thicknessTable 2
Critical parameters case a.
Critical parameter IDDescriptionC2Heat Losses pipingW1PHRS tube thicknessHLRPV dome heat lossesFPHRS frictionPspSafety valves: pressure set point


### 4.2. Definition of Failure Criteria

The knowledge of the system missions and failure modes allows evaluating the failure criteria. The accident scenario considered is a loss of the ultimate heat sink with the hypothesis of loss of all safety systems involved, no feed and bleed strategy is taken into account, and so forth Considering that transient, the system mission is to remove the decay heat reducing the pressure in the primary system.The design FC defined for the transient sequence is the opening of the safety valves during any stage of the transient. To characterize the passive system behavior (or passive system performance) three Transient Performance Indicators (TPI) are defined. In particular they have to indicate how far the system is from the opening condition of the passive safety valve of the condenser system.In terms of the system mission two design targets can be defined: long-term (e.g., hot shutdown condition) and short-term (e.g., primary overpressure) design target. The failure of the system is reached when passive safety valves are open.The TPIs defined are(i)
(1)χ(CASEi)|65000≥0.9·χNOMINALCASE|65000,(ii)
(2)1(eot-Ti)∫TieotχCASEi(t)dt≥0.9·1(eot-TNOM)∫TNOMeotχNOMINALCASE(t)dt,(iii)
(3)pCASEi|65000<1.1·pNOMINALCASE|65000,(4)χ(t)=PHX(t)PCORE(t).
where PHX is the Power exchanged across the condensers tubes, PCORE is the Core power, TPRHRS  is the activation time, p is the primary circuit pressure, eot is the end of transient (65000 seconds).


### 4.3. Detailed Code Modeling

RELAP5 mod 3.3 input deck has been developed to perform the TH analyses. The model involves the Primary System and the pool for the removal of decay heat (see Figure4).Figure 4
Simplified RELAP 5 nodalization for case a.The primary circuit has been set up by modeling the most relevant components: Reactor Pressure Vessel (RPV), Steam Generator (SG), Down-Comer (DC), Core, Lower Plenum (LP) and Upper Plenum (UP).The passive heat removal nodalization includes steam line and return line, condensers, and the pool.In order to simulate properly the natural circulation inside the pool, a detailed model has been adopted with specific feature coming from engineering judgments and user experience (e.g., by pass line, slice nodalization).


### 4.4. Direct Monte Carlo Simulation Applied to TH Code

The purpose of direct Monte Carlo simulation is to assess the propagation of the uncertain parameters through the TH code in order to obtain a model response (set of code run). In particular it consists in sampling the identified parameters, running, for each obtained sample, the system model computer code and estimating the characteristics of the output variables. This method was used to evaluate the failure probabilitypf (an estimation can be obtained dividing the number of simulation cycles in which the failure criteria take places by the total number of simulation cycles) associated with the failure criteria of the system defined above ([1, 3]).In the following subsections the main steps of direct Monte Carlo simulation (i.e., sampling and best—estimate code run) are outlined, describing the used procedures and the results obtained. Also best estimate code run results are reported based on deterministic selection of input cases coming from engineering judgment and sensitivity analysis outcomes.


#### 4.4.1. Sampling

Simple Random Sampling (SRS) method was adopted to obtain the parameters samples. The method generates randomly all values of parameter sample from their defined distribution.Simple Random Sampling Procedure
The parameter samples, through SRS, are obtained considering the following three main steps.(1)
to draw the value of the truncated cumulative distribution function by sampling a uniform distributionu=U(0,1),(2)
to obtain the correspondent value (y=F(x)) of the non truncated cumulative distribution by means of the following correction:
(5)y=F(xmin)+u·[F(xmax)-F(xmin)],(3)
to feed this probability into the inverse of the cumulative distribution function in order to obtain the parameter sample (x):(6)x=F-1(y).
Consider the following definitions.
For normal distribution,we have the following.
(i)
Cumulative function is(7)F(x)=12[erf((x-μ)2σ)].(ii)
Inverse ofF is
(8)F-1(y)=μ+2·σ·erf-1(2y).
For lognormal distribution,we have the following.
(i)
Cumulative function is(9)F(x)=12[erf(ln(x/eμ)2σ)](ii)
Inverse ofF is
(10)F-1(y)=eμ+exp(2·σ·erf-1(2y-1)).Parameters Sampling Results
The tool used to analyze the sampling results is the cobweb plot. The parameter samples are represented as points in vertical lines. Each set of inputs can be seen as a vector where its elements represent one sample value for each parameter. In the plot shown in Figure5 the overall input vectors are reported.
From the plot it can be seen that some parameters were not sampled in their full range (blank regions); this outcome led to the necessity of generating additional deterministic cases in order to add completeness to the study.Figure 5
Cobweb plots of normalized parameters range.Stochastic and Deterministic Selection of Input Cases
The  stochastic selection has been made sampling the defined design and critical parameters (Tables1 and 2).
A hundred samples were obtained for each parameter implying the same number of code runs. The input set was built as follows(11)Sj=(Pi-j),
where Sj is the set of parameters used to perform the jth code run (with: j=1,2,…,100), and Pi-j is the jth sample value of parameter i.
The number of code runs (and then the number of samples for each parameter) was calculated by means of Wilks’ formula [12].
Wilks’ formula gives the proper number of independent observations of the random output(Y) (minimizing the number of calculations that characterize the system performance) in order to fulfill the following relationship:(12)P[P(U≤Y≤L)>α]≥β.
Based on the hypothesis that nothing is known about the output distribution function-fY(y)-except that it is continuous, we have the following.
(i)
αis the probability content limit. It gives a lower limit to the proportion of the distribution included in the tolerance interval [L,U]. This proportion is called probability content (pc) and is given by the following expression:
(13)pc=∫LUfY(y)dy.(ii)
βis the confidence level. It gives the probability that the tolerance interval [L,U] has a probability content major than α.
The number of independent observations of the output variable (i.e., number of code runs) for the two-sided tolerance interval is calculated by the following equation:(14)1-αN-N(1-α)αN-1≥β.
The tolerance interval[L,U] is given by L=y1,U=yN; where y1=min[yk] and yN=max[yk], with 1≤k≤N.
According to this, the number of codes runs obtained (N) results independent by the number of inputs parameters, their assigned distributions, and sampling method adopted.
The selected sample size, 100 samples, satisfies, the 95%/99% criteria (probability content = 95%, confidence level = 99%) for one-sided tolerance interval.
The deterministic selected cases have been made in order to add completeness to the analysis, additionally ten cases where added, based on engineering judgment, five “a priori” to evaluate parameters combinations not achieved by the stochastic selection (blank region of cobweb plot) and five “a posteriori” considering as feedback the results obtained from sensitivity analysis.Direct Monte Carlo Simulation: RELAP5 Calculations Results
The main outcomes, obtained by Direct Monte Carlo simulation, are linked to the design FC selected for the passive system. B-E code runs of the associated input vector are shown; in particular are reported the follows.(i)
the pressure trend:
(a)
short term  (Figures6 and 12);(b)
a long term (Figure9);(ii)
the power exchange ratio (power exchanged across the condensers tubes and core power) long term (Figure7).Below are reported the main outcomes of the three TPIs defined above (Figures 9, 10, and 11), in particular, the following. (i)
TPI-I. Only three probabilistically selected cases over 100 do not meet the first proposed TPI.(ii)
TPI-II. The second proposed TPI is verified by the all 100 probabilistically selected cases.(iii)
TPI-III. The third proposed TPI is verified by 78 over 100 probabilistically selected cases.Figure 6
Pressure behavior—normalized scale—Short-term (stochastic selected and nominal case).Figure 7
Power ratio evolution—long-term behavior (stochastic selected and nominal case).Figure 8
Pressure evolution—normalized scale—Long-term (a priori deterministic selected cases).Figure 9
Transient performance indicator—1 result (long term).Figure 10
Transient performance indicator—2 results (long term).Figure 11
Transient performance indicator—3 results (long term).Sensitivity analysis to identify the worst system condition.


### 4.5. Additional Analysis

Sensitivity analysis can provide additional criteria in order to perform a further screening of the uncertain parameters. In this case, since the number of relevant parameters selected is reasonably low, the sensitivity analysis will be used just to determine those parameters that affect mostly the condenser system behavior.As it can be observed (Figure12) the worst system condition is linked to transients with slow pressurization phases since they allow a higher system energy accumulation.The Standardized Regression Coefficients (SRCs) technique [13] allows the ranking of the parameters according to their relative contribution upon the system Performance Indicator (PI) and quantifying this contribution for each parameter.The technique is based on the hypothesis of a linear relationship between response and input parameters.For the use of the SRC technique it is supposed that the responseY (in this case the system PIs defined above) is a linear function of the random input variables Xi, that is, Y=βO+∑i=1pβiXi.The SRCs are given by is(15)SRC(Y,Xi)=βiVar(Xi)Var(Y)
and indicate the importance of the individual input variables Xi with respect to the output Y.The SRCs quantify the effect of varying each input variable from its mean value by a fixed fraction of its variance (maintaining all other variables at their expected values).The SRC values are reported in Figure13 in relation to each of the identified parameters listed in Tables 1 and 2.Figure 13
Standardized regression coefficients for the defined performance indicator.


### 4.6. Quantitative Reliability Evaluation

A preliminary qualitative reliability assessment is made by means of a so-called response surface calculation [12, 14]. It is based on a simplified equivalent model that fits the initial data, which has good prediction capacities. After determining the response surface, a Monte Carlo Simulation was performed to assess the reliability of the passive safety system.Several code runs were done without obtaining failure cases, showing that the use of Monte Carlo is limited to estimate rare events probabilities. This allows estimating a conservative boundary of the failure probability by means of equation used to evaluate the number of code runs necessary to setγ as a boundary of the failure probability (p):(16)1-(1-γ)k≥β,
where β represent the “confidence” that p will be lower than γ, and kcan alternatively take the valuesNor N+1.Consideringk=N=105 and β=0.95, the boundary achieved for the probability of failure is γ=3·10-5.The same can be achieved by the application of Wilks’ formula [12, 15].The result obtained shows the highly reliability of the investigated passive safety system.


### 4.7. Lay-Out Modification

A lay-out modification (see Figure14) test study was also performed(i)
to analyze the methodology and the model developed,(ii)
to evaluate the long term transient,(iii)
to give support to the system design adding another judgment criterion(iv)
to add completeness to the sensitivity analysis.Figure 14
Lay-out modification: scope calculation.In particular the length of the connection lines between the condenser pool and the reactor was reduced of about 3 meters.One of the results of reducing the piping line of the safety system is the condensers tubes flooding after the system is demanded. This is due to the fact that the liquid column height is mainly affected by the overall friction across the safety system circuit.The change proposed affects only the nonrelevant distributed frictions; thus, the return line equivalent liquid level is approximately sustained at original system values, which derives in the mentioned piping line flooding.The liquid present into the piping affects the heat transfer reducing the power exchanged across the condensers. The relevance of this effect can be seen through the comparison between the power ratio values obtained for the original and modified systems (Figure15).Figure 15
Power ratio comparison between the original and the modified system.From  the simulations results (Figure16) it has been shown that there are no differences in the long-term system behavior. The application of long-term defined TPI gives us a result similar to system performances, reflecting the condition stated before.Figure 16
Transient performance indicators results comparison between original and modified system.


## 4.1. Characterization of Design/Operational Status for the System

The first step is the characterization of the system, in particular the identification of relevant parameters connected with the TH phenomenon. The relevant parameters are defined design and critical parameters.Design Parameters
are mainly related to the nominal system configuration, for example, nominal power, pressure, level, and may include also geometrical parameters.Critical Parameters
are physical quantities that may affect the mission of the passive system like presence of noncondensable gas in an NC system.In Tables1 and 2 are reported the design and critical parameters; for each of them are defined nominal values, range of variation, and an assigned probability distributions. The full characterization of a thermal-hydraulic system may need a very large number of such parameters. Therefore, a bounded number of parameters should be selected deterministically (based on engineering judgment) and statistically (e.g., through a Monte Carlo procedure).Table 1
Design parameters case a.
Design parameter IDDescriptionOPNominal PowerSDSRAM delayDFDecay power factorP1Reactor nominal pressureSPSCRAM: pressure set pointP2PHRS: pressure set pointL1RPV: dome water levelMPCS: mass flow rateT1PHRS: valves opening timePTPHRS: pool temperatureTTPHRS: tube thicknessTable 2
Critical parameters case a.
Critical parameter IDDescriptionC2Heat Losses pipingW1PHRS tube thicknessHLRPV dome heat lossesFPHRS frictionPspSafety valves: pressure set point


## 4.2. Definition of Failure Criteria

The knowledge of the system missions and failure modes allows evaluating the failure criteria. The accident scenario considered is a loss of the ultimate heat sink with the hypothesis of loss of all safety systems involved, no feed and bleed strategy is taken into account, and so forth Considering that transient, the system mission is to remove the decay heat reducing the pressure in the primary system.The design FC defined for the transient sequence is the opening of the safety valves during any stage of the transient. To characterize the passive system behavior (or passive system performance) three Transient Performance Indicators (TPI) are defined. In particular they have to indicate how far the system is from the opening condition of the passive safety valve of the condenser system.In terms of the system mission two design targets can be defined: long-term (e.g., hot shutdown condition) and short-term (e.g., primary overpressure) design target. The failure of the system is reached when passive safety valves are open.The TPIs defined are(i)
(1)χ(CASEi)|65000≥0.9·χNOMINALCASE|65000,(ii)
(2)1(eot-Ti)∫TieotχCASEi(t)dt≥0.9·1(eot-TNOM)∫TNOMeotχNOMINALCASE(t)dt,(iii)
(3)pCASEi|65000<1.1·pNOMINALCASE|65000,(4)χ(t)=PHX(t)PCORE(t).
where PHX is the Power exchanged across the condensers tubes, PCORE is the Core power, TPRHRS  is the activation time, p is the primary circuit pressure, eot is the end of transient (65000 seconds).


## 4.3. Detailed Code Modeling

RELAP5 mod 3.3 input deck has been developed to perform the TH analyses. The model involves the Primary System and the pool for the removal of decay heat (see Figure4).Figure 4
Simplified RELAP 5 nodalization for case a.The primary circuit has been set up by modeling the most relevant components: Reactor Pressure Vessel (RPV), Steam Generator (SG), Down-Comer (DC), Core, Lower Plenum (LP) and Upper Plenum (UP).The passive heat removal nodalization includes steam line and return line, condensers, and the pool.In order to simulate properly the natural circulation inside the pool, a detailed model has been adopted with specific feature coming from engineering judgments and user experience (e.g., by pass line, slice nodalization).


## 4.4. Direct Monte Carlo Simulation Applied to TH Code

The purpose of direct Monte Carlo simulation is to assess the propagation of the uncertain parameters through the TH code in order to obtain a model response (set of code run). In particular it consists in sampling the identified parameters, running, for each obtained sample, the system model computer code and estimating the characteristics of the output variables. This method was used to evaluate the failure probabilitypf (an estimation can be obtained dividing the number of simulation cycles in which the failure criteria take places by the total number of simulation cycles) associated with the failure criteria of the system defined above ([1, 3]).In the following subsections the main steps of direct Monte Carlo simulation (i.e., sampling and best—estimate code run) are outlined, describing the used procedures and the results obtained. Also best estimate code run results are reported based on deterministic selection of input cases coming from engineering judgment and sensitivity analysis outcomes.


### 4.4.1. Sampling

Simple Random Sampling (SRS) method was adopted to obtain the parameters samples. The method generates randomly all values of parameter sample from their defined distribution.Simple Random Sampling Procedure
The parameter samples, through SRS, are obtained considering the following three main steps.(1)
to draw the value of the truncated cumulative distribution function by sampling a uniform distributionu=U(0,1),(2)
to obtain the correspondent value (y=F(x)) of the non truncated cumulative distribution by means of the following correction:
(5)y=F(xmin)+u·[F(xmax)-F(xmin)],(3)
to feed this probability into the inverse of the cumulative distribution function in order to obtain the parameter sample (x):(6)x=F-1(y).
Consider the following definitions.
For normal distribution,we have the following.
(i)
Cumulative function is(7)F(x)=12[erf((x-μ)2σ)].(ii)
Inverse ofF is
(8)F-1(y)=μ+2·σ·erf-1(2y).
For lognormal distribution,we have the following.
(i)
Cumulative function is(9)F(x)=12[erf(ln(x/eμ)2σ)](ii)
Inverse ofF is
(10)F-1(y)=eμ+exp(2·σ·erf-1(2y-1)).Parameters Sampling Results
The tool used to analyze the sampling results is the cobweb plot. The parameter samples are represented as points in vertical lines. Each set of inputs can be seen as a vector where its elements represent one sample value for each parameter. In the plot shown in Figure5 the overall input vectors are reported.
From the plot it can be seen that some parameters were not sampled in their full range (blank regions); this outcome led to the necessity of generating additional deterministic cases in order to add completeness to the study.Figure 5
Cobweb plots of normalized parameters range.Stochastic and Deterministic Selection of Input Cases
The  stochastic selection has been made sampling the defined design and critical parameters (Tables1 and 2).
A hundred samples were obtained for each parameter implying the same number of code runs. The input set was built as follows(11)Sj=(Pi-j),
where Sj is the set of parameters used to perform the jth code run (with: j=1,2,…,100), and Pi-j is the jth sample value of parameter i.
The number of code runs (and then the number of samples for each parameter) was calculated by means of Wilks’ formula [12].
Wilks’ formula gives the proper number of independent observations of the random output(Y) (minimizing the number of calculations that characterize the system performance) in order to fulfill the following relationship:(12)P[P(U≤Y≤L)>α]≥β.
Based on the hypothesis that nothing is known about the output distribution function-fY(y)-except that it is continuous, we have the following.
(i)
αis the probability content limit. It gives a lower limit to the proportion of the distribution included in the tolerance interval [L,U]. This proportion is called probability content (pc) and is given by the following expression:
(13)pc=∫LUfY(y)dy.(ii)
βis the confidence level. It gives the probability that the tolerance interval [L,U] has a probability content major than α.
The number of independent observations of the output variable (i.e., number of code runs) for the two-sided tolerance interval is calculated by the following equation:(14)1-αN-N(1-α)αN-1≥β.
The tolerance interval[L,U] is given by L=y1,U=yN; where y1=min[yk] and yN=max[yk], with 1≤k≤N.
According to this, the number of codes runs obtained (N) results independent by the number of inputs parameters, their assigned distributions, and sampling method adopted.
The selected sample size, 100 samples, satisfies, the 95%/99% criteria (probability content = 95%, confidence level = 99%) for one-sided tolerance interval.
The deterministic selected cases have been made in order to add completeness to the analysis, additionally ten cases where added, based on engineering judgment, five “a priori” to evaluate parameters combinations not achieved by the stochastic selection (blank region of cobweb plot) and five “a posteriori” considering as feedback the results obtained from sensitivity analysis.Direct Monte Carlo Simulation: RELAP5 Calculations Results
The main outcomes, obtained by Direct Monte Carlo simulation, are linked to the design FC selected for the passive system. B-E code runs of the associated input vector are shown; in particular are reported the follows.(i)
the pressure trend:
(a)
short term  (Figures6 and 12);(b)
a long term (Figure9);(ii)
the power exchange ratio (power exchanged across the condensers tubes and core power) long term (Figure7).Below are reported the main outcomes of the three TPIs defined above (Figures 9, 10, and 11), in particular, the following. (i)
TPI-I. Only three probabilistically selected cases over 100 do not meet the first proposed TPI.(ii)
TPI-II. The second proposed TPI is verified by the all 100 probabilistically selected cases.(iii)
TPI-III. The third proposed TPI is verified by 78 over 100 probabilistically selected cases.Figure 6
Pressure behavior—normalized scale—Short-term (stochastic selected and nominal case).Figure 7
Power ratio evolution—long-term behavior (stochastic selected and nominal case).Figure 8
Pressure evolution—normalized scale—Long-term (a priori deterministic selected cases).Figure 9
Transient performance indicator—1 result (long term).Figure 10
Transient performance indicator—2 results (long term).Figure 11
Transient performance indicator—3 results (long term).Sensitivity analysis to identify the worst system condition.


## 4.4.1. Sampling

Simple Random Sampling (SRS) method was adopted to obtain the parameters samples. The method generates randomly all values of parameter sample from their defined distribution.Simple Random Sampling Procedure
The parameter samples, through SRS, are obtained considering the following three main steps.(1)
to draw the value of the truncated cumulative distribution function by sampling a uniform distributionu=U(0,1),(2)
to obtain the correspondent value (y=F(x)) of the non truncated cumulative distribution by means of the following correction:
(5)y=F(xmin)+u·[F(xmax)-F(xmin)],(3)
to feed this probability into the inverse of the cumulative distribution function in order to obtain the parameter sample (x):(6)x=F-1(y).
Consider the following definitions.
For normal distribution,we have the following.
(i)
Cumulative function is(7)F(x)=12[erf((x-μ)2σ)].(ii)
Inverse ofF is
(8)F-1(y)=μ+2·σ·erf-1(2y).
For lognormal distribution,we have the following.
(i)
Cumulative function is(9)F(x)=12[erf(ln(x/eμ)2σ)](ii)
Inverse ofF is
(10)F-1(y)=eμ+exp(2·σ·erf-1(2y-1)).Parameters Sampling Results
The tool used to analyze the sampling results is the cobweb plot. The parameter samples are represented as points in vertical lines. Each set of inputs can be seen as a vector where its elements represent one sample value for each parameter. In the plot shown in Figure5 the overall input vectors are reported.
From the plot it can be seen that some parameters were not sampled in their full range (blank regions); this outcome led to the necessity of generating additional deterministic cases in order to add completeness to the study.Figure 5
Cobweb plots of normalized parameters range.Stochastic and Deterministic Selection of Input Cases
The  stochastic selection has been made sampling the defined design and critical parameters (Tables1 and 2).
A hundred samples were obtained for each parameter implying the same number of code runs. The input set was built as follows(11)Sj=(Pi-j),
where Sj is the set of parameters used to perform the jth code run (with: j=1,2,…,100), and Pi-j is the jth sample value of parameter i.
The number of code runs (and then the number of samples for each parameter) was calculated by means of Wilks’ formula [12].
Wilks’ formula gives the proper number of independent observations of the random output(Y) (minimizing the number of calculations that characterize the system performance) in order to fulfill the following relationship:(12)P[P(U≤Y≤L)>α]≥β.
Based on the hypothesis that nothing is known about the output distribution function-fY(y)-except that it is continuous, we have the following.
(i)
αis the probability content limit. It gives a lower limit to the proportion of the distribution included in the tolerance interval [L,U]. This proportion is called probability content (pc) and is given by the following expression:
(13)pc=∫LUfY(y)dy.(ii)
βis the confidence level. It gives the probability that the tolerance interval [L,U] has a probability content major than α.
The number of independent observations of the output variable (i.e., number of code runs) for the two-sided tolerance interval is calculated by the following equation:(14)1-αN-N(1-α)αN-1≥β.
The tolerance interval[L,U] is given by L=y1,U=yN; where y1=min[yk] and yN=max[yk], with 1≤k≤N.
According to this, the number of codes runs obtained (N) results independent by the number of inputs parameters, their assigned distributions, and sampling method adopted.
The selected sample size, 100 samples, satisfies, the 95%/99% criteria (probability content = 95%, confidence level = 99%) for one-sided tolerance interval.
The deterministic selected cases have been made in order to add completeness to the analysis, additionally ten cases where added, based on engineering judgment, five “a priori” to evaluate parameters combinations not achieved by the stochastic selection (blank region of cobweb plot) and five “a posteriori” considering as feedback the results obtained from sensitivity analysis.Direct Monte Carlo Simulation: RELAP5 Calculations Results
The main outcomes, obtained by Direct Monte Carlo simulation, are linked to the design FC selected for the passive system. B-E code runs of the associated input vector are shown; in particular are reported the follows.(i)
the pressure trend:
(a)
short term  (Figures6 and 12);(b)
a long term (Figure9);(ii)
the power exchange ratio (power exchanged across the condensers tubes and core power) long term (Figure7).Below are reported the main outcomes of the three TPIs defined above (Figures 9, 10, and 11), in particular, the following. (i)
TPI-I. Only three probabilistically selected cases over 100 do not meet the first proposed TPI.(ii)
TPI-II. The second proposed TPI is verified by the all 100 probabilistically selected cases.(iii)
TPI-III. The third proposed TPI is verified by 78 over 100 probabilistically selected cases.Figure 6
Pressure behavior—normalized scale—Short-term (stochastic selected and nominal case).Figure 7
Power ratio evolution—long-term behavior (stochastic selected and nominal case).Figure 8
Pressure evolution—normalized scale—Long-term (a priori deterministic selected cases).Figure 9
Transient performance indicator—1 result (long term).Figure 10
Transient performance indicator—2 results (long term).Figure 11
Transient performance indicator—3 results (long term).Sensitivity analysis to identify the worst system condition.


## 4.5. Additional Analysis

Sensitivity analysis can provide additional criteria in order to perform a further screening of the uncertain parameters. In this case, since the number of relevant parameters selected is reasonably low, the sensitivity analysis will be used just to determine those parameters that affect mostly the condenser system behavior.As it can be observed (Figure12) the worst system condition is linked to transients with slow pressurization phases since they allow a higher system energy accumulation.The Standardized Regression Coefficients (SRCs) technique [13] allows the ranking of the parameters according to their relative contribution upon the system Performance Indicator (PI) and quantifying this contribution for each parameter.The technique is based on the hypothesis of a linear relationship between response and input parameters.For the use of the SRC technique it is supposed that the responseY (in this case the system PIs defined above) is a linear function of the random input variables Xi, that is, Y=βO+∑i=1pβiXi.The SRCs are given by is(15)SRC(Y,Xi)=βiVar(Xi)Var(Y)
and indicate the importance of the individual input variables Xi with respect to the output Y.The SRCs quantify the effect of varying each input variable from its mean value by a fixed fraction of its variance (maintaining all other variables at their expected values).The SRC values are reported in Figure13 in relation to each of the identified parameters listed in Tables 1 and 2.Figure 13
Standardized regression coefficients for the defined performance indicator.


## 4.6. Quantitative Reliability Evaluation

A preliminary qualitative reliability assessment is made by means of a so-called response surface calculation [12, 14]. It is based on a simplified equivalent model that fits the initial data, which has good prediction capacities. After determining the response surface, a Monte Carlo Simulation was performed to assess the reliability of the passive safety system.Several code runs were done without obtaining failure cases, showing that the use of Monte Carlo is limited to estimate rare events probabilities. This allows estimating a conservative boundary of the failure probability by means of equation used to evaluate the number of code runs necessary to setγ as a boundary of the failure probability (p):(16)1-(1-γ)k≥β,
where β represent the “confidence” that p will be lower than γ, and kcan alternatively take the valuesNor N+1.Consideringk=N=105 and β=0.95, the boundary achieved for the probability of failure is γ=3·10-5.The same can be achieved by the application of Wilks’ formula [12, 15].The result obtained shows the highly reliability of the investigated passive safety system.


## 4.7. Lay-Out Modification

A lay-out modification (see Figure14) test study was also performed(i)
to analyze the methodology and the model developed,(ii)
to evaluate the long term transient,(iii)
to give support to the system design adding another judgment criterion(iv)
to add completeness to the sensitivity analysis.Figure 14
Lay-out modification: scope calculation.In particular the length of the connection lines between the condenser pool and the reactor was reduced of about 3 meters.One of the results of reducing the piping line of the safety system is the condensers tubes flooding after the system is demanded. This is due to the fact that the liquid column height is mainly affected by the overall friction across the safety system circuit.The change proposed affects only the nonrelevant distributed frictions; thus, the return line equivalent liquid level is approximately sustained at original system values, which derives in the mentioned piping line flooding.The liquid present into the piping affects the heat transfer reducing the power exchanged across the condensers. The relevance of this effect can be seen through the comparison between the power ratio values obtained for the original and modified systems (Figure15).Figure 15
Power ratio comparison between the original and the modified system.From  the simulations results (Figure16) it has been shown that there are no differences in the long-term system behavior. The application of long-term defined TPI gives us a result similar to system performances, reflecting the condition stated before.Figure 16
Transient performance indicators results comparison between original and modified system.


## 5. Main Outcomes of Cases (b) and (c)

In the following are reported the main results of the REPAS application to the following systems:(i)
a scaled IC of an SBWR (case b) [2],(ii)
TTL-1 experimental apparatus (case c) [6].In particular in the following, according to Section2 (methodology overview) and Section 4 (detailed description of case a), are presented only the main steps. Main purpose of this section is just to show how the REPAS grew up.


### 5.1. Case (b) Isolation Condenser (IC) of an SBWR

The system was modeled (Figure17) and the design and critical parameter were selected (Tables 3 and 4).Table 3
Design parameters case b.
Design parameter IDDescriptionUNITNominal valueRangeDiscrete initial valueP1RPV PressureMPa70.2–90.2 1 3 7 100.05 0.1 0.15 0.5 0.2L1RPV collapse levelM8.75–125    7 8.7 10 120.05 0.1 0.5 0.2 0.15L3POOL levelM4.32–52 4.3 50.1 0.8 0.1Tp (0)POOL initial temperatureK303280–368280 303 3680.1 0.8 0.1—System geometry layout——Not assigned—1.0Table 4
Critical parameters case b.
Critical parameter IDDescriptionUnitNominal valueRangeDiscrete initial valueX1RPV Non-condensable fraction—00-10 0.01 0.1 0.2 0.5 0.8 10.719 0.12 0.07 0.05 0.03 0.01 0.001X2Non-condensable fraction at the inlet of IC piping—00-10 0.01 0.1 0.2 0.5 0.8 10.71 0.12 0.07 0.05 0.03 0.01 0.01ΘInclination of the IC piping on the suction sidedeg00–100 1 5 100.5 0.4 0.08 0.02C2Heat Losses piping –IC suctionkW50–1000 5 20 1000.10 0.7999 0.10 0.0001L2 (0)Initial condition liquid level –IC tubes, inner side%1000–1000 50 1000.10 0.10 0.80ULUndetected leakagem200–10e-50 1e-5 5e-5 10e-50.8899 0.1 0.001 0,0001POVPartially opened valve in the IC discharge line%1001–1001 10 50 1000.001 0.01 0.1 0.889Table 5
Design and critical parameters case c.
Parameter IDDescriptionUnitNominal valueRangeDiscrete initial valueand associated probabilitiesLPLinear power of electrically heated rodW/m30e60–30e6—1.0P1Initial Pressure of the loopbar51–101 3 5 8 100.02 0.13 0.7 0.1 0.05T2Temperature of the SS fluid at the cooler inletK303295–350295 303 325 3500.18 0.65 0.15 0.02HL1Heat losses from the test section (TS). % of TS power%0.20–4.50.0 0.2 1.0 4.50.1 0.69 0.15 0.06HL2Heat losses from the loop w/o (TS). % of TS power%30–200.0 3 10 200.1 0.69 0.15 0.06L1Total length of the loopm2112–3412 21 28 340.05 0.69 0.14 0.12LVLoop volume (change of the pre-heater tank)m30.090.07–0.20.07 0.09 0.12 0.20.05 0.65 0.18 0.12PVVolume of PRZm30.060.03–0.120.03 0.06 0.09 0.120.05 0.65 0.18 0.12PNNoding of the PRZ—NN1-N2N1 N N20.1 0.8 0.1PPPosition of the PRZUpstream the cooler (U)—UU–DU DDownstream the cooler (D)0.85 0.15K1Local pressure drop coefficient (K) at the inlet of the TS—0.20–1.20.0 0.2 0.4 1.20.05 0.53 0.3 0.12K2K factor at the outlets of the TS—0.60-10.0 0.6 0.8 1.20.05 0.53 0.22 0.2TKSum of the K factors, w/o TS inlet and outlet—7.53–253 7.5 15 250.05 0.55 0.22 0.18EIElectrical Insulation in the heaterAL2O3 (A)—AA-BA BBoron nitride (B)0.85 0.15CITThickness of cooler tubesmm21–31 2 30.05 0.65 0.3CTCooler tubes—CuCu–SSCu SS0.85 0.15E2Equivalent diameter of secondary side of the coolermm107–207 10 200.25 0.7 0.05E1TS Equivalent diameter (coolant passage)mm85–125 7 8 120.05 0.3 0.55 0.1ARRatio of Heater heat transfer area to cooler heat transfer area—0.180.05–0.370.05 0.12 0.18 0.370.05 0.3 0.6 0.05PDAxial power distributionUniform (U)—UC–SC U SCosine (C)0.1 0.65 0.25Semi cosine (S)COOrientation of  the coolerVertical (V)—HI–VI H VHorizontal (H)0.08 0.65 0.27Inclined (I)MF2Secondary side mass flow rateKg/s1.20.4–1.80.4 1.2 0.8 1.80.05 0.55 0.23 0.17P2Secondary side pressurebar11–101 5 100.6 0.3 0.2LSPresence of U-pipe or loop seal in the cold part of the loop—NoYes-NoY N0.2 0.8D1Riser diametermm2525–10025 50 75 1000.55 0.25 0.15 0.05D2Down comer diametermm2525–7525 50 750.55 0.25 0.2PCPRZ ConnectionDirect (D)—SD–SS DSurge Line (S)0.8 0.2G1Non-condensable gas mass fraction at the inlet of cooler piping—00–10.0 0.05 0.2 0.5 0.80.58 0.3 0.1 0.01 0.01G2Non-condensable gas mass fraction inside the TS—00–10.0 0.05 0.3 0.5 0.80.58 0.3 0.1 0.01 0.01ULUndetected leakageKg/s00–1e-20.0 0.1e-5 0.1e-3 0.1e-20.65 0.25 0.09 0.01Figure 17
RELAP5 nodalization of IC of an SBWR case b.For the analysis were chosen 6 system status selected deterministically and 69 system status selected probabilistically (for each of two probability distribution) discrete and continuous (Figures18 through 20).(a) Reference system performance: power exchanged through the IC. (b) Time trends related to the ensemble of 75 code runs (6 deterministic status and 69 probabilistic status—discrete probability distribution): power exchanged trough the IC. (c) Time thrends related to the ensemble of 75 code runs (6 deterministic status and 69 probabilistic status—continuous probability distribution): power exchanged through the IC.
(a)(b)(c)Figure 19
Characterization of system status on the basis of the probability. Six system status (1 to 6 in the figure) is deterministically derived and sixty-nine (7 to 75 in the figure) are statistically derived assuming a discrete probability distribution.Figure 20
Characterization of system status on the basis of the probability. Six system status (1 to 6 in the figure) is deterministically derived and sixty-nine (7 to 75 in the figure) are statistically derived assuming a continuous probability distribution.The FC considered was(17)FC=Z-ZrefZref=<(-0,2),
where Z is(i)
the thermal power exchanged across the IC (W2);(ii)
mass flow rate at the IC inlet (Γ2).“ref” related to the code calculation for the reference or nominal system configuration.Indicators of system performance are(1)
time during the calculation when the FC is verified, failure timeFt(s),(2)
(18)∫TnomeocW2(t)dt∫TrefeocW2ref(t)dt=(1/eoc-Tnom)∫Tnomeoc(PHX(t)/PCORE(t))dt(1/eoc-Tref)∫Trefeoc(PHX(t)/PCORE(t))refdt,∫TnomeocΓ2(t)dt∫TrefeocΓ2ref(t)dt,(3)
ratio between the failure time and the time of calculation. wherePHX is the Power exchanged across the condensers tubes, PCORE is the Core power,  T is the system activation time, and eot is the end of transient calculation.In this case the curves of merit (Figure21) were used to judge the system acceptability and to compare the selected system with different system. They show the PI values (W2/W2ref) as a function of the probability interval range.Figure 21
Curves of merit: probability for the performance indicator “IC power integral ratio” (discrete probability distribution).


### 5.2. Case (c) TTL-1 Apparatus

The system was modeled (Figure22) and the design and critical parameter were selected (Table 4).Figure 22
RELAP 5 nodalization TTL-1 apparatus case c.Figure 23
Time trends related to the ensemble of 137 code runs ([1–18] deterministic status): power exchanged in the cooler.The FC is expressed as(19)FC=Wref-WWref≤0.2,
where
(20)W=∫0τobsW(t)dtτobs,
where W is the integral of thermal power exchanged in the cooler, “ref” is the related to the code calculation for the reference or nominal system configuration,  and τobs is the “observation time”.The system PIs to evaluate the Thermal Hydraulic Reliability (TH-R) are(i)
integral value over a mission time,(ii)
ratioW/Wref.The deterministic and statistic selection of system scenarios was done by means of Monte Carlo procedure. Four ways are pursued to arrive at four definitions for the TH-R of the TTL-1 loop, respectively, adopting the following.(1)
The “figure of merit” approach proposed by [2]: the result is given in Figure 24.(2)
The “cumulative probability” approach suggested by [16]: the result is given in Figure 25, where a comparison is made with the result from a previous REPAS application case b.(3)
The R1 single-valued reliability definition is(21)R1=1-NFN=0.70,
where NF is number of failed runs and N is total number of runs.Figure 24
Probability distribution for the performance indicator: integral power ratio exchanged in the cooler.Figure 25
Comparison between thermal hydraulic reliability for two different systems: IC-SBWR (two-phase NC system) and TTL 1.The R2 single-valued reliability definition is(22)R2=∑1N(W/Wref)N=0.85.
The TH-R definition in Figure 24 (first TH-R definition) uses data elaboration given in Table 6.Table 6
Selected system performance indicator related to individual probability intervals.
Case IDProbabilityAccepted RunFailed RunW/WrefReference4.25E-06□—111.21E-07□*0.78521.18E-06□—1.00431.31E-07□—0.9743.69E-07□—0.95353.69E-07□*0.78263.08E-07□—1.0277.39E-07□—0.99687.84E-07□—193.27E-07□—0.99107.84E-07□—0.995115.31E-07□—1127.50E-07□—1139.62E-07□—1141.60E-06□—1151.39E-06□—1167.50E-07□—1.007171.96E-06□—1187.50E-07□—1193.03E-07□—0.99203.86E-07□—0.995217.72E-07□—1223.54E-07□—1233.54E-07□—0.9246.54E-07□—1251.77E-06□—1261.31E-06□—1271.42E-06□—1281.06E-06□—0.98293.86E-07□—0.91301.16E-06□—0.95311.06E-06□—0.98327.32E-08□—1337.32E-08□—1345.88E-07□*0.77351.87E-07□—0.97367.79E-08□*0.4371.08E-14□*0.26389.39E-11□—0.9394.48E-11□—1.007404.59E-12□—0. 83411.66E-10□—0.93426.65E-14□—0.8436.66E-10□—0.94441.16E-09□—0.94452.54E-14□—1464.64E-14□*0.62472.02E-12□*0.67The TH-R definition in Figure25 (second TH-R definition) makes use of the classic Cumulative Distribution Function (CDF) concept. The TH-R is achieved by ordering the cooler power integral ratio (W/Wref) with respect to the probability of occurrence of each configuration from the probabilistic and deterministic sets.Sensitivity analyses identify the main contributors to the passive system performance. The SRC technique, see the above section, was used. The SRC values are reported in Figure26 in relation to each of the defined critical and design parameters.Figure 26
Standardized regression coefficients for the defined performance indicator:W/Wref


## 5.1. Case (b) Isolation Condenser (IC) of an SBWR

The system was modeled (Figure17) and the design and critical parameter were selected (Tables 3 and 4).Table 3
Design parameters case b.
Design parameter IDDescriptionUNITNominal valueRangeDiscrete initial valueP1RPV PressureMPa70.2–90.2 1 3 7 100.05 0.1 0.15 0.5 0.2L1RPV collapse levelM8.75–125    7 8.7 10 120.05 0.1 0.5 0.2 0.15L3POOL levelM4.32–52 4.3 50.1 0.8 0.1Tp (0)POOL initial temperatureK303280–368280 303 3680.1 0.8 0.1—System geometry layout——Not assigned—1.0Table 4
Critical parameters case b.
Critical parameter IDDescriptionUnitNominal valueRangeDiscrete initial valueX1RPV Non-condensable fraction—00-10 0.01 0.1 0.2 0.5 0.8 10.719 0.12 0.07 0.05 0.03 0.01 0.001X2Non-condensable fraction at the inlet of IC piping—00-10 0.01 0.1 0.2 0.5 0.8 10.71 0.12 0.07 0.05 0.03 0.01 0.01ΘInclination of the IC piping on the suction sidedeg00–100 1 5 100.5 0.4 0.08 0.02C2Heat Losses piping –IC suctionkW50–1000 5 20 1000.10 0.7999 0.10 0.0001L2 (0)Initial condition liquid level –IC tubes, inner side%1000–1000 50 1000.10 0.10 0.80ULUndetected leakagem200–10e-50 1e-5 5e-5 10e-50.8899 0.1 0.001 0,0001POVPartially opened valve in the IC discharge line%1001–1001 10 50 1000.001 0.01 0.1 0.889Table 5
Design and critical parameters case c.
Parameter IDDescriptionUnitNominal valueRangeDiscrete initial valueand associated probabilitiesLPLinear power of electrically heated rodW/m30e60–30e6—1.0P1Initial Pressure of the loopbar51–101 3 5 8 100.02 0.13 0.7 0.1 0.05T2Temperature of the SS fluid at the cooler inletK303295–350295 303 325 3500.18 0.65 0.15 0.02HL1Heat losses from the test section (TS). % of TS power%0.20–4.50.0 0.2 1.0 4.50.1 0.69 0.15 0.06HL2Heat losses from the loop w/o (TS). % of TS power%30–200.0 3 10 200.1 0.69 0.15 0.06L1Total length of the loopm2112–3412 21 28 340.05 0.69 0.14 0.12LVLoop volume (change of the pre-heater tank)m30.090.07–0.20.07 0.09 0.12 0.20.05 0.65 0.18 0.12PVVolume of PRZm30.060.03–0.120.03 0.06 0.09 0.120.05 0.65 0.18 0.12PNNoding of the PRZ—NN1-N2N1 N N20.1 0.8 0.1PPPosition of the PRZUpstream the cooler (U)—UU–DU DDownstream the cooler (D)0.85 0.15K1Local pressure drop coefficient (K) at the inlet of the TS—0.20–1.20.0 0.2 0.4 1.20.05 0.53 0.3 0.12K2K factor at the outlets of the TS—0.60-10.0 0.6 0.8 1.20.05 0.53 0.22 0.2TKSum of the K factors, w/o TS inlet and outlet—7.53–253 7.5 15 250.05 0.55 0.22 0.18EIElectrical Insulation in the heaterAL2O3 (A)—AA-BA BBoron nitride (B)0.85 0.15CITThickness of cooler tubesmm21–31 2 30.05 0.65 0.3CTCooler tubes—CuCu–SSCu SS0.85 0.15E2Equivalent diameter of secondary side of the coolermm107–207 10 200.25 0.7 0.05E1TS Equivalent diameter (coolant passage)mm85–125 7 8 120.05 0.3 0.55 0.1ARRatio of Heater heat transfer area to cooler heat transfer area—0.180.05–0.370.05 0.12 0.18 0.370.05 0.3 0.6 0.05PDAxial power distributionUniform (U)—UC–SC U SCosine (C)0.1 0.65 0.25Semi cosine (S)COOrientation of  the coolerVertical (V)—HI–VI H VHorizontal (H)0.08 0.65 0.27Inclined (I)MF2Secondary side mass flow rateKg/s1.20.4–1.80.4 1.2 0.8 1.80.05 0.55 0.23 0.17P2Secondary side pressurebar11–101 5 100.6 0.3 0.2LSPresence of U-pipe or loop seal in the cold part of the loop—NoYes-NoY N0.2 0.8D1Riser diametermm2525–10025 50 75 1000.55 0.25 0.15 0.05D2Down comer diametermm2525–7525 50 750.55 0.25 0.2PCPRZ ConnectionDirect (D)—SD–SS DSurge Line (S)0.8 0.2G1Non-condensable gas mass fraction at the inlet of cooler piping—00–10.0 0.05 0.2 0.5 0.80.58 0.3 0.1 0.01 0.01G2Non-condensable gas mass fraction inside the TS—00–10.0 0.05 0.3 0.5 0.80.58 0.3 0.1 0.01 0.01ULUndetected leakageKg/s00–1e-20.0 0.1e-5 0.1e-3 0.1e-20.65 0.25 0.09 0.01Figure 17
RELAP5 nodalization of IC of an SBWR case b.For the analysis were chosen 6 system status selected deterministically and 69 system status selected probabilistically (for each of two probability distribution) discrete and continuous (Figures18 through 20).(a) Reference system performance: power exchanged through the IC. (b) Time trends related to the ensemble of 75 code runs (6 deterministic status and 69 probabilistic status—discrete probability distribution): power exchanged trough the IC. (c) Time thrends related to the ensemble of 75 code runs (6 deterministic status and 69 probabilistic status—continuous probability distribution): power exchanged through the IC.
(a)(b)(c)Figure 19
Characterization of system status on the basis of the probability. Six system status (1 to 6 in the figure) is deterministically derived and sixty-nine (7 to 75 in the figure) are statistically derived assuming a discrete probability distribution.Figure 20
Characterization of system status on the basis of the probability. Six system status (1 to 6 in the figure) is deterministically derived and sixty-nine (7 to 75 in the figure) are statistically derived assuming a continuous probability distribution.The FC considered was(17)FC=Z-ZrefZref=<(-0,2),
where Z is(i)
the thermal power exchanged across the IC (W2);(ii)
mass flow rate at the IC inlet (Γ2).“ref” related to the code calculation for the reference or nominal system configuration.Indicators of system performance are(1)
time during the calculation when the FC is verified, failure timeFt(s),(2)
(18)∫TnomeocW2(t)dt∫TrefeocW2ref(t)dt=(1/eoc-Tnom)∫Tnomeoc(PHX(t)/PCORE(t))dt(1/eoc-Tref)∫Trefeoc(PHX(t)/PCORE(t))refdt,∫TnomeocΓ2(t)dt∫TrefeocΓ2ref(t)dt,(3)
ratio between the failure time and the time of calculation. wherePHX is the Power exchanged across the condensers tubes, PCORE is the Core power,  T is the system activation time, and eot is the end of transient calculation.In this case the curves of merit (Figure21) were used to judge the system acceptability and to compare the selected system with different system. They show the PI values (W2/W2ref) as a function of the probability interval range.Figure 21
Curves of merit: probability for the performance indicator “IC power integral ratio” (discrete probability distribution).


## 5.2. Case (c) TTL-1 Apparatus

The system was modeled (Figure22) and the design and critical parameter were selected (Table 4).Figure 22
RELAP 5 nodalization TTL-1 apparatus case c.Figure 23
Time trends related to the ensemble of 137 code runs ([1–18] deterministic status): power exchanged in the cooler.The FC is expressed as(19)FC=Wref-WWref≤0.2,
where
(20)W=∫0τobsW(t)dtτobs,
where W is the integral of thermal power exchanged in the cooler, “ref” is the related to the code calculation for the reference or nominal system configuration,  and τobs is the “observation time”.The system PIs to evaluate the Thermal Hydraulic Reliability (TH-R) are(i)
integral value over a mission time,(ii)
ratioW/Wref.The deterministic and statistic selection of system scenarios was done by means of Monte Carlo procedure. Four ways are pursued to arrive at four definitions for the TH-R of the TTL-1 loop, respectively, adopting the following.(1)
The “figure of merit” approach proposed by [2]: the result is given in Figure 24.(2)
The “cumulative probability” approach suggested by [16]: the result is given in Figure 25, where a comparison is made with the result from a previous REPAS application case b.(3)
The R1 single-valued reliability definition is(21)R1=1-NFN=0.70,
where NF is number of failed runs and N is total number of runs.Figure 24
Probability distribution for the performance indicator: integral power ratio exchanged in the cooler.Figure 25
Comparison between thermal hydraulic reliability for two different systems: IC-SBWR (two-phase NC system) and TTL 1.The R2 single-valued reliability definition is(22)R2=∑1N(W/Wref)N=0.85.
The TH-R definition in Figure 24 (first TH-R definition) uses data elaboration given in Table 6.Table 6
Selected system performance indicator related to individual probability intervals.
Case IDProbabilityAccepted RunFailed RunW/WrefReference4.25E-06□—111.21E-07□*0.78521.18E-06□—1.00431.31E-07□—0.9743.69E-07□—0.95353.69E-07□*0.78263.08E-07□—1.0277.39E-07□—0.99687.84E-07□—193.27E-07□—0.99107.84E-07□—0.995115.31E-07□—1127.50E-07□—1139.62E-07□—1141.60E-06□—1151.39E-06□—1167.50E-07□—1.007171.96E-06□—1187.50E-07□—1193.03E-07□—0.99203.86E-07□—0.995217.72E-07□—1223.54E-07□—1233.54E-07□—0.9246.54E-07□—1251.77E-06□—1261.31E-06□—1271.42E-06□—1281.06E-06□—0.98293.86E-07□—0.91301.16E-06□—0.95311.06E-06□—0.98327.32E-08□—1337.32E-08□—1345.88E-07□*0.77351.87E-07□—0.97367.79E-08□*0.4371.08E-14□*0.26389.39E-11□—0.9394.48E-11□—1.007404.59E-12□—0. 83411.66E-10□—0.93426.65E-14□—0.8436.66E-10□—0.94441.16E-09□—0.94452.54E-14□—1464.64E-14□*0.62472.02E-12□*0.67The TH-R definition in Figure25 (second TH-R definition) makes use of the classic Cumulative Distribution Function (CDF) concept. The TH-R is achieved by ordering the cooler power integral ratio (W/Wref) with respect to the probability of occurrence of each configuration from the probabilistic and deterministic sets.Sensitivity analyses identify the main contributors to the passive system performance. The SRC technique, see the above section, was used. The SRC values are reported in Figure26 in relation to each of the defined critical and design parameters.Figure 26
Standardized regression coefficients for the defined performance indicator:W/Wref


## 6. Conclusions

The assessment of the reliability of passive systems is a crucial issue to be solved for their extensive use in future NPPs.Several physical parameters affect significantly the behavior of a passive system and their values at the time of operation are “a priori” uncertain: thus, there is the need to consider a multitude of scenarios of system response. This gives back the reliability assessment nonmanageable, the bottleneck being the need to simulate several system behaviors with time-consuming mechanistic computer codes.To overcome these difficulties, it is necessary to identify those parameters which are most relevant to the system response and limit the probabilistic analysis to them. The REPAS procedure can be applied:(i)
to evaluate the acceptability of a passive system,(ii)
to compare two different passive systems having the same mission; moreover the methodology is still in assessment phase (by means of a suitable “experimental tests”) for absolute reliability evaluation,(iii)
to evaluate the performances of an active and a passive system on a common basis,(iv)
to supplement deterministic criteria and analyses (e.g., TH) in the design process considering the reliability of accident prevention and mitigation functions,(v)
to optimize the design of a passive safety system,(vi)
to assess the economical impact in the design change.REPAS method is described in Section2 and its application in Sections 4 and 5. The first “embryonic” applications of the methodology are reported in [2, 5, 7] and so forth. It was the result of a joint cooperation between ENEA, UNIPI, and Polytechnic of Milan. Then this methodology was embedded in the RMPS EU project on the framework of the 5th EURATOM program [19], see also [3, 4, 16, 17] and so forth,  In this report is shown an improvement of the methodology for the relative reliability evaluation including a more robust mathematical model based on Probabilistic basis.REPAS method is described and three applications related to a pool heat removal system of a prototypical integrated system, a scaled IC of an SBWR and TTL 1 experimental apparatus, were presented.The methodology is tested on examples of T-H passive systems.Identification and quantification of the sources of uncertainties and determination of the important variables are done. The sources of Uncertainties are identified and they are mainly in the following:(i)
approximations in modeling of the process physics;(ii)
approximations in modeling of the system geometry;(iii)
the input variables.The engineering judgment plays an important role in the REPAS and in the identification of source of uncertainty by means of selecting the range of uncertainty, the probability density function, and so forth.The analysis of the results and the use of the system performance indicator (PI or TPI) allowed the achievement of the system performance evaluation.  The relevant results are summarized in the above sections for all the three investigated cases. The sensitivity analysis has been completed by adopting the Standardized Regression Coefficients technique (SRCs).Areas for further development and improvement of the procedure have been identified. They are summarized as follows.(i)
Absolute reliability evaluation is needed by means of a tailored experimental tests.More rigorous and systematic basis is necessary to select the parameters that characterize the system status (e.g., a complete Expert Judgment procedure).



---

*Source: 768947-2009-11-30.xml*