.jpg)
1. Introduction
The safety goal for a deep geological repository is to protect the general public and radiation workers from radioactivity through safety assessments [1]. The safety assessment of a repository is divided into two steps, before and after the closure of the repository, which are called the operational safety assessment [2-5] and the post-closure safety assessment [2, 6-9]. In Korea, studies on the post-closure safety assessment have been actively conducted, and many methods and results have been amassed. However, studies on the operational safety assessment have not been performed. The operational safety assessment determines the existence of hazards that may occur during the operation stage of a repository and develops measures to eliminate those hazards so that the general public and the environment are protected from such hazards.
An IAEA report states that all safety-related phenomena related to operational safety should be considered in development of the safety case [1]. The operational safety assessment assesses the safety of the repository for normal operation and anticipated accident conditions. Under both normal and accident conditions, internal and external exposure dose evaluations must be conducted for the protection of the public and radiation workers. Even in an accident situation, an exposure dose assessment need to be performed, and an emergency operation procedure established based on these results. Safety evaluations needs to be conducted for predictable accidents, such as drops, fires, and earthquakes that may occur during the operation of ground and underground facilities. The results of operational safety assessments can be used as basic data for decision making, for example, on supplying air to underground facilities, sealing disposal containers, positioning radiation dose measurements, and shielding. Therefore, the operational safety assessment is a part of the field of repository design, and the results can be used as an important tool in decision-making for the operation and design of a repository.
In this study, we used the probabilistic safety assessment method (PSA) [10] for the operational safety assessment that is widely used for the safety assessment of nuclear power plants. The first thing to do is to select accidents that may occur during the operation of a repository. Next, the institution should conduct a performance evaluation of safety systems using event tree and fault tree analysis methods, and select accident scenarios that cause leakage of radioactive material. Finally, an evaluation of exposure doses has to be made and the compliance with regulatory requirements checked. We established a procedure for these methods, determined the necessary evaluation tools, and confirmed their applicability through an example evaluation. We propose the CONPAS ET Editor for the event tree analyses and KwTree for the failure tree analyses which are components of the AIMS-PSA Manager [11], and the RSAC program [12] for estimating exposure doses to establish an operational safety assessment framework.
2. Method for the operational safety assessment
We propose a procedure for the operational safety assessment of a conceptual repository for the disposal of spent fuels, KRS+ (KAERI Reference Disposal System for SNFs) [13]. The procedure and flow of assessment are summarized in Fig. 1 [14]. The applicable areas of the results are also included. The collection of information collects basic data related to the repository such as site information, facility design and operation procedure, and characteristics of spent fuels. The site data includes meteorology, geology, and human activities around the site. The facility data refers to design details and operational procedures of a repository. In addition, characteristics of spent fuels that will be disposed of in a repository have to be collected. These data are collected in a database and used in detail operational safety assessment.
The procedures for operational safety assessment include selection of initiating events, event tree analysis and fault tree analysis, and exposure dose evaluation. An initiating event is an event that can influence the normal operation of a repository and may create the release of radioactive material to the environment, which can cause exposure doses to the public and radiation workers. Initiating events are selected by considering the characteristics of the site and facility through operational hazard analysis methods such as FMEA (Failure Mode and Effect Analysis) and HAZOP (HAZard and OPerability). The initiating events for the detailed analysis are usually selected by applying appropriate screening criteria.
The ETA (Event Tree Analysis) method is used for accident scenario analysis. We estimate the frequency of each accident scenario by considering the frequency of an initiating event and failure probabilities of each mitigating system. Failure probabilities of each mitigating system are estimated by the FTA (Fault Tree Analysis) method. We propose the CONPAS (CONtainment Performance Analysis System) ET Editor for ETA and KwTree (KIRAP window Tree) for FTA, which are included in the AIMS-PSA Manager [11]. In the AIMS-PSA Manager, analyses of a specific initiating event are based on the project explorer and integrated analyses of both the event tree and the fault tree. The example project explorer including ETA and FTA modules in the AIMS-PSA Manager, is shown in Fig. 2.
Finally, an exposure dose evaluation for each accident scenario developed by the ETA has to be made to check the regulatory compliance. In general, the exposure dose evaluation is conducted using a computer program that considers the relevant pathways and dose coefficients. We proposed the RSAC (Radiological Safety Analysis Computer Program) for exposure dose evaluation [12].
3. Operational Safety Assessment Framework
The operational safety assessment of a repository is usually carried out step by step. Based on the review of the general probabilistic safety evaluation procedures and methods, the following safety evaluation procedures were established.
-
a) Selection of initiating events: selection of initiating events for the analysis based on hazard analysis considering natural events and human error
-
b) Event sequence analysis: composition of scenarios for accident propagation through event tree analysis, probability evaluation through failure tree analysis, and selection of accident sequences that may cause the release of radioactive material to the environment
-
c) Exposure dose assessment: estimation of exposure doses for the public and radiation workers
3.1 Selection of initiating events
Selection of initiating events for the operational safety assessment of a repository is usually conducted by operational hazard analysis methods such as HAZOP, which was used in the operational safety assessment of YMP [2]. HAZOP is a systematic examination of the process or operation to identify and evaluate problems that may result in risks to personnel or equipment. Initiating events may stem from external events including natural phenomena or internal events resulting from mechanical or electromechanical equipment failure (e.g., crane failure) and human failure associated with the operations of the systems or components. The HAZOP analysis considers the parameters that apply to the design intent, a list of standard guide words (e.g., no, more, less, early, late, other than, etc.), postulated cause, and consequences. A typical part of the HAZOP evaluation for the YMP operational safety assessment is shown in Table 1 [2]. Among the list of internal initiating events for the operational safety assessment of the initial handling facility (IHF) of YMP, initiating events related to cranes are summarized in Table 2 to illustrate the initiating event [15]. Among the list of initiating events obtained through HAZOP analysis, initiating events for the detailed analysies can be selected by applying qualitative and quantitative screening criteria such as the possibility and frequency of the occurrence of initiating events.
Table 1
A typical part of HAZOP evaluation [15]
| Facility/Operation: Example facility | ||||
|
|
||||
| Node 1: Move Canister Transfer Machine (CTM) Laterally | ||||
|
|
||||
| Guide words: No, More, Less, Other Than | ||||
|
|
||||
| Node No. | Parameter | Deviation Considered | Postulated Cause | Consequences |
|
|
||||
| 1.1 | Speed (CTM) | (More) CTM moves faster than allowed | 1. Human failure
2. Mechanical failure |
Potential collision of canister |
| 1.2 | Speed (CTM) | (No) CTM stuck in middle of room | 1. Human failure
2. Mechanical failure |
Operations are interrupted |
| 1.3 | Speed (CTM) | (Less) CTM moves too slow | 1. Human failure
2. Mechanical failure |
Operations slowdown |
| 1.4 | Direction (CTM) | (Less) CTM does not move enough | 1. Human failure
2. Mechanical failure |
No safety consequence |
| 1.5 | Direction (CTM) | (Other Than) Bridge impacts and stops | 1. Human failure
2. Mechanical failure |
Potential collision of canister |
| 1.6 | Direction (CTM) | (Other Than) CTM moves wrong direction | 1. Human failure
2. Mechanical failure |
Potential collision of canister |
| 1.7 | Miscellaneous (CTMCrane) | (No) Crane malfunction | 1. Human failure
2. Mechanical failure |
Potential canisterdrop |
| 1.8 | Miscellaneous (CTMCrane) | (No) Two-blocking of CTM crane | 1. Human failure
2. Mechanical failure |
Potential canisterdrop |
Table 2
List of initiating events related to crane in IHF of YMP [15]
| Identifier | General initiating event description |
|---|---|
|
|
|
| IHF-401 | Cask preparation crane drops load onto transportation cask |
| IHF-403 | Cask preparation crane or cask handling crane failure causes cask impact |
| IHF-501 | Cask handling crane failure causes transportation cask drop |
| IHF-502 | Operation of cask handling crane cause unplanned conveyance movement and cask drop |
| IHF-503 | Unplanned conveyance movement while crane is attached to transportation cask or conveyance fixtures causes cask drop |
| IHF-504 | Cask handling crane drops object onto transportation cask |
| IHF-506 | Cask handling crane drops cask |
| IHF-701 | Operation of cask preparation crane leads to cask tip over |
| IHF-702 | Cask preparation crane drops object onto cask |
| IHF-705 | Cask preparation crane causes impact to side of cask |
| IHF-803 | Cask transfer trolley or cask catches crane hook or rigging during movement resulting in cask impact |
| IHF-1002 | Canister transfer machine crane drops waste package inner lid onto canister during placement |
| IHF-1202 | Waste package handling crane drops an object |
3.2 Event tree analysis tool
Event tree analysis is the process of logically uncovering all the major accidents that cause radioactive material leakage by constructing an event tree for a selected initiating event. The safety functions necessary to maintain the system under analysis for each initiating event need to be understood, and safety systems and operator actions that require operation are defined as the title of the event tree as a binary tree to form an accident scenario to logically construct possible accidents.
The safety functions required for the development of an event tree are selected, the systems necessary to maintain the selected safety function are identified, and this is defined as the event tree title. In addition, the success criteria and timing of the operation of each system according to the initiating event are determined. The order of the headings does not have a significant effect on the results, but it is very important in terms of efficient analysis and understanding of event propagation. The relationship between time, function and interrelationship between systems is a major consideration, and it is common to arrange the headings in the order of the possible operating time of the related lines. After determining the system, success criteria, and order of titles for each initiating event, derivation of all possible accidents for each initiating event according to the success or failure of these titles is to be made logically.
As a tool for event tree analyses, we propose the CONPAS ET Editor developed by KAERI. The CONPAS ET Editor has been widely used for the analysis of event trees in probabilistic safety assessment of nuclear power plants. It is an event tree editor that operates in a Windows environment. It has the advantages of multiple windows, selection using a mouse, and a command execution function using a menu, which are the advantages of Windows, so we can perform tasks conveniently. An example screen for CONPAS ET Editor is shown in Fig. 3, and the basic function is to input and modify the event tree [11].
3.3 Fault tree analysis tool
Fault tree analysis is a method that expresses all cases where the system to be analyzed becomes unavailable by using a logical figure. In other words, fault tree analysis is an analysis method that logically explains the cause of an event that causes a system malfunction. This method is an analysis technique that deductively unfolds the logic of malfunction of a system, which enables detailed analysis of complex systems, and has features such as quantitative analysis and visual expression. In addition, it can deal with complex factors such as human factors and common cause failures, which is different compared to failure mode and impact analysis.
It is desirable to apply the fault tree analysis from the early stage of design, if possible. In the absence of a detailed design of the system configuration, unfavorable events that result in malfunction of a system can be identified through fault tree analysis, and through this, a more secure and improved system can be designed in the detailed design stage. In order to evaluate the reliability of the modeled system when analyzing event trees, system analysis is performed using fault tree analysis techniques. A fault tree is a logical tree that is deductively plotted in a state in which the system is unable to perform the required function, that is, all cases in which it becomes unavailable, using AND, OR, or NOT logic gates.
As a tool for fault tree analysis, we propose KwTree, which was developed by KAERI. KwTree has been widely used for the analysis of fault trees in probabilistic safety assessment of nuclear power plants. It is a fault tree editor that works in the Windows environment. The basic function of KwTree is to input and correct the fault tree, display the fault tree on the screen in the same form as the output, and directly edit and modify the fault tree using multiple windows. The example screenshot of the fault tree analysis tool is shown in Fig. 4 [11].
3.4 Exposure dose assessment tool
During normal operation of a radioactive waste repository, exposure doses are generated by radioactive gases, volatile substances, or radioactive particles emitted from surface or subsurface facilities. The exposure doses from radioactive materials are assessed by dividing them into individual workers and the general public. In general, a worker exposure dose refers to the exposure dose received by an individual designated as a radiation worker, and all non-workers are regarded as the general public in the evaluation of the exposure dose. The exposure doses are generally evaluated as the sum of external and internal exposures, and is generally the total effective dose equivalent (TEDE). Among these, internal exposure is caused by breathing or consumption of contaminated food. External exposure includes direct exposure by radioactive plume, surface deposition or radioactive substances contained in the air.
RSAC (Radiological Safety Analysis Computer Program) code was selected for evaluating exposure doses to workers and the general public due to radioactive substances released into the atmosphere during an accident condition at a radioactive waste repository [12]. RSAC was developed by the Idaho National Engineering and Environmental Laboratory (INEEL) in the 1960s. RSAC-5 calculates the result of atmospheric release of radionuclides, the exposure dose, and the exposure dose when it spreads in the wind direction and radiation collapse in the path from the source to the environment. It is possible to calculate the internal exposure according to the breathing and ingestion pathway, and it can be applied up to 100 km by calculating the external exposure according to the gamma ray due to the movement of a radioactive plume. RSAC-5 can be easily installed and operated on a personal computer, but its disadvantage is that it works in a DOS window. Currently, the Windows version RSAC-7 is developed and used.
4. Example analysis
We selected a drop accident due to a crane failure during transportation by a crane to check the applicability of the established operational safety assessment system. For the construction of the event trees caused by a drop accident, we selected the HVAC (Heating, Ventilation and Air Conditioning) system and HEPA (High Efficiency Particulate Air Filter) as accident mitigation systems. The event trees were constructed considering the initiating events and the operation of these systems. The probability for each branch of event trees was evaluated using the fault tree analysis method.
The accident sequences were developed by considering hazards, initiating events, and failures of the mitigation system after the occurrence of the initiating event. The accident sequences assumed in this analysis were accident sequences due to a drop of a spent fuel assembly during transport from the mobile shelf, a fuel cladding breach, and function and malfunction of HVAC system and HEPA. The structured event trees and accident scenarios are shown in Fig. 5. The crane failure rate was assumed to be 5.6×10-5 based on the reference data [16], and the annual number of transportation of spent fuels was 12,000[10]. Using these data, the probability of annual drop accidents of a fuel assembly due to crane failure is 0.672.
The event sequences shown in Fig. 5 are as follows [14]:
-
• Sequence 1: does not cause any leakage of radioactive material due to no cladding breach
-
• Sequence 2: an accident sequence in which the fuel
-
cladding breach occurs, the primary HVAC system succeeds, the primary HEPA filter succeeds, and then noble gases releases
-
• Sequence 3: an accident sequence in which noble gases and particulates are released to the general public and external workers due to a fuel cladding breach and the failure of HEPA filter
-
• Sequence 4: an accident sequence in which noble gases and particulates are released due to fuel cladding breach and the failure of the primary HVAC system and HEPA filter
In the fault tree analysis, the HVAC system was assumed to consist of a normal exhaust fan and a redundant exhaust fan, and the HEPA filter was analyzed by assuming a system consisting of two filters A and B. The result of the fault tree analysis showed a probability of HVAC failure of 8.06×10-5, and the probability of HEPA filter failure was 1.20×10-5. The fault trees of the HVAC system and HEPA filter for the failure tree analysis are as shown in Fig. 6 [14].
The radioactive isotopes and inventories of a reference spent fuel assembly of the PWR plant selected for the assessment of the exposure dose for the accident sequences are summarized in Table 3 [13]. The radionuclides were classified as particulates, noble gas, CRUD, tritium, and iodine to estimate the source term released to the atmosphere. The exposure doses were calculated for accident sequence 3. The exposure dose to the general public was evaluated for accidents in which noble gas and particulates of radioactive materials were released due to damage of fuel cladding and failure of the primary HEPA filter after the primary HVAC system was successfully operated.
Table 3
Radionuclide inventory for a reference spent nuclear fuel (Ci/MTU)
| Radionuclide | Inventory | Nuclide Group | Radionuclide | Inventory | Nuclide Group |
|---|---|---|---|---|---|
|
|
|||||
| 3H | 6.22×102 | Tritium | 103mRh | 4.20×10-14 | Particulates |
| 54Mn | 8.05×10-3 | Particulates | 106Rh | 5.72×103 | Particulates |
| 55Fe | 1.70×100 | CRUD | 106Ru | 5.72×103 | Noble Gas |
| 58Co | 4.23×10-10 | CRUD | 123Sn | 7.10×10-4 | Particulates |
| 60Co | 6.07×101 | CRUD | 125Sb | 1.71×103 | Particulates |
| 85Kr | 7.45×103 | Noble Gas | 125mTe | 4.17×102 | Particulates |
| 89Sr | 4.92×10-10 | Particulates | 127Te | 1.36×10-3 | Particulates |
| 90Sr | 8.58×104 | Particulates | 129Te | 5.12×10-19 | Particulates |
| 90Y | 8.58×104 | Particulates | 129mTe | 7.99×10-19 | Particulates |
| 91Y | 7.73×10-8 | Particulates | 129I | 4.31×10-2 | Iodine |
| 95Zr | 1.52×10-6 | Particulates | 134Cs | 2.15×104 | Noble Gas |
| 95Nb | 3.34×10-6 | Particulates | 137Cs | 1.24×105 | Noble Gas |
| 103Ru | 4.21×10-14 | Particulates | |||
For the evaluation of the source term, the failure rate of fuel cladding was assumed to be 1 for conservative evaluation. In general, the value of the leak path factor is 1.0 for fuel cladding, 0.1 for transport or disposal containers, 1.0 for buildings, and 2.0×10-4 for HEPA filters [2]. However, for accident sequence 3, the value of the leak path factor for the HEPA filter is 1.0 because the operation of the HEPA filter has failed.
For the assessment of exposure dose, the site of the repository was assumed to be Wolseong. The average wind speed was estimated to be 2.87 m·sec-1 based on weather data for one year of the Wolseong site, and it was assumed that the emission was 1 m above the ground to obtain conservative results. Precipitation by rainfall was not considered. In addition, the atmospheric stability class was assumed to be neutral to obtain conservative results. The plume rise was not considered. The mixing layer height was assumed to be 400 m, and an air density of 1.099×103 g·m-3 was used [12]. The deposition velocity for evaluating the exposure dose by surface deposition was assumed to be 0.01 m·sec-1 for halogen elements and 0.001 m·sec-1 for the rest of the elements, and it was assumed that no deposition of noble gases occurred [2].
The results of the exposure doses due to the drop accident of a spent fuel assembly of PWR evaluated using the RSAC-5 code are summarized in Table 4. Internal exposure indicates the internal exposure dose by breathing. The external exposure is the sum of the external exposure dose by surface deposition, the external exposure dose by radioactive plume, and the external exposure dose by radioactive plume gamma rays. According to the results, the exposure dose to the general public due to the drop accident of a spent fuel assembly is mostly due to internal exposure by breathing. In this study, we evaluated the exposure dose as part of an example analysis for the established operational safety assessment framework to check its applicability. For detailed evaluation in the future, it will be necessary to obtain and use facility-specific detailed data.
Table 4
Exposure dose for the public as a function of distance
| Exposure dose distance(m) | Internal exposure(mSv) | External exposure(mSv) | Total(mSv) |
|---|---|---|---|
|
|
|||
| 200 | 8.09×10-1 | 5.40×10-4 | 8.09×10-1 |
| 300 | 5.09×10-1 | 2.64×10-4 | 5.09×10-1 |
| 500 | 2.09×10-1 | 1.08×10-4 | 2.09×10-1 |
| 700 | 1.16×10-1 | 6.04×10-5 | 1.16×10-1 |
| 1,000 | 6.29×10-2 | 3.27×10-5 | 6.29×10-2 |
| 2,000 | 1.99×10-2 | 1.04×10-5 | 1.99×10-2 |
5. Summary and Conclusion
The operational safety assessment assesses the safety of the facility during both normal operation and postulated accidents. It is an important factor in the development of a safety case for a deep geological repository for spent fuels. As an operational safety assessment method, we adopted a PSA method that has been widely used in the safety assessment of nuclear power plants. We established an operational safety assessment framework using an AIMS-PSA Manager and RSAC. We checked the applicability of the assessment framework by making an example analysis for a drop accident of a spent fuel assembly due to crane failure.
We found that the operational safety assessment framework established through this study will be a useful tool for the operational safety assessment of a repository for the disposal of spent fuels. It can also be used to improve the design of a spent fuel disposal facility such as KRS+ by performing importance analysis with the safety assessment results. In addition, the procedures and assessment framework for operational safety can be used to develop a safety case that is an essential part of the repository development program for the disposal of spent fuels.
