Safety assessments and severe accidents, impact of external events on nuclear power plants and on mitigation strategies

The Fukushima-Daiichi accidents in 2011 underlined the importance of severe accident management (SAM), including external events, in nuclear power plants (NPP) and the need of implementing efficient mitigation strategies. To this end, the Euratom work programmes for 2012 and 2013 was focused on nuclear safety, in particular on the management of a possible severe accident at the European level. Relying upon the outcomes of the successful Euratom SARNET and SARNET2 projects, new projects were launched addressing the highest priority issues, aimed at reducing the uncertainties still affecting themain phenomena. Among them, PASSAM and IVMR project led by IRSN, ALISA and SAFEST projects led by KIT, CESAM led by GRS and sCO2-HeRO lead by the University of Duisburg-Essen. The aim of the present paper is to give an overview on the main outcomes of these projects.


Introduction
Despite accident prevention measures, including design modification and operating procedures, used in the nuclear power plants (NPP), under operation, some accidents, within very low probability, may evolve into severe accidents with core melting and plant damage and lead to release and dispersion of radioactive materials into the environment, thus constituting a danger for the public health and for the environment. This risk was unfortunately evidenced by the Fukushima Daiichi accidents in Japan in March 2011, which underlined the importance of severe accident management and the need to implement and to improve the corresponding mitigation strategies and systems.
The severe accident phenomena are complex and cannot be addressed completely within the framework of a national research program, therefore the collaboration at European and international level is needed. The integration of the European severe accident research facilities into a pan-European laboratory for severe accident helps understanding the possible accident scenarios and related phenomena and contributes to improve safety of existing and, future reactors.
To achieve these ambitious objectives, several projects were launched under the auspices of EURATOM with the aim at: -filling the gap of knowledge and reducing the uncertainties on phenomena participating in severe accidents such as the core degradation, the core melt and the hydrogen deflagration as addressed in the framework of ALISA and SAFEST projects, developing new mitigation systems and strategies to reduce the source term release in the framework of PASSAM project and a system for heat removal in the framework of the sCO 2 -HeRo project, improving the mitigation strategies in support to the invessel retention as done in the framework of the IVMR project, improving the ASTEC code suitability to address severe accident phenomena and severe accident management for a large number of reactor design including PWR, BWR, VVER and CANDU.

PASSAM project
The PASSAM [1][2][3] (Passive and Active Systems on Severe Accident source term Mitigation) project was launched within the 7th framework programme of the European Commission and coordinated by IRSN. During this four year project (2013-2016) nine partners from six countries: IRSN, EDF and University of Lorraine (France); CIEMAT and CSIC (Spain); PSI (Switzerland); RSE (Italy); VTT (Finland) and AREVA GmbH (Germany) were involved. The PASSAM project aimed at exploring potential enhancements of existing source term mitigation devices and checking the capacity of innovative systems to achieve even larger source term attenuation (acoustic agglomeration systems; high pressure spray agglomeration systems; electric filtration systems; improved zeolite filtration systems; combined filtration systems). Thus, the performed R&D program was mainly of experimental nature, and addressed phenomena able to reduce the radioactive releases to the environment in case of a severe accident.
Consequently the project major outcome was an extensive and sound database that could help the utilities and regulators to assess the performance of the existing source term mitigation systems, to evaluate potential improvements of these systems and to develop severe accident management (SAM) measures. In addition, simple models and/or correlations have been proposed for these systems. Within the objective that their implementation in severe accident analysis codes would help the enhancement of their capability to model SAM measures and to improve the existing guidelines.
Pool scrubbing has been addressed as a first priority topic. It has been demonstrated that the in-pool gas hydrodynamics under anticipated conditions is quite different from the model currently implemented in severe accident analysis codes, particularly at high velocities (i.e., jet injection regime and churn-turbulent flow). Additionally, it has been proved that maintaining a high pH in the scrubber solution in the long run is absolutely necessary for preventing a late iodine release. Sand bed filters (plus metallic pre-filters) showed-out inefficient for gaseous molecular and/or organic iodides; moreover, it was demonstrated that cesium iodide aerosols trapped in the sand filter during a severe accident are unstable allowing a potential delayed source term. On the contrary, CsI particles trapped in the metallic pre-filter do not lead to any significant delayed release. Innovative processes, as acoustic agglomeration and high pressure spray systems were studied with the aim of producing bigger particles upstream of filtered containment venting systems (FCVS), which enhance the filtration efficiency. Actually an increase of the particle size by ultrasonic fields was experimentally observed. Moreover, the hard-to-filter particles (i.e., 0.1-0.3 mm) were drastically reduced in the particle size distribution. The increase in particle size by high pressure sprays could not be measured. However, the system showed a better efficiency regarding the airborne particle concentration which was lower than for low pressure sprays. The performed studies for trapping gaseous molecular and organic iodine using wet electrostatic precipitators (WESP) confirmed the importance of optimizing the WESP design and the need of some pre-WESP steps (e.g. oxidation of I 2 or CH 3 I into iodine oxide particles) to improve the trapping efficiency. Extensive testing of zeolites as gaseous iodine trapper was performed. The results showed very good trapping efficiencies, particularly the so-called silver Faujasite-Y zeolite. Finally, the combination of a wet scrubber followed by a zeolite filtration stage was extensively studied in representative severe accident conditions and showed the ability of this configuration to reach a significant retention for gaseous organic iodides. Small and mid-size facilities have been used for these experimental campaigns: Figure 1 shows a few of them (mostly addressing pool scrubbing research).
Heavily relying on experiments, the PASSAM project provided new data on the ability and reliability of a number of systems related to FCVS: pool scrubbing systems, sand bed filters plus metallic prefilters, acoustic agglomerators [2], high pressure sprays, electrostatic precipitators, improved zeolites and combination of wet and dry systems. Nonetheless, the scope of some of the PASSAM research topics À as fission products and aerosol retention in water ponds À goes beyond FCVS and might be applied for accident situation other than containment venting, e.g. for fission product scrubbing in the wet well of a BWR or for Steam Generator Tube Rupture (SGTR) accident with submerged secondary side.
Complementary to the experimental investigations, the focus was put on trying to get a deeper understanding of the phenomena underlying their performance and to develop models/correlations that allow modelling of the systems in accident analysis codes, like ASTEC.

ALISA project
The ALISA project [4] (Access to Large Infrastructure for Severe Accidents) is a European FP7 Project (Grant Agreement No: 295421). It is a unique project between European and Chinese research institutions in the area of severe accident research providing a shared access to large research infrastructures to study severe accident phenomena.
Such an access to large research infrastructure through ALISA allows optimal use of the R&D human and financial resources in Europe and in China in the complex field of severe accident analysis for existing and future power plants and promotes the collaboration among nuclear utilities, industry groups, research centres, TSOs and safety authorities, in Europe and China. This is precisely the main objective of the ALISA project. Large-scale facilities of the ALISA project are designed to resolve the most important À still pending À severe accident safety issues, ranked with high or medium priority by the SARP group for SARNET NoE. These issues are the coolability of a degraded core, the corium coolability in the RPV, the possible melt dispersion to the reactor cavity, the molten corium concrete interaction and the hydrogen mixing and combustion in the containment. The ALISA program objective is to understand the effect that these events may have on the safety of existing reactors and to define suitable soundly based accident management procedures. The main aim is not only understanding the physical background of severe accidents but also providing with the underpinning knowledge that can help to reduce the severity of the consequences.
In the framework of the project, access to six Chinese facilities belonging to four Chinese research organizations was allowed to European users and six facilities from KIT and CEA were opened to the Chinese partners. The project started on July 1, 2014 and lasted for four years. Two calls for proposals have been undertaken during the project followed by the evaluation and selection of proposals by the User Selection Panel. All the facilities offered for access in Europe and in China have received proposals. The European facilities are QUENCH, LIVE, DISCO, HYKA at KIT, and KROTOS, VITI at CEA, and the Chinese facilities are COPRA from Xían Jiaotong University (XJTU), HYMIT and WAFT from Shanghai Jiaotong University (SJTU), and IVR2D, IVE3D from CNPRI and MCTHBF from Nuclear Power Institute of China (NPIC). The nature of the majority of the Chinese proposals reveals the high demand to evaluate the safety design of their own reactor types. Since some EU and Chinese proposals investigate similar phenomena but in different scale and geometry, such as LIVE and COPRA, HYKA, HYMIT and MCTHBF, the comparison of the test results provide a broader range of applicability. Other proposals investigate different aspects of a same severe accident strategy, such as LIVE and IVR2D/IVR3D. The gained knowledge can provide comprehensive understanding of the phenomena of in-vessel melt retention with external cooling.
A wide range of European and Chinese organizations have participated in the elaboration of the experimental proposals as well as the preparation and analysis of the experiments. Due to strong links to other European projects, ALISA offers a unique opportunity for all partners to get involved in the networks and activities supporting safety of existing and advanced reactors and to get access to large-scale experimental facilities in Europe and in China to enhance understanding reactor core behaviour under severe accident conditions (Fig. 2).

SAFEST project
SAFEST [5] (Severe Accident Facilities for European Safety Targets) is a European project networking the European corium experimental laboratories and CLADS/ JAEA, Japan. The duration of the project is 4.5 years and it was scheduled to end in December 2018. The safest objective is to address the still pending severe accident issues related to accident analysis and corium behaviour in Light Water Reactors.
Moreover, and due to the links to other European projects or platforms (e.g. CESAM, IVMR, NUGENIA/ SARNET, etc.), the SAFEST project offers a unique opportunity for all parties to get involved in the networks and activities supporting safety of existing and advanced reactors and to get access to large-scale experimental facilities in Europe dealing with core behaviour under severe accident conditions. The project is a valuable asset for the fulfilment of the severe accident R&D programs that are being set up after Fukushima and the subsequent European stress tests, addressing both national and European objectives. It has the aim of establishing coordination activities, enabling the development of a common vision and research roadmaps for the next years, and of the management structure to achieve these goals.
Roadmaps on European severe accident experimental research for light water reactors and for GenIV technologies have been developed. Joint R&D has been conducted to improve the excellence of the SAFEST facilities: that includes the corium physical properties measurements, the improvement of these instrumentation, the consensus on scaling law rationales and cross comparison of material analyses.
Joint experimental research was a clear objective in the SAFEST project to provide solutions for the mitigation of severe accident and the limitation of consequences for the current GEN II and III plants. Consequently, the knowledge obtained in SAFEST shall improve severe accident management measures. In addition, it offered competitive advantages for the nuclear industry and contributed to the long-term sustainability of nuclear energy.
A direct outcome from the SAFEST project was the progress towards the creation of an integrated pan-European laboratory for study of corium behaviour in severe accident conditions. Indeed, it covers a very large spectrum of nuclear reactors severe accident phenomenology dealing with corium (mainly oriented at LWRs, even though several aspects of Gen IV severe accidents can be studied in some of the SAFEST facilities). By strengthening the links between European corium facility operators, preparing a common roadmap for future EU research and improving the capabilities and performance of experimental facilities, this laboratory shows-up a valuable asset for the fulfilment of severe accident R&D programs which are being set up after Fukushima-Daiichi and the subsequent stress tests both at the national level and at the European level.
The main results of SAFEST activities include a better understanding of the physical background of severe accidents and a prototypic corium behaviour. It profits to the EU utilities and safety organizations, which will be able to validate (either directly through the access to the SAFEST distributed infrastructure or indirectly through R&D) the hypotheses and assumptions adopted for severe accident scenarios and propose pertinent procedures for accident mitigation taking into account experimental results. The experimental results will be used for the development and validation of models and their implementation in the severe accident codes such as ASTEC, MELCOR, and ATHLET-CD. This enables capitalizing in the codes and in the scientific databases the outcomes of severe accident research, thus allowing preserving and divulgating the knowledge to a large number of current and future end users in Europe.

CESAM project
The CESAM (Code for European Severe Accident Management) project goal was to enhance the ASTEC software system, which is the European reference for the study and the management of core melt accidents for all types of second-and third-generation nuclear power plants (Gen.II and Gen.III NPPs). CESAM [6][7][8]   To this end, simulations of relevant experiments that allow a solid validation of the ASTEC code against single and separate effect tests have been conducted. The topics covered in the CESAM project have been grouped in 9 different areas among which are re-flooding of degraded cores, pool scrubbing, hydrogen combustion, and spent fuel pools behaviour.
Additionaly, modeling improvements have been implemented in the current ASTEC V2.1 series for the estimation of the source term impact on the environment and the prediction of plant status in emergency situations.
Among the most significant developments in terms of functionality, we mention: the possibility of simulating all accident sequences involving a delayed injection of water into the vessel, even if the core is already severely degraded; the possibility to consider new types of objects (internal canisters or channel boxes, sub-channels, cross-shaped control rods) to represent the actual geometry of the BWR cores; the possibility to model non-axisymmetric cores which is also of interest for PHWRs (such as e.g. CANDU NPPs); the improvement of the model of transport and the chemistry of fission products and aerosols in the reactor coolant system and containment.
Moreover, the following physical model improvements have been achieved: integration of a new model of reflooding a degraded core, specifically designed to be applicable to the geometries of porous media; improvement of the oxidation model of Zircaloy cladding exposed to a mixed air/vapour atmosphere, while taking into account nitriding phenomena; improvement of corium behaviour models, to deal with conditions representing transients external vessel cooling circuit (in-vessel melt retention (IVMR) strategy); integration of new corium cooling models with top water in the molten corium-concrete interaction (MCCI) phase, relating to corium ejection and water ingression; integration of a dedicated model for calculating pH in the containment sumps as well as various improvements to the physicochemical behaviour models of iodine in the RCS as well as the containment. Furthermore, the ASTEC numeric performance has been significantly improved which allows reducing computation time and more generally increasing the software reliability. Last but not least, ASTEC reference input decks have been created for all reactor types currently operated in Europe as well as for spent fuel pools. These reference input decks À providing a gross description of plant types such as PWR, BWR, and VVER, without defining any proprietary data of particular plants À account for the best recommendations from code developers. In addition, also a generic input deck for a spent fuel pool has been elaborated. These input decks can be used as a reference guidelines by all (and especially new) ASTEC users. Within CESAM project, benchmark calculations have been performed with other codes (such as MELCOR, MAAP, ATHLET-CD, COCOSYS) to quantify the effectiveness of currently implemented SAM measures based on these generic inputs.
As an extension to CESAM, IRSN is now coordinating a new project called ASCOM, launched in October 2018 as part of NUGENIA's Technical Area 2, "Severe Accidents-SARNET" with the objectives to consolidate the ASTEC developments made during the CESAM project and to develop new functionalities as the partners' needs evolve. The extension of the "generic" data set library will also be continued. These new data sets will primarily concern Gen. III NPPs (AP1000 and VVER-1200), and possibly spent fuel pools and small modular reactors.

IVMR project
The IVMR project [9,10], coordinated by IRSN between 2015 and 2019, aimed at providing new experimental data and a harmonized methodology for the in-vessel melt retention (IVR). The IVR strategy for LWR intends to stabilize and isolate the corium and the fission products inside the reactor pressure vessel and in the primary circuit. The IVR strategy has already been incorporated in the SAM guidance (SAMG) of several operating small-size LWR below 500 MWe (e.g. VVER-440) and it is part of the SAMG strategies for some Gen III+ PWRs of higher power such as AP1000, HPR1000 or APR1400. However, the demonstration of IVR feasibility for large power reactors requires the use of less conservative models leading to a reduction of the safety margins. During the project, several organizations outside Europe (South Korea, China, Russia, Ukraine, and Japan) have joined and provided additional contribution showing then the wide world interest to the IVR topic and the concerns about reactors of new generation adopting the IVR strategy.
As a first step of the project, an in-depth survey analysis of the methodology and a screening of the available computer codes have been performed. Thus, a synthesis of the methodology applied to demonstrate the efficiency of IVR strategy for VVER-440 in Europe (Finland, Slovakia, Hungary and Czech Republic) was carried out. The quite comparable methodologies adopted by the designers lead to very consistent results. The main weakness of the demonstration was identified in the evaluation of the heat flux that could be reached in transient situations, e.g. under the "3-layers" configuration of the corium pool in the lower plenum of the reactor vessel.
Analyses have also started for various designs of reactors with a power between 900 and 1300 MWe [11]. The large discrepancies of the results were justified by the adoption of very different models for the description of the molten pool: homogeneous, stratified with fixed configuration, and stratified with evolving configuration. The latter provides the highest heat fluxes whereas the former, which provides the lowest heat fluxes, is not realistic due to the non-miscibility of steel with UO 2 .
The first obtained results have enabled drawing preliminary conclusions. The most straightforward one is that the majority of current SA codes can be used for deterministic and probabilistic evaluations of IVR, but they must be used with care referring to the up-to-date knowledge of SA phenomenology and the SAMG logic for different reactor designs, using the material properties at extreme conditions, checking and respecting the code limitations and referring to appropriate user specific options. Moreover, some models must even be improved in order to improve their consistency and reliability. In particular, IVR studies require a very detailed meshing of the vessel and mechanical models enabling to evaluate the resistance to high thermal gradient of even a very thin residual layer of steel. Such aspects, which are crucial for IVR, have a negligible impact on the more conventional sequences with early vessel failure and melt release into dry reactor pit. From a general point of view, a PIRT was elaborated in order to identify the models or parameters having the largest impact on the evaluation of risks in case of IVR [10].
Another important conclusion is that the conventional investigations based on the comparison of steady-state heat fluxes with critical heat fluxes (CHFs) at the vessel external surface are not sufficient for the demonstration of a successful IVR. Higher transient heat fluxes can occur during specific transients with molten pool formation and evolution, e.g. either after stratified layer inversion and steel relocation on the top of the pool or after a secondary inversion whether the heavy metal became light again. When using systems codes and dealing with transient situations, the second significant criterion for the success of IVR is the minimum residual thickness of vessel wall and its cold layer which reflects mechanical resistance of pressure vessel against non-isotropic thermomechanical loads.
To account for any transient peak heat flux causing significant ablation in the evaluation of the likelihood of IVR strategy success, a revised methodology is proposed [9]. It is based on the comparison of the residual thickness with the minimum thickness before failure, considering the internal load. That approach requires a tabulation of the minimum thickness as a function of internal pressure, for various types of vessel steel. Such tabulation is to be obtained from detailed mechanical calculations. That revised methodology, which can be easily implemented in deterministic approaches, may also be used for probabilistic studies. The revised methodology implicitly includes the standard criterion (steady-state heat flux lower than CHF at all locations along the vessel).
The most advanced models for stratified pools are able to simulate transient evolution with a possible inversion of the stratification (the heavy metal becoming lighter). This situation is identified as a possibly critical one because it drives highly superheated metal to the top of the pool. In the current state of knowledge, it is very difficult to conclude about the actual risk engendered by this situation because the models describing the kinetics of stratification inversion the heat transfers under transient conditions are not accurate enough. For this purpose, the project has focused on providing new experimental data (e.g. in facilities such as in NITI in Russian Federation: see Fig. 4) for situations such as the inversion of corium pool stratification and the kinetics of growth of the top metal layer. The project also provided new data about the external vessel cooling from full-scale facilities: CERES (at MTA-EK in Hungary) for VVER-440 and a new facility built by UJV (in Czech Republic) for VVER-1000. It also included an activity on innovations dedicated to increase the efficiency of the IVR strategy such as delaying the corium arrival in the lower plenum, increasing the mass of molten steel or implementing measures for simultaneous in-vessel water injection.
With respect to external cooling (ERVC) and CHF issues, only small scale tests were performed, investigating the effects of water chemistry and corrosion of the vessel wall, either under normal condition (EDF-MIT tests) or during the activation of ERVC with borated water. It was observed that natural corrosion of the vessel, producing a porous oxide layer, could have a positive effect on the increase of the local CHF.

sCO 2 -HeRo project
The sCO 2 -HeRo project (2015-2018), led by the University of Duisburg-Essen with 6 partners from 3 countries, was aimed at developing and proving the concept of a new selflaunching, self-propelling, and self-sustaining safety system for nuclear power plants [13].
The supercritical CO 2 heat removal system (sCO 2 -HeRo) is a novel approach to deal with Fukushima-like accident scenarios with combinations of events such as a station blackout (SBO), the loss of ultimate heat sink (LUHS) and the loss of emergency cooling. The system uses the decay heat to power a Brayton cycle with supercritical CO 2 as working fluid. Since a Brayton cycle À which consists in a heat exchanger to the heat source, a turbocompressor system and a heat exchanger to the ultimate heat sink À can fulfil the safety function "removing the decay heat from the core to the diverse ultimate heat sink" and simultaneously produce electricity, which is quite valuable in the case of a station blackout, e.g. for recharging batteries or supporting fans for cooling of the CO 2 . Venker et al. [11,12] have studied the feasibility of this decay heat removal system À with supercritical CO 2 (sCO 2 ) as working fluid À using the German thermalhydraulic code ATHLET. For a boiling water reactor (BWR), the simulation results have shown that such a system has the potential to enlarge the grace time for interaction to more than 72 hr. Figure 5 shows the Brayton cycle attached to a BWR. In case of an accident, the containment isolation valves will be closed and the safety valves (SV) will open. The steam flows into a heat exchanger (CHX), which must be very compact to fit into the limited space available in existing reactors. Inside the CHX the carbon dioxide is heated up. It flows through a turbine, which drives the compressor and generator sitting on the same shaft. Downstream of the turbine, the CO 2 is cooled by air and is delivered to the compressor and to the compact heat exchanger. Since the turbine of the Brayton cycle produces more power than the compressor needs to operate, the excess power is transformed into electricity, in Figure 5, used to power additional fans to improve the heat removal. However, the ATHELT results are based upon best estimates and must be validated with suitable experiments. Within the EU funded project "sCO 2 -HeRo", six partners from three European countries are working on the assessment of this innovative decay heat removal system. The goal is to investigate the technical potential of this system and to build up a small-scale demonstrator (technology readiness level (TRL) 3) at the PWR glass model at Gesellschaft für Simulatorschulung (GfS), Germany [13].   Figure 6 shows the compact heat exchanger from University of Stuttgart attached to the glass model. Figure 7 depicts the sCO 2 -HeRo turbine alternator compressor from University Duisburg-Essen during the cold air tests, and Figure 8 shows heat rejection unit during test at UJV, Rez. The main components of the sCO 2 -HeRo system have been shipped to GfS, Essen and were installed at the PWR glass model.
The tests at Gesellschaft für Simulatorschulung GfS are used to prove the concept and assess technology readiness level 3. Furthermore, the cycle shall be used to gain experience on the design, performance, and operation of sCO 2 loops and the consisting components [14]. Additionally, the results may also provide a pathway for a future use of sCO 2 -cycles in nuclear e.g. for Gen IV reactors.

Knowledge dissemination and education
The projects presented above were also committed to the dissemination of the knowledge among the partners and the general scientific community through several Master trainings and more than 9 PhDs. Moreover, the demonstration prototype of sCO 2 -HeRo was installed at PWR glass model in Essen, Germany and used as part of teaching/training courses.
The results gained and the lessons learned from those projects were also widely disseminated through several peer reviewed articles and have been presented in international conferences (such as ICONE, ICAPP, NURETH and EUROSAFE). As an example, the sCO 2 -HeRo project supported the organization of the 'European sCO 2 -conference' (www.sco2.eu).   Moreover, dedicated workshops were organized in the framework of each project to present and discuss the achievements and the results, to identify the remaining and pending issues. The outcomes of these projects were also used as inputs in international frameworks organized, e.g., under the auspices of the OECD/NEA and the IAEA, such as the IAEA Technical Meeting on severe accident mitigation [15].

Conclusions
The Fukushima Daiichi accidents claimed the crucial need to improve the safety equipment and the mitigation strategies for severe accident. To achieve this ambitious goal, several projects were launched in the severe accidents field of endeavour to address the topics considered of highest priority and reduce the still pending uncertainties on several selected main phenomena. As the great majority of the major severe accident phenomena cannot be addressed within the framework of a national research program only, the PASSAM, SAFEST, ALISA, IVMR and the sCO 2 -HeRo projects were launched under the auspices of EURATOM enabling the collaboration among R&D partners at European and international level.
The achievements of these projects allow getting a better understanding of the severe accident phenomena, such as the core degradation, the core melt and the hydrogen deflagration, and contribute significantly to reduce the related uncertainties. The outcomes of the above mentioned projects contributed also to increase, improve and demonstrate the ASTEC code suitability to address severe accident phenomena and severe accident management for a large number of reactor designs including PWR, BWR, VVER and CANDU.
Moreover, the lessons learned from the projects supported the development of novel mitigation equipment for heat removal and the improvement of innovative strategies in support of the in-vessel retention and the source term reduction.