ASTEC core degradation calculations in support of
Level-2 Probabilistic Safety Assessment for 1300MWe
French reactors: Methodology and preliminary results

Mathieu Monestier, Laure Bellenfant, Guillaume Kioseyian, Laurent Foucher, Laurent Laborde

► To cite this version:

Mathieu Monestier, Laure Bellenfant, Guillaume Kioseyian, Laurent Foucher, Laurent Laborde. ASTEC core degradation calculations in support of Level-2 Probabilistic Safety Assessment for 1300MWe French reactors: Methodology and preliminary results. Annals of Nuclear Energy, 2025, This article is part of a special issue entitled: 'ERMSAR 2024' published in Annals of Nuclear Energy., 219, pp.111458. 10.1016/j.anucene.2025.111458. hal-05099421

HAL Id: hal-05099421

https://asnr.hal.science/hal-05099421v1

Submitted on 5 Jun 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
<figure><img src="image_2.png" /></figure>

# ASTEC core degradation calculations in support of Level-2 Probabilistic Safety Assessment for 1300MWe French reactors: Methodology and preliminary results☆

M. Monestier *, L. Bellenfant, G. Kioseyian, L. Foucher, L. Laborde

Institut de Radioprotection et de Sûreté Nucléaire (IRSN) (Since 2025, Autorité de Sûreté Nucléaire et Radioprotection (ASNR)), 31, avenue de la Division Leclerc, 92260 Fontenay-aux-Roses, France

## ARTICLE INFO

**Keywords:**

Severe accident

L2 PSA

PWR

ASTEC

SAMG

## ABSTRACT

The Institute for Radiation Protection and Nuclear Safety (IRSN) in France has updated its Level-2 Probabilistic Safety Assessment (L2 PSA) for the French 1300MWe Pressurized Water Reactors (PWRs) as part of the decennial safety reevaluation for these specific reactor units. This study was particularly underpinned by computations performed using the IRSN ASTEC V2.2 code. ASTEC, which stands for Accident Source Term Evaluation Code, is the reference integral code employed by IRSN for modeling and predicting the progression of severe accidental sequences. Within this framework, IRSN has conducted a total of 554 simulations of accidental sequences, for both conditions of 100% Nominal Power and of reactor shutdown. These accidental sequences have been defined based on the ASNR results of Level-1 PSA. They encompass the entire spectrum of events starting from initiating event to the point of vessel rupture. Furthermore, these simulations implement state-oriented Emergency Operating Procedures (EOPs) and Severe Accident Management Guidelines (SAMGs). This paper presents the different calculations carried out, outlines the methodology used to define them and the primary outcomes derived.

## 1. Introduction

The IRSN has completed a comprehensive update of its Level-2 Probabilistic Safety Assessment (L2 PSA) for the 1300 MWe Pressurized Water Reactors. This update is part of the ten-year safety review of these reactors, aiming to incorporate the latest advances in safety methodology.

The goal of this Level-2 Probabilistic Safety Assessment is to provide, for the accident sequences identified by the Level-1 PSA, the failure modes of the containment during the progression of a severe accident, the magnitude of the releases into the environment, and the associated probabilities.

A key step in this L2 PSA was to perform thermohydraulic and core degradation calculations for as many representative sequences as possible of those identified by the Level-1 PSA. To this end, IRSN used its ASTEC V2.2 code, which serves as the integral reference code for modeling and predicting the progression of severe accident sequences. In this context, a series of 554 simulations of accidental sequences from

initiating events to reactor vessel failure were conducted.

This paper presents the tools and the methodology used for these calculations, as well as the different simulation hypotheses. It also provides an overview of the results, thus offering a basis for more in-depth analysis and perspectives that can contribute to the improvement of the safety of French PWRs.

## 2. French PWR 1300 modeling with ASTEC

### 2.1. ASTEC code

ASTEC (Accident Source Term Evaluation Code) (Chatelard and Laborde, 2022) is the IRSN reference integral code to model and predict the progression of severe accidental sequences and associated environmental source term. Developed for many years by IRSN, its models reflect the state-of-the-art knowledge on severe accidents and are continuously updated and validated against experimental results and benefit from the experience of international collaborations around ASTEC developed in the European Framework Programs. Its modular

<footnote>* This article is part of a special issue entitled: 'ERMSAR 2024' published in Annals of Nuclear Energy.</footnote>

<footnote>* Corresponding author.
E-mail address: mathieu.monestier@asnr.fr (M. Monestier).</footnote>
## Nomenclature

AFW Auxiliary Feed Water

ASNR Autorité de Sûreté Nucléaire et de Radioprotection

ASTEC Accident Source Term Evaluation Code

CDF Core degradation frequency

CL Cold Leg

CSS Containment Spray System

CT Combustion Turbine (Turbine à Combustion interne en French)

DCH Direct Containment Heating

EOP Emergency Operating Procedures

HL Hot Leg

IRSN Institut de Radioprotection et de Sûreté Nucléaire

LOCA Loss Of Coolant Accident

PAICC Adiabatic isochoric complete combustion pressure

PSA Probabilistic Safety Assessment

RWST Refueling Water Storage tank

SAMG Severe Accident Management Guidelines

SBO Station Black Out

SG Steam generator

SIS Safety Injection System

TRIC Core outlet temperature

UBD Ultimate Backup Diesel (Diesel Ultime de Secours in French)

structure facilitates its validation by comparing simulation results to experimental outcomes. The different ASTEC modules are shown in the Fig. 1.

## 2.2. Models and main assumptions

### 2.2.1. Primary and secondary circuits

The two-phase thermohydraulic of the primary and secondary circuits of the reactor is performed by the CESAR module. The thermohydraulic modeling of the primary and secondary circuits is based on one-dimensional discretization (except in the core where it is two-dimensional) with a numerical approach involving 6 equations. The six-equation two-phase model and the interface temperature model are essential for 'Shutdown States' sequences characterized by low speeds and pressures, separated phases, and non-condensable, as well as for reflooding sequences. Moreover, with the intention of unifying the models used, the six-equation model is also employed for 'Power States' sequences. This model has been validated through experimental tests and is presented in documents (Gómez-García-Torano and Laborde,

2019; Gómez-García-Torano and Laborde, 2021; Gómez-García-Torano et al., 2022).

The primary circuit of the 1300 MWe PWR dataset is discretized into 12 volumes, while the secondary circuit is discretized into 5 volumes.

For initial shutdown states, the Reactor Heat Removal (RHR) and the Intermediate Cooling System (ICS) have been modeled with the CESAR module. The RHR system consists of 2 identical paths, each mainly comprising an aspiration line on 2 hot legs, 1 circulation pump, 1 heat exchanger (with the ICS), an RHR valve, and a discharge line on 2 cold legs. While ASTEC RHR model is fully detailed, the ICS modeled is simplified and only presents a heat exchanger and a fictive source of water at constant pressure and temperature.

The mass, residual power, and activity of fission products and actinides in the degraded core, primary circuit, containment enclosure, as well as in the environment are calculated by the ISODOP module. It particularly assesses the transmutation and natural decay of several thousand isotopes.

The transport and chemical behavior, in the primary and secondary circuits and in the containment, of vapors and aerosols formed by the

<figure><img src="image_3.png" /><figcaption>Fig. 1. ASTEC modules.</figcaption></figure>
condensation of fission products released during core degradation is calculated with SOPHAEROS. It specifically calculates the retention of radionuclides in the primary circuit as well as the size of aerosols and their chemical speciations in the containment and at the level of primary breaches, which could lead to a modification of their behaviors.

### 2.2.2. Containment enclosure

The containment of the French 1300 MWe reactors is ensured by an internal enclosure and an external enclosure, both made of concrete, separated by a space between enclosures maintained at a lower pressure, allowing the collection and filtration of any potential releases.

The conditions within the containment enclosure (thermohydraulics, hydrogen risk, etc.) is evaluated by the CPA module. It includes modeling of passive hydrogen recombiners. Furthermore, the CPA module simulates leaks from the Inner Containment to the Space Between Containments, the environment, and the surrounding buildings.

In the dataset, the containment enclosure of the 1300 MWe PWR is discretized into 19 compartments (18 compartments for the inner containment and 1 for the space between containment). Surrounding buildings and the environment are represented by an additional 5 compartments.

The CPA module is coupled with the COVI module. If the ignition criteria are met in at least one area of the containment, the COVI module provides the value of the peak pressure generated by the adiabatic and isochoric combustion of all the hydrogen present in the containment. The peak pressure value calculated by COVI is an enveloping value in the case of a slow deflagration only.

The results of COVI do not impact the thermohydraulic calculation of the CPA module (no feedback): the calculation of the accidental sequence continues beyond the virtual combustion without considering this potential combustion.

To estimate the dose rate in each compartment constituting the containment enclosure the DOSE module is used. It also calculates the dose rate on the internal walls of each area of the containment enclosure. Both β and γ emitters are considered in the dose rate calculation.

### 2.2.3. Core degradation

The ICARE module models the core degradation in a severe accident situation. This module invokes the ELSA module, which calculates the

release of fission products and materials from the core structure. Numerous models are utilized from the onset of degradation, covering aspects like cladding burst, oxidation of components, flows of molten materials, etc., up to advanced degradation: potential formation of a corium pool, corium flow to the bottom of the vessel, and vessel rupture.

Due to insufficient cooling, the core and vessel components degrade and transform into magma and debris. The bottom-of-the-vessel model in ASTEC V2.2, depending on the simulated transient, considers up to 5 distinct layers of corium: 1 to 3 dense layers of magma surrounded by two layers of debris beds. As the vessel, internal structures, and debris bed particles melt, their components are transferred into the dense magma layers in contact. Regarding mass transfers between corium layers at the bottom of the vessel, a detailed phase separation model is used (Carénini et al., 2014).

The Corium-Concrete Interactions (CCI) in the reactor vessel pit (and potentially other areas) is calculated by the MEDICIS module.

### 2.2.4. Induced break model

During a core meltdown accident, part of the power in the uncovered core areas is dissipated by natural convection. The hot gases exiting the core move towards the cooler areas of the primary circuit, thus forming natural convection circulation loops.

As shown in Fig. 2, there are two modes of steam circulation in the primary circuit:

- Without a water plug in the U-tube, the gases exit the core pass through the Hot Leg (HL), then through the Steam Generator (SG) tubes, then through the intermediate branch, and then through the Cold Leg (CL) before being reinjected into the lower part of the core.

- With a water plug in the U-tube, the steam circulation is blocked: the gases exit the core pass through the HL and some of the SG tubes (direct tubes) where the gases are cooled down. Once cooled, the gases use the other SG tubes (indirect tubes) to go back. Thus, in the HL, there are two directions of gas flow (the hot gases flowing from the reactor vessel to the SG in the upper part of the HL and the cooled gases flowing from the SG to the reactor vessel in the lower part of the HL).

The current version of the code and dataset do not allow modeling

<figure><img src="image_4.png" /><figcaption>Fig. 2. Modes of steam circulation in the RCS.</figcaption></figure>
the two-way flow when there is a water plug in the U-tube. As these situations can be encountered for pressurized core melt scenarios, the modeled flow is therefore incomplete and could underestimate the heating of the hot legs and SG tubes in these situations, where the risk of induced breach opening (in the hot leg or on an SG tube) is important. The possible occurrence of induced breaks is therefore delayed.

Because of these limitations, the PSA uses an additional specific model, based on previous studies, to assess the risk of induced breach opening, their location and the end of the scenario. Thus, in the ASTEC calculation, even if induced breaches model is activated their opening section is set to zero, in order to continue the calculation as long as possible, to have the primary conditions data for the dedicated induced break model.

The locations of the induced breaks correspond to the “weak” points identified in the primary circuit: on the primary hot legs, on the SG tubes and on the pressurizer surge line.

### 2.2.5. Primary pumps seals leak

Based on recent technological advancements in primary pump seals and new loop tests (Karlstein tests from 2014 to 2020), a new and more representative model for leak rates at primary pump seals has been implemented in ASTEC. This model, known as the “Karlstein model,” considers the evolution of the leak rate at primary pump seals during the accidental transient, depending on the thermohydraulic conditions of the primary circuit.

This model is applied in scenarios where the primary pump seals are not cooled.

### 2.2.6. Safety injection system failure for high sump temperature

The primary purpose of the Containment Spray System (CSS) is to mitigate the consequences of a severe accident by reducing the pressure and temperature within the containment building, and by scrubbing and washing out radioactive particles from the containment.

For sequences in which the CSS is unavailable, due to the increasing temperature inside the containment, it is considered in this study that the Safety Injection System also fails from the following instants:

- when a temperature of 120 °C is reached for the medium pressure injection system (ISMP) and 140 °C for the low-pressure injection system (ISBP) in the sumps,

- 24 hours of Safety Injection System (SIS) recirculation operation after the CSS loss.

### 2.2.7. Ultimate backup Diesel (UBD) and combustion Turbine (TAC)

After the Fukushima-Daiichi accidents, an additional power source, the Ultimate Backup Diesel (UBD), was installed in the French nuclear reactors to supply backup systems in the event of a loss of internal power supplies. Additionally, each power plant is equipped with a common internal ultimate backup power source for all its reactors, the Combustion Turbine (TAC).

In the ASTEC dataset, and for some sequences with a total loss of electrical power, for the L2 PSA purpose, it was assumed that the UBD and CT allow the recovery of certain systems, previously unavailable, 4 h after the start of the accident.

### 2.2.8. Stop criterion for ASTEC calculations

In this study, 3 types of scenarios have been considered: scenarios with core degradation and no induced breaks, scenarios with core degradation and induced breaks, and scenarios without core degradation.

For scenarios with core degradation and no induced break, ASTEC calculation is stopped when 200 tons or more of corium is released from the reactor vessel, or 24 h after the vessel failure (to study the secondary flows of corium out of the vessel).

For scenarios without core degradation after 7 days, ASTEC calculation is stopped. It is considered that beyond this delay, the restorations

and repairs are sufficient to prevent core meltdown.

For sequences meeting the criteria for induced breach opening, the calculation is stopped at the vessel rupture. Indeed, due to the non-opening of the induced breaks in the calculation, the end of the degradation is not considered realistic, and anything simulated after the vessel rupture would not be relevant.

## 2.3. Operating procedures

Due to the significant number of calculations required for this support study (554 accidental scenarios), it was necessary to automatize the drive actions of EOPs (Emergency Operating Procedures) and SAMGs (Severe Accident Management Guidelines) into the ASTEC data set.

The correct application of these operating procedures was then subject to a comprehensive validation, as well as a verification on several in-power and shutdown state scenarios.

### 2.3.1. Emergency Operating procedures (EOPs)

The state-based approach involves applying procedures that are developed based on the identified physical state of the reactor, regardless of the events that led to that state.

All EOPs documents are composed of modules and tests that define the steps to be taken to safeguard the reactor. To adapt these operating procedures to the modeling capabilities of the reactor by ASTEC, several hypotheses have been developed and serve as the basis for simplifying the EOPs (for example some systems are partially or not modeled).

The coding of the operation is based on the SENSOR objects of the ASTEC code. These SENSORS are used to define real variables that are used for the management of systems, alarms, automatisms, and operating procedures.

In this study, EOPs operation are halted upon reaching the first criterion between the very high dose rate in the containment (dome or upper annular space) and the exit temperature from the core (TRIC) exceeding 1373 K.

### 2.3.2. Severe accident Management Guidelines (SAMGs)

When the operators conclude the EOP operations, they implement the SAMGs procedures. This SAMG is a post-accident management approach for scenarios with core meltdown, defining recommended actions. The purpose of SAMG is to minimize real-time expert debates and to promote quick and effective decision-making.

Thus, the objectives of SAMG are:

- to prevent or minimize radioactive releases outside of the containment,

- to allow sufficient time before potential loss of containment for implementing population protection measures under emergency plans,

- to bring the unit back to a controllable situation (residual heat removal, submerged corium).

For this study, as for EOPs actions, SAMGs actions were coded based on operators' documents.

Implementation timelines, depending on the plant's situation and system availability (action execution locally or in the control room), were estimated and implemented in the ASTEC input deck. Finally, in situations with total loss of electrical power, field agents and their availability are modeled in the input deck for executing actions locally.

The main immediate actions include stopping the primary pumps and heaters, opening the pressurizer discharge line valves, deisolating the accumulators, managing water make-up operations, isolating the cooling circuit, etc. The main deferred actions concern the management of water supply operations and containment spray system, replenishing the Auxiliary Feed Water (AFW) tank, and managing ventilation of peripheral buildings.
# 3. Connection with Level-2 probability safety analysis

## 3.1. Methodology to select scenarios

The ASTEC simulations in support of the L2 PSA are defined with the Plant Damage State (PDS) list, that is the result of the interface between L1 and L2 PSA. Each PDS is defined by a large set of interface variables attributes, some of them containing useless information for ASTEC simulation. For example, the status of the containment isolation system is only considered in the Accident Progression Event Tree (APET) and is not useful for ASTEC. Therefore, different PDS may be associated to the same ASTEC simulation. Thus, it appears necessary to have a strong and efficient bridge between PDS and definition of ASTEC simulated sequences. To facilitate this task, the IRSN L2 PSA team has specifically developed a graphical interface, presented in (Guigueno et al., 2016).

## 3.2. Selected scenarios

A total of 345 scenarios (261 power states and 84 shutdown states) were defined from around 10,000 PDS. These scenarios are grouped into families of accidents and differ from each other based on the initiating events leading to the accident (breaches, system availability, human errors, etc.). These scenarios are presented in the Tables 1 and 2.

Among the 345 scenarios calculated for this study, not all lead to an accident with core melt. For each sequence leading to core melt, two calculations are performed: one without applying the SAMGs procedure

<table><caption>**Table 1**
Power states scenarios selected for the PSA-2 Studies.</caption><thead><tr><th>Scenario type</th><th>Number of scenarios</th><th>Sub-scenario type</th><th>Description</th></tr></thead><tbody><tr><td rowspan="7">Loss of Coolant accident (LOCA)</td><td rowspan="7">120</td><td>Intermediate breach</td><td>Break from 2.55" to 4.123"</td></tr><tr><td>Small breach</td><td>Break from 0.6173" to 0.8344" (on HL or on primary pumps seal)</td></tr><tr><td>Steam breach</td><td>1 PZR valve blocked open</td></tr><tr><td>Large breach</td><td>10.512" break (on CL or HL)</td></tr><tr><td>Very Large breach</td><td>Guillotine break (on CL or HL)</td></tr><tr><td>Very small breach</td><td>0.265" break on CL</td></tr><tr><td>Leak at the seals of the primary pumps</td><td>0.6173" or 0.8344" break for each primary pump</td></tr><tr><td rowspan="2">Station Black Out (SBO)</td><td rowspan="2">99</td><td>SG Auxiliary Feed Water is unavailable</td><td>With possible leaks at the seals</td></tr><tr><td>SG Auxiliary Feed Water is available</td><td>With possible leaks at the seals</td></tr><tr><td rowspan="2">Steam generator tube rupture</td><td rowspan="2">25</td><td>Refilling auxiliary feed water tank is unavailable</td><td>With possible leaks at the seals</td></tr><tr><td>Steam generator tube rupture</td><td>Rupture of 1 or 2 steam generator tubes</td></tr><tr><td rowspan="2">Secondary pipe rupture</td><td rowspan="2">14</td><td>Steam generator tube rupture and steam line rupture</td><td>Rupture of 1 steam generator tube cumulated with steam pipe rupture</td></tr><tr><td>–</td><td>Break inside or outside the confinement enclosure</td></tr><tr><td>Loss of Coolant accident outside confinement enclosure</td><td>3</td><td>–</td><td>A small primary break located at the thermal barrier of the primary pump motor group in loop 2 leading to the rupture of the ICS circuit and a breach extending outside the containment</td></tr></tbody></table>

<table><caption>**Table 2**
Shutdown states scenarios selected for the PSA-2 Studies.</caption><thead><tr><th>Shutdown states</th><th>Number of scenarios</th><th>Scenario type</th><th>Description</th></tr></thead><tbody><tr><td>Shutdown on RHR, primary circuit closed, two-phase PZR</td><td>4</td><td>Break on the cooling circuit</td><td>3.021" to 10.512" break</td></tr><tr><td>Shutdown on RHR, primary circuit closed, primary circuit depressurized</td><td>13</td><td>Steam break</td><td>One PZR valves blocked open</td></tr><tr><td rowspan="2">Shutdown for maintenance, PZR manhole open</td><td rowspan="2">67</td><td>SBO</td><td>1.093" break</td></tr><tr><td>Break on the primary circuit</td><td>1.093" break</td></tr><tr><td rowspan="3">Shutdown for maintenance, PZR manhole open</td><td rowspan="3">67</td><td>SBO</td><td>1.212" break</td></tr><tr><td>Break on the primary circuit</td><td>1.212" break</td></tr><tr><td>Break on the cooling circuit</td><td>1.212" break</td></tr></tbody></table>

and one applying the SAMGs procedure. In total, this study includes 554 accidental scenarios calculated with ASTEC V2.2 (Table 3).

# 4. Results overview

## 4.1. Core meltdown scenarios

For all the scenarios selected for this support study to the PSA-2 for 1300 MWe reactors of the French fleet, ASTEC V2.2 calculations were carried out until one of the predefined stop criteria was reached.

For the 261 scenarios where the initial state of the reactor is at power, ASTEC V2.2 calculations lead to core degradation in 136 scenarios, representing 92 % of the total Core Damage Frequency (CDF) for power states, while 125 scenarios are stopped 7 days after the initiating events, without core meltdown, representing only 8 % of the total CDF for power states.

For the 84 scenarios where the initial state of the reactor is in shutdown, ASTEC V2.2 calculations lead to core degradation in 73 scenarios, representing 94 % of the total CDF for shutdown states, while 11 scenarios are stopped 7 days after the initiating events, without core meltdown, representing only 6 % of the total CDF for shutdown states.

## 4.2. Induced breaks and water plugs

As previously mentioned, in this study it was decided to keep the induced breach model activated in the ASTEC V2.2 code despite the underestimation of steel temperature due to the double flow caused by the presence of water plugs. However, a zero section was systematically imposed. This was done to detect the achievement of criteria at the 9 identified weak points on the primary circuit (primary hot legs, steam generator tubes, and pressurizer expansion line). Therefore, there is no actual opening of the induced breaches. In case these criteria are met,

<table><caption>**Table 3**
Part of scenarios leading to core degradation.</caption><thead><tr><th rowspan="2">Initial state of reactor</th><th rowspan="2">Total number of scenarios</th><th colspan="2">Scenarios with core degradation</th><th colspan="2">Scenarios without core degradation after 7 days</th></tr><tr><th>Numbers of scenarios</th><th>Parts of the total CDF (%)</th><th>Numbers of scenarios</th><th>Parts of the total CDF (%)</th></tr></thead><tbody><tr><td>Power states</td><td>261</td><td>136</td><td>92</td><td>125</td><td>8</td></tr><tr><td>Shutdown states</td><td>84</td><td>73</td><td>94</td><td>11</td><td>6</td></tr></tbody></table>
the presence of potential water plugs in the primary circuit is indicated, and the calculations are stopped at the vessel's failure.

For all 136 power state scenarios leading to core melt, 48 scenarios meet the criteria for an induced breach occurrence. These sequences represent 29.7 % of the total CDF for power states.

According to ASTEC v2.2 calculations, the most likely scenario families to present induced breaches are the followings:

- SBO with possible leaks at the primary pump seals.

- LOCA with very small breaks in the primary circuit.

- Steam Generator Tube Rupture.

- Secondary piping rupture, with a small break in the containment.

Among the 48 scenarios showing criteria for the occurrence of an induced breach, there are 22 scenarios where induced breaches appear on the pressurizer surge line (representing 14 % of the total power states CDF), 26 scenarios present induced breaches on hot leg (representing 15 % of the total power states CDF).

The Fig. 3 indicates the value of the primary pressure when the criteria for opening an induced breach are met for the 'Power States' sequences, depending on the location of the induced break.

Almost all scenarios that meet the criterion for opening an induced break on the pressurizer surge line exhibit very high primary pressure, exceeding 160 bar. Meanwhile, those with the criterion for opening an induced break on the hot leg present primary pressures between 80 and 160 bar.

### 4.3. SBO scenarios and recovery of water injection systems during SAMGs

For reference cases, meaning without considering Severe Accident Management Guidelines (SAMGs) actions, 136 'power state' scenarios and 73 'shutdown state' scenarios lead to core meltdown. These sequences have been subject to additional calculations with ASTEC V2.2, considering the application of the (SAMGs).

Only a limited number of the foreseen SAMGs actions have a significant influence on the degradation phases of the sequences calculated with the ASTEC V2.2 code:

- the opening of pressurizer surge line valves,

- initiating maximum cooling through the still available SGs,

- the discharge of accumulators,

- the management of water injection systems such as the Chemical and Volume Control System (CVCS), SIS, and CSS.

These actions can change the characteristic moments of the accident scenario (for example, by delaying the moment of vessel rupture) and modify numerous physical parameters (primary pressure at vessel rupture, H₂ production and hydrogen risk, corium mass at the bottom of the vessel, etc.).

In this study, the Ultimate Diesel Generators (UBD) and/or the Emergency Power Supply (TAC) are recovered 4 h after the initiating

events (L2 PSA assumption) in 12 "Power State" scenarios. In these scenarios, the end criteria for the EOPs operation are met before this 4-hours limit (high-level dose rate or TRIC temperature exciding 1373 K). Therefore, in these calculations, after the end of EOPs operation and without the SAMGs operation, systems that could be recovered using the UBD and TAC, such as the CVCS, are never recovered. On the other hand, in calculations that consider SAMGs operation, the CVCS can be recovered and can delay the progression of the degradation phase.

Table 4 presents the main results of 3 scenarios among the 12 discussed previously.

For LOCA_PP_14 and PCint_2_4 scenarios, the primary pressures at the exit of the EOPs procedure are respectively 120 and 160 bar. The opening of the PZR surge line valves allows to reduce primary pressure and thus allows the full discharge of water accumulators. The CVCS is put into operation with a maximum injection flow rate. All these actions will not be sufficient to prevent the rupture of the vessel, which occurs before the complete emptying of the RWST (Refueling Water Storage Tank).

However, these actions have significantly delayed the moment of the reactor vessel rupture, by approximately 1 h and 30 min for the PCint_2_4 scenario, and by 4 h and 30 min for the LOCA_PP_14 scenario.

In the PCint_1_7 scenario, the primary pressure at the exit of the EOPs procedure is around 35 bar. The PZR surge line valves are already open, and about 100 m³ of water are still present in the accumulators and will be injected in the primary during the SAMGs procedure. Moreover, the injection of water by the CVCS system at a maximum flow rate delays by more than 3 days the rupture of the vessel, which occurs after the complete emptying of the RWST (2850 m³). An additional calculation has shown that by limiting the flow rate of the CVCS charge, this sequence could be stabilized in 5 days. However, the injection of water via the accumulators and the CVCS during the degradation phase while applying the SAMGs has no significant impact on hydrogen production in the vessel or the amount of corium at the bottom of the vessel, as shown in the Table 5.

### 4.4. Main conclusions about SAMGs application for power state scenarios

The Table 6 presents the effects of the main SAMG actions on several key parameters that are characteristic of accidental scenarios. It is particularly noticeable that the deisolation and complete discharge of the accumulators are always beneficial. This action significantly delays the vessel rupture moment without significantly increasing the hydrogen risk. Moreover, opening the pressurizer surge valves is always a favorable action. It delays the vessel rupture while depressurizing the primary circuit. However, it should be noted that the late opening of the pressurizer valves can have a negative impact on the hydrogen risk. Furthermore, opening these valves in conjunction with water injection via accumulator discharge can delay vessel rupture, but may have a negative effect on the hydrogen risk (Table 7).

<figure><img src="image_5.png" /><figcaption>Fig. 3. Primary pressure at the opening an induced break for the 'Power States' scenarios.</figcaption></figure>
<caption>**Table 4**</caption>

Impact of recovering water injection systems during SAMGs on the timing of vessel rupture for 3 scenarios.

<table><caption>**Table 5**</caption><thead><tr><th>Scenario name</th><th>Scenario type</th><th>Time of end of EOP application</th><th>Time of vessel rupture (without SAMGs)</th><th>Time of vessel rupture (with SAMGs)</th><th>Accumulator volume of injected water (m³)</th><th>CVCS volume of water injected (m³)</th></tr></thead><tbody><tr><td>LOCA_PP_14</td><td>LOCA with break at primary pumps seals + SBO</td><td>2 h 44 min</td><td>4 h 28 min</td><td>8 h 57 min</td><td>Full accumulators discharge</td><td>236</td></tr><tr><td>PCint_2_4</td><td>Primary circuit intact with leaks at primary pumps leaks + SBO + refeeding AFW tank unavailable</td><td>2 h 52 min</td><td>4 h 23 min</td><td>5 h 48 min</td><td>Full accumulators discharge</td><td>40</td></tr><tr><td>PCint_1_7</td><td>Primary circuit intact with leaks at primary pumps leaks + SBO + AFW unavailable</td><td>1 h 41 min</td><td>7 h 18 min</td><td>3 days 12 h</td><td>109</td><td>2844</td></tr></tbody></table>

Impact of recovering water injection systems during SAMGs on the H₂ mass production and the mass of corium in the vessel.

<table><thead><tr><th rowspan="2">Scenario name</th><th colspan="2">H₂ mass produced (kg)</th><th colspan="2">Mass of corium at the bottom of the vessel (metric ton)</th></tr><tr><th>Without SAMGs</th><th>With SAMGs</th><th>Without SAMGs</th><th>With SAMGs</th></tr></thead><tbody><tr><td>LOCA_PP_14</td><td>590</td><td>600</td><td>130</td><td>130</td></tr><tr><td>PCint_2_4</td><td>600</td><td>510</td><td>60</td><td>60</td></tr><tr><td>PCint_1_7</td><td>690</td><td>730</td><td>130</td><td>110</td></tr></tbody></table>

### 4.5. Description of the PSA-2 prevailing scenario

The scenario discussed in this section is of particular interest, as it was by far the most probable accidental sequence, representing 43 % of the total core melt frequency of this PWR 1300 MWe PSA 2.

This is a sequence of loss of electrical power with 4 leaks at the primary pump seals of 5 t/h (0.0803 in. per breach, or 0.13 cm²). No safety system is operational. The SGs are unavailable and thus it is impossible to cool the primary circuit. The 3 pressurizer relief valves operate on battery power. Therefore, in this sequence, only the pressurizer relief valves can potentially open before the battery discharge, and only the passive accumulators can inject water. The Table 6 presents the main characteristics times of this scenario.

With the SG levels assumed to be unavailable, the reactor operator is quickly directed to the appropriate procedure, asking for the PZR valves opening, and the steam operator must isolate the SGs that have become unavailable. With no cooling from the SGs and no water injection to compensate for the water lost through leaks at the seals and PZR valves, the primary circuit level dropped, and the core was uncovered about 1 h after the initiating event.

At 1 h and half, the accumulators start to discharge their water and the end criterion for the EOP is reached about 10 min after. The first pour of corium (more than 10 tons) into the bottom of the vessel occurs at 6 h 45 min. The rupture of the vessel occurs few minutes later, the primary pressure is around 20 bar and about 80 tons of corium are ejected from the vessel, with 50 tons going towards the vessel pit, the rest being sprayed by DCH (Direct Containment Heating) into the inner containment. Two additional pours of about 15 and 65 tons occur into the vessel pit subsequently around 7 h and 12 h after the initiating event. The collapse of the vessel happens at 12 h and 45 min. Finally, 175 tons of corium pours have exited the vessel 24 h after its rupture, and about 500 tons of corium stay in the vessel bottom.

The Fig. 4 presents the evolution of the primary pressure and corium mass in the vessel's lower plenum.

During the degradation phase, the PZR relief valves are open, but the primary pressure remains high, around 20 bar. When reaching the TRIC 1100 criterion, the primary pressure is around 40 bar. Before the corium relocation in the lower plenum at 6 h 45 min, the primary pressure is around 8 bar, and it abruptly increases when the corium pours into the bottom of the vessel (80 tons) up to 50 bar. It then decreases following

<caption>**Table 6**</caption>

Main conclusions about SAMGs actions.

<table><thead><tr><th>SAMGs actions</th><th>Time between the end of EOPs and vessel rupture</th><th>Primary pressure at vessel rupture time</th><th>Hydrogen risk before vessel rupture</th></tr></thead><tbody><tr><td>Deisolate and complete discharge of accumulators before vessel rupture (13 scenarios)</td><td>Significant increase (&gt;10 %), especially with high accumulator water mass for 10 scenarios</td><td>Pressure remains &lt; 10 bar<br>No impact clearly identified</td><td>Maximum PAICC remains &lt; 4 bar<br>PAICC decreases by more than 10 % for 8 scenarios</td></tr><tr><td>Maximum cooling with SGs (3 scenarios)</td><td>Significant increase for 1 scenario (Low residual power at the end of EOPs)</td><td>Pressure &lt; 20 bars with SAMGs actions</td><td>Maximum PAICC &lt; 4.5 bar</td></tr><tr><td>Enabling CVCS after UBD/CT starting (1 scenario)</td><td>Vessel rupture is delayed by 2 days (possibly 5 days if CVCS is not set at max flow rate)</td><td>Decrease from 12 to 7 bar</td><td>Small impact on PAICC<br>No more hydrogen risk (without SAMGs action, max PAICC was 5.2 bar)</td></tr><tr><td>Opening PZR valves without water injection (6 scenarios)</td><td>Increase (&gt;10 %) for 3 scenarios</td><td>Significant decrease, Pressure &lt; 20 bar for 5 scenarios,<br>40 bar Pressure for one scenario (PZR valve open just before vessel rupture)</td><td>No impact for 5 scenarios,<br>15 % PAICC increase for 1 scenario</td></tr><tr><td>Opening PZR valves combined with accumulators' discharge (11 scenarios)</td><td>Increase (&gt;10 %) for 9 scenarios</td><td>Significant decrease</td><td>No more hydrogen risk for 2 scenarios,<br>Increase of hydrogen risk for 8 scenarios, Max PAICC &gt; 5 bars for 7 scenarios</td></tr></tbody></table>

the opening of the PZR valves, but, at such pressure with the current mechanical models of the vessel, the rupture of the vessel occurs rapidly. Subsequently, the primary pressure is still at 20 bar at the time of the vessel rupture implying a risk of DCH (Direct Containment Heating), which could potentially lead to the destruction of the containment.
<table><caption>**Table 7**
Main characteristics times.</caption><thead><tr><td>Instant</td><td>Event</td></tr></thead><tbody><tr><td>7 min</td><td>Start of operators' orientation</td></tr><tr><td>23 min</td><td>Application of EOPs</td></tr><tr><td>42 min</td><td>The 4 SGs are isolated</td></tr><tr><td>52 min</td><td>PZR valves are opened</td></tr><tr><td>1hr</td><td>PZR valves 1 is out of battery and will remain opened</td></tr><tr><td>1hr11min</td><td>PZR valves 2 and 3 in neutral position</td></tr><tr><td>1hr17min</td><td>Start of core recovery</td></tr><tr><td>1hr25min</td><td>Opening PZR valves 2 and 3</td></tr><tr><td>1hr36min</td><td>Accumulators discharge</td></tr><tr><td>1hr42min</td><td>Reach of criteria TRIC > 1100 and stop of EOPs application</td></tr><tr><td>2hr</td><td>PZR valves 2 and 3 out of battery and will remain opened</td></tr><tr><td>6hr22min</td><td>End of accumulator's discharge</td></tr><tr><td>6hr45min</td><td>First corium pour into the vessel's lower cavity (at least 10 tons)</td></tr><tr><td>6hr46min</td><td>60 tons of corium into the vessel's lower cavity</td></tr><tr><td>6hr53min</td><td>Vessel failure</td></tr></tbody></table>

The Fig. 5 presents an ASTEC visualization of the core degradation. One of the main reasons for this risk of DCH is the rapid rupture of the vessel following the relocation of corium to the bottom of the vessel (only 8 min between the two events). This delay, estimated by the ASTEC V2.2, is quite penalizing, and there are many uncertainties regarding whether the vessel will hold or not. With a slightly longer delay between these two events, the primary circuit would have had

time to continue depressurizing via the PZR valves, and the risk of DCH would have been reduced.

Besides, a significant hardware modification on the PZR valves have been deployed in the framework of the post-Fukushima upgrade for the 1300 MWe reactors and are not fully modeled in this ASTEC input deck. These modifications allow for a faster depressurization of the primary circuit. For example, considering these modifications in the specific scenarios studied previously enables to reduce the primary pressure at the vessel failure and thus allow excluding the DCH risk.

Furthermore, an earlier start of the UBD and CT prevents core meltdown.

## 5. Conclusion

This study has provided a comprehensive overview of accidental scenarios related to the 1300 MWe reactors in the French nuclear power plant, employing the methodology of Level-2 Probabilistic Safety Assessment (PSA-2).

The 554 simulations conducted with the ASTEC V2.2 code allow quantifying various physical phenomena impacting the primary circuit, reactor vessel, secondary circuit, and containment structure. Among these 554 simulations, many scenarios identified as potentially leading to core meltdown by the Level-1 PSA do not lead into a core meltdown situation according to the ASTEC V2.2 calculations.

EOPs and SAMGs driving procedures were coded and implemented

<figure><img src="image_6.png" /><figcaption>**Fig. 4.** Evolution of the primary pressure and corium mass at the bottom of the vessel.</figcaption></figure>

<figure><img src="image_7.png" /><figcaption>**Fig. 5.** Core degradation at 5 h57 (left) and at 6 h53 (right).</figcaption></figure>
into the ASTEC input decks to simulate all operational actions. They have been subjected to validation and verification across many scenarios, both for power and shutdown states. The impact of the main actions carried out within the framework of the SAMGs application have been evaluated on a significant number of accident scenarios.

The results highlight the significance of ongoing material modifications as part of the post-Fukushima and the 4th decade inspection of the 1300 MWe reactors allowing reducing the likelihood of a severe accident occurring and to lessen the consequences of a severe accident for both populations and the environment.

Ultimately, these findings provide crucial insights for the updating of the Probabilistic Safety Assessment for the 1300 MWe reactors, contributing to the enhancement of nuclear safety and informing future decisions regarding reactor design and operation.

## Declaration of competing interest

The authors declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper.

## Data availability

The authors do not have permission to share data.

## References

* Carénini, L., Fleurot, J., Fichot, F., June 2014. Validation of ASTEC V2 models for the behaviour of corium in the vessel lower head. *Nucl. Eng. Design* 272.

* Chatelard, P., Laborde, L., 2022. ASTEC V2.2 code validation: illustrative results and main outcomes. ERMSAR 2022, Karlsruhe, May 16-19.

* Gómez-García-Torano, I., Laborde, L., 2019. Validation of selected Cesar friction models of the ASTECV21 code based on Moby dick experiments. J. Nucl. Eng. Radiat. Sci., 5 (020908-9).

* Gómez-García-Torano, I., Laborde, L., 2021. Modelling reflooding of intact core geometries in ASTEC V2.1: improvements and validation on PERICLES experiments. Nucl. Eng. Design 378, 111157.

* Gómez-García-Torano, I., Laborde, L., Fichot, F., Mutelle, H., 2022. Reflooding of degraded cores in ASTEC V2.1: modelling and validation on pearl experiments. Nucl. Eng. Design 393, 111768.

* Guigueno, Y., et al., 2016. Severe accident risk assessment for NPPs – Software tools and methodologies for level 2 PSA development available at IRSN", PSAM 13.