Rodolfo Avila Facilia, Sweden

1. Workshop on the Application of the IAEA Methodology and Safety Assessment Framework (SAFRAN) Tool for the Safety Case (SC) and Safety Assessment (SA) for Predisposal Management of Disused Sealed Radioactive Sources (DSRS)Athens, GREECE 23-27 June 2014 Rodolfo Avila Facilia, Sweden Definition, Role and Documentationof the Safety Case

2. Outline of the Presentation • Preamble • Overview of Safety Case • Specific issues • Evolution of the safety case; • Graded approach; • Defense in depth; • Reliability; • Expected lifetime of the facility; • Long term storage; • Summary and conclusions.

3. PREAMBLE 3

4. Definition of safety • Safety is the state of being "safe" (from French sauf), the condition of being protected against physical, social, occupational, or other types or consequences of failure, damage, error, accidents or any other event which could be considered non-desirable. • Safety can also be defined to be the control of recognized hazards to achieve an acceptable level of risk. • It is important to realize that safety is relative. Eliminating all risk, if even possible, would be extremely difficult and very expensive. A safe situation is one where risks of injury or property damage are low and manageable.

5. Types of safety • Normative safety is when a product or design meets applicable design standards and protection. • Substantive safety or objective safety occurs when the real-world safety history is favorable, whether or not standards are met. • Perceived safety or subjective safety refers to the level of comfort of users. Low perceived safety can have costs. For example, after the 9/11/2001 attacks, many people chose to drive rather than fly, despite the fact that, even counting terrorist attacks, flying is safer than driving.

6. What is a Safety Case? • The collection of arguments and evidence, including the outcome of safety assessment, in support of the safety of a facility or activity • The basis for the safety considerations in respect of sitting and locating facilities, construction, operation and decommissioning of the facility, including the justification for changes • The basis for interaction and dialogue between the operating organization and the regulatory body 6 6

7. IAEA Requirements for Safety Case and Safety Assessment • GSR Part 5, GSG-3: Safety Case • A collection of arguments and evidence in support of the safety of a facility or activity. This will normally include the findings of a safety assessment and a statement of confidence in these findings. • GSR Part 4 , GSG-3: Safety Assessment 1. Assessment of all aspects of a practice that are relevant to protection and safety; includes sitting, design & operation of the facility. This normally includes risk assessment and probabilistic SA. 2. Analysis to predict the performance of an overall system and its impact, where the performance measure is the radiological impact or some other global measure of the impact on safety.

8. 1. Government responsibilities2. National Policy & Strategy 3. Regulatory Responsibilities 4. Operator Responsibilities 5. Safety/Security 6. Interdependences 7. Management systems 8. Waste minimization 9. Characterization and classification 10. Waste treatment 11. Waste storage 12. Waste acceptance for processing, storage and/or disposal 13. Prepare safety case and supporting safety assessment 14. Safety case scope and regulatory compliance 15. Safety case documentation 16. Periodic safety review 17. Facilities location and design 18. Facility construction and commissioning 19. Facilities operation, maintenance, emergency preparedness 20. Decommissioning 21. Nuclear safeguards 22. Existing facilities GSR Part 5, Safety Requirements for Predisposal Management of RW • Introduction • Protection of Human Health & Environment • Responsibilities • Steps in the Predisposal Management of RW • Development and Operation of RWM Facilities & Activities 8

9. Safety requirements for SA and SC The safety case (SC) shall: Include a description of how all the safety aspects of the site, the design, operation, shutdown and decommissioning of the facility, and the managerial controls satisfy the regulatory requirements Demonstrate the level of protection provided and shall provide assurance to the regulatory body that safety requirements will be met Include arguments justifying the approaches taken in the safety case on the basis of information that is traceable Document the arguments at a level of detail and to a quality sufficient to demonstrate safety 9

10. GSG-3: Safety Guide for SC and SA A. Safety Case Context B. Safety Case Strategy C. System Description Stakeholder and Regulatory Involvement Application of Management System D. Safety Assessment E. Iteration and Design Optimization F. Management of Uncertainty G. Limits, Controls and Conditions H. Integration of Safety Arguments 10

11. GSG-3: Safety Guide for SC and SA Introduction Demonstrating the Safety of RW Management Objectives and Development of the Safety Case Safety Assessment Specific Issues Evolution of the SC Graded Approach Defence in Depth Reliability Expected Facility Lifetime Long Term Storage Documention and Use of the Safety Case Regulatory Review Process 11

12. Preparation and review of SC and SA Systematic methodology Supports appropriate waste management decisions Demonstrate compliance with applicable safety requirements and criteria for the lifecycle of the facility Ensure confidence in the safety of the facility or activity Guidance on SC and SA (GSG-3) 12

13. Specific issues (GSG-3) Evolution of SC Graded approach Defence in depth Reliability Expected facility lifetime and activity duration Long term storage 13

14. OVERVIEW OF THE SAFETY CASE 14

15. Purpose of safety case Demonstrate that all planned activities can be carried out in a safe manner The SC concept will be of particular importance for large predisposal waste management facilities such as national centres for the processing and storage of radioactive waste. Provide guidance for the design, engineering and planning of operations to ensure safety Input to regulatory process, including evidence of compliance and arguments for confidence building 15 International Course on Management of Waste, Clausthal-Zellerfeld, Germany, 6-15 October 2010

16. Objectives and Roles of SC and SA (GSG-3) Integrating scientific and other information Demonstrating safety (incl. uncertainties) Demonstrating compatibilities with next waste management steps (e.g. disposal) Aiding decision making on the authorisation/ licensing of the facilities Other information and arguments that support continued development, use or eventual decommissioning of the facility 16

17. Development and content of SC and SA Some countries do not use the term SC in a formal way, but the approaches and processes to demonstrate safety similar The operator shall prepare a safety case and a supporting safety assessment. In the event of a step by step development or in the event of the modification of the facility or activity, the SC and its supporting SA shall be reviewed and updated as necessary. Regulatory body is responsible to derive and document in a clear and unambiguous manner the criteria on which the regulatory decision making process is based 17

18. Safety Case content Waste types and the rationale for the chosen/proposed waste management options Facilities and the site, based on traceable information Managerial and regulatory controls over the facilities Plans regarding the development, operation and shutdown and decommissioning of the facilities Safety assessment (SA) Other information and arguments supporting the development, use or decommissioning of a facility 18

19. Scope of the safety case for predisposal Relevant facilities / activities: Processing of radioactive waste Clearance and Discharges Storage facilities Transport Intervention situations (e.g. old storage facilities) All types of wastes low level to high level waste disused sealed sources NORM 19 International Course on Management of Waste, Clausthal-Zellerfeld, Germany, 6-15 October 2010

20. SPECIFIC ISSUES:- Evolution of the safety case- Graded approach- Defense in depth- Reliability- Expected lifetime of the facility- Long term storage 20

21. Introduction During facility lifecycle, the safety case will evolve in five main stages: • Concept and siting; • Design; • Construction and commissioning; • Operation and modifications; • Shutdown and decommissioning. 21

22. Concept and sitting The first step in the pre-operational phase addresses concept and design development; At this stage it will not be possible to provide a detailed description and assessment of the facility or activity; However, key aspects related to the safety strategy and to the description of the design concept have to be addressed; 22

23. Concept and sitting (cont.) The output of the safety case at this stage of development is justification that the facility or activity should, in principle, be undertaken and that it appears safe to do so. 23

24. Concept and sitting (cont.) • The safety case for this step should present the safety strategy and the way it will be met: • In the absence of any quantitative demonstration, qualitative justifications have to be provided; • Safety case should address the design concept and explain how the characteristics and properties of each component of the system are intended to provide for the allocated safety functions and how this will evolve with time; 24

25. Concept and sitting (cont.) This should be supported by: • An overview of the technical feasibility of the proposed design options, identifying aspects that rely on already proven techniques and those that are new and need future confirmation through experimental tests; • An overview of the level of knowledge on the ability of each component of the system to fulfil its expected role under anticipated conditions and accounting for the possibility of key perturbations that have already been identified; • An assessment how the components of the system will function together in a complementary manner to ensure that there is adequate defense in depth and that safety is not unduly dependant on a single safety function. 25

26. Concept and sitting (cont.) • Radiological impact assessments can only be very preliminary at the conceptualization step; • Nevertheless, it is desirable to carry out such preliminary assessment: • to provide a broad order of magnitude estimate of possible impacts, based on generic considerations of site performances; • to begin to identify the features of the facility and environment that are likely to be important to safety. 26

27. Concept and sitting (cont.) • Siting should consider the affect the facility or activity will have on: • Other activities on the site; • On any neighboring populations. • Consideration needs to be given to: • Effects of other activities or facilities on the proposed facility or activity; • Management, predisposal, discharges or clearance of any wastes generated. 27

28. Concept and sitting (cont.) • The safety case should also contain information about the management systems: • Organizational structure; • Required resources to undertake the project; • Programme for the project planning; • Information management system. • It is also necessary to develop and implement plans for regulatory and stakeholder dialogue. 28

29. Design • During the design development and construction, the safety case will be further developed to provide a mature assessment of the engineering and of the impact of the facility or activity; • The safety case should demonstrate that: • Likelihood of a component of the system failing is low, • In the event of degradation, the loss of a safety function of one component does not jeopardize the safety of the whole system. 29

30. Design (cont.) The output of design stage of the safety case development is justification that the facility or activity, as designed, can be safely constructed and operated. 30

31. Design (cont.) The design of any waste management facility should consider that the facility eventually will be shutdown and decommissioned. From the very earliest stage of the safety case development decommissioning must be addressed to justify its safety. The justification should be based upon techniques that are currently available and commensurate with the level of resources likely to be available at the time of closure. 31

32. Construction and commissioning • During commissioning, specific attention should be paid to the performance of structures, systems and components important to safety. • A safety commissioning schedule should be prepared, detailing: • Test to be undertaken, • Results expected to ensure, that all aspects of the facility important to safety are adequately tested. 32

33. Construction and commissioning (cont.) The safety case at this stage should demonstrate that the as constructed facility meets the safety requirements specified in the final design. This should include the impact of any modifications to the design, which have been implemented during the construction stage. 33

34. Construction and commissioning (cont.) • It is possible that separate safety cases and safety commissioning schedules will be required for in-active and active commissioning: • The aim of the in-active commissioning safety case is to justify that the as built facility is safe to operate; • The aim of the active commissioning safety case is to justify the safety of the facility to accept radioactive material. 34

35. Construction and commissioning (cont.) The safety case should update information about the management system with emphasis on: • Organization and procedures that are in place to assure the quality of the work performed, • Linkage of designs to the outcome of research and development activities and safety assessment work, • Keeping of records on the basis for design or operational decisions, • Design basis information including information on design modifications, • The expertise available to carry out tests and operate the facility or activity. 35

36. Operation Any significant differences between the actual and predicted performance of the facility or activity should be identified and the reasons investigated. All discrepancies should be justified. If there are safety implications, then a re-examination of the related structures, systems and components important to safety should be carried out. 36

37. Operation (cont.) The aim of the operational safety case is to justify that the facility can be operated safely for a specific period and can then be safely decommissioned. 37

38. Operation (cont.) The safety case should update information about the management system with particular emphasis on: • Organization and procedures that are in place to assure the safety of operations, • Record keeping and tracking system covering data, information and the records of decision, • That there is sufficient expertise to operate the facility or activity, • Interdependencies. 38

39. Operation (cont.) During the operational life of a facility there may be a need to modify some aspect. Where the modifications have a potential impact on safety, an appropriate safety assessment should be conducted or the current assessment updated before implementation of modification to assure continuing compliance with established safety requirements. 39

40. Operation (cont.) There may be time dependent processes and events both internal and external, which will eventually modify certain assumptions, parameters and boundary conditions; Processes and events may be gradual or may occur at unpredictable times; Operational safety case should be reviewed periodically in order to detect significant changes to the underlying assumptions, parameters and boundary conditions. If necessary, the safety case should be revised accordingly. 40

41. Operation (cont.) • Periodic review should be mandatory at periods determined by the regulatory body; • Periodic safety reviews may also be required to justify: • Life extension of the facility beyond its original design life, • Changes in the ownership or management of a facility, • Changes in regulations. 41

42. Operation (cont.) The updating of the safety assessment should take account of operating experience including data relating to anticipated operational occurrences, accident conditions and accident precursors both from: • Facility or activity itself, • Other similar facilities or activities. 42

43. Operation (cont.) The safety case should justify that the facility can be safely decommissioned; • Where a treatment facility is developed for all decommissioning waste then it should be recognized that the treatment facility will also generate decommissioning waste that will need some sort of treatment facility. 43

44. SPECIFIC ISSUES:- Evolution of the safety case- Graded approach- Defense in depth- Reliability- Expected lifetime of the facility- Long term storage 44

45. Introduction Predisposal waste management includes a wide range of facilities or activities, and characteristics of waste processed, which may pose different degrees of hazard and risk; A graded approach to safety assessment should be used, therefore, which recognizes these different levels of hazard and risk. 45

46. Graded approach The scope and level of detail of the safety assessment carried out for any particular facility or activity shall be consistent with the magnitude of the possible radiation risks arising from the facility or activity. It could be expected that greater levels of effort should be put into developing safety cases and safety assessments for a large treatment facility than for a small low-level waste storage facility. 46

47. Graded approach: Criteria • When undertaking a safety assessment, it is necessary to ensure that: • Assessment is based on an appropriate level of understanding of the system and its potential behavior, • All safety relevant issues are considered and addressed. • The degree of detail required in the safety assessments should be determined by first undertaking relatively simple safety assessments that provide an indication of the potential levels of risk. 47

48. Graded approach: Criteria (cont.) • Various criteria may be used to help in determining the level of understanding that should be expected for a particular facility or activity; • Criteria may be: • Safety significance, • Complexity, • Maturity. 48

49. Safety significance • Safety significance will usually be the most important criterion; • Use of this criterion will necessitate consideration of facility or activity performance in terms of: • Releases from normal operation, • Potential consequences of anticipated operational occurrences and reasonably foreseeable accidents, • Potential significance of low probability events with potentially high consequences. 49

50. Complexity A complex facility or activity might suggest the need for a correspondingly complex representation of the design in safety assessment: • Development of a safety case for a comparatively simple waste management facility such as a storage facility in a hospital may require only a few weeks of time and may be conducted using a checklist approach. • Development of a safety case for a large centralized waste processing facility may require a large team with several different specializations and require several years of work. 50