Engineered and Administrative Safety Systems for the Control of Prompt Radiation Hazards at Accelerator Facilities

Transcription

1 Engineered and Administrative Safety Systems for the Control of Prompt Radiation Hazards at Accelerator Facilities James C. Liu Stanford Linear Accelerator Center (SLAC) Vashek Vylet Thomas Jefferson National Accelerator Facility (TJNAF) Lawrence S. Walker Los Alamos National Laboratory (LANL) 1

2 Radiation Safety System (RSS) RSS: Engineered and/or administrative safety systems to monitor, mitigate and control prompt radiation hazards. RSS = ACS + RCS ACS keeps people away from radiation Ropes, signs, barrier and access controls RCS keeps radiation away from people Shielding, beam and radiation interlocks 2

3 ANSI N43.1 Standard Draft N43.1 Standard Radiation safety for the design and operations of particle accelerators American National Standards Institute (2008?) Chapters 4, 5 and 6 of the N43.1 Standard draft, as well as some U.S. regulations and standards, are the main basis for this presentation. 3

4 N43.1 Committee Reviewers Ted de Castro (LBNL) Roger Kloepping (LBNL) Robert May (TJNAF) Norman Rohrig (INEEL) Olin Van Dyck (LANL) Paula Trinoskey (LLNL) John Drozdoff (TRIUMF, Canada) Albert Evans (DOE) Wesley Dunn (Texas DHS) Vashek Vylet (Duke University) Larry Larson (Sematech) DOE NRC states CAMD FNAL CERN KEK, JAPRC PAL NSRRC, AEC 4

5 Disclaimer N43.1 Standard is not yet approved. Requirements (shall) and recommendations (should) in this chapter should not be quoted as official ANSI positions. Authors take full responsibility for any errors of this chapter and any discrepancies with the N43.1 standard. Contributions by N43.1 members and the reviewers are acknowledged. 5

6 Goals of Presentation Successful RSS needs a multidisciplinary team Presented from a health physicist s, not a system engineer s, perspective Health physicist roles for RSS Analyze radiation hazards; develop policies, requirements and procedures for systems For interlocked systems Review and/or approve design, changes, use, and associated operating and testing procedures Design, install and/or maintain the systems, if limited facility size 6

7 Contents U.S. regulations and standards Radiation Safety System (RSS) Access Control System (ACS) Radiation Control System (RCS) Examples of RSS policies and practices at some accelerator facilities 7

8 U.S. Federal and State Regulations 10CFR20 Standards for protection against radiation U.S. NRC (1991) NUREG-1736 Consolidated guidance for 10CFR20 U.S. NRC (2001) CRCPD Suggested State Regulations (SSR) Radiation safety requirements for particle accelerators (1991) 8

9 U.S. DOE Regulations 10CFR835 Occupational radiation protection (1998, 2007) DOE O 420.2B Safety of accelerator facilities (2004) DOE G Implementation guide for DOE O 420.2B (2005) DOE G Radiation-generating devices guide for use with 10CFR835 (1999) 9

10 Main U.S. Standards NCRP-88 Radiation alarms and access control systems (1986) ANSI N43.3 American National Standard for general radiation safety - installations using nonmedical X-ray and sealed gamma-ray sources, energies up to 10 MeV (1993, in revision) IEC Functional safety of electrical, electronic, programmable electronic safetyrelated systems (1998) ANSI/ISA-84.01/IEC Functional safety - Safety Instrumented Systems for the process industry sector (1996, 2004) - does not cover nuclear power facilities 10

11 ANSI N43.1 Chapters 1. Purpose and Scope 2. Definitions 3. Radiation Safety Program 4. Radiation Safety System (RSS) 5. Access Control System (ACS) 6. Radiation Control System (RCS) 7. Accelerator Operations 8. Operational Radiation Safety 9. Training 11

12 ANSI N43.1 Appendix Implementation guidance for: A. Safety Assessment Document (SAD) B. Interlocked-type Access Control Systems (ACS) C. Decommissioning Program D. Measurements of Radiation and Radioactivity E. Examples of Safety Standards for Commercially Available and/or Production- Type Accelerators 12

13 N43.1 Requirements and Recommendations Performance-oriented Prescriptive when practical and needed (Who, What, When, How) Technical, operational and management aspects 13

14 Radiation Safety System (RSS) Systems that Protect People from Prompt Radiation Hazards 14

15 Radiation Safety System (RSS) RSS is defined as a combination of engineered (passive and active elements) and/or administrative safety systems to monitor, mitigate and control prompt radiation hazards. RSS = ACS + RCS ACS keeps people away from radiation RCS keeps radiation away from people 15

16 ACS and RCS Access Control System (ACS) Ropes and warning signs Door or gate with locks Interlocked access control Beam inhibiting devices (BID) Radiation Control System (RCS) Passive systems: shielding, fence Active systems: beam interlocks and radiation interlocks 16

17 RSS Graded Approach RSS complexity depends on accelerator characteristics, facility operations, and radiation hazards. A hierarchy of controls, with general, flexible requirements for all radiological areas and more specific and stringent requirements for areas of greater hazard 17

18 Range of RSS Examples An accelerator with inherently limited radiation output might have a single warning boundary as administrative-type ACS and RCS. A bench-top accelerator with a fully-shielded enclosure has passive RCS, but no ACS interlocks. A large facility with several rooms independently receiving beam (or secondary radiation) needs engineered, interlocked ACS and RCS systems. 18

19 Facility Safety Assessment and Controls Identify accelerator beam parameters, facility operation modes (normal and abnormal beam losses), and personnel occupancy Analyze associated radiation hazards Develop RSS requirements for risk mitigation and controls Define Safety Envelope and Operation Envelope Experience from peer labs 19

20 20

21 RSS Interlock Functional Relationship INPUT Area Secure Signal Access Control System Logic OUTPUT Warnings Operate Permission Radiation Detectors Beam Inhibiting Devices Radiation Control System Logic Area Safe Signal Operate Permission 21

22 RSS Interlock Design Considerations ACS versus RCS (hazards and mitigation) Both preventive and reactive system types Develop system functional specification (what) Develop system integrity specification (well) 22

23 RSS Interlock Design Considerations Reliable and high performance No single-point failures (redundancy) No common-mode failures (separation and diversification) Sufficiently fast response time Protection for harsh environment (radiation, humidity, temperature, vibration, power, etc) Negligible false or nuisance trips 23

24 RSS Interlock Design Considerations Testability Simple and modular design Tamper resistance (e.g., concealed door microswitches, protected devices, cables and equipment, locked cabinets) Ergonomic (easy to use and understand, prevent human error, interface) Life-time cost and resource 24

25 RSS Interlock Design Considerations Interlocked-type ACS (and active RCS) are dormant systems, i.e., no response or action under normal conditions Self-checking Fail-safe 25

26 Fail-safe Design Definition: One in which the credible failure modes leave the system in a safe condition Examples of failure: Loss of AC or DC power Loss of air pressure Open or short circuit Ground fault Likely circuit element failure modes Relay - coil burnout PLC software bug, uncertain 26

27 Engineered RSS Operational Requirements and Guidance Quality assurance (QA) program Components, workmanship Design, installation, testing, commissioning and operations Configuration control (CC) program Maintenance, repair and modification program Periodic certification and check programs Safety systems independent and separated from non-safety systems 27

28 Engineered RSS Operational Requirements and Guidance Trained, qualified and authorized individuals System readiness review Document and record management program (transferable and auditable) Self assessment Peer (internal and external) review 28

29 RSS for Non-Beam Radiation Radiation from dark current due to HV and/or RF fields (e.g., cavity, klystron) Exposure from induced radioactivity in machine components (e.g., beam stops, collimators) Shielding to reduce activation to air, soil, groundwater Engineered controls for exposure to activated air 29

30 RSS Interlock Bypass or Variance Governed by policies and procedures Justified Alternative protection, e.g., radiation source inhibited, tight administrative controls Written approval via authorized channels Detailed documentation Affected systems or areas posted Involved parties communicated Normal interlocks restored and verified ASAP 30

31 Some Questions for Interlocked-type RSS What technology should be used: relay or PLC? Which system is safer? dual 1oo2 or triple 2oo3? How often should systems be certified or tested? What types of documentation are needed? How can peer labs safety system performance or experience be used? How to strike the balance in satisfying so many sometimes competing or conflicting requirements? What kind of safety culture is needed? 31

32 RSS Accident 1982, A fatal exposure to Co-60 irradiator in Norway (due to a series of 5 failures!) Conveyor belt jammed at night (failure #1) Sources failed to automatically retract into the shielded position (failure #2). First person arriving at work in the morning found a green indicator light (failure #3) and an unlocked, interlocked door (failure #4). A interlocked radiation monitor normally located in the maze was out for repair (failure #5). 32

33 RSS Accident 1991, An over-exposure to 3-MV accelerator industrial irradiator in Maryland Gun off, but accelerating potential on Hands, feet and head in the dark current beam 13 Gy/s at hand position (55 Gy dose) Both hands amputated 33

34 ACS Violations 1998 BNL AGS: Someone left in Exclusion Area 2006 SLAC PEP-II: 2 users entered Exclusion Area with one key Lessons learned: Layers of prevention and mitigation systems, AND management system 34

35 35

36 Access Control System (ACS) Control Personnel Occupancy in Areas with Prompt Radiation above the Acceptable Levels 36

37 37

38 N43.1 Access Control System (ACS) Entry and access control modules Enclosures (ropes and/or barriers) Personnel entry gates Warnings and signs Communication and monitoring features Exclusion Area (> 10 msv/h) needs Area Secure System Emergency response features 38

39 N43.1 Access Control System (ACS) Beam Inhibiting Devices (BID) Power supply for gun or RF, beam safety shutter, electromagnet, etc Normal access control function Fault-response beam removal function 39

40 ACS Entry Module 40

41 41

42 ACS Mechanical BID (Beam Shutters) 42

43 N43.1 ACS Graded Approach Dose in 1-h (msv) Dose Category Start-up Warning Enclosure Personnel Entryway Gate Minimum None Rope No Restriction 1 10 Low Locked or Interlocked Area Secure System Not Required Moderate Visible & Audible > 100 High Visible/Audible; Emergency Off Barrier Locked; Interlock Also Recommended Locked & Interlocked Required (Exclusion Area) 1) Tighter than NCRP-88 2) Access to areas 0.05 msv/h is governed by general RPP. 3) Interlock redundancy is required for High dose category. 43

44 Additional Functional Requirements for Interlock-type ACS Redundancy via independent chains (from sensors to control devices) A single mechanical beam shutter is acceptable. Reliability, maintainability, testability, simplicity Interlocks not used as normal on-off devices Must have a manual emergency shutdown mode to override interlocks 44

45 Beam Shutter Comparison for 5 Facilities SLAC LANSCE TRIUMF TJNAF DFELL Number of Beam Shutter Beam Shutter Failure Analysis Yes No No No No Protection of Beam Shutters BTM & 2 devices Fusible Beam Plug Beam Spill Detectors Beam Diffuser or ACM If hit by beam, heat-load protection for 1-h at Allowed Beam Power A means to terminate beam when excessive beam power is detected 45

46 Comparison of Beamline BID for Synchrotron Light Facilities Facility ALS APS NSLS SSRL Most Europe Number of Beam Shutter Microswitches and signal chains for each beam shutter are redundant. Normal access control function only. 46

47 Computer-Based Logic Systems Use Programmable Logic Controllers (PLCs), instead of relays, to perform logic functions and monitor status signals associated with entry control Benefits: ease of use, handle complex and extensive logic requirements, good immunity to electrical interference, provide automatic documentation of the logic 47

48 Computer-Based Logic Systems Safety-rated PLC systems shall be used. Redundancy should be achieved by using independent PLC systems and may involve different programmers. Software program requirements shall follow a determined set of specifications. Watchdog timers shall be incorporated into internal processor and external systems. High modularity and testability Protection from radiation damage 48

49 Computer-Based Logic Systems Software program QA shall be performed. Supplement with simplified hardware second chain. Integrated risk assessment of the systems shall be made. Systems and procedures shall be peerreviewed, validated, verified prior to use. Management of documentation and operation of the software and systems 49

50 Useful ACS Standards IEC-880 Software for computers in the safety systems of nuclear power plants (1986) and its supplements EWICS TC-7 Position Paper 6012 Guidelines for the use of programmable logic controllers in safety-related systems (1998) IEC Functional safety of electrical, electronic, programmable electronic safetyrelated systems (1998) ANSI/ISA-84.01/IEC Functional safety - Safety instrumented systems for the process industry sector (1996, 2004) 50

51 51

52 Certification and Checks for Interlocked-type ACS Extensive certification and check programs are needed and shall be developed. Certification, check and maintenance shall be conducted following formal, written procedures by authorized personnel. Activities shall be properly documented. 52

53 ACS Certification Prior to accelerator commissioning or major ACS changes, system certified to meet safety requirement specifications via acceptance test Performance of sensors, logic, and control elements All functions of the logic (including unintended and bypass functions) Potential failure modes from errors in system design or implementation, and component failures 53

54 ACS Certification Before accelerator operation past one year following the last successful annual certification, the ACS hardware/software and functionality shall be certified to operate as intended. Before restarting operation following ACS modification, repair or maintenance, the potentially affected portions shall be certified. Certification shall be end-to-end, i.e., from inputs to outputs. May be the same as system acceptance test, particularly for small systems 54

55 ACS Checks More frequent and periodic checks by Operations or authorized individuals should be implemented for critical system components that are subject to accidental damage or potential failures caused by frequent use or presence in a harsh physical environment Micro-switches Emergency-off Keybank 55

56 56

57 Regulations and Standards for Some ACS Specifics Access to HRA (> 10 msv in one hour at 30 cm) Access to VHRA (> 5 Gy in one hour at 1 m) Critical devices (i.e., beam-inhibiting devices) Redundancy 57

58 Access Controls to HRA in 10CFR20 and 10CFR835 One or more physical controls (see next 2 viewgraphs) shall function automatically (or the area be locked) to ensure that no one is inside a High Radiation Area (HRA). 58

59 Access Controls for HRA in 10CFR20 and 10CFR835 A control device that prevents entry to HRA or that, upon entry, causes the radiation level to be reduced below HRA; A control device that energizes a visible or audible alarm so that the individual entering HRA and supervisor of the activity are made aware of entry; Entryways that are locked. During periods when access to the area is required, positive control over each entry is maintained; Continuous direct or electronic surveillance that is capable of preventing unauthorized entry; 59

60 Physical Controls for HRA in 10CFR835 A device that functions automatically to prevent use or operation of the radiation source or field while individuals are in the area. A control device that will automatically generate audible and visual alarm signals to alert personnel in the area before use or operation of the radiation source and in sufficient time to permit evacuation of the area or activation of a secondary control device that will prevent use or operation of the source. 60

61 Physical Controls for VHRA in 10CFR20 and 10CFR835 Very High Radiation Areas (VHRA): > 5 Gy in one hour at 1 m Use one of the access/physical controls to HRA. Additional measures shall be implemented to ensure individuals are not able to gain unauthorized or inadvertent access to VHRA. 61

62 Interlocked-Type ACS in DOE G Define Exclusion Area as an area that is locked and interlocked to prevent personnel access while the beam is on. Exclusion areas should be searched before the beam is introduced. 62

63 Interlocked-Type ACS in DOE G Two or more critical devices should be considered for use in interlock systems where a VHRA can be produced during operations. Critical devices are specific accelerator or beam line components that are used to ensure that the accelerator beam is either inhibited or cannot be steered into areas where people are present (e.g., steering magnets, beam stops, collimators and devices to inhibit beam sources). 63

64 Interlocked-Type ACS in DOE G Status of each critical device should be monitored to ensure that the devices are in the safe condition when personnel access is permitted. Specification and use of critical devices and redundancy requirements should be governed by a documented criterion. 64

65 Redundancy Requirements in DOE Health Physics Manual of Good Practices for Accelerator Facilities [SLAC 327 (1988)] Duplicate circuits or redundant components should always be used in critical applications. The chains should remain independent and not neck down to a single connection. Independence should be carried all the way from duplicate sensors through to the devices or mechanisms that shut off the radiation source. Wherever possible, two different methods should be in place to remove the beam or radiation source. 65

66 ACS for HRA in CRCPD SSR for Accelerators Each entrance into High Radiation Area (HRA) shall be provided with safety interlock that shuts down the machine under conditions of barrier penetration. HRA and its entrance shall be equipped with observable warning lights that operate when radiation is being produced. 66

67 ACS for HRA in CRCPD SSR for Accelerators HRA shall have an audible warning device which shall be activated for 15 seconds prior to possible creation of HRA. A scram button or other emergency power cutoff switch shall be located and identifiable in HRA. 67

68 ACS for HRA in CRCPD SSR for Accelerators When a safety interlock system has been tripped, it shall only be possible to resume operation of the accelerator by manually resetting controls at the position where the safety interlock has been tripped and, lastly, at the main control console. 68

69 ACS for HRA in CRCPD SSR for Accelerators Radiation levels in all HRA shall be continuously monitored. All safety and warning devices, including interlocks, shall be checked for proper operation at intervals not to exceed three months. 69

70 ACS in DOE G (for RGD 10 MeV) Access control devices are to prevent unauthorized or inadvertent entry into a Radiological Area and/or to warn of a hazard. Additional measures shall be implemented to ensure individuals are not able to gain unauthorized or inadvertent access to VHRA. Such measures should include locking or securing service doors and panels with tamper resistant fasteners or the use of multiple and redundant access controls. 70

71 ACS in DOE G (for RGD 10 MeV) Doors and/or access panels in exempt shielded, shielded, and unattended installations should be equipped with one or more fail-safe safety interlocks to prevent irradiation of an individual (ANSI N43.3). If an area radiation monitor is incorporated into a safety interlock system, the circuitry should be such that a failure of the monitor shall either prevent normal access into the area or operation of the RGD. 71

72 ACS in DOE G (for RGD 10 MeV) Control devices used to limit RGD time, position (irradiation geometry), current, voltage, beam intensity, or control panel lights or system indicators should be fail-safe. 72

73 ACS for Simple Accelerator Facility Radiation Therapy Linac Video Cameras Emergency Exit Radiation Detectors Emergency Off Interlocked and locked door Operator console, EO, Status Light 73

74 Function Logic for Detector and Door Interlocks 74

75 SSRL ACS BID Systems 75

76 76

77 HPS Logic Diagram Crystal Cooling (BL6) Disaster Monitor 80 psi (BL6&10) Radiation Warning Lamp Hutch Search Complete On-Line SRU Key In Shutter Open Command Helium Interlock Beamstop Position (BL4&10) Disaster Monitor 30 psi (BL6&10) Emergency Stop Hutch Doors Closed Machine Protection (BL5,6&10) Injection Septum Interlock (BL5,6&10) Open Shutter Permit Off-Line Off-Line Monochromator Switch Mono Door Emergency Stop SRU Key HS1 HS2 HPS Fault Chain Beamstop Position Disaster Monitor 15 PSI Hutch Panel Hutch Door Ion Chamber Closed Closed A10 77

78 78

79 Radiation Control System (RCS) Control Prompt Radiation in Occupiable Areas Not Exceeding the Acceptable Levels under both Normal and Abnormal Accelerator Operation Conditions 79

80 80

81 Radiation Control System (RCS) Passive systems Shielding (bulk and local) and fence Active systems Beam interlocks Radiation detector interlocks Should follow the same general requirements as interlocked-type ACS (redundancy, failsafe, and testability) 81

82 RCS Performance Requirements Normal Operations (within Operation Envelope) RCS ensures dose rates as Table 5.1 Shielding design criteria 20% of dose limit for radiological workers 1 msv/y for general employee 0.1 msv/y (7200 h/y) for off-site doses Observe ALARA principle 82

83 RCS Performance Requirements Abnormal Operations Exposure analysis for maximum credible beam losses throughout facility (capabilities of accelerator systems, modes of operation, and the RSS features; peer lab experience) Dose per unlikely event 10 msv Layers of hazard controls (higher levels of radiation risk are mitigated by increasing layers of safety controls) 83

84 Risk Assessment Risk of hazard = Event probability x Event severity SIL (Safety Integrity Level) for each safety function Qualitative or quantitative Levels 1 to 4 (SIL 4 has a risk reduction factor of > 10 4 ) 84

85 Passive versus Active RCS Normal beam losses shall be addressed by passive systems. Abnormal beam losses or operations shall be controlled by passive and/or active systems. Balance between passive and active systems (passive systems are preferred) Probabilistic Risk Analysis (PRA) with performance data should be made when active RCS play extensive or critical roles. 85

86 SSRL RCS Policies Dose in experimental floor where users occupy Normal beam loss: 1 msv/y Allowed beam mis-steering: 4 msv/h Active RCS failures: 0.03 Sv per event or 0.25 Sv/h General public dose at SLAC site boundary 0.1 msv/y Abnormal events need to be terminated timely via active RCS systems. 86

87 RCS Passive Systems Shielding and/or fences Conservative shielding design for both normal (allowed beam power) and abnormal (maximum credible beam power) operations Designed or reviewed by safety professional Verification survey for normal and likely abnormal beam losses Configuration control program is crucial 87

88 RCS Active Systems Monitors/limiters for beam energy, beam current and beam losses Electronic system may include: A beamline transducer, e.g., current toroid, secondary emission monitor, beam position monitor, repetition rate monitor, ion chamber or meter relay An electronic processing module that integrates or counts beam current pulses A beam shut-off circuit connected to beam shutters, RF sources or high-voltage supplies 88

89 RCS Active Systems Protection for mechanical beamline safety devices that have power ratings below the Allowed Beam Power Coolant flow switches Temperature sensors Vacuum pressure sensors Ionization chambers Burn-Through Monitor (BTM), a pressurized chamber that ruptures on over-heating 89

90 SSRL Beamline Burn-Through Monitor 90

91 RCS Active Systems Radiation detectors Inside accelerator housing and/or in occupiable areas Effects on detector response in pulsed radiation fields, the RF/magnetic field interference, and radiation damage Current-mode ionization chamber is generally the choice 91

92 Active RCS Field Devices Sensors Logic Control Elements Radiation Current Voltage Temperature Pressure Flow etc Redundant Relay and/or PLC Wiring Power Supplies Trigger Shutter Valve (switches) Account for 90% of safety system failures! 92

93 Some Active RCS Considerations Selection of sensors and final elements Sensor response accuracy and calibration Different action levels Warning to mitigate radiation Trip to terminate beam (particularly for critical applications) Self-checking and Fail-safe Interfaces for Operator and with non-safety systems 93

94 Fail-safe Detector Design 94

95 Active RCS Certification and Test Annual system certification and calibration Regular and frequent verification of active and operational status during operation Self-test provisions, e.g., Keep-alive radioactive source Housekeeping pulses through toroid windings Test buttons be provided so that each redundant path can be fully exercised 95

96 ACS versus Active RCS ACS failure radiation hazard Door or BID interlocks fail high radiation Active RCS failure + abnormal machine performance radiation hazard Detector fails + abnormal beam loss high radiation Implications: self-diagnosis, redundancy and fail-safe Beam shutters are ACS and RCS Concept of safety critical device or system 96

97 RCS Administrative Controls Supplement the passive and active systems in low-hazard conditions Configuration control (SLAC uses RSWCF) Operation control Machine parameters (beam energy, beam current, number of integrated beam particles, pulses, and particle type) should be controlled by administrative means (computer control or operating procedures), if not by engineered means Safety credit? 97

98 Machine Protection System (MPS) Protect beamline components where radiation damage or overheating would not result in personnel hazards Electronic systems to monitor beam parameters, operational modes, beam loss conditions, machine performance, etc MPS is in general less rigorous and controlled than RCS MPS credit as active RCS (MPS may provide early detection and prevention/mitigation for events that may otherwise trigger RCS) 98

99 RCS Comparison for 5 Facilities SLAC LANSCE TRIUMF TJNAF DFELL Power Limiting # ACM 3 (Energy) 2 No 2 No Abnormal Termination LION, ARMD ( 0.03 Sv) Radiation Detectors Radiation Detectors (0.2 s) Radiation Detectors (1 s) Radiation Detectors ARMD γ/n Paired γ inside γ/n γ ion chamber n outside 99

100 RCS Comparison for 5 Facilities SLAC LANSCE TRIUMF TJNAF DFELL Shielding (Normal) 10 (1) msv/y 20% of Limits 0.01 msv/h 2.5 msv/y State Limits Abnormal Pa (Sv/h) Pm No Shielding 0.1 DBA (Site Boundary) msv/y 10 msv in one hour msv/y 100

101 Some Laboratory Reports SLAC Report 327 Health physics manual of good practices for accelerator facilities (1988) SLAC Radiation safety systems, technical basis document (2006) TJNAF Jefferson Lab Personnel Safety System, systems requirement specification (2007) TRIUMF Radiation safety system at TRIUMF (2001) LANL Accelerator Access-Control Systems LS (1993) 101

102 Some References IAEA Report 188 Radiological safety aspects of the operation of electron accelerators (1979) IAEA Report 283 Radiological safety aspects of the operation of proton accelerators (1988) NCRP Report 144 Radiation protection for particle accelerator facilities (2005) 102

103 Summary Facility needs formal, written policies and procedures to analyze hazards, and to develop and operate RSS in a graded approach SAD, Safety Envelope, Operation Envelope ACS and RCS: consistency and balance Life-cycle concept and cover technical, operational and management aspects Personnel responsibilities and training Documentation of activities Peer review and improvement for systems and program 103

104 More Examples of ACS and RCS 104

105 SLAC Accelerator Facilities SLAC 105

106 106

107 107

108 108

109 FFTB Emergency-off Button & LIONs 109

110 Stanford Synchrotron Radiation Laboratory (SSRL) 110

111 Available Access Modes and Their Conditions for the Linac, Booster and SPEAR Areas Access Mode Entry Condition Radiation Hazard Electrical Hazard PPS Area Linac Booster SPEAR Permitted Access (PA) Unlimited No No Controlled Access (CA) Limited No No Restricted Access (RA) RASK No Yes No Access (NA) No Yes Yes Note: The change of the access mode of a PPS area is always in the sequence PA CA RA NA or the reverse. RASK = Restricted Access Safety Key A15

112 Beam Stopper Response for ACS Violation 112

113 SPEAR TOP-OFF RSS Top-off stored current interlock < 50 ma SPEAR dipole current interlock (ΔB/B) > ± 0.5% QF1 magnet interlocks (Δ QF/QF) Current > - 25% Voltage > - 20% Injection energy interlock (ΔE inject /E SPEAR ) > 3.3 GeV BTS B2-B6 dipoles current interlock > + 1% BTS B3 trim current interlock > 10 A Beamline radiation monitor interlocks Non-BCS interlocks (administrative) Software power supply voltage & current monitor > TBD Software power supply resistance monitor > TBD Software Injection efficiency interlock < TBD 113

114 SSRL PPS/BCS 114

115 Top-off BCS Block Diagram 115

116 SPEAR3 Ring Typical Girder BD2 QF2 QFC BD1 QF1 116

117 SPEAR Ring Dipole Current Interlock 117

118 QF1 Voltage and Current Interlock 118

119 Stored Current Interlock 119

120 BCS Magnet Interlock Summary 120

121 SSRL Beamline Heat Protection RCS HPS #2 HUTCH DOORS CHAIN A EMERGENCY OFF CHAIN A BURN THRU MONITOR CHAIN A HPS OK CHA HPS #3 HUTCH SUMMARY OK CHA VAT SENSOR FROM PLC CONNECTION FOR NONE HPS MAINLINE MM1,IS1,IS2 CLOSED CHAIN A HPS #2 HUTCH DOORS CHAIN B EMERGENCY OFF CHAIN B BURN THRU MONITOR CHAIN B HPS OK CHB HPS #3 HUTCH SUMMARY OK CHB LCW SUMMARY FROM PLC CONNECTION FOR NONE HPS MAINLINE MM1,IS1,IS2 CLOSED CHAIN B HPS ACCESS &STOPPER CONTROL HUTCH SUMMARY 121

122 LANSCE Beam Interlock System* Electronic Beam Gate Inhibit To Injector and Beam Deflectors Pulse by Pulse Inhibit Latched Off Inhibit Fast Protect System Inputs Beam Spill Inputs Magnet Currents Equipment Status Run Permit System Equipment Line-up Monitoring On-Off Status Radiation Instrumentation * HPS 1997 Midyear Proceedings, pp49-58 Inputs Radiation Security System Redundant Fail-safe Fusible Beam Plugs Latched Outputs Active Safety Devices Radiation Dose Limiters Beam Current Limiters Radiation Instrumentation Personnel Access Control System Barriers, Shielding, Configuration Control 122