Conclusiones respecto a la pregunta de investigación y los objetivos del estudio

Canadian CANDU traditionally utilized the Limiting Operating Envelope (LOE) methodology [23]. This was a conservative approach that focused on worst case scenarios. The base assumption is that every key parameter is simultaneously operating at their worst case value for the event, even when this is not possible. A number of deterministic assumptions are also utilized [23]. These include simultaneous power losses, total failure of an SDS, partial failure of the other, and more. The LOE method thus builds an envelope of safe operations for the key parameters.

Recently, CANDU plants in Canada have moved towards the Best-Estimate and Uncertainty Analysis (BE+UA) methodology [23]. This has a number of benefits including

 More realistic predictions of plant behaviour, increasing confidence in predictions

 Resolve many outstanding safety questions by verifying their benignity

 Utilizes a more narrow range on parameters used in code validation

 Realistic plant behaviours breed familiarity for operators in diagnosing events

 Makes use of past analysis results, permitting incrementally improved analysis

 Potential to relax certain operating parameters

The BE+UA code requires sufficient certification and demonstration of prudence in order to be accepted by the CNSC. The methodology works with a number of generalized steps [23]:

All relevant traits of the facility, including its operating state, the performance of its equipment, and location must be specified. The analyzed event must be completely identified. This includes postulated initiating event, sequence of assumed failures, and actions of operators. At this point, the acceptance criteria must also be stated with justification. It must be demonstrated to the CNSC that all threats posed have been covered. Validated models must be available to facilitate the BE+UA method for the selected criteria.

(2) Important phenomena and key parameters

Important phenomena must be identified and adequately modeled by computer codes. The parameters are ranked according to importance to the event. Uncertainty and sensitivity must be considered when ranking parameters [37].

High ranking parameters may use statistical uncertainties as they propagate through the code, or may use conservative values including the 95/95 principle [37]. Medium parameters are to be placed at their conservative values and low ranking parameters may be handled in any method.

(3) Analytical tools

The analytical codes used must satisfy the CNSC’s criteria by demonstration of adequate modeling of important systems, phenomena and equipment. Code must demonstrate accurate and stable algorithms and verified interfaces for data transfer. Scaling must documented and verified. Outputs of all sections of code that are either acceptance parameters or the input of another code must include their bias and variance at the 95 percent confidence level [37].

(4) Deterministic assumptions

Deterministic assumptions introduce a measure of conservatism by postulating multiple failures and worst case scenarios. Deterministic assumptions are to be included and documented. Examples include LOCAs at worst case locations rather than most likely, crediting only one SDS with proper functioning, partial failure of shut-off rods, etc [37].

(5) Analysis input parameters

For every analysis, each relevant design and modeling parameter must be discovered. The size of the sampling set required to achieve the pre-determined confidence levels on the parameter characteristics (standard deviation, type of distribution, etc.) must be determined and realized. Equipment testing frequency must be decided to capture trends, covariances, and operational data, especially the effects of ageing [37].

If operational data is to be pooled, it must be demonstrated that the other unit, even if it is from the same facility, must be free from systematic differences. This includes design, equipment, and operating procedures. Only information gathered from the same operating state being analyzed is applicable [37].

(6) Quantification of uncertainties

There are three major sources of parameter uncertainties:

 Operational uncertainty results from variability, trends, measurement errors, instrument drift, etc.

 Design uncertainty results from allowances, fabrications tolerances, measurement errors, test and calibration accuracy, etc.

 Modeling uncertainties come from scaling effects, unmodeled processes, simplifications, nodaliztion effects, numerical solution schemes, etc.

Uncertainties must be characterized quantitatively with conservative envelopes. Distributions must be fully realized and integrated into parameter ranking and uncertainty assessment [37].

(7) Integrated uncertainty assessment

The uncertainty of output parameters of interest must be generated. Extremely low probability values must be included. The CNSC requires 95/95 conformance with acceptance criteria. At this stage, confirmation of parameter ranking should be performed. Sensitivity studies must now be performed to ensure all parameter behaviours have been identified [37].

(8) Expert judgement

Expert judgement should be minimized as much as practical. CNSC has established rules for the use of expert judgement. These rules address the identification of areas where expert opinions are logical and needed, the qualifications of experts, integration of judgements, references of supporting information, and documentation of recommendations made. Posteriori confirmation of judgement must be made when possible [37].

(9) Validation of the analysis

Sufficient demonstration must be performed to verify that non-characterized operating states are bounded by the analysis. If operating states cannot be verified to be covered by analysis, new analysis must be performed. Operations and procedures that have been covered by the analysis must be documented such that unusual operations (e.g. deliberate operation

changes due to impairment of equipment) may only persist for a limited time. Longer unusual operations (e.g. repairs) must be analyzed separately [37].

Adequate procedures for monitoring and updating plant parameter behaviours must be created. Compliance with analysis assumptions should continue to be verified through statistical observance. A ‘shelf life’ of the model should be created using these statistical observances [37].

(10) Non-typical plant states

As BE+UA focuses on most likely states and conditions, additional assessments must be performed. Operating procedures such as reactor upsets, equipment failures, operation with defective fuel, fueling operations, start-up/shutdown, etc. must also be performed, or verified to be enveloped by previous analysis [37].