Study on Typical Design Basis Conditions of HPR1000 With Nuclear Safety Analysis Code ATHLET

The third-generation nuclear power plant Hua-long Pressurized Reactor (HPR1000) is developed based on the experience of Chinese commercial Nuclear Power Plant (NPP) designs, construction, operation and maintenance. It improves the concept of defense in depth and strengthens severe accident prevention and mitigation strategies. The HPR1000 has implemented a number of active and passive innovative safety systems and accident management procedures for design basis conditions, e.g., the employment of Medium Pressure Rapid Cooldown (MCD) and Atmospheric Steam Dump System (ASDS) for the activation of Middle Head Safety Injection (MHSI), the application of Secondary Passive Residual Heat Removal System (SPRHR) for the residual heat removal. In the article, calculations are carried out for HPR1000 nuclear power plant with nuclear system safety analysis code ATHLET (Analysis of Thermal-Hydraulics of Leaks and Transient) 3.1 (Lerchl et al., 2016). By means of conservative deterministic safety analysis approach, transient analyses concerning selected typical design basis conditions, i.e., Large Break Loss-Of-Coolant Accident (LB-LOCA), Small Break Loss-Of-Coolant Accident (SB-LOCA), Steam Generator Tube Rupture accident (SGTR), and Feed water Line Break (FLB) are performed. The ATHLET results are also compared with the results performed by CGN-CNPTRI (China General Nuclear—China Nuclear Power Technology Research Institute) with their own code LOCUST with similar assumptions. The comparisons indicate that, although some discrepancies are detected, the trends of system responses predicted by the two codes are generally in agreement with each other for different accident scenarios. The results also demonstrate that the acceptance criteria for each accident can be met with significant safety margin. Thus, the effectiveness of safety system configuration and accident management procedures is guaranteed.

The third-generation nuclear power plant Hua-long Pressurized Reactor (HPR1000) is developed based on the experience of Chinese commercial Nuclear Power Plant (NPP) designs, construction, operation and maintenance. It improves the concept of defense in depth and strengthens severe accident prevention and mitigation strategies. The HPR1000 has implemented a number of active and passive innovative safety systems and accident management procedures for design basis conditions, e.g., the employment of Medium Pressure Rapid Cooldown (MCD) and Atmospheric Steam Dump System (ASDS) for the activation of Middle Head Safety Injection (MHSI), the application of Secondary Passive Residual Heat Removal System (SPRHR) for the residual heat removal. In the article, calculations are carried out for HPR1000 nuclear power plant with nuclear system safety analysis code ATHLET (Analysis of Thermal-Hydraulics of Leaks and Transient) 3.1 . By means of conservative deterministic safety analysis approach, transient analyses concerning selected typical design basis conditions, i.e., Large Break Loss-Of-Coolant Accident (LB-LOCA), Small Break Loss-Of-Coolant Accident (SB-LOCA), Steam Generator Tube Rupture accident (SGTR), and Feed water Line Break (FLB) are performed. The ATHLET results are also compared with the results performed by CGN-CNPTRI (China General Nuclear-China Nuclear Power Technology Research Institute) with their own code LOCUST with similar assumptions. The comparisons indicate that, although some discrepancies are detected, the trends of system responses predicted by the two codes are generally in agreement with each other for different accident scenarios. The results also demonstrate that the acceptance criteria for each accident can be met with significant safety margin. Thus, the effectiveness of safety system configuration and accident management procedures is guaranteed.
Keywords: design basis conditions, LOCA, SGTR, FLB, HPR1000, ATHLET HIGHLIGHTS • Application of ATHLET 3.1 for the typical Design Basis Conditions (DBCs) transient analysis of a Generation III nuclear reactor design. • Comparison between results of different nuclear system analysis codes.
• Demonstration of the effectiveness of the safety system configuration of a Generation III nuclear reactor design.

INTRODUCTION
The Hua-long Pressurized Reactor (HPR1000) technology is developed based on experiences of Chinese commercial Nuclear Power Plant (NPP) designs, construction, operations, and maintenance (General Nuclear System Ltd., 2018a). By considering operational experience from similar nuclear power plants and the lessons learned from the Fukushima accident, as well as applying new proven technologies, a series of modifications were implemented. The third-generation nuclear power plant HPR1000 improves the design of defense in depth, and strengthens severe accident prevention and mitigation. HPR1000 design proposed by CGN is implemented in FCG (Fang Cheng Gang) Units 3&4 which are under construction (Nian, 2017). The HPR1000 is a third-generation 3-loop Pressurized Water Reactor (PWR), which has a design life of 60 years and a nominal electrical power output of 1,180 MW (General Nuclear System Ltd., 2018a). The system layout of nuclear island is shown in Figure 1 and the main technical characteristics are summarized in Table 1. The HPR1000 design employs three separate safety systems. It incorporates active and passive safety systems and severe accident prevention and mitigation measures. The "safety redundancy" is put into practice for HPR1000 by means of multiple levels of protection that work independently from each other, and some of the key features include: Safety Injection System; Emergency Boration System; Emergency Water Supply System; Secondary Passive Residual Heat Removal System and In-vessel Retention System (IVR) (General Nuclear System Ltd., 2018a). HPR1000 has also employed an innovative accident management procedure for LOCA and SGTR accidents, i.e., the Medium Pressure Rapid Cooldown (MCD). This cooldown procedure is working by discharging the steam through the ASDS from the top of SGs. Both primary pressure and second pressure are reduced at a specific rate corresponding to −250 • C/h as the residual heat is removed via ASDS, so that the middle head safety injection (MHSI) can be activated. The adoption of MCD and MHSI can reduce the primary pressure faster and more actively at the early stages of the transients and therefore can reduce the break flow compared to traditional PWRs, for which the high-pressure head injection (HHSI) systems are commonly used. The effectiveness of the innovative safety system configurations and accident management strategies of the third-generation nuclear power plant ought to be evaluated.
The article aims to evaluate the arrangement and capacity of various safety systems of the newly developed third generation nuclear reactor, e.g., the Medium Head Safety Injection system (MHSI), the Low Head Safety Injection system (LHSI), the accumulator (ACC), Atmospheric Steam Dump System (ASDS), safety valve of pressurizer for depressurization and the capability of the innovative Medium Pressure Rapid Cooldown (MCD), as well as to assess the mitigation strategies of specific accident/event, e.g., the mitigation strategies and the operator actions in the event of Steam

SIMULATION TOOLS USED FOR HPR1000
In the past few decades, plenty of projects were launched for the studies on system transients of nuclear power plants in the events of various accidents. The LOCAs, SGTR and other design basis transients have attracted more attentions for nuclear safety analysis since the Three Mile Island (TMI) nuclear power plant accident. Plenty of institutions have contributed a lot on the Design Basis Condition transients with different simulation tools such as ATHLET, RETRAN, TRAC, CATHARE, RELAP5, and TRACE for di?erent reactor types for the variations of reactor thermal hydraulic parameters. A large amount of knowledge about thermohydraulic processes in the reactor cooling systems under different operational statuses and accident conditions has been gained based on a vast number of experimental and analytical studies (Aksan, 2008;Umminger et al., 2010;Kozmenkov and Rohde, 2013;Asmolov et al., 2014;Wang et al., 2015;Bestion, 2017). The recent studies focus more on the performance of passive safety systems and the increased safety margins of newly developed reactors, as well as the code to code comparisons (Nevo et al., 2012;Wang et al., 2012;Hu et al., 2013Hu et al., , 2014Salehi and Jahanfarnia, 2016;Yousif et al., 2017). In the article ATHLET 3.1A is employed for the transient analysis of LB-LOCA, SB-LOCA, SGTR, and FLB (350 s transient for LB-LOCA, 5,000 s for SB-LOCA, 12,000 s for SGTR, and 3,000 s for FLB), and the results predicted with LOCUST by CGN-CNPTRI are captured for comparison.

Nuclear System Thermal Hydraulic Code ATHLET
In the study the German nuclear system thermal hydraulic code ATHLET 3.1A is employed for the DBC analysis of HPR1000. The code is developed by the GRS (Gesellschaft für Anlagen-und Reaktorsicherheit-a German institute for nuclear plant and reactor safety) to describe the reactor coolant system thermal-hydraulic response during various operating conditions including LOCA accidents Austregesilo and Deitenbeck, 2017). For all working fluids, the system of differential equations used in ATHLET is based on the following general conservation equations for the liquid and vapor phases : Externalmomentumsourceterms (e.g., pumps)

Vapor Momentum
After spatial integration, the above conservation equations lead to a set of first order differential equations. For solving the equation systems, certain additional parameters are determined with closure equations or constitutive models. The code comprises of the following main constitutive models: (1) The wall mass and heat transfer model; (2) The Fluid properties; (3) Liquidvapor interphase mass and energy transfer model; (4) The drift-flux model providing a one-dimensional description of the velocity differences between liquid and vapor phases taking into consideration the void fraction across the flow channel; (5) The form pressure loss and the wall friction pressure loss determining the irreversible pressure loss in a flow channel. ATHLET has incorporated a large spectrum of models as illustrated in Figure 2A (Di Marcello et al., 2015;Wielenberg et al., 2019). With user's interfaces, the other independent modules like the GRS containment code COCOSYS and the Computational Fluid Dynamics (CFD) codes can be coupled. The extended ATHLET-CD code can be applied for the analysis of the beyond design basis conditions considering core degradation. Moreover, as illustrated in Figure 2B, with the GRS analysis simulator ATLAS, the visualization and interactive controls of the above-mentioned codes are enabled.
A systematic validation process based on separate effect tests and integrated experiments of the OECD/NEA/CSNI code validation matrices ensures the capability and quality of the code (Hollands et al., 2019;Wielenberg et al., 2019). The ATHLET has been successfully applied in the case of pre and post-test calculations of both large and small-scale experiments in the frame of International Standard Problems (ISPs), benchmarks and various international and national projects, e.g., the LSTF, PKL, and UPTF test facilities (Yousif et al., 2017;Hollands et al., 2019). The code's capabilities were investigated with the experimental data of test facilities named ATLAS and INKA (Di Marcello et al., 2015). Moreover, the code is validated is against the experimental data of facilities like MYHRRA, KASOLA, and TALL for the Accelerator-Driven Subcritical (ADS) systems and the future Generation IV nuclear applications (Hollands et al., 2019).

The Nuclear System Thermal Hydraulic Code LOCUST
In the article, the results of selected HPR1000 DBC scenarios simulated with LOCUST are captured from the literature (China Nuclear Power Design Co., Ltd., 2018a,b,c,d) and presented in the following chapter for comparison. LOCUST is a system thermal-hydraulic code developed by CGN and it has the capability of performing the analysis of LB-LOCA, IB/SB-LOCA, SGTR, etc. Figure 3 demonstrates the modular structure of LOCUST, the physical models implemented in the code can cover the key phenomena of HPR1000 within the application scope (China Nuclear Power Technology Research Institute, 2019).
The code is used to simulate two-fluid, non-equilibrium, and heterogeneous hydrodynamic conditions in various NPP transients. A six-equation two-phase flow model is employed in hydrodynamics model. These equations represent the balance of mass, momentum and energy for gas phase and liquid phase, as expressed by Equations (1)-(6) (China Nuclear Power Technology Research Institute, 2019).
Continuity equations for gas and liquid phase: Momentum equations for gas and liquid phase: Frontiers in Energy Research | www.frontiersin.org Thermal energy equations for gas and liquid phase: Frontiers in Energy Research | www.frontiersin.org  The constitutive models, e.g., the water state equations, heat transfer properties on the liquid-steam interphase or wall-fluid interface, interphase friction force in different flow regime, are used to solve the conservation equations. Plenty of types of constitutive correlations are built into LOCUST including interphase friction; interphase mass transfer; virtual mass force; wall friction; wall-fluid heat transfer; and direct heating between the gas and liquid. Some models describing special process are developed in the code as summarized in Table 2.
The most important features of LOCUST are the flexible nodalization, capability to analyze two-fluid, thermal nonequilibrium in all fluid volumes. The code is incorporated with models to simulate special processes such as choked flow, thermal stratification, and counter-current flooding limitations. LB-LOCA and SB-LOCA are analyzed using conservative evaluation models, and some of optional physical models in LOCUST are modified according to the requirements of 10 CFR 50 Appendix K (US Nuclear Regulatory Commission, 1974).

SIMULATION OF HPR1000 UNDER SELECTED DBC CONDITIONS
A Design-Basis Accident/Condition (DBA/DBC) refers to the postulated event/condition that a nuclear facility must be designed and built to withstand without loss to the systems, structures, and components that are necessary to ensure public health and safety. The HPR1000 design has groups PIE (Postulated Initial Events) into four categories (DBC-1 to 4) according to their anticipated frequency of occurrence and potential radiological consequences to the public. DBC-1 and DBC-2 indicate normal operation and anticipated operational occurrences. DBC-3 refers to conditions that may occur once during the lifetime of an operating plants and may result in the failure of a small fraction of the fuel rods, while DBC-4 indicates the limiting conditions considered in the design which are unlikely to happen but considered since their consequences might lead to the release of radioactive material in significant quantities (General Nuclear System Ltd., 2018b).
The study aims to investigate four typical DBC-3/4 conditions, i.e., LB-LOCA (DBC-4), SB-LOCA (DBC-3), SGTR (one tube) (DBC-3), and FLB (DBC-3) scenarios, which may result in relatively serious consequences and involve complicated thermal hydraulic phenomena e.g., the two phase critical break flow and two phase phenomena in reactor core. These selected events can also activate various safety systems, e.g., the Medium Pressure Rapid Cooldown (MCD) and may require further actions by the operators, and therefore are of great concern for nuclear safety analysis and pertinent simulation tools.

HPR1000 System Nodalization With ATHLET
ATHLET nodalization scheme of HPR1000 is presented in Figure 4A. The plant model contains 555 control volumes and sub-control volumes, 623 junctions or sub-junctions, and 66 heat structures. The RPV (Reactor Pressure Vessel) and three cooling loops in parallel make up for the basic thermal-hydraulic model of HPR1000. The tube side of the steam generators, the cold legs, the hot legs, the surge-line with the pressurizer, and the RPV comprise the primary side of the RCS. The cold legs are connected to the passive water Accumulators (ACC). The secondary side of SGs, the steam link tank, the Main Steam Lines (MSL), along with the Feed Water (FW) lines, the Emergency Feed Water (EFW), and the Main Steam Isolation Valves (MSIV), form the components of secondary side. The Atmospheric Steam Dump System (ASDS) connects the SGs to the environment. As indicated in Figure 4B, the ATHLET Input Graphics Program (AIG) is applied to create a graphical representation of an ATHLET input data set. It displays the general schematic representation of all control volumes, i.e., the Thermo Fluid dynamic Object (TFOs) and their interconnections. This supports the examination and documentation of the geometry and nodalization of the input data set.

LB-LOCA Simulation
The Large Break Loss of Coolant Accident (LB-LOCA) is considered as a DBC-4 accident for HPR1000 (General Nuclear System Ltd., 2018b). It is imperative for the modern reactor designs to ensure the safety of the public and the environment in the event of LB-LOCA without potential substantial core damage. The passive accumulators and active low-pressure injection systems (activated in case of large break LOCA) are designed as part of the important safety systems to ensure this purpose (General Nuclear System Ltd., 2018a). When RCS pressure falls below a set point, the passive accumulators start to inject coolant passively from the elevated tanks due to the pressure difference and the gravity. The low-pressure injection systems, which are driven by electricity, pump cooling water to the RCS when the system pressure drops to a lower setpoint. Sufficient time margin is guaranteed for further actions since the safety systems transfer water in large quantities into the reactor core after depressurization. With the availability of a proper heat sink and the startup of an active system injection, the ultimate core cooling is ensured.
The study conducted with LOCUST has identified the worst case against acceptance criteria for LB-LOCA of HPR1000 (China Nuclear Power Design Co., Ltd., 2018a). The configuration of the ATHLET model in the article for simulation is therefore in line with these findings. Important penalizing parameters used in the analysis are presented as follows: the break size used for simulation is 0.7 times of double-ended loop leg break. The break is assumed to be on the cold leg between main pump and the reactor pressure vessel inlet. Safety injection in the broken loop is failed. Important initial conditions are: the initial operating power is full power plus the maximum uncertainty; the initial primary temperature is the rated value at power minus the maximum uncertainty; the initial pressure of the pressurizer is the rated value plus the maximum uncertainty to postpone the reactor trip and safety injection signals; low containment pressure is assumed to increase the break flow during the blowdown, and to decrease the core reflood rate. For the safety systems, the main assumptions are: the minimum safety injection flowrate. Safety injection water of broken loop leaks to the containment directly. It is assumed that the SI injects at full flowrate after a delay due to LOOP as SI signal is generated. The ACCs are postulated with fast discharge rate which is conservative for the reflood peaking cladding temperature. Emergency feedwater system (EFWS) is actuated by the SI signal with Loss of Offsite Power (LOOP). The single failure (SF) criterion is assumed to occur on the Emergency Diesel Generator (EDG). Consequently, one RIS train (one MHSI pump and one LHSI pump) and one EFWS train are unavailable. Regarding the LOOP, it's assumed all the coolant pumps begin to coast down at 0 s, leading to a faster depressurization of primary system. The initial conditions of ATHLET simulation are presented in Table 3.
The typical LB-LOCA scenario of HPR1000 can be divided into 4 phases based on relatively independent phenomena, i.e., the blowdown, the core refill, early stage of reflooding, and the late stage of reflooding. The fuel cladding temperature can exhibit 3 peaks in the meantime in accordance with the progression of accident scenario. During the blowdown phase, the fast depressurization leads to the instant vaporization of the coolant in the RCS. The departure from nucleate boiling (DNB) occurs at the high-power region of the reactor core which results in the sharp increase of fuel cladding temperature. Thereafter, the coolant from intact coolant trains and reverse flow of coolant from upper plenum of RPV moisten the core and reduce the cladding temperature. The above-mentioned process causes the first peak cladding temperature (PCT1). During the refill, due to the bypass of coolant injected from accumulator (ACC), only a small amount of coolant flows through the core and cladding temperature rises again. This temperature increase stops at the early stage of reflooding when the safety injection water enters the core in the form of steam after vaporization and this leads to the second peak cladding temperature (PCT2). In the late phase of reflooding, the upper core region may experience a temperature rise again, but the trend is moderate due to the cooling of steam flow and entrained liquid droplets and this results in the third peak cladding temperature (PCT3).
Figures 5A-E present the results of AHTLET for LB-LOCA with the assumptions described above. The LOCUST results are shown with dashed curves for comparison. Figure 5A demonstrates the peak cladding temperature calculated with ATHLET and LOCUST. The two curves exhibit similar timings of three PCTs. However, LOCUST gives a higher overall peak cladding temperature (PCT1) while ATHLET predicts a higher PCT3 during reflooding.
The initial peak cladding temperature (PCT1) is related to the blowdown process after break. However, slight difference of pressure drops in the reactor core in the first a few seconds after break leads to the difference of predicted initial cladding  temperature. It is noteworthy that the cladding temperature drops considerably earlier according to the result of ATHLET than that of LOCUST. This is caused by a slightly higher collapse level in the RPV calculated by ATHLET and resultant earlier completion of reflooding, as indicated in Figure 5B. Figure 5C shows the overall safety injection rate history including the medium/low head safety injection and accumulator discharge rate. The peak injection rate as shown in the figure in the early stage is mainly resulted by the accumulator discharge. The ATHLET gives a higher overall injection rate in the early stage while in the later phase, both curves present similar values. Figures 5D,E present the break flow rate and pressure history predicted by both codes, which are consistent with each other. The time sequence of key events during the LB-LOCA transient predicted with ATHLET is shown in Table 4. The analysis performed for LB-LOCA, as described above, indicates that the peak cladding temperature during the transient predicted with AHTLET, which is 1,016 • C, meet the important acceptance criteria of DBC-4 that the PCTs should not exceed 1,204 • C. Additionally, by considering similar initial conditions and assumptions for the simulation, the results performed with ATHLET are generally in good agreement with those predicted by LOCUST.

SB-LOCA Simulation
The SB-LOCA is classified as a DBC-3 event for HPR1000 (China Nuclear Power Design Co., Ltd., 2018b). The small break LOCAs are characterized by longer period of transient after the break, compared to LB-LOCAs. During the SB-LOCA transient the core remains covered by the coolant at the beginning and the primary system remains at a high pressure relatively. Different break locations, break sizes, the ECCS set points, reactor designs, and the various operator actions, lead to various sequence of events following a small break LOCA in contrast to the large break LOCAs. Therefore, the integral system behavior during a small break LOCA ought to be carefully investigated.
As a significant safety-related system, the Atmospheric Steam Dump System (ASDS) is designed for HPR1000 to eliminate the high-pressure head safety injection. In the event of SB-LOCA and SGTRs, Medium Pressure Rapid Cooldown (MCD) shall be carried out through the ASDS by releasing the steam into the atmosphere to remove the decay heat if the turbine bypass is unavailable. The primary pressure can be reduced accordingly and injection pressure of the middle head safety injection (MHSI) will be reached. In addition, during SB-LOCA with complete loss of MHSI, Low Pressure Full Cooldown (LCD) shall be carried out through the operation of the ASDS, thus the RCS pressure and temperature can be reduced to the injection conditions of the LHSI.
For the simulation performed with ATHLET, the break is assumed to be at the cold leg of the reactor coolant system. A break with an equivalent diameter of 5.0 cm is considered according to the sensitivity study based on LOCUST (China Nuclear Power Design Co., Ltd., 2018b). The initial conditions are chosen to maximize the primary heat and to minimize water inventory. Important assumptions for the initial condition are summarized as follows: initial reactor power is the nominal power plus maximum uncertainty; the average temperature of the coolant is the rated value plus maximum uncertainty; the initial pressure of the pressurizer is the rated value plus the maximum uncertainty to delay the reactor trip and safety injection signals. The single failure is assumed occur on the emergency diesel generator. Consequently, one safety injection system train, one emergency feedwater system for one intact loop are unavailable. This assumption penalizes the water inventory and heat removal for primary side. It is assumed that LOOP occurs at the time of turbine trip. LOOP leads to the coolant pumps trip and maximize time delay of emergency feedwater system and safety injection system startup. The initial conditions of ATHLET simulation for SB-LOCA are presented in Table 3.
The SB-LOCA results in a potential decrease of primary pressure and possible radioactive release to the environment, as well as the decrease of reactor coolant inventory and potential core overheating. SB-LOCAs are mainly gravity-driven accidents, in which the reactor coolant system discharges slowly with the formation of mixing layers in primary system. The reactor core can be heated up at the beginning and the engineered safety systems, e.g., the Medium Head Safety Injection (MHSI), Accumulators (ACC), and Low Head Safety Injection (LHSI) for HPR1000, will be activated to inject coolant through core and prevent further increase of fuel cladding temperature. The time sequence of key events during the SB-LOCA transient simulated with ATHLET is shown in Table 4.
Figures 6A-E demonstrate the important results of SB-LOCA calculated with AHTLET, the LOCUST results are displayed for comparison. Figure 6A demonstrates the pressure variation during the transient. As shown in the figure, shortly after the break, the reactor core is scrammed as the primary pressure drops to the setpoint. Main feedwater flow is isolated, and the turbine is tripped. This leads to an increase of the secondary pressure and the ASDS is activated subsequently to maintain the secondary pressure at the setpoint of 8.6 MPa. As the primary pressure decreases to pressurizer pressure low 3 setpoint, the Medium Pressure Rapid Cooldown (MCD) is triggered through the ASDS by discharging the steam from the top of SGs. Both primary pressure and second pressure are reduced at a rate corresponding to −250 • C/h as the residual heat is removed via ASDS, so that the middle head safety injection (MHSI), as shown in Figure 6B, is activated. Both codes exhibit same trend of pressure history but ATHLET gives a faster pressure decrease and accordingly early activation of ASDS. Figures 6C,D present the change of the break flow rate, RPV collapse level and SG wide range level over time, respectively. It is noteworthy that for ATHLET simulation, the core level experienced a considerable drop between 2,500 and 3,000 s. At around 2700 s, the primary side experienced a pressure drop, as indicated in Figure 6A. This results in a slight increase of safety injection rate and therefore leads to a water level increase in the core. On the other hand, the pressure decrease also results in further evaporation, which can cause level decrease. The overall change of the water level depends on the combine effect of these two phenomena. For ATHLET, the core level exhibits a considerable drop for a short period. However, for LOCUST, the water level also experienced significant oscillation, but the pressure drop is not obvious.
It can be inferred from these simulation results that for the SB-LOCA with above described penalizing assumptions, the configuration and operation strategy of the safety system ensures that the plant can be brought plant into a safe status, that the safety injection can be introduced into the primary system in time and it provides sufficient flow rate to guarantee the core to be covered. Thus, no significant core heat-up would occur. Moreover, the comparison between the results predicted by ATHLET and LOCUST also indicates that, though discrepancies are exhibited, both codes give similar trend of the variations of various parameters.

SGTR Simulation
For PWRs, the performance and reliability of the steam generator are of crucial importance. The steam generator tube rupture accidents may result in the leak of radionuclides from the primary circuit to the secondary side and finally to the environment with the containment being bypassed. More involvement of the operator's actions before the primary loop comes to the Residual Heat Removal (RHR) operation modes, makes SGTR accidents different from other LOCAs. For HPR1000, one SG tube rupture condition (One tube SGTR) is classified as a DBC-3 event.
In case of an SGTR event of HPR1000, the radioactivity could be released by steam or liquid discharge through Main Steam Relief Control Valve (MSRCV) of Atmospheric Steam Dump System (ASDS) or Main Steam Safety Valve (MSSV) and this will lead to a direct discharge of activity to the atmosphere. The typical transient of SGTR event of HPR1000 can be divided into two phases, i.e., the short-term phase until leak elimination and the long-term phase to the safe state.
At the beginning of the event, primary coolant leaks to the secondary side through the break, the primary pressure decreases. The reactor trip signal is triggered. Turbine trip and isolation of Main Feedwater Flow Control System full load lines for all SGs are initiated. Thereafter, the secondary pressure increases and rapidly reaches the setpoint of ASDS. Contaminated steam is thus released to the environment and decay heat is removed. The continuous leakage to secondary side and the decrease of decay heat lead to a primary depressurization. Then the Medium Pressure Rapid Cooldown (MCD) is actuated. The MCD is carried out by reducing the ASDS setpoint in order to cool the Reactor Coolant System with a specific rate of 250 • C/h. The Medium Head Safety Injection (MHSI) pumps are actuated on Safety Injection (SI) signal and start injecting when the primary pressure is lower than their injection head. The MHSI injection flow can compensate the leak flow and thus the controlled state is reached. To eliminate the leak, the operator isolates the affected steam generator from both the steam side and feed side. The injection of MHSI maintains the primary pressure at a stable level. To reduce the leakage flow, the operator can shut down two of the three MHSI pumps. Due to the isolation of the SGa, the pressure of SGa increases until it reaches primary pressure level and the leak is eliminated.
During the RCS cooldown, to ensure the core sub-criticality, the operator uses Emergency Boration System (EBS) to compensate the reactivity insertion resulting from the RCS cooldown. Unaffected Steam Generators and MHSI are used to cool the primary at a rate of 56 • C/h with two or three EBS trains. The SIS in RHR mode can finally be connected and the safe state is reached. The SGTR nodalization is shown in Figure 7. When SGTR occurs, the valve simulating the tube rupture is open and the coolant leaks from primary circuit to the secondary circuit via the valve.
The initial conditions for SGTR event are chosen to maximize the primary heat and to penalize the tube uncovery of SGa (the affected Steam Generator). The initial core power is 102% FP (Full Power). The primary pressure is maximized to increase the difference between primary and secondary pressure. The initial SG level is minimized to penalize the SG tube uncovery. The single failure is assumed at the EFWS train applied to the SGa. This penalizes the steam release and tube uncovery in SGa. The  Table 3.
The transient of selected SGTR case with ATHLET is presented in Figures 8A-E. The time sequence of key events during the SGTR transient calculated with ATHLET is shown in Table 4. Figures 8A,B demonstrate the pressure history of primary and secondary side and the coolant temperature change of an intact loop in the transient of SGTR. Figures 8C,D show the break flowrate and safety injection rate over time. These results indicate that the leak elimination and safe state of the plant can be successfully achieved by automatic accident management strategy. For the safety injection rate, as indicated in Figure 8D, a valley of flow rate is exhibited in LOCUST result at about 4800 s which is not shown in ATHLET result. The MHSI injection rate is quite sensitive to the primary pressure depending on the SG tube break flow rate. As shown in Figure 8B, the break flow rate predicted by AHTLET is slightly higher than that of LOCUST, this results in generally larger MHSI injection rate and thus the valley of injection rate doesn't appear in ATHLET result. Figure 8E shows the prediction of integrated steam mass release via the Atmospheric Steam Dump System (ASDS). According to the study with LOCUST (China Nuclear Power Design Co., Ltd., 2018c), the total steam release from ASDS of SGa is calculated to be slightly more than 100 tons, including about 88 tons released during the short-term phase. The radiological consequences are within the limit of acceptance criteria. As shown in Figure 8E, ATHLET gives a prediction of about 57 tons released during the short-term phase and the total steam release is slightly lower than the result of LOCUST. Therefore, it can be inferred that ATHLET results can reach similar conclusion, since both codes exhibit similar prediction results of total steam release from ASDS of SGa.
Nevertheless, remarkable discrepancies can still be observed between the results of ATHLET and LOCUST for the SGTR accident transient. For instance, the ATHLET calculated primary pressure decreases faster than the prediction of LOCUST shortly after the occurrence of SG tube rupture. This results in the difference in the activation time of MCD, and therefore the difference of pressure responses in secondary side. This could be attributed to the discrepancies of the modeling details between the two codes due to the lack of detailed information, e.g., the possible difference of rupture nodalization, the possible discrepancy of Chemical and Volume Control System (CVCS) charging and letdown rate in the early stage of the transient.

FLB Simulation
A large feedwater system piping break is selected as one of key DBCs to be analyzed in the article. It is defined as a Feedwater Line Break (FLB) which is large enough to prevent the feed water from reaching the SGs. The fluid in corresponding SG may be discharged through the break, resulting in depressurization and a reversal of steam flow from the two intact SGs to the affected SG. The event could result in the overheating of primary loop. Therefore, the primary system heat-up effects of the FLB are evaluated in the study. The initial conditions of ATHLET simulation for FLB are presented in Table 3.
The feedwater system piping break is classified as a DBC-4 event for HPR1000 (General Nuclear System Ltd., 2018b). A feedwater line rupture impairs heat removal from the RCS. This is due to the reduction of flow rate of the main feedwater to the SGs, and the fluid discharged through the break with low enthalpy is not available for heat removal, this reduction of heat removal capability results in the increase of RCS pressure and temperature.
Automatic and manual actions are required during a typical sequence of this event. The current study only addresses the transient from the initial event to the controlled state. After the feedwater line break, the water level in the intact SGs will decrease before the isolation of the affected SG, leading to the primary heat up. After the "Reactor Trip, " the primary temperature and pressure continue to increase due to the decay heat. Then bulk boiling may occur and the pressurizer may be filled. The RCS pressure can be limited by opening PSVs. Then the main steam line will be isolated, and the emergency feed water system will be actuated. Therefore, the residual heat can be continuously removed.
For the ATHLET simulation, the boundary and initial conditions are considered in accordance with LOCST calculation (China Nuclear Power Design Co., Ltd., 2018d). The break is assumed to occur between SG feedwater inlet nozzle and check valve. The size of break is assumed to be corresponding to the area of the SG feedwater inlet nozzle. Main feedwater to all SGs is assumed to be lost after the break occurs. LOOP is assumed to occur at the time of turbine trip. For the initial conditions, the core power is 102% of the full power. Coolant temperature is nominal value plus 2.5 • C uncertainty. The pressurizer pressure is nominal value minus 0.25 MPa uncertainty, and pressurizer level is nominal value minus 7% uncertainty.
The current study only addresses the transient from the initial event to the controlled state. Operators can take actions to achieve the final safe state from controlled state by performing primary cooldown and depressurization via EFWS, ASDS, pressurizer spray and the PSVs. Accordingly, before the operator actions, which is assumed to be about 30 min after the occurrence of the event, the controlled state ought to be ensured, i.e., the RCS pressure can be limited by PSVs, the main steam line will be isolated and the emergency feed water system will be actuated. The system responses of HPR1000 after a typical FLB accident are shown in Figures 9A-C. The time sequence of key events during the FLB transient predicted with ATHLET is recorded in Table 4. The transient time duration of ATHLET results are rescaled as indicated by the labels at the top of the figures, in order to be compared to the results of LOCUST, since considerable discrepancies of time frames of the transients predicted with the two codes are found. As indicated in these figures, for both transients predicted by ATHLET and LOCUST, the RCS pressure is limited by PSVs, the pressurizer dose not overfill, a sufficient subcooling of the hot leg coolant is maintained and there is no risk of core uncovery before the operator action time which is ∼1800 s after the occurrence of the event. Consequently, the controlled state of the plant after FLB is successfully reached. Although discrepancies are detected between the results of ATHLET and LOCUST, the trends of system responses predicted by the two codes are generally in correspondence with each other.

CONCLUDING REMARKS
In the article, calculations are carried out with reference to the HPR1000 nuclear power plant, utilizing a qualified nodalization of the geometry model for the nuclear system safety analysis code ATHLET 3.1. In order to evaluate the arrangement and capacity of various safety systems, e.g., the Medium Head Safety Injection system (MHSI), the Low Head Safety Injection system (LHSI), the accumulator (ACC), Atmospheric Steam Dump System (ASDS), and safety valve of pressurizer for depressurization, as well as to assess the mitigation strategies of specific accident/event, several typical design basis conditions (DBC) of HPR1000, i.e., LB-LOCA, SB-LOCA, SGTR, and FLB are selected in the article for the transient analysis. The results of ATHLET are also compared with those performed by LOCUST with similar conservative assumptions. The noteworthy findings are summarized as follows.
For the analysis performed for LB-LOCA, it can be concluded that the peak cladding temperature during the transient predicted with AHTLET, which is 1,016 • C, meet the important acceptance criteria of DBC-4. Additionally, by considering similar initial conditions and assumptions for the simulation, the results performed with ATHLET are generally in good agreement with those predicted by LOCUST.
For the SB-LOCA with penalizing assumptions, the configuration and operation strategy of the safety system ensures that the plant can be brought into a safe status, that the safety injection can be introduced into the primary system in time and it provides sufficient flow rate to guarantee the core to be covered. Thus, no significant core heat-up would occur. Moreover, the comparison between the results predicted by ATHLET and LOCUST also indicates that, though discrepancies are exhibited, both codes give the similar trend of the variations of various parameters during the transient.
For SGTR events of HPR1000, according to the study with ATHLET, the total steam release from ASDS of SGa is calculated to be slightly less than the result of LOCUST. Accordingly, the radiological consequences are within the limit of acceptance criteria. Both ATHLET and LOCUST code exhibit similar prediction results of total steam release from ASDS of SGa, though discrepancies can still be observed between the results of both codes.
Regarding the FLB accidents, for both transients predicted by ATHLET and LOCUST, the RCS pressure is limited by PSVs, the pressurizer dose not overfill, a sufficient subcooling of the hot leg coolant is maintained and there is no risk of core uncovery before the operator action time, which is supposed to be about 1800 s after the occurrence of the break. Therefore, the controlled state of the plant after FLB can be reached successfully. Although considerable discrepancies are detected, the trends of system responses predicted by the two codes are generally in correspondence with each other.
Based on the transient analyses and comparison carried out in the study, it can be inferred that, the discrepancies between the results predicted with the two codes might be attributed to the discrepancies of the modeling details between the model of AHTLET and that of LOCUST due to the lack of detailed information, the different nodalization schemes as well as the differences of physical models incorporated into the codes. Further investigations in detail concerning these discrepancies are foreseen in near future. Nevertheless, the results indicate that the acceptance criteria for each accident taken into account can be met with significant safety margin, and both codes present similar trends of system response for different accident scenarios.

DATA AVAILABILITY STATEMENT
The datasets presented in this article are not readily available for reasons of confidentiality. Please contact the corresponding author for the requests to access the datasets.

AUTHOR CONTRIBUTIONS
XH has written and organized the structure of the article, and has performed some of the calculations presented in the article. WZ and CL have performed some of the calculations in the article. YY has given some advice about the article. All authors contributed to the article and approved the submitted version.