Technical safety objectives for research reactors

Technical safety objectives have to be developed for any research reactor with reference to the three main safety functions that also need to be ensured for external event scenarios [1]:

(1) Reactivity control during and after the external event² allowing, either automatically or through operator action, the power of the research reactor to be reduced to a sufficiently low level to maintain a suitable margin to deal with later events or an evolution in the emergency.

Redundancy and diversity in the reactor reactivity control system should be demonstrated.

(2) Cooling of radioactive material after the external event should also be possible with dedicated and reliable systems when necessary, though often for research reactors natural convection or heat accumulation in the coolant is sufficient. Whenever needed, redundancy of devices for estab-lishing the natural convection should be considered.

(3) Confinement of radioactive material and protection of workers, the public and the environment against irradiation should be provided within prescribed limits.

For each selected postulated initiating event, a list of safety related structures, systems and components needs to be developed and safety require-ments for these items established. Spatial and other possibilities of interaction between items have to be examined since an external event can alter the

2 The analysis should consider the duration of the event and the time needed to return to a normal situation. In case the facility is not started again, the total duration of the event corresponds to the time needed to come to a new, stable and sustainable situ-ation. The safety analysis should also consider this scenario.

behaviour of a great number of items simultaneously.³ In particular, external events could induce chemical or biological hazards that might result in conse-quences for safety such as reductions in personnel availability, limitations on transportation and restriction of access.

Table 1 illustrates some of the challenges posed by different external events to the basic safety functions of a research reactor. A special column (the sixth) highlights the need for additional protection features against beyond design basis events when the development of the external event can induce cliff edge effects in the response of the facility.

The technical safety objectives aim at preventing accidents in research reactors and mitigating their consequences if they occur. It is necessary to show that any radiological consequence would be below prescribed limits, with a high level of confidence and for all design basis accidents. For research reactors this means the following:

(1) Shutting down the reactor when it is subjected to an extreme external event (reactivity control) and maintaining the reactor in a safe shutdown condition;

(2) Removal of residual heat over an extended period of time (cooling of radioactive material);

(3) Preventing radioactive releases or maintaining releases below the limits established for accident conditions (confinement);

(4) Avoiding any failure of structures, systems or components which could directly or indirectly cause accident conditions as a consequence of an external event, particularly with respect to reactivity control, cooling of radioactive material and confinement;

(5) Monitoring of the critical reactor parameters during and after an external event, in particular the reactivity;

(6) Monitoring the radiological dispersion parameters;

(7) Guaranteeing access and evacuation to the operating personnel in charge of the above functions (e.g. ventilation in the control room), communi-cation (both among personnel and with the outside world), and alarm (for implementation of the emergency measures, both on-site and off-site).

3 For example: (1) operator access to safety systems may be impaired by difficult conditions at the site, e.g. heavy snow, flood; and (2) internal flooding can originate as a result of leakage from or failure of fluid storage tanks, including non-safety-related tanks.

TABLE 1. SAFETY FUNCTIONS AND EXTERNAL EVENTS

Can be excluded by site screening or hazard monitoring

Lightning (DB) () () ()^d Yes No

Forest fire (P) (Y/N) ^c () ()^d Yes No

(P): The possibility of a screening criterion based on probabilistic evaluations.

(D): The possibility of a screening criterion based on deterministic evaluations (distance, etc.).

(Y/N): The event may be included or not in the design basis, according to the site evaluation.

(DB): The event is usually included in the design basis, at least with a minimum deterministic value, also to envelope effects from other sources not explicitly evaluated.

: The function is directly challenged.

(): The function is only indirectly challenged.

x: The function is usually not directly affected (only in case of building collapse or loss of containment).

a Common mode on a wide area usually indicates possible loss of site infrastructures such as power distribution, communication, water cooling, lubrication, remote surveillance. Therefore common mode failure could greatly impact defence in depth, also through the possibility of implementation of the emergency plan.

b In some external scenarios, the development of the consequences for the facility is not proportional to the growth of the load. In these cases a cliff edge effect is recorded, i.e. a sudden increase of the consequences as a result of a small increase of the causes. A typical example is the flooding scenario in a site protected by a dam, where as soon as the water is higher than the protection, the whole site is flooded to the maximum level.

c The reactor should be shut down prior to the extreme event if enough warning time is available. The combination of engineering features and operational/

administrative measures is discussed below.

d For example, loss of confinement through loss of power (lightning), or smoke plugging the filtration system (fire), or many others.

TABLE 1. SAFETY FUNCTIONS AND EXTERNAL EVENTS (cont.)

External event Reactivity