## Abstract

Nordic boiling water reactor (BWR) design employs ex-vessel debris coolability in a deep pool of water as a severe accident management (SAM) strategy. Depending on melt release conditions from the vessel and core–melt coolant interactions, containment integrity can be threatened by: (i) formation of noncoolable debris bed or (ii) energetic steam explosion. Melt is released from the vessel affect ex-vessel phenomena and is recognized as the major source of uncertainty. The risk-oriented accident analysis methodology (ROAAM+) is used for quantification of the risk of containment failure in Nordic BWR where melt ejection mode surrogate model (MEM SM) provides initial conditions for the analysis of debris agglomeration and ex-vessel steam explosion which determine the respective loads on the containment. Melt ejection SM is based on the system analysis code methods for estimation of leakages and consequences of releases (computer code) (MELCOR). Modeling of vessel failure and melt release from the vessel in MELCOR is based on parametric models, allowing a user to select different assumptions that effectively control lower head (LH) behavior and melt release. The work addresses the effect of epistemic uncertain parameters and modeling assumptions in MEM SM on the containment loads due to ex-vessel steam explosion in Nordic BWR. Sensitivity and uncertainty analysis performed to identify the most influential parameters and uncertainty in the risk of containment failure due to ex-vessel steam explosion. The results of the analysis provide valuable insights regarding the effect of MELCOR models, modeling parameters, and sensitivity coefficients on melt release conditions and predictions of ex-vessel steam explosion loads on the containment structures.

## 1 Introduction

Severe accident management (SAM) strategy in Nordic boiling water reactors (BWRs) employs ex-vessel core debris coolability. In severe core meltdown accident, molten core is released from the vessel into a deep pool of water in the lower drywell. The melt is expected to fragment, quench, and form a debris bed that is coolable by natural circulation of water. Formation of noncoolable debris bed and energetic interactions (steam explosion) between hot liquid melt and volatile coolant steam explosion pose credible threats to containment integrity. Success of the strategy is contingent upon melt release conditions from the vessel, which determine (i) debris bed formation phenomena, resulting properties and coolability of the bed, and (ii) steam explosion phenomena.

Risk-oriented accident analysis methodology (ROAAM+) is used in this work for quantification of the risk of containment failure in Nordic BWR [1,2]. The risk-oriented accident analysis methodology (ROAAM) developed by Professor Theofanous and coworkers [3] has been previously applied to successfully resolve several severe accident issues and to develop new severe accident management strategies in different designs of light water reactors [4–7]. The ROAAM integrates risk assessment (analysis) and risk management (modifications in the design, procedures, etc.) and marries probabilistic and deterministic approaches. ROAAM provides guidelines for bounding of epistemic (modeling) and aleatory (scenario) uncertainties in a transparent and verifiable manner that enables convergence of experts' opinions on the outcomes of the analysis. In order to achieve the transparency and verifiability, ROAAM employs its principal ingredients: (i) identification, separate treatment, and maintenance of separation (to the end results) of aleatory and epistemic uncertainties; (ii) identification and bounding/conservative treatment of uncertainties (in parameters and scenarios, respectively) that are beyond the reach of any reasonably verifiable quantification; and (iii) the use of external experts in a review, rather than in a primary quantification capacity.

The ROAAM+ is an extension of classical ROAAM methodology and relies on extensive use of computationally efficient models (called surrogate models (SMs)) for sensitivity and uncertainty analyses in risk quantification. In the ROAAM+ framework for Nordic BWR—the ex-vessel steam explosion impact map surrogate model (SEIM SM) [8] is used for prediction of the loads on the containment. The SEIM SM is based on TEXAS-V code [8]. Steam explosion loads on the containment depend on characteristics of melt release from the vessel, predicted by melt ejection SM [9], based on methods for estimation of leakages and consequences of releases (computer code) (MELCOR) code [10,11] analysis results of vessel failure mode and melt release conditions in Nordic BWR [12].

Modeling of vessel failure and melt release from the vessel in MELCOR code is based on parametric models, allowing a user to select different assumptions and effectively control lower head (LH) behavior and melt release.

The goal of this work is to evaluate the effect of epistemic uncertain parameters and modeling assumptions in MELCOR code on containment loads due to ex-vessel steam explosion in Nordic BWR using ROAAM+ framework for Nordic BWR [1,2]. We carry out sensitivity analysis using standalone and coupled models in order to identify the most influential scenario and modeling parameters. Further, we quantify the effect of the most influential parameters on the failure probability. The results are presented using the failure domain approach and second-order probability analysis, considering the uncertainty in distributions of the input parameters.

## 2 Risk-Oriented Accident Analysis Methodology+ Framework for Nordic Boiling Water Reactor

One of the key ingredients of ROAAM methodology is the decomposition of complex physical phenomena into subphenomena, where each phenomenon constitutes a well-posed problem that can be solved independently from one another. The top layer of the ROAAM+ framework for Nordic BWR decompose severe accident progression into a set of causal relationships represented by respective surrogate models (SM) connected through initial conditions [1]. Computational efficiency of the top layer of the framework allows for extensive sensitivity and uncertainty analysis in the forward and reverse analyses.

In ROAAM+ framework—forward analysis defines conditional containment failure probability for each scenario ${si}$ and reverse analysis identifies failure domains in the space of scenarios ${si}$, and model input parameters ${pi}$.

### 2.1 Failure Domain.

Failure domain is defined as the domain of model input and scenario parameters where the values of $Pf$ are larger than a “physically unreasonable” [3] level ($PS$ = 0.001) of probability ($PFi\u2265PS$). Since in the analysis we obtain not a single value of $Pf$ but a distribution, the following classification of failure domain was proposed and illustrated in Fig. 1, which shows an example of possible cumulative distribution functions (CDFs) (or complementary cumulative distribution functions(CCDFs)) of $Pf$ that can be obtained in ROAAM+ failure domain analysis. These resultant CCDFs can be color-coded as follows:

*Green*: at most in 5% of the cases $Pf>Ps$, i.e., with 95% confidence the probability of failure $PF$ will not exceed selected screening probability $Ps$. If selected $Ps$ is sufficiently small, then green domain indicates a combination of parameters where “failure is physically unreasonable” regardless of the modeling uncertainties.*Red*: at least in 95% of the cases $Pf>Ps$, i.e., with 95% confidence the probability of failure $PF$ will exceed selected screening probability $Ps.$ If selected $Ps$ is sufficiently large, then red domain indicates a combination of parameters where “failure is imminent” regardless of the modeling uncertainties.*Blue*: $PF$ exceeds $Ps$ in 5–50% of the cases.*Purple*: $PF$ exceeds $Ps$ in 50–95% of the cases.

## 3 Surrogate Models Overview

This section provides a brief overview of full and surrogate models used in the ROAAM+ framework for Nordic BWR, that connect plant damage states with respective threats to containment integrity. These models include (i) melt ejection mode surrogate model (MEM SM), based on MELCOR code; (ii) SEIM SM, based on TEXAS V code.

### 3.1 Melt Ejection Mode Surrogate Model.

The MEM SM is based on the MELCOR code analysis results of vessel failure mode and melt release conditions in Nordic BWR [12,13].

The MEM SM is built for the unmitigated station blackout (SBO) scenario with depressurization (low pressure (LP)), denoted as (SBO LP). In this scenario, the accident is initiated by the station blackout that results in complete loss of safety systems that require AC power. That is, the systems such as emergency core-cooling system (both high and low pressure) and residual heat removal system are considered unavailable during the whole transient. Reactor shutdown, safety relief valves, and automatic depressurization systems are activated according to the control logic. Flooding of the lower dry well (LDW) from the wet well for ex-vessel debris coolability is initiated according to the standard control logic, i.e., (water level below the top of active fuel for 10 min.). Containment venting system (CVS) includes filtered (through CVS—multiventuri scrubbing system) and nonfiltered containment venting, which are activated when correspondent pressure set-points are reached (5.5 bar and 6.5 bar in the upper drywell).

#### 3.1.1 Overview of Nordic BWR MELCOR Model.

where $DIGT$ is the diameter of IGT penetration (m) and $NIGT$ is the number of failed IGTs in every radial ring.

In this work, lower head penetrations and correspondent failure modes are only modeled for IGTs, since, according to Ref. [15] and Nordic BWR design, the control rod drive housing support located under the vessel limits downward displacement of CRGTs to approximately 3 cm, while the thickness of the vessel lower head is around 20 cm; therefore, the scenario with ejection of CRGTs was not considered in the analysis presented in this paper.

The solid debris ejection mode (IDEJ) is used in the MELCOR code to calculate the mass of each material in the bottom axial level that is available for ejection (but not necessarily ejected). In the default option (ON, IDEJ = 0), the masses of each material available for ejection are the total debris and molten pool material masses, regardless of whether or how much they are molten. In the second option (OFF, IDEJ = 1), the masses of steel, Zircaloy, and UO_{2} available for ejection are simply the masses of these materials that are molten; the masses of steel oxide and control poison materials available for ejection are the masses of each of these materials multiplied by the steel melt fraction, based on an assumption of proportional mixing; the mass of ZrO_{2} available for ejection is the ZrO_{2} mass multiplied by the Zircaloy melt fraction. Additionally, the mass of solid UO_{2} available for ejection is the Zircaloy melt fraction times the mass of UO_{2} that could be relocated with the Zircaloy as calculated in the candling model using the secondary material transport model [10,11]. Furthermore, MELCOR puts additional constraints on the mass that can be ejected at vessel failure: (i) to initiate melt ejection, the mass of molten material should be greater than SC1610(2) (5000 kg—default value), or a melt fraction should be larger than SC1610(1) (0.1—default value. In this analysis, the values of sensitivity coefficients SC1610(1,2) were set to zero, so any amount of melt available for ejection would be ejected. Furthermore, in case of gross failure of the vessel LH, it is assumed that all debris in the bottom axial level of the corresponding ring, regardless its state, is discharged linearly over 1 s time-step without taking into account failure opening diameter [10,11].

#### 3.1.2 Postprocessing of the Results.

Postprocessing of MELCOR analysis results [13] of vessel failure mode and melt release conditions is performed, in order to provide initial database of full model (FM) solutions for the development of the MEM SM. This step is necessary, since the MELCOR code does not predict directly such parameters as jet radius and jet speed used as initial conditions in the model for assessment of ex-vessel steam explosion loads on the containment (called SEIM SM) in Nordic BWR. The complete list of the input parameters in the SEIM SM can be found in Refs. [8] and [16].

##### Melt jet radius and speed.

It is important to note that the current SEIM SM can predict steam explosion loads on the containment per single melt jet, defined in terms of jet radius (mm), with minimum size $RMIN$=35 mm (that corresponds to a single IGT size break) and $RMAX$=300 mm, without taking into account possible interactions between jets during premixing and explosion phases (see for details Ref. [8]).

^{2}), number of failed penetrations (–), and respective accident progression time. Thus, based on the MELCOR results, the debris ejection rate (kg/s) can be derived as follows:

where $\Delta Mej$ is the mass of ejected debris during $\Delta TP$ time interval (MELCOR plotting time-step).

^{3}(average corium density, based on Ref. [17])

where $g(m/s2)$ is the gravitational acceleration constant, $h(m)$ is the free fall height (derived from water pool depth), $UMELC(m/s)$ is the initial jet velocity calculated by Eq. (5), and $Rring$(m) is the radius derived from the cross section area of the ring with failed segment of vessel lower head.

##### Temperature of ejected debris.

The temperature of ejected debris (TPIN) is calculated as the maximum debris temperature in the cells adjacent to the vessel lower head.

##### Pool conditions.

The pool conditions, such as water pool depth (XPW), lower drywell pressure (PO), and water pool temperature (TLO)—can be directly imported from the MELCOR analysis results.

##### Postprocessing of the results, assumptions, and limitations.

To summarize, when performing postprocessing of the MELCOR results the following assumptions have been made:

Uniform distribution of ejected debris flow between all failed IGTs, without taking into account failed IGTs locations (e.g., in the center or periphery).

Ejected debris density is assumed to be equal to $\rho =8000(kg/m3)$. This vale was assumed based on SERENA-II BWR benchmark exercise [17].

Debris ejection rate $M\u02d9deb$ is uniform during MELCOR plotting time-step $\Delta TP(s)$.

Debris ejection temperature is calculated as the maximum particulate debris temperature in the COR cells adjacent to the vessel lower head.

No correction is made for the fraction of solid debris during debris ejection from the vessel.

If gross failure is declared (due to vessel lower head creep-rupture), the ejection is calculated as a single jet with jet radius defined as $RMAX=300\u2009mm$ (max. permitted value of SEIM SM) and respective jet velocity is recalculated based on Eq. (6).

#### 3.1.3 Data Base of MELCOR Code Solutions.

Current state-of-knowledge in the field of vessel failure mode and multicomponent debris ejection from the vessel is quite limited. In reality, it is difficult to assess the fraction of failed (ejected) penetrations. The process of vessel failure and debris ejection involve several interacting phenomena, which include formation and accumulation of liquid melt, gravity-driven drainage of molten materials through the porous debris bed, melt resolidification, and crusts formation in colder regions of the debris bed, that prevent further material drainage, which can result either in slow dripping of the melt from the vessel or in accumulation of significant amounts of superheated metallic melt above the crust, which will be released upon crust remelting/failure. The crust formation can result in interaction of significant amounts of debris at high temperature with the vessel lower head wall, and significant mechanical loads on the structures which can lead to creep-rupture failure of the vessel lower head and massive ejection of the debris from the vessel.

Fraction of failed penetrations and debris ejection mode (solid debris ejection switch) are treated as splinters [3] in ROAAM+ considering the (i) high sensitivity of MELCOR results to the selection of these parameters and (ii) lack of knowledge about them.

Splinter scenario in ROAAM [3] is defined as a scenario where relevant epistemic uncertainties are *beyond the reach of any reasonably verifiable quantification*. Thus, in total four different splinter scenarios, with respective surrogate models are considered in the analysis:

solid debris ejection—on (IDEJ0) with 100% of IGTs ejected at penetration failure in respective radial ring (EIGT100 IDEJ0 LP);

solid debris ejection—off (IDEJ1) with 100% of IGTs ejected at penetration failure in respective radial ring (EIGT100 IDEJ1 LP);

solid debris ejection—on (IDEJ0) with 25% of IGTs ejected at penetration failure in respective radial ring (EIGT25 IDEJ0 LP);

solid debris ejection—off (IDEJ1) with 25% of IGTs ejected at penetration failure in respective radial ring (EIGT25 IDEJ1 LP).

where $f(ti)$ is the system response quantity value as a function of time, $\Delta Mej(ti)$ is the fraction of mass ejected during $ti$ and $ti\u22121,$ and $MejTOT$ is the total ejected mass. The motivation for the use of mass-averaged values in SM development is twofold, first—the current implementation of SEIM SM does not calculate explosion impulses during time-dependent melt release, and consequences of ex-vessel steam explosion, based on the sensitivity study presented in Ref. [8], are determined by the mass (enthalpy) released from the vessel.

The results of postprocessing are presented in Figs. 3–5 in the form of box-and-whisker plots [18] with a total amount of samples for each splinter scenario considered, equals to $nMELCOR=2000$.

The list of input parameters and respective ranges used to generate the database of MELCOR solutions is presented in Table 1, detailed discussion on parameters selection, and sensitivity of the MELCOR code response to the variability of these parameters can be found in Ref. [12]. The same parameters will be used to develop the MEM SM. The list of MEM SM outputs and their ranges is presented in Table 2. Note that the ranges, presented in the Table 2 can be considered as conservative, and significantly wider than the actual MEM SM predicted quantities, illustrated in the Figs. 3–9.

It is important to emphasize that the current ex-vessel steam explosion surrogate model—SEIM SM (see Refs. [8] and [17] for details) is implemented to predict steam explosion loads on the containment per single melt jet, without taking into account possible interactions between multiple jets. Thus, current implementation of the MEM SM is limited to predict melt release conditions (such as jet radius, initial jet velocity) per single jet.

#### 3.1.4 Approach for Melt Ejection Surrogate Model Development.

Uncertainty analysis in ROAAM+ framework requires a large number of model executions. In order to make computational costs feasible, the model should be sufficiently “fast running.” For these reasons “surrogate models” SMs are developed and used in ROAAM+ framework for Nordic BWR. SM is an approximation of the full model predictions of the target parameters. The MEM SM has been developed using regression tree learning [19].

Regression tree learning applies recursive partitioning of the global input space into smaller subdomains, where simple models, such as linear regression can be applied. The global predictive model has two parts: (i) the recursive partitioning, and (ii) a model built for each final cell (leaf node) of the partition (regression tree).

The basic regression tree-learning algorithm then is as follows:

start with a single node containing all points (regression tree root node);

calculate

*S*value (see below):If all the points in the node have the same value for all the input variables, stop.

Otherwise, search over all binary splits of all variables for the one which will reduce

*S*as much as possible.If the largest decrease in

*S*would be less than some threshold*δ*, or one of the resulting nodes would contain less than $nmin$ points, stop.Otherwise, take that split, creating two subnodes.

$Vi$ and $ni$ are the respective variance and number of instances in the *R* leaf node.

Figures 10 and 11 shows an example of MEM SM predictions of jet radius and jet velocity in cases of solid debris ejection on (IDEJ0) and off (IDEJ1) compared to the original data used in the regression tree learning process (red points) and previously unobserved data (blue points), that gives relatively good results (coefficient of determination—*R ^{2}*).

#### 3.1.5 Melt Ejection Surrogate Model Results.

In this section, we present the results of melt ejection surrogate model application in ROAAM+ framework for Nordic BWR [1,2].

In Figs. 6–9, we show the results in form of respective CDFs of different MEM SM response quantities generated with random sampling of the MEM SM in ROAAM+ Framework, where $nROAAM+=105$ samples were used. The results are compared to the original MELCOR data distribution ($nMELCOR=2000)$, obtained with random sampling of MELCOR code [13].

The results show that the MEM SM reproduces the distributions of the different characteristics of melt release from the vessel (e.g., jet radius—RPARN (mm) and jet velocity—UPIN (m/s)) in Nordic BWR in different splinter scenarios. This feature of the SM is crucial for the risk analysis. The results show that in some cases the MEM SM slightly underestimates the tails of the distribution; however, these discrepancies can be taken into account by application of the approaches for quantification of the uncertainty due to SM approximation of FM, implemented in Refs. [16] and [17].

One of the disadvantages of application of the regression trees is a nonsmooth response, which is seen in the plots—blue lines on Figs. 6–9. However, it does not affect significantly the statistical result. Smoothness can be achieved by increasing the number of leaf nodes in the tree. However, it might lead to overfitting, and overall reduction of predictive capability of the model.

### 3.2 Ex-Vessel Steam Explosion Surrogate Model.

Steam explosion in a deep pool is a credible threat to containment integrity potentially leading to large early release of radioactive products to the environment. The general approach for development of ex-vessel SEIM and respective surrogate model (SEIM SM) is illustrated in the Fig. 12.

Steam explosion impact map surrogate model is a fast running surrogate model that has been developed [16] for the assessment of the risk of containment failure due to steam explosion in Nordic BWR. Development of the SM relies on a database of solutions generated by a 1D FCI code TEXAS-V. TEXAS-V is a 1D three-field transient code with Eulerian fields for gas and liquid and a Lagrangian field for fuel particles. It is comprised of two modules for calculation of premixing and steam explosion [20].

The surrogate model is based on TEXAS-V code results and developed using deep (two hidden layers) multilayer perceptron artificial neural network [8].

The artificial neural network predicts impulses (Table 3) which correspond to certain percentiles of the impulse distribution for given melt release characteristics (see the list of the parameters in Table 4) and arbitrary triggering time. The motivation for the parameters selection and respective ranges can be found in Refs. [8] and [16].

## 4 Results

The analysis of the risk of containment failure due to ex-vessel steam explosion has been performed using surrogate model for ex-vessel steam explosion and melt ejection mode surrogate models [8,9]. In the analysis, two fragility limits for the containment hatch door located in the lower drywell of the Nordic BWR were considered, where the respective fragility limits are: (i) for original design “nonreinforced hatch door”—6 kPa·s; and for (ii) modified design “reinforced hatch door”—50 kPa·s.

The analysis has been performed for individual models, e.g., only for SEIM SM; and for coupled models SEIM SM and MEM SM, where the melt release characteristics, predicted by MEM SM, are used as initial conditions in SEIM SM. Furthermore, all epistemic modeling parameters in MEM SM and SEIM SM are considered as model intangible parameters in ROAAM+ treatment (i.e., incomplete probabilistic knowledge, see Ref. [9] for details). Furthermore, model input parameters in SEIM SM (see Table 4), such as KFUEL, PHEAT, CP, RHOP—are not predicted by current version of MEM SM, and, therefore, are considered as model intangible. However, it should be noted that the importance of these parameters on SEIM SM predictions is relatively low, according to sensitivity analysis results presented in Fig. 13 and Ref. [8].

### 4.1 Risk Analysis Using Ex-Vessel Steam Explosion Surrogate Model.

Using ROAAM+ probabilistic framework, the complementary cumulative distribution of probability of failure $CCDF(PF)$ can be obtained using SEIM SM. Figure 14 illustrate $CCDF(PF)$ obtained for nonreinforced and reinforced hatch door. The results show that the screening probability $Ps=$0.001, which corresponds to “physically unreasonable” limit (see Refs. [3] and [21] for details) is exceeded in approximately 99% of the cases with nonreinforced hatch door and in ∼70% of the cases with reinforced hatch door. On the other hand, we see that there is nonzero fraction of scenarios that have $Pf$<$Ps$, even in the case of nonreinforced hatch door, which means that if we reduce the uncertainty in the input—the results can change.

For this purpose, we perform model sensitivity analysis, to identify the parameters that have the highest influence on the results. Sensitivity analysis is performed using Morris method for global sensitivity analysis (see for details). In the analysis, we considered the effect of SEIM SM input parameters on the magnitude of explosion impulse predicted by the SEIM SM.

The results of sensitivity analysis are presented in Fig. 13 in form of Morris diagram, where the parameters in the legend are ordered according to its influence on the SEIM SM responses, defined by the Morris $\mu $ values (the larger values of Morris $\mu $ indicate larger importance of the parameter on the system response, see Ref. [22] for details). The aim of Morris sensitivity analysis is to identify parameters that have significant and negligible effects on the system response. In Morris sensitivity diagrams, the parameters that have significant effect on the system response have the highest value of the Morris modified mean and clearly visible in the figures. The parameters that have negligible effect on the results have smaller vales of the Morris modified mean (the group of parameters with low significance) and can be screened out (e.g., fixed to a certain value) in the further analysis. Even though the parameters with low importance might overlap each other in the figure, the list of these parameter is also shown in the legend and sorted according to the Morris importance index.

The results show that the most influential parameters are RPARN (initial jet radius), TPIN (fuel inlet temperature), and XPW (water pool depth). The effect of these parameters on steam explosion energetics can be explained as follows: (i) RPARN—affects the depth of coherent melt mass penetration in water and total amount of melt available for interaction, steam explosion energetics increase with increase of RPARN; (ii) TPIN—affects total amount of liquid melt available for fine fragmentation, steam explosion energetics increase with increase of TPIN; (iii) XPW—define system confinement and availability of volatile liquid, with decrease of XPW steam explosion energetics deteriorates.

The next step of ROAAM+ treatment is failure domain analysis (see Sec. 2.1 for details) in the space of the most influential parameters, to identify if there are specific parameters combinations that lead to failure or success, and therefore, if reduction of the uncertainty in these parameters can help to resolve the issue.

Failure domain analysis is performed using probabilistic framework, where respective complementary cumulative distributions of probability of failure $CCDF(PF)$ are obtained for every scenario defined in terms of the most influential parameters, which can provide a more comprehensive view on the possible outcomes of ex-vessel steam explosion. In failure domains, every $CCDF(PF)$ is color coded with respect to the exceedance frequency of screening probability level $Ps$, as demonstrated in Fig. 1.

Failure domain analysis using probabilistic framework for ROAAM+ has been performed for SEIM SM in the domain of the most influential parameters identified in sensitivity study.

Figure 15 illustrate the failure domain maps build in the space of TPIN (fuel inlet temperature) and RPARN (Jet radius) considering different fragility limits that correspond to nonreinforced (6 kPa·s) and reinforced hatch door (50 kPa·s).

The results of failure domain analysis show that failure (due to ex-vessel stream explosion) can be considered as *physically unreasonable* regardless the remaining uncertainty if one can demonstrate that the jet radius (RPARN) will be limited to 0.05 m (corresponds to the vessel LH opening with slightly ablated IGT size) even with the original design (nonreinforced hatch door). Furthermore, if it can be demonstrated that it will be a shallow pool in the lower drywell (XPW < 4 m) than the jet radiuses up to 0.09 m (ablated IGT size) can be considered as safe for ex-vessel steam explosion.

In case of modified design, i.e., reinforced hatch door, containment failure due to ex-vessel stream explosion can be considered as *physically unreasonable* regardless remaining uncertainty if one can demonstrate the jet radius (RPARN) will be limited to ∼0.15 m (corresponds to vessel LH opening with nonablated CRGT size).

### 4.2 The Effect of Melt Release Conditions on Ex-Vessel Steam Explosion.

The results of sensitivity analysis (see Fig. 13) and failure domain analysis (see Fig. 15) for ex-vessel steam explosion surrogate model show that the radius of the jet, water pool depth and the temperature of the melt—are the most influential parameters on the magnitude of ex-vessel steam explosion in Nordic BWR. These parameters depend on the in-vessel phase of accident progression, vessel failure mode, and melt release conditions—which predicted by the melt ejection surrogate model in ROAAM+ framework for Nordic BWR.

The ROAAM+ analysis of probability of failure has been performed using complete framework (MEM SM and SEIM SM) for unmitigated SBO scenario with depressurization. In the analysis using complete framework, SEIM SM predicts steam explosion loads on the containment depending on MEM SM predictions of melt release conditions for four splinter scenarios (see Sec. 3.1). The results are presented in Figs. 16 and 17.

The results show the dominant effect of the solid debris ejection mode (*IDEJ0* and *IDEJ1*) on the containment loads due to ex-vessel steam explosion.

In case of IDEJ0 (solid debris ejection—on)—the melt and debris mixture is released in a dripping mode, resulting in the small values of jet radiuses (RPARN), melt release velocity (UPIN), and melt temperature (TPIN) compared to IDEJ1 (solid debris ejection—off)—where the major part of in-vessel debris is ejected in the form of massive release (due to vessel lower head wall failure).

Initial breach area due to failed penetrations (*EIGT25* versus *EIGT100*) also has quite significant effect on the results; however, it does not change the conclusions in the case of single jet SEIM model. The effect of the number of failed penetrations on melt release conditions and ex-vessel steam explosion is the subject of future research and beyond the scope of the work presented in this paper.

Based on the differences between four splinter scenarios considered in MEM SM (see Sec. 3.1)—the solid debris ejection mode (IDEJ0 versus IDE1) has the dominating effect on the results.

The MEM SM splinters with IDEJ1 in most of the cases result in large jets with significant melt temperatures and jet velocities; thus, the magnitude of ex-vessel steam explosion is large. In particular, for 6 kPa·s fragility limit for the nonreinforced hatch door, the screening probability limits $Ps=0.001$ and $Ps=0.999$ are exceeded in 100% of the cases, as demonstrated in Figs. 16(a) and 16(b)), which indicate that containment failure is imminent. In case of 50 kPa·s fragility limit for the reinforced hatch door (design modification), the screening probability limit—$Ps=0.001$ is exceeded in 90% of the cases; however, $Ps=0.999$ limit is exceeded in less than 5% of the cases, meaning that further reduction of uncertainty is necessary.

The MEM SM splinters with IDEJ0 results in a dripping melt release mode (small jets with small ejection velocity). Thus, for 6 kPa·s fragility limit for nonreinforced hatch door, the screening probability limit—$Ps=0.001$ is exceeded in ∼16% to 25% of the cases, depending on the number of failed penetrations (EIGT100 versus EIGT25), while $Ps=0.999$ is exceeded in less than 1% of the cases, which indicate that further reduction of uncertainty is necessary. In case of reinforced hatch door with 50 kPa·s fragility limit, the screening probability $Ps=$ 0.001 is exceeded in less than 5%, thus, containment failure due to ex-vessel steam explosion can be considered as *physically unreasonable* in this splinter scenario. It is important to note that in case of EIGT25-IDEJ0 splinter scenario, there is a small fraction of scenarios (<1%) where the values of probability of failure $Pf$ exceed $Ps=$ 0.001 in case of reinforced hatch door (see blue curve on Fig. 17(b)); this particular values of parameters combinations and respective probability distributions are subject to the expert review and elicitation process.

Figures 18 and 19 show the results of sensitivity analysis for coupled melt ejection and ex-vessel steam explosion surrogate models (MEM-SEIM SMs) for EIGT100IDEJ1 and EIGT100IDEJ0 splinter scenarios. Note that water pool depth is considered as scenario parameter in these calculations.

The results of sensitivity analysis indicate that the uncertainty in the results in coupled MEM-SEIM analysis in case of IDEJ0 is majorly driven by parameters that control failure of penetrations (HDBPN and TPFAIL—heat transfer coefficient from debris bed to penetrations and penetrations failure temperature, respectively) in MELCOR code. It can be explained by overall small values of jet radiuses and ejected debris temperatures predicted by MELCOR code in case of IDEJ0 (see Figs. 3(a) and 4(a)), and the uncertainty is mostly dominated by TPFAIL and HDBPN, as demonstrated in Fig. 18. The effect of these parameters on steam explosion energetics can be explained as follows: based on sensitivity and uncertainty analysis of the vessel lower head failure and melt release (see Refs. [12] and [13] for details) in case of IDEJ0 (both solid and molten materials can be ejected simultaneously)—small values of HDBPN and TPFAIL can lead to formation of protective crust in the axial levels adjacent to the vessel wall (in form of conglomerate debris) which can prevent gradual debris ejection and result in eventual creep-rupture of the vessel lower head.

In case of IDEJ1, the results of coupled MEM-SEIM analysis are mostly affected by the pool depth (XPW), in-vessel particulate debris porosity (PDPor), and penetrations failure temperature (TPFAIL); which can be explained by the distributions of the jet radiuses (RPARN) and ejected debris temperatures (TPIN) predicted by MELCOR code in case of IDEJ1 (see Figs. 3(a) and 4(a)). In case of large jet radiuses, the uncertainty in the results is mostly driven by the water pool depth, i.e., water pool depth defines system confinement and availability of volatile liquid available for interaction; thus, with reduction of pool depth steam explosion energetics decreases.

Figures 20 and 21 show the results of failure domain analysis in case of EIGT100-IDEJ1 in the domain of the most influential parameters identified in Fig. 19. The results show that in the original design (Figs. 20(a) and 21(a)), both possibility ($Ps=0.001)$ and necessity ($Ps=0.999)$ of failure is high, i.e., no matter the uncertainty in modeling parameters, the nonreinforced door will fail in case of EIGT100-IDEJ1 scenario (solid debris ejection—OFF).

On the other hand, in case of EIGT100-IDEJ0, the results look completely different. For example, in the original design with nonreinforced hatch door, containment failure due to ex-vessel steam explosion can be considered as physically unreasonable (Figs. 22(a) and 23(a)) in case of early failure of penetrations (IGTs), provided by large values of heat transfer coefficient between debris and penetration structures (HDBPN) and small values of penetrations failure temperature (TPFAIL). This effect can be explained by the amount of melt and melt superheat available at the time of penetrations failure, i.e., later time of penetrations failure can lead to increased amount of liquid melt and larger values of melt superheat that can affect ablation of the opening, and thus, steam explosion energetics. In case modified design with reinforced hatch door (Figs. 22(b) and 23(b)), containment failure due to ex-vessel steam explosion can be considered as physically unreasonable for all combinations of the most influential parameters.

## Conclusions

In this paper, the effect of the uncertainty in melt release conditions on the risk of containment failure due to ex-vessel steam explosion in Nordic BWR has addressed with the risk-oriented accident analysis methodology (ROAAM+) for Nordic BWR.

In the ROAAM+ for Nordic BWR, melt release conditions are predicted by MEM SM (which is based on the MELCOR code), and respective loads on the containment due to ex-vessel steam explosion are predicted by SEIM SM (based on TEXAS-V code).

The results show that the mode of debris ejection from the vessel (*IDEJ1* versus *IDEJ0*) has the dominant effect on the conditional containment failure probability due to ex-vessel steam explosion. In case of solid debris ejection—off (*IDEJ1*—only molten materials + some fraction of solid debris can be ejected) containment failure due to ex-vessel steam explosion cannot be considered as physically unreasonable, even in modified design with reinforced hatch door. Moreover, in the original design, with 6 kPa·s, containment failure is imminent ($Ps=0.999$ is exceeded in over 95% of the cases). In case of solid debris ejection—on (*IDEJ0*—solid and liquid debris can be ejected)—containment failure due to ex-vessel steam explosion can be considered as physically unreasonable only in case of the modified design (with reinforced hatch door); in the original design—the physically unreasonable level ($Ps\u2009$= 0.001) is exceeded in ∼15% to 25% of the cases; however, the necessity of failure is small; therefore, further reduction of uncertainty potentially can demonstrate the effectiveness of SAM measures.

The analysis presented in this paper shows the dominant effect of the modeling of ejection mode of multicomponent debris from the vessel on the steam explosion loads on the containment. The mode of debris ejection from the vessel is controlled through the user-defined switch (IDEJ = 0, i.e., solid and liquid can be released versus IDEJ = 1 only liquid can be released) in the MELCOR code. Reduction of the uncertainty in the mode of ejection of multicomponent mixture of solid and molten debris, melt filtration through the porous debris, and crust formation is the necessary next step. It is needed for adequate modeling of severe accident transition from in-vessel to ex-vessel phase, which is important for reduction of uncertainty in the risk of containment failure.

## Acknowledgment

The simulations were performed on resources provided by the Swedish National Infrastructure for Computing (SNIC) at PDC Centre for High Performance Computing (PDC-HPC).

The work is supported by the Swedish Nuclear Radiation Protection Authority (SSM), Swedish Power Companies, Nordic Nuclear Safety Research (NKS), Swiss Federal Nuclear Safety Inspectorate (ENSI) under the APRI-MSWI program at the Royal Institute of Technology (KTH), Stockholm, Sweden.

## Nomenclature

- $Abreach$ =
total breach area $(m2)$

- $AIGTeff$ =
the initial effective area of the breach (prior to ablation) due to IGTs failure $(m2)$

- CFR =
proportionality constant for the rate of fuel fragmentation

- CP =
fuel heat capacity (J/kg K)

- $DIGT$ =
IGT diameter (m)

- $DIGTeff$ =
effective breach diameter due to failed IGTs (m)

- DHYPDLP =
lower plenum particulate debris equivalent diameter (m)

- EIGT25 =
effective breach diameter due to failure of 25% of instrumentation guide tubes in respective MELCOR radial ring (m)

- EIGT100 =
effective breach diameter due to failure of 100% of instrumentation guide tubes in respective MELCOR radial ring (m)

- $g$ =
free fall acceleration constant ($m/s2$)

- $h$ =
melt jet free fall height (m)

- HDBPN =
heat transfer coefficient from debris to penetration structures ($W/m2\u2009K)$

- HFRZSS =
refreezing heat transfer coefficient for stainless steel, control rod poison material $(W/m2\u2009K)$

- HFRZZR =
refreezing heat transfer coefficient for Zircaloy $(W/m2\u2009K)$

- IDEJ =
mode of debris ejection from the vessel in MELCOR code

- KFUEL =
fuel thermal conductivity (W/m K)

- $M\u02d9deb$ =
debris ejection rate $(kg/s$)

- $MejTOT$ =
total ejected debris mass (kg)

- $nIGTfailed$ =
number of failed IGTs

- $NIGT$ =
total number of IGTs

- $Pf$ =
probability of failure

- $Ps$ =
screening probability

- PDPor =
particulate debris porosity

- PHEAT =
fuel latent heat (J/kg)

- PO =
system pressure (Pa)

- $RMAX$ =
maximum jet radius permitted by TEXAS-V code (m)

- $Rring$ =
MELCOR ring radius (m)

- $RWL$ =
melt jet radius at the water level (m)

- RHOP =
fuel density

- RPARN =
initial melt jet radius (m)

- SC10202 =
time constant for radial (liquid) debris relocation (s)

- SC10201 =
time constant for radial (solid) debris relocation (s)

- SC1131-2 =
molten Zircaloy melt break through temperature (K)

- SC1141-2 =
molten cladding/pool-drainage rate (kg/m s)

- TFRAGLIMIT =
fragmentation time (s)

- TLO =
water pool temperature (K)

- TMELT =
fuel melting temperature (K)

- TPFAIL =
penetration failure temperature (K)

- TPIN =
fuel inlet temperature (K)

- $UMELC$ =
velocity of ejected debris (m/s)

- $UWL$ =
velocity of ejected debris at the pool level (m/s)

- UPIN =
fuel inlet velocity (m/s)

- VFALL =
velocity of falling debris (m/s)

- XPW =
water pool depth (m)

- $\Delta TP$ =
MELCOR plotting time-step (s)

### Greek Symbol

### Subscripts

### Acronyms and Abbreviations

- BWR =
boiling water reactor

- CART =
classification and regression tree

- CCDF =
complementary cumulative distribution function

- CDF =
cumulative distribution function

- CRGT =
control rod guide tube

- CVS =
containment venting system

- IGT =
instrumentation guide tube

- MELCOR =
methods for estimation of leakages and consequences of releases (computer code)

- MEM =
melt ejection mode

- ROAAM =
risk-oriented accident analysis methodology

- SAM =
severe accident management

- SBO =
station blackout

- SEIM =
steam explosion impact map

- SM =
surrogate model

## Footnotes

$UWL$ is the jet velocity (m/s) at the water level surface; $RWLis the$ jet radius (m) at the water level surface.

Whiskers lengths are calculated according to $q1\u2212(q3\u2212q1)$ and $q3+(q3\u2212q1)$ where $q1$ and $q3$ are 0.25 and 0.75 quantiles of the distribution. Red crosses indicate individual “outliers” that lie outside the $[q1\u2212(q3\u2212q1)$,$q3+(q3\u2212q1)]$ interval.