Code assessment and modelling for Design Basis Accident analysis of the European Sodium Fast Reactor design. Part II: Optimised core and representative transients analysis

The new reactor concepts proposed in the Generation IV International Forum require the development and validation of computational tools able to assess their safety performance. In the ﬁrst part of this paper the models of the ESFR design developed by several organisations in the framework of the CP-ESFR project were presented and their reliability validated via a benchmarking exercise. This second part of the paper includes the application of those tools for the analysis of design basis accident (DBC) scenarios of the reference design. Further, this paper also introduces the main features of the core optimisation process carried out within the project with the objective to enhance the core safety performance through the reduction of the positive coolant density reactivity effect. The inﬂuence of this optimised core design on the reactor safety performance during the previously analysed transients is also discussed. The con- clusion provides an overview of the work performed by the partners involved in the project towards the development and enhancement of computational tools speciﬁcally tailored to the evaluation of the safety performance of the Generation IV innovative nuclear reactor designs.


a b s t r a c t
The new reactor concepts proposed in the Generation IV International Forum require the development and validation of computational tools able to assess their safety performance. In the first part of this paper the models of the ESFR design developed by several organisations in the framework of the CP-ESFR project were presented and their reliability validated via a benchmarking exercise. This second part of the paper includes the application of those tools for the analysis of design basis accident (DBC) scenarios of the reference design. Further, this paper also introduces the main features of the core optimisation process carried out within the project with the objective to enhance the core safety performance through the reduction of the positive coolant density reactivity effect. The influence of this optimised core design on the reactor safety performance during the previously analysed transients is also discussed. The conclusion provides an overview of the work performed by the partners involved in the project towards the development and enhancement of computational tools specifically tailored to the evaluation of the safety performance of the Generation IV innovative nuclear reactor designs.
© 2014 The Authors. Published by Elsevier B.V. This is an open access article under the CC BY license (http://creativecommons.org/licenses/by/3.0/).

Introduction
The Generation IV International Forum proposed several innovative nuclear reactor designs aimed to achieve enhanced safety performances, advanced waste management capabilities and economic competitiveness. Among these designs, the Sodium Fast Reactor concept is identified as a very promising technology based on the extensive technological and operational experience accumulated during the last decades in many international projects that demonstrated the concept's feasibility. This sodium reactor concept is based on a fast neutron spectrum, liquid sodium as coolant and advanced structural materials that require the qualification and review of dedicated computational tools and procedures (system codes) able to assess the plant safety performance.
One of the main objectives of the Collaborative Project on European Sodium Fast Reactor (CP-ESFR) (Vasile et al., 2011) was to evaluate the effect of different advanced design alternatives of the European Sodium Fast Reactor design. Within the work package focused on accident analysis, a dedicated task (Task 3.3.1) had the objective to assess the viability and applicability of the computational tools used to perform safety analysis of the reactor's behaviour under various safety related transient conditions.
Eight different European organisations (CEA, EDF, ENEA, JRC, KIT, PSI, NRG and UPM) participated in this task. Each organisation selected a computational tool (system code) it judged suitable for the objectives of the task (CEA: CATHARE, EDF: MAT5-DYN, ENEA: RELAP5 and CATHARE, JRC: TRACE, KIT: SAS-SFR and SIM-SFR, PSI: TRACE-FRED, NRG: SPECTRA) and adapted the codes' respective thermal-hydraulic and fuel pin mechanics models to the particularities of the ESFR design as far as possible based upon commonly agreed calculation procedures.
The first part of this paper (Lazaro et al., 2014) described the methodology followed for this purpose including the modelling guidelines and the extensive analysis of the results achieved within the performed benchmarking exercise. This exercise consisted in a code-to-code comparison of the time-evolution of the most relevant system parameters in response to a well-defined, unprotected but limited loss-of-flow transient initiator. The benchmark exercise demonstrated that the various applied codes and models are able to simulate the ESFR plant transient behaviour within an acceptably narrow range for what concerns the variables relevant for judgement on the plant safety characteristics.
Once the models and codes were demonstrated to be able to analyse the transient behaviour of the system, the task group analysed a selected set of transient initiators that were considered relevant for the safety design objective of the plant. These representative transient initiating events were identified and classified in a dedicated project task (Ehster, 2010). This paper focuses on the analysis of two of these transients that could be considered relevant to the safety design objectives of the plant, potentially leading however to severe consequences such that retention capabilities of the primary and secondary containment systems may play an important role to assure plant safety.
The first transient presented is a reactivity initiated accident (RIA), which consist in the simulation of a runaway of a group of control rods. Since the system is considered in unprotected conditions and it evolves to a power level higher than nominal the transient has been classified as an Unprotected Transient Over Power (UTOP).
The second analysed transient is triggered by a reduction in the core cooling capability. The Unprotected Loss of Flow (ULOF) accident consists in the coast-down of all primary pumps reducing the primary mass flow to natural circulation conditions. The importance of this particular transient is reflected in its potential of progressing into the thermal-hydraulic domain of core coolant boiling conditions and subsequently into partial or even total core destruction.
The main objectives of this analysis are twofold: first, to gain a deeper physical understanding of the plant behaviour under these transient conditions as well as to define grace times and limit values that trigger appropriate responses of the plant protection systems in order to limit consequences to the primary system, and second, to test the applicability of the various system codes and the underlying thermal-hydraulic and fuel pin mechanics models used in order to identify potential model limitations as well as to identify physical domains in which the codes need further model improvements and/or extensions.
In an advanced stage of the project the core design was further optimised in order to enhance its safety characteristics. This paper will also describe the modifications performed to the core design, mainly focused on the further reduction of positive sodium void reactivity feedback, and its effect on the overall plant safety behaviour by reanalysing the same transients.
The conclusions provide an overview of the outcomes of this study oriented to identify necessary system codes enhancements by upgrading specific physical models or adding new models with a view to perform continued safety studies of Sodium Fast Reactor design. The findings range from the proposal of design optimisations which might lead to the improvement of the plant system characteristics to sustain the most severe transients identified up to issues that arose during the safety analysis requiring further research.

Design basis analysis of the ESFR concept
A set of initiating events in Design Basis Conditions (DBC) triggering transients that may challenge safety characteristics of the plant were identified in a dedicated task (Ehster, 2010). The DBC comprises normal plant operating conditions as well as accidental conditions against which a plant is designed applying well established criteria, and for which the damage to the fuel and the release of radioactive material are prevented with certainty or kept within defined limits in a few exceptional cases.
These initiating events are categorized according to the European practice established in (EUR, 2001). The categorisation is as follows: DBC1 -Normal operating conditions transients -Power operation, start-up, shutdown, load following.
DBC2 -Anticipated Operational Occurrences -Corresponding initiating events that might occur several times during the plant life (cumulative frequency of occurrence higher than 10 −2 reactoryear, such as: • Protected reactivity insertion as a runaway of a group of control rods (TOP) • Acceleration of primary pumps from 30% load • Protected coast down of all secondary pumps • Loss of feed water on all SGs • Doubling core by-pass flow DBC3 and DBC4 accidents correspond to initiating events that are not expected to occur during the life-time of the plant but analysed to assess the potential consequences. They are divided into two subcategories according to their occurring frequency, namely: DBC3 -Accidents with a cumulative frequency higher than 10 −4 per reactor-year: • Protected coastdown of all primary pumps (loss of flow transients: LOF) • Protected loss of offsite power (LOOP) DBC4 -Accidents with a cumulative frequency lower than 10 −4 per reactor-year: • All unprotected transients (the shutdown system is assumed to fail when called upon) • LIPOSO (break of a pipeline joining the primary pump with the core grid plate) In addition to the DBC transients, safety evaluations become necessary for transients being allocated to so called Design Extension Conditions (DEC). These kinds of analyses need specific approaches for demonstration that consequences of even extremely low probability events, or event sequences, are limited to the plant itself and do not pose a safety problem to the plant surrounding area. Computational tools including fuel mechanic model for these kinds of analyses are partly different from the ones used for consequence analyses of transients belonging to DBC events.

Analysed transients
Within Task 3.3.1 of the CP-ESFR the partners have performed and compared results of their calculations for each of the representative transients identified according to their occurrence frequency (Dufour et al., 2013).
The analysis of the dynamic behaviour of the plant required the modelling of the core configuration, embedded in the primary system (reactor vessel), and the secondary and partly tertiary heat transport loops. The dynamics of the core was modelled in most of the system codes in terms of a point kinetic scheme, that is, reactivity coefficients that were calculated using neutron physics codes (such as ERANOS (Rimpault et al., 2002) and KANEXT (Becker et al., 2010) which provided input to the neutron kinetic models of the various system codes (Lazaro et al., 2014). These SFR specific reactivity coefficients are mainly based on reactivity feedback effects associated with in-core and ex-core temperature changes, namely in-core temperatures such as: the fuel temperature, the cladding temperature, the coolant temperature (density), the core inlet and outlet temperatures, and ex-core temperatures such as the diagrid temperature (driven by the outlet temperature of the intermediate heat exchanger), the control rod drive-line temperature (driven by upper sodium pool temperature), the strongback, and the vessel wall temperatures. This means that the power and temperature evolution during the transient is impacted by perturbations of both in-core and ex-core temperatures. During the transient evolution, changes in in-core temperatures and their reactivity feedback effects are more immediate in time whereas reactivity feedbacks due to changes in ex-core temperatures will be considerably delayed in time due to differences in thermal inertia. For example, during a loss of flow transient, in-core temperature changes in the various materials of the core (fuel, cladding, coolant) are primarily driven by the continuously changing ratio of reactor power to coolant flow-rate, as well as the changing core coolant inlet temperature driven by ex-core temperatures (mainly the intermediate heat exchanger outlet temperature).
The paper is describing results of the UTOP (reactivity insertion) and the ULOF transients (reduction in the core flow-rate), both under unprotected conditions (i.e., insertion of shut-down rods is presumed to fail -DBC4 event), as both for the protected reactivity insertion event (PTOP) and protected loss of primary flow event (PLOF) can be shown to evolve to a decay heat removal transient of benign outcome. The objective of the study of unprotected transients is to define the requirements for protective actions and the capability of implementing associated detection and mitigating provisions.

Unprotected reactivity insertion as consequence of a runaway of a group of control rods UTOP [DBC4]
The spurious runaway of a group of control rods causes in the reactor an effect equivalent to a net insertion of positive reactivity. The shutdown system is assumed to fail. The transient is ascribed among the reactivity and power distribution accidents, or unprotected transient overpower (UTOP). The control rod runaway is defined by a linear positive reactivity insertion ramp of 250 pcm within 10 s, or 25 pcm/s over a time interval of 10 s, corresponding to a rod withdraw rate of ∼2.37 mm/s with control rods inserted 25 cm into the core under BOC conditions. The net total positive reactivity insertion leads to an increase of core power and in turn to an increase in fuel and coolant temperatures. The positive core reactivity feedbacks (coolant feedback and cladding expansion feedback) are progressively counterbalanced by the negative core feedbacks (Doppler effect, axial fuel expansion, control rod insertion due to control rod drive-line expansion) eventually driving the core power into a new equilibrium at a higher power level above nominal. The reactor power evolution during the first 50 s of this particular UTOP transient is shown in Fig. 1 as calculated by the various organizations using their respective system codes.
The predicted peak value of reactor power is calculated by the various codes to be between 142% and 175% nominal. The reason of the higher value calculated by the partners using CATHARE (Geffraye et al., 2011) code (ENEA and CEA) is linked to the dynamic fuel rod gap model used in the code with the gap heat transfer coefficient calculated as a function of heat flux. Compared to a constant gap size with average constant heat transfer coefficient, the dynamic gap size model leads to a lower thermal gradient across the fuel rod affecting the reactivity feedback (in particular the Doppler reactivity).
The peak fuel and cladding temperatures in the hot fuel assembly are presented in Figs. 2 and 3. The peak fuel temperature is predicted to be between 2670 • C and 2940 • C. Local, central fuel pin melting may thus be encountered in the hottest fuel pins as the fuel melting temperature of ∼2780 • C of the MOX fuel mixture (16.4 wt% PuO 2 ) could be reached (Popov et al., 2000). This is however not expected to be of a safety concern as melting fuel temperatures are confined to only the hottest fuel pins in the core, are highly localized to the central region of the fuel pellet, and are expected to last only for a relatively short time interval of less than ∼300 s after transient initiation (according to the safety objectives of the design state that are valid for a DBC4 accident, localised melting is allowed as long as simultaneous and coincident clad failure is excluded (Ehster, 2010). Fig. 4 shows the peak fuel temperature in an average fuel assembly, where the MOX melting point is not reached). The large spread observed in the results is caused by the different power peaks as predicted by the different participants and by the differently calculated nominal maximum fuel temperatures    (∼2280 • C for and ∼2440 • C) primarily due to slightly different fuel pin geometric assumptions (geometry of fuel annulus -2.0 vs. 2.4 mm diameter). The peak value for the cladding temperature is calculated to be between 610 • C and 670 • C. This spread in calculated peak cladding temperatures is primarily caused by differently calculated nominal peak cladding temperatures of ∼ 550 • C and ∼ 585 • C, and different power evolutions as seen in Fig. 1. Fig. 5 shows the temperature evolution of the coolant at the core outlet. The temperature increase after the reactivity insertion is limited to 100 • C, that is far from the sodium boiling point (T boil = 934 • C at 1.6 bar).
As mentioned before, the Doppler effect counterbalances the power increase induced by the control rod extraction with an insertion of negative reactivity. All codes predict similar peak negative Doppler feedbacks in the range of 140-200 pcm. Discrepancies in the results are linked to the fuel gap heat transfer model and the relative contribution of the other reactivity feedbacks. The Doppler effect feedback can be observed in Fig. 6.
The positive coolant expansion feedback evolution is presented in Fig. 7; it follows the variation in the coolant temperature. The  increase in coolant temperature of this transient is limited since the power peak occurs within a few seconds from the start of the transient and the power is reduced thereafter. The rise in coolant temperature, though limited, causes a reduction in its density with the consequent neutron spectrum hardening and a positive reactivity insertion.
The reactivity insertion is also counterbalanced by the relative slowly responding control rod drive-line expansion reactivity feedback as shown in Fig. 8. This reactivity feedback is a consequence of the fractionally deeper insertion of the control rods into the core caused by the relative movement of the core structures and the control rod bank due to thermal expansions. Fig. 9 shows the evolution of the total reactivity which takes into account coolant, Doppler and control rod reactivity feedbacks together with other minor reactivity feedbacks induced by the fuel, cladding and diagrid expansion effects. The total reactivity increases during the first seconds reaching maximum values in the range of +50-70 pcm before decreasing close to zero after reaching the asymptotic power level and new equilibrium temperatures towards the end of the transient (∼500 s). Fig. 8. UTOP -Control rod differential insertion reactivity. The response of the ESFR core indicates that the plant can accommodate this transient without major safety implications as the safety relevant temperatures (in particular clad temperatures) remain below critical values. Highly localized fuel melting may be encountered for a limited time interval in the hottest fuel pins of the core, but this is considered to be a relatively insignificant safety issue.

Unprotected loss of flow accident ULOF [DBC4]
The unprotected shutdown of primary pumps is an accident scenario ascribed among the loss of flow events (ULOF). It consists in the simultaneous coast-down of all primary pumps and the presumed concurrent failure of tripping the reactor by insertion of shut-down rods. Such a sequence of events is considered as extremely unlikely (significantly less than 10 −4 per reactor-year), classifying the ULOF as a DBC4.
The ULOF transient is initiated by the trip of all primary pumps, causing a strong reduction in the primary coolant mass flow (Fig. 10). The primary mass flow rate is assumed to decrease  according to the characteristics of the primary pumps (10 s halftime as stated in the design specification). The decrease in the mass flow rate would continue until the natural convection process takes over at some point into the transient if boiling of sodium at the core outlet would not precede this event. The remaining mass flow under natural circulation conditions depends on buoyancy forces and friction losses closely associated with the inner-vessel coolant flow paths, so it is directly related to the particular primary system design configuration.
The decrease in the in-core mass flow rate will lead to a marked mismatch between the power generated and the convective power extraction from the active core region, leading subsequently to an increase in the maximum temperatures of the core structures (cladding, wrapper, etc.) and the sodium coolant, in particular the sodium coolant temperatures at the active core outlet region. At some point into the ULOF transient, sodium boiling temperatures at the active core outlet region are reached (934 • C at 1.6 bar). Most of the system codes terminated their calculations once sodium boiling temperatures were reached at the active core outlet. The codes (SAS-SFR, SIM-SFR, TRACE-FRED) that were able to continue the calculation beyond sodium boiling onset predict a sharp drop in the mass flow rate several seconds after the core coolant reaches the boiling point (Fig. 10), resulting in a rapid rise in local peak cladding temperatures (beyond the boiling temperature of sodium) due to the sharp decrease in the heat-transfer coefficient between clad surface and the bulk coolant vapour after the boiling crisis (dryout).
As shown in Fig. 11, all codes predict that sodium reaches boiling conditions at the active core outlet after ∼30 s into the ULOF transient. This should be considered as an upper limit value of the grace time for the reactor protection system to become activated and initiate reactor shut-down within a few hundred milliseconds time period. The codes that are able to continue with the calculation beyond that point predict saturation conditions followed by dryout and a rapid increase in both fuel and cladding temperatures caused by the loss of heat removal capability in the vaporized core region.
Figs. 12 and 13 show the evolution of peak fuel temperature and peak cladding temperature respectively. The cladding temperature increases all along the transient quite consistently with the coolant temperature. All the codes predict a slight increase in the fuel temperature during the initial seconds of the transient followed by a decrease caused by the reduction in core power. The codes that are able to deal with boiling conditions predict a strong increase in the fuel and cladding temperatures after boiling crisis conditions are reached as a consequence of the abrupt decrease of heat transfer to the biphasic coolant leading to excessively high cladding temperatures, melting and subsequent axial clad relocation followed by fuel melting and fuel pin break-up.
The total reactivity evolution is shown in Fig. 14. The codes predict a sharp increase in reactor power at 38-45 s into the ULOF transient due to the positive reactivity inserted by the coolant voiding (Fig. 15). After that, reactor power may drop as major negative reactivity effects such as Doppler (Fig. 17) reactivity feedback in combination with removal of mobile fuel from the core region (not shown) becomes more effective. However, dependent on respective time scales of the ex-core temperature increases it appears questionable that fuel pin failures and thus core destruction can be prevented (Figs. 16 and 17). Fig. 18 shows the power evolution of the core during the transient. After the small increase in the early seconds of the ULOF transient the following power decrease is governed by the negative control rod insertion reactivity effect (Fig. 16). When boiling conditions are reached at the core outlet the reactor is predicted Fig. 13. ULOF -Peak cladding temperature.    to become unstable due to the large positive reactivity insertion caused by sodium voiding of the central core region.
The response of the above described SFR core to the ULOF transient indicates that this unprotected transient must be either avoided under all circumstances, or the design of the core/primary system configuration must be adapted in such a manner that boiling of the primary sodium coolant is prevented by appropriate design measures in order to exclude a power excursion resulting in core destruction.

The optimised ESFR core
One of the main work packages of the CP-ESFR project was dedicated to the core design (ESFR CORES, 2013). During the first part of the project the reference oxide core proposed in the design was studied to improve its performance, particularly in the area of safety and minor actinides management. This core was described in the first part of the paper and in the dedicated project deliverable (Blanchet and Buiron, 2009).  In the later stage of the project, this reference core design was modified in order to optimise its safety characteristics, namely by decreasing the total positive sodium void reactivity feedback (Sunderland et al., 2012). The void effect reactivity is the combination of three phenomena: the hardening of the neutron spectrum (positive effect), the increase in neutron leakage (negative effect), and reduced neutron capture (positive effect). Therefore, a reduction of the positive void effect reactivity can be achieved by either increasing neutron leakage or by neutron spectrum softening.
An increase of neutron leakage from the core region can be achieved through modifications in the core geometry (usually by adopting a pan-cake geometry of the active core region at the expense of the general neutron economy). Extensive studies determined a set of core design modifications that optimised the total sodium void reactivity (becoming less positive). Among the most efficient design solutions identified is an enlarged sodium plenum above the active core region in combination with an absorber layer above the sodium plenum (to reduce neutron backscattering from the reflector region above the plenum). Fig. 19 shows the combined effect of different upper plenum thicknesses of the absorber and boron layers. It can be observed that the sequential increase of the layer's thickness converge to an asymptotic value of reactivity reduction slightly over 800 pcm. The pair of values selected was 60 cm for the sodium plenum and 30 cm for the boron layer. These modifications implied a considerable increase in the sub-assembly length that was compensated by reducing the upper axial reflector width (Sun et al., 2013).
Figs. 20 and 21 show the axial distributions of the fuel assembly in the reference core and the optimised version (referred as OOoptimised oxide core).  With these modifications the cumulative value of the positive void reactivity feedback effect was considerably decreased. Table 1 shows the different reactivity coefficients for both the reference and the optimised core configuration (Mikityuk et al., 2012). This effect is important in those transients in which the coolant temperature remarkably increases. The most impacted are DBC3 and DBC4 transients. The effect of the void reactivity feedback reduction in less severe DBC1 and DBC2 transients is very limited (Dufour et al., 2013).
After introduction of the upper sodium plenum other design options were investigated sequentially, taking into account the various accumulative effects. In this line, the lower axial blanket was substituted by a fertile blanket composed of depleted uranium dioxide and AmO 2 .

Unprotected reactivity insertion UTOP-OO, runaway of grouped control rods [DBC4]
As indicated in the UTOP transient of the reference design above, the coolant temperature does not play an important role in this transient since the temperature increase is limited remaining several hundred • C below the coolant boiling point. The effect of the core optimisation on the UTOP transient behaviour is thus marginal. As in the reference core design, localized fuel melting may be reached in the hottest fuel pins for limited time duration of this UTOP transient. As in the above case, this is judged to be of no imminent safety concern.
In Fig. 22 the coolant density reactivity feedback for the optimised core under UTOP-OO conditions is displayed. Indeed, there is a considerable reduction in this positive reactivity component  (∼factor 3) when comparing to the reference configuration (Fig. 7), as reflected in the different coolant expansion reactivity coefficients displayed in Table 1. Fig. 23 shows the power evolution during the first 50 s of the UTOP-OO transient. The reduction in the coolant density positive feedback leads to a small decrease in the attained peak power levels and to a slight time shift when it occurs in comparison to the reference configuration (Fig. 1).

Unprotected loss of flow accident, ULOF-OO [DBC4]
The major impact of the core optimisation effort can be noticed in the unprotected loss of flow transient (ULOF-OO). Fig. 24 displays the decreasing core mass flow rate during the ULOF-OO event and Fig. 25 shows the corresponding sodium temperature at active core outlet of the average subassembly. As can be observed from Fig. 25, boiling of the coolant at the active core outlet of the average subassembly begins ∼40 s into the ULOF-OO transient, implying that boiling of the hottest subassembly begins a few seconds (∼3-4 s) beforehand. Boiling of the coolant leads  to a chocking axial flow pattern under the established power to flow ratio at the time of boiling onset. This in turn results then,in the following, in an almost complete stagnation of mass flow in this affected subassembly, affecting the total core coolant flow as can be seen in Fig. 24. Sodium vapour will first expand axially by penetrating the upper sodium plenum region. Voiding of the plenum region results in a local, limited negative reactivity insertion (about −1.5 pcm/SA for the average-power assembly and about −9 pcm/SA for the peak-power assembly), resulting in a small decrease in reactor power -, as removing liquid sodium of the upper sodium plenum region has been demonstrated to lead to negative reactivity insertions in this core design due to enlarged neutron leakage (see Table 1). A few seconds after voiding the plenum, the sodium voiding front however will proceed axially downward into the central core region due to the nearly stagnating flow in the flow channel, releasing then locally a large, positive reactivity (about +3 pcm/SA for average-power assembly and about +17 pcm/SA for the peak-power assembly) due to neutron spectrum hardening. The net sum of reactivity insertion due to complete sodium vaporization will become positive again (about +1.5 pcm/SA), even though it was briefly negative initially. Under the transiently established  power to flow ratios at this time into the transient voiding of the sodium plenum leads to voiding of the central core region due to the still high reactor power of 0.6 nominal (see Fig. 30). This timewise cyclic characteristic in the sodium reactivity component can be clearly observed in Fig. 26. Initially, only the hottest subassembly will be voided. The voiding front will however continue to expand in radial direction by progressively involving an increasing number of lower powered subassemblies until the average powered subassemblies will also start voiding. At this time, the total positive reactivity inserted into the core will become sufficiently large and positive (Fig. 29).
At this time into the ULOF-OO transient, the progression of the radial voiding front can only be limited if either the power level becomes sufficiently suppressed by the voiding process of the hottest flow channels or by other triggered negative reactivity feedback effects (such as insertion of control rods or other active or passive safety devices), or the nature of the continuously decreasing flow rate (pump coast-down) can be mitigated (i.e., by large natural convection level, or pony motors), or even reversed (i.e., restart of pumps).
As the boiling process in the hottest subassemblies starts at relative mass flow rates in the range of ∼23-33% (specifics depend on the exact power level and the core inlet temperature at this time in the ULOF-OO transient), the mass flow rate will continue to decrease according to the pump coast down characteristics until the natural convection level is attained. In the current ESFR primary system design, the mass flow rate in the natural convection mode will be less than 10%, implying that the decreasing nature of the mass flow rate at the time boiling in the hottest subassemblies commences (∼23-33% mass flow rate) is far away from the natural convection level (<10%). An early stabilization of the mass flow rate after initiation of sodium boiling thus cannot be expected under current ESFR plant design characteristics. The issue of the continuously decreasing mass flow rate alone will drive the continued radial expansion of the sodium boiling front enveloping more and more lower-powered subassemblies.
As the basic nature of a continuously decreasing mass flow rate cannot be influenced during the coast-down process of the primary pumps, the only other mechanism terminating the radial expansion of the sodium boiling process is to significantly depress the power level by providing a sufficiently large negative reactivity insertion at the time boiling in the hottest subassemblies is initiated. As this cannot be demonstrated under current ESFR conditions (even for the optimised core), further ESFR primary system design optimisation efforts are needed in order to conclusively demonstrate that the resulting core design will be able to accommodate a ULOF. Fig. 27 displays the time evolution of the peak cladding temperature with the concurrent evolution of the peak fuel temperature in Fig. 28. Due to sodium vapour generation on a relatively high power level, clad melting temperatures (∼1340 • C) are quickly reached as the heat transfer coefficient between clad surface and bulk coolant after the boiling crisis (dryout) becomes substantially reduced (∼factor 10). Once melting of the cladding material commences, clad material becomes axially expelled from the active core region (due to the chugging channel flow characteristics), resulting in an additional, and significant positive reactivity insertion. This positive clad reactivity insertion in conjunction with the net positive sodium voiding reactivity from above will add sufficient total positive reactivity (as displayed in Fig. 29) into the core resulting in a power excursion, see Fig. 30, shortly after 40 s into the ULOF-OO transient.
The observed differences in timing of the above described events between the three code system (SAS-SFR, TRACE-FRED, and SIM-SFR) that allow calculations to proceed into and through the core   boiling phase are model-dependent and not really decisive for an answer to the question whether design optimisation performed for the CP-ESFR OO core design are sufficient to prevent the transient entering into core destruction as consequences of a ULOF. However, differences are interesting and important for better understanding of the sodium boiling physics and consequences of the differences in the modelling approaches.

Conclusion
The part I and II of the paper have shown the work conducted in the task 3.3.1 of the CP-ESFR project with the objective to assess and develop the computational tools and to perform safety analysis of the ESFR reactor concept.
The first paper detailed the benchmarking exercise performed within the task aimed to check the consistency between the different models and codes employed to assess the safety behaviour of the reactor. The main outcome of this study was the confirmation that the codes are able to predict the main operational parameters of the ESFR plant with a fair level of agreement, and thus, they can be used to simulate transients identified within the design basis of the proposed technology.
This second part of the paper has presented the simulations of the reactor behaviour against two transient initiators considered as a potential threat to the reactor integrity: the unprotected transient over power (UTOP) and the unprotected loss of flow (ULOF).
The analyses have shown that the design is able to accommodate the UTOP transient without activation of any dedicated protection system, the spontaneous reactivity feedback counterbalances the positive reactivity that causes the reactor overpower. The reactor evolves into a new equilibrium at higher power but stays under the defined safety margins.
The analysis of the ULOF transient, however, has pointed out that under unprotected conditions the coolant will inevitably reach saturation conditions, a situation of special concern for Sodium Fast Reactor technology.
The analysis has identified the grace time for the protection systems to act in order to avoid potentially limiting situations. This analysis has also shown the behaviour of the system after the core coolant reaches saturation, which may lead to a power excursion. All codes that are able to continue the simulation well into the boiling phase predict a reactor power excursion, so this situation should be unconditionally avoided by the dedicated protection systems.
The relatively high discrepancies appearing among the partners' calculations point out the definitive need of further optimisation and harmonization efforts in the simulation approach of the considered transients and especially reviewing the different approaches for simulation of sodium boiling and its accuracy. This research should be focused not only to adequacies of the codes to simulate the particular phenomena (thermal-hydraulic, neutronic and fuel pin mechanics) that are involved in two-phase liquid metals transients, but also focused on the experimental validation of the different sodium boiling models to improve the consistency of the calculations.
This second part of the paper has also shown the optimisation of the reference core design in order to improve the safety response. The procedure consisted in a modification of the core layout in order to reduce the positive reactivity feedback of the coolant density effect.
The analysis showed that the core optimisation reduces peak values and enlarges grace times especially in those accidents where the coolant density effect plays an important role. Nevertheless, it has been demonstrated that this optimisation is not sufficient to avoid sodium boiling during the ULOF transient, so this should be considered as a step forward towards a final European SFR design.
From the ULOF-OO calculations we generally observed, that the rather small effect of voiding of the upper plenum is related to the fact that it is counterbalanced with only a small time delay by the voiding of the fissile core height. The cumulative void effect per flow channel and for the whole core therefore is dominated by the positive effect of the voiding of the fissile core height. This indicates that the sodium plenum does not really play its role of substantially improving the void effect during boiling. In other words: under the established power to flow ratios at the time of boiling onset sodium boiling inevitably leads to a power excursion (even for the optimised core). It means that design measures should be taken to avoid entering into boiling (e.g. pump flywheel or pony motors), because the optimisation of the core neutron physics alone (at least in the case of the ESFR design) is not sufficient to avoid the power excursion, even though the total void effect (active core + plenum) can be close to zero or even negative.
In general terms, this study has shown that the selected computational tools (system codes) are capable to predict the plant behaviour during DBA and some DEC transients quite consistently and the current ESFR plant design is able to accommodate them assuming that the plant protection system functions as foreseen (in terms of monitoring plant parameters in relation to their specified limit values and meets with a reasonable margin the necessary response times).