Autonomous Robotics in the Nuclear Industry Dr Andrew White

Who are the ONR? ONR independently regulates the safety and security of 37 nuclear licensed sites across the country. ONR uses a wide range of regulatory tools to influence positively those we regulate, and to encourage the achievement of sustained excellence and continuous improvement in safety and security performance across the nuclear sector. ONR’s power comes from the Nuclear Installations Act (1965), the Health and Safety at Work Act (1974), and the Ionising Radiation Regulations (1999). Providing efficient and effective regulation of the nuclear industry, holding it to account on behalf of the public.

How the ONR regulates ONR is made up of site inspectors and specialist inspectors, drawn from various professional fields including civil engineering, radiological protection, human factors, chemical engineering, mechanical engineering, nuclear physics, electrical engineering and control and instrumentation (C&I). It is the inspectors role to inspect facilities, assess safety cases, and permission activities. The inspection of facilities is undertaken with regards to the License Conditions that ONR has set. These can be found on the ONR website: www.onr.org.uk ONR makes legally binding judgements that can prevent work being carried out or requiring licensees to make improvements. Could point out here that permissioning and assessment activities are the most applicable ones for this group of people.

The Safety Case Nuclear licensees submit and maintain safety cases to justify how risks arising from activities are reduced to as low as reasonably practicable (ALARP). However, the responsibility of the risk remains with the licensee. In a safety case: The Hazards should be identified e.g. Presence of nuclear material, Potential for people to be crushed, etc Actions to control hazards should be identified e.g. Prevent criticality, provide cooling, prevent loss of containment. Keep people away from moving parts An argument is presented, using evidence, that the risks associated with the activity are ALARP. A safety case makes Claims, uses Arguments, and provides Evidence the claims have been met.

How ONR assess a Safety Case What is the scope of proposed work? What are the relevant standards and guidance? What are the claims and arguments being made, and is the evidence clear? Does it meet the relevant standards and guidance? If standards are not met, what are the gaps? Is the risk reduced to ALARP? Should the work be carried out?

Standards: Safety Lifecycle The international standard IEC 61508 describes how electrical, electronic, and programmable electronic safety systems should be designed. It is essential the first 5 phases of the safety lifecycle are carried out and documented.

Hierarchy of Measures Consider measures that are likely to be most reliable/effective first Start Here Human Can have no access If not possible then this Use a less hazardous material, or in a less hazardous form If not possible then this Prevent access using interlocked gate, when open robot enters into a safe state etc. Hard wired (priority) and software based interlocks Person told not to access robot danger zone etc. Person wears safety equipment to protect them

Hazard Identification Non nuclear hazard: Robot causes crush hazard Consequence: Ranges from individual injury to death Safety Function: Robot is prevented from harming person, e.g. via physical limitations, limited power when human is in area Nuclear hazard: Robot drops contaminated material Consequence: Ranges from contaminated dust entering air and stopping work to contamination spreading to where many people are present Safety Function: Robot must be prevented from damaging container, e.g. robot keeps container close to the ground. Kuka robot

Robot Robotic System Safety System Autonomous System Simple Complex Show these systems are within one. Straighten lines. Contrasting colours. White on blue – not good. Simple Complex Safety System not affected by autonomous system

Concluding Remarks: Engage ONR Early: Wealth of engineering experience in the field of safety systems and what has been done before (saves time, effort, money) Think of safety implications first: Not considering safety functions will prevent the autonomous system being permissioned for use.