INTRODUCTION Defence in Depth

173 SAFETY CULTURE AS A PILLAR OF DEFENSE-IN-DEPTH

IMPLEMENTATION AT THE EXPERIMENTAL FUEL ELEMENT INSTALLATION, BATAN INDONESIA

H. Hardiyanti, B. Herutomo, G. K. Suryaman

H. HARDIYANTI, B. HERUTOMO, G. K. SURYAMAN

Center for Nuclear Fuel Technology – National Nuclear Energy Agency (BATAN) Tangerang, Indonesia

E-mail: [email protected]

Abstract

Defence-in-depth (DID) needs to be implemented not only in a nuclear power plant, but also in a non-reactor nuclear facility. The application of safety culture in a nuclear facility is one way of DID implementation. Safety culture aims at the performance of safe works, the prevention of deviation, and the accomplishment of quality operation. It is in accordance with the first level of DID concept which is the prevention of abnormal operation and failures that is done through conservative design and high quality in construction and operation. Experimental Fuel Element Installation (EFEI) is a non- reactor nuclear facility that belongs to BATAN (the National Nuclear Energy Agency of the Republic of Indonesia) that functions as its research and development facility on power reactor fuel production. The objective of safety culture implementation in the EFEI is to encourage workers to have a stronger sense of responsibility on safety and to contribute actively for its development. The enhancement of safety culture in the EFEI refers to the attributes of a strong safety culture listed in the IAEA Safety Standard Series No.GS-G-3.5 (The Management System for Nuclear Installations Safety Guide).

The strategies performed were: a) Internalization of safety values through activities such as briefings, “coffee morning”, visual management, workshops, and training; b) Enhancement of leadership effectiveness through activities such as senior management visits, safety leadership training, and personnel qualification training; c) Integration of safety into all work processes through activities such as setting up HIRADC (hazard identification, risk assessment, and determining controls) documents, setting up WHA (workplace hazard assessment), and routine housekeeping; d) Learning about safety through activities such as occupational health and safety inspections, safety self-assessments, open reporting on safety incidents, and participation in the FINAS (fuel incident notification and analysis system); e) Enhancement of safety performance accountability through activities such as ensuring open and timely reporting to the regulatory agency, evaluation of the SPI (safety performance indicators), and defining clear roles and responsibilities for each worker.

1. INTRODUCTION 1.1. Defence in Depth

Defence in Depth in Nuclear Safety is the implementation of several levels of equipment and procedures to ensure the effectiveness of physical barriers which limit the interaction between radioactive materials with workers, public and environment. The physical barriers are intended to protect the workers, public and environment in normal operation condition, anticipated operational occurrences, and accident conditions. Defence in Depth concept is implemented through design and operation of the installation. This concept is very important for nuclear installations. As was stated in the Basic Safety Principles for Nuclear Power Plants (INSAG-10) in relation to the safety of nuclear power plants, "All safety activities, whether organizational, behavioural or equipment related, are subject to layers of overlapping provisions, so that if a failure should occur it would be compensated for or corrected without causing harm to individuals or the public at large. This idea of multiple levels of protection is the central feature of defence in depth..." [1].

The main object of the defence in depth concept is the levels of protection barrier.

Those barriers include the barrier whose main function is to prevent radioactive releases to the environment. The objectives of defence in depth concept are as follows:

1) To compensate for potential human and component failures.

2) To maintain the effectiveness of the barriers by averting damage to the plant and to the barriers themselves.

3) To protect the public and the environment from harm in the event that these barriers are not fully effective.

174

The defence in depth concept is explained in Basic Principles for Nuclear Power Plants (INSAG-3) [1].

The strategy for defence in depth is twofold: first, to prevent accidents and, second, if prevention fails, to limit their potential consequences and prevent any evolution to more serious conditions.

Defence in depth is generally structured in five levels. Should one level fail, the subsequent level comes into play. The objective of the first level of protection is the prevention of abnormal operation and system failures.

If the first level fails, abnormal operation is controlled or failures are detected by the second level of protection. Should the second level fail, the third level ensures that safety functions are further performed by activating specific safety systems and other safety features.

Should the third level fail, the fourth level limits accident progression through accident management, so as to prevent or mitigate severe accident conditions with external releases of radioactive materials. The last objective (fifth level of protection) is the mitigation of the radiological consequences of significant external releases through the off-site emergency response [1].

The safety provisions at Level 1 are taken through the choice of site, design, manufacturing, construction, commissioning, operating and maintenance requirements such as:

1) The clear definition of normal and abnormal operating conditions.

2) Adequate margins in the design of systems and plant components, including robustness and resistance to accident conditions, in particular aimed at minimizing the need to take measures at Level 2 and Level 3.

3) Adequate time for operators to respond to events and appropriate human-machine interfaces, including operator aids, to reduce the burden on the operators.

4) Careful selection of materials and use of qualified fabrication processes and proven technology together with extensive testing.

5) Comprehensive training of appropriately selected operating personnel whose behaviour is consistent with a sound safety culture.

6) Adequate operating instructions and reliable monitoring of plant status and operating conditions.

7) Recording, evaluation and utilization of operating experience.

8) Comprehensive preventive maintenance prioritized in accordance with the safety significance and reliability requirements of systems.

Point number 5 of the safety provision at level 1 shows that qualified personnel which has good safety behaviour is needed to achieve reliable and safe operation of the installation. So, the safety culture [2, 3] is very important to enhance the safety behaviour of every personnel in the installation.

For the effective implementation of defence in depth, some basic prerequisites apply to all measures at Levels 1 to 5. These prerequisites, which are interrelated and are fulfilled as part of policy for safe design and operation, are appropriate conservatism, quality assurance and safety culture [1].

1.2. Defence in Depth in the Experimental Fuel Element Installation (EFEI)

The Experimental Fuel Element Installation (EFEI) is one of the nuclear installations in BATAN that supports the research and development of the production technology of nuclear fuel. EFEI is designed to convert yellow cake into nuclear grade UO₂ powder. This

175 installation also has the ability to turn the nuclear grade UO2 powder into Heavy Water Reactor (HWR) type fuel bundle. According to production process, EFEI consists of several facilities such as purification and conversion facility, pelletisation facility, Fuel assembly facility, quality control laboratory, mechanical workshop, supporting and energy supply and safety systems. EFEI is designed to support two main activities on the development of power reactor fuel technology in BATAN:

1) Conversion of yellowcake into nuclear grade UO2.

2) Fuel fabrication of Heavy Water Reactor (HWR) that uses natural UO2; research and development of fuel fabrication and fuel rod PWR type. The equipment in the EFEI could be upgraded to produce other kinds of pellet based fuel elements for power reactors whether using natural UO2 or enriched UO2 with a maximum enrichment of 5% U-235.

Defence in depth concept is implemented in the EFEI. The objectives of the implementation of the concept are to prevent accidents and to give the appropriate protection for the workers, public and environment. The main aspect of this concept is the use of several levels of protection layers to prevent radioactive releases to the environment. The levels of protection back up each other if failures or accidents happen.

The Defence in Depth concept for non-reactor nuclear installations is generally the same as that for nuclear reactors, but the implementation of this concept is slightly different.

The objectives of defence in depth strategies in the EFEI are: (a) to prevent accidents, and (b) in case an accident happens, to limit its radiological consequences and to prevent the evolution of the event to become worse. The application of defence in depth in a nuclear installation usually consists of five independent layers that a failure in one layer would not affect the others.

Defence in depth is applied in the EFEI in the following structures:

a) First Level of Protection

The prevention of abnormal operation and failures that is done through conservative design and high quality in construction and operation. All systems, structures, and components of the EFEI are of conservative design (such as the building that can endure a seismic load of 0.16g), having considered all potential hazards present (such as the ability to handle uranyl nitrate solution, the use of stainless steel tanks, etc), and having considered environmental factors in its construction. Regarding high-quality operation, the EFEI conducts the following administrative measures: (a) access control to the laboratories, (b) all instruments are operated below their safe operating conditions and following valid procedures, (c) maintenance programs are conducted on schedule, (d) operation and maintenance activities are done only by able and trained personnel, (e) safety based classification of systems, structures, and components, (f) implementation of quality management system and safety culture.

b) Second Level of Protection

The objective of the second level is to detect abnormalities and prevent the abnormalities from becoming accidents. For this reasons, EFEI is equipped with systems to detect abnormal operations and to protect the facility in case of failures, such as radiation/contamination detection system, smoke/fire detection, hydrogen/combustible gases leak detection, overpressure protection, over volume protection, and fire protection. An interlock system is installed in vital instruments.

Besides that, the operation and maintenance procedures have to be available in EFEI.

Those procedures have to be complied with and implemented in accordance with the applicable provisions.

176

c) Third Level of Protection

The objective of the third level is to control the accidents within the design basis so that the radioactive materials would not harm the workers and it won’t be released to the environment. For this reason, IEBE is equipped with engineered safety features such as radiation shielding, ventilation system, etc. Besides that, the operation procedures in emergency conditions have to be available in EFEI. These procedures have to be done if accidents occur in the installation. A routine emergency preparedness exercise is conducted at least once a year.

d) Fourth Level of Protection

The objective of the fourth level of protection layer is to control accidents beyond the design basis which could cause radioactive releases to the environment. For this reason, EFEI is equipped with isolation systems (Including ventilation systems and building isolation) to prevent radioactive releases to the environment. Besides that, the accident management procedures in emergency condition have to be available and they have to be done if accidents happen in the installation. The objective is to mitigate the impact of accidents.

e) Fifth Level of Protection

The objective of the fifth layer is to mitigate the radiological consequences of significant releases of radioactive material to the environment if the fourth level fails.

The emergency situation is assumed to go beyond the borders of the facility, hence the need for the involvement of related external organizations, such as local authorities, the national police, the military, nearby hospitals, and the regulatory agency [7].