Development and Application of a Sensitivity and Uncertainty Analysis Framework for Safety Analysis of Molten Salt Reactors

Abstract

To provide reliable safety margins in reactor design and safety analysis, the best estimate plus uncertainty (BEPU) analysis, which is recommended by the International Atomic Energy Agency (IAEA), has drawn increasing attention worldwide. In order to systematically evaluate the sensitivity and uncertainty in the design and safety analysis of molten salt reactors (MSRs), a sensitivity and uncertainty analysis framework has been developed by integrating the reactor system safety analysis code RELAP5-TMSR with the data analysis code RAVEN. The framework is tested using the transient scenarios of the molten salt reactor experiment (MSRE): reactivity insertion accident (RIA) and station blackout (SBO). The testing results demonstrate that the proposed framework effectively conducts sensitivity and uncertainty analysis. Sensitivity analyses identify key input parameters, including the primary exchanger parameters, air radiator parameters, initial temperatures, delayed neutron parameters and volumetric heat capacity of the INOR-8 alloy. Uncertainty quantification provides 95% confidence intervals for the figures of merit (FOMs) and the steady-state and RIA scenarios remained within safety limits. The developed framework enables automated, efficient, and high-capacity sensitivity and uncertainty analysis across multiple parameters and transient scenarios. The systematic analysis provides sensitivity indicators and uncertainty distributions, offering quantitative insights into the safety margins and supporting the design and safety analysis of MSRs.

1. Introduction

Reactor safety analysis is of great significance in reactor research. Due to insufficient knowledge, there are many uncertainties in reactor design and safety analysis, especially for molten salt reactors (MSRs). Compared to conventional light-water reactors, MSRs use liquid fuel, which introduces strong coupling between neutronics and thermal-hydraulics, as well as fuel–coolant interaction. These characteristics lead to more complex transient behaviors and a broader range of uncertainty propagation paths, posing greater demands on modeling and simulation. According to related regulatory guidance documents [1,2], sensitivity and uncertainty analysis should be conducted during reactor design and safety analysis to reveal the uncertainties of reactors under various operating conditions and to ensure adequate and reasonable safety margins during reactor operation. Thus, sensitivity and uncertainty analysis is among the important aspects of nuclear safety analysis. Conducting comprehensive sensitivity and uncertainty analysis for MSRs is crucial.

The methods used for sensitivity and uncertainty analysis can be classified into deterministic and statistical methods [3]. Currently, the commonly used deterministic methods primarily include the adjoint sensitivity analysis procedure (ASAP) and the global adjoint sensitivity analysis procedure (GASAP) [4]. Among the statistical methods, common approaches based on sampling include random sampling, and stratified sampling, including Latin hypercube sampling [5]. Deterministic methods have the advantage of a fast solving speed, but they introduce uncertainty in the solution process and provide limited insights into the overall uncertainty in model predictions. Additionally, solving large systems using these methods can be very difficult. Although statistical methods exhibit lower computational efficiency, their solution accuracy matches the accuracy of the program itself, and they can be flexibly applied to large systems. In practice, deterministic methods are mostly used for local analysis, whereas statistical methods are used for both local and global analyses [4]. Global sensitivity analysis can reveal the overall effect on the responses (or the figures of merit, i.e., FOMs) when the input parameter varies throughout the input interval.

The statistical methods are gaining increasing attention in terms of the uncertainty and sensitivity analysis of reactors [6]. Consequently, this paper will employ a global sensitivity and uncertainty analysis method based on statistical sampling to conduct sensitivity and uncertainty analysis of MSRs.

The purpose of sensitivity analysis is to determine the contribution of each individual input parameter to the uncertainty of a specific system response, while uncertainty analysis aims to characterize the uncertainty of the system response due to the uncertainty of the physical model’s input parameters [7].

The initial phase of an uncertainty analysis involves the identification and characterization of uncertainty sources. Models of complex physical systems generally involve two distinct sources of uncertainty: stochastic uncertainty and subjective uncertainty [4,8]. The International Atomic Energy Agency (IAEA) classifies the sources of uncertainty in typical reactor safety analysis into five categories: code or model uncertainty, representation uncertainty, scaling uncertainty, plant uncertainty, and user-induced uncertainty [9,10].

Sensitivity and uncertainty analysis is increasingly widespread in many areas of engineering and science, encompassing virtually all nuclear reactor research. In this study [11], a statistical sampling method was employed to investigate uncertainty propagation in a light-water reactor (LWR). The uncertainty of the core key parameters was obtained and analyzed using normality tests. Then, based on the random sampling method, uncertainty propagation and quantification methods for the multi-physics of the pressurized water reactor (PWR) core simulation were developed [12]. In addition, inverse uncertainty quantification by hierarchical Bayesian modeling has also been used to study nuclear system thermal-hydraulics codes [8,13,14]. For sodium-cooled fast reactor systems, an analysis of the influence of nuclear data uncertainty on breeding was performed [15]. For a small lead-cooled reactor, dynamic sensitivity and uncertainty analysis were performed [16]. For MSRs, various studies have explored sensitivity and uncertainty analyses using different methodologies. The uncertainty quantification and sensitivity analysis of a 20 MWth prismatic transportable fluoride-salt-cooled high-temperature reactor was performed using the DAKOTA code coupled with the best-estimate nuclear system software RELAP5-3D [17]. The uncertainty analysis of a molten salt reactor (MK1 PB-FHR) under natural circulation was conducted using the coupled DAKOTA and GenFlow framework [18]. A preliminary uncertainty and sensitivity analysis of a molten salt fast reactor (MSFR) under steady-state conditions was performed using the polynomial chaos expansion (PCE) method [19]. To effectively reduce the computation time of multi-physics model solutions, a sensitivity analysis was conducted to identify the most important input parameters affecting the controllability assessment of the MSR [20]. Additionally, the sensitivity of the design parameters for MSRs has been investigated [21], and the heat transfer uncertainties analysis of the TMSR-SF0 simulator were performed in order to investigate the effects of thermophysical property uncertainties on the molten salt heat transport systems [22].

At present, research on the sensitivity and uncertainty of MSRs is relatively preliminary, and a general framework has not yet been established. Most researchers develop methods based on a single approach tailored to a specific scenario, which is difficult to generalize to other situations, thus lacking versatility. Additionally, increasing the number of input parameters significantly raises the workload. As a result, when selecting input parameters, the potential uncertainties in MSRs are not adequately considered, leading to excessive reliance on expert judgment and assumptions. Furthermore, the analysis of accident scenarios is often cumbersome, with most studies focusing on steady-state conditions and limited attention paid to accident scenarios. To address these issues, this study constructs a comprehensive framework for sensitivity and uncertainty analysis, which effectively supports sensitivity and uncertainty studies, providing valuable insights for the safety analysis and control of MSRs. Based on this framework, sensitivity and uncertainty analyses are performed for two scenarios in the molten salt reactor experiment (MSRE). The steady-state conditions and reactivity insertion accident (RIA) are selected as specific case studies due to their credibility and relevance to the design of molten salt reactors (MSRs), as well as their significant impact on reactor dynamic behavior and licensing requirements [21].

The remainder of this paper is organized as follows. Section 2 discusses the methods for conducting the sensitivity and uncertainty analysis. Section 3 outlines the components of the entire framework, including a brief introduction to the programs required for the framework and their coupling strategies. Section 4 provides a detailed description of the RELAP5-TMSR model of the MSRE, along with the identification of input parameters and responses. In Section 5, two accident scenarios are selected based on the relevant literature and molten salt reactor safety analysis requirements, and sensitivity and uncertainty analyses are conducted using the framework. Section 6 presents the conclusions and a summary.

2. Sensitivity and Uncertainty Analysis Methods

Generally, a complete sensitivity and uncertainty analysis includes the following: select a specific research object, abstract an appropriate accident scenario and determine the input parameters, perform repeated simulations to carry out uncertainty calculations, and finally, perform post-processing [6]. Specifically, the input parameter files are generated by perturbing the input parameters, and the code reads the input files to calculate the responses. Finally, the probability characteristics of the responses are analyzed to draw conclusions. The general process of implementing this method is summarized in this paper [17].

2.1. Sensitivity Calculation Methods

A definition of sensitivity analysis is as follows: the study of how uncertainty in the output of a model (numerical or otherwise) can be apportioned to different sources of uncertainty in the model input [23]. From this, we can derive a mathematical expression for sensitivity.

$$S_{Z_i}^{\sigma }={\displaystyle \frac{{\sigma }_{Z_i}\partial Y}{{\sigma }_Y\partial Z_i}}$$

(1)

where $Y$ represents the model output, $Z_i$ represents the $i$-th input parameter, and $\sigma$ denotes the standard deviation.

In the Risk Analysis Virtual Environment (RAVEN) theory manual, the normalized sensitivity matrix is chosen as the sensitivity coefficients, which are defined as follows [24]:

$$S_{Z_i}^{\sigma }=(\mathsf{\Sigma }(Y,Z)v{c}^{-1}(Z))\times {\displaystyle \frac{E(Z)}{E(Y)}}$$

(2)

where $\mathsf{\Sigma }\left(Y,Z\right)$ is the covariance between $Y$ and $Z$, ${vc}^{-1}\left(Z\right)$ is the inverse of the covariance of the input space, $E\left(Z\right)$ means the expected values of the input space, and $E\left(Y\right)$ represent the expected values of the output space.

2.2. Uncertainty Quantification Methods

The uncertainty quantification process for reactor safety analysis involves several key steps. First, the number of required samples is determined. Then, a sample space is generated. These input samples are propagated through simulations using a reactor system model. The FOMs—such as the core power and temperature—are collected to form statistical distributions. Finally, these distributions are analyzed to quantify the uncertainty.

A sufficient number of samples is required to ensure the confidence level of the uncertainty [3]. The confidence of the response can be determined by nonparametric estimation methods. One of the most commonly used nonparametric estimation methods is Wilks’ method and its improved versions.

According to Wilks’ method [25,26] and its improvements, its formula is as follows [27]:

$$\alpha =1-{\gamma }^N-N(1-\gamma ){\gamma }^{N-1}$$

(3)

where $\alpha$ denote the confidence level, $\mathsf{\gamma }$ indicates the probability, and $N$ represents the minimum number of samples required.

According to Formula (3), achieving uncertainty with 95% probability at a 95% confidence level (the 95/95 level) requires a minimum of approximately 93 sampled calculations. It is evident that an increase in the sample size will lead to a corresponding increase in the reliability of the results. However, this also necessitates the allocation of additional computing resources, which ultimately results in a decline in marginal utility. After comprehensively considering the available options, this paper selected 400 samples using the simple random sampling method.

3. Sensitivity and Uncertainty Analysis Framework

The framework primarily consists of the data analysis code RAVEN, the reactor system safety analysis code RELAP5-TMSR and an automated post-processing module. This section presents an overview of the main components and their interconnections.

3.1. RAVEN

RAVEN was initiated in 2012 and developed by the Idaho National Laboratory (INL) [5]. RAVEN integrates a variety of sampling methods (such as Monte Carlo sampling, stratified sampling, Latin hypercube sampling, etc.), along with common sensitivity calculation methods, data optimization algorithms, and more, to meet different needs, including sensitivity analysis, uncertainty quantification, optimization, and others [5,28].

Therefore, RAVEN can easily propagate the uncertainty of input parameters into the system response and perform sensitivity calculations, data optimization, and other tasks. Naturally, RAVEN was selected as the data analysis component for this framework.

3.2. RELAP5-TMSR

The system analysis code RELAP5-TMSR is an extended version of RELAP5/MOD4.0, which integrates specialized models and methodologies specifically developed for the liquid-fueled molten salt reactor (LF-MSR) [29,30,31]. To improve the accuracy of transient response simulations of the LF-MSR, a one-dimensional delayed neutron precursor (DNP) transport model has been incorporated into the RELAP5-TMSR code. This model was then validated using experimental benchmarks from the MSRE [32].

The neutron balance equation can be expressed in the following form:

$${\displaystyle \frac{dn(t)}{dt}}={\displaystyle \frac{\rho (t)-\beta }{\mathsf{\Lambda }}}n(t)+{\displaystyle {\sum }_{i=1}^6{\lambda }_i}{C}_i(t)$$

(4)

where $n\left(t\right)$ is the neutron density, $C_i$ indicates the quantity of DNPs in the core of group $i$, $\rho \left(t\right)$ is the total reactivity as a function of the time, ${\beta }_i\left(t\right)$ indicates the delayed neutron fraction of group $i$, $\beta$ is the total delayed neutron fraction, $\mathsf{\Lambda }$ is prompt neutron lifetime, and ${\lambda }_i$ indicates the decay constant of group $i$.

The DNPs are in the primary loop in the following form:

$${\displaystyle \frac{\partial C_i}{\partial t}}+{\displaystyle \frac{\partial (C_{i}v)}{\partial x}}={\displaystyle \frac{{\beta }_i}{\mathsf{\Lambda }}}n-{\lambda }_i{C}_i$$

(5)

where $v$ represents the fuel salt flow velocity.

The concentration conservation equation of the DNPs in the external loop is represented as follows:

$${\displaystyle \frac{\partial C_i}{\partial t}}+{\displaystyle \frac{\partial (C_{i}v)}{\partial x}}=-{\lambda }_i{C}_i$$

(6)

Therefore, the coupled point reactor neutron kinetics model, taking into account the impact of 1-D DNP transport, is formulated by the Equations (4)–(6).

In this context, RELAP5-TMSR is used as the physics prediction model in the framework, providing the capability to simulate and predict the thermal-hydraulic and neutronic behavior of LF-MSRs.

3.3. Automated Post-Processing Module

The computational results generated by RAVEN are distributed across multiple files, which complicates centralized result presentation and analysis. To address this issue, this paper developed an automated post-processing module using Python 3.7, tailored to the structure of the RAVEN-generated result files. The module automatically extracts and processes the output data, reorganizes it into new files based on the visualization requirements, and significantly improves the efficiency of the result handling and interpretation.

Additionally, in simpler scenarios, RAVEN functions solely as a sampler (propagating input parameter uncertainties without performing sensitivity calculations). The automated post-processing module is employed to collect the sampling results, followed by basic sensitivity analysis using an external library (e.g., SALib) to rapidly generate the preliminary outcomes.

3.4. Integrated Framework

In terms of reactor safety analysis, one powerful feature of RAVEN is that many system modeling software programs, including RELAP5, can be coupled to RAVEN using various integration approaches [6].

As mentioned, RELAP5-TMSR is an extended version based on RELAP5/MOD4.0. To better monitor the communication between RAVEN and RELAP5, the original application programming interface (API) has been modified to enable efficient interaction between RAVEN and RELAP5-TMSR, with Figure 1 demonstrating the successful data exchange. The data flow between RAVEN and RELAP5-TMSR is illustrated within the dashed box in Figure 2. Subsequently, the sensitivity and uncertainty analysis procedure for the selected model (e.g., MSRE) is translated into RAVEN-compatible XML (eXtensible Markup Language) input files.

The XML file already contains all the process nodes for the sensitivity and uncertainty analysis [28]. Each implementation of a specific step within the sensitivity and uncertainty analysis procedure, as shown in Figure 2, corresponds to a specific node. The main input nodes and their corresponding functionality are summarized in

Table 1. XML file main input nodes and functionality [5].

Node	Functionality
<RunInfo>	Specifies the calculation settings
<Files>	Specifies the files (RELAP5-TMSR input files)
<Samplers>	Specifies the strategies used for sampling and lists the input parameters
<Distributions>	Defines distributions of input parameters
<DataObjects>	Specifies internal data objects used by RAVEN
<Models>	Specifies executable program (RELAP5-TMSR), post-processing analysis model, etc.
<Steps>	Combines other blocks to detail a step in the RAVEN workflow

.

New users only need to make simple modifications to the XML file to start the analysis. The automated post-processing module can automatically filter the data required by the user in advance, significantly lowering the threshold for conducting sensitivity and uncertainty analysis.

4. Description of the MSRE Case

To test the framework’s capabilities, the MSRE was selected as the subject in this paper. This section first provides a brief introduction to the MSRE, followed by a detailed description of its RELAP5-TMSR model, and it concludes with a listing of the sources of uncertainty and FOMs.

4.1. Introduction of MSRE

The MSRE is a small molten salt reactor developed by Oak Ridge National Laboratory (ORNL) to advance civilian molten salt reactor technology. It is categorized as a research reactor with a design power of 10 MW and an actual operating power of 8 MW. The MSRE core consists of graphite rod assemblies, with grooves on the surface of the graphite rods serving as flow channels for the molten salt. In the MSRE, the fuel salt is heated within the core and then circulated by the fuel salt pump to the shell side of the primary heat exchanger. In the primary heat exchanger, heat is transferred to the coolant salt in the secondary loop. After transferring the heat, the fuel salt returns to the core to continue the cycle. The coolant salt from the tube side of the primary heat exchanger flows into the salt-to-air radiator (air-cooled radiator), where it releases its own heat to the outside environment (atmosphere), and is then transported by the coolant salt pump to the tube side of the primary heat exchanger for the next cycle. The flowsheet of the MSRE is presented in Figure 3.

4.2. Modeling of the MSRE

The RELAP5-TMSR model of the MSRE is established based on the design and operational parameters of the MSRE.

Table 2. Thermo-physical properties of different materials in the MSRE [32].

Parameter	Value
Primary (fuel) salt
Density/kg∙m−3	2934−0.668∙T (K)
Thermal conductivity/W∙m−1∙K−1	1.44
Heat capacity/J∙kg−1∙K−1	1983
Dynamic viscosity/mPa∙s	7.44
Secondary (coolant) salt
Density/kg∙m−3	2446−0.711∙T (K)
Thermal conductivity/W∙m−1∙K−1	1.73
Heat capacity/J∙kg−1∙K−1	2146
Dynamic viscosity/mPa∙s	8.30
Graphite
Density/kg∙m−3	1874
Thermal conductivity/W∙m−1∙K−1	53.0
Heat capacity/J∙kg−1∙K−1	1772
INOR-8
Density/kg∙m−3	8775
Thermal conductivity/W∙m−1∙K−1	20.4
Heat capacity/J∙kg−1∙K−1	578

shows the thermo-physical properties of the materials in the MSRE.

Table 3. The MSRE plant parameters [32].

Parameter	Value
Core
Power/MW	8
Flow area of the core/m2	0.327
Core height/m	1.638
Hydraulic diameter/m	0.0158
Heat transfer area in the core/m2	21.54
Primary heat exchanger Shell-side
Fuel salt mass flow/kg∙s−1	168
Flow area/m2	0.09
Hydraulic diameter/m	0.025
Primary heat exchanger Tubes-side
Coolant salt mass flow/kg∙s−1	105
Flow area/m2	0.014
Hydraulic diameter/m	0.014
Heat transfer area/m2	26
Tube thickness/mm	1.067
Salt-to-air radiator
Air mass flow/kg∙s−1	75
Air volume/m3	81
Heat transfer area/m2	65.6
Heat transfer coefficient/W∙m−2∙K−1	240
wall thickness/mm	1.829
Fuel transit time in external primary loop/s	16.7
Total circulation time in the secondary loop/s	21.5

shows the main plant parameters of the MSRE. The neutronic property parameters of U-233 are shown in

Table 4. Neutronics parameters of U-233 [32].

Parameter	Value
Reactivity coefficient of fuel salt αfuel/10−5∙K−1	−11.0
Reactivity of graphite αgraphite/10−5∙K−1	−5.81
Neutron life time Λ/s	0.00040
Effective delayed neutron fraction β/10−5	264
β1/10−5	22.8
β2/10−5	78.8
β3/10−5	66.4
β4/10−5	73.6
β5/10−5	13.6
β6/10−5	8.80
Decay constant λ1/s−1	0.0126
Decay constant λ2/s−1	0.0337
Decay constant λ3/s−1	0.1390
Decay constant λ4/s−1	0.3250
Decay constant λ5/s−1	1.1300
Decay constant λ6/s−1	2.5000

. The RELAP5-TMSR model of the MSRE is shown in Figure 4. More detailed parameters can be found in the cited references [32,34]. In this paper, the third loop model (see the far-right section of Figure 4) is improved, based on the reference papers [32,34], to evaluate the impact of environmental temperature uncertainty on molten salt reactors.

The primary loop consists of a core, an upper and a lower plenum, a fuel salt pipe, a fuel salt pump and a salt-to-salt heat exchanger, as depicted in Figure 4. The core is represented by four channels, with the flow areas corresponding to zones 1 through 4 (as shown in

Table 5. Input parameters [16,17,35,36,37].

Parameter	Nominal Value	Uncertainty	PDF Type
Geometric parameters
Flow area of zone 1/m2	0.0185	1.2%	Normal
Flow area of zone 2/m2	0.0556	3.4%	Normal
Flow area of zone 3/m2	0.0927	5.7%	Normal
Flow area of zone 4/m2	0.1604	9.7%	Normal
Heat transfer area of primary exchanger/m2	26	10.0%	Normal
Heat transfer area of salt-to-air radiator/m2	65.6	10.0%	Normal
Primary heat exchanger tube thickness/mm	1.067	2.0%	Normal
Salt-to-air radiator wall thickness/mm	1.829	2.0%	Normal
Thermo-physical properties
Graphite_k/W∙m−1∙K−1	53	10.0%	Normal
Wall roughness of graphite channels 100/m	1.0 × 10−6	20.0%	Normal
Wall roughness of graphite channels 101/m	1.0 × 10−6	20.0%	Normal
Wall roughness of graphite channels 102/m	1.0 × 10−6	20.0%	Normal
Wall roughness of graphite channels 103/m	1.0 × 10−6	20.0%	Normal
Volumetric heat capacity of graphite (366 K)/J∙m−3∙K−1	2.01 × 106	10.0%	Normal
Volumetric heat capacity of graphite (588 K)/J∙m−3∙K−1	3.01 × 106	10.0%	Normal
Volumetric heat capacity of graphite (922 K)/J∙m−3∙K−1	3.83 × 106	10.0%	Normal
INOR-8_k (300 K)/W∙m−1∙K−1	10.4	2.0%	Normal
INOR-8_k (978 K)/W∙m−1∙K−1	21.8	2.0%	Normal
Volumetric heat capacity of INOR-8 (300 K)/J∙m−3∙K−1	3.66 × 106	10.0%	Normal
Volumetric heat capacity of INOR-8 (978 K)/J∙m−3∙k−1	4.93 × 106	10.0%	Normal
Initial and boundary conditions
Core 100 inlet pressure/Pa	3.79 × 105	5.0%	Normal
Core 100 inlet temperature/K	921.8	1.0%	Normal
Core 101 inlet pressure/Pa	3.79 × 105	5.0%	Normal
Core 101 inlet temperature/K	921.8	1.0%	Normal
Core 102 inlet Pressure/Pa	3.79 × 105	5.0%	Normal
Core 102 inlet temperature/K	921.8	1.0%	Normal
Core 103 inlet Pressure/Pa	3.79 × 105	5.0%	Normal
Core 103 inlet temperature/K	921.8	1.0%	Normal
Fuel mass flow/kg∙s−1/m∙s−1	168	20.0%	Normal
Coolant salt mass flow/kg∙s−1	105	20.0%	Normal
Air mass flow/kg∙s−1	81	10.0%	Normal
Air-cooled radiator inlet temperature/K	311	10.0%	Normal
Neutronics properties
β/Λ	6.6	1.8%	Normal
Decay constant λ1/s−1	0.0126	1.0%	Normal
Decay constant λ2/s−1	0.0337	1.0%	Normal
Decay constant λ3/s−1	0.1390	1.0%	Normal
Decay constant λ4/s−1	0.3250	1.0%	Normal
Decay constant λ5/s−1	1.1300	1.0%	Normal
Decay constant λ6/s−1	2.5000	1.0%	Normal

), which correspond to No. 100 to No. 103. Each channel is divided into 10 nodes.

The secondary loop primarily consists of the salt-to-salt heat exchanger, coolant salt pipes, coolant salt pump, and salt-to-air radiator, all of which are modeled in a manner similar to the primary loop.

The third loop represents the air flow, with the inlet and outlet modeled using the “tmdpvol” (time-dependent volume, TDV) model and “tmdpjun” (time-dependent junctor) models to control the temperature and flow rate of the air entering the radiator. An equivalent assumption is made in the model, where the air flow direction is assumed to be opposite to the molten salt flow direction.

As shown in Figure 4, all the numbers in the box indicate the lump numbers of the RELAP5-TMSR model.

4.3. Source of Uncertainty

As mentioned earlier in this paper, different studies have applied slightly different definitions of uncertainty sources, and they are generally not distinguished in forward uncertainty analysis [8]. Therefore, this paper does not strictly distinguish between them.

In this paper, the sources of uncertainty are divided into four categories [16]: geometric parameters, thermo-physical properties, initial and boundary conditions, and neutronics properties, as shown in Table 5. These parameters are uniformly referred to as input parameters throughout the remainder of this paper. According to the ORNL report and other literature sources, all the input parameters and their uncertainties are listed in Table 5. All the input parameters are assumed to follow a normal distribution. A normal distribution is chosen to reduce the uncertainty of the input parameters when little or no knowledge of them is available.

In Table 5, “Graphite_k” refers to the thermal conductivity of graphite, “Volumetric heat capacity of graphite (366 K)” indicates the volumetric heat capacity of graphite at 366 Kelvin (366 K), and the others follow a similar format. “Core 100 initial temperature” and “Core 100 initial pressure” denote the initial temperature and pressure of Core 100, as shown in Figure 4. “Volumetric heat capacity of graphite (588 K)” is abbreviated to “V-H-C of graphite (588 K)”, and “Volumetric heat capacity of INOR-8 (300 K)” is abbreviated to “V-H-C of INOR-8 (300 K)” in Section 4.

4.4. Figures of Merit of Interest

Since the ORNL report provides experimental data on power under RIA conditions, and given that power is of great significance in reactor safety analysis, power is selected as one of the FOMs. The safety limitations for LF-MSRs primarily consider molten salt solidification and structural material failure. In both the primary and secondary loops, the lowest temperature is typically observed at the molten salt inlet. Naturally, the melting points of the fuel salt and coolant salt are their respective safety limits. However, for a conservative perspective, the liquidus temperature (722 K for fuel salt and 727.6 K for coolant salt) [38] is selected as the safety limit; on the other hand, the highest temperature points are located at the respective outlets. Considering that the structural material is INOR-8, a nickel-base alloy is developed for use in the MSR [39]. Naturally, the highest usage temperature of INOR-8 is considered as the safety limit, and its value is 1003 K [40]. Therefore, the remaining four FOMs are the fuel inlet temperature, the fuel outlet temperature, the coolant inlet temperature, and the coolant outlet temperature.

Table 6. FOMs and corresponding safety limits.

Parameter	Experiment [33]	Nominal	Safety Limit
Power/MW	8	8
Fuel outlet temperature/K	927	930.6	<1003
Fuel inlet temperature/K	905	905.6	>722
Coolant outlet temperature/K	853	857.6	<1003
Coolant inlet temperature/K	819	825.4	>727.6

lists all the output parameters, along with their corresponding safety limits and nominal values.

5. Results and Discussion

In this section, based on the above framework, sensitivity and uncertainty analyses are carried out for the accident scenario, namely, the reactivity insertion accident (RIA). The initial conditions for simulating the aforementioned accident scenario are based on the MSRE operating at a steady-state power level of 8 MW, with U-233 fuel loaded.

5.1. Steady-State Conditions

Before performing an uncertainty and sensitivity analysis, it is necessary to verify whether the model calculation is accurate and reliable. The nominal values of the RELAP5-TMSR predictions, without considering the uncertainty inputs, and the experimental values are listed in Table 6 [33]. Overall, there is little difference between them, so the RELAP5-TMSR predictions can achieve an overall good agreement with the experiment, which verifies the correctness of our model.

As all the accident scenarios analyzed in this study originate from steady-state conditions, the uncertainty and sensitivity analysis results for the steady-state scenario are presented first.

The power distribution is depicted in Figure 5a. The sample mean is calculated as 7.96 MW, slightly lower than the nominal value of 8 MW, with an uncertainty of 1.17 MW.

Figure 5b,c display the fuel temperatures in the primary loop as histogram plots. For the fuel outlet temperature, the sample mean is 931.20 K, slightly higher than the nominal value of 930.6 K, with an uncertainty of 3.47 K. Meanwhile, for the fuel inlet temperature, the sample mean is 904.63 K, slightly lower than the nominal value of 905.6 K, with an uncertainty of 6.6 K.

Figure 5d,e present the coolant salt temperatures in the secondary loop as histogram plots. For the coolant outlet temperature, the sample mean is 855.14 K, slightly lower than the nominal value of 857.6 K, with an uncertainty of 16.78 K. Similarly, for the coolant inlet temperature, the sample mean is 824.06 K, marginally lower than the nominal value of 825.4 K, with an uncertainty of 19.67 K.

Table 7. Nominal and sample mean and uncertainty.

Parameter	Nominal	Mean	Difference	Uncertainty
Power/MW	8	7.96	0.04	1.17
Fuel outlet temperature/K	930.6	931.20	−0.6	3.47
Fuel inlet temperature/K	905.6	904.63	0.97	6.60
Coolant outlet temperature/K	857.6	855.14	2.46	16.78
Coolant inlet temperature/K	825.4	824.06	1.34	19.67

summarizes the nominal value, sample mean, difference, and uncertainty for the FOMs.

The uncertainties of all the FOMs envelop their corresponding experimental values, indicating that the calculations are reasonable. Even when accounting for uncertainties, the fuel salt outlet temperature (maximum: 933.2 K), fuel salt inlet temperature (minimum: 900.5 K), coolant salt outlet temperature (minimum: 862.6 K), and coolant salt inlet temperature (minimum: 814.8 K) remain within their respective safety limits. This outcome aligns with expectations, considering that the MSRE is a research reactor. Additionally, due to the direct propagation of the boundary condition-related uncertainties to the coolant salt in the secondary loop, the uncertainty of the coolant salt temperatures is greater than that of the fuel salt temperatures.

Figure 6 illustrates the sensitivity coefficients for the FOMs under steady-state conditions. Each subplot, from left to right, represents the sensitivity coefficients corresponding to a specific response. A red bar signifies that a positive change in the parameter value results in an increase in the output parameter, indicating a directly proportional relationship, whereas a green bar denotes an inversely proportional relationship, where an increase in the parameter leads to a decrease in the output parameter.

The sensitivity coefficients for the core power are illustrated in Figure 6a. Certain input parameters exhibit considerably higher sensitivity, as listed in descending order of influence:

(1)

decay constant λ₄ (negative sign),

(2)

core 102 inlet temperature (negative sign),

(3)

heat transfer area of radiator (positive sign),

(4)

air mass flow (positive sign),

(5)

decay constant λ₂ (positive sign).

The influence of the decay constants corresponding to different groups on the FOMs requires consideration of the distribution of the DNP concentrations and the molten salt circulation time within the primary loop. Therefore, only the sensitivity analysis results are provided in this paper. Additionally, given the similarity of subsequent sections, further explanation is omitted.

The selection of initial temperature values (e.g., “core 102 inlet temperature”) is subjective and depends on the model assumptions, modeling methods, and numerical calculations. The results in Figure 6 show that these inputs significantly impact the uncertainty of the FOMs. Therefore, it is crucial to clearly state their potential impact when reporting the uncertainty analysis results. Such a practice may enhance the transparency and credibility of the analysis, while reducing the influence of the user effect on the FOMs to a certain extent.

The reactor power is significantly impacted by the heat dissipation capacity of the salt-to-air radiator. Specifically, parameters like the radiator’s heat transfer area and air mass flow rate, which directly govern the radiator’s cooling efficiency, exhibit the highest sensitivity to the reactor power, consistent with theoretical expectations.

The sensitivity coefficients for the fuel temperature are presented in Figure 6b,c. For the fuel outlet temperature, certain input parameters exhibit considerably higher sensitivity, as listed in descending order of influence:

(1)

core 101 inlet temperature (positive sign),

(2)

decay constant λ₂ (negative sign),

(3)

core 103 inlet temperature (positive sign),

(4)

decay constant λ₅ (positive sign),

(5)

fuel mass flow (negative sign).

Analogously, for the fuel inlet temperature, certain input parameters exhibit considerably higher sensitivity, as listed in descending order of influence:

(1)

decay constant λ₄ (positive sign),

(2)

decay constant λ₂ (positive sign),

(3)

decay constant λ₃ (negative sign),

(4)

core 102 inlet temperature (negative sign),

(5)

decay constant λ₁ (negative sign).

As illustrated in Figure 6b, the results indicate that the uncertainty of the fuel outlet temperatures is significantly influenced by the “101 inlet temperature” and “core 103 inlet temperature”. The significance of this impact has been discussed earlier and will not be reiterated here. In the MSRE, the fuel salt cycle time and the DNP decay constants jointly influence the DNP distribution within the loop, resulting in higher concentrations for certain groups. Consequently, decay constants λ₂ and λ₅ play a significant role in contributing to the fuel outlet temperature.

As shown in Figure 6c, the sensitivity coefficients associated with the DNP exhibit opposite signs to those in the second subplot, indicating that they have opposite effects on the fuel inlet and outlet temperatures.

The different distribution of the sensitivity coefficients in Figure 6b,c also explains the differences in the uncertainties of the fuel outlet and fuel inlet temperatures. In other words, since the sensitivity coefficients in Figure 6c are larger than those in Figure 6b, the uncertainty of the fuel inlet temperature is also greater.

The sensitivity coefficients for the coolant temperature are presented in Figure 6d,e. For the coolant outlet temperature, certain input parameters exhibit considerably higher sensitivity, as listed in descending order of influence:

(1)

decay constant λ₄ (positive sign),

(2)

exchanger tube thickness (positive sign),

(3)

core 102 inlet temperature (negative sign),

(4)

decay constant λ₂ (positive sign),

(5)

core 101 inlet temperature (negative sign)

Analogously, for the coolant inlet temperature, certain input parameters exhibit considerably higher sensitivity, as listed in descending order of influence:

(1)

decay constant λ₄ (positive sign),

(2)

core 102 inlet temperature (positive sign),

(3)

exchanger tube thickness (positive sign),

(4)

decay constant λ₁ (positive sign),

(5)

heat transfer area of radiator (positive sign).

As mentioned above, the decay constant is positively correlated with the fuel temperature, as shown in Figure 6d, and this also applies to the coolant salt. The uncertainty of the exchanger tube thickness is positively correlated with the coolant salt temperature. This is because increasing the wall thickness essentially increases the heat exchange area. Additionally, “102 inlet temperature” significantly impacts the uncertainty of the coolant outlet temperatures, as previously noted, so it will not be repeated here. The results in Figure 6e are similar to those in Figure 6d.

From the subplots Figure 6b–e, it can be observed that the “red” gradually increases, indicating that the coolant salt temperature is more sensitive to the uncertainty of the input parameters. This is why the uncertainty of the coolant salt temperature is greater than that of the fuel salt temperature (see Table 7).

5.2. The Reactivity Insertion Accident (RIA)

The RIA scenario is supported by experimental data from the ORNL, making it a credible and applicable case for MSR design and safety evaluation. Based on the ORNL report, this paper investigates the transients introduced by reactivity (step introduction of 13.9 pcm). The sensitivity of the input parameters to the response is examined, and the uncertainty of the FOMs under transient conditions is assessed. The main purpose is to identify the key parameters that affect the MSRE security, enhance comprehension of the MSRE transient phenomenon, and also confirm the safety margins of the MSRE during RIA conditions.

The uncertainties of all the FOMs are presented in Figure 7. Each uncertainty band consists of 400 curves. Nominal values and sample means are provided in each figure. Specifically, the experimental data for the power distribution are presented in Figure 7a.

In Figure 7a, the uncertainty band completely encompasses the experimental value, sample mean and normal value. All the curves exhibit an approximate bell-shaped distribution around the mean value, indicating a denser distribution closer to the center. This suggests that the selection of input parameters is both reasonable and acceptable. The maximum uncertainty is 1.27 MW, which occurs 2.5 s after the accident, stabilizes at 1.19 MW after 40 s, marginally exceeding the steady-state value of 1.17 MW.

As shown in Figure 7b,c, the uncertainty band of the fuel temperatures exhibits a pattern similar to that of the power distribution. In Figure 7b, the fuel outlet temperature reaches its maximum value approximately 10 s after the accident, with a maximum temperature of 934.8 K (considering the effect of uncertainty), which is well below the safety limit of 1003 K. Moreover, the uncertainty band for the fuel outlet temperature stabilizes at 3.47 K.

As shown in Figure 7c, the results for the fuel inlet temperature show a pattern similar to that of the fuel outlet temperature. However, its lowest temperature is 900.4 K, which is well above the safety limit of 722 K. Similar to the uncertainty band for the fuel outlet temperature, the uncertainty band for the fuel inlet temperature stabilizes at 6.60 K.

In Figure 7d,e, the uncertainty band of the coolant temperatures is similar to the uncertainty of the fuel temperatures. The primary difference is that the coolant salt temperature is almost unaffected by the RIA. Therefore, the uncertainty band of the coolant temperatures shows almost no change compared to the steady state. The uncertainty results are consistent with those observed during steady-state conditions.

In the RIA condition, the fuel outlet temperature increases by 2 K (nominal value), and the fuel inlet temperature increases by 0.7 K (nominal value). The increase in the coolant temperatures is very small, less than 0.2 K. After integrating the uncertainty analysis results, all the temperatures remain within safety limits.

Finally,

Table 8. Summary of the FOM values at the time of maximum uncertainty under RIA conditions.

Parameter	Time (s)	Nominal	Mean	Max	Min	Uncertainty
Power/MW	2.5	8.82	8.77	9.45	8.18	1.27
Fuel outlet temperature/K	10	932.2	932.8	934.80	931.33	3.47
Fuel inlet temperature/K	20	905.7	904.6	907	900.40	6.6
Coolant outlet temperature/K	30	857.8	855.16	862.6	845.82	16.78
Coolant inlet temperature/K	30	825.6	824.1	834.5	814.83	19.67

presents a summary of the FOM values at the time of maximum uncertainty under RIA conditions.

The sensitivity coefficient in an accident scenario is time-dependent and thus varies over time after the accident. For a short period following the accident, the impact of the accident itself dominates the perturbation due to the input parameter uncertainties. Therefore, the sensitivity analysis results are derived from the moment of maximum uncertainty on the curve of the selected sensitivity coefficients.

The sensitivity coefficients for the core power in the RIA are illustrated in Figure 8a. Certain input parameters exhibit considerably higher sensitivity, as listed in descending order of influence:

(1)

decay constant λ₄ (negative sign),

(2)

core 102 inlet temperature (negative sign),

(3)

heat transfer area of radiator (positive sign),

(4)

decay constant λ₂ (positive sign),

(5)

air mass flow (positive sign).

The sensitivity coefficients for the fuel temperature are presented in Figure 8b,c. For the fuel outlet temperature, certain input parameters exhibit considerably higher sensitivity, as listed in descending order of influence:

(1)

core 101 inlet temperature (positive sign),

(2)

core 103 inlet temperature (positive sign),

(3)

decay constant λ₂ (negative sign),

(4)

decay constant λ₅ (negative sign),

(5)

fuel mass flow (negative sign).

Analogously, for the fuel inlet temperature, certain input parameters exhibit considerably higher sensitivity, as listed in descending order of influence:

(1)

decay constant λ₂ (positive sign),

(2)

decay constant λ₄ (positive sign),

(3)

decay constant λ₃ (positive sign),

(4)

core 102 inlet temperature (positive sign),

(5)

fuel mass flow (positive sign).

The sensitivity coefficients for coolant temperature are presented in Figure 8d,e. For the coolant outlet temperature, certain input parameters exhibit considerably higher sensitivity, as listed in descending order of influence:

(1)

decay constant λ₄ (positive sign),

(2)

exchanger tube thickness (positive sign),

(3)

core 102 inlet temperature (positive sign),

(4)

decay constant λ₂ (positive sign),

(5)

core 101 inlet temperature (negative sign).

Analogously, for the coolant inlet temperature, certain input parameters exhibit considerably higher sensitivity, as listed in descending order of influence:

(1)

decay constant λ₄ (positive sign),

(2)

core 102 inlet temperature (positive sign),

(3)

exchanger tube thickness (positive sign),

(4)

decay constant λ₁ (positive sign),

(5)

heat transfer area of radiator (negative sign).

A comparison of Figure 6 and Figure 8 reveals that the distribution of the sensitivity coefficients has remained largely unchanged. After an RIA, the reactor quickly stabilizes to a new steady-state condition that closely resembles the original one.

5.3. The Station Blackout (SBO)

The SBO scenario is widely recognized for its relevance and importance in evaluating reactor behavior under severe transient conditions, particularly for licensing and safety assessments. Since no nuclear power plants currently utilize molten salt reactors as nuclear islands, the SBO scenario specifically refers to the loss of the off-site power supply to the MSRE without any subsequent corrective actions being taken. More specifically, this involves simultaneous trips of the fuel salt pump, the coolant salt pump, and the air radiator fan. To simplify the scenario, it is assumed that the air radiator damper remains open. Under these conditions, uncertainties related to the fuel mass flow, coolant salt mass flow, and air mass flow are not considered.

Figure 9a displays the uncertainty of the power during an SBO accident. Following the incident, the core power initially drops rapidly within the first 100 s, experiences a slight increase, then gradually decreases again, and finally stabilizes after 1000 s. The uncertainty in the power first increases, then decreases, and eventually stabilizes, with the maximum uncertainty reaching 0.51 MW.

Figure 9b shows the uncertainty of the fuel outlet temperature. As shown in Figure 9b, after the accident, the fuel outlet temperature increases rapidly and reaches the highest temperature point, then drops from the highest temperature to a high temperature “platform”, and then slowly drops to the initial temperature. The highest temperatures without and considering the uncertainty are 945.6 K and 947.1 K, respectively, where the former is slightly lower than the latter by 1.5 K, and neither is higher than the safety limit. The maximum uncertainty observed is 6.1 K, occurring 298 s after the accident.

Figure 9c displays the uncertainty of the fuel inlet temperature. The temperature initially rises rapidly to a peak, then quickly declines to a minimum, and finally stabilizes near the fuel outlet temperature. The minimum temperatures recorded are 893.2 K when not considering uncertainty and 883 K when uncertainty is accounted for, with the latter being approximately 10 K lower. Both temperatures remain above the safety limit. The maximum uncertainty observed is around 20 K, occurring approximately 59.5 s after the accident.

Figure 9d shows the uncertainty of the coolant outlet temperature. After the accident, the coolant temperature first rises rapidly, and then rises relatively steadily to reach close to the fuel outlet temperature. From Figure 9d, without and with considering the uncertainty, the maximum value of the coolant outlet temperature is about 929.9 K (at 1000 s) and 932.6 K (700 s), and neither is higher than the safety limit. The maximum uncertainty is about 22 K (about 50.5 s after the accident).

Figure 9e shows the uncertainty of the coolant inlet temperature. After the accident, the coolant temperature first rises rapidly, and then rises relatively steadily to reach close to the coolant outlet temperature. From Figure 9e, without considering the uncertainty and considering uncertainty, the maximum value of the cooling salt inlet temperature is about 927.72 K (at 1000 s) and 932.4 K (at 800 s), and neither is higher than the safety limit. The maximum uncertainty is about 42 K (about 10.5 s after the accident).

Finally,

Table 9. Summary of the FOM values at the time of maximum uncertainty under SBO conditions.

Parameter	Time (s)	Nominal	Mean	Max	Min	Uncertainty
Power/MW	400	0.67	0.68	0.96	0.45	0.51
Fuel outlet temperature/K	298	940.5	940.6	943.7	937.6	6.1
Fuel inlet temperature/K	59.5	893	892.8	903.2	883.2	20
Coolant outlet temperature/K	50.5	876	875	887.4	865.4	22
Coolant inlet temperature/K	10.5	841	840	861.6	819.6	42

provides a summary of the FOM values at the time of maximum uncertainty under SBO conditions.

The sensitivity coefficients for the core power under SBO conditions are illustrated in Figure 10a. Certain input parameters exhibit considerably higher sensitivity, as listed in descending order of influence:

(1)

heat transfer area of radiator (positive sign),

(2)

decay constant λ₆ (negative sign),

(3)

core 102 inlet temperature (positive sign),

(4)

decay constant λ₄ (positive sign)

(5)

V-H-C of INOR-8 (300 K) (positive sign).

The heat transfer area of the radiator is positively correlated with the power, as the heat dissipation of the air radiator primarily depends on this area. Additionally, the volumetric heat capacity (V-H-C) of INOR-8 at 300 K exhibits a greater sensitivity to power changes.

The sensitivity coefficients for the fuel temperature are presented in Figure 10b,c. For the fuel outlet temperature, certain input parameters exhibit considerably higher sensitivity, as listed in descending order of influence:

(1)

core 102 inlet temperature (positive sign),

(2)

heat transfer area of radiator (positive sign),

(3)

decay constant λ₆ (negative sign),

(4)

V-H-C of INOR-8 (300 K) (positive sign),

(5)

radiator wall thickness (negative sign).

Analogously, for the fuel inlet temperature, certain input parameters exhibit considerably higher sensitivity, as listed in descending order of influence:

(1)

heat transfer area of radiator (negative sign),

(2)

core 101 inlet temperature (positive sign),

(3)

core 103 inlet temperature (positive sign),

(4)

decay constant λ₄ (negative sign),

(5)

decay constant λ₁ (negative sign).

The sensitivity coefficients for the coolant temperature are presented in Figure 10d,e. For the coolant outlet temperature, certain input parameters exhibit considerably higher sensitivity, as listed in descending order of influence:

(1)

heat transfer area of radiator (negative sign),

(2)

core 101 inlet temperature (positive sign),

(3)

decay constant λ₄ (negative sign),

(4)

core 103 inlet temperature (positive sign),

(5)

V-H-C of INOR-8 (300 K) (negative sign).

Analogously, for the coolant inlet temperature, certain input parameters exhibit considerably higher sensitivity, as listed in descending order of influence:

(1)

heat transfer area of radiator (negative sign),

(2)

core 101 inlet temperature (positive sign),

(3)

decay constant λ₆ (positive sign),

(4)

decay constant λ₄ (negative sign),

(5)

V-H-C of INOR-8 (300 K) (negative sign).

In this accident scenario, the heat transfer area of the radiator plays a dominant role in the heat removal from the MSRE, resulting in it having the largest sensitivity coefficient, aligning with our expectations. Moreover, beyond the common input parameters previously mentioned, we also discovered that the output parameters are particularly sensitive to the V-H-C of INOR-8.

6. Conclusions

The identification and quantification of uncertainties are of great importance in reactor design, safety assessment and related disciplines. To comprehensively analyze the uncertainties, a sensitivity and uncertainty analysis framework was established by coupling the RAVEN platform with the system analyze code RELAP5-TMSR and an automated post-processing module. All the steps in the sensitivity and uncertainty analysis procedure are encapsulated within this framework, which endows it with comprehensive applicability, operational flexibility, and full-process automation. Compared with existing methods, this framework significantly lowers the technical threshold for conducting sensitivity and uncertainty analyses, while substantially reducing the manual workload for researchers.

To test the capabilities of the framework, the MSRE was selected as the subject in this study. Two scenarios, including RIA and SBO, were modeled and analyzed without a control system. Sensitivity and uncertainty analyses were conducted and the results were evaluated against safety limits. The results show that for input parameters with large sensitivity (e.g., primary exchanger design parameters, air radiator design parameters, initial temperature values, delayed neutron parameters, and the volumetric heat capacity of INOR-8 alloy), a straightforward ranking of the sensitivity coefficients across different operating conditions reveals similar degrees of sensitivity, although their signs vary across different conditions. Conversely, input parameters with very small sensitivity coefficients are found to have negligible impacts on the FOMs under all the conditions. Consequently, these parameters can be excluded from subsequent sensitivity and uncertainty analyses. The findings of this study contribute to a deeper understanding of the evolution of transient conditions in MSRs. The ranking of the sensitivity coefficients can provide crucial screening criteria for key parameters in the future design optimization and safety analysis of molten salt reactors (MSRs).

By combining these uncertainties with nominal values and comparing them against safety limits, the probability of exceeding the safety limits was assessed. The results of the uncertainty analysis are as follows:

• Under RIA conditions, the power uncertainty band fully encompasses the experimental results, further demonstrating that the selection of input parameter uncertainties is reasonable.
• During both RIA and SBO conditions, all the FOMs remain within their respective safety limits. This observation aligns with empirical operational data from the MSRE, further validating the inherent safety characteristics of molten salt reactor designs.

The sensitivity and uncertainty analysis framework developed in this paper provides an effective tool for evaluating both sensitivity and uncertainty in MSRs under various accident conditions. This comparative study of three typical operational conditions—steady state, reactivity RIA, and SBO—reveals minor variations in the sensitivity coefficients across different accident scenarios. Consequently, it offers critical support for MSR design optimization and safety assessment.