Luka Štrubelj
email: luka.strubelj@gen-energija.si

Evelyne Foerster
email: evelyne.foerster@cea.fr

Giuseppe Rastiello
email: giuseppe.rastiello@cea.fr

James Daniell
email: james.daniell@kit.edu

Behrooz Bazargan-Sabet
email: b.bazargan-sabet@brgm.fr

Pierre Gehl
email: p.gehl@brgm.fr

Philip J Vardon
email: p.j.vardon@tudelft.nl

Varenya Kumar

Duvvuru Mohan
email: v.k.duvvurumohan@tudelft.nl

The Goal of the New Approach to Reactor Safety Improvements (NARSIS) Project

Keywords: External hazards characterisation,  WP2: Fragility assessment of main NPPs critical elements,  WP3: Integration and safety analysis,  WP4 Dissemination, recommendation, and training,  WP7: Project management and coordination Nuclear Reactor, Nuclear Safety, Computer Simulation, Severe Accident, Technical Support Center 1

NUCCON), Poland (NCBJ, WUT), Germany (KIT, Framatome -ex. Areva), Finland (VTT), The Netherlands (TU Delft, NRG), United Kingdom (EDF Energy) formed a consortium and applied to the H2020-Euratom call. The main ambitions of the consortium are to fill some gaps identified in existing external events probabilistic safety analyses (PSA) and to improve parts of the existing methodologies by 3 points: (1) to adapt most up to date frameworks and methodologies already existing or under development outside of nuclear community; (2) to use knowledge and experience on recent national and international projects; (3) to develop demonstration cases at the real NPP scale. Interactions are envisaged with on-going international initiatives and with the International Advisory Board, which will follow and discuss the project results with the aim to propose recommendations for future regulations. The main expected results are the development of an integrated risk framework for safety analyses and the development of a decision-making tool for demonstration of nuclear facility management. The integrated risk framework consists of:

 Scenarios comprising single or multiple external hazards. Hazards can be combined or cascading and include earthquake, flooding, extreme weather and others, 165-2

 The physical and functional fragilities and interdependencies between systems/equipment are taken into account,  Human factors are taken into account and may play important role during severe accidents.  A support decision-making tool will be developed to demonstrate nuclear facility management during severe accidents due to external natural events.

The project is structured into seven work packages (WP)

INTRODUCTION

The lessons learnt from the Fukushima Daiichi nuclear disaster point out the necessity of upgrading the current methodological framework related to areas such as cascading and/or conjunct events characterization, structure responses and uncertainties treatment. New developments in those areas would even enable the extension of their use in accident management.

The NARSIS (New Approach to Reactor Safety ImprovementS project) project propose some elements of improvement to be integrated in the current PSA procedures. The effectiveness of these improvements will be tested and validated in the frame of the project through a set of laboratory experimentations and numerical simulations using generic nuclear power plant and real case applications. To achieve this goal, NARSIS brings together relevant researchers and practitioners in a consortium (Figure 1) and take benefit from the expertise of an advisory board formed by regulatory representatives.

The main objective of NARSIS is to bring sound contributions to the safety assessment methodologies by reviewing, analysing and improving some aspects concerning:

 external hazard events, potentially including events arising from the combination of hazards, frequency estimation of high-intensity low probability events and re-evaluation of screening criteria,  modelling of the structure response to external aggressions, and introduction of new concepts of fragility surfaces, correlation effects and consequent damage scenarios,  theoretical developments for constraining expert judgment, treatment of parameter, model and completeness uncertainties, development of methods based on Bayesian models and human reliability analysis, and  Level 2 PSA aspects of external hazards risk analysis including evaluation of accident management measures in case of external events. The global concept of the proposed project NARSIS consists in providing a scientific framework to address some of these issues not only from a theoretical point of view but also by effectively applying the results at the demonstration level. More precisely, NARSIS project put together three interconnected components:  theoretical improvement in the scientific approach to natural hazards assessment and their impacts including advances in the evaluation of uncertainties and reduction of subjectivity in expert judgments;  validation of the findings in the frame of the safety assessment through adequate model reductions, simulations and experimentations and finally,  application of the outcomes at the demonstration level by providing supporting tools for severe accident management. To reach this goal, NARSIS will rely on a multidisciplinary approach. Indeed, the complexity of the nuclear environment makes safety assessment increasingly difficult by extending the scope of investigations. The appropriate method for building the most likely successful project in this area is that which effectively integrates knowledge from various scientific disciplines and practitioners' experiences. NARSIS project mirrors this fact through the composition of its consortium that encompasses leading universities, research institutes, technical support organizations, nuclear power producers and suppliers, reactor designers and operators. The work is characterised by the active involvement of high-level experts from several disciplines, such as geology and other earth sciences, physics, mathematics, civil and structural engineering, modelling and computing having a common understanding of the concept of safety.

The improvement in the characterization of potential physical threats due to different external hazards and building scenarios related to these hazards are the first concern of the NARSIS project.

165-4

Applying lessons learnt from Fukushima accident, all potential external hazards should be evaluated. Therefore, we propose a comprehensive classification method after analysing the processes from initiation to consequences, and develop a common process to select the most appropriate evaluation in terms of frequency but also severity and impacts. The framework for an integrated analysis will provide means for assessing the risk associated with external hazards based on graded screening approach that will also minimise analytical effort.

Based on theoretical developments, the NARSIS project aims at making a significant leap forward in the scientific approach to reactor safety by proposing updates of some elements required for the safety assessment. These advances would concern three main domains:

Objective 1: Improvement on the characterization of natural external hazards and consideration of concomitant external events, either simultaneous-yet-independent hazards or cascading events.

Indeed, hazards are currently often taken individually, yet they might occur during a similar period, and their effects can then be exacerbated (e.g. earthquake inducing floods due to dykes leakages). The NARSIS project will therefore propose a unique framework to characterise the different events.

Objective 2: Improvement of vulnerability assessment of the elements subjected to complex aggressions and introduction of vector-based fragility surfaces (instead of fragility curves)

Simultaneous events would have conjunct effects on the responses of the structures and the different components of the Nuclear Power Plant (NPP). Furthermore, the combination of different external aggression mechanisms could take place within a single event with, for instance, the coexistence of different strong ground motions phenomena during an earthquake. The NARSIS project will propose new methods to consider several intensity measures (either from a unique or different hazards) in the evaluation of the response of the structures and the critical elements of the NPPs to the external events. Furthermore, the response of the structure is also conditioned by the ageing effect that will be taken into consideration in the project.

Objective 3: Improvement on the treatment of uncertainties including uncertainties related to the integration of the expert judgment in the PSA (Probabilistic Safety Analyses).

One of the main difficulties in determining the occurrence frequency of natural external hazards is the lack of reliable observations for those events whose probability should be estimated, since adequate data samples from experience are incomplete or only available for short durations. The results include significant uncertainties irrespectively of the computational method applied. Thus, even if more and more models and techniques allow reducing the importance of expertise in the safety assessment procedures, experts' judgments are still cornerstones in many steps. In the hazard evaluations, the low probabilities of concerns and the lack of reliable data make the level of experience inadequate. Improvements in the integration could repose on the development of experts' judgment representation, techniques to aggregate several opinions or several sources of information and the evaluation of the uncertainty related to expert-based information. Therefore, the NARSIS project aims at proposing new scientifically based procedures to better constrain the uncertainty related to the knowledge incompleteness, i.e. epistemic uncertainty.

Obviously, any improvement of scientific knowledge needs validation through adequate experiments and simulations. To achieve this objective NARSIS will implement and validate a numerical platform based on the definition of a simplified virtual reactor that would be representative of the European fleet. Improvement of existing simulation methods and notably new development related to the model reduction that consists in the projection of the original, high-dimensional, statespace on a properly chosen low-dimensional subspace in order to obtain smaller system having properties similar to the original system will be a part of the expected works in our project. The impact of complex and multiple external aggressions on the physical integrity of the system will be tested using this simulation tool as well as the accuracy and reliability of methodologies developed for enhancing the safety. NARSIS also proposes a set of laboratory hybrid tests consisting in combination of physical experiments and simulation to exploring how individual components and subsystems will behave. The project is structured into seven work packages (WP), presented on

WP1: EXTERNAL HAZARDS CHARACTERIZATION

The topic of WP1 is to propose new approaches for characterization of potential physical threats a nuclear installation can be exposed to, due to different external natural hazards, focusing on some of them identified as priorities by the PSA End-Users community in the ASAMPSA_E project: earthquakes, flooding and extreme weather. New methodological developments in science dealing with risk and safety will be scrutinized and adapted to safety demands of NPPs. The movement towards a multi-hazard and multi-risk perspective for safety demands of NPPs has occurred over the last few decades starting with a mention in NUREG/CR 5042. However, this has not been approached in a systematic way in terms of a systemic view of the object at risk, in this case, the various facilities operating at a NPP site (different buildings, spent fuel tank(s), power supply systems, etc.) and their physical and logical interactions including dependencies from outside supply and infrastructures. This includeson the hazard side -consideration of all possible scenarios; however, also taking into account combinations of hazards and cascading hazards (hazards that are amplified or triggered by the occurrence of other hazards). An example for multi-hazard cascades is the failure of a dam due to an earthquake and/or its aftershocks causing induced landslides, causing large flooding. Combinations of hazards may have a significantly higher impact on plant safety than each individual hazard. Although the recent stress tests for EU (European Union) nuclear power plants (http://www.oecd-nea.org/nsd/fukushima/ ) considered single primary hazards such as earthquakes and floods, only the resulting recommendations acknowledge secondary effects such as flood and fire following an earthquake. In WP1, such combinations that may be significant for risk will be processed and analysed. The impact of combinations of natural hazards on safety functions need to be reassessed as they may affect different safety functions or the same function in a more severe manner than a single hazard. A detailed review of state-of-the art for hazard, such as earthquake (Figure 3) and multi-hazard characterisation is the first task. This will present the extensive review of existing multihazard approaches and procedures for natural hazard assessment with respect to nuclear hazard and safety.

In the second task of this work package, stochastic analyses of scenarios for hazards will provide a probabilistic basis which contributes to creating the accident scenarios. The systemic understanding of a NPP exposed to natural hazards requires the development of methods and models that capture the internal implications of singular hazards thus the need for the exploration of singular approaches before moving to combined hazards. • Improved methodologies for tsunami hazard assessment will present the use and implications of fast graphical process unit computations for probabilistic hazard assessment on one hand, and on the other hand, the general probabilistic hazard assessment approach to be developed for earthquaketriggered tsunamis [START_REF] Schäfer | Tsupy: computational robustness in Tsunami hazard modelling[END_REF], [START_REF] Terrier | Tsunamis: case study on the coast of the French Mediterranean -Synthesis report[END_REF].

• Improved methodologies for extreme weather and flooding hazard assessment will first report on proposed methods and related uncertainties, to address combination of phenomena in the framework of flooding hazard curves assessment. The probabilistic assessment of failures for some geotechnical safety structures by external hydraulic effects will also be examined.

• Flooding impact on industrial facilities via advanced numerical modelling will also be undertaken presenting the results of smoothed-particle hydrodynamics simulations of a realistic coastal NPP platform for selected flooding event scenarios (i.e. storm). These results will be analysed with respect to the requirements of nuclear engineering.

• Improved methodologies for extreme earthquake hazard assessment will present the implementation of the conditional spectra approach (so-called risk-targeted hazard) [START_REF] Baker | Conditional Mean Spectrum: Tool for ground motion selection[END_REF], [START_REF] Giardini | Mapping Europe's Seismic Hazard[END_REF]. The task focuses on the development of single and secondary effect hazard assessment methodologies including uncertainty quantification and comparison. This will provide methods to analyse extreme hazards using multi-varied statistics and to account for secondary hazards associated with each NPP component separately using physical approaches. On the other hand, it will present a stochastic approach to scenario development, allowing characterization of the hazard curve to integrate all possible uncertainty, temporal and spatial combinations for Design Basis Events for each of the hazards. The task will then be integrated into a combined hazard framework.

The third task of WP1 is thus the production of an integrated hazard framework for combined hazard scenarios for Safety Assessment which shows a systematic framework for combination of hazard scenarios in order to provide an integration of the various single and cascade (internal/external) hazards that are possible at a site. The multi-hazard and multi-risk methodology of the FP7 MATRIX project will be adapted and further developed along the lines of the findings of the first task, so that the risk metric refers to the performance goals for the NPPs and in order to use novel approaches for sensitivity analysis for complex systems [START_REF] Liu | A three-level framework for multi-risk assessment[END_REF], as presented on The last task is the production of an open-source generic software tool for understanding combined hazard scenarios which can then feed in to subsequent work packages. The envisaged output is an open-source generic software tool that allows the application of the multi-hazard methodology developed for users. The scope of this software will depend on the second and third tasks. In addition, recommendations for regulators using the integrated hazard framework will be studied with a synthetic document to be created providing recommendations for the regulators and describing best practice and identified deficiencies in the current methodologies for hazard assessment.

This framework and quantification for multi-hazard assessment serves as an input for WP2, WP3 and WP4 providing the initial framework for the case study assessment as well as the production of singular and combined hazards (e.g. high winds or earthquake & high precipitations leading to structural damage and equipment flooding) and cascades (earthquake with fire-following or floodingfollowing due to damaged spent fuel pool or pipes, etc.) but also the potential impact on supply and infrastructure (road access, power supply, water supply, etc.) in which the NPP is embedded and on which its functionality depends. The sensitivity of the model assumptions creating the hazard curves will be examined including long period combinations of events. We also plan to use novel approaches for sensitivity analysis for complex systems [START_REF] Saltelli | Global sensitivity analysis: the primer[END_REF]. A key result of this task is an open-source generic software tool that allows the application of the multi-hazard methodology developed for users encompassing an integrated multi-hazard framework for nuclear safety assessment accounting for single, cascade and combination events at different time scales.

WP2: FRAGILITY ASSESSMENT OF MAIN NPPS CRITICAL COMPONENTS

As a crucial step of the PSA of a NPP, the vulnerability of the structures, systems and components (SSC) must be quantified with respect to a wide range of external loadings induced by natural hazards. To this end, fragility curves (Figure 5), which express the probability of an SSC to reach or exceed a predefined damage state as a function of an intensity measure representing the hazard loading, are common tools developed in the nuclear industry. Their probabilistic nature make them well suited for PSA applications, at the interface between probabilistic hazard assessments and event tree analyses, in order to estimate the occurrence rate of undesirable top events. Due to the thousands of SSCs that may be comprised within a NPP, most nuclear regulations advocate the application of Safety Factors methods, which consist in multiplying design level values with factors representing uncertainties due to capacity and demand variability. Practitioners have favoured this approach since the 1980s, due to its relative ease of implementation when compared to time-consuming numerical simulations [START_REF] Zentner | Construction of variance-based metamodels for probabilistic seismic analysis and fragility assessment[END_REF].

Therefore, the main objective of WP2 is to develop refined fragility derivation methods in order to increase the accuracy of the estimation of SSC failure rates, thanks to current advances in quantitative hazard modelling and computational capacities. Such fragility models are expected to provide the following features:

 Use of multiple intensity measures expressing a given hazard loading, in order to improve its characterization and reduce its inherent randomness: this is mostly the case for seismic loadings, where the temporal and frequency contents of a ground motion record are only imperfectly represented by a single intensity measure [START_REF] Seyedi | Development of seismic fragility surfaces for reinforced concrete buildings by means of nonlinear time-history analysis[END_REF].  Integration of multi-hazard interactions and cumulated effects (succession of events, ageing mechanisms, fatigue, etc.) within a harmonized multi-hazard framework [START_REF] Gehl | Ranking of epistemic uncertainties in scenario-based seismic risk evaluations[END_REF]. Human factors and organizational aspects, which may be the cause of additional dysfunctions, will also be incorporated to the fragility analysis.  Design of functionality-based damage scales that account for various and potentially concurring failures modes within a single SSC, in order to create harmonized and ready-touse fragility functions for the subsequent safety analysis of the NPP. To this end, a statistical tool of choice will be vector-based fragility functions, which have the ability to represent probabilities of damage as a function of multiple intensity measures. Moreover, the correlation between intensity measures, failure modes and engineering demand parameters will be appropriately treated thanks to the application of system reliability methods [START_REF] Kang | Further development of matrix-based system reliability method and applications to structural systems[END_REF]. Due to the large number of SSCs, the first task of WP2 will be to rank the importance of these components, in order to select only the components for which a refined fragility analysis would have a significant impact on the principal safety functions of the NPP. The model reduction strategies developed in WP4 will also be used in order to reduce the computation load of the numerical simulations. Finally, the resulting fragility models will constitute the elementary building blocks upon which the Bayesian Belief Networks will be assembled in WP3. The interaction of WP2 tasks is presented on Figure 6.

165-9

WP3: INTEGRATION AND SAFETY ANALYSIS

By integrating the characterized hazards and associated fragility functions for various SSC into a global framework, allows for the quantification of risk for the NPP. NPPs involve various social, organisational and technical aspects and are subject to multiple hazards including low-probability and potentially interdependent events. Our understanding of hazards and their effects on SSC, both of which are often time-dependent, is driven by data coupled with the experience of subject experts. This understanding is also subject to varying degrees of uncertainty depending on the extent of data availability, completeness of our models and the inherent stochastic nature of events. Hence, a suitable risk assessment framework should include at least the following key features to enable informed decision-support:

 accounts for the interdependencies of the various hazards, and captures the causal and diagnostic relations between them  accounts for the cascading effects from events  integrates social, organisational and technical aspects of the NPP  accounts for the temporal variation of reliability and damage states of SSC  integrates evolving data as well as expert opinion  quantifies uncertainty associated with the risk model Two main approaches will be investigated in this project: Bayesian Networks (BNs) and the Extended Best Estimate Plus Uncertainty (E-BEPU) method. The BN allows a full system overview whereas the E-BEPU evaluates deterministically the most likely pathways to failure.

A Bayesian network is a specific application of Bayesian probability theory, presented on Figure 7. A BN is a directed acyclic graph which is composed of nodes that correspond to random variables (which can, for example, represent a single structure, system or component), and arcs that link dependent variables. The direction of the arcs indicate the cause-effect relationships between the nodes (i.e. are "directed"), and these arcs never cycle back to parent nodes ("acyclic"). Hence, a Bayesian network is a visually explicit representation ("graph") of the mutual causal relationship between random variables, and represents the joint probability distribution (JPD) of all random variables within the model.

165-10

Figure 7: Examples of Bayesian networks and dynamic Bayesian networks [START_REF] Jensen | Bayesian networks and decision graphs[END_REF].

The dependencies between random variables are usually encapsulated within conditional probability tables (given by (P(Xi)|Parents(Xi))) at each node of the BN. The JPD is given by the chain rule of Bayesian Networks: P(X1, X2,…, Xn) =  𝑖=1 𝑛 P(Xi|Parents(Xi). Through Bayesian inference, the JPD can be queried to infer the state of a random variable given our beliefs regarding the other variables. A dynamic Bayesian network (DBN) is a type of BN where the probability distributions of random variables vary over time. The DBN is composed of discretized time slices that allow for a random variable to have conditional dependencies: (i) with its parents within a given time slice, (ii) with its parents within the previous time slice, and (iii) with itself within the previous time slice.

The risk assessment framework can be separated into two parts; (i) the inference phase, where the resultant probability distributions of each possible action under consideration are derived, and (ii) the decision-making phase, where the safest or most appropriate action is selected. While dealing with multi-hazard systems composed of uncertainties and evolving data, methodologies that apply Bayesian probability theory are assessed to be most appropriate for the inference phase and decision theory-based methods are mostly suited for the decision phase [START_REF] Van Erp | Risk analysis framework for single and multiple hazards[END_REF].

Therefore, a BN, when used in the NPP risk assessment framework, caters to each of the requirements listed earlier. External hazard information and various fragility models assimilated from WP1 and WP2 will be used to construct a BN to model the interdependencies and integrate the risks for a NPP test case. Prior to integration of results from the hazard and fragility models into the BN, uncertainty associated with these models will be characterized and constrained. Individual subnetworks will be built for each of the technical aspects affected by the external hazards. A risk subnetwork will also be included within the BN to account for social/organisational aspects; outcomes from this task could be incorporated into WP5 where a tool will be developed to help decision-making during accident scenarios. The various risk sub-networks will be integrated into the global BN, while devoting additional focus towards assessing the geotechnical response of a flood defence system to extreme weather that could lead to flooding and damage to the NPP.

An "Extended Best Estimate plus Uncertainty" (E-BEPU) analyses will also be developed, combining insights from both probabilistic and deterministic safety analysis to provide sufficient safety margins and eliminate cliff-edge effects. The BEPU method deterministically analyses the consequences from an initiating event. Uncertainties are propagated through the analysis to produce results in probabilities. Typically, however, BEPU analyses are unable to fully take advantage of the both deterministic and probabilistic nature of the analysis and this will be addressed in this project.

The E-BEPU analysis will be used to evaluate "defence-in-depth" (DiD) of the NPP, and also check for performance under "design extension conditions" (DEC) where a scenario unforeseen in the NPP design is assumed. In WP4, the results from the BBN and E-BEPU analyses will be tested and compared using the case of a virtual NPP.

WP3 will also investigate improving procedures to elicit and implement expert opinion into the risk assessment methods detailed above. The interaction between tasks is presented on Figure 8.

165-11

WP4: MODELING REDUCTION STRATEGIES

Safety analyses of NPPs under operation, as well as the design of new reactors, require numerical modelling strategies combining detailed descriptions of the considered structures, systems and components with reduced computational costs. This aspect is of paramount importance for probabilistic reliability and sensitivity analyses. Since thousands of mechanical numerical simulations are often needed the resulting computational times often make these studies not feasible in an industrial framework, in particular when uncertainties (on mechanical properties, external actions) should be evaluated. Reduced modelling strategies provide useful numerical tools for overcoming this limitation. Developing and validating (on a "simplified NPP" defined within the project) this kind of approaches are the main finalities of the WP4.

A simplified theoretical NPP representative (second and third generation) of the European fleet will be defined first. Attention will be focused on the reactor, containment, and associated systems. Critical systems and components will be identified based on experience feedbacks from PSA studies of existing reactors and European stress tests, considering different scenarios and safe shutdown paths (e.g., station blackout). Each selected system will be precisely described in terms of its major components and eventually simplified based on explained and justified considerations. This work will also provide information concerning the determination of criteria for developing model reduction methods (useful for PSAs) for external hazards events.

Based on these criteria, several reduced modelling formulations will be studied, developed and applied. Meta-modelling strategies (response surface or surrogate models), in particular, will be used to apply models for assessing the impact of external hazards on the fragility of critical systems and components from a probabilistic perspective (Figure 9). Widely used in structural reliability modelling, in aircraft industries, and in different domains of natural hazard assessment (e.g., landslides [START_REF] Rohmer | Global sensitivity analysis of large-scale numerical landslide models based on Gaussian-Process meta-modeling[END_REF], coastal flooding [START_REF] Rohmer | A strategy to identify the critical offshore conditions for coastal flooding[END_REF], earthquakes [START_REF] Gehl | Ranking of epistemic uncertainties in scenario-based seismic risk evaluations[END_REF], [START_REF] Zentner | Construction of variance-based metamodels for probabilistic seismic analysis and fragility assessment[END_REF], [START_REF] Wang | Seismic fragility analysis with artificial neural networks: Application the niclear power plant equipment[END_REF], these formulations allow PSAs based on approximate "input-output" relationships. Their applicability for safety analysis purposes will be analysed by studying the simplified NPP's response to different scenarios (design based and beyond basis events) to evaluate consequences on relevant systems, functions, and equipment, as well 165-12 as the related uncertainties. Attention will be focused on natural risks associated with earthquake, flooding and/or tsunamis events. Their combinations will be also considered. Concerning the earthquake risk domain, for instance, these approaches will be used to link the seismic demand (output) to the seismic intensity measure, also taking into account uncertainties on mechanical models parameters and seismic intensity measures (multivariate input parameters).

Figure 9: Workflow for the computation of fragility curves with Artificial Neural Networks (ANN) [START_REF] Wang | Seismic fragility analysis with artificial neural networks: Application the niclear power plant equipment[END_REF].

Enhancements to existing formulations will also be investigated. A challenging scientific task will concern, in particular, the development of a new model reduction method for dealing with complex, highly nonlinear dynamic structural systems. Based on the proper generalized decomposition (PGD) and the LATIN method [START_REF] Ladeveze | The LATIN multiscale computational method and the Proper Generalized Decomposition[END_REF], this model will allow deriving virtual charts related to the NPP units' dynamic response and including parameters related to the seismic loading features.

The simplified NPP model will be finally used to compare existing and new (developed in NARSIS) PSA and DSA (deterministic safety analyses) methods. Different scenarios (WP1) for physical threads (WP1) will be considered, and their consequences on the fragility and functioning of NPP system components (WP2) evaluated. Results of these analyses will the subsequently used in WP5 to support the definition of Severe Accident Mitigation Guidelines (SAMGs), FLEXible coping strategies and Extensive Damage Mitigation Guidelines (EDMG).

The interactions between tasks are illustrated on Figure 10.

WP5: SUPPORTING TOOL FOR SEVERE ACCIDENT MANAGEMENT

The work package (WP5) is about development of decision making supporting tool for severe accident management and its demonstration. The task 5.1 is to define the referential nuclear power plant (NPP) for which the decision supporting tool will be developed. The referential NPP is based on operating power plant in European Union. The safety SSC of referential nuclear power plant include design basis safety SSC, safety SSC to mitigate severe accident and mobile SSC (FLEX equipment). The design basis SSC was installed during the construction of NPP and includes high pressure injection, borated water accumulators, and low pressure safety injections, to supply cooling water and mitigate loss of coolant accident. Emergency diesel generators and batteries are intended to supply energy for operation of pumps, valves and instrumentation and control. Emergency feed water pumps are intended for reactor core cooling. The safety valves are installed at reactor coolant system to decrease pressure below design value. The containment is building around reactor to 165-13 confine the radioactive material and prevent releases to the environment and radioactive doses to the public. After the Fukushima accident stress test were performed on all European NPPs. New SSC was installed in NPPs all over EU, to prevent or mitigate severe accidentsaccidents with core melting. Additional energy sources in terms of diesel generators and batteries were installed. The passive containment venting is installed to decrease the pressure in containment in case of low probable high pressure scenario. The passive autocatalytic recombines were installed to reduce the possibility of hydrogen explosions. Alternative depressurization system was installed to have high confidence for depressurization of reactor coolant system. 10: Simplified flowchart of the organisation of WP4.

The task 5.2 is to describe SAMG applicable to referential NPP. In case of deviation of some measurements in NPP, alarms goes off in control room and the operators use alarm respond procedures to respond to alarms. If they are not able successfully correct the situation, the use abnormal operating procedures is envisaged. If the problems still persists and reactor trip is activated, it means that design basis accident is occurring and emergency operating procedures are used to activate safety SSC. If such action is not successful, the core starts to heat up due to decay heat and severe accident with core degradation or melting can occur. The management of NPP is transferred from operators in control room to the technical support centre. In order to manage severe accidents, the SAMG are used by managers in technical support centre. In contrast to previously used procedures, where operators followed the procedures line by line and no decisions are needed, in SAMG the technical support center needs to take decisions. There can be large amount of information, some of them available only partially, or with high uncertainty. The technical support center managers are under stress due to large damage in NPP, potential releases of radioactivity and time pressure. In order to make good decisions, with appropriate prioritization [START_REF] Bašić | Prioritization of the recovery actions in the Krško NPP SAMGs[END_REF] in timely manner, the decision support tool will be developed. The SAMG includes operations such as:

 Injection to steam generator, to remove decay heat from reactor coolant system.  Depressurization of reactor coolant system, to prevent high pressure melted corium ejection, which can damage containment and causes quick rise of containment pressure and hydrogen generation.

165-14

 Injection to reactor coolant system, which assures coolant water to reactor core to remove decay heat.  Injection of water into containment, to reduce containment pressure and possible radioactive releases. For each operation, several SSC are available as identified in task 5.1. However due to (above design basis) rare and severe external hazards, and rare combinations of hazards some SSC may be damaged. The interaction between design bases, plant status, safety systems and procedures is presented on Figure 11. In task 5.3 the hazard-induced damage states and development of specific accident progression event tree for demonstration purposes will be developed. This includes developing accident progression logic structure for postulated hazard damage states, where damaged SSC will be identified.

Severe accident may take 2 major sequences: high pressure or low pressure sequence. The High pressure sequence starts with initiating event like station black out (total loss of internal and external electricity power), or loss of ultimate heat sink, where decay heat removal is absent and the depressurization of reactor coolant system fails. The core temperature starts to rise and hydrogen production starts in contact of hot steam and cladding. The core starts to melt and can be ejected to containment with reactor vessel failure. The molten corium (melted core and reactor internals) interaction with concrete starts to produce hydrogen and carbon monoxide, which both can form explosive mixture. The deposit of corium on containment walls threatens containment integrity. The containment pressure starts to increase, with reactor pressure vessel failure, which can threaten integrity of containment.

The low pressure sequence starts with initiating event like loss of coolant accident, where the water in reactor coolant system is lost, and there is no medium to remove decay heat. The core temperature starts to rise. The core starts to melt and reactor vessel fails at the bottom. The reactor cavity bellow the reactor pressure vessel can be flooded with water. Hot corium in contact with water can initiate steam explosions, which can threaten containment integrity. The molten corium interaction with concrete and water starts to produce hydrogen and carbon monoxide, which both can form explosive mixture.

The decisions needed to be taken by technical support center, will be identified. The set of attributes against which all decisions will be evaluated in decision support process will be identified. This will include the status of main barriers, fuel cladding, reactor coolant boundary and containment.

Since the status of boundaries is not measured directly some indirect parameters may include temperatures and pressure defined in task 5.4. The containment pressure starts to increase with loss of coolant accident, which can threaten integrity of containment.

In task 5.4 the development of supporting SAMG decision support tool will be developed. The alternative paths, based on alternative decisions will be identified. The information needed for the decision will be identified. The correlation between input and output information will be established, based on deterministic and probabilistic models results. Main input variables such as temperatures and pressure of reactor coolant system, water level in reactor pressure vessel, steam generator level, containment pressure and temperature, hydrogen concentration in containment and radiation monitoring in containment and status of SSC will be used. The main output variables shall be in support to decision making process to managers in technical support center and could include: probability of reactor pressure vessel failure and containment as main physical barriers to prevent radioactive releases; the time till reactor vessel and containment failure. The interaction between tasks is presented on Figure 12.

SUMMARY

Based on recent theoretical progresses, the NARSIS (New Approach to Reactor Safety Improvements Project) project aims at making significant scientific step forward towards addressing the update of some elements required for the safety assessment. These improvements mainly concern:

 Natural hazards characterization, in particular by considering concomitant external events, either simultaneous-yet-independent hazards or cascading events, and the correlation in intra-event intensity parameters.  Vulnerability of the elements to complex aggressions, with the integration of new approaches such as vector-based fragility surfaces and reduced models.  Better treatment of uncertainties through adoption of probabilistic framework for vulnerability curves and non-probabilistic approach to constraining the "expert judgments". More about NARSIS project can be found on http://www.narsis.eu/.

Figure 1 :

 1 Figure 1: Partners of NARSIS project.

Figure 2 :

 2 Figure 2: Work packages and its interactions.

Figure 3 :

 3 Figure 3: Example of 5000-year, 95th Percentile (+2 sigma) ground motion exceedance in terms of PGA for Europe using the SHARE-EU Model (measured in g).

  Figure 4. 165-7

Figure 4 : 3 -

 43 Figure 4: 3-Level Approach as used in the MATRIX project [3], as shown for this project.

Figure 5 :

 5 Figure 5: Example of composite fragility curves as used in nuclear industry standards.

Figure 6 :

 6 Figure 6: Simplified flowchart of the organisation of WP2.

Figure 8 :

 8 Figure 8: Simplified flowchart of the organisation of WP3.

Figure 11 :

 11 Figure 11: Design bases, plant status, safety systems and procedures.

Figure 12 :

 12 Figure 12: Simplified flowchart of the organisation of WP5.

ACKNOWLEDGMENT

The work in the project NARSIS is supported by European Commission, Directorate general research & innovation, by grant agreement 755439.