Abstract

IRIS is an advanced integral pressurized water reactor, developed by an international consortium led by Westinghouse. The licensing process requires the execution of integral and separate effect tests on a properly scaled reactor simulator for reactor concept, safety system verification, and code assessment. Within the framework of an Italian R&D program on Nuclear Fission, managed by ENEA and supported by the Ministry of Economic Development, the SPES3 facility is under design and will be built and operated at SIET laboratories. SPES3 simulates the primary, secondary, and containment systems of IRIS with 1 : 100 volume scale, full elevation, and prototypical thermal-hydraulic conditions. The simulation of the facility with the RELAP5 code and the execution of the tests will provide a reliable tool for data extrapolation and safety analyses of the final IRIS design. This paper summarises the main design steps of the SPES3 integral test facility, underlying choices and phases that lead to the final design.

1. Introduction

The International Reactor Innovative and Secure (IRIS) is a modular, safe, economic, medium size Advanced Light Water Reactor that provides a viable bridge to Generation IV reactors and satisfies the Global Nuclear Energy Partnership requirements for grid-appropriate Nuclear Power Plants. Based on a safety-by- philosophy, the IRIS integral configuration represents the advanced engineering solution of the latest LWR technology. This allows the reactor commercialisation without the construction of a demonstration prototype, once the FDA is obtained by NRC.

As a member of the IRIS consortium, ENEA coordinates the activities of design, construction and testing of a new Integral Test Facility, supported by the Italian Ministry of the Economic Development in the framework of a wider Italian R&D program on Nuclear Fission.

In the early 90s, the SIET company upgraded the SPES facility (simulating a three loop PWR for the Italian PUN) into SPES2, providing the experimental data that allowed the licensing of the Westinghouse AP-600 reactor. On the basis of the lessons learned from the past and relaying on the same auxiliary systems of SPES2, the SIET company is designing the SPES3 facility that will simulate accidental sequences for providing the needed experimental results to verify the general behaviour of the system, allow a code assessment process and produce a reliable tool for the IRIS plant safety analyses.

A Phenomena Identification and Ranking Table, set up by an international team of experts, and a Hierarchical Two-Tiered Scaling Analyses, evolved into a Fractional Scaling Analysis, led to identifying the main facility scaling parameters resulting in 1:100 volume scale, 1:1 elevation scale, prototypical fluid at plant pressure and temperature full conditions. The detailed scaling of all plant components is the result of an iterative process aimed at verifying the SPES3 facility component design adequacy to appropriately represent what is expected in the plant.

The RELAP5 thermal hydraulic code is used to simulate the facility at different stages of the activity: design support, pretest for test and procedure design, post-tests for code assessment and data extrapolation to the real plant.

Thanks to the iteration between facility design and analyses, SPES3 will provide experimental data based on a list of accidental transients required by NRC for the licensing process. The code assessment on such data will guarantee the availability of reliable computational tools to perform the IRIS plant safety analyses for the Final Design Approval.

2. The IRIS Plant

The IRIS design was conceived to satisfy the DOE requirements for the new generation reactors, that is, improved proliferation resistance, enhanced safety, improved economics and reduced waste [14]. IRIS is a small-medium size (1000 MWth) pressurized water reactor with an integral configuration, suitable for modular deployment. A schematic of the IRIS integral layout is shown in Figure 1.

The reactor pressure vessel hosts all the main reactor coolant system components: core, pressurizer, spool-type reactor coolant pumps, steam generators and control rod drive mechanism. Eight once-through helical coil SGs are located around the riser and a pump is installed axially on top of each SG. The riser is defined by the extension of the core barrel. The “inverted hat” pressurizer occupies the RPV upper head.

The water flow path is from bottom to top through the core and riser, then the circulation reverses and water is pushed downward by the immersed pumps through the SG tubes. At the SG outlet, the flow path goes along the annular downcomer region outside the core to the lower plenum and then back into the core.

The integral arrangement of the plant allows avoiding pressurized components, like the SGs, outside the RPV and largely reduces the size and number of RPV penetrations. Large LOCAs are eliminated and the number of possible small LOCAs is reduced. The RCS integral layout leads to a RPV diameter of 6.2 m, larger than conventional PWR, with a total height of about 22 m. A compact spherical steel containment, 25 m in diameter, is part of the IRIS safety approach and is directly involved, through a coupled dynamic behaviour, in the passive mitigation strategy that enhances the safety and reliability of IRIS. The IRIS containment and safety systems are shown in Figure 2.

The IRIS safety-by- approach addresses small LOCA sequences by limiting and eventually stopping the loss of mass from the RPV rather than relaying on water injection by active or passive devices. This is achieved by (i)a large coolant inventory in the RPV;(ii)RPV depressurization achieved by means of Emergency Heat Removal Systems that remove the decay heat by condensing steam directly through the SGs;(iii)a compact, high design pressure containment, thermodynamically coupled to the RPV during an accident, which limits the blowdown by rapidly equalizing RPV and containment pressure.

As shown in Figure 2, the containment vessel consists of different compartments, in particular the Dry-Well and the Reactor Cavity, the Pressure Suppression Systems and the Long-term Gravity Make-up Systems. An Automatic Depressurization System dumps steam in a Quench Tank in case of need during normal operation. Emergency Boration Tanks are connected to the Direct Vessel Injection lines which inject water into the vessel from the LGMS and eventually back from the Reactor Cavity. The EHRS heat exchangers are contained in the Water Refuelling Storage Tank and intervene at isolated reactor condition. A Passive Containment Cooling System allows limiting the CV pressure in case of EHRS unavailability.

A typical sequence of LOCA events can be summarized in the following phases:(i)blowdown: the RPV depressurises and looses mass to the containment;(ii)reactor trip, pump trip, reactor isolation and EHRS intervention, ADS actuation, the EHRS depressurizes the primary system without loss of mass while, if the ADS intervenes, it carries out the same function with loss of mass;(iii)the PSS limits the containment pressure, once the RPV-CV pressure equalization is reached, the blowdown phase ends;(iv)the RPV-CV coupled system is depressurised by the EHRS that condenses steam and has the capability of removing more than the decay heat;(v)once the pressure inside the RPV becomes lower than the containment pressure, a reverse flow of steam from the CV may occur through the break;(vi)a long-term cooling phase follows the depressurization phase with the LGMS intervention and guarantees the core cooling.

3. IRIS Scaling Approach and SPES3 Simulation Choices

The scaling analysis and identification of similarity criteria is based on a Hierarchical, Two-Tired Scaling Analysis [5], which then evolved into a Fractional Scaling Analysis [6, 7]. The scaling analysis is part of an Evaluation Model Development and Assessment Process [8], which consists of six basic principles that in an iterative process provide the final decisions on the simulation choices: (i)establish the requirements for the evaluation model capability, this specifies the purpose of the analysis; identifies the transient and the power plant class; identifies the systems, the component geometry, phases and processes of transients;(ii)develop an assessment base, this performs scaling analyses and identifies the similarity criteria; identifies existing data or performs specific integral or separate effect tests; evaluates the distortion effects and experimental uncertainties;(iii)develop an Evaluation Model, this establishes a plan to develop the EM, its structure and incorporates closure models;(iv)assess the evaluation model adequacy, an iterative process between two different criteria is carried out: (a) Bottom-up (closure relations): assesses the scalability of the models; determines the model applicability to simulate the physical processes; assesses the model fidelity and accuracy by preparing input and performing calculations; (b) Top-down (integrated EM): determines the capability of field equations and numerical solutions to represent processes and phenomena; assesses interaction among systems and components by performing calculations; assesses the scalability of integrated calculations and data for distortions; (v)follow an Appropriate Quality Assurance Protocol, it applies quality assurance standards as in Appendix B of 10 CFR Part 50; it is based on a peer review by independent experts;(vi)provide comprehensive, accurate, up-to-date documentation, it is needed for peer review, for the NRC review and to track of all changes.

On the basis of the six principles of the EMDAP, the Two-Tiered Scaling Analysis (H2TS) is subdivided in four stages:

Stage 1. a system decomposition that provides the system hierarchy and identifies the system characteristics: geometry, area and volume concentrations, initial conditions and time sequence of events, transfer processes;

Stage 2. a scale identification that provides the hierarchies for volume and area concentrations, residence times, process time scales;

Stage 3. a top-down system scaling analysis that provides the conservation equations, derives scaling groups, establishes hierarchies and identify important processes to be investigated iteratively with the bottom-up system scaling analysis;

Stage 4. a bottom-up process scaling analyses that performs detailed analyses for important local processes; derives and validates the scaling groups.

The Fractional Scaling Analysis is a quantitative methodology that accomplishes the EMDAP principles by scaling the time dependent evolution processes involving an aggregate of interacting components and processes. Moreover, the introduction of Fractional Rate of Change provides the proper time constants for scaling time-dependent processes and makes this approach more appropriate for scaling Integral Test Effects than the H2TS. FSA consists of two stages:

Stage 1. a system decomposition, with a hierarchical approach, down to components and to process levels (for IRIS: RCS to ESF to CV and then to related subsystems); identifies the dominant processes and ranks them according to their importance;

Stage 2. a fractional scaling that provides a synthesis of experimental data and generates quantitative criteria for assessing the effects of various design and operating parameters.

The FSA provides the tools to verify the accomplishment of the two Figures of Merit for IRIS specified in the PIRT [9], which are (a) the Reactor Vessel coolant inventory, which should be enough to avoid significant fuel cladding temperature excursions and (b) the Containment pressure within design value through successful heat removal to the environment, to limit the initial containment over-pressurization and guarantee its following depressurization.

The basis scaling parameters for SPES3 are:(i)volume ratio (ii)same fluid properties (prototypical pressure and temperature);(iii)same height;(iv)area ratio , to maintain the same Resident time and velocity of fluid;(v)same pressure drops.

the above listed choices lead to advantages and disadvantages:(i)the full height provides prototypical distance between heat sources and heat sinks to properly simulate natural convection effects; both single phase and two phases natural convection loops can be simulated simultaneously; prototype and model fluid velocities and residence times in the loops are the same; horizontal inter-phase areas (i.e., transfer area concentrations) are properly scaled,(ii)the prototypical fluid avoids distortions due to different fluid properties (i.e., the scaling analysis does not generate additional terms related to property distortions) and interpretation of the results is easier,(iii)the area of the side walls decreases only 10 times (not 100 times as the volumes) and this results in 10 times larger transfer area concentrations for heat transfer (energy exchange) and wall friction (momentum exchange), (iv)some components (e.g., heat exchangers and steam generators) might be represented with limited number of tubes (i.e., not ideal for reproducing side effects),

The FSA scaling analysis allows keeping into account and quantifying the distortions introduced by the scaling choices.

4. The SPES3 Facility

The SPES3 facility layout is shown in Figure 3 and its general view in Figure 4. SPES3 simulates the primary, secondary and containment systems of the IRIS reactor as follows:(i)the primary system includes the Reactor Vessel and internals with power channel and fuel bundle box, lower riser and RCCA, upper riser and CRDM, pressurizer, upper downcomer in the steam generator zone, riser to downcomer connection check valves, lower downcomer, lower plenum, core bypass, and a portion of the Direct Vessel Injection lines. A single outer pump simulates the eight IRIS internal pumps;(ii)the three secondary systems, simulating four IRIS loops, include the steam lines and feed lines up to the Main Steam and Feed Isolation Valves, the eight IRIS Steam Generators are simulated by three helical coil SGs: two of them simulating two IRIS SG each and one simulating the remaining four.(iii)the IRIS containment compartments are simulated in SPES3 by separate tanks properly connected, representing the Dry-Well, two Pressure Suppression Systems, two Long-term Gravity Make-up Systems, the Reactor Cavity and the ADS Quench Tank, shape and dimensions are fixed in order to reproduce the trend of IRIS compartment volumes versus height, the Passive Containment Cooling and a portion of the DVI lines are included in the containment as well. (iv)the safety systems include the Emergency Boration Tanks, the Emergency Heat Removal Systems connected to the Refueling Water Storage Tank and the Automatic Depressurization System, three EHRS loops represent the four trains of IRIS.

The design pressure of the primary and secondary systems up to the main isolation valves is 17.25 MPa with its corresponding saturation temperature of 353.5°C. The primary and secondary side operating pressure is 15.5 MPa and 5.8 MPa, respectively. The containment design pressure is 2 MPa with its corresponding saturation temperature of 212.4°C. Its operating pressure is 0.1013 MPa.

According to the established scaling factors, SPES3 rod bundle power should be 10 MW. The SIET power capability for SPES3 is 6.5 MW, so the power to volume ratio is not preserved during the steady state, while it is rapidly matched at the beginning of the transient. The primary and secondary loop flowrates are therefore adjusted to maintain the steady state temperatures as in the IRIS plant. Table 1 reports a comparison of the main characteristics between IRIS and SPES3.

The facility configuration is suitable to investigate the natural circulation loops that allow removing the decay heat during the long-term accidental transients.

4.1. The Primary System

The SPES3 Reactor Pressure Vessel is shown in Figure 5.

The total height of the RPV is around 22 m with 0.65 m diameter. It consists of three main sections:(i)the lower section that hosts the power channel, the lower plenum with closure plates and heater rod tightness system, the lower downcomer and DVI lower connections;(ii)the intermediate section that hosts the riser, the steam generator annular zones, the feed lines and steam lines connections, the pump delivery and DVI upper connections;(iii)the upper section that hosts the “inverted hat” pressurizer and the ADS, the pump suction plenum, pump suction and EBT to RPV line connections.

The rod bundle consists of 235 heated and 1 dummy rods that reproduce the dimensions and pitch of the Westinghouse rod assembly, also adopted in IRIS, Figure 6. The rods are indirectly heated and the axial power profile is constant. Two rods provides a greater power with 1.2 peak factor. They are maintained in their relative position by spacer grids located at different elevations. A double layer fuel bundle box envelops the rods and acts as downcomer barrel. A filler between the wall layers is chosen to scale correctly the thermal mass and the global heat transfer coefficient to compensate for the not correctly scaled side surface area, Figure 7.

The lower plenum contains a perforated cylinder that allows water from the downcomer to turn into the core, Figure 7. A tightness system, with graphite disks compressed between plates, allows the rods to exit the vessel bottom and join the electrical connections for power supply.

The SPES3 riser, over the core, simulates in one cylindrical volume the IRIS riser, annular space and SG central columns. Vertical tubes and perforated plates are inserted in the riser to simulate RCCAs, CRDMs and to adjust the pressure drops.

The helical coil Steam Generators consist of 14 tube rows wrapped around the barrel with prototypical diameter (17.48 mm), height (8.2 m) and length (32 m). The inner SGs have a single row while the outer one has two. Each SG is located in an annulus, obtained by vertical barrels concentric to the riser, and the tubes are maintained in their position by proper vertical plates. The tubes cross the vessel wall in correspondence of the Feed Line and Steam Line nozzles. In the nozzle area, the tubes bend to be welded on a plate between the nozzle flanges, Figure 8. This allows the feed water to redistribute in the tubes and steam to flow through the steam lines.

The “inverted hat” pressurizer reproduces the IRIS one; differently from IRIS, the SPES3 pressurizer will adopt electrical heaters vertically inserted from the RPV top, to set the pressure during the steady conditions. Proper holes at the PRZ bottom simulate the IRIS surge path. The pump suction plenum is the volume outside the PRZ hat.

The limited room inside the RPV does not allow fitting internal pumps, so a single outer pump distributes water to the three SG annuli through four separate nozzles, Figure 9. The mass flow balance is obtained by proper distribution plates at the SG top.

Nozzles on the RPV allow connecting the primary system to the DVI, the outer core by-pass, the pump suction and delivery, the ADS and the EBT balance lines.

Two Emergency Boration Tanks are connected to the RPV at the top, by the balance lines, and at the bottom through the DVI lines. They operate at the same RPV pressure.

4.2. The Secondary System and EHRS Loops

The SPES3 secondary system consists of three loops simulating four with a loop lumping two IRIS secondary trains. The feed lines and steam lines are simulated from the RPV nozzles up to the MFIV and MSIV. The piping size is chosen to maintain the same pressure drops as in the IRIS plant, even with different routing.

The Emergency Heat Removal Systems consist of three loops with vertical tube heat exchangers immersed in the RWST and hot and cold legs joined to the SLs and FLs, respectively. In particular, EHRS connected to the double secondary loop has a double heat exchanger. The heat exchangers are about 3 m high and contain 3, 3 and 5 tubes of 50.8 mm diameter.

4.3. The Containment System

The different IRIS containment compartments are simulated in SPES3 by tanks connected among them and to the RPV by piping. Such pipes do not exist in the IRIS plant and they are designed in terms of size and layout to limit their influence on the flow. The tank shape is chosen to reproduce the same volume trend versus height as in IRIS and, in specific cases, cylindrical tanks with variable sections are designed. The SPES3 containment tanks are: the Dry Well, the Reactor Cavity, two PSS, two LGMS, the Quench Tank.

The three IRIS ADS trains are simulated in SPES3 by two trains: a single and a double train. Each train consists of a safety valve, a line to the Quench Tank and a line to the Dry Well. The line to the QT ends with a sparger that enhances the steam condensation under the water level.

The PCC is a condenser installed at the DW top which consists of an horizontal tube bundle, with the only requirement of removing a specified power, without scaling the IRIS PCCS geometry (PCCS is an IRIS non-safety system and its use is foreseen only during beyond design basis accident sequences addressed in the Probabilistic Risk Assessment).

A thermal insulation is foreseen for all SPES3 tanks and piping to reduce the heat losses to the environment.

4.4. The Break Lines

Break line systems are designed to simulate both split and double ended guillotine breaks. Break locations are foreseen at different elevations, in particular the lower break is on the horizontal part of the DVI and ends into the RC; the upper break is on the EBT to RV balance line top and ends into the DW; the ADS break is on the single train, upstream of the safety valve and ends into the DW; the FL break ends into the RC; the SL break ends into the DW (i.e., steam and feed line break in containment are simulated).

The exact break size is set by calibrated orifices that scale the IRIS plant pipe size.

4.5. The Auxiliary Systems

The auxiliary systems provide water to the experimental facility at the required temperature, pressure and mass flow. Direct current generators provide power to the fuel bundle and to the PRZ heaters. Some modifications to the already existing systems at SIET were needed to match the IRIS requirements, in particular to the condensation system (heat sink), to the machinery cooling loop, to the air circuit for valve operation and instrumentation, to the power channel electrical connection.

5. Instrumentation

A large set of instruments (about 600) is installed on SPES3 to provide data both for the test run and analysis. It consists of conventional instrumentation (i.e., relative and absolute pressure transmitters, temperature sensors) and special instrumentation for two-phase flow measurement. The quantities directly measured by conventional instrumentation are: fluid and wall temperatures, absolute and differential pressures, velocity, volumetric flow, voltage and current, while special instrumentation is used for void fraction and volumetric flow. Derived quantities are: level by differential pressure and density, mass flow by differential pressure and density, mass flow by volumetric flow and density, mass flow by volumetric flow and void fraction (wire mesh sensors and turbine), mass by level and density, mass flow by heat transfer (heated thermocouples), heat losses by wall thermocouples, power by voltage and current.

The rod bundle is instrumented with 120 wall thermocouples distributed at different levels, with a greater density at the upper levels. They provide the rod cladding temperature and provide the signals for core protection against superheating.

6. Test Matrix

The planned test matrix consists of 2 separate effects and 13 integral tests. The SETs are devoted to investigate the interaction and characterize the heat transfer of innovative components like the helical coil SGs and the EHRS heat exchangers for long-term decay heat removal. The ITs are devoted to investigate the general behaviour of the system, the primary and containment dynamic interaction during accidental transients, the effectiveness of the Engineered Safety Features, the IRIS capability to cope with postulated accidental transients.

According to NRC requests for the licensing process, in terms of experimental data, both Design Basis Accidents (DBAs) and Beyond Design Basis Accidents (BDBAs) are foreseen together with long-term cooling transients. A synthesis of the text matrix is reported in Table 2.

All the worse LOCA cases foreseen on IRIS are simulated: 1 inch equivalent DVI split break; 2 inch equivalent DVI DEG break; 4 inch equivalent EBT to RPV balance line DEG break; 6 inch equivalent single train ADS DEG break. Secondary side line breaks such as the 12 inch equivalent FL DEG break and the 16 inch equivalent SL DEG break are also included in the test matrix.

The Design Basis cases verify the whole system response and mixture level in the core. The Beyond Design Basis cases verify the plant coolability even with the contemporary failure of some ESFs.

7. SPES3 Simulation with the RELAP5 Code

The IRIS plant simulation and analyses have been carried out at FER (University of Zagreb) by means of the RELAP5 and GOTHIC coupled codes to keep into account specific thermal hydraulic phenomena in the primary system (with RELAP) and typical containment volume phenomena (with GOTHIC).

The reduced dimensions of the SPES3 components, while still allowing three dimensional circulations in the tests, allow also for simulating the whole facility with the RELAP5 code, which is applied during all the main phases of the facility design. A scheme of the SPES3 nodalization for the RELAP5 code is shown in Figure 10 for the primary and the secondary loops and in Figure 11 for the containment.

Three steps of code application are planned: (1)supporting design analyses aimed at obtaining feedback information on the facility design, in particular the comparison between the SPES3 facility and the IRIS reactor simulations provides information on the appropriateness of the performed scaling choices;(2)pretest analyses aimed at the test design and test procedure set-up;(3)post-test analyses and code assessment on a set of qualified data.

The IRIS plant safety analyses devoted to the FDA will be carried out with numerical codes validated on the SPES3 experimental data.

In order to compare the SPES3 results with the IRIS ones, the design support analyses have been carried out at 10 MW power. The calculated steady state results are summarized in Table 3.

8. Conclusions

In the frame of the IRIS reactor licensing process, the construction of experimental facilities is required to study separate effect phenomena on the innovative components and the integral system behaviour during postulated accidents.

This paper deals with the design of the SPES3 integral test facility to simulate the primary, secondary and containment systems of IRIS at full pressure and temperature conditions, with elevation and volume scaling factor, as required by NRC for this reactor.

The SPES3 facility is under design and will be built at the SIET laboratories, under the sponsorship of the Italian government and the coordination of ENEA.

The main design steps of the SPES3 integral test facility are shown, starting from the scaling approach and proceeding to the component and piping design, the RELAP5 code system simulation, the feedback on the design choices and finally the pretest and post-test analyses that will allow extrapolation of the experimental results to the prototype plant.

he SPES3 facility experimental data will provide a qualified data base for the accident analyses and code assessment.

Numerical codes, qualified via the SPES3 test results, will be used for the IRIS safety analyses to be submitted with the application for the NRC Final Design Approval.

Nomenclature

ADS:Automatic Depressurization System
ALWR:Advanced Light Water Reactor
BDBA:Beyond Design Basis Accident
CV:Containment Vessel
CFR:Code of Federal Regulation
CRDM:Control Rod Drive Mechanism
DBA:Design Basis Accident
DC:Downcomer
DEG:Double Ended Guillotine
DOE:Department of Energy
DVI:Direct Vessel Injection
DW:Dry-Well
EBT:Emergency Boration Tank
ESF:Engineered Safety Features
EHRS:Emergency Heat Removal System
EMDAP:Evaluation Model Development and Assessment Process
ENEA:Ente per le Nuove tecnologie, l’Energia e l’Ambiente
EM:Evaluation Model
FDA:Final Design Approval
FL:Feed Line
FSA:Fractional Scaling Analysis
FW:Feed Water
GNEP:Global Nuclear Energy Partnership
GOTHIC:Generation Of Thermal-Hydraulic Information for Containments
H2TS:Hierarchical Two-Tiered Scaling Analysis
IRIS:International Reactor Innovative and Secure
IT:Integral Test
ITF:Integral Test Facility
LGMS:Long-term Gravity Make-up System
LOCA:Loss Of Coolant Accident
LP:Lower Plenum
LWR:Light Water Reactor
MFIV:Main Feed Isolation Valve
MSIV:Main Steam Isolation Valve
NPP:Nuclear Power Plant
NRC:Nuclear Regulatory Commission
PCCS:Passive Containment Cooling System
PIRT:Phenomena Identification and Ranking Table
PRZ:Pressurizer
PSS:Pressure Suppression System
PUN:Progetto Unificato Nazionale (National Unified Project)
PWR:Pressurized Water Reactor
QT:Quench Tank
RC:Reactor Cavity
RCCA:Rod Cluster Control Assembly
RCS:Reactor Coolant System
RELAP:REactor Loss of coolant Analysis Program
RI:Riser
RPV:Reactor Pressure Vessel
RV:Reactor Vessel
RWST:Refueling Water Storage Tank
R&D:Research and Development
SET:Separate Effect Tests
SIET:Società Informazioni Esperienze Termoidrauliche (Company for Information on Thermal-hydraulic Experimentation)
SL:Steam Line
SG:Steam Generator
SPES:Simulatore Per Esperienze di Sicurezza (Simulator for Safety Tests)