Integration of Safety in IFMIF-DONES Design

Abstract

The IFMIF-DONES (International Fusion Material Irradiation Facility-DEMO Oriented NEutron Source) facility is being designed with the general objective of providing irradiation of representative samples of power fusion machine materials under prototypical conditions. A linear accelerator will deliver deuterons at high intensity to circulating lithium in a loop, which will produce neutrons capable of obtaining the required damage conditions. As a result of this process, radionuclides will be produced as a by-product, which is characterized by several degrees of mobility. Shielding and radiation protection measures will be required in the facility. IFMIF-DONES will be classified as a first class radioactive facility according to national regulations, with Spain being the European candidate to site the facility. Several aspects of the main safety instructions affecting the facility’s design are explained and discussed in this paper.

1. Introduction

The IFMIF-DONES (International Fusion Material Irradiation Facility-DEMO Oriented NEutron Source) facility is being designed under the EUROFUSION/WPENS project. Its general objective is to provide an intense neutron source and representative irradiations of materials to be used in future fusion reactors.

DONES is presently the result of several initiatives across many years towards a neutron source based on deuterium-lithium stripping reactions, with changing specifications along several periods of design. The previous project directly benefiting present activities was IFMIF-EVEDA, as part of the Japan-Europe ‘Broader Approach’ agreement launched in 2007 to complement the ITER project and boost fusion research by means of dedicated projects. In the IFMIF-EVEDA project (IFMIF Engineering Validation and Engineering Design Activities), the building and operation of key IFMIF systems for demonstration of basic performances has been or is being achieved, while dedicated activities were also performed to progress the design of the whole facility.

After launching the present design activities under the EUROFUSION consortium workpackage in 2015, two recent important facts affect its activities. First, as a fundamental frame for safety, the Spanish candidature for building IFMIF-DONES in Europe has been endorsed by EUROFUSION. This point is important because it directly facilitates the national legislation for licensing and operating the facility as a singular radioactive installation. Secondly, the facility has been recently accepted as part of the ESFRI (European Strategy Forum for Research Infrastructures) scientific network.

Several aspects of the main safety regulations affecting the design are explained and discussed in this paper. Discussions are based on main assumptions, estimates, and other information included in internal reports of ongoing WPENS works, not all of which are publicly available. Also, they are subjected to recalculations as design features are updated. In any case, the facility design is more stable at this stage of the project and it is expected that many estimates will only change in relatively small ranges.

2. IFMIF-DONES Facility Description

The facility is made of five main systems, shown in Figure 1 and briefly explained below with possible emphasis on safety aspects. IFMIF-DONES will be a complex first-in-a-kind facility and a full description would require much additional description here. Therefore, additional important information can be found in other references, such as reference [1] and reference [2].

• Accelerator Systems (AS) will provide an intense 125 mA deuteron beam of 40 MeV by means of a linear accelerator. Deuteron particles are generated in the injector area and they are boosted by means of non-superconducting and superconducting cavities, connected to radiofrequency tubes. Some scrapers and magnets will drive and trim the beam at lower and intermediate energy regions. A long section in the high energy region of the beam is provided with additional magnets and a collimator to drive the beam, and a beam dump for occasional operation. Ancillaries systems are designed for cooling some components and to provide vacuum conditions along the tube. Isolation valves are also provided in several points of the beam duct.
• Lithium Systems (LS) is in essence a liquid lithium loop of more than 8 m³ receiving the deuterons in a free surface area, with no window material, producing neutrons above 40 MeV through nuclear reactions. The Target Assembly (TA) is the component in the loop where deuteron-lithium reactions occur. The high velocity circulating lithium removes 5 MW thermal energy in the TA, and is stopped in a Quench Tank. The lithium then transports the heat to a secondary loop by means of a lithium-oil Heat Exchanger.
• Test Systems (TS) include a specific container called High Flux Test Module (HFTM), housing the samples to be irradiated with neutrons, very close to the Target Assembly. In addition, Test Systems are formed by the Test Cell (TC) room enclosure housing the module itself and the TA where the deuteron beam impacts. The Test Cell consists of a monolith wall of several meters thickness working as a neutron and gamma shield, internally tightened with a steel liner of 8 mm thickness. At the TC top there are removable upper shielding blocks and a cover plate. Test Systems are completed with ancillary systems that provide cooling of HFTM and a walls monolith; they also maintain a He inert gas TC atmosphere and provide purification.
• Building and Plant Systems (BPS) is the ensemble of a large number of ancillary and supporting systems necessary to develop the main function of the facility. They include the Main Building itself with radiological confinement functions and systems with a significant role in the safe operation of the facility: Heating, a Ventilation and Air Conditioning System, Service Gas System (to provide inerting atmospheres), Vent Detritiation System and Fire Protection System, among others.
• The Central Instrumentation and Control Systems (CICS) is organized in three subsystems, one of them being the Safety Control System. A Machine Protection System for investment protection, and a CODAC (Control, Data Access and Communications) control system for supervision under normal operation are also part of CICS.

3. Radiological Material at Risk and Radiation Sources

As a result of local high values of deuteron and neutron fluxes, IFMIF-DONES is expected to produce a moderate amount of radioactive inventory, as explained in next paragraphs.

Deuteron particles will impinge on the flowing lithium, which also transports some corrosion impurities, then produces activation products in the lithium stream. The secondary but also intense neutron source occurrence in the same region will produce additional activation products.

The provision of the radionuclide required data necessitates the availability of dedicated computational tools to model the plant with the relevant components/systems in sufficient detail, simulate the transport of deuterons, neutrons, and photons in the AS, the Li target and the TC cell down to the neighboring rooms, assess the activation of all materials/components subjected to the radiation, and predict the resulting radiation dose fields. Suitable computational tools, based on the Monte Carlo transport technique and the coupling to nuclide inventory calculations, were developed to cope with such demands. These include specific tools and data developed for IFMIF-DONES over a couple of years as well as tools and data available from other nuclear application areas.

For deuteron transport simulations in the accelerator area of IFIMF-DONES, the MCUNED computer code [3] has been developed by Universidad Nacional de Educación a Distancia (UNED), Madrid. MCUNED is as an extension to the MCNPX Monte Carlo code [4] with the capability of handling charged particle transport, in particular light ions such as deuterons, based on cross-section data provided on nuclear data files such as TENDL [5]. MCUNED is thus well suited to simulate the deuteron transport in the accelerator and provide the neutron and photon production as result of the interaction of deuterons with beam guides, scrapers, etc., or the beam dump. MCUNED has been extensively benchmarked and applied for design analyses of the IFMIF accelerator and is the standard code for such applications in DONES design. In particular, it is used to produce the neutron and gamma sources which results from deuteron interactions with accelerator materials in DONES. The McDeLicious Monte Carlo code [6,7] has been developed by KIT, Karlsruhe, specifically for application to IFMIF (and later DONES). McDeLicious is an extension to the LANL Monte Carlo code MCNP [8,9] with the capability to simulate the generation of (d, Li) source neutrons (and photons) based on the use of evaluated d + ^6,7Li cross-sections [10,11]. McDeLicious has been thoroughly benchmarked and validated against thin and thick Li target neutron yield measurements [7,11] for the Li (d, xn) cross-section at 40 MeV incident deuteron energy and thick Li target neutron yield data as a function of the deuteron energy.

The Fusion Evaluated Nuclear Data Library (FENDL) with the current version 3.1 d, is the reference data library for IFMIF-DONES. FENDL is provided by the IAEA to satisfy the needs both for fusion technology and IFMIF-type applications. Thus, the libraries cover the energy range above 20 MeV neutron energy. The FENDL-3.0/A neutron activation data library, identical to the European Activation File EAF-2010 is the current reference for activation calculations.

The simulation models used in the Monte Carlo calculations with MCNP, McDeLicious or MCUNED need to be consistent with the engineering CAD models prepared for DONES. This requires a suitable translation of the CAD models into the geometry representation used by Monte Carlo codes. To this end, the ENS project utilizes the McCad approach developed by KIT, Karlsruhe.

The main results of computational models are that an annual production of 3.9 g (1.3 × 10¹⁵ Bq) of tritium and 0.12 g (1.5 × 10¹⁵ Bq) of beryllium-7, equilibrium value, and minor amounts (4 × 10¹¹ Bq) of activated corrosion products (ACP) are presently estimated, which will be retained at the first instant in the liquid lithium itself and transported afterwards to areas away from the origin point.

The lithium loop will be serviced with an online ‘Impurity Control System’ which takes a fraction of the flow. This circuit is composed by an yttrium trap and a cold trap, respectively dedicated to capture tritium and ACP. Present estimates indicate that the efficiency of traps can reduce the presence of tritium dissolved in the lithium loop to 0.3 g and Be-7 to 23 µg. A similar amount of tritium is expected as maximum in the trap, as it will be specified that yttrium traps must be removed when loaded to 0.3 g (i.e., one trap replacement is anticipated every month). Be-7 will deposit in the last segment of the Heat Exchanger (HX) due to a decrease of solubility of the expected specie (Be₃N₂) as Li decreases its temperature. Be-7 will also deposit in the cold trap, working at lower temperature. The cold trap is estimated to capture 0.03 g Be-7 while 0.09 g will deposit at HX outlet section (these values are still subjected to further investigation).

Small amounts of tritium will permeate from the lithium loop to surrounding atmospheres. Present estimate is about 1.5 × 10⁴ Bq/h towards the Lithium Loop Cell atmosphere. A detritiation system under normal operation conditions will be implemented for atmospheres purification, as in the case of the Lithium Loop Cell, the Impurity Control System Cell, and the Target Cell.

A very small fraction of deuterons running in the accelerator duct and components will also induce direct activation of structural and functional components when impacting them, as scrapers, a collimator, or occasionally in the beam dump. Neutrons will occur in a second step as a result of such reactions, then traveling some distances from the point of origin and therefore with possibilities to activate separate materials where the neutron flux remains significant. Scrapers and the collimator will again be further activated in this way, but also coils, cooling the water of some circuits and atmospheres surrounding the accelerator, especially in high deuteron energy areas. Air atmospheres will produce Ar-41 (up to some 1 × 10⁷ Bq equilibrium value, when conservatively assuming no ventilation removal of concerned rooms), and minority amounts of tritium, C-14, N-13, etc. An additional atmosphere of concern is the Target Interface Room, which is an Argon inertized cell adjacent to the Test Cell receiving back streaming neutrons, then originating Ar-41 around 5 × 10⁹ Bq, equilibrium value.

In what concerns activation of structural materials around the target it is estimated in the range of a dozen of grams (Fe-55, Mn-54, Co-58, etc.) distributed in the structural material of the target assembly (mostly backplate) and in the High Flux Test Module. This radioactive inventory, which includes minor amounts of tritium, will be an issue for waste management but of less concern for mobilization in design basis conditions.

Direct exposure to gamma and neutron sources is the other important radiation risk to address. Wall rooms in the main building are designed with shielding function to allow acceptable dose rates in neighbor rooms. Also, local shielding structures close to origins of radiation are being explored to further deplete the exposure during normal irradiation and during beam shutdown maintenance conditions. Both fixed and transferred sources as waste management during maintenance operations are considered in the analyses.

The Target Assembly located in the Test Cell is the main intense source of neutrons during beam operation, some 7.7 × 10¹⁶ n/s, and thick shielding walls of magnetite concrete are designed in the TC, 4 m in downstream neutron favored traveling direction. Somewhat lower thicknesses in other walls around TA are designed, while all TC walls configure the so called Test Cell monolith.

In addition, there are several penetrations of the monolith walls and therefore streaming to neighbor rooms must be addressed. Backstreaming neutrons towards the Target Interface Room and further to Accelerator Vault is estimated and shielded until affordable dose rates are obtained. Access of personnel to accelerator high radiation areas is forbidden (function provided by the ‘Personnel Protection System’). The combination of local shielding and room walls will reduce the dose rate in neighbor rooms to specified values in supervised or controlled areas, Figure 2.

Streaming from the Target to the lower Lithium Loop Cell (LLC) will occur through inlet and outlet lithium loop penetrations. Again, while LLC is forbidden access its walls are planned for further reduction of dose rates in neighbor rooms and corridors. Finally, streaming from Target to the so called upper Access Cell (access to TC components is provided from this upper bay area by remote handling) is also minimized, taking into account effectiveness of specific components in the upper part, such as large Shielding Plugs slabs as well as Pipe and Cabling Plugs. These plugs house inserted pipes for transport of cables and gas services, with several changes in direction to deplete streaming.

As introduced above, additional neutron sources are identified along the deuteron beam before the target, specifically when intercepting components as the last collimator and scrapers. Conservative beam losses are assumed for other segments (superconducting RF cavities, beam duct), with the manual maintenance of AS components being a plant requirement. In these cases, the neutron sources are several orders of magnitude lower than in the target. In addition, specific streaming in walls of this area is addressed, as it is the case of wall penetrations in the accelerator vault for radiofrequency tubes.

The facility rooms are classified from the radiological point of view as shown in Figure 2 according to the expected level of radiation and also taking into account interventions to be done in the different rooms. Two classifications are developed, for beam-on and maintenance conditions, and they are systematically verified by means of neutronic computations under continuous refinement towards realistic models. The usage of ad-hoc Remote Handling devices is anticipated in areas with high dose rate values.

4. The Licensing Frame

One of the top level national regulations is the Spanish RINR, (‘Reglamento de Instalaciones Nucleares y Radiactivas’, or ‘Regulation for Nuclear and Radioactivity Facilities’), Royal Decree 1836 as of 1999, modified in 2015, which leads to IFMIF-DONES classification as a ‘First Category Radioactive Facility’. The complete set of required documentation to provide to the Regulatory Body for licensing is specified according to the above RINR classification. In the DONES case, a single operation permit would be requested, which includes a construction permit when issued. Nevertheless, while all safety design activities are presently oriented to the full facility, a licensing scheme will be pursued in due course in line with commissioning of the facility in several phases: establishing the injector, medium energy, beam dump, and beam-on-target.

More closely related to design activities, the next top level mandatory documentation to follow is the so-called ‘Safety Instruction 26’ (SI-26) which contains Plant Safety Requirements (PSR) to implement and to be demonstrated in the licensing reports.

SI-26 is similar to the main worldwide regulations for equivalent facilities, and

Table 1. Chapters and sections of ‘Safety Instruction 26’.

General Objectives & Requirements			Siting	Design
General objectives	Defense in depth	Human factors	General requirements for siting	Barriers in design	Design requirements for safety functions	Instrumentation & control
Organization & Management of Safety	Safety Analysis. Safety Study	Dose limits & dose restrictions	Tracking of siting conditions	Safety functions	Environmental & seismic classifications
Quality Assurance	Risk Analysis	Inner & outer emergencies		Accident analysis	External & internal events protection
Recording & reports	Periodic Safety Review	Security		SIC classification	Fire protection
Construction & Operation		Explotation			Decommissioning
Construction & assembly		Personnel	Control of effluent emissions	Radwaste	Desing implications
Operation		Maintenance, tests, inspections	Modifications		Safety during shutdown & decommissioning
		Operation specifications	Operative experience

summarizes the PSR according to SI-26. There are six main chapters: (i) General Objectives, (ii) Siting, (iii) Design, (iv) Construction and Operation, (v) Exploitation, and (vi) Decommissioning. The traditional procedure to follow in design activities is to apply specific guidelines to develop the main chapters down to complete the system requirements of safety class systems, structures, and components. However, the selection of specific guidelines is typically not stated and can be defined by designers. There are available guidelines at the national and international levels. In any case, the definitive set of guidelines applied to DONES must be provided to the Regulatory Body as part of the evaluation process. In this way, a complete set of directions to hierarchically follow regulations, standards, building codes, etc., will contribute to demonstrating the required degree of robustness in the design, while specific analyses will complement the guidelines and standards.

On the other hand, it must be mentioned that SI-26 was developed for licensing nuclear facilities and that the Regulatory Body could likely issue a future specific adaptation to DONES, which would be expected to not be very different in content than the present SI-26 (also, new official versions of SI-26 as well as the above RINR are expected in the short term, forcing further review and adaptation when necessary).

The next section will explain the main activities developed in the EUROFUSION/WPENS project to implement the main SI-26 Safety chapters, incorporating the specificities of the facility.

5. Implementation of the Main SI-26 PSR in the DONES Design

5.1. General Objectives

The general objective of the facility owner must be to protect the public and workers as well as the environment from dangerous effects of ionizing radiation. To accomplish such an objective, important safety principles apply, as limitation, control and minimization of radioactive material, limitation of the probability in events related to facility loss of control, minimization of consequences, and minimization of waste management production. These principles will apply in all of the facility cycle, starting with design activities.

5.2. Defense in Depth

This is an important principle to consider in design tasks as well as in other phases of the facility (construction, operation, dismantling, and waste management). Very briefly, in addition to the configuration of several barriers for confinement, the principle consists of providing several layers of protection to be developed independently from each other. The first layer is minimization of deviations from normal operation, the second is detection and control of deviations, the third is provision of systems driving the plant to a controlled state in case of accident, the fourth is to reduce the probability of beyond design basis accidents as much as possible, and the fifth is to reduce the consequences of releases as a result of accidents.

5.3. Risk and Safety Analysis

The facility owner must demonstrate that designed barriers and provision of Safety Class systems, structures, and components (SSC) are adequate for prevention of accidents and mitigation of consequences. A safety study according to the directions of the above RINR regulation must be provided, where postulated accident scenarios are analyzed.

Risk analysis must be provided for global verification of probabilities in the accident scenarios. Analyses are ongoing in the frame of EUROFUSION WPENS project, taking into account the first-of-a-kind nature of DONES due to a number of features. Event Trees are being developed including the expected lines of defense, and plant status probabilities are quantified. Available failure databases from Fusion Component Failure Rate Data Base [12] are being used, or failure rate objectives are assumed to be further demonstrated via safety requirements assigned to systems and components.

A complete and enveloping set of design basis accidents must be provided in licensing. This work is being developed for DONES following bottom-up and top-down approaches to analyze the facility response to postulated failures. The bottom-up approach started with ‘Failure Mode and Effect Analysis’ (FMEA) for the different main DONES systems and interfaces according to the available status of design. The FMEA analyses are done following IEC guidance [13] and activities are being further updated as design progresses. The following steps are fulfilled in compliance with FMEA activities:

• The component or system under analyses is identified according to the Plant Breakdown Structure (PBS). There are 34 main systems in PBS, broken down to subsystems at low levels as possible for analyses.
• Process function associated to subsystems or component is identified.
• The associated Safety Function is identified. An expanded list of detailed safety sub-functions has been produced (as explained in Section 5.3 below).
• Failure mode is postulated.
• Causes leading to failure mode are provided.
• Consequences of failure are projected.
• Detection actuations are proposed.
• Automatic action on detection is proposed.
• Preventive and mitigative actions are additionally proposed.

FMEA exercises are presently available for Lithium Systems, Test Systems including Ancillary Systems, Accelerator Systems, Radwaste Treatment Systems, Heat, a Ventilation and Air Conditioning system, and a Service Gas System, with updated versions in some cases.

The top-down approach assumes that large areas of the facility are unavailable to perform their functions. Losses of large areas of the facility due to external or internal events are examples of scenarios under consideration.

A list of Reference Accident Scenarios (RAS) is proposed and continuously reviewed for evaluation as candidates Design Basis Accidents.

Table 2. The present list of Reference Accident Scenarios.

Number of RAS	Description
1	Loss of flow in the Lithium Loop due to EMP trip
2	Loss of heat sink for removal of heat loads from Li loop due to seizure of the Secondary Loop pump
3	Loss of lithium in Lithium Loop Area due to large break at the electromagnetic pump outlet
4	Loss of lithium in the TC due to large break in piping running inside the cell
5	Loss of vacuum in Target Vacuum Chamber
6	Loss of helium gas from HFTM cooling circuit inside TC
7	Loss of flow in the TC-HCS-LP due to spurious valve closure
8	Loss of helium gas from HFTM cooling circuit inside the cooling room hosting TS-HCS-LP equipment
9	Loss of water flow in the TC-WCS due to spurious closure of isolation valve in the loop hot leg
10	Loss of cooling water from TC-WCS circuit inside the room hosting the TC-WCS equipment
11	Release towards the environment through TC exhaust due to spurious relief from TC-GICS
12	Cooling water ingress in the accelerator beam duct
13	Loss of vacuum in beam duct and air ingress
14	Loss of D2 or H2 into the Accelerator Vault due to rupture of gas supply system
15	Loss of vacuum in ion source due to containment rupture
16	Leakage in Liquid Radioactive Waste Treatment Systems
17	Degradation of Radioactive Gas Treatment Systems
18	Dynamic confinement failure (HVAC failure)

shows the present list (changes in the list are still possible as analyses progress).

Deterministic analyses of scenarios in Table 2 including sensitivity cases are being done while being supported with the fusion version of the MELCOR code [14]. The lithium equation of state is implemented in the code, therefore enabling lithium loop accidents. Also, specific features like tritium transport in rooms as HTO specie are implemented, in addition to other possible aerosol or gas species. Rooms housing potential material at risk can be modeled and flow paths simulated according to identified failure modes in accident conditions. Several MELCOR models are available, as shown in Figure 3, which implement the operation of main and ancillary systems, and make sure that safety functions are addressed. Mitigated and unmitigated scenarios are analyzed in an iterative way as long as performance of systems and details of design aspects progress. Metrics for accident evaluation are being established, including released radionuclides amounts outside the facility, as well as to rooms inside, some of them potentially occupied by workers.

The technical safety requirements (operational limits, control parameters, and actions to implement in abnormal situations) are under exploration by means of monitors and actuators built in the above models thanks to the MELCOR Control Function package, while definitive proposals will be done in next stages as part of this type of analyses. The Safety Control System will be designed in line with this information.

An assessment of Beyond Design Basis scenarios must be also provided in safety analysis for understanding the ultimate safety risks of the facility. The credibility of such scenarios will depend on final assessment of probabilities (still showing uncertainties) and on possible changes in design. This means that the probability can still be decreased when design specifications are modified as necessary.

Potential external events beyond design basis might lead to the highest levels of releases, such as beyond design basis earthquakes, but internal events could also be a factor if several lines of defense fail. An example of such a scenario presently under consideration is adapted from PSAR-05 [15]. The scenario is a lithium fire in the Lithium Loop Cell, leading to a complete combustion of lithium affecting critical components and leading to complete loss of protection from confinement barriers. The radiological source term has three contributions: (i) Tritium originally dissolved in the lithium, 0.3 g (ii) Be-7 deposited in HX plus dissolved in the lithium, 90 mg, (iii) Activation Corrosion Products (typically, a percentage of the calculated inventory is assumed to release). However, present estimates of ACP in the lithium loop are small (4 × 10¹¹ Bq), even when assuming no role of the cold trap in the purification loop. As the ACP removal efficiency must be considered in the next activities, no ACP contribution to the dose in this scenario is calculated.

Definitive dose conversion factors for the source term material will be obtained according to the US-NRC Regulatory Guide 1.145 [16], which is presently acceptable under Spanish guidelines. This activity is ongoing, and instead of definitive results, illustrative assumptions are provided here as a first reference for this scenario.

The atmospheric dispersion of the release material is assumed to take place under pessimistic weather conditions as low wind velocity, atmosphere stability class and 10 m height release (i.e., no credit to stack release). The offsite Most Exposed Individual (MEI) is a member of the public assumed to be located at the boundary edge of the facility. The present specification involves MEI being placed in the 100 m range. For such a distance, a dose conversion factor for tritium is provisionally taken as 10 mSv/g-T(HTO) based on project internal estimates. This factor accounts for exposure pathways due to tritium inhalation and skin absorption at short term. No chronic long term dose by ingestion of contaminated foods has been estimated. For Be-7, the dose factor is higher than tritium, and it is provisionally taken as 400 mSv/g-Be7, based on reference [17]. Therefore, the total dose due to all tritium and Be-7 contributions is in the order of 40 mSv, dominated by the Be-7 release. As mentioned above, definitive results will be provided later as part of the licensing methodology, taking into account the full source term, specific dose conversion factors (including ingestion and chronic dose), weather conditions, and distance to MEI among other assumptions.

On the other hand, design improvements are under consideration to further address the very low probability range of accidents. Examples are: implementation of separate fire sectors making the sources behave independently under fire conditions, lowering Be-7 deposits in HX with a different specification of circuit operation, detritiation during fire events, and other similar events. In this case, mobilizable radionuclides would then be decreased, leading to lower dose values.

5.4. Barriers in Design

According to SI-26, barriers must be provided by design for confinement of radionuclides in compliance with the defense in depth concept. In DONES, the confinement approach is based on two or three levels, commensurately to the material at risk that is under confinement. The first level is the immediate wall or pipe around the process itself, which is built with high mechanical standards, therefore reducing the probability of failures. Mechanical building codes such as RCC-MX are applied in most of safety class systems. However, not all the processes are immediately confined by safety class SSCs as the first barrier due to complexity in design or due to a particularly difficult working environment preventing the application of codes. This could be the case for the lithium loop pipe components in high neutron flux areas (Test Cell) or the accelerator beam duct. In these cases, respectively, the safety function is transferred to the next enveloping barrier, which is the Test Cell liner, or a Fast Isolation Valve in the beam duct is implemented close to the target.

The second level of confinement is provided by a new barrier around the process. In this case the barrier is identified as safety class component and safety system requirements are applied accordingly: robustness against design basis loads, inspectionability, specific isolation conditions for penetrations, program of tests, etc. The third barrier is provided by the rooms around the second barrier, working under the dynamic confinement principle. According to this principle, concerned rooms are served by nuclear HVAC system which provides depressed conditions according to ISO 17873 standard. In virtue of this standard, rooms are categorized in four potential confinement categories lumping nominal and accidental conditions, while HVAC should then provide corresponding depressed level degrees. HVAC will also provide the room with the isolation safety function in case of necessity (dampers closed), as well as aerosol removal by means of HEPA filters. In addition, the tritium presence may be significant in normal operation and accident conditions in some of the second or third barrier rooms. Therefore, detritiation systems are provided by design in compliance with the safety function, ‘management of tritium’. In this case, two systems are provided: ‘Vent Detritiation System’ (VDS) for detritiation under normal operation (mostly in first barrier processes, under intermittent or continuous operation depending on the concentration), and ‘Emergency Detritiation System’ (EDS), implemented for second and third barriers under accident conditions.

Deterministic analysis of cells and rooms in the main building, with appropriate modeling of leak paths and emergency systems, will address situations involving barriers under accident conditions. Inertized rooms for the prevention of fire scenarios will also be addressed as part of the depression chains among rooms, for which negative pressure is provided by specific gas mass control systems instead of by HVAC.

5.5. Dose Objectives

Dose objectives are established in all categories of design basis, from normal operation (effluents, beam-on irradiation) to incident and accident conditions.

Table 3. Dose objectives for the public and workers.

DONES Project Criteria
Category	Event	Frequency	Dose Objectives for the Public	Dose Objectives for the Worker
I	Normal operation	1/year	ALARA, and in any case: <20 µSv/year	ALARA, and: <5 mSv/year (max)<2 mSv/year (average)
II	Incidents	10−2/year < f < 1/year	<0.1 mSv/scenario	5 mSv/scenario
III	Unlikely Accidents	10−4/year< f < 10−2/year	<1 mSv/scenario	A radiation exposure 10 mSv/scenario < dose < 100 mSv/scenario, including management of the accident and post-accident situation
IV	Extremely Unlikely Accidents	10−6/year< f < 10−4/year	<10 mSv/scenario	A radiation exposure ≥ 100 mSv, taking into account the management of the accident and post-accident situation

shows present objectives for design basis scenarios, which still could change slightly depending on the progress of analysis and final adaptation to particular regulations (slightly different categories according to initial events rather than scenarios). Both the public and the worker are subjected to dose objectives and these are well below ICRP recommendations. Activities are ongoing for verification of the dose objectives by means of deterministic analysis of Reference Accident Scenarios.

5.6. Safety Functions

The Safety Functions (SF) are established starting at the highest level with four fundamental ones: confinement of radioactivity, limitation of exposure, protection of the two previous SF, and support for implementing main SF.

Table 4. Main DONES Safety Functions and Sub-functions.

Identifier	DONES Safety Functions
S1	Provide confinement of radioactivity
S1-1	Provide process confinement barriers (first barrier)
S1-2	Provide building confinement barriers, including systems for maintaining depression and filtering/detritiating effluents
S2	Provide limitation to radioactive exposure
S2-1	Shield to limit radioactive exposure
S2-2	Provide access control in the operating area
S3	Provide protection of systems for safe confinement and limiting exposure
S3-1	Provide management of beam energy
S3-2	Provide management of pressure/temperature
S3-3	Provide management of chemical energy
S3-4	Provide fire monitoring/mitigation
S3-5	Provide features to prevent or to assure resistance to mechanical impact (including seismic, dropped load, etc.)
S3-6	Provide management of mobilizable radionuclides in Normal Operation
S3-7	Provide management of activated and contaminated streams
S4	Provide supports for implementing safety functions
S4-1	Provide auxiliaries essential for implementing safety functions (electrical power supply, compressed air, etc.)
S4-2	Provide monitoring plant status: safety functions, radiation monitoring, etc.
S4-3	Provide protection of systems important for safety (e.g., earthing, lightning, flooding, etc.)
S4-4	Provide transport/lifting of radioactive components/materials
S4-5	Provide support to operator intervention (lighting, communications, etc.)

shows the list of main SF, which is still broken down to lower levels, presently up to some 40 safety sub-functions (not all of them are shown in the table) to ease interaction with design teams.

System safety requirements for design are being selected and developed for demonstration of the safety functions applied to safety class SSCs. The main orientation for development of safety system requirements is to be in line with the main codes and standards typically applied in the nuclear field area.

5.7. Safety Important Class Classification of SSC’s

A ‘Safety Important Class’ (SIC) classification of SSCs must be provided according to SI-26. The SIC classification is being pursued by means of analysis under continuous review around the Reference Accident Scenarios in Table 2. A methodology based on IAEA [18] and Fusion/DEMO activities is being applied. The main characteristics of the methodology are the following.

Three criteria are applied to identify a SIC SSC: (A) A failure can directly initiate an incident or accident leading to risk of exposure or contamination; (B) The SSC is needed to limit consequences of an accident; (C) The SSC is needed to ensure the operation of other SIC components.

According to the above methodology, three SIC categories are established, which will allow a gradual implementation of system requirements according to their degree of importance: SIC-1 category (‘safety important’) is applied to SSC’s necessary to avoid ‘high’ consequences in postulated accidents (typically more than 1 mSv for accidents, 100 µSv for incidents; this category is therefore assigned to systems necessary to achieve the specified dose objectives in the project); SIC-2 category is assigned to SSC’s involved in ‘medium’ consequences (more than 100 µSv for accidents); and SIC-3 for lower consequences (10 µSv). The probability of scenarios is also considered in the classification, as they are divided in incidents, accidents, and very low probability accidents. ‘Non safety’ significant category is applied for the rest of the SSCs.

The present list of candidate SIC-1 SSCs is provided in

Table 5. Provisional list of SIC-1 SSC. (Safety Functions mentioned in the table are coherent with Table 4).

Item	System, Structure or Component	Safety Function
1	Safety Beam Shutdown System	S3
2	Beam Duct Fast Isolation Valve	S3
3	Test Cell shieldings	S2-1
4	Test Cell liner/Lithium Loop Cell liner	S1-1
5	Structures for neutron & gamma shielding:Walls, floors, roofs, doors & penetrations	S2-1
6	Personnel Access Safety System	S2-2
7	Service Gas System (I): Argon gas for Li loop area Helium gas for TC area	S3-4
8	Service Gas System (II): Compressed air for SIC-1 actuators	S4-1
9	Nuclear HVAC: HVAC outlet Outlet HVAC filter	S3-7
10	Electric Power System for SIC-1 components	S4-1
11	Vent Gas Detritiation System—Stage 1 (VDS-1)	S3-6
12	Emergency Detritiation System (EDS)	S3-7
13	Stack release monitoring system (RAMSES)	S1-2
14	Tritium detectors in rooms connected to EDS (RAMSES)	S1-2

(although, variations are possible as analyses progress).

A final step is still necessary for adaptation to national regulations, because only two safety class categories will be requested, ‘safety important’ (SIC-1 class) and ‘safety relevant’ (in principle, SIC-2 and SIC-3 classes).

5.8. External Events Protection

DONES will be designed against external events with natural or non-natural origins, where seismic hazard is the first external event being considered. A seismic classification in four categories is applied to safety class components as follows: (i) Seismic Class SC1/SF category (SF stands for structural and functional characteristics preserved), (ii) SC1/S (structural function only), (iii) SC2 (non-damage to SC1), and (iv) non-seismic category. In addition to other SIC SSCs, the main building is subjected to seismic requirements as part of last confinement barrier and shielding safety functions, while assurance of mechanical protection of these main safety functions is also provided. The International Building Code is applied for further non-radiological safety requirements and design criteria. Deterministic analyses for the demonstration of requirements concerning displacements, leakages, and integrities are ongoing. The presence of seismic isolation devices at foundation level is being considered below the main building.

In addition, SL-2 (Safe shutdown earthquake for which safety functions must be provided, where a 10,000 years return period is considered) and SL-1 (for which no releases above normal operation are allowed and resumption of operation without extensive inspection is expected; a 100 years return period) IAEA classification levels are being applied. While generic peak ground accelerator values are being applied to SL-2 and SL-1 in a first approach (respectively 0.25 g and 0.1 g, where ‘g’ stands for unit of gravitational acceleration, 9.8 m/s²), specific characterization of the site is being done for application of more realistic values.

External hazards to be included in the next phases of natural phenomena analyses are external flooding and rains, while non-natural hazards are under discussion.

5.9. Fire Protection

Several types of activities are being developed for the fire protection approach configured in the design. A Preliminary Fire Hazard Analysis (PFHA) was performed and is now being updated according to the last available design of the facility. The methodology in the PFHA is divided in five steps: identification of safety targets, Safety Functions, Safety Important Components (SIC), TRICE products (toxic, radioactive, inflammable, chemical, explosive), location of SIC’s and TRICE products, and characteristics of the rooms with SIC and TRICE products.

In addition to considerations of traditional fire risk, special care is taken for lithium as a pyrophoric product, which will be present in the facility in the order of 9 m³ and is the carrier of radionuclides that are potentially mobilizable when exposed to fire (tritium, beryllium, and ACP). Safety functions are established to prevent lithium fires by means of dedicated systems: helium or argon inertization atmospheres will be established in rooms potentially receiving lithium leakages; lithium leakage detection will be implemented; and mitigation systems will be implemented. In any case, room inertization will likely be part of the ‘Performance Technical Specifications’ Book, which means that plant operation is not possible when specifications are not achieved. In addition, a methodology is being pursued involving phenomenology related to lithium fires (ignition conditions, temperature loads to confinement, etc.), engineering preventive measures, and systems mitigation actions with the objective to demonstrate that an extremely low probability of radiological consequences due to lithium fires in the facility can be achieved (i.e., beyond design basis category).

Fire areas have also been established, with identification of fire barriers and walls, as per two hours and three hours fire ratings. The PFHA analysis is being done assuming that each room is a single fire zone.

Analytical support of fire scenarios is being done with the reference codes FDS and MELCOR, where combined performance of safety systems is addressed.

Among the main references the DOE-STD-1066-2016 Standard [19] and its associated documentation is being considered for application. The outputs of fire protection activities are being reviewed and updated according to progress in DONES design and parallel analyses.

6. Conclusions

Safety is being integrated in the DONES design according to Spanish and international regulations for nuclear facilities, which assure an important degree of robustness of the facility to provide protection to the public, the workers, and the environment. Safety activities are challenging due to being the first facility of its kind, and the several safety functions involved for several dedicated systems. The design basis is being developed through a continuous interaction with design teams and the licensing process is expected to be launched shortly.