Assessment of Severe Accident Management for Small IPWR under an ESBO Scenario

Interest in evaluation of severe accidents induced by extended station blackout (ESBO) has signiﬁcantly increased after Fukushima. In this paper, the severe accident process under the high and low pressure induced by an ESBO for a small integrated pressurized water reactor (IPWR)-IP200 is simulated with the SCDAP/RELAP5 code. For both types of selected scenarios, the IP200 thermal hydraulic behavior and core meltdown are analyzed without operator actions. Core degradation studies ﬁrstly focus on the changes in the core water level and temperature. Then, the inhibition of natural circulation in the reactor pressure vessel (RPV) on core temperature rise is studied. In addition, the phenomena of core oxidation and hydrogen generation and the reaction mechanism of zirconium with the water and steam during core degradation are analyzed. The temperature distribution and time point of the core melting process are obtained. And the IP200 severe accident management guideline (SAMG) entry condition is determined. Finally, it is compared with other core degradation studies of large distributed reactors to discuss the inﬂuence of the inherent design characteristics of IP200. Furthermore, through the comparison of four sets of scenarios, the eﬀects of the passive safety system (PSS) on the mitigation of severe accidents are evaluated. Detailed results show that, for the quantitative conclusions, the low coolant storage of IP200 makes the core degradation very fast. The duration from core oxidation to corium relocation in the lower-pressure scenario is 53% faster than that of in the high-pressure scenario. The maximum temperature of liquid corium in the lower-pressure scenario is 134K higher than that of the high-pressure scenario. Besides, the core forms a molten pool 2.8 h earlier in the lower-pressure scenario. The hydrogen generated in the high-pressure scenario is higher when compared to the low-pressure scenario due to the slower degradation of the core. After the reactor reaches the SAMG entry conditions, the PSS input can eﬀectively alleviate the accident and prevent the core from being damaged and melted. There is more time to alleviate the accident. This study is aimed at providing a reference to improve the existing IPWR SAMGs.


Introduction
After the Fukushima accident, the severe accident due to extended SBO caused widespread concern. For large distributed reactors, scholars at home and abroad have conducted many studies on severe accidents caused by SBO. Common systematic analysis severe accident analysis codes MAAP and MELCOR have been used to calculate the accident sequence process of different large distributed nuclear power plants under severe accidents caused by SBO, and the mitigation capacity of related safety facilities has been calculated and evaluated [1][2][3][4]. In addition, the phenomena in the SBO transient process and safety system design are the hot research area. Korean Atomic Energy Institute [5] (KAERI) developed a phenomenon identification ranking table (PIRT) in the OECD-ATLAS project to identify the main parameters affecting the thermal hydraulic phenomena in SBO transients. Taking into account the important phenomena in the PIRT results, it can be confirmed that ATLAS can simulate the main thermal hydraulic phenomena during the SBO transient as realistically as possible. Chang et al. proposed the design idea of an integrated PSS that can perform various passive safety functions [6]. e simulation results of IPSS show that the decay heat can be fully eliminated in the accident of SBO. Moreover, the molten core can be retained in the vessel by the passive in-stack retention strategy of the integrated PSS.
Above researches have studied the accident process, thermal hydraulic response, and passive safety system evaluation of severe accidents caused by SBO in some large distributed reactors through systematic severe accident analysis codes and have obtained some good research results. However, there are few studies on severe accidents of IPWR. In addition, the system analysis code is relatively simple. It is aiming to cover the whole process of severe accident phenomenon. e system is discretized coarsely, and the conservation equation is simplified. For mechanism phenomena in severe accidents, the model may not be accurate enough. Due to the large difference between the traditional distributed arrangement and the integrated small stack arrangement, the trend of the accident and the change of key parameters may be different during the normal operation or accident. ere are few studies on SBO severe accidents on small IPWRs over the world. erefore, the core degradation mechanism in a small IPWR needs to be further studied due to its special design characteristics and safety characteristics. It could provide reference for severe accident management of small IPWRs.
SCDAP/RELAP5 is characterized by its detailed, mechanistic models of severe accident phenomena; however, the calculations can be rather time-consuming. SCDAP/RELAP5 typically uses on the order of hundreds of hydrodynamic components to model the primary system. SCDAP/RELAP5 employs the detailed mechanistic models for single-and twophase flow. e one-dimensional, semi-implicit forms of the conservation equations for the two-fluid model are solved. e robust RELAP5 modeling is clearly superior to the thermal hydraulic models of the other codes. Another significant difference is the detail in which the core transitions from an intact state to a degraded state. e most detailed models for material interactions and relocations have been incorporated into SCDAP/RELAP5 [7].
In this paper, the core degradation of high pressure and low pressure in ESBO scenarios for IP200 is simulated by the SCDAP/RELAP5 code. e design characteristics of the IP200 are carefully considered in modeling. Diverse early thermal hydraulic behavior and core degradation process of IP200 in integrated and low power design is compared with a large distributed reactor. en, the natural circulation in RPV, reaction mechanism of zirconium with the water and steam, core cladding oxidation, and hydrogen generation are studied. As IPWR differs greatly from the large distributed reactor in terms of the system structure and parameter design, it is necessary to evaluate the SAMG entry condition for IP200 severe accident mitigation. us, referring to the EPRI TBR and the Westinghouse PWR severe accident management entry conditions, the severe accident entry conditions for the IP200 reactor are determined by calculations. Finally, the effect of the passive safety system on severe accident mitigation is quantitatively evaluated. is study can provide a reference for practical engineering and design of SAMG for IPWR.

System Design and Modeling
2.1. Brief Description of IP200. IP200 is a newly developed IPWR by Harbin Engineering University, whose major design parameters could be referenced from previous papers [8][9][10][11]. Its main purpose is to generate electricity for the floating nuclear power plant (NPP). It is also able to provide energy for coastal cities and remote islands far from the mainland. e integral system layout is adopted for IP200, which can benefit from the simplified structure, light weight, and the elimination of large diameter piping, hence eliminating large-break loss of coolant accident (LOCA). All the components, including twelve once-through steam generators (OTSGs), four main coolant pumps (MCPs), and the core, are located in the reactor vessel, as shown in Figure 1.
e twelve steam generators are spaced evenly at the annulus between the steam generator inlet region and the lower plenum. e twelve steam generators absorb the 220 MW heat energy in the coolant. With the heat energy, feedwater in OTSG tubes becomes superheated steam. Its passive safety system is mainly composed of three parts: SG water supply tank, core water supply tank, and residual heat-removal exchanger. e passive safety system is fitted with an isolation valve. ese valves are closed under normal operation. In the event of an accident, water is injected into the core and the secondary side of the SG by a trigger signal or by the operator manually opening the valve, with the residual heat of the core derived. e integrated pressurized water reactor canceled the large-size pipeline of the main circuit and radically eliminated the large-break accident. However, the marine IP200 reactor still uses the main pump forced circulation, and it is necessary to consider the working conditions of the main pump and the feed pump failed after the power failure. is study assumes the extreme conditions of long-term full-field power-off superposition of emergency power failures, intending to conservatively evaluate the ability of the safety system to mitigate accidents.

Calculation Model.
e SCDAP/RELAP5 program is developed by the US Nuclear Regulatory Commission (NRC) in conjunction with Innovative Systems Software (ISS). e model has been verified by QUENCH/CORA and is widely used in numerical research and safety analysis. e model of the reactor and safety system is based on the SCDAP/RELAP5 code, and the nodes are shown in Figure 2. e 014/015/016/017 represents the core hot aisle, respectively, and 018 represents the bypass. e built-in pressurizer space is represented by 026, and 037/047 represents the safety valve and the pressure relief valve, respectively, which can be deployed either automatically or manually according to the trigger limit. 115/116 denotes a double-sided heating passage on the primary side of the OTSG, and 314 denotes a secondary side. Feed water and steam are given by separate time-dependent volume boundaries. e core make-up tank (CMT) of the passive safety injection system is indicated by 064. e passive residual heat-removal system (PRHRS) shares part of the pipeline with the secondary circuit, which reduces the complexity of the system. 253 denotes the SG water supply tank, 258/300 denotes the secondary circuit side and the seawater side of the residual heat-removal exchanger, respectively, and 302 denotes the final heat sink (seawater). e fuel assembly is established based on the SCDAP model. e fuel assembly is divided into four layers radially outward and ten layers axially upward with the core bottom center as the reference (Figure 3). To simulate the coolant flow changes when the core loses its geometry in the event of a severe accident, the establishment of the core model considers the flow mixing of each channel.

Steady-State Calculation.
Before simulating an ESBO, this research selects the key parameters of the primary system for steady-state calibration. e calculation time is 1000 s. e results of the steady-state simulation are presented in Table 1. All the steady-state parameters agree well with operating conditions (relative errors less than 2%). e subsequent accident scenarios described in this research are all based on this steady state as the initial condition.

Results and Evaluations
For the low-pressure core melt (the pressurizer pressure relief valve (PRV) opening all the time, depressurization) and high-pressure core melt (the pressurizer safety valve with the continuous opening and closing, no depressurization), the program calculates 20,000 s. e ESBO accident begins after 1000 s of steady-state operation, with the water supply to the second circuit lost, and the main pump and emergency power supply are both failed. Considering conservative assumptions, 10 s after the accident, the reactor is emergency shutdown. e decay heat continues to heat up the core, assuming all safety systems are not available. is section compares the core damage process of two scenarios. is section is limited to the in-pile stage of the accident's progress, that is to say the heating and melting of the core. Detailed results show that compared to the typical large distributed nuclear power plant [12,13], the time course of the IP200 severe accident is faster. Figure 4(a) shows the main circuit pressure. In the calculation, the pressurizer safety valve is set to open when the pressurizer pressure exceeds 15.8 MPa and closes when it is lower than 16.0 MPa to simulate the cycle behavior of the safety valve opening and closing. For the highpressure scenario, the initial pressure will uctuate greatly after the accident starts (mainly because the reactor takes a while to heat the coolant in the reactor coolant system (RCS) to boil). e pressurizer pressure then uctuates around 15.8 MPa, until the calculation is terminated. For the lowpressure scenario, the pressurizer PRV will be fully open all the time when the RCS pressure exceeds 15.8 MPa.

Pressure.
is safety valve stuck condition caused the TMI-2 accident to occur. Due to the rapid ow of high-pressure coolant from the safety valve, the RCS pressure is rapidly reduced to a pressure equilibrium with the containment (0.1 MPa, 1070 s).

Water Level. Figures 4(b) and 4(c)
show the water level in the pressurizer and core. e most prominent feature of IP200 is that the water capacity of per unit thermal is very low, which will cause a faster loss of the coolant. e initial rise of the pressurizer water level in the high-pressure scenario is due to the rapid rise of pressure to opening the PRV after the accident occurs; when the PRV opens, the coolant is discharged and the coolant is forced to rise to ll the pressurizer space. After 1225 s, as the coolant is continuously discharged, the pressurizer water level begins to shrink and the pressurizer is drained when it is calculated to 3780 s. e core water level is also decreasing, and the core begins to uncover (2.3 m, 4215 s), accompanied by a large amount of steam, until the core water level drops to the core separator (0.8 m, 6070 s) and the core water level is completely dried at 7630 s. In the lower-pressure scenario, the water level of the pressurizer and the core increased brie y in the early stage of the accident, but after 1015 s, the water level began to drop rapidly, and the pressurizer is emptied at 1210 s. e core water level also dropped rapidly, and the core began to be exposed at 1045 s. After that, the core water level dropped slowly until the 7590 s core is completely exposed. At the end of the transient calculation, there is still a smooth water level of 0.33 m in the lower plenum.

Temperature Distribution.
e maximum core surface temperature in SCDAP is represented by the variable bgmct, which represents the maximum cladding temperature until the cladding melts and the hottest spot in the core. Figures 5  and 6 show the core fuel temperature distribution in the high-pressure and lower-pressure scenario, respectively. e integrated design makes the main circuit placed in RPV, shortens the length of the main circuit, reduces the ow resistance of the pipeline, and is conducive to the formation of the natural circulation of the main circuit. is makes the core temperature rise slower in the early stages of the accident. e maximum surface temperature peak in the highpressure and lower-pressure scenario is shown in   In the high-pressure scenario, the Ag-In-Cd alloy begins to melt first due to the heat of decay, and the core temperature begins to rise to 940 K at 5880 s. In the following period of time, the temporary drop in temperature can be noticed, and the temperature starts to rise after falling to 750 K at 6270 s. When the temperature reaches 1001 K at 7705 s, the zirconium alloy and the water vapor begin to react with the zirconium-water reaction, and hydrogen gas is produced (the maximum hydrogen generation rate is 0.086 kg/s at 10015 s) with a large amount of heat released, which causes the core temperature to rise rapidly. During this process, part of the material that is melted is repositioned to a lower temperature location in the lower part of the core, and a blockage is formed in the lower part of the assembly, which causes the flow distribution to transfer from the hotter passage to the cooler passage, exacerbating the melting of the remaining zirconium alloy. When the maximum surface temperature of the core reaches 2874 K, the fuel and oxidized cladding (U-Zr)-O 2 will melt and begin to form a molten pool at 12080 s. en, the maximum surface temperature of the core reached a maximum of 2996 K at 12965 s and stabilized at 2874 K after 13055 s. For the lowerpressure scenario, as the pressurizer safety valve is opened, the pressure in the primary circuit drops rapidly, and the core flashes to generate a large amount of water vapor. e core is rapidly oxidized, and the temperature rises sharply to 1001 K at 1220 s. e zirconium alloy begins to react with water vapor to generate hydrogen gas, which releases a large amount of heat, further aggravating the temperature rise. e maximum surface temperature of the core quickly reaches 2853 K at 1880 s. e formation of a molten pool begins.
e maximum surface temperature of the core  Figure 4(e) shows the rate of hydrogen generation and total hydrogen production during transients. e maximum rates of hydrogen generation in highpressure and lower-pressure scenarios are 0.086 kg/s (10015 s) and 0.439 kg/s (1570 s), respectively, while total hydrogen production is 39.91 kg and 16.16 kg, respectively. In the high-pressure scenario, since the coolant drains slowly and does not boil instantaneously, the core melting process is delayed. About the lower-pressure scenario, the coolant rapidly boils to generate steam and quickly drains through the stuck opening safety valve, which causes the zirconium alloy cladding to oxidize quickly. e total hydrogen production during the high-pressure scenario process greatly exceeds the lower-pressure scenario (although the hydrogen generation rate is very high under the lowerpressure scenario). Figure 4(e) also shows that, for lowerpressure and high-pressure scenarios, almost no hydrogen is produced after 10.850 s and 12.525 s, respectively.

Core Molten
Pool. e molten pool radius and formation time for two transients are shown in Figure 4(f). According to the core node diagram in Figure 3, the core is divided into four layers radially outward and ten layers axially upward with the core bottom center as the reference. en, according to the calculation results, the temperature of each core node can be obtained, and then the two-dimensional temperature distribution diagram of the longitudinal section of the core can be obtained. Figures 5 and 6 show the core temperature distribution and the formation process of the molten pool in high-pressure and lower-pressure scenarios, respectively. For the lower-pressure scenario, the core begins to oxidize at 1400 s very early. As the heat discharge is deteriorative, the core oxidation range is also expanding, with a large amount of heat released, further increasing the core temperature and causing the core start melting at 1830 s. en, a molten pool forms at 1880 s. As the accident progressed, the molten pool gradually expanded and continued to develop to the lower part of the core, eventually starting falling from the zone around the core center (not core center) to the lower head at 3855 s. In this process, the maximum radius of the molten pool is 0.726 m at 5895 s. For the high-pressure scenario, the core start oxidation time at 7710 s is delayed by 1.75 h compared with the lower-pressure scenario. Since the water level of the lower head has also been reduced to zero, less water vapor in the RPV is unfavorable for the zirconiumwater reaction. e core oxidation process is slower than the lower-pressure scenario, making the core melt at 12075 s after the initial oxidation 1.2 h (430 s under the lower-pressure scenario), and forms a molten pool at 12090 s. After that, the molten pool continued to develop and drop from the center of the core bottom to the lower head at 12975 s. e radius of the molten pool is up to 0.706 m at 12300 s. e duration from core oxidation to corium relocation is about 5265 s, and the maximum temperature of liquid corium is close to 2996 K in the high-pressure scenario. e two data 2455 s and 3130 K are, respectively, in the lower-pressure scenario. e latter has a shorter duration and a higher maximum temperature than the former.

SAMG Entry Conditions.
e primary task of the SAMG is to determine the entry conditions of severe accident, which determine the transition of the plant from the Emergency Operating Procedures (EOPs) to the SAMG. e transition point from accident prevention to accident mitigation should be set at the point before the "core is about to be damaged" or "the core begins to break." e choice of the transition point may affect the extent and sequence of subsequent threats to the fission product barrier. e main monitoring parameters are identified by the basic report of guidelines for severe accident management EPRI TBR [14]: damage to the reactor coolant system, including cladding oxidation, damage to the core, and accumulation of most core debris into containment (outside the PRV). e determination of the inlet conditions is based on the core oxidation mechanism in the EPRI TBR and is determined by extensive analytical work. Studies have shown that the zirconium-water reaction is more obvious when the core temperature is 1273-1373 K. Failure to take timely measures may result in extensive damage to the core. erefore, the severe accident management guidelines should be transferred before the core temperature reaches this temperature. Usually, the entry condition of the Westinghouse PWR severe accident management is that the core outlet temperature reaches 650°C [15]. For IP200, because it is different from large distributed reactors, a separate analysis is needed to determine the severe accident entry conditions. is paper selects the ESBO accident in high-pressure and lower-pressure scenarios to analyze the entry conditions of severe accidents.
Selecting the fuel temperature continues to rise and exceeds 1 300 K as a distinct starting point for the zirconiumwater reaction. For the high-pressure scenario, according to Figure 4(d), it can be seen that, after the core is completely exposed, the fuel temperature gradually increases due to the decrease of heat transfer capacity, and the fuel temperature rises to 1001 K at the time point 1 (7705 s), with the zirconiumwater reaction beginning to occur. By the time point 2 (8620 s), the fuel temperature rises to 1300 K and the zirconium-water reaction become apparent. e severity of the oxidation reaction can be assisted by the generation of hydrogen and the rate of hydrogen production. Figure 7(a) shows the change in the hydrogen rate over time and total hydrogen production in the core. It can be seen that, after the corresponding time point 2 at the fuel temperature of 1 300 K, the hydrogen production rate has increased significantly. At time point 2, the total hydrogen production in the core is relatively small, and then hydrogen is produced in large quantities. erefore, it can be said that the drastic zirconium-water reaction is about to start at the time point 2, and the core will deteriorate sharply if no effective mitigation measures are taken. At time point 2, the core outlet temperature is 1267 K. For the lower-pressure scenario, after the core is in extensive exposure, the heat transfer capacity is reduced and the fuel temperature is gradually increased. By the time point 1 (1235 s), the fuel temperature rises to 1001 K with the zirconium-water reaction beginning to occur. At the time point 2 (1405 s), the fuel temperature rises to 1300 K, and the zirconium-water reaction becomes apparent. If no effective mitigation measures are taken, the core will deteriorate sharply. Figure 7(b) shows the total core hydrogen production and the hydrogen generation rate in the lower-pressure scenario. At time point 2, the core outlet temperature is 1083 K. Conservative considerations can bring the core outlet temperature to 1083 K as the severe accident entry condition.

Passive Safety System Input.
is section analyzes the thermal hydraulic response after the ESBO has occurred, and the accident process reaches the severe accident management entry condition, triggering the corresponding passive safety system input. e effectiveness of the passive safety system for accident mitigation is evaluated. e accident process is shown in Table 2.
For the high-pressure scenario, when the core outlet temperature reaches 1083 K, the PRHRS input is triggered with the core heat derived, so that the main circuit pressure reduces rapidly (Figure 4(a)). When the pressure drops to 11.72 Mpa, the CMT starts injecting. Injection of CMT cools the high temperature of steam in the RPV, and the core surface temperature rapidly drops below 1000 K (Figure 4(d)). At this point, severe zirconium-water reaction in the core has not yet occurred, making CMT injection very effective in preventing core damage. From Figure 4(c), we can see that the water level in the RPV rises and floods the core again. At the same time, PRHRS forms a stable natural circulation between the main circuit and the second circuit and continuously brings out the residual heat of the core, so that the PCT reduces rapidly to below 500 K, which can effectively prevent the core damage caused by the zirconium-water reaction, avoid the massive generation of hydrogen, and effectively guarantee core integrity.
For the lower-pressure scenario, when the pressure is below 11.72 MPa, the CMT is working (Figure 4(c)) and the core is refilled with water. At this time, the core outlet temperature is 583.3 K. Since the pressure is rapidly reduced to pressure balance with the containment (Figure 4(a)), the coolant loss begins to become very slow and the core is always submerged during the calculation time. e residual heat is stably derived from the evaporated coolant, and the core surface temperature is rapidly reduced to below 500 K (Figure 4(d)), avoiding the occurrence of the zirconium-water reaction and hydrogen generation (Figure 4(e)), preventing core damage (Figure 4(f )). e integrity of the core is effectively guaranteed over a long period of time.

Conclusions
In this paper, the ESBO accidents in small IPWR-IP200 for high-pressure and low-pressure scenarios are studied. It is observed that the core degradation is very fast. e duration of core degradation is faster, and the core damage is earlier in the low-pressure scenario. e reactor core will melt in both types of selected scenarios. In addition, the PSS input can effectively alleviate the accident and prevent the core damage. e main conclusions are as follows: (1) e most prominent feature of IP200 is that the water capacity of per unit thermal is very low. is will make the core degradation very fast. And the time course of IP200 severe accident is faster than that of the large distributed reactor. Furthermore, the upper part of core will melt firstly. e duration from core oxidation to corium relocation in the lowerpressure scenario is 53% faster than that of the highpressure scenario. e maximum temperature of liquid corium in the lower-pressure scenario is 134 K higher than that of the high-pressure scenario. is is caused by the core uncovering earlier in the lower-  pressure scenario, and the core decay heat is higher at this time. (2) e hydrogen generated in the high-pressure scenario is higher when compared to the low-pressure scenario due to the slower degradation of the reactor core. e core hydrogen generation rate in high pressure is lower than that of the low-pressure scenario, but the core degradation duration is longer in the high-pressure scenario, so the final hydrogen production is higher. e higher hydrogen production will also bring the bigger risk of hydrogen combustion or explosion.
(3) e core damage time in the low-pressure scenario is 2.8 h earlier than that of the high-pressure scenario. ere will be lesser threat to the integrity of the RPV with less hydrogen production in the low-pressure scenario but will be rapid coolant loss, and the containment pressure increases. And it will allow more time to prevent core damage but will result in a risk of overpressure for the RPV in the high-pressure scenario. (4) e core outlet temperature reaches 1083 K when the IP200 reactor is in the transition point, which can be used as an entry condition for IP200 severe accident management. When the entry conditions for severe accident management are reached, the PSS input can effectively alleviate the accident and prevent the core damage, which is very important for obtaining the subsequent processing time of the accident.

Nomenclature
CMT: Core make-up tank ESBO: Extended station blackout EOP: Emergency operating procedure IPWR: Integrated pressurized water reactor LOCA: Loss of coolant accident MCP: Main coolant pump NPP: Nuclear power plant OTSG: Once-through steam generator PRHRS: Passive residual heat-removal system PSS: Passive safety system PWR: Pressurized water reactor PRV: Pressure relief valve RPV: Reactor pressure vessel RCS: Reactor coolant system SAMG: Severe accident management guideline SBO: Station blackout.
Data Availability e table and graph data used to support the findings of this study are included within the article.