SBO analysis of a generic PWR-900 with ASTEC and MELCOR codes

After the Fukushima accident, the interest of the public to nuclear safety has growth and the international technical nuclear community has increased his attention in the investigation and the characterization of Severe Accident (SA) scenarios. In order to simulate the different, complex and multi-physical phenomena involved in a SA, computational tools, known as SA codes, have been developed in the last decades. In order to give some insights on the modelling capabilities of these tools and the differences in the calculation results, also related to the user-effect, an analysis of an unmitigated Station Black Out (SBO) occurring in a generic Western three-loops PWR 900 MWe has been carried out by the authors in the framework of the NUGENIA TA-2 ASCOM project. The simulation results of ASTEC code (study carried out with ASTEC V2, IRSN all rights reserved, [2019]), developed by IRSN, and MELCOR 2.2 code, developed by SANDIA for USNRC, have been compared and analyzed. The SBO scenario considered takes into account the intervention of the accumulators as only accident mitigation strategy. Several figures of merits related to the thermal-hydraulic (e.g. primary pressure, cladding temperature, etc.) and to the core degradation (e.g. hydrogen production, etc.) have been considered to describe the accident evolution until the vessel failure, for the two codes comparison.


Introduction
Nuclear energy systems have all the necessary features needed to play a substantial and long-term role in the major energy challenges of the present time. Indeed, the necessity of an energy system able to satisfy the global energy-demand growth and, at the same time, the need of a sustainable and CO2 free energy production, is becoming of greater interest every day. After the Severe Accident (SA) of Fukushima, also the interest of the public to nuclear safety has growth, and the international nuclear community has increased its research effort in nuclear safety, including SA. With the aim of developing new accident mitigation strategies and Severe Accident Management (SAM) measures, the thorough study on the SA phenomenology of the last decades led to the development of SA simulation codes; such as ASTEC [1], developed by IRSN, and MELCOR [2], developed by SANDIA National Laboratories for USNRC. A SA code is developed within the aim of simulating a SA scenario in a nuclear reactor, from the initial event until the possible radiological release of Fission Products (FPs). SA codes are therefore designed to simulate the complex and mutual different interacting and interrelated phenomena/processes along a SA transient progression. Several experimental programs have been conducted to provide a valuable assessment database [3]. However, the analyses of the current state-of-the-art shows that there is a need to reduce some uncertainties still present [4] and a consequent investigation of phenomena/processes, to date not investigated in detail in geometric prototypical experimental facility with prototypical material, should be addressed (e.g. the area for the oxidation process is characterized by a great uncertainty due to the complex phenomena taking place during the degradation and relocation of the core material and the limited full-scale experimental data for validation purpose). Therefore, discrepancies in some core degradation phenomena can be still observed when comparing the results as predicted by different simulation tools, considering the different core degradation models implemented in the codes [5] [6]. Within this framework, code-to-code exercises have been performed and must be continued. In particular code-to-code exercises involving code developers are useful to identify the modelling differences affecting the code prediction results, examples are reported in [7] [8]. Code-to-code exercises involving code-users give some insights about code modelling difference and characterize the influence of user effect on the different code predictions, examples are reported in [6] [9]. In this framework, a generic three-loops 900 MW PWR was chosen as the reference reactor for a code to code ASTEC -MELCOR comparison. Starting from the activity developed in [6], the postulated SA is an unmitigated SBO, and in this application the ACCumulators (ACCs) injection is considered as only safety intervention. This activity has been carried out in the framework of the NUGENIA TA-2 ASCOM (ASTEC COMmunity) collaborative project [10] [11] coordinated by IRSN.

Description of the ASTEC code
The ASTEC code [1] (Accident Source Term Evaluation Code), jointly developed until 2015 by the French "Institut de Radioprotection et de Sûreté Nucléaire" (IRSN) and the German "Gesellschaft für Anlagen und Reaktorsicherheit mbH" (GRS), and developed now only by IRSN, aims at simulating an entire Severe Accident (SA) sequence in nuclear water-cooled reactors from the initiating event through the release of radioactive elements out of the containment. It features a modular structure where each module is aimed to simulate a specific set of physical phenomena or reactor zone. A module is itself a code and can be used in stand-alone mode or coupled with the other modules. The main uses of the ASTEC are source term evaluations, accident management studies, etc [6]. The modules CESAR, CPA and ICARE have been implemented in the present work. CESAR [12] is the ASTEC module dedicated to the simulation of the primary and secondary systems thermal-hydraulics. It is a one-dimensional twophase fluid system code, characterized by a two-phase model based on a five (or six in the lasts code versions) equations approach. ICARE [13] is the module dedicated to the simulation of the in-vessel core degradation phenomena. It implements mechanical models, processes several chemical reactions, in-corporates fission product release. It uses basic geometrical objects able to reproduce most of the internals of the core and the related heat exchange with coolant fluid. The core fluid channels complete the meshing to allow computation of thermal-hydraulics by CESAR. CPA module [14] provides a tool based on mechanistic models with the purpose of simulating all the relevant thermal-hydraulic processes and plant states taking place in the containment compartments. The code version used is ASTEC-V2.1.1.6.

PWR-900 ASTEC model description
The reference reactor input-deck used for the ASTEC calculation is the PWR900-like input-deck delivered by IRSN with the ASTEC release, used in this application, and it is an update version of the ASTEC input deck used for the application reported in [6], and used as a reference to develop the MELCOR input-deck. The primary and secondary system model is realized with the CESAR module and the nodalization scheme is shown in Figure 1-left. The primary circuit features 3 independent loops (Hot Leg (HL), Pressurizer (PRZ), Steam Generator (SG) tubes, main pump and Cold Leg (CL)) and includes some parts of the vessel (Upper Plenum (UP), collector, etc.). The secondary circuit includes the secondary side SGs and the Steam Lines (SLs). In the ICARE model the reactor core is divided into 5 radial regions and 16 axial segments plus a volume for the Lowe Plenum (LP). The containment is realized with CPA module. Safety systems such as the Emergency Core Cooling System (ECCS), containment sprays, Emergency Feed Water System (EFWS), relief valves, etc. and their functioning logics have been modelled with the dedicated structures of ASTEC.

Description of the MELCOR code MELCOR [2]
[15] is a fully integrated severe accident code able to simulate the thermal-hydraulic and the main SA phenomena characterizing a Light Water Reactor (LWR) SA scenario. MELCOR is being developed at Sandia National Laboratories for the US Nuclear Regulatory Commission (NRC). The code is based on a "control volume" approach. MELCOR can be used with the Symbolic Nuclear Analysis Package (SNAP) [16] for the development of the nodalization and for the post processing of data. MELCOR has a modular structure and is based on packages. Each package simulates a different transient phenomenology. In particular, the Control Volume Hydrodynamics (CVH) and Flow Paths IOP Publishing doi:10.1088/1742-6596/1868/1/012019 3 (FL) packages simulate the mass and energy transfer between control volumes; the Heat Structure (HS) package simulates the thermal response of the heat structure; the Core (COR) package evaluates the fuel, the core and the LP structures behaviour, including the degradation phenomena; Cavity (CAV) package models the core-concrete interactions; and the Radionuclide (RN) package characterizes the aerosol behaviour. It is to underline the role of the CVH/FP packages that provides the boundary condition for other packages. The validation of the MELCOR code is based mainly on comparison with analytical results, code to code benchmark with other validated computer codes, validation against experimental data, and comparison to published real accident/events [17]. The MELCOR code version used is MELCOR 2.2_9607.

PWR-900 MELCOR model description
MELCOR nodalization [6][18] [19] has been developed with the use of SNAP, considering the plant information reported in the 2013 Foucher reports [20] [21], and the ASTEC input files provided by IRSN during the EU-CESAM project [22]. It has been revised along the EU-FASTNET [23] [24] and EU-IVMR [25] [26] projects. Like the ASTEC model, the three cooling loops are modelled separately. The PRZ is modelled with one equivalent CVH volume. The U tubes of each SG, are modelled with two equivalent regions, one for the ascending U tubes and the other for the descending side. The SG secondary side is composed of three different volumes (SG downcomer, riser and cavity). The RPV nodalization includes the LP, the core, the bypass, the UP and the Downcomer. Figure 1-right shows the overall RCS thermal-hydraulic nodalization. The core thermal-hydraulics is modelled by a single CVH region coupled with the corresponding model of the COR package, in which the core is modelled with 17 axial regions. 5 radial regions are used for the active core in agreement with ASTEC nodalization. The containment is made of one hydraulic volume coupled with several heat structures having the same surfaces and thermal inertia of the ASTEC input. A separate hydraulic volume modelling the cavity is considered. The modelling parameters used in the early SOARCA project [15] or the code default values [2] are selected. The value of 2500 K is used for the melting temperature of Uranium-dioxide and Zirconium-oxide [25][27].

Steady-state analysis comparison
A steady-state analysis has been performed with the two codes. Since the generic PWR-900 MELCOR input-deck has been developed starting from the generic PWR-900 ASTEC input-deck, ASTEC operational values have been assumed as a reference for the comparison. Table 1 shows that the two code are, in general, characterized by comparable and stable initial conditions.

SBO transient sequence main features
The selected SA scenario is an unmitigated SBO [6] [19]. The plant operational point before the Start Of the Transient (SOT), is the nominal power condition point reported in Table 1. The accident initiator event is the loss of offsite Alternating Current power, with the failure of all Diesel Generators. All the safety systems are considered unavailable except for the ACCs passive intervention. The opening of the primary and secondary side Steam Relief Valves (SRVs) is considered available. The only SA Management actions considered is the opening of the Safety Valves of Pressure Compensator (SEBIM) valves once reached the core outlet temperature of 650°C. The reference transient sequence has been analysed until the Lower Head (LH) failure. *A difference of less 7 % is related to the SG1,2,3 mass between the two codes; this is coupled with a difference less of the 3% on the SGs recirculation ratio between the two codes. These are the current values of the steady state of the PWR-900 input-deck delivered by IRSN with the ASTEC version used for this application. For this first analyses the MELCOR operational point has not been updated.

SOT and primary side quasisteady state phase
The reactor SCRAM and the secondary system isolation are assumed to take place at the SOT (t = 0 s).
In the first phase of the sequence the three isolated SGs work as the only heat sink for the primary side: heat is transferred from the SG primary side to the secondary side, whose pressure rapidly increases. Following the overcome of the secondary side SRV pressure set points, the three SRVs start to release steam from the SGs to the atmosphere. Hence, the SGs secondary mass inventory starts to decrease. While the secondary pressure is cycling around the SRV pressure set point, power is being removed from the primary side. At the SOT, the primary system pressure rapidly drops to around 140 bar, reaching quasi -steady state conditions. As can be observed in Figure 2-left, both the codes show a consistent prediction of this phase of the transient. During the primary side quasi -steady state phase, the primary to secondary heat flux balances the FP decay heat produced in the core. The total heat transferred from the primary to the secondary side is reported in Figure 2-right. The total mass flow rate predicted by the codes in the CLs 1 and 2 (CL 3 has the same behaviour of CL 2) is shown in Figure 3. During the single-phase natural circulation regime (until 6000 s in ASTEC and 6100 s in MELCOR), the CLs liquid flow rate predicted by the ASTEC core is lower of around 60 kg/s in comparison with MELCOR. The difference is probably due to the different approach adopted in the two nodalizations of the reactor loops (e.g. different number of volumes used) [6]. Once the primary system moves from single-phase to two-phases natural circulation, the CLs mass flow rate drops to few kg/s. The codes predict with a good agreement the timings for the singletwo phases transition, as reported in Table 2. The primary side quasi -steady state phase lasts until the heat removal capability of the SGs is reduced due to the SGs water depletion. This leads to the primary pressure increase, as can be observed in Figure  2-left. When the primary pressure set point is reached, the SEBIM cycling phase starts. Timings of SEBIM cycling inception are predicted with a good agreement by the two codes and are reported in Table 2. Steam is released from the SEBIM valves on the PRZ head, to the containment. Therefore, the loss of the primary coolant is followed by a water level decreasing in the RPV. Timings of Top of Active Fuel (TAF) uncovering are reported in Table 2 and are comparable for the two codes calculations.  Following the fuel rods uncovering, the fuel cladding temperature starts to increase. Once the core outlet temperature reaches 650°C, a safety signal triggers the stuck opening of the SEBIM valves, predicted with a good agreement between the two codes as reported in Table 2. The SEBIM opening and steam release is followed by a fast primary pressure drop (Figure 2-left). The fuel uncovering leads to the inception of the first cladding -steam oxidation reaction and hydrogen release. The oxidation starts in both the calculations before the stuck openings of the SEBIM valves with a comparable timing ( Table  2). In both the calculations this first degradation does not lead to a major loss of core geometry. However, the oxidation features a different quantitative evolution: in MELCOR a larger quantity of hydrogen (about 125 kg over a total of about 350 kg) is produced (Figure 4-left). The same observations can be made by looking at Figure 4-right, reporting the top level cladding temperatures: the first temperature peak has a similar timing for the two calculations, but higher temperatures are reached in MELCOR.  (Table 2). Thanks to the injection, the hot core is quenched (Figure 4-right) and the RPV gets again almost completely filled. From a quantitative point of view, as discusses in [11], the ASTEC core refill is faster and the water inside the core reaches a higher level; MELCOR injection, in the contrary, takes place more gradually reaching lower water level inside the core but injecting water for a longer time interval.

Core degradation evolution and retention in the LP
After the ACCs intervention and core refill, the RPV water level decreases again and the second core BAF uncovering is reached at 12900 s in ASTEC and in 16905 s in MELCOR ( Table 2). The degradation advances more rapidly in ASTEC: higher temperatures and hydrogen production start earlier (Figures 4) than in the MELCOR. Looking at Figure 4-left, can also be observed the much higher total hydrogen mass produced in ASTEC. In Figure 5-left, is reported the total mass of metallic Zr and oxidized Zr in the core, for the two codes. Consistently with the H2 production, the first oxidation phase features a higher oxidation of the Zr in MELCOR. While the second oxidation phase, after the core refill, features a much higher oxidation in the ASTEC simulation. The same observation can be made from Figure 5

Conclusions
The present work is aimed at providing a benchmark exercise by comparing the simulation results of two state-of-the-art SA codes ASTEC and MELCOR. The reference SA scenario is a SBO, in which the ACCs injection is considered as the only safety mitigation system available. The focus of the analysis has been pointed on the thermal-hydraulics and the fuel degradation phenomena occurring in the transient. Some FOMs (primary pressure, CLs mass flow rate, fuel cladding temperature, hydrogen production, etc.) have been chosen for the characterization of the phenomena until the RPV failure. The analysis of the code calculations discrepancies is also discussed and supported by the phenomenological analyses of the postulated transient. After the SOT, the first phase of the transient is dominated by thermal-hydraulic phenomena (e.g. natural circulation). In general, the two codes show a good agreement in the qualitative and quantitative prediction of the selected FOMs during this phase (e.g. primary pressure, primary to secondary SG heat transfer, etc.). Some discrepancies can be observed when the core degradation starts. The major discrepancy is the amount of total Hydrogen produced: more than 500 kg in MELCOR and less than 350 kg in ASTEC. Also it is to underline that in both the calculations the first degradation phase (before the ACC injection) does not lead to a major loss of core geometry. However, the first oxidation features a different quantitative evolution: in the MELCOR case a larger quantity of hydrogen (about 125 kg over a total of about 350 kg) is produced in this phase. In the second degradation phase (after the accumulator injection) the degradation advances more rapidly in ASTEC: higher temperatures and hydrogen production start earlier than in the MELCOR calculation, and can be observed a much higher total hydrogen mass produced in ASTEC along this phase. Other discrepancies are also observed on the timing of the code degradation phase (e.g. second core BAF uncovered, massive slumping inception), though the vessel failure takes place with a good agreement with the two codes. The work conducted, confirm previous study [6], and shows that in general the phase dominated by the thermal-hydraulics phenomena is predicted with a reasonable agreement and minor discrepancies. More discrepancies are observed along the degradation phase and in particular the invessel hydrogen mass prediction shows bigger differences. The results discrepancies underline the modelling differences between the two codes related to the core material degradation/relocation. This different modelling approach determines differences in the available area for the oxidation process, different flow blockage conditions, different code node porosity prediction, etc. Further details studies are in progress to characterize code modelling differences in the view of uncertainty estimation in SA.