Abstract: In-vessel retention (IVR) of molten core debris is a significant severe accident management strategy to prevent vessel failure and subsequent debris relocation to the containment. High-risk ex-vessel phenomena such as steam explosion, core-concrete interaction (CCI) that may challenge the containment integrity are eliminated by successful IVR measures. In unmitigated severe accident, loss of cooling leads to core heat-up and molten debris relocates into the plenum of reactor vessel. High heat flux from molten pool to the vessel may melt through the wall, which depends on stratification of the debris and critical heat flux (CHF) of the ex-vessel surface. The debris configuration used to be postulated as a metal layer floating on the oxide layer. Nowadays thin metal layer over an oxide layer and bottom metal layer configuration is considered as the limiting and reasonable assumption. For high power nuclear power plant (NPP) with less metal in molten pool, if three-layer molten pool formed in the reactor vessel lower head, top thin metal layer may lead to focus effect and challenge the integrality of vessel. In-vessel injection is recommended to mitigate focus effect. CAP1400 is designed as passive GEN-Ⅲ PWR and adopts IVR as main severe accident management strategy. For CAP1400 NPP IVR design, reactor cavity flooding system provides enough containment water level for natural circulation ex-vessel cooling, which is beneficial to water backflow from break. Emergency operating procedure (EOP) and severe accident management guideline (SAMG) also instruct plant staff recovering other engineering injection path to the reactor vessel manually. Therefore lower head debris decay heat removal is achieved by both in-vessel and ex-vessel cooling. Experiments such as ELIAS, ANAIS show that debris top cooling heat transfer is enhanced than that predicted by film boiling correlation. Heat transfer model were established to investigate the top cooling capability, including natural convection, radiation heat transfer, nucleate boiling and film boiling. Two classic three-layer molten pool scenarios were analyzed, according to the CAP1400 severe accident sequence and debris quality participated in interaction. Results show that some of the three-layer assumption cannot lead to vessel failure without in-vessel injection. For more limiting three-layer case, heat flux to the vessel wall decrease lower than CHF with conservative top cooling heat flux. In-vessel injection success probability was analyzed by decomposition event tree methods. Five nodes such RCS depressurize, core reflooding etc. are established to generate six IVR end states. 88.44% of core damage sequences can achieve IVR success by reflooding the break passively. Plant staff action provides additional 4.53% IVR success probability. Finally 0.075% core damage sequences have the potential to challenge the vessel integrity. Based on deterministic and probabilistic assessment, there is reasonable assurance that the IVR strategy is successful by both in-vessel and ex-vessel cooling.