Politechnika Warszawska
Warsaw University of Technology
Publikacja / Publication
DOI wersji wydawcy / Published version DOI
Adres publikacji w Repozytorium URL /
Publication address in Repository
Data opublikowania w Repozytorium /
Deposited in Repository on
Identyfikator pliku / File identifier
Identyfikator publikacji / Publication identifier
Cytuj tę wersję / Cite this version
http://repo.pw.edu.pl
Total loss of AC power analiysis for EPR Reactor,
Darnowski Piotr, Skrzypek Eleonora, Mazgaj Piotr, Świrski Konrad,
Gandrille Pascal
http://dx.doi.org/10.1016/j.nucengdes.2015.03.020
http://repo.pw.edu.pl/info/article/WUT348658b2b10749698209aabbca3bce79/
September 7, 2017
WUT5b66f35a1f0440cf9252b3c3b9c790e7
WUT348658b2b10749698209aabbca3bce79
Darnowski Piotr, Skrzypek Eleonora, Mazgaj Piotr, Świrski Konrad,
Gandrille Pascal: Total loss of AC power analiysis for EPR Reactor, Nuclear
Engineering and Design, no. 289, 2015, pp. 8-18, DOI:10.1016/j.nucengdes.
2015.03.020
 Nuclear Engineering and Design 289 (2015) 8–18

Contents lists available at ScienceDirect

Nuclear Engineering and Design

journal homepage: www.elsevier.com/locate/nucengdes

Total loss of AC power analysis for EPR reactor

Piotr Darnowski a,∗ , Eleonora Skrzypek a,b , Piotr Mazgaj a , Konrad Świrski a ,
Pascal Gandrille c
a
Warsaw University of Technology, Institute of Heat Engineering, Nowowiejska 21/25, 00-665 Warsaw, Poland
b
National Centre for Nuclear Research (NCBJ), A. Sołtana 7, 05-400 Otwock-Świerk, Poland
c
AREVA NP SAS, Tour AREVA, 1 place Jean Millier, 92084 Paris La Défense, France

h i g h l i g h t s
Pobrano z http://repo.pw.edu.pl / Downloaded from Repository of Warsaw University of Technology 2024-03-18

• Total loss of AC power (Station Blackout) was simulated for the EPR reactor model.
• In-vessel phase of the accident is under consideration.
• Comparison of MELCOR and MAAP results is presented.
• MELCOR and MAAP results are comparable.

a r t i c l e i n f o a b s t r a c t

Article history: In this paper the results of severe accident simulations for the EPR reactor in the case of loss of offsite
Received 25 April 2014 power combined with total failure of all diesel generators (total loss of AC power) are presented. Cal-
Received in revised form 27 March 2015 culations were performed with MELCOR 2.1 computer code for in-vessel phase of the accident. In this
Accepted 28 March 2015
scenario, the unavailability of all offsite and onsite power sources and the lack of cooling leads directly
to core degradation, material relocation to the lower plenum and rupture of the reactor pressure vessel.
MELCOR results were compared qualitatively and quantitatively with MAAP4 code results and show a
good agreement.
© 2015 Elsevier B.V. All rights reserved.

1. Introduction
In this work the results of the total loss of AC power (Total Station
Blackout) scenario simulations for the EPR reactor are presented.
This accident is a Severe Accident (SA) being the simultaneous com-
bination of Loss of Offsite Power (LOOP) with unavailability of all
diesel generators, both four Emergency Diesel Generators (EDG)
and two Ultimate Diesel Generators (UDG or SBO diesels) (ONR,
2013).
To provide the reader with full understanding of the analyzed
accident and of the differences between the terminology for
EPR reactor designs, the following explanation of the scenarios
characteristics is presented. In common terminology, total loss
of AC power is equivalent to Station Blackout (SBO) accident.
Precisely, in the EPR case SBO has a somewhat different meaning.
∗ Corresponding author. Tel.: +48 22 234 15 44.
E-mail addresses: piotr.darnowski@itc.pw.edu.pl (P. Darnowski),
eleonora.skrzypek@ncbj.gov.pl (E. Skrzypek), piotr.mazgaj@itc.pw.edu.pl
(P. Mazgaj).
Station Blackout event consists of LOOP and failure of all four EDGs
leading to the total loss of power on the emergency and non-
emergency 10 kV busbars (Areva and EDF, 2013b; NRC, 1988). In
order to withstand such conditions, EPR is equipped with two UDG
diesel generators, classified as alternate alternating current (AAC)
sources, dedicated to SBO. Low power UDGs are connected to 690 V
busbars of two safety trains. They are fully diversified, redundant,
protected and physically separated with 24 h autonomy each, in
the case of basic design (ONR, 2013). During SBO event, UDGs
mainly provide power to two emergency feedwater pumps, part of
ventilation system, crucial I&C and Main Control Room. There are
also provisions to provide power to other systems. In principle, one
UDG is able to cope with SBO and in these circumstances, it does
not lead directly to the core melt sequence (Areva and EDF, 2013b;
ONR, 2013). On the contrary, total loss of AC power includes SBO
and unavailability of two UDG generators and it is a severe acci-
dent. It leads to core degradation with the violation of the reactor
pressure vessel (RPV) integrity in a couple of hours (ONR, 2013).
The distinction between these two accidents is important from the
point of response to the system behavior. This response is directed
by the operator action during the course of accident progression.

http://dx.doi.org/10.1016/j.nucengdes.2015.03.020
0029-5493/© 2015 Elsevier B.V. All rights reserved.
 P. Darnowski et al. / Nuclear Engineering and Design 289 (2015) 8–18
The reactor design of EPR has its own Emergency Operating
Procedures (EOP) and Operating Strategies for Severe Accidents
(OSSA), which defines operators’ actions during Design Basis Acci-
dents and Severe Accidents (Prior and Sauvage, 2006). During total
loss of AC power reactor enters into OSSA regime and for SBO it
does not. The transition between those two operational regimes is
determined by the core exit threshold temperature value of 650 ◦ C.
The principles of the accident management assembled in the EOPs
and OSSA guidelines describe the need of the system depressuriza-
tion to avoid the High Pressure Melt Ejection (HPME) from the RPV.
The HPME can lead to strong molten corium interaction with cavity
materials and could lead to early containment failure by Direct Con-
tainment Heating (DCH) (Fischer et al., 2014; Areva and EDF, 2013c;
Sehgal, 2012; Bouteille et al., 2006; Fischer, 2004). Depressuriza-
tion core exit temperature trigger is consistent with Westinghouse
Owners Group Severe Accident Management Guidelines (SAMG)
(Sehgal, 2012). The temperature criterion for depressurization acti-
vation was selected to prevent accumulator water injection after
the onset of core melt and in consequence, to avoid high tempera-
ture core reflooding with strong oxidation (Areva and EDF, 2013c).
For the EPR, accident management aims to depressurize RCS and
the main recovery action is the SG depressurisation, being an action
performed in the framework of EOPs. For the cases in which the
Pobrano z http://repo.pw.edu.pl / Downloaded from Repository of Warsaw University of Technology 2024-03-18
SG depressurization is not successful, the action to be undertaken
by the operator in the frames of EOPs, is the primary Feed and
Bleed procedure performed by PDS actuation (first level of PDS)
(Areva and EDF, 2013c). The Feed & Bleed procedure involves the
Safety Injection System water make-up, while for the total loss of
AC power water supply is provided only by the passive accumula-
tors. For the mitigation of the consequences of the severe accident,
operator is opening the PDS system and it is part of OSSA frame-
work (second level of PDS actuation, if not yet opened) (Areva and
EDF, 2013c). Total loss of AC power analysis presented in this paper
assumes that there is no SG depressurization, primary Feed and
Bleed is not possible and PDS are not activated until the entrance
to the severe accident operation regime. This scenario is believed
to be the most severe to PDS valves design due to rapid high energy
steam discharge.
Despite of all, total loss of AC power and severe accidents for
EPR, in general, are characterized by very low probability. In the
framework of Probabilistic Safety Assessment (PSA) studies for EPR
reactor, core damage sequences initiated by loss of offsite power are
the dominant contributor to the overall Core Damage Frequency
(CDF). Among those events the loss of all diesels is an important
cut-set and total CDF for Short Term and Long Term LOOP type
initiating events equals about 1.3 × 10–7 [1/year] (Julin et al., 2014).
From the very beginning the concept of severe accident mitiga-
tion was present as a part of design process of EPR reactor (Czech
et al., 1999). The reactor is characterized by robust design based on
the proven defense in-depth concepts. It has high level of redun-
dancy, diversity as well as a group of passive and active features
developed to mitigate severe accidents, minimize any releases and
to protect the Public from any potential radiological effects (Fischer
et al., 2014; Bouteille et al., 2006; Fischer, 2004).
The Fukushima-Daiichi NPP accident with long term Station
Blackout was caused by extreme external events and vulnerabil-
ities in the plant design. It forced plant operators and designers
of all nuclear reactors to review their designs and improve them
and it is also the case for EPR. The series of meltdowns reminded
the whole Nuclear Community of the importance of the SBO type
events and the key role of preparedness for severe accidents, even if
they are characterized by very low probability. It has led to intensi-
fication of several research and development programs aimed to
understand Fukushima, find conclusions, learn and increase the
resistance of existing and planned reactors to extreme external
and internal circumstances. After Fukushima plenty of studies and
9
analyses are in process and many of them have been completed by
vendors, nuclear utilities, governmental agencies, universities and
research institutions (Sevón, 2015; Wang et al., 2015; Julin et al.,
2014; Lombard et al., 2014; EPR Working Group, 2014; ONR, 2013;
Burns et al., 2012; SNL, 2012). Work described in this paper is a
contribution to the vast set of activities in this field.
The very strong earthquake and tsunami with similar charac-
teristic as during Fukushima accident, in the case of EPR reactor
would results in Loss of Offsite Power and Loss of Ultimate Heat
Sink (LUHS). Analyses shows that the plant would withstand such
circumstances due to leak tightness and structural robustness of
safety related buildings which are designed to be exposed to such
external flooding and seismic hazards (Lignini, 2013). Total loss
of AC power investigated in this work can be caused by a series
of significantly more severe events than those which occurred in
Fukushima and PSA studies identify them (Julin et al., 2014; Areva
and EDF, 2013a).
In order to withstand more serious sequences and as a part
of conclusions after Fukushima, a multiple enhancements were
additionally proposed. The EPR reactor safety functions strongly
depends on high reliability of power supplies. High quality, redun-
dancy and diversity is basic way to ensure that. Principal lesson
after Fukushima is to provide stronger protection and ultimate
availability of power sources for long time during SBO type events.
In the case of UK EPR, group of five basic resilience enhance-
ments were identified (ONR, 2013). First is improved flooding
resistance for emergency electrical AC and DC power sources. Sec-
ond is increase of autonomy and capabilities of emergency AC and
DC power sources. Third is addition of well-defined mobile power
means (diesel generators) connection points for both spent fuel
pool and reactor. Fourth and fifth areas are: provision of severe
accident I&C monitoring of spent fuel pool and connection points
for mobile water sources for spent fuel pool and containment
spray and heat removal systems (EPR Working Group, 2014; ONR,
2013). Other enhancements are possible and many of them are
strongly plant site dependant. Examples of planned modifications
for Flamanville-3 and Olkiluoto-3 are: allow fuel transfer from EDGs
tanks to UDG tanks, increase DC batteries operation time (12–24 h)
and provide possibility to fill emergency feedwater system water
tanks with water basins located above station level (EPR Working
Group, 2014).
There are some general conclusions for most of the plants. Basi-
cally stronger physical protection of permanently installed onsite
and offsite AC power sources should be provided. Additionally,
provision of mobile power supply units in proper amount and con-
figuration is necessary. Long term fuel, water and lubrication oil
reserves for emergency power sources have to be ensured. Spent
fuel pool cooling by mobile means should also be provided and abil-
ity of plant personnel to prepare measures to restore power have
to be provided. Accessibility and habitability of the Main Control
Room, Emergency Response Centre and local control panels in the
plant should be present for long enough time with proper com-
munication system and I&C operation (EPR Working Group, 2014;
ONR, 2013).
2. Computer codes
In order to perform computations MELCOR 2.1.5482 com-
puter code was applied. Code was developed by Sandia National
Laboratory (SNL) and financed by U.S. Nuclear Regulatory Commis-
sion (NRC). MELCOR is integral analysis tool which was initially
developed to perform a part of the Probabilistic Risk Assessment
(PRA) analysis of nuclear reactors and to evaluate radionuclides
releases—source terms (Sehgal, 2012; SNL, 2011a,b). Currently
MELCOR is becoming best-estimate severe accident tool. Neces-
sity to creation of such a code emerged from the WASH-1400–“The
 10 P. Darnowski et al. / Nuclear Engineering and Design 289 (2015) 8–18
Reactor Safety Study” report and further after the events in TMI-2
(NRC, 1975). The need for creating the methods to predict and eval-
uate the progression of accidents in light water reactors became
undeniable. MELCOR as engineering-level computer code is ded-
icated to severe accident analysis and allows to perform integral
simulations, which can imitate physical phenomena occurring dur-
ing accident in the nuclear power plant. Those phenomena do
involve all relevant thermal-hydraulic processes in Reactor Coolant
System (RCS) and containment, including core degradation and
melting. Moreover thermal and mechanical loading and failure
of the lower head both with molten corium ejection into reactor
cavity. It envelops core-concrete interactions (MCCI), fuel coolant
interactions (FCI), flammable gas production and combustion and
their influence on the containment. Code simulates radionuclides
(under the forms of aerosols and vapors) dynamics and chemistry
with their generation, deposition, retention etc. It simulates signif-
icant engineering safety systems and their impact on the accident
progression (Burns et al., 2012; Sehgal, 2012; SNL, 2011a,b).
Results provided by AREVA which were used for comparison
with MELCOR were prepared with severe accident analysis code
MAAP4.0.7 (Fauske & Associates, 1994). MAAP code is a fast-
running industrial computer code that simulates the response
of light water nuclear power plants for both Gen II and current
Pobrano z http://repo.pw.edu.pl / Downloaded from Repository of Warsaw University of Technology 2024-03-18
Advanced Light Water Reactors (ALWR). The code is used by numer-
ous Nuclear Utilities, Vendors and Regulatory Bodies for design
studies, PSA/PRA level 1 and 2 studies and SAMG support studies.
MAAP4, similarly to MELCOR is categorized as an integral SA analy-
sis tool, what means it integrates a large number of phenomena into
a single plant simulation (NSSS, containment, auxiliary buildings)
such as: thermal hydraulic, core heat-up and melt progression,
lower plenum debris behavior, thermal and mechanical responses
of the RPV lower head, hydrogen production, transport and possible
combustion, Direct Containment Heating (DCH), Fission Products
(FP) release, transport and deposition.
3. Plant model
The investigated reactor design is European Pressurized Water
Reactor (EPR), which is four loop pressurized water reactor (PWR).
The MELCOR simulations were performed with model based on EPR
UK 4590 MWth type unit and MAAP4 was for EPR standard design
with 4590 MWth (Areva and EDF, 2013a).
Fig. 1. Primary and secondary reactor coolant system and containment nodalization.
3.1. MELCOR model
General nodalization applied in MELCOR model is presented in
Fig. 1. Reactor Coolant System consisting of four loops is divided
into two model loops. It is an usual approach to increase compu-
tational efficiency (Kim et al., 2014; SNL, 2014). First loop is called
“broken” and corresponds to loop with the connection to the pres-
surizer. Its geometry is equivalent to the dimensions of the one EPR
loop. Three other loops were merged into one—“intact” (unbroken)
loop with properly rescaled geometry. Nodalization of hot leg (HL)
is finer for broken loop, because there is connection to the pressur-
izer through the surge line (SL). Models of cold legs (CL) and cross
over legs (COL) are the same for both primary circuit loops. Accu-
mulators (ACC)—the passive safety injection system are linked to
the CL control volumes. Four accumulators are combined into two
representations—one for broken loop with 29,667 kg of water and
another one for intact loop with 89,334 kg. The start of water injec-
tion into the cold leg has a set point of 45 bars (Areva and EDF,
2013c).
Pressurizer (PZR) is made of three control volumes and it is con-
nected through safety valves (Pressurizer Safety Valve (PSV) and
Pressurizer Discharge System (PDS)) to the Pressurizer Relief Tank
(PRT)—the tank for the releases of the excess of the energy from the
RCS. Initially pressurizer was filled with about 22,500 kg of water.
PRT tank has 31 m3 of water, 9 m3 of nitrogen and pressure equals
0.8 bars and it has connection to the containment through rupture
disc, which breaks at 19 bars overpressure relative to the contain-
ment (Areva and EDF, 2013a). Three Pressurizer Safety Valves (PSV)
installed at the top of pressurizer are merged into one valve with
three opening set points: 175/178/181 bars. Every set point corre-
sponds to 33% opening of the merged valve. PSV valves are modeled
by hysteresis function and they become closed at 151/155/158 bars
(Areva and EDF, 2013c; SNL, 2011a).
Containment of the EPR was constructed using only one con-
trol volume with free volume equal to 78,500 m3 (Areva and EDF,
2013c). Simple nodalization was selected because of the fact that
the phenomena in the containment are less important during in-
vessel phase of the accident and simple model greatly improve
computational performance. There are two heat structures—one
for inner containment steel structures and one for concrete struc-
tures with area of 43,300 m2 and 24,600 m2 respectively (Areva
and EDF, 2013c). Additionally, inside the containment there is pool
 P. Darnowski et al. / Nuclear Engineering and Design 289 (2015) 8–18
which simulates In-Containment Refueling Water Storage Tank
(IRWST) with 2066 tonnes of water. Containment initial pressure
was 1.01 bar, 315 K and relative humidity 50% (Areva and EDF,
2013c; SNL, 2011b). Forty-seven Passive Autocatalytic Recombin-
ers (PAR)—based on the parametric default MELCOR model, are
located inside the containment, in order to remove hydrogen pro-
duced due to the oxidation.
In the EPR model the steam generators with their primary and
secondary sides are scaled in the same manner as the broken and
intact loops, 1:3. The U-tubes from the primary side are merged
into three control volumes with additional two volumes for inlet
and outlet chambers (Fig. 1). The secondary side is divided into
three volumes representing downcomer, riser with separator part
and steam dryer with steam dome (SD) (Areva and EDF, 2013a).
Steam generator outlet is connected to the Main Steam Line (MSL)
and it is connected to the Steam Header (SH).
The secondary side of steam generator has two types of safety
valves—Main Steam Relief Valves (MSRV or MSRT) and Main Steam
Safety Valve (MSSV). The first one are opened when pressure in the
SG reaches 95.5 bars and second one opens at 104 bars. MSRV valves
opening is modeled by hysteresis function and MSSV by ramp func-
tion. All valves are connected to the MSL control volumes and they
discharge mass to the environment (Areva and EDF, 2013; SNL,
Pobrano z http://repo.pw.edu.pl / Downloaded from Repository of Warsaw University of Technology 2024-03-18
2011a).
Hydrodynamics package (CVH) nodalization for RPV (Fig. 2) has
three control volumes for core region and they are distributed radi-
ally. There is one volume for bypass, lower plenum (LP), upper
plenum (UP), upper head (UH) and downcomer (DC). Reactor core
nodalization for core simulations package (COR) is divided into
nineteen axial levels (right side of Fig. 2). Four bottom levels are
dedicated to simulation of lower plenum, fifth level is for core
support plate (CSP). Sixth and nineteen levels are for non-active,
Fig. 2. (a) RPV and core model. Left part of the RPV picture presents CVH nodalization. Right part presents COR package nodalization and heat structures for RPV simulated
by HS package. (b) Radial and axial power density profile.
11
bottom and top part of the core. There are twelve levels for active
part of the core (from seventh to eighteen levels). Radially core is
divided into six rings for LP and five rings for core part of the model
(Fig. 2). A conservative decay heat curve and core power density
distribution were based on MAAP4 model.
The EPR reactor has special robust design of reactor reflector
which is called Heavy Reflector (HR) and its main purpose is to
reduce irradiation rate of the reactor vessel and extend its lifetime
during normal plant operation and it has ability to absorb large
amount of energy during accidents (Areva and EDF, 2013a). Heavy
Reflector was merged with core barrel and modeled as a set of heat
structures by MELCOR HS package, similarly to typical practice for
simulation of core barrel (SNL, 2001).
MELCOR recommended one-dimensional mechanical lower
head model was applied. It calculates plastic and thermal strains
in each loaded lower head mesh. Lower head mesh has eight
nodes and it was composed of twelve segments (SNL, 2011b).
Most of the MELCOR2.1 configuration, sensitivity coefficients and
modeling parameters were based on SNL MELCOR best practices
recommendations developed during SOARCA project (SNL, 2014).
Example practices are application of: temperature time-to-failure
table (Table 1) for intact but heavily oxidized fuel rods; fuel rods
collapse ultimate temperature equal to 2800 K, particulate debris
porosity equal 40%, lower head to debris heat transfer coefficient
equal to 100 W/m2 K and many others.
3.2. MAAP model
The EPR model is based on standardized MAAP4 code PWR
model. General RCS nodalization is fixed with two loops—single
and triple. Model has 14 nodes, one for separated pressurizer
model, fours nodes for primary side SG tubes, two hot legs, two
 12 P. Darnowski et al. / Nuclear Engineering and Design 289 (2015) 8–18

Table 1 Table 2
Time to fuel rod collapse as a function of cladding oxide temperature. Best-estimate Plant steady state conditions for MAAP and MELCOR.
recommended MELCOR fuel rods collapse model (SNL, 2014).
Initial conditions MAAP MELCOR
Cladding temperature (K) Time to failure
Core power [MWth ] 4590 4590
2090 Infinite PZR pressure [bar] 155 155
2100 10 h PZR level [m]/Water mass [kg] 6.62/22,500 6.73/22,512
2500 1h SG collapsed water level [m] 14.7 14.93
2600 5 min SG feed water temp. [K] 503.15 503.15
SG secondary side pressure [bar] 77 77
Steam flow rate (per SG) [kg/s] 656.9 657.51
Steam flow rate ×3 SG [kg/s] 1970.7 1972.6
RCS flow rate (4 loops) [kg/s] 23,156 22,614
intermediate legs, two cold legs, one lower plenum, one upper RCS flow rate (1 loop) [kg/s] 5789 5633
RCS flow rate (3 loops) [kg/s] 17,367 16,980
plenum and one core node. Each secondary side of SG has two
Core inlet temp. [K] – 572.33
nodes with additional model of separators and dryers. Core model Core outlet temp. [K] – 605.74
has five rings and thirty-two axial levels. Containment contains ten Water mass ×1 SG [kg] 78,000 78,027
computational nodes. Water mass ×3 SG [kg] 234,000 234,018
MAAP code has simplified thermal-hydraulics formulation Water mass RCS [kg] 271,000 271,179

which solves lumped parameters differential equations for mass

and energy conservation and employs quasi-steady state momen-
5. Results and discussion
tum balance in form of algebraic equations. Otherwise MELCOR
solves semi-implicit discretized differential equations for momen-
5.1. Plant steady state
tum, energy and mass (Vierow et al., 2004; Sehgal, 2012).
Pobrano z http://repo.pw.edu.pl / Downloaded from Repository of Warsaw University of Technology 2024-03-18

Steady state plant conditions obtained with MELCOR and MAAP

are compared in the Table 2. Computed states are in good agree-
4. Scenario and assumptions ment with relative differences lower than 3%.

The initiating event for the scenario is loss of offsite power. 5.2. Severe accident analysis
There are some fundamental assumptions for the sequence under
consideration: The sequence of events was identified and summarized in
Table 3. Important events for MELCOR are shifted in time by about
• Offsite power is not recovered. 3–61 min in comparison to MAAP. In the Figs. 3–17 the evolution of
• All diesel generators (DG), four Emergency Diesel Generators and the system parameters during the total loss of AC power accident
are shown. Presentation and discussion of the results are conducted
two Ultimate Diesel Generators are not available.
• Only in-vessel phase of the accident is under consideration and in this section.
The first phase of the accident starts with LOOP and lasts about
all computations are stopped when RPV is breached.
• It is assumed that Pressurizer Discharge System (PDS)—system 2 h until the SGs complete dryout. Trends of the primary pressure
and primary water inventory are shown in Figs. 3 and 4. MELCOR,
with severe accident dedicated valves installed at the top on the
pressure has different dynamics than MAAP prediction. Initially, it
pressurizer are opened when core outlet gas temperature reaches
decreases quicker, reaches lower minimum and rapidly increases at
650 C. Those valves are powered by long duration (>12 h) SA dedi-
the end of the phase (Fig. 3). Primary water inventory stays constant
cated batteries which are credited during the scenario (Areva and
because there is no water loss (Fig. 4).
EDF, 2013c).
• Loss of offsite power leads to the SCRAM of the reactor at the The secondary side steam generator water level indicating rate
of dryout is presented in Fig. 5. MELCOR water level decrease rate
beginning of the accident. It is followed by the loss of Main Feed-
is higher in comparison to MAAP with additional discrepancies
water (MFW) and closure of the Main Steam Isolation Valves
present at the very beginning and at the end of the dryout pro-
(MSIV).
• The loss of AC power causes that the Emergency Feedwater Sys- cess. There is about 30 min dryout shift for MAAP calculation and
it is mainly due to smoother drop of the water level at the end
tem (EFWS), pressurizer cooling sprays and heaters, Containment
Heat Removal System (CHRS) are not available.
• Reactor Coolant Pumps (RCP) coast down begins immediately Table 3
after accident initiation. Sequence of events.
• Reactor coolant pumps seals are undamaged (there is no seal Key events MAAP MELCOR Difference
LOCA). EPR has an accident dedicated standstill seal system for Reactor SCRAM 0 h 00 min 0 h 00 min 0 min
idle pumps. It provides shaft leak-tightness with no necessity for Start of PZR valves cycling 1 h 48 min 1 h 36 min 12 min
active seal water supply (Areva and EDF, 2013d). Broken SG dry 2 h 01 min 1 h 33 min 28 min
• It is assumed that there is no primary component creep rupture PRT disc rupture 2 h 02 min 1 h 51 min 9 min
Core uncovery starts—1st time 2 h 36 min 2 h 31 min 5 min
and only exception is reactor vessel lower head. It has no pen-
Tmax 650 signal reached 2 h 57 min 2 h 54 min 3 min
etrations and breach due to penetration failure is not possible. SA dedicated valves opening 2 h 57 min 2 h 54 min 3 min
Furthermore, thermally induced LOCA and SGTR events are not (PDS)—depressurization
credited. Accumulator injection onset 3 h 05 min 3 h 00 min 5 min
• The unavailability of all diesels causes no emergency feed water Accumulator depletion 3 h 21 min 3 h 09 min 12 min
Core uncovery starts—2nd time 3 h 46 min 3 h 38 min 8 min
flow to steam generators (SG) and their dryout. Oxidation onset 4 h 11 min 4 h 00 min 11 min
• Due to the lack of power, active safety injection Start of core melting 4 h 13 min 4 h 10 min 3 min
systems—Medium Head Safety Injection (MHSI) and Lower Start of core relocation to 6 h 20 min 5 h 21 min 1 h 01 min
Head Safety injection (LHSI) are not available. lower head
• Passive accumulators are available. Vessel failure 6 h 50 min 6 h 23 min 27 min
 P. Darnowski et al. / Nuclear Engineering and Design 289 (2015) 8–18 13

Fig. 6. Broken (TBUS) and unbroken (TGUS) gas temperature inside steam generator.
Fig. 3. Primary system pressure (in the pressurizer).
Pobrano z http://repo.pw.edu.pl / Downloaded from Repository of Warsaw University of Technology 2024-03-18

Fig. 7. Broken (PBS) and unbroken (PUS) steam generator pressure.

Fig. 4. Reactor coolant system water inventory.

of the phase (Fig. 5). Lower primary side pressure and faster sec-
ondary side dryout suggest that the heat transfer between primary
and secondary side predicted by MELCOR is more intensive. It is
an effect of MAAP4 and MELCOR thermal-hydraulics and SG model
differences.
The thermal-hydraulics related processes predicted by MELCOR
are shifted in time due to shorter SGs dryout. There is no steam gen-
erator water makeup and shortly after its isolation pressure rises
(Fig. 7). Then, MSRVs start their cyclic operation when pressure
reaches 95.5 bars. This process continues until the initiation of the
RCS depressurization. The heat is intensively transferred from the
primary side, water turns into steam and leaves the system through
MSRVs.
Fig. 8. Gas temperature at core outlet.

Fig. 5. Collapsed water level in the steam generator. ZWUS for intact and ZWBS for
broken loop. Fig. 9. Water level in the core. BAF, Bottom of Active Fuel; TAF, Top of Active Fuel.
 14 P. Darnowski et al. / Nuclear Engineering and Design 289 (2015) 8–18
Fig. 10. Fuel cladding temperatures. In MELCOR case for inner core ring and four top
axial levels (Fig. 2). For MAAP it is maximum temperature and it does not indicate
the fuel element collapse time.
Pobrano z http://repo.pw.edu.pl / Downloaded from Repository of Warsaw University of Technology 2024-03-18
Fig. 11. In-vessel hydrogen production.
Further accident phase starts with initiation of PSV valves
cycling and ends with depressurization (Table 3). The first apparent
effect of the shorter dryout is an earlier initiation of the pressurizer
safety valves cycling (Fig. 3 and Table 3). During the dry-out, SGs
loss ability to fulfill their primary task—to completely remove the
heat from the primary side. A less efficient heat removal causes pri-
mary water heat-up and pressure increase, which inevitably leads
to PSV valves operation.
Primary coolant system is heavily emptied before depressuriza-
tion, due to PSV valves operation (Fig. 4). Before the beginning of
the depressurization there is only about 70 tonnes of water in the
RCS for both codes. Pressure history (Fig. 3) shows similar trends
during that phase with time span of valve cycling for MELCOR being
Fig. 13. In-core hydrodynamic fluid volume fraction (indicator of core blockage) evolution for the MELCOR core degradation.
Fig. 12. In-vessel hydrogen production rate.
shorter (4140 s) in comparison to MAAP4 (4698 s) (Fig. 3). Due to
this difference, the low pressure phase of the accident starts prac-
tically in the same moment with PDS initiation time differing only
by 142 s.
Core gas outlet temperature was used as an indicator of severe
accident and trigger for the PDS valves opening (Fig. 8). After about
3 h gas reaches temperature of PDS activation signal (650 ◦ C) and
it leads to primary system depressurization (Fig. 3). After depres-
surization, primary water drops to 50 tonnes and primary pressure
heavily decreases. When pressure reaches 45 bars passive accu-
mulators start water injection to the cold legs and as an effect
approximately 100 tonnes of water is transferred to the system
(Fig. 4). Accumulator injection takes 572 s and 960 s for MELCOR
and MAAP respectively. It is because, MELCOR does not predict
short plateau in water inventory as MAAP does (Fig. 4) and it trans-
fers about 10 tonnes more water to the primary system. MELCOR
pressure drops faster during the injection and because its rate is
pressure difference induced, timing is different and plateau exists.
What is remarkable after the end of the water injection, RPV water
dryout starts and it has higher rate for MELCOR (Fig. 4). Those effects
are visible when core water level is under consideration (Fig. 9).
Differences in temperature and pressure histories occur in
steam generators after depressurization (Figs. 6 and 7). Although,
they are not significant for the course of the accident due to very
small heat transfer between primary and secondary side. Temper-
ature and pressure decrease are mainly due to heat exchange with
the containment. Its rate is controlled by the modeling of heat struc-
tures connecting SG with containment and by the fact that MELCOR
has only one control volume for the containment. Steam genera-
tors water level increase to a small extent 5 h after the onset of the
 P. Darnowski et al. / Nuclear Engineering and Design 289 (2015) 8–18
Fig. 14. Mass of debris and corium in the lower head.
Pobrano z http://repo.pw.edu.pl / Downloaded from Repository of Warsaw University of Technology 2024-03-18
Fig. 15. Pressure in the containment.
accident (Fig. 5). Effect is present due to the steam condensation
process and it was observed for both codes.
The highest fuel and cladding temperatures are present in upper
parts of the core (Fig. 2). Fuel temperature starts to rise after about
2 h 30 min when the first core uncover begins (Figs. 9 and 10 and
Table 3). Due to delayed water injection, top MELCOR predicted
temperature is about 1000 K and for MAAP it is about 200 K higher.
Water injected from accumulators effectively supress temperature
rise, core is reflooded and intensively quenched (Fig. 9). This state
lasts for about 45 min and 35 min for MELCOR and MAAP respec-
tively (Fig. 10).
Fig. 16. Steam mass in the containment.
15
Fig. 17. Hydrogen mass in the containment.
The core degradation phase initiates at the beginning of the
secondary core uncover (Figs. 9 and 10). Fuel and cladding temper-
ature starts to rise due to the lack of proper cooling. The oxidation
threshold temperature is reached (∼1500 K) after about 4 h and
very intensive exothermic zirconium oxidation reactions start to
generate large amount of heat and hydrogen gas (Figs. 10 and 11).
In-vessel cumulative hydrogen production is presented in
Fig. 11. The production rate for MELCOR was calculated as deriva-
tive of cumulative hydrogen production (Fig. 12). Until the vessel
rupture, MAAP model produces about 200 kg more hydrogen than
MELCOR. During initial half an hour of oxidation phase, hydro-
gen production is similar for two codes (Fig. 12) and it is about
550 kg. Afterwards, MELCOR intensive oxidation heavily drops at
4 h 35 min and ceases at 4 h 50 min. Otherwise, MAAP in-core oxi-
dation intensity decreases at 4 h 50 min but until 5 h 30 min it is
not suppressed completely (Fig. 11). High oxidation rate occurs
again only when hot corium relocates to the lower plenum. A very
small amount of hydrogen is produced during first core uncover
and most of the hydrogen production results from secondary
uncover (Figs. 9 and 11). Hydrogen production rate is in general
lower for whole oxidation phase for MELCOR than for MAAP4
(Figs. 11 and 12). The anticipated physical explanation of MELCOR
lower hydrogen production is due to faster secondary uncovery
resulting in earlier core degradation. After 4 h 06 min MELCOR core
water level drops below BAF and for MAAP4 it occurs after 4 h
55 min (Fig. 9). Otherwise, oxidation starts after 4 h 00 min and 4 h
11 min for MELCOR and MAAP respectively. Hence, water and steam
are directly available in the core for longer time in the MAAP. The
physical explanation of an earlier uncovery is presented in one of
the subsequent paragraphs. Moreover, less steam produced at the
surface of water inside the core has an possibility to leave RPV by
different flow path without contact with degrading cladding. The
more rapid core uncover leads to enhanced core degradation rate
and an earlier core blockage phenomena. The changes in the fuel
geometry effectively blocks steam inflow into the core and stops
oxidation. Zero hydrogen production rate was observed after 4 h
50 min (Fig. 11) and it is coincident with the moment of the total
core blockage for gas flow (Fig. 13 (#3)).
The recent EPRI comparison study between MAAP5 and MEL-
COR shows that MAAP produces two-to-three times less hydrogen
during in-vessel phase of the core melt scenario in the case of
BWR reactors (EPRI, 2014). EPRI describes that the effect is due
to differences in the core degradation evolution with modeling of
changes in the geometry (areas for oxidation) and flow blockage
(EPRI, 2014). It is important for steam flow through the core during
early degradation when the hydrogen production is expected to
be intense. What is interesting, in our work we did not observed
such discrepancy for PWR reactor. However, MELCOR hydrogen
production is in fact lower but prior to its termination, oxidation
 16 P. Darnowski et al. / Nuclear Engineering and Design 289 (2015) 8–18
rate it is relatively similar (Figs. 11 and 12). In the publicly available
literature, MELCOR and MAAP4 usually produce similar hydrogen
inventory for PWR reactors. An example calculations are available
for total loss of Feedwater (H2 sequence) for French PWR 900 MWe
for the end of in-vessel phase of the accident. Hydrogen produc-
tion obtained with MAAP4.0.7, ASTECV2.0 and MELCOR1.8.5 (after
5 h) are: 410, 390 and 400 kg respectively (Lombard et al., 2014; De
Rosa, 2008). Similar result can be found for SBO/TMLB’ Zion PWR
simulations (after 5 h) with MAAP4.0.5, SCDAP/RELAP5 MOD3.3
and MELCOR1.8.5 with detailed and simple CVH core nodalizations,
respectively: 490, 510, 530, 470 kg of hydrogen (Vierow et al., 2004;
SNL, 2001). For those two codes, it suggest that there is substantial
difference between BWR and PWR core degradation modeling from
oxidation point of view. One of the possible explanations is the dif-
ference in canisters degradation evolution and what is undeniable
PWRs have no canisters (EPRI, 2014).
In the MELCOR simulation presented in this work, higher
core uncovery rate and lower oxidation rate can be caused by
the simplified CVH nodalization of the core. Applied modeling
simplifies thermal-hydraulic phenomena and leads to possible
under-predictions of the hydrogen production. In the case of
detailed CVH nodalization, PWR SBO model should produce sim-
ilar hydrogen masses for MELCOR and MAAP (Vierow et al., 2004).
Pobrano z http://repo.pw.edu.pl / Downloaded from Repository of Warsaw University of Technology 2024-03-18
Moreover for the simple nodalization predicted inventory can be
lower (SNL, 2001). Code developers from Sandia recommends (it is
not demanded) to develop CVH core model with one CVs per two
core axial levels (SNL, 2014). In general MELCOR in-vessel hydrogen
production is very sensitive to huge set of uncertain parameters and
for same reactor it can give wide span of the results (Gauntt et al.,
2001). MAAP and MELCOR have different oxidation and core degra-
dation models and it is also potential source of differences. MELCOR
applies parabolic oxidation correlation by Urbanic–Heidrick and
MAAP4 uses Baker-Just correlation combined with Cathcert model
(Wang et al., 2014a,b). Those two models are not very different but
they are very sensitive to the temperature variation (as oxidation
does) and even slight difference in oxidation surface temperature
prediction across the core can impact the calculation. Temperature
is controlled by heat transfer with fluid and it seem to be reasonable
that thermal-hydraulics nodalization could have an impact onto
fluid behavior and in consequence on oxidation rate. In MELCOR
code special dT/dz model dedicated to predict core fluid temper-
atures for coarse CVH nodalization containing many COR nodes is
available (and was used). Although, it is still possible that code sim-
plifies gas heat transfer, leading to under or over-prediction of the
temperatures (SNL, 2011b).
Fuel elements lose their integrity and collapse immediately after
entering into temperature range 2600–2800 K (Fig. 10). The degra-
dation starts in the upper central part of the core and process
propagate thought it creating complex debris beds with evolving
molten pools. Material of the fuel assemblies is melting, candling,
refreezing, slumping and successively moving downward.
MELCOR predicts about 10 tonnes of material being transferred
to the lower plenum before the massive relocation preceded by the
core plate failure. Otherwise, MAAP does not predict any material
transfer before the massive relocation. A part of debris and molten
material created in the upper parts of the core relocates downwards
and settles on the lower core structures. Hot material during reloca-
tion is intensively cooled by remaining water and it promotes steam
creation. In the case of MELCOR, the process is more efficient and
secondary core uncovery is quicker (Fig. 9). After the complete core
uncover, the hot material collected on the core plate is no longer
cooled. MELCOR due to its modeling allows molten materials, i.e.,
remained superheated unoxidized metals or control materials to
be transferred to the lower plenum before core plate failure (SNL,
2011b, 2014). Those interacts with water, forms debris and settles
on the lower head. In this process, water in the lower plenum is
intensively transformed into steam which leaves the RPV (Fig. 9).
Phenomenology described above is the main reason of earlier core
uncovery predicted in MELCOR calculation. The mass of molten
material and debris relocated to the lower plenum is presented in
Fig. 13. For MELCOR, it can be observed that the massive relocation
occurs approximately 1 h earlier in comparison to MAAP (Table 3).
During the first massive relocation there are approximately
40 tonnes of material more transported to the lower plenum in the
MELCOR case (Fig. 13). MELCOR relocation takes more time due to
sequenced failure of the core support plate rings. Corium starts to
relocate after 5 h 21 min and it takes more than 1 h to breach the
vessel. The lower head failure is predicted to occur after 6 h 23 min
as a creep-rupture process in one of the sideward nodes and it leads
to calculation termination. The side rupture indicates the interac-
tion with metal layer. Different MELCOR simulations performed
for the ex-vessel phase (beyond the scope of this article) predict
the series of the failures of other lower head nodes and effectively
continuous corium discharge into the reactor pit.
In MAAP, the first relocation occurs after 6 h 20 min due to side-
ward heavy reflector (HR) melt-through (Areva and EDF, 2013c;
Sehgal, 2012). After the first relocation corium stays in the lower
plenum for 30 min only, until the initial RPV rupture occurs. MAAP
has special mode of RPV breach with initial sideward breach due
to interaction with molten metal layer and subsequent breach
(Lombard et al., 2014). The subsequent breach occurs after about
7 h 20 min (Fig. 13) and the second relocation due to core plate fail-
ure is predicted after 7 h 45 min. The plate does not have to support
the whole corium mass and it lasts for longer time.
Due to its specific design, Heavy Reflector was modeled in MEL-
COR by the set of heat structures (Fig. 2) and only relocation through
the core plate is possible. It induces observed differences in the
core relocation results. MAAP has dedicated heavy reflector model
with melt-through capability and MELCOR does not (Sehgal, 2012).
What is worth to mention, MELCOR has ability to model TMI-2
like sideward corium relocation, through the core shroud, bypass
and further to lower plenum (SNL, 2011b). For EPR situation it is
different than in TMI-2. In the HR there are hundreds of low diam-
eter cooling holes and corium cannot relocate massively through
them because there is not enough space. Hence, it is expected that
corium will melt-through HR to the downcomer and slumps down
to the lower plenum (Areva and EDF, 2013c). EPR was modeled
as typical MELCOR PWR core with downcomer not being a part
of core degradation model (COR package) and in consequence it
was not possible to model relocation through it (SNL, 2011b). As an
response to that result it would be desirable to make an attempt
to model downcomer as a part of the core package model. It is not
clear though if this approach is possible. Another interesting and
important attempt would be to add HR as an additional mass to the
COR package with downcomer modeled traditionally. These modi-
fications should change the course of the events and in our opinion
it would consequently increase time to corium relocation and time
to vessel rupture.
MELCOR and MAAP4 lower plenum corium behavior and lower
head interaction models are different and it is the principal rea-
son of the faster lower head failure after mass relocation in the
MAAP case. MAAP4 applies, three layer model of material in the
lower plenum. The top layer is made of particulate debris and it
covers molten metal layer which is placed on the layer of oxide
molten pool. The oxide pool is additionally coated by an isolating
crust. Code effectively models lower plenum as one node (EPRI,
2014; Lombard et al., 2014). In MELCOR different debris materi-
als are located within a lower plenum nodalization structure and
code calculates the distribution of those materials among the com-
plex nodalization. In EPR case it has 6 rings and 4 axial levels.
Lower plenum possible constituents are similar to MAAP: conglom-
erate debris, particulate debris, oxidic pool, metallic pool and crust.
 P. Darnowski et al. / Nuclear Engineering and Design 289 (2015) 8–18
Nevertheless, MELCOR for debris and pools is more mechanistic
than MAAP models (EPRI, 2014; Lombard et al., 2014; SNL, 2011b).
Those two codes predict debris layer or crust between oxide pool
and lower head and due to that first rupture is not expected in the
bottom part of the lower plenum. MELCOR and MAAP in order to
predict creep-rupture failure apply the Larson-Miller logic based
models (EPRI, 2014; SNL, 2011b). In two calculations under con-
sideration, metal layer is main contributor to vessel failure. Metal
layer promotes vessel failure due to the so-called focusing effect
(Sehgal, 2012).
The time history of the pressures, steam and hydrogen masses
in the containment are compared in Figs. 15–17. The increase of
the pressure in the containment starts after PRT tank rupture disc
break. In MELCOR case, PSV valves cycling time span after PRT
disc rupture is longer (Fig. 15). Time period between start of PSV
cycling to PRT disc rupture for MELCOR is 894 s and for MAAP is
840 s, hence dynamics of PRT loading seems to be comparable. For
the first few minutes after disc rupture, steam mass released to
the containment effectively increase pressure. Afterwards, pres-
sure stabilizes at constant level (about 2 bars) and it is mainly due to
quasi-equilibrium between periodical steam release by PSV valves
and steam condensation. In general containment pressure level is
controlled by steam content for all scenario phases (Figs. 15 and 16).
Pobrano z http://repo.pw.edu.pl / Downloaded from Repository of Warsaw University of Technology 2024-03-18
In the course of the depressurization process MELCOR predicts
high pressure peak (Fig. 15) and it is an effect of one control volume
containment model (Tills et al., 2009). MAAP4 containment nodal-
ization is more detailed and gives different response during steam
outflow. After the end of depressurization peak disappears, steam
content falls down and MELCOR pressure is lower due to efficient
condensation (Figs. 15 and 16).
Discrepancy between pressure peak predictions at the
corium massive relocation to the lower plenum was observed
(Figs. 3 and 15). Simulation with MAAP predicts about 4 MPa
peak in RCS whereas MELCOR gives only 1 MPa. Peak properties
strongly depends on amount of water in the lower plenum but it
is also dependant on corium fragmentation and molten corium
heat transfer formulation (SNL, 2014; Humphries et al., 2010).
MAAP4 water mass in lower plenum is larger and during reloca-
tion it produces more steam and generate higher pressure peak
(Figs. 4 and 9). Finally modeling of corium coolant interactions
during relocations are governed by different models and similar
peak could not have been expected. Pressure peak is visible as
change in steam inventory for the containment (Fig. 16) and water
mass in RCS (Fig. 3). It is weak pressure disturbance from the RCS
point of view (Fig. 3). In the containment pressure peaks related to
the relocation are lower than 0.5 bars (Fig. 15). Nevertheless, those
values are not significant and higher pressure peak occurs during
RCS depressurization (Fig. 15). Pressure in the containment during
in-vessel phase is well below design limit (5.5 bars) and there is
no threat to the containment integrity due to over-pressurization.
Hydrogen mass in the containment is presented in the Fig. 17.
Results are close for both codes with mass increasing during core
degradation phase. After 4.5 h when intensive oxidation stops
inventory decreases—due to the operation of the Passive Autocat-
alytic Recombiners. MAAP uses recombiners model based on the
actual Areva PARs, otherwise default code model was used in MEL-
COR simulations (Sehgal, 2012). Therefore, it is possible to conclude
that the observed good agreement is rather incidental. It results
from lower recombination rates predicted with MELCOR as the
hydrogen mass released into the containment is also lower.
6. Conclusions
The paper presents the in-vessel phase simulation results of the
total loss of AC power severe accident for EPR reactor. Compari-
son of results obtained by two different integral Severe Accident
17
codes—MAAP4 and MELCOR was performed. Differences in the
physical models and modeling approach were discussed. It shows
that results are comparable even due to substantial differences in
code capabilities. Similar timing and course of the events during in-
vessel phase of the accident was observed (Table 3). From reactor
safety point of view principal result is comparable time to vessel
breach—end of the in-vessel phase. MELCOR predicts 27 min ear-
lier RPV rupture than MAAP. Another important result from safety
point of view is the estimated time to initiation of SAMG depres-
surization procedure and both codes are in good agreement with
11 min difference.
The MELCOR simulation predicts lower hydrogen in-vessel
production than MAAP code (Fig. 7). Differences in core Thermal-
Hydraulics and core degradation sequence are main contributors
to that effect. Different core degradation evolution is basically
an effect of more intensive water dryout during secondary core
uncover.
MELCOR predicts earlier and different mode of the corium relo-
cation to the lower plenum with more mass being transported.
Corium inventory accumulated in lower plenum before lower head
breach are different by about 40 tonnes. It is believed to be an effect
of different modeling of EPR heavy reflector. MAAP4 has dedicated
heavy reflector model with a possibility of melt-through calculation
and relocation to the downcomer and MELCOR does not.
Reactor Pressure Vessel failure calculated by MELCOR occurs
after six and half hour after accident initiation and it is half an hour
earlier than predicted by MAAP4. Codes have different RPV breach
modeling, MELCOR predicts one failure due to creep-rupture and
MAAP predicts initial and subsequent creep-rupture failures.
Generally core degradation, lower plenum phenomena as well
as hydrogen production are sensitive to changes in large amount
of usually very uncertain parameters like candling heat transfer,
debris porosity, oxidation coefficients, etc. (Humphries et al., 2010;
SNL, 2014; Gauntt et al., 2001). Hence, principal recommendation is
to perform sensitivity analysis to get wider perspective. It is crucial
step and without it we should not state final conclusions about
safety of nuclear reactor, its behavior during severe accident and
potential consequences. Worthy to find that different integral codes
for the same nuclear reactor give comparable results and it provides
a justification to further development of the model and conduction
of more detailed comparison of MELCOR with different codes like
MAAP, ASTEC or SCADAP/RELAP.
Presented MELCOR model is still under development with
a more detailed RPV model, new containment, alternative HR
modeling, new PARs and other features. Further development is
important, especially if authors would like to work with wide range
of alternative scenarios, with consideration of ex-vessel phases and
in order to perform reliable radionuclides source term calculations.
Acknowledgements
The publication was created in the framework of a strategic
project NCBR: “Technologies for the development of safe nuclear
energy”, Research Task No. 9 entitled: “Development and imple-
mentation of safety analysis methods in nuclear reactors during
disturbances in heat removal and severe accident conditions.” The
publication was created also thanks to the fruitful cooperation
between Warsaw University of Technology and AREVA. The authors
would like to thank for AREVA contribution and to Pascal Gandrille
and Werner Schmidt for numerous hints.
References
Areva, EDF, 2013a. The Pre-Construction Safety Report (PSCR) for UK EPR Reactor,
www.epr-reactor.co.uk
 18 P. Darnowski et al. / Nuclear Engineering and Design 289 (2015) 8–18
Areva, EDF, 2013b. UK-EPR PCSR Sub-Chapter: S.1, Section: S.1.2FSc, Fundamental
Safety Overview, vol. 2: Design and Safety. 2.fsc. Station Blackout (SBO), IN STATE
A.
Areva, EDF, 2013c. The Pre-Construction Safety Report (PSCR) for UK EPR Reactor,
UK EPR GDA Submission. RCC-B—Severe Accident Analysis (Chapter 16.2).
Areva, EDF, 2013d. The Pre-Construction Safety Report (PSCR) for UK EPR Reactor,
UK EPR GDA Submission. Components and Systems Sizing (Chapter 5.4).
Bouteille, F., Azarian, G., Bittermann, D., Brauns, J., Eyink, J., 2006. The EPR overall
approach for severe accident mitigation. Nucl. Eng. Des. 236, 1464–1470.
Burns, P.C., Ewing, R.C., Navrotsky, A., 2012. Nuclear fuel in a reactor accident. Science
335, http://dx.doi.org/10.1126/science.1211285
Czech, J., Wirkner, J., Yvon, M., Serret, M., Krugmann, U., Schmidt, K.E., Berger, J.P.,
Grenet, M., 1999. European pressurized water reactor: safety objectives and
principles. Nucl. Eng. Des. 187, 25–32.
De Rosa, F., 2008. LFW-SG accident sequence in a PWR 900: considerations con-
cerning recent MELCOR 1.8.5/1.8.6 calculations. In: 1st European MELCOR Users
Group Meeting, (15–16 December 2008, Villigen).
EPR Working Group, 2014. Multinational Design Evaluation Programme Design-
Specific Common Position No EPR-02—Common Position Addressing
Fukushima-Related Issues (April 2014, Version 3).
EPRI, 2014. Modular accident analysis program (MAAP)—MELCOR crosswalk phase
1 study, Electric Power Research Institute Report.
Fauske & Associates Inc, 1994. MAAP4: Modular Accident Analysis Program for LWR
Power Plant User Manual. EPRI Project RP3131, USA.
Fischer, M., 2004. The severe accident mitigation concept and the design measures
for core melt retention of the European Pressurized Reactor (EPR). Nucl. Eng.
Des. 230, 169–180.
Fischer, M., Henning, A., Surmann, R., 2014. Mitigation of severe accidents in AREVA’s
Gen 3+ nuclear power plants. Nucl. Eng. Des. 269, 323–329.
Gauntt, R.O., Bixler, N., Wagner, K.C., 2001. An Uncertainty Analysis of the Hydrogen
Pobrano z http://repo.pw.edu.pl / Downloaded from Repository of Warsaw University of Technology 2024-03-18
Source Term for a Station Blackout Accident in Sequoyah Using MELCOR 1.8.5.
Sandia National Laboratories Report.
Humphries, L.L., Wagner, K.C., Leonard, M., Cole, R., Gauntt, R.O., Esmaili, H., 2010.
New ‘Best Practice’ Default Values for MELCOR 2.1. Second European MELCOR
User Group, Czech Republic, Prague.
Julin, A., Lehto, M., Dupuy, P., Georgescu, G., Lanore, J.M., Turner, S., Calle-Vives, P.,
Grady, A.M., Phan, H., 2014. Insights from PSA comparison of EPR designs. In:
Probabilistic Safety Assessment and Management PSAM 12, June 2014, Hono-
lulu, Hawaii.
Kim, T.W., Song, J., Huong, V.T., Kim, D.H., Rhee, B.W., Revankar, S., 2014. Sensitivity
study on severe accident core melt progression for advanced PWR using MELCOR
code. Nucl. Eng. Des. 269, 155–159.
Lignini, F., 2013. INPRO Criterion 1.1.1 Robustness of Design Position of the
EPR Reactor Part 3. INPRO Dialogue Forum 7, Vienna, pp. 19–22, November
2013; http://www.iaea.org/INPRO/7th Dialogue Forum/AREVA EPR reactor
Criterion111 robustness PART3.pdf
Lombard, V., Azarian, G., Gandrille, P., 2014. ASTEC V2.0 reactor applications on
French PWR 900 MWe accident sequences and comparison with MAAP4. Nucl.
Eng. Des. 272, 219–223, http://dx.doi.org/10.1016/j.nucengdes.2013.10.010
U.S. NRC, 1975. Reactor safety study—an assessment of accident risks in U.S. Com-
mercial Nuclear Power Plants, WASH-1400 (NUREG 75/014).
NRC, 1988. Regulatory Guide 1. 155—Station Blackout. Nuclear Regulatory Commis-
sion (August 1988).
ONR, 2013. GDA close-out for the EDF and AREVA UK EPR reactor. In: GDA Issue
GI-UKEPR-CC-03 Rev 3—Fukushima Lessons Learnt Impact on UK EPR. Office for
Nuclear Regulation Assessment Report: ONR-GDA-AR-12-025, Rev 0.
Prior, R., Sauvage, E., 2006. Progress on Operating Strategies for Severe Accidents
(OSSA). In: Conduite Accidents Graves NFPSS, FROG EOP 8th Meeting, (Erlangen
12/05/2006).
Sehgal, B.R., 2012. Nuclear Safety in Light Water Reactors—Severe Accident Pheno-
menology. Academic Press, Boston (ISBN: 978-0-12-388446-6).
Sevón, T., 2015. A MELCOR model of Fukushima Daiichi Unit 3 accident. Nucl. Eng.
Des. 284, 80–90.
SNL, 2001. MELCOR Computer Code Manual, vol. 3. Demonstration Problems (Ver-
sion 1.8.5, NUREG/CR-6119).
SNL, 2011a. MELCOR Computer Code Manual, vol. 1: Primer and Users’ Guide, Ver-
sion 2.1. Sandia National Laboratories (NUREG/CR-6119, vol. 1, Rev 3179).
SNL, 2011b. MELCOR Computer Code Manual, vol. 2: MELCOR Computer Code
Manual, vol. 2: Reference Manual, Version 2.1. Sandia National Laboratories
(NUREG/CR-6119, vol. 2, Rev 3194).
SNL, 2012. Fukushima Daiichi Accident Study. Sandia National Laboratories (July
2012, SAND2012-6173).
SNL, 2014. MELCOR Best Modelling Practices—State-of-the-Art Reactor Conse-
quence Analyses Project. Sandia National Laboratories (NUREG/CR-7008).
Tills, J., Notafrancesco, A., Phillips, J., 2009. Application of the MELCOR Code to
Design Basis PWR Large Dry Containment Analysis. Sandia National Laboratories
(Report SAND2009-2858).
Vierow, K., Liao, Y., Johnson, J., Kenton, M., Gauntt, R.O., 2004. Severe accident analy-
sis of a PWR station blackout with MELCOR, MAAP4 and SCADAP/RELAP5 codes.
Nucl. Eng. Des. 234, 129–145.
Wang, J., Corradini, M.L., Fu, W., Haskin, T., Tian, W., Zhang, Y., Su, G., Qiu, S., 2014a.
Comparison of CORA & MELCOR core degradation simulation and the MELCOR
oxidation model. Nucl. Eng. Des. 276, 191–201.
Wang, J., Tian, W., Fan, Y., Mao, K., Lu, J., Su, G., Qiu, S., 2014b. The development of a
zirconium oxidation calculating program module for module in-vessel degraded
analysis code MIDAC. Prog. Nucl. Energy 73, 162–171.
Wang, J., Zhang, Y., Mao, K., Huang, Y., Tian, W., Su, G., Qiu, S., 2015. MELCOR simula-
tion of core thermal response during a station blackout initiated severe accident
in china pressurized reactor (CPR1000). Prog. Nucl. Energy 81, 6–15, http://dx.
doi.org/10.1016/j.pnucene.2014.12.008.