1. Hazards Analysis and Safety Classification Process Linda R. Coney Group Leader – Target Safety and Controls www.europeanspallationsource.se April 7, 2016

2. Outline Hazard Analysis purpose and scope Hazard Analysis Procedure – Qualitative HA – Accident Analyses (Quantitative HA) – Selection of mitigation and/or prevention measures Safety classification – SSC selection – Engineering design features, PSS, TSS Conclusions 2

3. Purpose of HA Protect ESS workers and the public from accidents with potential radiological consequences Identify hazardous events associated with the facility processes, associated operations, work activities, and natural phenomena – High power beam impacting the tungsten target material will create an inventory of nuclides – 3000 kg of tungsten, 5 MW beam, 5 year target wheel lifetime Understand potential hazardous scenarios Define necessary mitigating measures – Input to system design requirements Target systems, building features, PSS, TSS – Identify need for safety functions Identify  evaluate  control these events 3

4. Hazard Analysis Overview Perform Qualitative Hazard Analysis – Identify bounding scenarios Execute Quantitative Accident Analysis of each bounding scenario – Evaluate accident in terms of dose consequences to workers and public – Identify need for risk and/or consequence reducing measures – Identify functions that can prevent or mitigate hazardous scenario May include passive engineered safety features, active controls, and admin controls Select Structures, Systems and Components (SSCs) that perform these safety functions – Prevent or control hazard – Assign classification to SSCs – Classification mandates appropriate requirements for each SSC – Evaluate effectiveness of chosen SSCs Feed HA results into system designs & operational procedures 4

5. Qualitative Hazard Analysis Status ‘Radiological Hazard Analysis Procedure for the ESS Target Station’ document written & under review for inclusion in PSAR Completed radiological Hazard Analysis for Target Station operations – About 350 events identified Radiological Hazard Analysis for all Target Station maintenance activities in progress – Wheel/shaft/drive & helium cooling – DONE – Shielding & plugs primary water cooling – DONE – Active liquid purification & storage – DONE – Intermediate cooling systems for water & helium – DONE – Primary & intermediate water system drain tanks – DONE – Monolith opening/plug replacement and transfer to Active Cells Facility analysis Selected 21 bounding scenarios for further study  Accident Analyses 5

6. Background and overview 6 SSM; Nuclear Authority Design Facility Hazard Analysis Systems Buildings Operation Systems Buildings Operation Events (Severity & Probability) PIEs and Top Enveloping Events (Severity & Probability) PIEs and Top Enveloping Scenario Analyses Radiological impact Inventory Dose Factors Radiological impact Inventory Dose Factors Safety Functions Classification Physical evolution Release Factors Leaks, diffusion Internal spread External spread Physical evolution Release Factors Leaks, diffusion Internal spread External spread 1.Unmitigated 2.Mitigated 1.Unmitigated 2.Mitigated Severity Probability<.01 0.01 -0.1 0.1 -1 1 -20 20 -100 >10 0 mSv H1 Normal H2 Expected H3 Unexpected H4 Unlikely H5 Very unlikely Dose to public (SSM) SSCs: - Safety - Safety-related Disciplines: - Mechanical - Ventilation - Electrical … SSCs: - Safety - Safety-related Disciplines: - Mechanical - Ventilation - Electrical …

7. Accident Analyses – Quantitative HA Identify set of formalized design basis accidents from hazard analysis – 350 Top Events from qualitative HAs – At least one event from each of the major types identified in HA – Accident with most severe consequences within a group of similar accidents – If prevented or mitigated, the group does not require additional safety functions Accident Analysis inputs – Inventories Tungsten ✔ Target cooling helium ✔ Moderator water ✔ Reflector beryllium ✔ Reflector water ✔ – Dose calculation procedures (ESH) ✔ For both dose to worker and to reference member of the public – Allowable dose limits ✔ Workers (ESS) and public (SSM) 7

8. Accident Analysis Input – Dose Limits 8 ESS Safety Objectives Operating conditions Initiating event likelihood Workers limit (effective dose) Public limit (effective dose) Normal operation - H110 mSv/year0,1 mSv/year Incidents – H2 F > 10 -2 20 mSv/event0,1 mSv/event Unexpected events – H3 10 -4 < F < 10 -2 50 mSv/event1 mSv/event Design Basis Accident – H4A 10 -6 < F < 10 -4 50 mSv/event20 mSv/event Highly improbable events – H5 10 -7 < F < 10 -6 Ex : plane crashes, major earthquake 100 mSv/event 8 Protect workers and public from unsafe levels of radiation Prevent the release of radioactive material beyond permissible levels Defining consequence = dose to public and workers

9. Risk assessment criteria: Severity Matrices H1 shaded out – indicates normal operation – limits per year – Normal operation limits and releases are handled separately from this analysis H2 – H5 dose limits are per event Limits for Public set by SSM Limits for Workers set by ESS GSO (General Safety Objectives) except for H5 limit which we chose to equal that of the public because there was no limit stated 9 Severity (mSv) Probability < 0.010.01-0.10.1-11-2020-100>100 H1 H2 H3 H4 H5 Unacceptable Tolerable Acceptable Public Severity (mSv) Probability0-11-1010-2020-5050-100>100 H1 H2 H3 H4 H5 Workers

10. Accident Analyses – Quantitative HA Identify  21 accident analyses Evaluate events – Describe system Determine baseline assumptions for event – Describe evolution of event Include simulations, calculation of effect on system or neighboring system – Consider all PIEs identified in Qualitative HA Quantitative determination of probability for occurrence – Identify inventory Determine source term – amount of radioactive material released during accident scenario – Calculate dose consequence to worker and/or public Identify need for risk reduction measures – prevent and/or mitigate event Control events – Determine required safety functions – Select risk reducing measures – hierarchy giving preference to passive engineered safety features over active, engineered over active controls or administrative controls and preventative over mitigative – Holistic approach – optimize selection How options fit with other analyses? Consider options to prevent and/or mitigate within other systems Consider impact on operations – Specify safety-related and safety SSCs – structures, systems and components – Reassess event evolution and dose consequences with safety measures implemented 10

11. Definition of SSCs 11 SSC SSC not important to safety SSC important to safety Safety related SSC Safety SSC Actuation SSC Protective SSC Supportive SSC All parts of the facility, except human factors, contributing to protection and safety All SSC that contribute to manage H1-H5 events All SSC that contribute to manage H2-H4A events No role in H1-H5 events Dedicated to H1,H2, H4B and H5

12. Analyses included in PSAR 1.Target Wheel stop during beam on target 2.Beam Event: Focused and non-rastered beam on target 3.Loss of Target wheel cooling during beam on Target 4.Leakage from Target Cooling circuit into monolith, depressurization of PCool 5.Partial loss of cooling of target wheel 6.Loss of He purification function 7.Water leakage from Intermediate Water System into Target He 8.Loss of confinement in Target He system – release into Utility rooms 9.LH2 leakage with explosion/LH2 leakage with local fire 10.Water leakage in monolith (highest contamination level) 11.Water leakage into connection cell and utility rooms 12.NBG/Chopper - missile effect on monolith system 13.Beam dump – high power beam when target in maintenance mode 14.Earthquake scenario Target/monolith 15.Active Cells: Operator inside maintenance cell when sliding door unintentionally opens 16.Active Cells: Operator inside process cell next to worst case inventory 17.Active Cells: Operator inside maintenance cell next to worst case inventory 18.Loss of dynamic confinement (loss of HVAC) 19.Active Cells: Loss of confinement process/maintenance – open doors 20.Active Cells: Fire in maintenance or process cell 21.Active Cells: Earthquake scenario 12 Active Cells Facility Events Target & He Cooling Monolith

13. AA15 – Active Cells: Operator in Maintenance Cell when intrabay door opens 13 Wheel in process cell – worker enters for planned work in maintenance cell – malfunction in door control/wrong working procedure – door opens – dose worker H2 event – limits 20 mSv for worker, 0.1 mSv for public – Unmitigated worker dose for 30 minutes – 50 mSv; No dose to public Requires risk reduction measures to protect workers – prevention and/or mitigations  safety functions

14. SSCs – Active Cells AA15 14 Safety function – Safety-related SSC Event Class Safety Group DID Shielding function – Intrabay doors and wallH1-H2Operational1-2 Shielding function – Blanket on wheelH1Operational1 Shielding function – Outer walls of Active CellH1-H2Operational1-2 Limit exposure – Gamma detector in maintenance cellH1-H2Operational1-2 Limit exposure – Access control system dependent upon mode and gamma detector level – Access permitted if gamma detector reading acceptable levels H1Operational1 Prevent dose – Quality motor on doorH1Operational1 Prevent dose – Control system on doorH1-H2Operational1-2 Prevent dose – Detection that door is closedH1-H2Operational1-2 Limit exposure – Administrative Control: Operator in Active Cell Control Room monitor work and Operations Mode (Process Mode) H1-H2Operational1-2 Reduce dose – Administrative Control: The operators shall be trained and educated in radiation safetyH2Operational2 Reduce dose – Administrative Control: The operators shall be equipped with personal dosimeters with alarm H2Operational2 Reduce dose – Administrative Control: The operators shall be physically examined on a regular basisH2Operational2 Safety function – Safety SSC Event Class Safety Group DID Prevent dose – Prevent door from opening – safety control on door – PSSH2Safety3 Limit exposure – Additional gamma detector and evacuation alarmH2Safety3 Limit exposure – Administrative Control: Operator trained to exit maintenance cell if alarm activatesH2Safety3 Mitigated results – prevent & alarm/evacuate – H3 with 8.33 mSv dose to worker, 0.0 mSv dose to public

15. AA3. Loss of target wheel cooling 15 -Target wheel is rotating -Criteria for safe shut down is 7 pulses on same sector ( ~ 18 s) before exceeding level D criteria on shroud -Initial unmitigated dose calculations: -H2: dose to worker – thousands of Sv -H2: dose to public – 2 mSv for release at monolith level or 0.3 at stack (without HVAC filtration) from first release of He and particles -Loss helium flow, loss heat exchanger or problem with int. system, large leak (AA4, AA8), internal bypass -Thermal stress and temperature increase in spallation material, cassettes and shroud -Shroud breaks and releases He coolant, filter particles into Monolith -Break NBW and/or PBW -Premoderator breaks, water leak, beam continues – release of vaporized W H2 – worker limit 20 mSv H2 – public limit 0.1 mSv  Mitigation required

16. Safety SSCs: Helium Cooling & Wheel 16 Safety function – Safety SSC Event Class Beam ON Beam OFF PBW or NOT Safety Group DIDSystem Op Prevent release by stopping proton beam from hitting wheel – Detect unacceptably low helium flow and prevent proton beam from hitting wheel – TSS H2X BothSafetyL2-L3X Prevent release by stopping proton beam from hitting wheel – Detect unacceptably high helium temperature and prevent proton beam from hitting wheel – TSS H2X BothSafetyL2-L3X Stop proton beam from hitting wheel - Remove PBW – passive beam shutdown H2X NSafetyL3X Control release – Rupture disk in monolith into Off-gas extraction system H2X NSafetyL3X Confine monolith atmosphere in order to control release of inventory (NO PBW) – Monolith vessel and NBWs H2X NSafetyL3X Prevent exposure – No access to accelerator tunnel when Beam ON – PSS H2X NSafetyL3X Limit exposure to public – Filtration in ventilation before release at stack (is it necessary?) H2X NSafetyL3X or Stop proton beam from hitting wheel - Put rupture disk in parallel with PBW (only structural) H2X YSafetyL3X Confine monolith atmosphere in order to control release of inventory (with PBW) – Monolith vessel, PBW, NBWs H2X YSafetyL3X Limit exposure to public – Filtration in ventilation before release at stack (is it necessary?) H2X YSafetyL3X If first TSS function fails : - Limit release & prevent escalation of event – Detect loss of helium and prevent proton beam from hitting wheel – TSS H2X Both SafetyL3-L4X Mitigated results – prevent release – H2: 0.0 mSv dose to worker – H2: 0.0 mSv dose to public

17. Safety-related SSCs: Helium Cooling & Wheel Safety function – Safety-related SSC Event Class Beam ON Beam OFF PBW or NOT Safety Group DIDSyste m Op Syste mMain t Confine helium – target shroudH1-H2XXBothOperationalL1-L2XX Confine helium – pipe system and componentsH1-H2XXBothOperationalL1-L2XX Limit inventory – helium purification systemH1-H2XXBothOperationalL1-L2X Limit inventory – getters in purification system to remove isotopes not captured by filters H1-H2XXBothOperationalL1-L2X Limit inventory – radiation monitoring in loop and filtersH1-H2XXBothOperationalL1-L2X Wheel cooling – process control system for helium cooling system functional H1-H2X BothOperationalL1-L2X Wheel cooling – helium flowing and cooling as designed, monitor process variables. H1-H2X BothOperationalL1-L2X Wheel cooling – monitor critical process variables, turn off beam – MPS H2X BothOperationalL2X Wheel cooling – internal helium channels and inner rotational seal H1X BothOperationalL1X Wheel cooling – pressure relief valve bleeds off helium into Off-gas extraction system H1-H2XXBothOperationalL1-L2XX Wheel rotates – drive motor functionalH1X BothOperationalL1X Wheel rotates – process control system for wheel drive functional H1-H2X BothOperationalL1-L2X Wheel rotates – wheel rotating as designed, monitor process variables H1-H2X BothOperationalL1-L2X Wheel rotates – Monitor rotation if fluctuates too far, turn off beam – MPS H2X BothOperationalL2X Limit exposure – Ventilation in room is functional (proper air renewal rate) H1-H2XXBothOperationalL1-L2XX 17

18. Safety-related SSCs: Helium Cooling & Wheel cont’d 18 Safety function – Safety-related SSC Event Class Beam ON Beam OFF PBW or NOT Safety Group DIDSyste m Op Syste mMain t Administrative Control: The workers shall be trained and educated in radiation safety. H2XXBothOperationalL2XX Confine monolith atmosphere in order to limit contamination production and to control release of inventory (with PBW) - Monolith vessel, PBW, NBWs H1-H2XXYOperationalL1-L2XX Confine monolith atmosphere in order to limit contamination production and to control release of inventory (NO PBW) - Monolith vessel and NBWs H1-H2XXNOperationalL1-L2XX Confine monolith atmosphere in order to limit contamination production and to control release of inventory (NO PBW) - Vacuum system H1-H2XXNOperationalL1-L2XX Confine monolith atmosphere in order to limit contamination production and to control release of inventory (NO PBW) - Process control system functional for vacuum system, monitoring system parameters H1-H2XXNOperationalL1-L2XX Confine monolith atmosphere in order to limit contamination production and to control release of inventory (NO PBW - Exhaust from vacuum pumps routed to stack through Off-gas extraction system H1-H2XXNOperationalL1-L2XX Prevent exposure when Beam OFF – valve in beam pipe between monolith and tunnel H1-H2 XNOperationalL1-L2XX

19. Hazard Analysis – TSS Where does TSS fit within overall Target Radiation Safety Strategy? – TSS is part of our set of tools The Target Safety System (TSS) is a safety classified, active monitoring and control system that shall: – Protect workers and public from exposure to unsafe levels of radiation and prevent the release of radioactive material beyond permissible limits – Bring the target station into a safe state in case of an abnormal event from the nuclear safety point of view Outcome of Radiation Safety Hazard Analysis includes: – Identification of safety functions – Identification & classification of SSCs 19

20. SSC Selection – TSS Safety functions defined in Accident Analysis lead to TSS requirements Safety SSCs – Safety Group Defense in Depth levels under evaluation Current TSS functions defined during analysis of AA1, AA3, AA4, AA8 – Safe state defined as no beam on Target No TSS functions identified in AA15 or AA18 (Active Cells) 20 Safety function – TSS Safety SSC TriggerEvent Class Beam ON Beam OFF PBW or NOT Safety Group DID Prevent release by stopping proton beam from hitting wheel – Detect unacceptably low helium flow and prevent proton beam from hitting wheel – TSS He flowH2X BothSafetyL2-L3 Prevent release by stopping proton beam from hitting wheel – Detect unacceptably high helium temperature and prevent proton beam from hitting wheel – TSS He inlet Temp H2X BothSafetyL2-L3 Prevent release by stopping proton beam from hitting wheel – Detect unacceptably slow wheel rotation rate and prevent proton beam from hitting wheel – TSS Wheel rotation H2XBothSafetyL2-L3 Limit release & prevent escalation of event – Detect loss of helium and prevent proton beam from hitting wheel – TSS He pressure H2X Both SafetyL3-L4 Under Consideration: Limit release & prevent escalation of event – Detect increase in monolith pressure and prevent proton beam from hitting wheel – TSS Monolith Pressure H2X Both SafetyL3-L4

21. Documentation of Safety 21 Hazard Analysis Accident Analysis Classification Hazard Analysis SDD AA Report Safety Analysis Report Safety Analysis Report DiD Analysis Design Safety Functions Safety Functions SystemEventFacilityPerspective Process Documents Design Operation Safety Functions Safety Related SSCs Operational Groups Safety SSCs Classification Scenario Probability Consequences Mitigations -> Safety Functions -> Safety Groups Sum. Safety Functions Sum. SSCs DiD Analysis Barriers Mitigating Groups System/Event Scenarios Probabilities

22. Conclusions Accelerated progress on Hazard Analyses recently – Qualitative analysis for Operations is complete – Qualitative analysis for Maintenance nearing completion – Effort on execution of Accident Analyses has significantly increased with good results – Inventories calculated & approved – Dose calculation methodology in place Target Station Hazard Analysis process in alignment with overall ESS process and SSM conditions – Complex process – application to Target analysis becoming more straightforward Classification of Target systems/components advancing – Growing list of safety-related and safety SSCs – Subdivision of Safety SSC may not stay 22

23. 23

24. Systems and Hazard Analysis – Scope 24 Moderator Systems Water Moderator Reflector System Cold Moderator Target Moderator Cryoplant System Target Systems Target Wheel and He Cooling He Purification Remote Handling Systems Target HVAC System Monolith Systems Monolith vessel incl. covers and penetrations, NBW, PBW Shielding systems Tuning Beam Dump Fluid Systems Active Liquid Purification system Primary Water Cooling Systems Intermediate Water Cooling Systems Intermediate Water Cooling for Water Systems Contaminated Tanks Gas Delay Tanks Applies to any system / subsystem / equipment / areas at Target Station that could have an accident with potential radiological impact to workers or the public. The hazard identification and analysis focuses on evaluating potential radiological accidents. Hazard analysis is a systematic process to identify, evaluate, and control potential hazards and accidents related to the Target Station.

25. Target Radiation Safety Hazard Analysis: Severity Matrix – Public H1 shaded out – indicates normal operation – Dose limits are per year – Normal operation limits and releases are handled separately from this analysis H2 – H5 dose limits are per event Limits set by SSM 25 Severity (mSv) Probability < 0.010.01-0.10.1-11-2020-100>100 H1 H2 H3 H4 H5 Unacceptable Tolerable Acceptable Public

26. Target Radiation Safety Hazard Analysis: Severity Matrix – Workers 26 Severity (mSv) Probability 0-11-1010-2020-5050-100>100 H1 H2 H3 H4 H5 H1 shaded out – indicates normal operation – limits per year – Normal operation limits and releases are handled separately from this analysis H2 – H5 dose limits are per event Limits set by ESS GSO (General Safety Objectives) except for H5 limit which we chose to equal that of the public because there was no limit stated Unacceptable Tolerable Acceptable Workers