Safety and Environment Thrusts - Extension of the Fusion Safety Standard and

1. ReNeWS HFP Theme Workshop, 2-4 March 2009, UCLA Harnessing Fusion Power: Safety and Environment Thrusts - Extension of the Fusion Safety Standard and Design IntegrationThrough Safety Phil Sharpe, Lee Cadwallader - INL

2. Extension of the Fusion Safety Standard As designs progress for next-step fusion facilities and DEMO power plants, evaluation of and improvement to the safety basis should occur to satisfy requirements established US Fusion Safety Standard (FSS): • DOE-STD-6002-96, “Safety of Magnetic Fusion Facilities: Volume 1: Requirements” • DOE-STD-6003-96, “Safety of Magnetic Fusion Facilities: Volume 2: Guidance” • DOE-HDBK-6004-99,”Supplementary Guidance and Design Experience for the Fusion Safety Standards” Historical perspective - the safety basis of ITER was established under these requirements, and are presently under review by the French regulatory authority.

3. High level requirements in FSS stem from DOE policy: • The public shall be protected such that no individual bears significant additional risk to health and safety from operation of those facilities above the risks to which members of the general population are normally exposed. • Fusion facility workers shall be protected such that the risks to which they are exposed at a fusion facility are no greater than those to which they would be exposed at a comparable industrial facility. • Risks both to the public and the workers shall be maintained as low as reasonably achievable (ALARA). Two additional requirements were developed aside from DOE policy: • The need for an off-site evacuation plan shall be avoided. • Wastes, especially high level radioactive wastes, shall be minimized.

4. Functional Safety Requirements: The FSS purposely describes a series of Functional Safety Requirements, i.e. they tell what must be done but not how they are to be accomplished. Fusion is not a mature technology compared to other nuclear technologies, and flexibility in this non-prescriptive safety approach allows innovation without overly constraining the technology as is develops. The requirements (Vol. 1) establish from a regulatory perspective the design and operational envelopes with respect to: • radiological dose limits • key safety functions (confinement and defense in depth) • establishing the safety design basis • safety assessment process (tools, V&V, QA, C&S, etc.) • operational basis (authorization, config. mgmt, conduct of ops, etc.)

5. Where are the scientific challenges? Primarily in the safety assessment and V&V processes… • Developing/modifying systems analysis tools with proper level of details for expected physical phenomena in off-normal and accident events (e.g. MELCOR-Fusion, RELAP5-3D, MAGARC…) • Performance of single-effects tests and experiments providing the database of materials responses for the analysis tools (e.g. chemical reactivity, oxide volatilization for LOVA, tritium mobilization, etc.) • Performance of integrated effects testing(dust and hydrogen explosibility, functionality of passive safety systems, magnet/busbar arcing etc.) These items require a sufficiently mature design to allow focus on the relevant materials and interactions - Safety assessment follows design,and provides feedback through safety integration.

6. Systems analysis tools for ITER (example) MELCOR simulations for postulated accidents events

7. Single effects tests for ITER (example) Be-steam reactivity measurements of H2 generation

8. Integrated effects testing for ITER (example) EVITA Thermal fluids benchmarking experiment • Physical phenomena for validation: • Pressurization in a vacuum vessel at low initial pressure during an ingress of coolant • Critical flow through a breach at break of piping • Condensation of vapor in a vacuum vessel pressure suppression system • Formation of ice on a cryogenic structure • Heat transfer and fluid flow characteristics under transient events in ITER Model Comparison to Test Results

9. What are the opportunities? • Scientific opportunities are defined as design concepts are selected for pursuit by the national program. Schedule is driven by progress of design selections. • Crosscutting activities occur primarily with technology aspects (tritium plant, PFC, blanket, etc.), however some physics aspects will be involved, e.g. physics basis of a safety-rated fast plasma shutdown system. Safety function integration in design ensures limitations are encountered sooner than later in the design cycle. • The FSS should be extended in application to these next-step devices or DEMO/plant designs, and an updated version of Vol. 2 would be released. This version may serve as the safety basis for detailed facility design. • FSS Vol. 2 guidance directs level of demonstration needed for separate and integrated effects testing; determines what phenomena must be verified based on consequence in design basis. Tests to be performed as design progresses.

10. What are the opportunities? (cont.) Although ITER is being licensed in France as an experimental nuclear facility (similar to reprocessing facilities), the US is the only nation with an established Fusion Safety Standard. No other nation as yet has fusion-specific regulations. As more countries begin pursuit of fusion power, strong motivation exists to develop an authoritative International Fusion Safety Framework* to ensure consistency in the safety approach. The future of fusion depends on safe, responsible operation of ALL fusion facilities worldwide. The US should leverage its experience and seize the opportunity to lead development of an international fusion safety framework in coordination with the International Atomic Energy Agency (IAEA). * - the term ‘framework’ is specifically applied here to indicate an evolving set of requirements, only to become a ‘standard’ after applying the IAEA protocol

11. Design Integration Through Safety - A key element of implementing the safety basis Although design leads safety, experience with ITER has shown that early implementation of safety features into the design is key to moving towards building and operating a particular design within regulatory constraints. The basic process of safety design integration was safety professionals learning about the system designs: reading design reports and attending system design meetings. This allowed the safety personnel to become familiar with each system design and facilitated working with the design personnel. Safety personnel would require information from the design teams and would help evaluate design alternatives, or would offer design suggestions to the system design teams.

12. Design Integration Through Safety, cont. An important design integration issues for ITER was selection of the VV as the first confinement boundary: • The VV met the low failure rate criteria with robust construction and double-walls that confined tritium, neutron activated materials, and chemically toxic materials. • Unfortunately, there were many VV penetrations that are necessary to operate the tokamak. • The integration challenge was determining the boundary perimeter for these penetrations. The designers required many vacuum vessel interfaces to the vacuum pumping system, the radiofrequency plasma heating systems, the fueling system, the diagnostics and their ports, penetrations for cooling system piping, and the maintenance access ports with port plugs. • All of these systems extended the VV strong barrier boundary, so safety personnel became familiar with each of the systems that penetrated the strong barrier thus forming a natural bypass of the strong barrier. • Ensuring a robust first strong barrier, thought circuitous through the ITER building, must be understood and preserved by design. This issue is not unique to ITER, but all fusion nuclear facilities must define and maintain the first confinement boundary.

13. Design Integration Through Safety, cont. An second issue for ITER safety in design integration was consideration of spatial positioning of equipment of ‘plant layout’: • An example is loss-of-coolant accidents (LOCAs) in the tokamak building and where the leakage water would pool after release from the tokamak cooling water system. • This water had the possibility of creating steam damage or submergence flooding damage to other equipment in a room so that a LOCA in one cooling loop could result in loss-of-flow accidents to other parts of the tokamak. • The ITER design was altered to provide distance between equipment to reduce the likelihood of LOCA water causing any additional impacts to ITER.

14. Summary • Extension of the US Fusion Safety Standard to next-step devices and DEMO plant conceptual designs; lead an effort towards an international fusion safety framework • Enhance design integration through safety in maturing designs of next-step devices and DEMO/plants Safety assessment follows design,and provides feedbackthrough safety integration.