Next Article in Journal
Development and Validation of Plain English Interpretations of the Seven Elements of the Risk Management Process
Previous Article in Journal
The Effect of All-Terrain Vehicle Crash Location on Emergency Medical Services Time Intervals

Safety 2019, 5(4), 74; https://doi.org/10.3390/safety5040074

Article
Integration of Safety in IFMIF-DONES Design
1
Centro de Investigaciones Energéticas, Medioambientales y Tecnológicas (CIEMAT), Avenida Complutense, 40, 28040 Madrid, Spain
2
Empresarios Agrupados Internacional, Magallanes, 3, 28015 Madrid, Spain
3
Agenzia nazionale per le nuove tecnologie, l’energia e lo sviluppo económico sostenibile ENEA—Fusion Technology Laboratory, Vía Enrico Fermi 45, I-00044 Frascati, Italy
4
Karlsruhe Institute of Technology (KIT), Hermann-von-Helmholtz-Platz 1, 76344 Eggenstein-Leopoldshafen, Germany
5
Escuela T. Superior de Ingenieros Industriales, Universidad Nacional de Educación a Distancia (UNED), C/Juan del Rosal, 12, 28040 Madrid, Spain
6
VTT Technical Research Centre of Finland Ltd., Kemistintie 3, FI-02044 Espoo, Finland
7
National Centre for Nuclear Research (NCBJ), Centre of Excellence MANHAZ, A. Soltana 7, 05-400 Otwock-Swierk, Poland
8
Universidad Politécnica de Madrid (UPM), Escuela T. Superior de Ingenieros Industriales, C/José Gutiérrez Abascal, 2, 28006 Madrid, Spain
*
Author to whom correspondence should be addressed.
Received: 11 June 2019 / Accepted: 21 October 2019 / Published: 25 October 2019

Abstract

:
The IFMIF-DONES (International Fusion Material Irradiation Facility-DEMO Oriented NEutron Source) facility is being designed with the general objective of providing irradiation of representative samples of power fusion machine materials under prototypical conditions. A linear accelerator will deliver deuterons at high intensity to circulating lithium in a loop, which will produce neutrons capable of obtaining the required damage conditions. As a result of this process, radionuclides will be produced as a by-product, which is characterized by several degrees of mobility. Shielding and radiation protection measures will be required in the facility. IFMIF-DONES will be classified as a first class radioactive facility according to national regulations, with Spain being the European candidate to site the facility. Several aspects of the main safety instructions affecting the facility’s design are explained and discussed in this paper.
Keywords:
IFMIF-DONES; safety; regulatory requirements; linear accelerator; fusion

1. Introduction

The IFMIF-DONES (International Fusion Material Irradiation Facility-DEMO Oriented NEutron Source) facility is being designed under the EUROFUSION/WPENS project. Its general objective is to provide an intense neutron source and representative irradiations of materials to be used in future fusion reactors.
DONES is presently the result of several initiatives across many years towards a neutron source based on deuterium-lithium stripping reactions, with changing specifications along several periods of design. The previous project directly benefiting present activities was IFMIF-EVEDA, as part of the Japan-Europe ‘Broader Approach’ agreement launched in 2007 to complement the ITER project and boost fusion research by means of dedicated projects. In the IFMIF-EVEDA project (IFMIF Engineering Validation and Engineering Design Activities), the building and operation of key IFMIF systems for demonstration of basic performances has been or is being achieved, while dedicated activities were also performed to progress the design of the whole facility.
After launching the present design activities under the EUROFUSION consortium workpackage in 2015, two recent important facts affect its activities. First, as a fundamental frame for safety, the Spanish candidature for building IFMIF-DONES in Europe has been endorsed by EUROFUSION. This point is important because it directly facilitates the national legislation for licensing and operating the facility as a singular radioactive installation. Secondly, the facility has been recently accepted as part of the ESFRI (European Strategy Forum for Research Infrastructures) scientific network.
Several aspects of the main safety regulations affecting the design are explained and discussed in this paper. Discussions are based on main assumptions, estimates, and other information included in internal reports of ongoing WPENS works, not all of which are publicly available. Also, they are subjected to recalculations as design features are updated. In any case, the facility design is more stable at this stage of the project and it is expected that many estimates will only change in relatively small ranges.

2. IFMIF-DONES Facility Description

The facility is made of five main systems, shown in Figure 1 and briefly explained below with possible emphasis on safety aspects. IFMIF-DONES will be a complex first-in-a-kind facility and a full description would require much additional description here. Therefore, additional important information can be found in other references, such as reference [1] and reference [2].
  • Accelerator Systems (AS) will provide an intense 125 mA deuteron beam of 40 MeV by means of a linear accelerator. Deuteron particles are generated in the injector area and they are boosted by means of non-superconducting and superconducting cavities, connected to radiofrequency tubes. Some scrapers and magnets will drive and trim the beam at lower and intermediate energy regions. A long section in the high energy region of the beam is provided with additional magnets and a collimator to drive the beam, and a beam dump for occasional operation. Ancillaries systems are designed for cooling some components and to provide vacuum conditions along the tube. Isolation valves are also provided in several points of the beam duct.
  • Lithium Systems (LS) is in essence a liquid lithium loop of more than 8 m3 receiving the deuterons in a free surface area, with no window material, producing neutrons above 40 MeV through nuclear reactions. The Target Assembly (TA) is the component in the loop where deuteron-lithium reactions occur. The high velocity circulating lithium removes 5 MW thermal energy in the TA, and is stopped in a Quench Tank. The lithium then transports the heat to a secondary loop by means of a lithium-oil Heat Exchanger.
  • Test Systems (TS) include a specific container called High Flux Test Module (HFTM), housing the samples to be irradiated with neutrons, very close to the Target Assembly. In addition, Test Systems are formed by the Test Cell (TC) room enclosure housing the module itself and the TA where the deuteron beam impacts. The Test Cell consists of a monolith wall of several meters thickness working as a neutron and gamma shield, internally tightened with a steel liner of 8 mm thickness. At the TC top there are removable upper shielding blocks and a cover plate. Test Systems are completed with ancillary systems that provide cooling of HFTM and a walls monolith; they also maintain a He inert gas TC atmosphere and provide purification.
  • Building and Plant Systems (BPS) is the ensemble of a large number of ancillary and supporting systems necessary to develop the main function of the facility. They include the Main Building itself with radiological confinement functions and systems with a significant role in the safe operation of the facility: Heating, a Ventilation and Air Conditioning System, Service Gas System (to provide inerting atmospheres), Vent Detritiation System and Fire Protection System, among others.
  • The Central Instrumentation and Control Systems (CICS) is organized in three subsystems, one of them being the Safety Control System. A Machine Protection System for investment protection, and a CODAC (Control, Data Access and Communications) control system for supervision under normal operation are also part of CICS.

3. Radiological Material at Risk and Radiation Sources

As a result of local high values of deuteron and neutron fluxes, IFMIF-DONES is expected to produce a moderate amount of radioactive inventory, as explained in next paragraphs.
Deuteron particles will impinge on the flowing lithium, which also transports some corrosion impurities, then produces activation products in the lithium stream. The secondary but also intense neutron source occurrence in the same region will produce additional activation products.
The provision of the radionuclide required data necessitates the availability of dedicated computational tools to model the plant with the relevant components/systems in sufficient detail, simulate the transport of deuterons, neutrons, and photons in the AS, the Li target and the TC cell down to the neighboring rooms, assess the activation of all materials/components subjected to the radiation, and predict the resulting radiation dose fields. Suitable computational tools, based on the Monte Carlo transport technique and the coupling to nuclide inventory calculations, were developed to cope with such demands. These include specific tools and data developed for IFMIF-DONES over a couple of years as well as tools and data available from other nuclear application areas.
For deuteron transport simulations in the accelerator area of IFIMF-DONES, the MCUNED computer code [3] has been developed by Universidad Nacional de Educación a Distancia (UNED), Madrid. MCUNED is as an extension to the MCNPX Monte Carlo code [4] with the capability of handling charged particle transport, in particular light ions such as deuterons, based on cross-section data provided on nuclear data files such as TENDL [5]. MCUNED is thus well suited to simulate the deuteron transport in the accelerator and provide the neutron and photon production as result of the interaction of deuterons with beam guides, scrapers, etc., or the beam dump. MCUNED has been extensively benchmarked and applied for design analyses of the IFMIF accelerator and is the standard code for such applications in DONES design. In particular, it is used to produce the neutron and gamma sources which results from deuteron interactions with accelerator materials in DONES. The McDeLicious Monte Carlo code [6,7] has been developed by KIT, Karlsruhe, specifically for application to IFMIF (and later DONES). McDeLicious is an extension to the LANL Monte Carlo code MCNP [8,9] with the capability to simulate the generation of (d, Li) source neutrons (and photons) based on the use of evaluated d + 6,7Li cross-sections [10,11]. McDeLicious has been thoroughly benchmarked and validated against thin and thick Li target neutron yield measurements [7,11] for the Li (d, xn) cross-section at 40 MeV incident deuteron energy and thick Li target neutron yield data as a function of the deuteron energy.
The Fusion Evaluated Nuclear Data Library (FENDL) with the current version 3.1 d, is the reference data library for IFMIF-DONES. FENDL is provided by the IAEA to satisfy the needs both for fusion technology and IFMIF-type applications. Thus, the libraries cover the energy range above 20 MeV neutron energy. The FENDL-3.0/A neutron activation data library, identical to the European Activation File EAF-2010 is the current reference for activation calculations.
The simulation models used in the Monte Carlo calculations with MCNP, McDeLicious or MCUNED need to be consistent with the engineering CAD models prepared for DONES. This requires a suitable translation of the CAD models into the geometry representation used by Monte Carlo codes. To this end, the ENS project utilizes the McCad approach developed by KIT, Karlsruhe.
The main results of computational models are that an annual production of 3.9 g (1.3 × 1015 Bq) of tritium and 0.12 g (1.5 × 1015 Bq) of beryllium-7, equilibrium value, and minor amounts (4 × 1011 Bq) of activated corrosion products (ACP) are presently estimated, which will be retained at the first instant in the liquid lithium itself and transported afterwards to areas away from the origin point.
The lithium loop will be serviced with an online ‘Impurity Control System’ which takes a fraction of the flow. This circuit is composed by an yttrium trap and a cold trap, respectively dedicated to capture tritium and ACP. Present estimates indicate that the efficiency of traps can reduce the presence of tritium dissolved in the lithium loop to 0.3 g and Be-7 to 23 µg. A similar amount of tritium is expected as maximum in the trap, as it will be specified that yttrium traps must be removed when loaded to 0.3 g (i.e., one trap replacement is anticipated every month). Be-7 will deposit in the last segment of the Heat Exchanger (HX) due to a decrease of solubility of the expected specie (Be3N2) as Li decreases its temperature. Be-7 will also deposit in the cold trap, working at lower temperature. The cold trap is estimated to capture 0.03 g Be-7 while 0.09 g will deposit at HX outlet section (these values are still subjected to further investigation).
Small amounts of tritium will permeate from the lithium loop to surrounding atmospheres. Present estimate is about 1.5 × 104 Bq/h towards the Lithium Loop Cell atmosphere. A detritiation system under normal operation conditions will be implemented for atmospheres purification, as in the case of the Lithium Loop Cell, the Impurity Control System Cell, and the Target Cell.
A very small fraction of deuterons running in the accelerator duct and components will also induce direct activation of structural and functional components when impacting them, as scrapers, a collimator, or occasionally in the beam dump. Neutrons will occur in a second step as a result of such reactions, then traveling some distances from the point of origin and therefore with possibilities to activate separate materials where the neutron flux remains significant. Scrapers and the collimator will again be further activated in this way, but also coils, cooling the water of some circuits and atmospheres surrounding the accelerator, especially in high deuteron energy areas. Air atmospheres will produce Ar-41 (up to some 1 × 107 Bq equilibrium value, when conservatively assuming no ventilation removal of concerned rooms), and minority amounts of tritium, C-14, N-13, etc. An additional atmosphere of concern is the Target Interface Room, which is an Argon inertized cell adjacent to the Test Cell receiving back streaming neutrons, then originating Ar-41 around 5 × 109 Bq, equilibrium value.
In what concerns activation of structural materials around the target it is estimated in the range of a dozen of grams (Fe-55, Mn-54, Co-58, etc.) distributed in the structural material of the target assembly (mostly backplate) and in the High Flux Test Module. This radioactive inventory, which includes minor amounts of tritium, will be an issue for waste management but of less concern for mobilization in design basis conditions.
Direct exposure to gamma and neutron sources is the other important radiation risk to address. Wall rooms in the main building are designed with shielding function to allow acceptable dose rates in neighbor rooms. Also, local shielding structures close to origins of radiation are being explored to further deplete the exposure during normal irradiation and during beam shutdown maintenance conditions. Both fixed and transferred sources as waste management during maintenance operations are considered in the analyses.
The Target Assembly located in the Test Cell is the main intense source of neutrons during beam operation, some 7.7 × 1016 n/s, and thick shielding walls of magnetite concrete are designed in the TC, 4 m in downstream neutron favored traveling direction. Somewhat lower thicknesses in other walls around TA are designed, while all TC walls configure the so called Test Cell monolith.
In addition, there are several penetrations of the monolith walls and therefore streaming to neighbor rooms must be addressed. Backstreaming neutrons towards the Target Interface Room and further to Accelerator Vault is estimated and shielded until affordable dose rates are obtained. Access of personnel to accelerator high radiation areas is forbidden (function provided by the ‘Personnel Protection System’). The combination of local shielding and room walls will reduce the dose rate in neighbor rooms to specified values in supervised or controlled areas, Figure 2.
Streaming from the Target to the lower Lithium Loop Cell (LLC) will occur through inlet and outlet lithium loop penetrations. Again, while LLC is forbidden access its walls are planned for further reduction of dose rates in neighbor rooms and corridors. Finally, streaming from Target to the so called upper Access Cell (access to TC components is provided from this upper bay area by remote handling) is also minimized, taking into account effectiveness of specific components in the upper part, such as large Shielding Plugs slabs as well as Pipe and Cabling Plugs. These plugs house inserted pipes for transport of cables and gas services, with several changes in direction to deplete streaming.
As introduced above, additional neutron sources are identified along the deuteron beam before the target, specifically when intercepting components as the last collimator and scrapers. Conservative beam losses are assumed for other segments (superconducting RF cavities, beam duct), with the manual maintenance of AS components being a plant requirement. In these cases, the neutron sources are several orders of magnitude lower than in the target. In addition, specific streaming in walls of this area is addressed, as it is the case of wall penetrations in the accelerator vault for radiofrequency tubes.
The facility rooms are classified from the radiological point of view as shown in Figure 2 according to the expected level of radiation and also taking into account interventions to be done in the different rooms. Two classifications are developed, for beam-on and maintenance conditions, and they are systematically verified by means of neutronic computations under continuous refinement towards realistic models. The usage of ad-hoc Remote Handling devices is anticipated in areas with high dose rate values.

4. The Licensing Frame

One of the top level national regulations is the Spanish RINR, (‘Reglamento de Instalaciones Nucleares y Radiactivas’, or ‘Regulation for Nuclear and Radioactivity Facilities’), Royal Decree 1836 as of 1999, modified in 2015, which leads to IFMIF-DONES classification as a ‘First Category Radioactive Facility’. The complete set of required documentation to provide to the Regulatory Body for licensing is specified according to the above RINR classification. In the DONES case, a single operation permit would be requested, which includes a construction permit when issued. Nevertheless, while all safety design activities are presently oriented to the full facility, a licensing scheme will be pursued in due course in line with commissioning of the facility in several phases: establishing the injector, medium energy, beam dump, and beam-on-target.
More closely related to design activities, the next top level mandatory documentation to follow is the so-called ‘Safety Instruction 26’ (SI-26) which contains Plant Safety Requirements (PSR) to implement and to be demonstrated in the licensing reports.
SI-26 is similar to the main worldwide regulations for equivalent facilities, and Table 1 summarizes the PSR according to SI-26. There are six main chapters: (i) General Objectives, (ii) Siting, (iii) Design, (iv) Construction and Operation, (v) Exploitation, and (vi) Decommissioning. The traditional procedure to follow in design activities is to apply specific guidelines to develop the main chapters down to complete the system requirements of safety class systems, structures, and components. However, the selection of specific guidelines is typically not stated and can be defined by designers. There are available guidelines at the national and international levels. In any case, the definitive set of guidelines applied to DONES must be provided to the Regulatory Body as part of the evaluation process. In this way, a complete set of directions to hierarchically follow regulations, standards, building codes, etc., will contribute to demonstrating the required degree of robustness in the design, while specific analyses will complement the guidelines and standards.
On the other hand, it must be mentioned that SI-26 was developed for licensing nuclear facilities and that the Regulatory Body could likely issue a future specific adaptation to DONES, which would be expected to not be very different in content than the present SI-26 (also, new official versions of SI-26 as well as the above RINR are expected in the short term, forcing further review and adaptation when necessary).
The next section will explain the main activities developed in the EUROFUSION/WPENS project to implement the main SI-26 Safety chapters, incorporating the specificities of the facility.

5. Implementation of the Main SI-26 PSR in the DONES Design

5.1. General Objectives

The general objective of the facility owner must be to protect the public and workers as well as the environment from dangerous effects of ionizing radiation. To accomplish such an objective, important safety principles apply, as limitation, control and minimization of radioactive material, limitation of the probability in events related to facility loss of control, minimization of consequences, and minimization of waste management production. These principles will apply in all of the facility cycle, starting with design activities.

5.2. Defense in Depth

This is an important principle to consider in design tasks as well as in other phases of the facility (construction, operation, dismantling, and waste management). Very briefly, in addition to the configuration of several barriers for confinement, the principle consists of providing several layers of protection to be developed independently from each other. The first layer is minimization of deviations from normal operation, the second is detection and control of deviations, the third is provision of systems driving the plant to a controlled state in case of accident, the fourth is to reduce the probability of beyond design basis accidents as much as possible, and the fifth is to reduce the consequences of releases as a result of accidents.

5.3. Risk and Safety Analysis

The facility owner must demonstrate that designed barriers and provision of Safety Class systems, structures, and components (SSC) are adequate for prevention of accidents and mitigation of consequences. A safety study according to the directions of the above RINR regulation must be provided, where postulated accident scenarios are analyzed.
Risk analysis must be provided for global verification of probabilities in the accident scenarios. Analyses are ongoing in the frame of EUROFUSION WPENS project, taking into account the first-of-a-kind nature of DONES due to a number of features. Event Trees are being developed including the expected lines of defense, and plant status probabilities are quantified. Available failure databases from Fusion Component Failure Rate Data Base [12] are being used, or failure rate objectives are assumed to be further demonstrated via safety requirements assigned to systems and components.
A complete and enveloping set of design basis accidents must be provided in licensing. This work is being developed for DONES following bottom-up and top-down approaches to analyze the facility response to postulated failures. The bottom-up approach started with ‘Failure Mode and Effect Analysis’ (FMEA) for the different main DONES systems and interfaces according to the available status of design. The FMEA analyses are done following IEC guidance [13] and activities are being further updated as design progresses. The following steps are fulfilled in compliance with FMEA activities:
  • The component or system under analyses is identified according to the Plant Breakdown Structure (PBS). There are 34 main systems in PBS, broken down to subsystems at low levels as possible for analyses.
  • Process function associated to subsystems or component is identified.
  • The associated Safety Function is identified. An expanded list of detailed safety sub-functions has been produced (as explained in Section 5.3 below).
  • Failure mode is postulated.
  • Causes leading to failure mode are provided.
  • Consequences of failure are projected.
  • Detection actuations are proposed.
  • Automatic action on detection is proposed.
  • Preventive and mitigative actions are additionally proposed.
FMEA exercises are presently available for Lithium Systems, Test Systems including Ancillary Systems, Accelerator Systems, Radwaste Treatment Systems, Heat, a Ventilation and Air Conditioning system, and a Service Gas System, with updated versions in some cases.
The top-down approach assumes that large areas of the facility are unavailable to perform their functions. Losses of large areas of the facility due to external or internal events are examples of scenarios under consideration.
A list of Reference Accident Scenarios (RAS) is proposed and continuously reviewed for evaluation as candidates Design Basis Accidents. Table 2 shows the present list (changes in the list are still possible as analyses progress).
Deterministic analyses of scenarios in Table 2 including sensitivity cases are being done while being supported with the fusion version of the MELCOR code [14]. The lithium equation of state is implemented in the code, therefore enabling lithium loop accidents. Also, specific features like tritium transport in rooms as HTO specie are implemented, in addition to other possible aerosol or gas species. Rooms housing potential material at risk can be modeled and flow paths simulated according to identified failure modes in accident conditions. Several MELCOR models are available, as shown in Figure 3, which implement the operation of main and ancillary systems, and make sure that safety functions are addressed. Mitigated and unmitigated scenarios are analyzed in an iterative way as long as performance of systems and details of design aspects progress. Metrics for accident evaluation are being established, including released radionuclides amounts outside the facility, as well as to rooms inside, some of them potentially occupied by workers.
The technical safety requirements (operational limits, control parameters, and actions to implement in abnormal situations) are under exploration by means of monitors and actuators built in the above models thanks to the MELCOR Control Function package, while definitive proposals will be done in next stages as part of this type of analyses. The Safety Control System will be designed in line with this information.
An assessment of Beyond Design Basis scenarios must be also provided in safety analysis for understanding the ultimate safety risks of the facility. The credibility of such scenarios will depend on final assessment of probabilities (still showing uncertainties) and on possible changes in design. This means that the probability can still be decreased when design specifications are modified as necessary.
Potential external events beyond design basis might lead to the highest levels of releases, such as beyond design basis earthquakes, but internal events could also be a factor if several lines of defense fail. An example of such a scenario presently under consideration is adapted from PSAR-05 [15]. The scenario is a lithium fire in the Lithium Loop Cell, leading to a complete combustion of lithium affecting critical components and leading to complete loss of protection from confinement barriers. The radiological source term has three contributions: (i) Tritium originally dissolved in the lithium, 0.3 g (ii) Be-7 deposited in HX plus dissolved in the lithium, 90 mg, (iii) Activation Corrosion Products (typically, a percentage of the calculated inventory is assumed to release). However, present estimates of ACP in the lithium loop are small (4 × 1011 Bq), even when assuming no role of the cold trap in the purification loop. As the ACP removal efficiency must be considered in the next activities, no ACP contribution to the dose in this scenario is calculated.
Definitive dose conversion factors for the source term material will be obtained according to the US-NRC Regulatory Guide 1.145 [16], which is presently acceptable under Spanish guidelines. This activity is ongoing, and instead of definitive results, illustrative assumptions are provided here as a first reference for this scenario.
The atmospheric dispersion of the release material is assumed to take place under pessimistic weather conditions as low wind velocity, atmosphere stability class and 10 m height release (i.e., no credit to stack release). The offsite Most Exposed Individual (MEI) is a member of the public assumed to be located at the boundary edge of the facility. The present specification involves MEI being placed in the 100 m range. For such a distance, a dose conversion factor for tritium is provisionally taken as 10 mSv/g-T(HTO) based on project internal estimates. This factor accounts for exposure pathways due to tritium inhalation and skin absorption at short term. No chronic long term dose by ingestion of contaminated foods has been estimated. For Be-7, the dose factor is higher than tritium, and it is provisionally taken as 400 mSv/g-Be7, based on reference [17]. Therefore, the total dose due to all tritium and Be-7 contributions is in the order of 40 mSv, dominated by the Be-7 release. As mentioned above, definitive results will be provided later as part of the licensing methodology, taking into account the full source term, specific dose conversion factors (including ingestion and chronic dose), weather conditions, and distance to MEI among other assumptions.
On the other hand, design improvements are under consideration to further address the very low probability range of accidents. Examples are: implementation of separate fire sectors making the sources behave independently under fire conditions, lowering Be-7 deposits in HX with a different specification of circuit operation, detritiation during fire events, and other similar events. In this case, mobilizable radionuclides would then be decreased, leading to lower dose values.

5.4. Barriers in Design

According to SI-26, barriers must be provided by design for confinement of radionuclides in compliance with the defense in depth concept. In DONES, the confinement approach is based on two or three levels, commensurately to the material at risk that is under confinement. The first level is the immediate wall or pipe around the process itself, which is built with high mechanical standards, therefore reducing the probability of failures. Mechanical building codes such as RCC-MX are applied in most of safety class systems. However, not all the processes are immediately confined by safety class SSCs as the first barrier due to complexity in design or due to a particularly difficult working environment preventing the application of codes. This could be the case for the lithium loop pipe components in high neutron flux areas (Test Cell) or the accelerator beam duct. In these cases, respectively, the safety function is transferred to the next enveloping barrier, which is the Test Cell liner, or a Fast Isolation Valve in the beam duct is implemented close to the target.
The second level of confinement is provided by a new barrier around the process. In this case the barrier is identified as safety class component and safety system requirements are applied accordingly: robustness against design basis loads, inspectionability, specific isolation conditions for penetrations, program of tests, etc. The third barrier is provided by the rooms around the second barrier, working under the dynamic confinement principle. According to this principle, concerned rooms are served by nuclear HVAC system which provides depressed conditions according to ISO 17873 standard. In virtue of this standard, rooms are categorized in four potential confinement categories lumping nominal and accidental conditions, while HVAC should then provide corresponding depressed level degrees. HVAC will also provide the room with the isolation safety function in case of necessity (dampers closed), as well as aerosol removal by means of HEPA filters. In addition, the tritium presence may be significant in normal operation and accident conditions in some of the second or third barrier rooms. Therefore, detritiation systems are provided by design in compliance with the safety function, ‘management of tritium’. In this case, two systems are provided: ‘Vent Detritiation System’ (VDS) for detritiation under normal operation (mostly in first barrier processes, under intermittent or continuous operation depending on the concentration), and ‘Emergency Detritiation System’ (EDS), implemented for second and third barriers under accident conditions.
Deterministic analysis of cells and rooms in the main building, with appropriate modeling of leak paths and emergency systems, will address situations involving barriers under accident conditions. Inertized rooms for the prevention of fire scenarios will also be addressed as part of the depression chains among rooms, for which negative pressure is provided by specific gas mass control systems instead of by HVAC.

5.5. Dose Objectives

Dose objectives are established in all categories of design basis, from normal operation (effluents, beam-on irradiation) to incident and accident conditions. Table 3 shows present objectives for design basis scenarios, which still could change slightly depending on the progress of analysis and final adaptation to particular regulations (slightly different categories according to initial events rather than scenarios). Both the public and the worker are subjected to dose objectives and these are well below ICRP recommendations. Activities are ongoing for verification of the dose objectives by means of deterministic analysis of Reference Accident Scenarios.

5.6. Safety Functions

The Safety Functions (SF) are established starting at the highest level with four fundamental ones: confinement of radioactivity, limitation of exposure, protection of the two previous SF, and support for implementing main SF.
Table 4 shows the list of main SF, which is still broken down to lower levels, presently up to some 40 safety sub-functions (not all of them are shown in the table) to ease interaction with design teams.
System safety requirements for design are being selected and developed for demonstration of the safety functions applied to safety class SSCs. The main orientation for development of safety system requirements is to be in line with the main codes and standards typically applied in the nuclear field area.

5.7. Safety Important Class Classification of SSC’s

A ‘Safety Important Class’ (SIC) classification of SSCs must be provided according to SI-26. The SIC classification is being pursued by means of analysis under continuous review around the Reference Accident Scenarios in Table 2. A methodology based on IAEA [18] and Fusion/DEMO activities is being applied. The main characteristics of the methodology are the following.
Three criteria are applied to identify a SIC SSC: (A) A failure can directly initiate an incident or accident leading to risk of exposure or contamination; (B) The SSC is needed to limit consequences of an accident; (C) The SSC is needed to ensure the operation of other SIC components.
According to the above methodology, three SIC categories are established, which will allow a gradual implementation of system requirements according to their degree of importance: SIC-1 category (‘safety important’) is applied to SSC’s necessary to avoid ‘high’ consequences in postulated accidents (typically more than 1 mSv for accidents, 100 µSv for incidents; this category is therefore assigned to systems necessary to achieve the specified dose objectives in the project); SIC-2 category is assigned to SSC’s involved in ‘medium’ consequences (more than 100 µSv for accidents); and SIC-3 for lower consequences (10 µSv). The probability of scenarios is also considered in the classification, as they are divided in incidents, accidents, and very low probability accidents. ‘Non safety’ significant category is applied for the rest of the SSCs.
The present list of candidate SIC-1 SSCs is provided in Table 5 (although, variations are possible as analyses progress).
A final step is still necessary for adaptation to national regulations, because only two safety class categories will be requested, ‘safety important’ (SIC-1 class) and ‘safety relevant’ (in principle, SIC-2 and SIC-3 classes).

5.8. External Events Protection

DONES will be designed against external events with natural or non-natural origins, where seismic hazard is the first external event being considered. A seismic classification in four categories is applied to safety class components as follows: (i) Seismic Class SC1/SF category (SF stands for structural and functional characteristics preserved), (ii) SC1/S (structural function only), (iii) SC2 (non-damage to SC1), and (iv) non-seismic category. In addition to other SIC SSCs, the main building is subjected to seismic requirements as part of last confinement barrier and shielding safety functions, while assurance of mechanical protection of these main safety functions is also provided. The International Building Code is applied for further non-radiological safety requirements and design criteria. Deterministic analyses for the demonstration of requirements concerning displacements, leakages, and integrities are ongoing. The presence of seismic isolation devices at foundation level is being considered below the main building.
In addition, SL-2 (Safe shutdown earthquake for which safety functions must be provided, where a 10,000 years return period is considered) and SL-1 (for which no releases above normal operation are allowed and resumption of operation without extensive inspection is expected; a 100 years return period) IAEA classification levels are being applied. While generic peak ground accelerator values are being applied to SL-2 and SL-1 in a first approach (respectively 0.25 g and 0.1 g, where ‘g’ stands for unit of gravitational acceleration, 9.8 m/s2), specific characterization of the site is being done for application of more realistic values.
External hazards to be included in the next phases of natural phenomena analyses are external flooding and rains, while non-natural hazards are under discussion.

5.9. Fire Protection

Several types of activities are being developed for the fire protection approach configured in the design. A Preliminary Fire Hazard Analysis (PFHA) was performed and is now being updated according to the last available design of the facility. The methodology in the PFHA is divided in five steps: identification of safety targets, Safety Functions, Safety Important Components (SIC), TRICE products (toxic, radioactive, inflammable, chemical, explosive), location of SIC’s and TRICE products, and characteristics of the rooms with SIC and TRICE products.
In addition to considerations of traditional fire risk, special care is taken for lithium as a pyrophoric product, which will be present in the facility in the order of 9 m3 and is the carrier of radionuclides that are potentially mobilizable when exposed to fire (tritium, beryllium, and ACP). Safety functions are established to prevent lithium fires by means of dedicated systems: helium or argon inertization atmospheres will be established in rooms potentially receiving lithium leakages; lithium leakage detection will be implemented; and mitigation systems will be implemented. In any case, room inertization will likely be part of the ‘Performance Technical Specifications’ Book, which means that plant operation is not possible when specifications are not achieved. In addition, a methodology is being pursued involving phenomenology related to lithium fires (ignition conditions, temperature loads to confinement, etc.), engineering preventive measures, and systems mitigation actions with the objective to demonstrate that an extremely low probability of radiological consequences due to lithium fires in the facility can be achieved (i.e., beyond design basis category).
Fire areas have also been established, with identification of fire barriers and walls, as per two hours and three hours fire ratings. The PFHA analysis is being done assuming that each room is a single fire zone.
Analytical support of fire scenarios is being done with the reference codes FDS and MELCOR, where combined performance of safety systems is addressed.
Among the main references the DOE-STD-1066-2016 Standard [19] and its associated documentation is being considered for application. The outputs of fire protection activities are being reviewed and updated according to progress in DONES design and parallel analyses.

6. Conclusions

Safety is being integrated in the DONES design according to Spanish and international regulations for nuclear facilities, which assure an important degree of robustness of the facility to provide protection to the public, the workers, and the environment. Safety activities are challenging due to being the first facility of its kind, and the several safety functions involved for several dedicated systems. The design basis is being developed through a continuous interaction with design teams and the licensing process is expected to be launched shortly.

Author Contributions

Conceptualization, F.M.-F.; Methodology, F.M.-F., M.E.G., P.F., Á.C., T.P., U.F., F.O., F.M., Y.Q., A.H., S.P., E.G.; Software, F.M.-F., G.D., Á.C., E.F., M.T.P., U.F., F.O., F.M., Y.Q., S.P., E.G.; Validation, U.F., Y.Q., F.M.-F., G.D., E.F., F.O.; Formal Analysis, U.F., Y.Q., F.M.-F., G.D., P.F., Á.C., E.F., T.P., M.T.P., F.O., F.M., A.H., S.P., E.G.; Investigation, U.F., Y.Q., F.M.-F., G.D., E.F., T.P., M.T.P., F.O., F.M., A.H., S.P., E.G.; Data Curation, F.M.-F., M.E.G., P.F., G.D., Á.C., E.F., T.P., M.T.P., U.F., F.O., F.M., Y.Q., E.G.; Writing-Original Draft Preparation, F.M.-F., U.F.; Writing-Review & Editing, M.E.G, U.F., Y.Q., F.M.-F., G.D., P.F., Á.C., E.F., T.P., F.O., F.M., A.H., S.P., E.G.; Visualization, M.E.G., Á.C., G.D., E.F., M.T.P., U.F., F.O., F.M., Y.Q.; Supervision, F.M.-F., M.E.G., U.F., Á.I.; Project Administration, F.M.-F., U.F., Á.I.; Funding Acquisition, Á.I.

Funding

This work has been carried out within the framework of EUROfusion Consortium and has received funding from the Euratom research and training programme 2014–2018 and 2019–2020 under grant agreement No. 633053. The views and opinions expressed herein do not necessary reflect those of the European Commission.

Conflicts of Interest

The authors declare no conflict of interest.

References

  1. Ibarra, A.; Arbeiter, F.; Bernardi, D.; Krolas, W.; Cappelli, M.; Fischer, U.; Heidinger, R.; Martin-Fuertes, F.; Micciché, G.; Muñoz, A.; et al. The European approach to the fusion-like neutron source: The IFMIF-DONES project. Nucl. Fusion 2019, 59, 065002. [Google Scholar] [CrossRef]
  2. Ibarra, A.; Arbeiter, F.; Bernardi, D.; Cappelli, M.; García, A.; Heidinger, R.; Krolas, W.; Fischer, U.; Martin-Fuertes, F.; Micciché, G.; et al. The IFMIF-DONES project: Preliminary engineering design. Nucl. Fusion 2018, 58, 105002. [Google Scholar] [CrossRef]
  3. Sauvan, P.; Sanz, J.; Ogando, F. New capabilities for Monte Carlo simulation of deuteron transport and secondary products generation. Nucl. Instrum. Methods Phys. Res. A 2010, 614, 323–330. [Google Scholar] [CrossRef]
  4. Hendricks, J.S.; McKinney, G.W.; Fensin, M.L.; James, M.R.; Johns, R.C.; Durkee, J.W.; Finch, J.P.; Pelowitz, D.B.; Waters, L.S.; Johnson, M.W.; et al. MCNPX 2.6.0 Extensions. In Report LA-UR-08-2216; LANL: Los Alamos, NM, USA, 2008. [Google Scholar]
  5. Rochman, D.; Koning, A.J.; Sublet, J.C.; Fleming, M.; Bauge, E.; Hilaire, S.; Romain, P.; Morillon, B.; Duarte, H.; Goriely, S.; et al. The TENDL library: Hope, reality and future. EPJ Web Conf. 2017, 146, 02006. [Google Scholar] [CrossRef]
  6. Simakov, S.P.; Fischer, U.; von Möllendorff, U.; Schmuck, I.; Konobeev, A.; Pereslavtsev, P. Advanced monte carlo procedure for the d-Li neutron source term based on evaluated cross-section files. J. Nucl. Mater. 2002, 1710, 307–311. [Google Scholar]
  7. Simakov, S.P.; Fischer, U.; Kondo, K.; Pereslavtsev, P. The mcdelicious approach for the d-Li neutron source term modeling in ifmif neutronics calculations. Fusion Sci. Technol. 2012, 62, 233–239. [Google Scholar] [CrossRef]
  8. X-5 Monte Carlo Team. MCNP—A General Monte Carlo N-Particle Transport Code. In Report LA-UR-03-1987; LANL: Los Alamos, NM, USA, 2003. [Google Scholar]
  9. Werner, C.J. (Ed.) MCNP Users Manual—Code Version 6.2. In Report LA-UR-17-29981; LANL: Los Alamos, NM, USA, 2017. [Google Scholar]
  10. Pereslavtsev, P.; Fischer, U.; Simakov, S.; Avrigeanu, M. Evaluation of d + 6,7Li data for deuteron incident energies up to 50 MeV. Nucl. Instrum. Methods Phys. Res. B 2008, 266, 3501. [Google Scholar] [CrossRef]
  11. Fischer, U.; Avrigeanu, M.; Pereslavtsev, P.; Simakov, S.P.; Schmuck, I. Evaluation and validation of d-Li cross-section data for the IFMIF neutron source term simulation. J. Nucl. Mater. 2007, 367, 1531–1536. [Google Scholar] [CrossRef]
  12. Pinna, T.; Izquierdo, J.; Porfiri, M.T.; Dies, J. Fusion component failure rate database. Fusion Eng. Des. 2006, 81, 1391–1395. [Google Scholar] [CrossRef]
  13. IEC. Analysis Techniques for System Reliability-Procedure for Failure Mode and Effects Analysis (FMEA). In EN IEC 60812; IEC: Geneva, Switzerland, 2006. [Google Scholar]
  14. Merrill, B.J.; Humrickhouse, P.W.; Moore, R.L. A recent version of MELCOR for safety fusion applications. Fusion Eng. Des. 2010, 85, 1479–1483. [Google Scholar] [CrossRef]
  15. Taylor, N.P.; Brañas, B.; Eriksson, E.; Natalizio, A.; Pinna, T.; Rodriguez-Rodrigo, L.; Ciattaglia, S.; Lässer, R. Preliminary assessment of the safety of IFMIF. J. Nucl. Mater. 2007, 367, 1537–1542. [Google Scholar] [CrossRef]
  16. US-NRC. Atmospheric Dispersion Models for Potential Accident Consequence Assessments at Nuclear Power Plants; NRC Regulatory Guide 1.145, US-NRC: Rockville, MD, USA, 1982. [Google Scholar]
  17. Nakamura, M.M.; Ochiai, K. Radiological consequences of a bounding event sequence of Advanced Fusion Neutron Source. Fusion Eng. Des. 2017, 118, 104–110. [Google Scholar]
  18. IAEA. Safety Classification of Structures, Systems and Components in Nuclear Power Plants. In Specific Safety Guide No. SSG-30; IAEA Safety Standards: Vienna, Austria, 2014. [Google Scholar]
  19. US-DOE. DOE Standard fire Protection. In DOE STD 1066 2016; US-DOE: Washington, DC, USA, 2016. [Google Scholar]
Figure 1. IFMIF-DONES (International Fusion Material Irradiation Facility-DEMO Oriented NEutron Source) plant systems configuration (LEBT stands for ‘Low Energy Beam Transport’, RFQ for ‘Radiofrequency Quadrupoles’, MEBT for ‘Medium Energy Beam Transport’, SRF for ‘Superconducting Radiofrequency’, HEBT for ‘High Energy Beam Transport’, HFTM for ‘High Flux Test Module’, STUMM for ‘Start-up Monitoring Module’, EMP for ‘Electromagnetic Pump’, HX for ‘Heat Exchanger’, HVAC for ‘Heating, Ventilation and Air Conditioning’, HRS for ‘Heat Removal System’).
Figure 1. IFMIF-DONES (International Fusion Material Irradiation Facility-DEMO Oriented NEutron Source) plant systems configuration (LEBT stands for ‘Low Energy Beam Transport’, RFQ for ‘Radiofrequency Quadrupoles’, MEBT for ‘Medium Energy Beam Transport’, SRF for ‘Superconducting Radiofrequency’, HEBT for ‘High Energy Beam Transport’, HFTM for ‘High Flux Test Module’, STUMM for ‘Start-up Monitoring Module’, EMP for ‘Electromagnetic Pump’, HX for ‘Heat Exchanger’, HVAC for ‘Heating, Ventilation and Air Conditioning’, HRS for ‘Heat Removal System’).
Safety 05 00074 g001
Figure 2. Radiation zones in the Main Building during operation at the accelerator plant level (Red color: prohibited access, >100 mSv/h; orange: restricted/special access, <100 mSv/h; yellow: restricted access, <1 mSv/h; green: controlled area/frequent access, <10 µSv/h; blue: supervised area/frequent access, <3 µSv/h. Threshold values are based on Spanish Regulatory Guide GS-07.06 and Directive 2013/59/EURATOM).
Figure 2. Radiation zones in the Main Building during operation at the accelerator plant level (Red color: prohibited access, >100 mSv/h; orange: restricted/special access, <100 mSv/h; yellow: restricted access, <1 mSv/h; green: controlled area/frequent access, <10 µSv/h; blue: supervised area/frequent access, <3 µSv/h. Threshold values are based on Spanish Regulatory Guide GS-07.06 and Directive 2013/59/EURATOM).
Safety 05 00074 g002
Figure 3. MELCOR models of Lithium Systems (top), Test Systems (middle) and Accelerator Systems (bottom) for deterministic analysis of Reference Accident Scenarios. FL stands for (MELCOR) ‘Flow Path’, CV for ‘Control Volume’ and HS for ‘Heat Structure’. Then, AC stands for ‘Access Cell’, TS-HCS-MP for ‘Test Systems-Helium Cooling System-Medium Pressure’, TS-HCS-LP for ‘Test Systems-Helium Cooling System-Low Pressure’, TS-GPS for ‘Test Systems-Gas Purification System’, TS-WCS for ‘Test Systems-Water Cooling System’, SS for ‘Stainless Steel’, BTR for ‘Beam Transport Room’, RIR for ‘Radiation Isolation Room’, TIR for ‘Target Interface Room’, TC for ‘Test Cell’, ECR for ‘Electron Cyclotron Resonance’, CCL for ‘Collimator Cooling Loop’, TTC for ‘Target and Test Cell’, BD for ‘Beam Duct’, TVC for ‘Target Vacuum Chamber’, QT for ‘Quench Tank’ (see also acronyms in Figure 1).
Figure 3. MELCOR models of Lithium Systems (top), Test Systems (middle) and Accelerator Systems (bottom) for deterministic analysis of Reference Accident Scenarios. FL stands for (MELCOR) ‘Flow Path’, CV for ‘Control Volume’ and HS for ‘Heat Structure’. Then, AC stands for ‘Access Cell’, TS-HCS-MP for ‘Test Systems-Helium Cooling System-Medium Pressure’, TS-HCS-LP for ‘Test Systems-Helium Cooling System-Low Pressure’, TS-GPS for ‘Test Systems-Gas Purification System’, TS-WCS for ‘Test Systems-Water Cooling System’, SS for ‘Stainless Steel’, BTR for ‘Beam Transport Room’, RIR for ‘Radiation Isolation Room’, TIR for ‘Target Interface Room’, TC for ‘Test Cell’, ECR for ‘Electron Cyclotron Resonance’, CCL for ‘Collimator Cooling Loop’, TTC for ‘Target and Test Cell’, BD for ‘Beam Duct’, TVC for ‘Target Vacuum Chamber’, QT for ‘Quench Tank’ (see also acronyms in Figure 1).
Safety 05 00074 g003aSafety 05 00074 g003b
Table 1. Chapters and sections of ‘Safety Instruction 26’.
Table 1. Chapters and sections of ‘Safety Instruction 26’.
General Objectives & RequirementsSitingDesign
General objectivesDefense in depthHuman factorsGeneral requirements for sitingBarriers in designDesign requirements for safety functionsInstrumentation & control
Organization & Management of SafetySafety Analysis. Safety StudyDose limits & dose restrictionsTracking of siting conditionsSafety functionsEnvironmental & seismic classifications
Quality AssuranceRisk AnalysisInner & outer emergencies Accident analysisExternal & internal events protection
Recording & reportsPeriodic Safety ReviewSecurity SIC classificationFire protection
Construction & OperationExplotationDecommissioning
Construction & assemblyPersonnelControl of effluent emissionsRadwasteDesing implications
OperationMaintenance, tests, inspectionsModifications Safety during shutdown & decommissioning
Operation specificationsOperative experience
Table 2. The present list of Reference Accident Scenarios.
Table 2. The present list of Reference Accident Scenarios.
Number of RASDescription
1Loss of flow in the Lithium Loop due to EMP trip
2Loss of heat sink for removal of heat loads from Li loop due to seizure of the Secondary Loop pump
3Loss of lithium in Lithium Loop Area due to large break at the electromagnetic pump outlet
4Loss of lithium in the TC due to large break in piping running inside the cell
5Loss of vacuum in Target Vacuum Chamber
6Loss of helium gas from HFTM cooling circuit inside TC
7Loss of flow in the TC-HCS-LP due to spurious valve closure
8Loss of helium gas from HFTM cooling circuit inside the cooling room hosting TS-HCS-LP equipment
9Loss of water flow in the TC-WCS due to spurious closure of isolation valve in the loop hot leg
10Loss of cooling water from TC-WCS circuit inside the room hosting the TC-WCS equipment
11Release towards the environment through TC exhaust due to spurious relief from TC-GICS
12Cooling water ingress in the accelerator beam duct
13Loss of vacuum in beam duct and air ingress
14Loss of D2 or H2 into the Accelerator Vault due to rupture of gas supply system
15Loss of vacuum in ion source due to containment rupture
16Leakage in Liquid Radioactive Waste Treatment Systems
17Degradation of Radioactive Gas Treatment Systems
18Dynamic confinement failure (HVAC failure)
Table 3. Dose objectives for the public and workers.
Table 3. Dose objectives for the public and workers.
DONES Project Criteria
CategoryEventFrequencyDose Objectives for the PublicDose Objectives for the Worker
INormal operation1/yearALARA, and in any case: <20 µSv/yearALARA, and: <5 mSv/year (max)<2 mSv/year (average)
IIIncidents10−2/year < f < 1/year<0.1 mSv/scenario5 mSv/scenario
IIIUnlikely Accidents10−4/year< f < 10−2/year<1 mSv/scenarioA radiation exposure 10 mSv/scenario < dose < 100 mSv/scenario, including management of the accident and post-accident situation
IVExtremely Unlikely Accidents10−6/year< f < 10−4/year<10 mSv/scenarioA radiation exposure ≥ 100 mSv, taking into account the management of the accident and post-accident situation
Table 4. Main DONES Safety Functions and Sub-functions.
Table 4. Main DONES Safety Functions and Sub-functions.
IdentifierDONES Safety Functions
S1Provide confinement of radioactivity
S1-1Provide process confinement barriers (first barrier)
S1-2Provide building confinement barriers, including systems for maintaining depression and filtering/detritiating effluents
S2Provide limitation to radioactive exposure
S2-1Shield to limit radioactive exposure
S2-2Provide access control in the operating area
S3Provide protection of systems for safe confinement and limiting exposure
S3-1Provide management of beam energy
S3-2Provide management of pressure/temperature
S3-3Provide management of chemical energy
S3-4Provide fire monitoring/mitigation
S3-5Provide features to prevent or to assure resistance to mechanical impact (including seismic, dropped load, etc.)
S3-6Provide management of mobilizable radionuclides in Normal Operation
S3-7Provide management of activated and contaminated streams
S4Provide supports for implementing safety functions
S4-1Provide auxiliaries essential for implementing safety functions (electrical power supply, compressed air, etc.)
S4-2Provide monitoring plant status: safety functions, radiation monitoring, etc.
S4-3Provide protection of systems important for safety (e.g., earthing, lightning, flooding, etc.)
S4-4Provide transport/lifting of radioactive components/materials
S4-5Provide support to operator intervention (lighting, communications, etc.)
Table 5. Provisional list of SIC-1 SSC. (Safety Functions mentioned in the table are coherent with Table 4).
Table 5. Provisional list of SIC-1 SSC. (Safety Functions mentioned in the table are coherent with Table 4).
ItemSystem, Structure or ComponentSafety Function
1Safety Beam Shutdown SystemS3
2Beam Duct Fast Isolation ValveS3
3Test Cell shieldingsS2-1
4Test Cell liner/Lithium Loop Cell linerS1-1
5Structures for neutron & gamma shielding:Walls, floors, roofs, doors & penetrationsS2-1
6Personnel Access Safety SystemS2-2
7Service Gas System (I):
  • Argon gas for Li loop area
  • Helium gas for TC area
S3-4
8Service Gas System (II):
  • Compressed air for SIC-1 actuators
S4-1
9Nuclear HVAC:
  • HVAC outlet
  • Outlet HVAC filter
S3-7
10Electric Power System for SIC-1 componentsS4-1
11Vent Gas Detritiation System—Stage 1 (VDS-1)S3-6
12Emergency Detritiation System (EDS)S3-7
13Stack release monitoring system (RAMSES)S1-2
14Tritium detectors in rooms connected to EDS (RAMSES)S1-2
Back to TopTop