The system code TRACE is the latest development of the U.S. Nuclear Regulatory Commission (US NRC). TRACE, developed for the analysis of operational conditions, transients and accidents of light water reactors (LWR), is a best-estimate code with two fluid, six equation models for mass, energy, and momentum conservation, and related closure models. Since TRACE is mainly applied to LWR specific issues, the validation process related to innovative nuclear systems (liquid metal cooled systems, systems operated with supercritical water, etc.) is very limited, almost not existing. In this work, essential contribution to the validation of TRACE related to lead and lead alloy cooled systems as well as systems operated with supercritical water is provided in a consistent and corporate way. In a first step, model discrepancies of the TRACE source code were removed. This inconsistencies caused the wrong prediction of the thermo physical properties of supercritical water and lead bismuth eutectic, and hence the incorrect prediction of heat transfer relevant characteristic numbers like Reynolds or Prandtl number. In addition to the correction of the models to predict these quantities, models describing the thermo physical properties of lead and Diphyl THT (synthetic heat transfer medium) were implemented. Several experiments and numerical benchmarks were used to validate the modified TRACE version. These experiments, mainly focused on wall-to-fluid heat transfer, revealed that not only the thermo physical properties are afflicted with inconsistencies but also the heat transfer models. The models for the heat transfer to liquid metals were enhanced in a way that the code can now distinguish between pipe and bundle flow by using the right correlation. The heat transfer to supercritical water was not existing in TRACE up to now. Completely new routines were implemented to overcome that issue. The comparison of the calculations to the experiments showed, on one hand, the necessity of these changes and, on the other hand, the success of the new implemented routines and functions. The predictions using the modified TRACE version were close to the experimental data. After validating the modified TRACE version, two design studies related to the Generation IV International Forum (GIF) were investigated. In the first one, a core of a lead-cooled fast reactor (LFR) was analyzed. To include the interaction between the thermal hydraulic and the neutron kinetic due to temperature and density changes, the TRACE code was coupled to the program system ERANOS2.1. The results gained with that coupled system are in accordance with theory and helped to identify sub-assemblies with the highest loads concerning fuel and cladding temperature. The second design which was investigated was the High Performance Light Water Reactor (HPLWR). Since the design of the HPLWR is not finalized, optimization of vital parameters (power, mass flow rate, etc.) are still ongoing. Since most of the parameters are affecting each other, an uncertainty and sensitivity analysis was performed. The uncertainty analysis showed the upper and lower boundaries of selected parameters, which are of importance from the safety point of view (e.g., fuel and cladding temperature, moderator temperature). The sensitivity study identified the most relevant parameters and their influence on the whole system.

The system code TRACE is the latest development of the U.S. Nuclear Regulatory Commission (US NRC). TRACE, developed for the analysis of operational conditions, transients and accidents of light water reactors (LWR), is a best-estimate code with two fluid, six equation models for mass, energy, and momentum conservation, and related closure models. Since TRACE is mainly applied to LWR specific issues, the validation process related to innovative nuclear systems (liquid metal cooled systems, systems operated with supercritical water, etc.) is very limited, almost not existing. In this work, essential contribution to the validation of TRACE related to lead and lead alloy cooled systems as well as systems operated with supercritical water is provided in a consistent and corporate way. In a first step, model discrepancies of the TRACE source code were removed. This inconsistencies caused the wrong prediction of the thermo physical properties of supercritical water and lead bismuth eutectic, and hence the incorrect prediction of heat transfer relevant characteristic numbers like Reynolds or Prandtl number. In addition to the correction of the models to predict these quantities, models describing the thermo physical properties of lead and Diphyl THT (synthetic heat transfer medium) were implemented. Several experiments and numerical benchmarks were used to validate the modified TRACE version. These experiments, mainly focused on wall-to-fluid heat transfer, revealed that not only the thermo physical properties are afflicted with inconsistencies but also the heat transfer models. The models for the heat transfer to liquid metals were enhanced in a way that the code can now distinguish between pipe and bundle flow by using the right correlation. The heat transfer to supercritical water was not existing in TRACE up to now. Completely new routines were implemented to overcome that issue. The comparison of the calculations to the experiments showed, on one hand, the necessity of these changes and, on the other hand, the success of the new implemented routines and functions. The predictions using the modified TRACE version were close to the experimental data. After validating the modified TRACE version, two design studies related to the Generation IV International Forum (GIF) were investigated. In the first one, a core of a lead-cooled fast reactor (LFR) was analyzed. To include the interaction between the thermal hydraulic and the neutron kinetic due to temperature and density changes, the TRACE code was coupled to the program system ERANOS2.1. The results gained with that coupled system are in accordance with theory and helped to identify sub-assemblies with the highest loads concerning fuel and cladding temperature. The second design which was investigated was the High Performance Light Water Reactor (HPLWR). Since the design of the HPLWR is not finalized, optimization of vital parameters (power, mass flow rate, etc.) are still ongoing. Since most of the parameters are affecting each other, an uncertainty and sensitivity analysis was performed. The uncertainty analysis showed the upper and lower boundaries of selected parameters, which are of importance from the safety point of view (e.g., fuel and cladding temperature, moderator temperature). The sensitivity study identified the most relevant parameters and their influence on the whole system.

Nukleare Brennelemente werden nach ihrem Betrieb mehrere Jahre in Nasslagerbecken gelagert, wo ihre Nachzerfallswärme durch elektrisch betriebene Kühlsysteme abgeführt wird. Bei Ausfall der Stromversorgung droht eine Überhitzung der Brennelemente und im schlimmsten Fall die Schädigung der Brennstabhüllen und der Austritt von radioaktivem Material in die Umwelt. Im Mittelpunkt der vorliegenden Dissertation steht die Untersuchung des komplexen Zusammenspiels von Strömung und Wärmetransport bei solch einem angenommenen Unfall, der zu teilweise freigelegten Brennelementen führt. Eine Auswertung des aktuellen Forschungsstandes verdeutlicht, dass die zugrundeliegenden physikalischen Prozesse zwar theoretisch verstanden sind, aber bisher keine speziellen Simulationsprogramme zur präzisen Vorhersage der Temperaturverteilung für mögliche Unfallszenarien existieren. Für die detaillierte Analyse der Vorgänge werden deshalb erstmals numerische Strömungssimulationen unter Berücksichtigung der exakten Geometrie und aller relevanten Wärmetransportmechanismen für ein teilweise freigelegtes Brennelement durchgeführt. Zur Gewährleistung eines praktikablen Rechenaufwands wird der instationäre Verdampfungsvorgang in mehrere, eigenständige Simulationen mit stationären Randbedingungen und jeweils konstantem Füllstand unterteilt. Die Validierung mit experimentellen Daten zeigt, dass dieser Ansatz bei niedriger Nachzerfallsleistung geeignet ist, um die Stabtemperaturen mit ausreichender Genauigkeit vorherzusagen. Durch eine umfassende Sensitivitätsanalyse wird darüber hinaus der Einfluss zahlreicher unsicherer Faktoren auf die Temperaturverteilung und Zusammensetzung im Brennelement untersucht, der sich rein auf Grundlage des Experiments nicht beurteilen lässt. Die Simulationsergebnisse zeigen, dass die maximale Stabtemperatur hauptsächlich vom Füllstand und der Leistung der Brennstäbe abhängt. Eine horizontal gerichtete Luftströmung oberhalb des Brennelements führt insgesamt zu einem Temperaturgefälle in Strömungsrichtung innerhalb des Brennelements. Die Ursache dafür ist ein charakteristisches Strömungsfeld, bei dem kaltes Gas an der stromabwärts gelegenen Wand des Brennelements nach unten und heißes Gas an der stromaufwärts gelegenen Wand nach oben befördert wird. Die alleinige Variation der Geschwindigkeit der Luftströmung bewirkt jedoch keine nennenswerte Änderung der maximalen Stabtemperatur. Erst durch die Verwendung realitätsnaher Randbedingungen für Geschwindigkeit, Temperatur und Zusammensetzung, die aus großskaligen Simulationen des gesamten Lagerbeckens gewonnen wurden, wird der Einfluss der Querströmung auf die Temperaturverteilung im Brennelement deutlich. Bedingt durch das Verhältnis aus Auftriebs- zu Trägheitskräften, steigt die Temperatur im Brennelement bei einer Kombination aus geringer Temperatur, geringem Dampfmassenanteil und hoher Geschwindigkeit der Querströmung signifikant an. Diese Ergebnisse ermöglichen die Ableitung gezielter Beladungsstrategien von Lagerbecken, sofern die Randbedingungen oberhalb der Brennelemente hinreichend genau bekannt sind bzw. vorhergesagt werden können. Im letzten Schritt wird eine Methode zur skalenübergreifenden Modellierung eines Lagerbeckenbereichs vorgestellt. Durch die Kopplung zweier Modellierungsansätze wird eine teilweise geometrieauflösende Simulation ermöglicht, bei der das zentrale Brennelement geometrisch aufgelöst und die benachbarten Brennelemente als poröse Körper modelliert werden. Diese Vorgehensweise verbessert die Übertragbarkeit der Ergebnisse auf ein ganzes Lagerbecken, weil die Auswertung im geometrisch aufgelösten Brennelement unabhängiger von den mit Unsicherheit behafteten Randbedingungen wird.:1 Einleitung 1 1.1 Chancen und Risiken der Kernenergienutzung 1 1.2 Randbedingungen für den Wärme- und Stofftransport im Lagerbecken 3 1.2.1 Zerfallsleistung 3 1.2.2 Brennelement-Typ und Aufbau 4 1.2.3 Wärmetransportmechanismen 6 1.2.4 Verdampfungsrate 8 1.2.5 Grenztemperaturen 9 1.3 Simulation des Wärme- und Stofftransports im Lagerbecken 10 1.3.1 Das Lagerbecken als Multiskalenproblem 10 1.3.2 Systemcodes und Codes für schwere Störfälle 12 1.3.3 CFD-Simulation mit Brennelementen als poröse Körper 13 1.3.4 Geometrieauflösende CFD-Simulation 15 1.4 Zielstellung und Aufbau der Arbeit 16 2 Modell für ein ausdampfendes Brennelement 19 2.1 Vorbetrachtungen 19 2.1.1 Strömungsform 19 2.1.2 Form des Wärmeübergangs 22 2.2 Physikalische Modellierung 23 2.2.1 Simulationsstrategie 23 2.2.2 Physikalische Modellgleichungen 24 2.2.3 Rechengebiet und Randbedingungen 27 2.3 Numerische Modellierung 32 2.3.1 Örtliche Diskretisierung 32 2.3.2 Zeitliche Diskretisierung 34 3 Sensitivitätsanalyse für ein ausdampfendes Brennelement 37 3.1 Vorgehensweise 37 3.2 Einfluss der Strahlungsmodellierung 39 3.2.1 Motivation 39 3.2.2 Bestimmung des Absorptionskoeffzienten 40 3.2.3 Einfluss der Gasstrahlung 41 3.2.4 Einfluss der numerischen Parameter 44 3.3 Einfluss unsicherer Randbedingungen 46 3.3.1 Wärmeverlust über die Isolierschicht 46 3.3.2 Verteilung des Dampfmassenstroms an der Wasseroberfläche 51 3.4 Einfluss der effektiv freigelegten Länge der Heizstäbe 56 3.5 Einfluss der Stableistung 58 4 Wechselwirkung zwischen Querüberströmung und Wärmetransport im Brennelement 63 4.1 Rechengebiet und Randbedingungen 63 4.2 Physikalische und numerische Modellierung 65 4.2.1 Physikalische Modellierung 65 4.2.2 Numerische Einstellungen 67 4.3 Ergebnisse und Diskussion 67 4.3.1 Generelles Vorgehen 67 4.3.2 Temperaturentwicklung und Strömung im Stabbereich 69 4.3.3 Temperatur und Strömung im Überströmkanal 75 5 Ansätze zur skalenübergreifenden Modellierung eines Lagerbeckens 81 5.1 Einordnung 81 5.2 Co-Simulation des Wärme- und Stoffaustauschs zwischen Einzelbrennelement und Lagerbeckenatmosphäre 81 5.2.1 Konfiguration 81 5.2.2 Einfluss der Konvektionsströmung oberhalb der Brennelemente 86 5.3 Gekoppelte Simulation eines Lagerbeckenbereichs 92 5.3.1 Motivation 92 5.3.2 Parametrierung des porösen Körpers 92 5.3.3 Vergleich der Simulationsansätze 94 5.3.4 Simulation der Brennelement-Gruppe 96 6 Zusammenfassung und Ausblick 101 Literaturverzeichnis 115 Symbol- und Abkürzungsverzeichnis 119 / After their operation, spent nuclear fuel assemblies are stored for several years in wet storage pools, where their decay heat is removed by electrically operated cooling systems. If the power supply fails, this poses the risk of overheating of the fuel assemblies and, in the worst case, damage to the fuel rod cladding and the release of radioactive material into the environment. This dissertation focuses on the investigation of the complex interaction of flow and heat transport in such an assumed accident, which leads to partially uncovered fuel assemblies. A review of the current state of research illustrates that although the underlying physical processes are theoretically understood, no specific simulation programmes exist to date to accurately predict the temperature distribution for possible accident scenarios. For the detailed analysis of the processes, numerical flow simulations taking into account the exact geometry and all relevant heat transport mechanisms are therefore carried out for a partially uncovered fuel assembly for the first time. To ensure a manageable computational effort, the transient evaporation process is subdivided into several, independent simulations with steady boundary conditions and a constant water level in each case. The validation with experimental data shows that this approach is suitable for predicting the rod temperatures with sufficient accuracy for low decay heat. A comprehensive sensitivity analysis also identifies the influence of numerous uncertain factors on the temperature distribution and composition in the fuel assembly, which cannot be assessed purely on the basis of the experiment. The simulation results show that the maximum rod temperature depends mainly on the water level and the power of the fuel rods. A horizontally directed air flow above the fuel assembly leads to an overall temperature gradient in the flow direction within the fuel assembly. This is caused by a characteristic flow field in which cold gas is transported down the downstream wall of the fuel assembly and hot gas is transported up the upstream wall. However, varying the velocity of the airflow alone does not cause a significant change in the maximum rod temperature. The influence of the crossflow on the temperature distribution in the fuel assembly only becomes clear by using realistic boundary conditions for velocity, temperature and composition, obtained from large-scale simulations of the entire storage pool. Determined by the ratio of buoyant to inertial forces, the temperature in the fuel assembly increases significantly with a combination of low temperature, low steam mass fraction and high velocity of the crossflow. These results provide information on how to best arrange fuel assemblies in spent fuel pools, provided that the boundary conditions above the fuel assemblies are known or can be predicted with sufficient accuracy. Finally, a method for modelling a larger part of the spent fuel pool is presented. The combination of two modelling approaches enables a partially geometry-resolving simulation in which the central fuel assembly is geometrically resolved and the neighbouring fuel assemblies are modelled as porous bodies. This approach improves the transferability of the results to an entire spent fuel pool, because the evaluation in the geometrically resolved fuel assembly becomes more independent from the uncertain boundary conditions.:1 Einleitung 1 1.1 Chancen und Risiken der Kernenergienutzung 1 1.2 Randbedingungen für den Wärme- und Stofftransport im Lagerbecken 3 1.2.1 Zerfallsleistung 3 1.2.2 Brennelement-Typ und Aufbau 4 1.2.3 Wärmetransportmechanismen 6 1.2.4 Verdampfungsrate 8 1.2.5 Grenztemperaturen 9 1.3 Simulation des Wärme- und Stofftransports im Lagerbecken 10 1.3.1 Das Lagerbecken als Multiskalenproblem 10 1.3.2 Systemcodes und Codes für schwere Störfälle 12 1.3.3 CFD-Simulation mit Brennelementen als poröse Körper 13 1.3.4 Geometrieauflösende CFD-Simulation 15 1.4 Zielstellung und Aufbau der Arbeit 16 2 Modell für ein ausdampfendes Brennelement 19 2.1 Vorbetrachtungen 19 2.1.1 Strömungsform 19 2.1.2 Form des Wärmeübergangs 22 2.2 Physikalische Modellierung 23 2.2.1 Simulationsstrategie 23 2.2.2 Physikalische Modellgleichungen 24 2.2.3 Rechengebiet und Randbedingungen 27 2.3 Numerische Modellierung 32 2.3.1 Örtliche Diskretisierung 32 2.3.2 Zeitliche Diskretisierung 34 3 Sensitivitätsanalyse für ein ausdampfendes Brennelement 37 3.1 Vorgehensweise 37 3.2 Einfluss der Strahlungsmodellierung 39 3.2.1 Motivation 39 3.2.2 Bestimmung des Absorptionskoeffzienten 40 3.2.3 Einfluss der Gasstrahlung 41 3.2.4 Einfluss der numerischen Parameter 44 3.3 Einfluss unsicherer Randbedingungen 46 3.3.1 Wärmeverlust über die Isolierschicht 46 3.3.2 Verteilung des Dampfmassenstroms an der Wasseroberfläche 51 3.4 Einfluss der effektiv freigelegten Länge der Heizstäbe 56 3.5 Einfluss der Stableistung 58 4 Wechselwirkung zwischen Querüberströmung und Wärmetransport im Brennelement 63 4.1 Rechengebiet und Randbedingungen 63 4.2 Physikalische und numerische Modellierung 65 4.2.1 Physikalische Modellierung 65 4.2.2 Numerische Einstellungen 67 4.3 Ergebnisse und Diskussion 67 4.3.1 Generelles Vorgehen 67 4.3.2 Temperaturentwicklung und Strömung im Stabbereich 69 4.3.3 Temperatur und Strömung im Überströmkanal 75 5 Ansätze zur skalenübergreifenden Modellierung eines Lagerbeckens 81 5.1 Einordnung 81 5.2 Co-Simulation des Wärme- und Stoffaustauschs zwischen Einzelbrennelement und Lagerbeckenatmosphäre 81 5.2.1 Konfiguration 81 5.2.2 Einfluss der Konvektionsströmung oberhalb der Brennelemente 86 5.3 Gekoppelte Simulation eines Lagerbeckenbereichs 92 5.3.1 Motivation 92 5.3.2 Parametrierung des porösen Körpers 92 5.3.3 Vergleich der Simulationsansätze 94 5.3.4 Simulation der Brennelement-Gruppe 96 6 Zusammenfassung und Ausblick 101 Literaturverzeichnis 115 Symbol- und Abkürzungsverzeichnis 119

The Electrical Power Systems (EPS) are indispensable for a Nuclear Power Plant (NPP). The EPS are essential for plant start-up, normal operation, and emergency conditions. Electrical power systems are necessary not only for power generation, transmission, and distribution but also to supply reliable power for plant operation and control system during safe operation, Design Basis Conditions (DBC) and Design Extension Conditions (DEC). According to IAEA Specific Safety Guide SSG-34, EPS are essentially the support systems of many plant equipment. Electrical system, which supply power to plant systems important to nuclear safety, are essential to the safety of an NPP. In recent years, due to the digitization of Instrumentation and Control (I&C) systems, along with their enhanced accuracy, ease of implementing complex functions and flexibility, have been also exposed to sophisticated cyber threats. Despite physical separation and redundant electrical power supply sources, malicious cyber-attacks performed by insiders or outsiders might disrupt the power flow and result in an interruption in the normal operation of an NPP. Therefore, for the uninterrupted operation of a plant, it is crucial to contemplate cybersecurity in the EPS design and implementation. Considering multiple cyber threats, the main objectives of this research work are finding out security vulnerabilities in electrical power systems, simulating potential cyber-attacks and analyzing the impacts of these attacks on the electrical components to protect the electrical systems against these cyber-attacks. An EPS testbed at a small scale was set up, which included commercial I&C and electrical equipment significant for the cybersecurity analysis. The testbed equipment comprises of electrical protection relay (IEC 60255), controller, operating panel, engineering workstation computer, simulation model, etc. to monitor and control the power supply of one or more electrical equipment responsible for a regular operation in an NPP. Simulated cybersecurity attacks were performed using this testbed and the outcomes were examined in multiple iterations, after adding or changing security controls (cybersecurity countermeasures). Analyzing the cybersecurity and performing cyber-attacks on these systems are very advantageous for a real power plant to prepare and protect the plant equipment before any malicious attack happens. This research work conclusively presents cybersecurity analysis, including basic and sophisticated cyber-attack scenarios to understand and improve the cybersecurity posture of EPS in an NPP. The approach was completed by considering the process engineering systems (e.g. reactor core cooling systems) as attack targets and investigating the EPS specific security Defense-in-Depth (DiD) design together with the Nuclear Safety DiD concepts.:CHAPTER 1 INTRODUCTION 1.1 Motivation 1.2 Technical Background 1.3 Objectives of the Ph.D. Project 1.4 State of the Art in Science and Technology CHAPTER 2 FUNDAMENTALS OF CYBERSECURITY AND ELECTRICAL CONTROL AND PROTECTION CONCEPTS 2.1 Electrical Power System 2.2 Electrical Protection System 2.3 Cyber-Physical System 2.4 Industrial Control System 2.5 Safety I&C and Operational I&C Systems 2.6 Safety Objective Oriented Top-Down Approach 2.7 Cybersecurity Concept 2.8 Threat Identification and Characterization in NPP 2.8.1 Design Basis Threat 2.8.2 Attacker Profile 2.8.1 Reported Real-Life NPP Cyber-Attack Examples 2.9 Security Levels 2.10 Summary CHAPTER 3 CYBER-PHYSICAL PROCESS MODELING 3.1 Introduction 3.2 Single Line Diagrams of Different Operational Modes 3.3 Design 3.4 Block Diagram of Simulink Model 3.5 Implementation of Simulink Blocks 3.5.1 Power Generation 3.5.2 Grid Feed 3.5.3 House Load (Feed Water Pump) 3.6 OPC UA Communication 3.7 Summary CHAPTER 4 CYBER THREAT SCENARIOS FOR EPS 4.1 Introduction 4.2 Cyber-Physical System for EPS 4.3 Cyber Threats and Threat Sources 4.3.1 Cyber Threats 4.3.2 Threat Sources 4.4 Cybersecurity Vulnerabilities 4.4.1 Vulnerabilities in EPS 4.4.2 Vulnerabilities in ICS 4.5 Attacker Modeling 4.6 Basic Cyber Threat Scenarios for EPS 4.6.1 Scenario-1: Physical Access to Electrical Cabinets 4.6.2 Scenario-2: Modification of Digital Protection Devices 4.7 Potential Advanced Cyber Threat Scenarios for EPS 4.7.1 Scenario-1: Alteration of a Set-point of the Protection Relay 4.7.2 Scenario-2: Injection of Malicious Packets 4.7.3 Scenario-3: False Trip Command 4.7.4 Scenario-4: Availability Attack on Protection Relay or SCADA System 4.7.5 Scenario-5: Permanent Damage to Physical Component 4.7.6 Scenario-6: Protocol-wise Attack on Operator Panel 4.8 Threat Scenario for Simulink model 4.9 Summary CHAPTER 5 EPS TESTBED DESCRIPTION 5.1 Introduction 5.2 Basic Industrial Automation Architecture 5.3 Need for Testbeds 5.4 Proposed EPS Testbed 5.4.1 Testbed Architecture 5.4.2 Testbed Implementation 5.5 EPS Physical Testbed Applications 5.5.1 Modeling and Simulation of Power System Faults 5.5.2 Modeling of Cyber-Attacks 5.6 Summary CHAPTER 6 EXPERIMENTAL AND IMPACT ANALYSIS OF CYBER THREAT SCENARIOS 6.1 Outline 6.2 Normal Operation and Control 6.3 Possibilities to Cause Failure in the Primary or Secondary Cooling Systems 6.4 Implementation of Cybersecurity Threat Scenarios 6.4.1 Alteration of a Relay Set-Point during Plant Start-Up Phase 6.4.2 Alteration of a Controller Set-Point during Normal Operation Phase 6.4.3 Availability Attack on Control and Protection System 6.4.4 Severe Damage to a Physical Component due to Overcurrent 6.5 Experimentally Assessed Cyber-attacks 6.6 Summary CHAPTER 7 SUMMARY AND OUTLOOK REFERENCES SCIENTIFIC PUBLICATIONS GLOSSARY