Requirements Management of Fusion Reactors and Fusionrelated

Transkriptio

1 Jaakko Iivanainen Requirements Management of Fusion Reactors and Fusionrelated Facilities Thesis submitted for examination for the degree of Master of Science in Technology. Rauma Supervisor: Prof. Sanna Syri Advisors: M.Sc. (Tech) Antti Rantakaulio M.Sc. (Tech) Elina Brunner

2 Aalto University, P.O. BOX 11000, AALTO Abstract of master's thesis Author Jaakko Iivanainen Title of thesis Requirements Management of Fusion Reactors and Fusion-related Facilities Degree programme Master s Programme in Energy Technology Major Energy Systems for Industry and Communities Thesis supervisor Professor Sanna Syri Thesis advisors M.Sc. (Tech) Antti Rantakaulio, M.Sc. (Tech) Elina Brunner Code ENG21 Date Number of pages 73 Language English Abstract The design of nuclear power plants and installations is tightly regulated by national nuclear and radiation regulatory authorities to ensure the safety of these facilities to the workers, people, and the environment. The party engaged in the project of designing and constructing a nuclear installation needs to gain a license or a recommendation for the granting of a license from the national regulatory authority for the construction of the installation. For the authority to grant the license, the licensee must demonstrate that all requirements are met in the design of the installation. Demonstrating the fulfilment of the large number of safety requirements in the design is an extremely complex task and a failure in this process would create schedule and financial setbacks. Requirements management is a discipline that focuses on the management of the requirements for a systems design. Requirements management is extremely useful in the licensing of complex engineering projects. The thesis investigates the theoretical foundations of requirements engineering and requirements management and presents examples of applying them in practice in nuclear projects. The thesis goes through the safety issues of fusion focusing on radiation and nuclear safety. Fusion would be fundamentally more benign to people and the environment compared to fission because of the low amount of radioactive material and its intrinsic safety features. However, the presence of radiation and radioactive material will subject fusion facilities to the scrutiny of nuclear and radiation safety requirements. The thesis states that existing radiation and nuclear safety regulation could function as a basis for the requirements imposed on fusion facilities but proposes some exceptions to them regarding the intrinsic safety features and safety benefits of fusion. The thesis proposes ways of applying modern requirements management methods in the licensing of future fusion facilities. The thesis projects applying requirements management practices to have great benefits for not only the licensing process of individual fusion facilities, but the whole fusion field could benefit from the improved documentation and regulatory correspondence created in the licensing. Keywords Licensing, requirements management, fusion, nuclear power

3 Aalto-yliopisto, PL 11000, AALTO Diplomityön tiivistelmä Tekijä Jaakko Iivanainen Työn nimi Requirements Management of Fusion Reactors and Fusion-related Facilities Koulutusohjelma Master s Programme in Energy Technology Pääaine Energy Systems for Industry and Communities Koodi ENG21 Työn valvoja Professori Sanna Syri Työn ohjaajat DI Antti Rantakaulio, DI Elina Brunner Päivämäärä Sivumäärä 73 Kieli englanti Tiivistelmä Ydinvoimalaitosten käyttöä ja suunnittelua valvotaan tiukasti kansallisten säteily- ja ydinturvallisuusviranomaisten toimesta, jotta ydinvoimalaitosten turvallisuus työtekijöille, muille ihmisille ja ympäristölle voidaan taata. Ydinvoimalaitoksen luvanhakijan täytyy saada viranomaiselta myöntävä päätös laitoksen rakentamisluvalle. Jotta viranomainen voi antaa päätöksenä, sen täytyy ensin todeta vastaako laitoksen suunnittelu kansallisia turvallisuusvaatimuksia. Vaatimusten täyttymisen osoittaminen on yksi ydinvoimaprojektien haastavimmista vaiheista ja siinä epäonnistuminen luo usein suuria myöhästymisiä ja rahallisia menetyksiä. Vaatimustenhallinta on systeemitieteen ala, joka keskittyy systeemille esitettyjen vaatimusten toteutumisen varmistamiseen järjestelmien suunnittelussa ja toteutuksessa. Vaatimustenhallintamenetelmät ovat erityisen hyödyllisiä monimutkaisten järjestelmien, kuten ydinvoimalaitosten, lisensioinnissa eli luvituksessa. Työssä selvitetään vaatimussuunnittelun ja vaatimustenhallinnan teoreettisia perusteita ja esitetään esimerkkejä niiden soveltamisesta käytännössä ydinvoimaprojekteissa. Työssä käydään läpi fuusion turvallisuuskysymyksiä keskittyen erityisesti säteily- ja ydinturvallisuuteen. Fuusio olisi huomattavasti vähemmän haitallista ihmisten terveydelle ja ympäristölle kuin fissio sen sisältämän pienemmän radioaktiivisten aineiden määrän sekä luontaisten turvallisuusominaisuuksien vuoksi. Toisaalta, säteilyn ja radioaktiivisten aineiden olemassaolo fuusiolaitoksissa tekee niistä alisteisia tiukoille säteily- ja ydinturvallisuusvaatimuksille. Työssä todetaan, että olemassa olevia säteily- ja ydinturvallisuusvaatimuksia voidaan käyttää fuusiolaitoksen turvallisuuden varmistamisen perustana, mutta esitetään niihin joitakin poikkeuksia fuusion luontaisten turvallisuusominaisuuksien takia. Työssä esitetään tapoja hyvien vaatimustenhallintakäytäntöjen soveltamiseen tulevaisuuden fuusiovoimaloiden lisensioinnissa. Työssä todetaan, että vaatimustenhallintamenetelmien soveltaminen tulisi tuottamaan suuria etuja fuusiolaitosten lisensioinnin sujuvuudessa sekä auttamaan myös muiden fuusiolaitosten suunnitellussa ja lisensoinnissa, kun tulevat projektit voivat hyödyntää aikaisemmissa projekteissa syntynyttä selkeää suunnittelu- sekä lisensiointidokumentaatiota. Avainsanat Lisensiointi, vaatimustenhallinta, fuusio, ydinvoima

4 Forewords Studying energy engineering provides a solid expertise in terms of knowledge of different energy solutions and the effects of emissions on the environment and climate. My personal interest in nuclear energy started when I worked in the 2015 outage of Loviisa nuclear power plant. After that I got an internship at STUK, the Finnish Radiation and Nuclear Safety Authority, which really sparked my interest in nuclear safety. I continued to work on nuclear safety interning at Fortum Power and Heat Oy. I'm grateful for the interesting opportunities and valuable experience I gained at Fortum. At the end of my internship at Fortum I got the chance to do a master's thesis while working at Fortum. This thesis was done for Fortum Power and Heat Oy the thesis purpose was to introduce the company s licensing tool ADLAS to the work of European fusion consortium EUROfusion. I'd like to thank my thesis advisors for their support and for the opportunity to do my thesis on an interesting subject working at Fortum and the perspective I got on the European efforts of the academic community and industry towards the realization of fusion energy. I d like to thank Professor Syri for supervising the process of making of this thesis. I'd also like to thank my parents and my extended family for their continuous support and encouragement throughout my studies and during the writing of this thesis. Rauma Jaakko Iivanainen

5 Table of contents Abstract Tiivistelmä Forewords Units and symbols Abbreviations 1 Introduction Energy production and energy policy Nuclear energy Fission Fusion Fusion roadmap ITER DEMO IFMIF-DONES Thesis purpose and methods Theory of fusion energy production The fusion reaction Deuterium tritium fusion Fusion reactor concepts Nuclear safety and regulation Safety of nuclear power plants and facilities Nuclear non-proliferation The International Atomic Energy Agency s (IAEA) Safety Standards Safety Fundamentals Safety Requirements Safety Guides Plant states Safety issues recognized in fusion Fusion safety research Exposure to radiation during normal operation Activated materials Tritiated materials Radioactive effluents Loss of coolant accident and decay heat Vacuum vessel accidents Confinement integrity Electromagnets and electromagnetic fields Chemical reactions External events Waste management and classification Proliferation aspects of fusion Applying nuclear regulation to fusion facilities Fundamental safety functions Control of reactivity Removal of decay heat Confinement of radioactive material... 42

6 5.2 Fusion requirements conclusions IFMIF-DONES The IFMIF-DONES facility Accelerator System Lithium Target System Test System Radiation safety Requirements management Requirements management as a subfield of systems engineering Requirements management principles Requirements management in the licensing of nuclear installations Basic licensing process for nuclear installations Applying requirements management in the design and licensing of nuclear installations The ADLAS method Licensing of fusion facilities Licensing ITER in France Requirements management feasibility study on IFMIF-DONES electrical power system Licensing DEMO Results Fusion safety Applicability of existing nuclear regulation to fusion Benefits of requirements management in the licensing of fusion facilities Conclusions... 67

7 Units and symbols Be Beryllium C Carbon D Deuterium E energy H Hydrogen He Helium Li Lithium O Oxygen Sv Sievert (radiation dose) T Tritium W Watt (power) Wh Watt-hour (energy) e electron ev electronvolt (energy) m metre (distance) n neutron p proton s second (time) α alpha particle γ gamma radiation

8 Abbreviations ALARA As Low As Reasonably Achievable AS Accelerator System ASN Autorité de Sûreté Nucléaire, French nuclear safety authority BDBA Beyond Design Basis Accident DBA Design Basis Accident DEC Design Extension Condition DEMO DEMOnstration Power Station DONES Demo-Oriented NEutron Source EMP Electromagnetic Pump EPS Electrical Power System FSAR Final Safety Analysis Report FPP Fusion Power Plant GHG Greenhouse Gas HLW High-Level Waste HX Heat Exchanger IAEA International Atomic Energy Agency IFMIF International Fusion Materials Irradiation Facility ILW-LL Intermediate Level Long Lived Waste ILW-SL Intermediate Level Short Lived Waste IPCC Intergovernmental Panel on Climate Change IRSN Institut de Radioprotection et de Sûreté Nucléaire, French Institute for Radiological Protection and Nuclear Safety ISOE International System on Occupational Exposure ITER International Thermonuclear Experimental Reactor JET Joint European Torus fusion experiment LILW-SL Low and Intermediate Level Short Lived Waste LOCA Loss Of Coolant Accident LOFA Loss Of Flow Accident LOVA Loss Of Vacuum Accident LS Lithium System NPP Nuclear Power Plant NPT Treaty on the Non-Proliferation of Nuclear Weapons (Non- Proliferation Treaty) PFC Plasma-Facing Components PSAR Preliminary Safety Analysis Report PWR Pressurized Water Reactor SAM Severe Accident Management SEAFP Safety and Environmental Assessment of Fusion Power SEIF Safety and Environmental Impact of Fusion SIC Safety Important Components SSC Systems, Structures, and Components TS Test Systems VLLW Very Low-Level Waste VVER Vodo-Vodyanoi Energetichesky Reaktor, (Водо-водяной энергетический реактор), Water-Water Power Reactor, Soviet/Russian PWR design

9 1 1 Introduction 1.1 Energy production and energy policy Conventional energy production has primarily been based on the burning of fossil fuels, such as coal, oil, and natural gas, and biomass, where energy is released through chemical reactions between fuel molecules and oxygen, i.e. combustion. The main products of combustion of fuels are carbon dioxide (CO2) and water vapor (H2O). Energy is released in the form of heat. The chemical reaction of burning octane (C8H18), the main compound in gasoline, is presented in Equation C 8 H O 2 16CO H 2 O + energy (1.1) Combustion of carbon-based fuels for energy releases CO2 to the atmosphere. CO2 is a greenhouse gas (GHG), meaning that when in the atmosphere, it prevents a part of the heat from solar radiation reflected off the Earth s surface from escaping to space. This greenhouse effect keeps the Earth warm, but an increase in GHG content of the atmosphere will warm the Earth even further and result in climate change. Fossil fuels, such as oil, coal, and natural gas, all contain carbon and produce CO2 when burned. Biomass, such as woody biomass, can be used as a renewable fuel as it grows back once harvested. The argument for biomass in climate change mitigation is that the CO2 released to the atmosphere when the biomass is burned is reabsorbed as new plants grow to replace the harvested ones. Thus, there would be a balance of CO2 emitted from burning and absorption if new growth. However, once wood is burned the CO2 is released instantly and it takes decades for the carbon to be reabsorbed in growing trees. This creates an increase in atmospheric CO2 that would last for an equivalent time to what a similar tree that was felled would take to grow. A large-scale transition to firing biomass for energy would mean that there d be an increased amount of CO2 in the atmosphere from burning for many decades before its eventual absorption. An increased CO2 content in the atmosphere would most likely accelerate global warming severely at an important threshold, where all possible means need to be deployed cut carbon emissions to a fraction, zero, or even negative during a few decades. All energy production based on burning is also responsible for particulate emissions and other emissions harmful for human health. Renewable energy is a term that includes energy production from resources, such as wind, solar radiation, moving water, geothermal heat, and biomass. Wind power is electricity produced with wind turbines. Solar power can be utilized as electricity using photovoltaic cells and concentrating solar power plants or as heat with solar collectors. In hydropower plants the flow of water through a turbine is used to create electricity. Geothermal energy is heat in the Earth s crust caused by radioactive decay inside the planet and the heat from solar radiation absorbed in the crust. Unlike solar, wind, hydro, or geothermal energy, burning biomass or biofuels for energy emits carbon emissions to the atmosphere. This argument would present low-carbon energy, such solar, wind, hydro, and geothermal energy as preferable alternatives to firing biomass. Mitigating climate change to a global average temperature rise of 1.5 C will require a fast and drastic drop in greenhouse gas emissions [1]. Nuclear power plants (NPPs) are able of producing large amounts of energy with almost negligible greenhouse gas emissions. The GHG emissions from nuclear energy are comparable to those of wind power and

10 2 photovoltaics as presented in Figure 1.1 [2]. Unlike weather dependent wind and solar, nuclear power can produce stable baseload power also with extremely low emissions. This would make it an important part of future energy infrastructures along with other low-carbon energy production. Wind onshore Wind offshore Nuclear Hydro Concentrated Solar Power Geothermal Solar PV rooftop Solar PV utility Biomass dedicated Gas Combined Cycle Biomass co-firing Coal kgco 2 eq/mwh Figure 1.1 Median lifecycle greenhouse gas emissions from electricity production by different sources as CO 2 equivalent reported in the IPCC Climate Change 2014 Annex III [2]. A great deal of primary energy in societies is used for heating and transportation. The energy that s used for heating of buildings and for transportation is mostly produced by combusting fossil fuels and to some extent, biomass. Bringing the carbon emissions of heating and transportation down could arguably be done best by transitioning from combustion-based energy to electric power in these areas. The utilization of heat pumps for heating and electric vehicles for transportation powered by low-carbon electricity is a prominent path towards a climate friendly energy sector, but the transition would demand a fast and significant increase in low-carbon electricity production. History has shown, that build-up of nuclear power can transform a nation s electricity sector in a decade more than any other form of low-carbon electricity production (Figure 1.2) [3]. Nuclear has proved to be by far the most effective way to scale-up carbon-free electricity production and should thus be viewed as an important tool for the scale-up of climate and environmentally friendly energy production in the coming decades.

11 3 Figure 1.2 Average annual increase of carbon-free electricity per capita during decade of peak scale-up. The largest scale-ups per capita have been achieved with nuclear build-up during the 1970s and 80s. [3] Many of existing nuclear power plants around the world are currently at the end of their planned operating life and are in the process or already been through the process of extending their operating licenses. Nuclear capacity has stagnated in the recent years with nuclear new builds only replacing decommissioned power plants. There is a reluctance, especially in Western Europe to build new large-scale nuclear power plants despite the crucial need to bring the GHG-emissions of energy production down in order to fight climate change. The planning and construction of new nuclear power plants in Europe has proven to be challenging due to timetables and costs blowing up. International nuclear safety standards and the requirements set by national regulatory bodies have developed over the decades and the regulatory system is vastly more extensive and challenging than in the early days of the nuclear energy industry. Proving the plant s safety to the national regulatory body is a great challenge that demands vast amounts of safety analysis, documentation, and other preparatory work that need to be completed before the plant is granted a license and the actual construction can start. Each new reactor project usually needs to be individually licensed despite the same reactor type been proved to apply to safety requirements elsewhere. Each new reactor type needs to be slightly redesigned to fit a specific country s requirements as native requirements between countries are different. The costs and long schedule work, such as licensing, required before a permit for plant construction is granted has led to very large-scale power plant megaprojects with a single, very powerful rectors constructed with a single license. These projects in Europe haven proven to be difficult to manage and have experienced multiple delays and cost runoffs. The construction of Olkiluoto 3 European Pressurized water Reactor (EPR) in Finland and Hinkley Point C EPR in the United Kingdom for example have had major delays and cost runoffs. Also, it was announced in the end of 2018, that the not yet constructed Finnish Hanhikivi 1 VVER-reactor project has been delayed for four years even before construction has started because of problems in preparing the required documentation for the Finnish regulatory authority [4].

12 4 There are many possible ways of making the preparatory work of nuclear new builds easier, such as harmonizing native requirements between countries, standardizing nuclear reactor designs, or developing better licensing procedures through systems engineering, such as better requirements management [5]. However, there is no standard reactor on the horizon as multiple new reactor designs, such as Gen 3.5 and Gen 4 nuclear reactors, and Small Modular Reactors (SMRs) are currently competing for their place as the go-to future reactor concept. Rising costs, multiple delays, and the not so great public acceptance of nuclear new builds are factors that limit the utilization on nuclear power in climate change mitigation. Low-carbon forms of electricity production, solar and wind especially, are viewed to have the most potential in replacing fossil generation and some are allocating them to replace nuclear also. However, the German Energiewende, where Germany decided to transition into renewable energy and to shut down its nuclear reactors, has proven problematic as solar and wind power have not been able to replace the low-carbon nuclear capacity and overall emissions reduction target have fallen short because of the buildup of new coal power capacity. It s a popular argument, that nuclear power should be omitted in the fight against climate change because of the aforementioned cost and schedule runoffs. Renewables, such as wind and solar power, are deemed to be fast and inexpensive solutions to decarbonizing the energy sector making nuclear power obsolete. Climate scientist tend to disagree with this sentiment, proclaiming that added capacity of nuclear power, along with renewable low-carbon energy, is necessary for bringing down the global carbon emissions of energy production [1]. However, nuclear energy based on fission has problems, such as nuclear waste and nuclear accidents, which have not been definitively solved. Although great progress in the safety of nuclear reactors and in waste handling and final deposition of spent fuel has been made, fission still contains risks which cannot be fully omitted. In the future, nuclear fusion can replace fission s role as a low-carbon, environmentally friendly source of almost unlimited energy. The risk of a nuclear accident as we know it isn t present in fusion power plants because of fusion s intrinsic safety features. 1.2 Nuclear energy Nuclear energy production is significantly different from conventional energy production since it generates energy from nuclear reactions rather than chemical reactions. The chemical reaction of the combustion of gasoline (octane) in Equation 1.1 produces 94 ev of energy per molecule of octane, which translates to ca. 40 MJ/kg of specific energy i.e. energy density [6, p. 22, 29]. When this energy is divided among the 102 atoms involved in the combustion reaction, the energy is ca. 0.9 ev per atom [6, p 22, 29]. For comparison, splitting or fission of one uranium-235 atom generates ca. 200 MeV or 82 TJ/kg depending on the end products of the fission reaction [7]. This means that the energy gain from uranium-235 is ca. 2 million times the energy from combustion of gasoline per unit of mass. The energy content of one kg of fusion fuel consisting of two isotopes of hydrogen, deuterium and tritium, however is 338 TJ, which is the same as the energy content of 8450 tonnes of gasoline [6, p ]. However, nuclear energy production involves the presence of radioactive material in larger quantities than in any other context. Radioactive material emits ionizing radiation, which is harmful to human health and for the environment. The workers in nuclear power plants may be exposed radiation even during normal operation and nuclear accidents can spread

13 5 radioactive material to the environment, endanger the health of humans, and contaminate water and food supplies. [8, p. 90] Fission Nuclear energy has been based on producing heat from the splitting of atoms, the fission reaction. In fission reactions, a heavy atom nucleus, such as a uranium-235 nucleus, absorbs a neutron and is split into two smaller nuclei, i.e. fission products. The reaction also emits new neutrons, which initiate new fission reactions in the nuclear fuel. This is process is called the nuclear chain reaction. In order for the chain reaction to uphold a stable supply of energy, every fission reaction should produce one neutron which initiates another fission in the fuel [8, p. 28]. A fission reaction creates two or three neutrons, so if the number of neutrons that initiate a new fission reaction more than one, the chain reaction will increase in power, and if less than one, the chain reaction will seize [8, p. 28]. A continuous increase in fission power could lead to a loss of control over the reaction called a reactivity accident, where the energy created in the reaction can damage the reactor and lead to a nuclear accident [8, p. 55]. This is why the reactivity of the fission reaction needs to be controlled with precision. The heat created in the fission reaction originates from the kinetic energy of the fission products interacting with their surrounding matter. The heat is utilized to generate steam that drives a turbo generator, as in a conventional condensing power plant. A fission nuclear reactor can be shut down by injecting control rods or borated water into the reactor, which absorb the fission neutrons and stop the chain reaction [8, p. 58]. Shutting down the reactor will bring its power to a few percent of the heat power during normal operation [8, p. 40]. This heat originates from the fission products in the fuel that will keep decaying radioactively and producing heat known as decay heat. However, the decay heat power is still enough to damage the fuel and even create a meltdown, if the removal of decay heat is not carried out by decay heat removal systems [8, p ]. Decay heat accidents can result in a release of radioactive material such as fission products, to the environment. These kind of releases from the reactor need to be stopped from spreading to the environment, because they are detrimental to human health and can contaminate large areas and food crops etc. If radioactive material would leak from the reactor, it is confined in an air and pressure tight containment building that would serve as the ultimate confinement of the possible radioactive releases from the reactor [8, p. 97]. The aforementioned three aspects, controlling reactivity, removing decay heat, and confining radioactive releases, from the fundamentals of nuclear safety in fission power plants Fusion When fission splits atoms into smaller parts, fusion combines small atoms into a larger one. Slow thermonuclear fusion is already the source of almost all our energy on Earth, as it s the fundamental phenomenon that power our Sun. In the Sun, hydrogen nuclei fuse under huge pressure and temperature created by the Sun s huge gravitational forces, to form heavier nuclei [9]. The thermonuclear fusion in the Sun occurs, because of the abundance of hydrogen fuel, the high temperature and density inside the Sun, and the generous confinement time the hydrogen nuclei spent inside the Sun. A controlled thermonuclear fusion also requires an extremely high temperature, a dense enough mass of fusion fuel, and a long enough confinement time to allow for fusion to happen [10, p. 1384]. The fusion fuel is in the plasma phase, which means in the form of gas heated to a high enough temperature that the electrons of the atoms escape the nucleuses of the atoms and the gas becomes

14 6 ionized. Confining the plasma for a long enough time in a great enough density is key to achieving a controlled fusion reaction, which can be used for energy production. Foreseeable fusion devices will mainly be fueled with a mix of deuterium and tritium, which are isotopes of hydrogen, or pure deuterium [6, p. 16]. Fuel for the fusion reaction is abundant and global deuterium reserves for fusion energy production would last for approximately 2 billion years at the current rate of energy consumption [6, p. 16]. Deuterium-tritium fusion is easier to achieve than pure deuterium fusion but requires an isotope of lithium, lithium-6, which would limit its possibilities to approximately years [6, p. 17]. Like fission power, fusion power doesn t emit GHGs from its operation. However, fusion is much safer than fission power since, as a result of the intrinsic safety features of fusion, the risk of meltdown or a runaway chain reaction is impossible [6, p. 16]. When in a conventional fission reactor, the amount of nuclear fuel inside the reactor at any moment is several tens of tonnes of uranium fuel, the fusion fuel inside the fusion reactor is measured in a few grams [6, p. 17], [8, p. 26]. The fuel inside a fission reactor is enough for several years of energy production and could in a worst case scenario be damaged in a meltdown and release radioactive material to the environment [6, p. 17]. The few grams of fuel inside a fusion reactor at any moment of operation is only enough to power the reaction for a few seconds, so if something would go wrong, the reaction would completely die out instantly [9, p. 16]. Fusion doesn t create long lived highly radioactive waste, such as the spent nuclear fuel created by fission reactors, yet less dangerous radioactive waste is still created from deuterium-tritium fusion in the form of tritiated and neutron activated materials, which result from materials being in contract with tritium fuel and the high-energy neutrons from the fusion reaction interacting with surrounding materials [11]. Fusion without the presence of radioactive materials, such as tritium or neutrons which activate materials is also possible, although harder to achieve, and fusion power plants operating based on such reactions have zero risk of any nuclear accidents making then fundamentally different from the nuclear energy production we have today. The non-proliferation aspects would also favor fusion over fission, as fusion doesn t involve nuclear material, such as uranium or plutonium which could be used to form a nuclear device, in any form. Research into harnessing fusion for energy production has been going on since the 1950s, but despite over 60 years of scientific research and engineering, commercial fusion electricity is still at least decades away. Harnessing fusion for energy production is arguably the most scientifically and technically challenging task humanity has ever undertaken. The development work requires enormous financial and technical resources. The development of fission power can be viewed as a byproduct of the Manhattan project to produce a nuclear bomb during World War II and later the arms race between the United States of America and the Soviet Union [8, p. 12]. It can be argued, the nuclear power as we know it today wouldn t exist without the extraordinary efforts carried out during that time. Fusion power however hasn t had the controversial benefit of almost unlimited resources of superpowers competing against each other but is carried out gradually though international co-operation. The International Thermonuclear Experimental Reactor (ITER), which is currently under construction in France, is a fine example of this. 1.3 Fusion roadmap The joint European efforts toward the realization of fusion electricity have been coordinated until the year 2013 by the European Fusion Development Agreement (EFDA) and later from the year 2014 onwards by its follower, the EUROfusion consortium as part of the European

15 7 Union s Horizon 2020 research and innovation programme [12]. The European roadmap for the realization of fusion energy is based on three key facilities. The main project is the construction and future operation of the ITER facility, which is to be used for testing the technology and materials for a future fusion demonstration power station (DEMO), which would serve as an example for future commercial fusion power plants [13]. An additional materials testing facility, the International Fusion Materials Irradiation Facility Demo- Oriented NEutron Source (IFMIF-DONES) will also be constructed and used in the validating process for materials that will be used in DEMO [13]. The European fusion efforts are based on the tokamak-type magnetic confinement fusion reactor design, in which the plasma is magnetically confined into a toroidal shape inside the similarly shaped fusion reactor. The Joint European Torus experimental fusion reactor (JET), located in the Culham Centre for Fusion Energy in the United Kingdom, is the world s largest operational magnetic confinement device and has produced small quantities of fusion energy from a deuteriumtritium plasma [13]. It s has served as a foundation for ITER design and is being used to test and validate the technologies and materials to be used in ITER [13]. The roadmap from JET to ITER and to DEMO through materials testing and validation (IFMIF-DONES) and finally to commercial fusion power plants is illustrated in Figure 1.3. Figure 1.3 The path from ITER to DEMO and finally to a commercial power plant EUROfusion/Culham Centre for Fusion Energy [14] ITER The ITER facility will be used for demonstrating the generation of fusion energy on a grand scale and for the testing and development of fusion technologies [13]. ITER will not be a fusion power plant as it will not generate electricity, but a fusion reactor that will demonstrate the generation of fusion energy and will be used for research that is aimed at building a fully functional fusion power station, DEMO [13]. ITER is currently under construction in Cadarache in southern France (Figure 1.4), and it s scheduled to begin operation in 2025 with a first plasma consisting of pure deuterium [12]. The high-power phase when ITER will operate with a deuterium-tritium plasma will begin in 2035 [12]. It will be the world s first magnetic confinement fusion device to produce a net gain of energy [12]. It will have a fusion gain factor of Q=10, meaning that it will produce ten times more energy as is required

16 8 for its operation [13]. It will produce 500 MW of heat power from 50 MW of injected power [13]. ITER is the most important facility of the early stages of the European roadmap toward fusion energy [12]. Its main goals are the demonstration of net power production through fusion plasma pulses lasting 400 seconds and to test the operation technologies required for DEMO, such as the divertor that s used for excess heat extraction from the fusion plasma, the tritium system that creates tritium fuel for the fuel cycle, and the effects of neutron irradiation on materials that have been developed to withstand the high neutron flux of a fusion reactor [12]. ITER has been licensed in France and the licensing process has confirmed the safety benefits of fusion [13]. The licensing process has also pointed out areas that need to be focused of in the licensing of a future fusion power station, such as DEMO [12]. Figure 1.4 ITER is currently under construction in Cadarache, France. The fusion reactor will be located within the round shape of the concrete bioshield in the middle of the image. ITER Organization/EJF Riche, 2018 [15] DEMO DEMO is intended to demonstrate operation fusion power station that generates electricity to the commercial grid (Figure 1.5) [13]. The goals of DEMO are to produce net electricity of a few hundred megawatts to the commercial grid, breed tritium to achieve a closed, selfsufficient fuel cycle, and to achieve a high availability factor while demonstrating the technologies needed for future fusion power plants [13]. DEMO should start operations in the 2050s, but its schedule is highly dependent of the success of ITER [12]. The main areas of research needed for DEMO are the excess heat exhaust from the reactor, neutron resistant materials, and tritium breeding and tritium self-sufficiency [13]. DEMO would be a major step for fusion energy, as it would integrate fusion electricity to the grid. Additionally, the licensing process of DEMO as a fusion power plant will also provide valuable experience on the safety of fusion as a means of electricity production and function as an example for the safety design and licensing of future fusion power plants. Figure 1.5 shows a schematic

17 9 of a future fusion power plant, such as DEMO. Deuterium and tritium form a fusion plasma inside the reactor. The fusion neutrons are utilized in breeding tritium from lithium-6 in the tritium breeding system. The heat from the fusion reaction is used to heat a coolant to a high temperature, which is then used to create steam from water in a steam generator. The steam drives a turbo generator which generates electricity to the grid. Figure 1.5 A schematic of a fusion power plant. [16] IFMIF-DONES The International Fusion Materials Irradiation Facility- Demo-Oriented NEutron Source (IFMIF-DONES) will be used for irradiating the materials needed for DEMO with neutrons that have a similar energy as the neutrons that are produced in a fusion reactor [13]. The facility is needed to simulate the conditions materials are exposed to in a fusion reactor. Knowing the effects of intense neutron irradiation on the materials is necessary for the safety design, licensing, and construction of a fusion power plant [17]. The neutrons created in IFMIF-DONES will have an energy distribution similar to that of neutrons from a deuteriumtritium fusion reactor and are created from a Li(d, xn) reaction, where a deuterium nucleus interacts with a lithium-7 atom and strips neutrons from it [17]. The main parts the IFMIF- DONES facility consists of are a linear accelerator, a lithium loop, and a test module, which holds the irradiated test subject [17]. The deuterium nuclei are accelerated with the linear accelerator and are collided into a flowing liquid lithium target where the neutron stripping reaction takes place [17]. The high energy neutrons created in the reaction then interact with the material test samples located immediately behind the lithium target [17]. The created neutron flux simulates the irradiation conditions of a fusion power reactor where the materials affected by high energy neutrons experience degradation [17]. Knowledge of the effects of neutron irradiation under fusion-like conditions on the structural integrity of fusion power plant materials has to be gained before the design of DEMO can be finished and its construction can start [13]. 1.4 Thesis purpose and methods The thesis was done under commission from the Finnish utility Fortum as a part of a research and development programme related to the company s nuclear regulation requirements management and licensing tool ADLAS. The thesis was mainly conducted as a literary review of fusion development and safety, nuclear regulation and nuclear safety requirements, and requirements management, but also involved a feasibility study on the application of requirements management and licensing principles on the IFMIF-DONES -facility. One purpose of the thesis in cooperation with the feasibility study was to support the introduction of ADLAS to the European efforts on fusion energy, particularly the EUROfusion

18 consortium. Different studies on the safety of fusion were reviewed and analyzed. Literature and standards on requirements engineering were reviewed to find the main requirements management procedures that could be used to support the licensing of nuclear and fusion power plants. The current nuclear regulation was analyzed to find its correspondence with the safety issues recognized in the studies on the safety of fusion. Existing studies on the applicability of fission regulation on fusion power plants were used to compliment the findings. Different ways to improve the licensing process of nuclear power plants were reviewed. Recommendations on the licensing of fusion facilities were made based on these findings. 10

19 11 2 Theory of fusion energy production 2.1 The fusion reaction Nuclear reactions are more likely to happen with elements at the two ends of the atomic mass spectrum, i.e. light and heavy elements [6, p. 29]. The binding energy, the forces that keep the nuclides of an atom s nucleus together, of light elements at the left end of the binding energy curve (Figure 2.1) and heavy elements at the right end is lower than that of the intermediate elements at the central part of the curve. Binding energy can be expressed as the difference between the measured mass of an atom and the sum of the masses of the protons and neutrons in the atom. The mass difference exist because some of the atom s mass is converted to binding energy between the nucleons of the atom according to the massenergy equivalence equation (Equation 2.1), where E B is the binding energy between the nucleons in an atom, Δm is the mass difference between the calculated mass of nucleons of the atom and the measured mass of the atom, and c is the speed of light in vacuum. E B = Δmc 2 (2.1) Nuclear reactions break and re-arrange bonds between the nucleons of the nuclei. Therefore, it s easier to initiate nuclear reactions with elements at the two ends of the atomic mass spectrum, where the binding energy per nucleon is at its smallest. In fission, e.g. a uranium- 235 atom interacting with a neutron can split into a xenon-140 atom, a strontium-94 atom, and two neutrons. The fission products, xenon-140 and strontium-94, are located higher and left of uranium-235 on the binding energy curve. A Fusion reaction is a nuclear reaction, where the nuclei of two light atoms located on the left end of the binding energy curve fuse into each other. The resulting nucleus is located higher and right of the fusing elements on the binding energy curve. Figure 2.1 The binding energy curve of nuclear reactions [6, p. 30]. A stands for the mass number of the nuclei and E B is the binding energy between the nucleons in a nuclide. E B is lowest with elements with lowest and highest A and highest with iron-56. In both fusion and fission reactions, the end product or products are located higher on the binding energy curve and have a higher binding energy that the original atom or atoms meaning the they are more strongly bound together [6, p. 31]. The energy released in a nuclear reaction originates from a mass difference between the start and end products of the reaction or i.e. the difference between the sum of binding energies of the start product nucleon or nucleons and the binding energy of the end product or products. The difference

20 12 in mass is converted to energy according to the mass-energy equivalence and is released as kinetic energy of the end product or products. 2.2 Deuterium tritium fusion There are three different isotopes of hydrogen, hydrogen-1 (H), deuterium, and tritium. Hydrogen-1 is the most common isotope covering 0,99985% of natural hydrogen [6]. The rest of natural hydrogen is deuterium, 2 H [6]. Tritium, 3 H, is a radioactive isotope of hydrogen that doesn t exist in nature [6]. Deuterium (D) exists in nature in small quantities, one of every 6700 hydrogen atoms being deuterium [6]. While the nucleus of the most common isotope of hydrogen, 1 H, consists of one proton, deuterium, has one neutron and one proton. Deuterium is a stable isotope meaning it s not radioactive. However, the twoneutron plus one proton isotope of hydrogen, tritium (T), is radioactive and has a half-life of approximately 12.3 years. [6, p ]. Deuterium-Tritium fusion, i.e. D T fusion, is the easiest fusion reaction to initiate compared to other possible alternatives for fusion energy production, such as D D and D 3 He fusion [6, p. 27]. The reaction products of D-T fusion are one α (alpha) particle and one neutron (n) (Equation 2.2). D(T, α)n (2.2) The α particle is a helium nucleus with two neutrons and two protons, i.e. a helium-4 ion. Along with the α particle and the neutron, the D-T fusion reaction releases 17.6 MeV of energy (Equation 2.3) [6, p. 28]. D + T α + n MeV (2.3) The energy released in the fusion reaction originates from the difference between the binding energies of the end product, the α particle, and the sum of the binding energies of D and T and is released in the form of kinetic energy, divided between the two end products according to an inverse of mass, i.e. the lighter product has more kinetic energy [6, p. 28]. The α particle is ca. four times heavier than the neutron, and receives 3.5 MeV of kinetic energy, while the neutron receives 14.1 MeV (Equation 2.4). D + T α(3.5 MeV) + n (14.1 MeV) (2.4) The D and T nuclei are positively charged and are confined in the plasma inside the fusion reactor. α particles are positively charged ions, so they are also confined in the electromagnetic field of the plasma vessel and don t escape the plasma. α particles are slowed down and release their energy while inside the plasma as heat and thus contribute to the heating of the fusion plasma [9, p. 17]. Neutrons do not have an electrical charge and aren t affected by the electromagnetic field. The neutrons escape the plasma and hit the inside parts of the vacuum vessel. The fusion neutrons release their energy by interacting with the inner parts of the vacuum vessel and produce heat that would be used for energy production in a fusion power plant.

21 13 The T used in the fusion reaction needs to be produced artificially, as it doesn t exist in nature [6, p. 17]. Ideally, to achieve a self-sustaining fusion reaction, the T should be produced in the fusion reactor itself. This can be achieved by breeding T with reactions between the fusion neutrons and lithium-6 located in a tritium breeding blanket at on the inside walls of the vacuum vessel [6, p. 17]. Lithium-6, i.e. 6 Li, is a non-radioactive isotope of lithium and accounts for 7.4% of natural lithium, the rest of lithium being 7 Li [6, p. 28]. Breeding tritium from 7 Li is also possible, but harder to initiate [6, p. 28]. Equation 2.5 shows the tritium breeding reaction for 6 Li. 6 Li receives a neutron and splits into an α particle and a T nucleus. The reaction also creates 4.8 MeV of energy. 6 Li + n α + T MeVe (2.5) These reactions form the basis for a self-sustaining fusion fuel cycle, where the neutrons created in a D-T fusion are used to breed more T from 6 Li in the reactor s breeding blanket. Figure 2.2 illustrates the fusion fuel cycle. Figure 2.2 The fusion fuel cycle [13]. Deuterium and tritium fuse together to create a helium-4 nucleus and a high-energy neutron. The neutron is utilized in a breeding blanket to breed tritium from lithium-6. The tritium created in the breeding blanket is used to fuel and maintain the fusion reaction. 2.3 Fusion reactor concepts In order to produce energy from thermonuclear fusion, three parameters need to be correct, fusion fuel density, plasma confinement time, and plasma temperature. Equation 2.6 shows the fusion triple product, n representing fusion fuel density in particles per m 3, T the plasma temperature in kev, and τ E the plasma energy confinement time in seconds [9, p. 34]. ntτ E (2.6) The triple product is a figure of merit used in fusion research that can be used to compare the achievements of different fusion experiments. Advancement in increasing each of the three factors the triple product increases and the fusion reaction can be made more efficient in producing energy. Different paths to achieving the goal of producing usable energy from controlled thermonuclear fusion reactions have been explored since the last few decades.

22 14 The main challenges of producing fusion energy can be summed up in trying to achieve advancements in increasing the fusion triple product via focusing on its different factors. The most notable fusion concepts can be divided on the factor of how the plasma is confined to achieve a desired particle density in a suitable plasma temperature. The plasma can be confined either magnetically by imposing strong electromagnetic fields on it, or inertially, where the fuel is compressed primarily by exposing it to a high power laser or a particle beam [9, p. 27]. Magnetic confinement fusion is a more mature technology than inertial confinement fusion and it s considered a more viable way to achieve controlled fusion energy production at a commercial scale. In magnetic confinement fusion the high temperature plasma is confined by strong magnetic fields in a steady state for long periods of time. [9, p. 26] The most notable magnetic confinement fusion reactor design is the tokamak-type reactor, where the plasma is confined inside a torus shaped vacuum vessel which is surrounded by powerful electromagnets. A toroidal magnetic field is created with a set of toroidal magnetic field coils running on the outside of the toroidally shaped vacuum vessel. The toroidal magnetic field is complimented with a set of poloidal magnetic field coils which create a toroidal current in the plasma and stabilize it away from the walls of the vacuum vessel. The central solenoid is responsible for initiating and sustaining a plasma current for the duration of the reactor s fusion sequences. The different magnet systems of a tokamak are illustrated in Figure 2.3. [9, p ] Figure 2.3 The plasma is confined inside the vacuum vessel away from its walls and stabilized by a strong electromagnetic field created with a set of toroidal and poloidal magnetic field coils and a central solenoid. [9, p. 28]

23 15 The fusion reaction and the fusion fuel cycle specific to magnetically confined fusion is described in the previous chapter. The divertor is a device inside the vacuum vessel which is intended to make contact with the plasma and is used to exhaust excess heat, impurities, and the helium ash created in D-T fusion from the plasma [9, p. 31]. The divertor helps to keep the conditions inside the plasma favorable for fusion to take place. Figure 2.4 shows the interior of the JET reactor fitted with material similar to that which will be used in ITER [13]. Figure 2.4 Split image showing an interior view of the JET vacuum vessel, with a superimposed image of an actual JET plasma taken with a visible light camera. Only the cold edges of the plasma can be seen, since the centre is so hot that it radiates only in the ultra-violet part of the spectrum. The image shows the donut shape of the vacuum vessel, which is engulfed by the D-shaped toroidal field coils. EUROfusion [18] Electric power production of a tokamak fusion power plant is described in chapter and illustrated in Figure 1.5. In short, the heat generated by the fusion reaction would heat a coolant and the coolant s heat would be used to generate steam in a steam generator to drive a turbine and a generator which would generate electricity. The cycle has similarities with the way power is generated in a PWR nuclear reactor. Tokamaks utilizing D-T fusion will have to deal with the neutrons generated from the D-T fusion reaction, which make the reactor materials radioactive and activate the coolant. This created issues with nuclear safety that are shared with the current forms of nuclear energy, fission. Inertial confinement fusion works in a pulsed fashion by compressing a small fusion fuel pellet with a high-power laser or particle beam to a very high density. The fuel is compressed to a high density as the inertia of the outside layer of the pellet exploding outwards from the intense heating effect of the beam compresses the round pellet from all sides. This process heats the fuel pellet partially to a temperature required for fusion. Net energy is created for a fraction of a second before the pellet disintegrates in micro-explosions. This process is repeated at a frequency of a few Hz and each process can create up to 400 MJ of energy. This would correspond to a fusion power of several hundreds of megawatts. [9, p ] Inertial confinement fusion is considered less promising than magnetic confinement fusion because of the larger amounts of energy required to achieve fusion. The high-power lasers

24 or particle beams require large amounts of energy and have low driver conversion efficiencies. Inertial confinement fusion devices would need a fusion gain factor of to achieve net electric power production, which makes it very challenging compared to the prospects of magnetically confined fusion. [9, p. 27] 16

25 17 3 Nuclear safety and regulation 3.1 Safety of nuclear power plants and facilities The nuclear industry, as all other industries, needs to maintain high standards of safety for workers, public, and the environment. This includes, but is not limited to, work related injuries and accidents and possible toxic emissions harmful to people and the environment, such as chemical emissions. As all methods of energy production nuclear energy has its own advantages and disadvantages. However, the nuclear industry receives unparalleled attention due to the presence of radiation and large amounts of radioactive material and the possible release of radioactive material into the environment in case of a nuclear accident. These create unique risks to human health and the environment, which are not present in other industrial activities and energy production methods at such scale. The International Atomic Energy Agency (IAEA), an international organization created in 1957, is the main body of international co-operation in the nuclear field. The IAEA has two main tasks. Firstly, it both monitors the international efforts for non-proliferation and upholds the international nuclear non-proliferation treaty. Its second task is to promote the peaceful and safe use of nuclear energy and radiation by means of nuclear safety recommendations, nuclear research, and the exchange of knowledge and experience. It s important to note, that The IAEA doesn t have regulatory control over the use of nuclear energy but gives recommendations for national nuclear regulatory authorities. The IAEA is an independent organization which functions under the United Nations. [19], [8, p ] Though the IAEA is a prestigious international organization that focuses of nuclear safety, each state is responsible for the creation and implementation of national nuclear legislation and regulation [20]. The nuclear legal and regulatory hierarchy (Figure 3.1) flows down from nuclear and radiation law to regulation and to regulatory guides [20]. It is the responsibility of the national governments to issue laws and statutes that form the legal framework for the utilization of nuclear energy and radiation [20]. The government should also establish a regulatory body as the legal authority on nuclear and radiation safety [20]. The regulatory body develops and implements the policies needed to ensure the safe use of nuclear energy and radiation [20]. The regulatory body establishes or adopts administrative and technical regulation that the users of nuclear energy and radiation are obligated to follow and creates guides on how to comply with the requirements [20]. The IAEA s glossary on nuclear safety related terms [21] defines nuclear safety as: The achievement of proper operating conditions, prevention of accidents, or mitigation of accident consequences, resulting in protection of workers, the public, and the environment from undue radiation hazards. Nuclear safety measures are needed to decrease the risk nuclear power plants pose to individuals, society, and the environment to the level of already accepted industrial activity [22]. When nuclear safety is achieved, the radiation hazard from nuclear power plants to human health and the environment is smaller or comparable to the risks posed by competing forms of electricity production [22]. Determining and comparing the risks requires the implementation of risk analysis [22].

26 18 Figure 3.1 The nuclear legal and regulatory hierarchy pyramid [23]. Preventing the radiation hazard from nuclear power plants means that the radioactive material present at the plant needs to be confined from the surrounding environment at all times [24]. Accidental releases of radioactivity within the plant and to the environment during operation, refueling, and during other operations need to be prevented [24]. Operating nuclear power plants release minuscule amounts of radioactive material to the environment mostly in the form of gaseous effluents originating from the nuclear fuel. The gases are normally confined inside the fuel rods between the fuel and the cladding but are released if a rod develops a small leak. A small portion of these effluents is released to air by ventilation of the plant. Liquid releases to a suitable water body, such as the natural cooling water source, during normal operation originate from water leaks in plant processes. Gaseous and liquid effluents released to the environment during normal operation have been purified and delayed minimizing the concentrations and harmful effects radioactive material. These releases are considered part of the normal operation of the power plant and do not pose a hazard to the local population or the environment. Releases to the environment are kept so small that the radioactive doses of locals living in the vicinity of nuclear power plants can t be differentiated the radiation dose received by individuals from other sources, such as natural background radiation. [8, p ], [24, p ] lähde sekä Workers at nuclear power plants are exposed to radiation mainly when working close to or in contact with plant processes containing radioactive materials. Radiation exposure happens externally in the form of electromagnetic gamma (γ) radiation or internally as radioactive material may find its way inside a person through ingestion or inhalation. Most of the radiation dose received by workers is external gamma radiation received from radioactive corrosion products within of the coolant loop that have been activated in the reactor s neutron flux. Short lived, highly radioactive activation products, such as 16 N and 19 O, only pose a radiation risk during the operation of the reactor since their radioactivity decays moments after they leave the reactor s neutron flux. The coolant loop may also include fission products that have leaked from the reactor s damaged fuel rods. The activated

27 19 particles may deposit on the insides of the coolant loop. Working with or close to the reactor coolant loop exposes workers to gamma radiation. Internal radiation dose may originate from surface or air contamination by radioactive material. Contamination may originate from opening plant systems containing radioactive material for maintenance or possible leaks of gaseous or liquid radioactive material. Controlling the amount of activation products in the coolant loop is essential for protecting plant workers from radiation exposure and is done by utilizing corrosion and activation resistant materials, water chemistry measures, and with coolant clean-up systems. [8, p ] A failure in a single safety system preventing or mitigating an accident cannot be allowed to cause the accident to escalate and harm people or the environment. In the concept of defence in depth, single failures in safety systems are mitigated by utilizing multiple successive levels of protection. If one level of protection fails, there should still be enough levels of protection to mitigate the accident. The levels of defence in depth should also be different enough, so that for example flooding couldn t disable multiple levels at a single time. There are five levels of defence in depth, which range from the prevention and control of abnormal operation and failures all the way to mitigating the consequences of large radioactive releases to the environment. [25] The design of safety features in nuclear power plants is based on the requirement to prevent postulated accidents and mitigate possible severe accidents so that their effects on the public and the environment is within acceptable limits [24, p. 681]. Accident conditions taken into account in the plant design are defined through conservative (pessimistic) assumptions, such as expecting safety system failures, including large safety margins, and overestimating the consequences of postulated accidents [26]. Conservative design leads to the plant being designed to be capable of handling highly improbable and more severe accident conditions than would be expected if the assumptions were based on best estimate methodology [26], [24, p. 681]. Conservative assumptions contribute to the safety of the plant, but too exaggerated assumptions may create economical and operational issues as applying the requirements set by these assumptions can e.g. require elaborate additional safety features and create unnecessary limits for plant operations. If there is not adequate data on which to design plant systems, conservative assumptions are used to be on the safe side and to avoid underestimating possibilities of failures and accidents. As improved safety compared to fission is one of the driving forces behind fusion energy, it s important to focus on safety aspects early in the development of fusion devices and fusion programmes. Nuclear safety cannot be achieved with just technical solutions, such as developing more and more reliable safety systems, but the decision making and behavior of the people working at nuclear power plants and on their design also needs to be addressed. Safety culture is a concept which addresses the policies and attitudes towards safety individuals and organizations have. Its purpose is to ensure that factors affecting nuclear safety are given the necessary attention and that they are prioritized in decision making [22]. Maintaining a high level of safety should be prioritized above financial costs and nuclear safety should be kept as high as achievable by reasonable means. When possible, safety should be improved continuously to further improve nuclear safety and to avoid stagnation and the misconception that safety is already passable.

28 20 With the very limited operational experience gained from experimental fusion devices, such as the JET in the United Kingdom, and no existing fusion power plants it s necessary to use conservative estimates especially in the design of safety features. However, avoiding overly conservative assumptions in the early design of fusion power plants is important since they may create too stringent requirements for safety. Nuclear power plants operate with a level of risk to society which is accepted and outweighed by the benefits and there shouldn t be a compelling reason to limit the risk from fusion power below that of the best NPPs of today. Fusion poses a lower risk to society because of its intrinsic safety features, low radioactive inventories, and no production of highly active long-lived radioactive waste [13]. Additionally, the need for evacuation of local population in the worst fusion accident has been deemed unnecessary [13]. Achieving the same level of safety to the public as with NPPs could function as a baseline for fusion safety, but a higher level of safety is expected. Using overly conservative assumptions in the early design of future fusion power plants could backfire undermining future possibilities by creating additional obstacles for the deployment of fusion power. 3.2 Nuclear non-proliferation Nuclear proliferation means the spread of nuclear weapons and the spread of nuclear material and technologies that can be used in the manufacturing of nuclear weapons. Nuclear material comprises substances containing uranium, plutonium, or thorium that can be used in the manufacturing of nuclear weapons [8, p. 322]. The international nuclear non-proliferation treaty, or the Treaty on the Non-Proliferation of Nuclear Weapons (NPT) prohibits states that possess nuclear weapons from passing on nuclear weapons to other parties or to help other parties to acquire nuclear weapons [27]. More prominently, it prohibits states not in the possession of nuclear weapons to receive or manufacture nuclear weapons [27]. Nonnuclear weapon states accept safeguards, which are measures established and conducted by the IAEA to verify that states follow their agreements on using nuclear energy only for peaceful purposes and not to produce, divert, or use nuclear material for nuclear weapons [27]. The first nuclear reactors were originally developed for the production of plutonium from uranium for use in nuclear weapons [8, p. 41]. The power reactors of today that have been developed for peaceful purposes still have the functionality of producing plutonium-239 from uranium-238 and thus monitoring the activities at nuclear reactors is needed to verify that the facilities are used only for legal purposes. The IAEA enforces the safeguards by monitoring the nuclear activities within states and verifying that the states are following their legal agreements concerning the use of nuclear technology [28]. The IAEA s safeguards approach is implemented as follows: 1. Collection and evaluation of safeguards-relevant information 2. Development of a safeguards approach for a State 3. Planning, conducting and evaluating safeguards activities 4. Drawing of Safeguards conclusions [28] The IAEA reviews and evaluates information about a state s nuclear programme [28]. The information the IAEA processes may be provided by the state itself, it may originate from field verification activities by the IAEA, and it may be acquired or received from other

29 21 sources [28]. Most of the information the IAEA uses for applying safeguards are the reports and documents states are obligated to provide concerning their nuclear activities, such as nuclear material accounting and transfers, and design information of nuclear facilities [28]. The IAEA safeguards review process then evaluates how this information hold up to other information collected and takes necessary actions to address possible problems [28]. Developing a safeguards approach for a state means that the IAEA analyzes ways how a specific state could acquire nuclear material and develops or chooses suitable safeguards to monitor these pathways [28]. Field safeguards activities allow the IAEA to determine if a state is following its safeguards obligations [28]. The safeguards inspections in the field can be in the form of nuclear material accounting procedures verifying the validity of the amount of nuclear material, design inspections verifying that the facility matches the design information the IAEA has been provided and isn t used for illicit purposes, and environmental analysis looking for trace amounts of nuclear material that could indicate that the facility has been used for undeclared operations [28]. After completing safeguards activities, evaluating safeguards information, and addressing possible problems, the IAEA draws conclusions on whether a state abides by the safeguards obligations i.e. if diversion on nuclear material from peaceful purposes or undeclared nuclear material was found [28]. Until this day, unlike fission power and research reactors, fusion reactors have not been subject to the safeguards because they don t use or include any of the nuclear material controlled under the IAEA safeguards. However, the presence of tritium and lithium-6, materials needed for thermonuclear weapons, and fast neutrons that may be used to breed fissile material, create other proliferation risks [11]. The proliferation risks of fusion are further discussed in chapter The International Atomic Energy Agency s (IAEA) Safety Standards The IAEA has created Safety Standards as a set of nuclear regulation recommendations for the use of nuclear facilities and radiation sources to protect people and the environment from the harmful effects of radiation [26]. The Standards aren t legally binding and nuclear regulation is under the responsibility of each state, but the Standards are highly regarded and provide a solid basis for and help to facilitate the implementation of national nuclear safety regulatory frameworks [8, p. 365]. The IAEA Safety Standards comprise following hierarchy levels, the Safety Fundamentals, Safety Requirements, and Safety Guides [26]. The Safety Fundamentals represent the highest level of hierarchy and include the basis for nuclear and radiation safety measures and for the Safety Requirements [26]. The Safety Requirements include general and specific requirements that must be met for the realization of nuclear safety [26]. The Safety Guides provide guidance on following the Safety Requirements and recommended best practices for achieving nuclear safety [26]. The Safety Standards hierarchy is illustrated in Figure 3.2. The Safety Standards concerning nuclear power have been developed over decades of international co-operation for ensuring the safety of fission power plants.

30 22 Figure 3.2 Overview of the IAEA Safety Standards Hierarchy. The Safety Standards comprise the Safety Fundamentals, Safety Requirements, and Safety Guides. Illustration by author based on [29] Safety Fundamentals The Safety Fundamentals consist of the Fundamental Safety Objective and of 10 Fundamental Safety Principles [30]. The objectives state what needs to be achieved and the principles ways to achieve these objectives. The Fundamental Safety Objective is stated as follows; The Fundamental Safety Objective is to protect people and the environment from harmful effects of ionizing radiation. [30] As radioactivity is a natural phenomenon, not all exposure to ionizing radiation can be avoided. It should be expressed, that the objective of protecting people and the environment has to be achieved without excessively restricting the use nuclear facilities or ionizing radiation, and similarly, the operation of nuclear facilities needs to be as safe as reasonably achievable, without unduly restricting the use of nuclear energy [30].

31 23 The Fundamental Safety Objective states three measures that need to be enforced for the safety object to realize; a) To control the radiation exposure of people and the release of radioactive material to the environment; b) To restrict the likelihood of events that might lead to a loss of control over a nuclear reactor core, nuclear chain reaction, radioactive source or any other source of radiation; c) To mitigate the consequences of such events if they were to occur. [30] These are the fundamental points of nuclear safety in the nuclear energy industry and apply to all stages of a nuclear power plant s lifetime, from planning to operation and finally decommissioning, including the transport of radioactive material and the management of spent nuclear fuel [30]. Point a) of the objective covers the radiation doses of workers in nuclear facilities and planned radioactive releases to the environment. Point b) plays a major role in the design of nuclear power plants and nuclear facilities. Nuclear power plants need to be designed reduce the risk of accidents to a minimum, some of which might have severe consequences for human health and the environment. The most serious safety issues of nuclear energy are related to the possible release of radioactivity from the fission fuel to the environment. Most notably, the cooling of the reactor core needs to be achieved in conditions following an emergency shut down of the nuclear reactor to prevent the core from melting due to decay heat generation which could result in the release of radioactive material. Future fusion reactors utilizing the D-T fuel will contain radioactive material in the form of activation products and tritium, the release of which to the environment needs to be prevented. c) If and when accidents were to occur, their consequences will need to be mitigated to reduce their impact on the plant, people, and the environment. Defence in depth is a method of creating consecutive barriers for the spreading of radioactive material. The differentiation of these barriers will ensure that a single initiating event or failure mode couldn't compromise the confinement of radioactivity. The management of severe accidents is used to mitigate the conditions and consequences of nuclear accidents. The Fundamental Safety Objective forms the basis for ten Fundamental Safety Principles. The Fundamental Safety Principles are presented in Table 3.1. The Fundamental Safety Objective and the Fundamental Safety Principles cover the responsibilities and safety issues of the use of radioactivity. The IAEA requirement Radiation Protection and Safety of Radiation Sources states principles 4, 5, 6, and 10 to be the key principles for radiation protection [31]. These principles concern the justification, optimization, and protecting individuals from radiation risks aspects in the use of radiation. The justification of nuclear facilities and activities means that the use of radiation must yield an overall benefit, i.e. the benefits from the use of radiation to individuals and society must be greater than its detrimental effects [30]. In the case of nuclear energy this can be expressed so that the benefits from affordable low

32 24 pollution and low carbon energy to society outweigh the adverse effects of small radiation doses to workers and risk of a nuclear accident. Fusion energy has the same benefits but lacks the possibility of severe accidents where the public would need to be evacuated [32]. Considering this aspect of fusion energy, fusion would yield a greater overall benefit than fission energy. Optimization of protection means that measures need to be taken for minimizing the radiation risks imposed to workers and the public without unduly limiting the use of radiation [30]. This principle encompasses an important principle in use of the nuclear industry, ALARA. The exposure of workers and radioactive emissions to the environment during normal operation need to be kept As Low As Reasonably Achievable (ALARA), economic and social factors being taken into account [21]. Table 3.1 The Fundamental Safety Principles [30]. The Fundamental Safety Principles form the basis for Safety Requirements. # Safety Principle Description 1 Responsibility for safety 2 Role of government Leadership and management for safety Justification of facilities and activities Optimization of protection Limitation of risks to individuals Protection of present and future generations 8 Prevention of accidents 9 10 Emergency preparedness and response Protective actions to reduce existing or unregulated radiation risks The prime responsibility for safety must rest with the person or organization responsible for facilities and activities that give rise to radiation risks. An effective legal and governmental framework for safety, including an independent regulatory body, must be established and sustained. Effective leadership and management for safety must be established and sustained in organizations concerned with, and facilities and activities that give rise to, radiation risks. Facilities and activities that give rise to radiation risks must yield and overall benefit. Protection must be optimized to provide the highest level of safety that can be reasonably achieved. Measures for controlling radiation risks must ensure that no individual bears an unacceptable risk or harm. People and the environment, present and future, must be protected against radiation risks. All practical efforts must be made to prevent and mitigate nuclear or radiation risks. Arrangements must be made for emergency preparedness and response for nuclear or radiation incidents. Protective actions to reduce existing or unregulated radiation risks must be justified and optimized Safety Requirements The IAEA Safety Requirements are set to ensure the protection of people and the environment from the harmful effects of ionizing radiation [26]. The Safety Requirements are a collection of requirements that need to be fulfilled to ensure the realization of the

33 25 Fundamental Safety Objective and Fundamental Safety Principles stated in the IAEA Safety Fundamentals (chapter 3.3.1) [26]. The Safety Requirements are designed to function as a basis for national regulatory frameworks. The requirements are presented as shall statements, as in: Requirement 1: Responsibilities in the management of safety in plant design An applicant for a licence to construct and/or operate a nuclear power plant shall be responsible for ensuring that the design submitted to the regulatory body meets all applicable safety requirements. [26] The Safety of Nuclear Power Plants: Design SSR-2/1 (Rev. 1) is a specific safety requirements document which contains specific safety requirements for the design of structures, systems, and components of nuclear power plants. The document also contains requirements for procedures and organizational processes important to safety. The purpose of those the requirements in the document is to help ensure safe operation, prevent accidents, and mitigate the consequences of possible accidents. [26] The Safety of Nuclear Power Plants: Design -requirements document contains some of the most important requirements for ensuring nuclear safety of fission power plants. Nuclear power plant is a term synonymous to fission power plant. As fusion power plants, such as DEMO, can be considered having major similarities with nuclear power plants as they produce energy from nuclear reactions and contain large amounts of radioactive materials, it s important to investigate what the requirements for traditional fission power plants are. These requirements, when modified, could also function as requirements for future fusion power plants. This chapter discusses some of the most important the fission specific nuclear safety requirements. The relevance of these requirements of fusion is discussed in chapter 5. Requirement 4 of the Safety of Nuclear Power Plants: Design -requirements document states requirement for three fundamental safety functions of a nuclear power plant. These functions are listed as; (i) control of reactivity; (ii) removal of decay heat from the reactor and fuel store; and (iii) confinement of radioactive material, shielding against radiation and control of planned radioactive releases, as well as limitation of accidental radioactive releases. [26] Control of reactivity When a nuclear reactor is critical the chain reaction rate and the reactor s power are stable. If the chain reaction decreases in power the reactor is subcritical and if the reaction rate increases the reactor is supercritical. Reactivity is a departure from criticality to either subcriticality or supercriticality. When the reactor is being shut down or its power is lowered, it s made subcritical and during start up or a power increase, it s made supercritical so that the chain reaction rate and the reactor s power would increase to a desired level. [8, p ] A reactivity accident is a situation where the control of reactivity is lost, and the reactor unintentionally becomes highly supercritical. This causes a sudden and large increase in heat power which can damage the fuel and cladding resulting in a release of fission products to

34 26 the reactor coolant which may lead to releases of radioactive material to the environment. The risk of a reactivity accident in modern reactors is small compared to other risks, such as a meltdown from a loss of coolant accident. Reactivity is controlled by manipulating the neutron flux of the reactor by the injection or retraction of neutron absorbing control rods into the fuel matrix or by injecting neutron absorbing boron containing water into the reactor. [8, p. 55] Modern nuclear reactors are designed so that negative feedbacks in the reactor mitigate the sudden increases in power and the possible effects of malfunctions in the reactor s control systems on reactivity are only minor. [8, p. 39] Removal of decay heat When a nuclear reactor is shut down by the injection of control rods into the fuel matrix, the chain reaction in the fuel stops. However, the radioactive decay of fission products resulting from the chain reaction in the fuel keeps releasing thermal energy. This heat is only a small fraction of the heat that is created during the normal operation of the fission reactor, but it s still enough to cause severe problems if it s not removed effectively. The decay heat can damage the fuel and result in the release if radioactivity in the form of fission products. In a worst-case scenario, the heat can build up to the point that the fuel, fuel rod cladding, and the reactor material melt, resulting in the infamous nuclear melt down. In a meltdown gaseous radioactive material is released into the confinement of the nuclear reactor. If the confinement is lost, radioactive material is released to the environment. [8, p ] Dedicated heat removal systems are in place for the removal of decay heat after the reactor is shut down. Emergency core cooling systems are in place in case of a loss of coolant accident, where the normal cooling of the reactor is compromised because of a leak in the cooling system. Emergency core cooling systems supply the reactor core with enough water to keep it from overheating. Emergency core cooling systems are the most important safety function in nuclear power plants and their functionality needs to be ensured. This is done by incorporating multiple parallel subsystems each capable of cooling the core in case of a loss of coolant. This creates redundancy in the emergency core cooling, which means that the core can be cooled even if some of the emergency systems fail. A total loss in decay heat removal for a long period of time will ultimately lead to a meltdown of the reactor core, which releases large amounts of fission products. These releases need to be confined from the environment. [8, p ] Confinement of radioactive material, shielding, and radioactive releases The radioactive material present at the nuclear reactor and inside the reactor core needs to be prevented from entering the environment. The radiation risk posed by NPPs to people and the environment is caused almost entirely by the possible release of fission products originating from the nuclear fuel. Nuclear accidents with a nuclear reactor or a spent fuel storage could result in the release of large amounts of fission products and pose a risk to people and the environment. Prevention of the accidents which could result in these kinds of consequences is greatest priority in nuclear safety engineering. [8, p. 39] However, if fission products are released, their possible spreading to the environment must be prevented. The containment building is an airtight structure surrounding the reactor intended to constrain the spreading of radioactive material outside the reactor building. The

35 27 integrity of the containment building in postulated accident conditions needs to be ensured. [8, p. 61] The workers at nuclear power plants need to be protected from radiation sources, such as the reactor, reactor cooling systems, radioactive wastes, and spent fuel. This can be achieved by shielding the workers from radioactive systems and components with walls or temporary radiation shielding during maintenance etc. [8, p. 151]. Apart from the radioactive releases caused by nuclear accidents, nuclear power plants release miniscule amounts of radioactive material to the environment during normal operation. These releases need to be constrained to a level that doesn t endanger the health of people or harm the environment. [8, p. 85] Safety Guides The Safety Guides give advice and recommendation on how to comply with the Safety Requirements and principles [26]. The Safety Guides strive to reflect the international best practices for achieving nuclear safety [26]. The recommendations provide both generic guidance on enhancing nuclear and radiation safety and specific guidance on applying the principles of nuclear and radiation safety and recommendations on fulfilling the Safety Requirements [26]. IAEA s Safety Guides function as examples for the safety guides issued by national regulatory authorities. The Finnish nuclear regulatory guides (YVL guides) issued by the Radiation and Nuclear Safety Authority of Finland function as guides and requirements for the nuclear energy industry in Finland. 3.4 Plant states Plant states are different modes that the NPP is designed to function in. Plant states are partitioned in two as operational states and accident conditions (Figure 3.3). Operational states cover normal operation, which includes normal electricity production, outages, maintenance, etc., and anticipated operational occurrences, which include events that aren t part of the normal operation of the plant, but neither have affect nuclear safety as accident conditions do. These are design specific postulated initiating events that are likely to happen in a plant s lifetime that make the power plant deviate from normal operation, the production of electricity, but aren t severe enough to be classified as accident conditions. Accident conditions deviations from the NPPs normal operation that are more severe and less likely to happen in the lifetime of a plant than anticipated operational occurrences. [26]

36 28 Figure 3.3 Plant states before the introduction of Design Extension Conditions (DECs) [33]. Design basis accidents (DBAs) are possible accident scenarios resulting from postulated initiating events which the plant safety design can prevent or mitigate so that the accident poses none or only minor radiological risk either onsite or offsite and there s no need to protect the local population from any hazard [26]. In the case of a DBA the plant s safety systems are designed to return the plant to a safe state [26]. An example DBA for a nuclear power plant is a loss of coolant accident (LOCA) in which the cooling of the reactor core is compromised creating a risk for core damage or melting and large radiological releases. A LOCA can be initiated by a break in the reactor coolant system piping. A break in the largest pipe of the reactor coolant system is used as basis for the design of the emergency core cooling systems of modern NPPs [8, p. 171]. Severe accident management, beyond design basis accidents Very unlikely accident scenarios caused by multiple failures or with possible severe consequences not included in the design basis accidents of the plant have been called Beyond Design Basis Accidents BDBA [22]. These kinds of severe accidents could cause a loss of cooling to the core and lead to fuel damage and large radioactive releases [22]. In case of a severe accident, Severe Accident Management (SAM) systems and procedures are required to prevent the progress and mitigate the consequences of such accidents [22]. SAM systems and procedures are designed to halt the progress of postulated severe accidents and to bring the plant to a controlled state [22]. Controlled state is explained in chapter 3.1. Controlled state after a severe reactor accident is defined in the Finnish nuclear energy law as: a state where the removal of decay heat from the remains of the reactor core and from the containment building is secured, the temperature of the remains of the reactor core is stable or decreasing, the remains of the reactor core are in a form where they don t pose a danger of recriticality, and no notable amounts of fission products are being released from the remains of the reactor core [34]. The objective mentions a target frequency for severe core damage below 10-4 events per year and that future power plants utilizing modern state of the art safety features would reduce the frequency tenfold to 10-5 events per year [22]. Design extension conditions Nowadays, plant design is required to include effective prevention and mitigation measures for accidents not included in design basis and which before were referred to as beyond design

37 29 basis accidents. BDBA conditions are now commonly referred to as Design Extension Conditions (DEC), which include foreseeable accident conditions with or without fuel damage and in which the release of radioactive material is kept within acceptable limits using accident mitigation measures, such as SAM (Figure 3.4). [21] DECs are mentioned Requirement 20 of the IAEA Requirements document Safety of Nuclear Power Plants: Design [26] as: Postulated accident conditions that are not considered for design basis accidents, but that are considered in the design process for the facility in accordance with best estimate methodology, and for which releases of radioactive material are kept within acceptable limits. Figure 3.4 Plant states introduced in the IAEAs requirements document SSR-2/1 published in 2012 [35].

38 30 4 Safety issues recognized in fusion 4.1 Fusion safety research Most of the safety studies on fusion energy have been conducted on the safety magnetically confined fusion reactor concepts and have ben related to the ITER- and DEMO-projects. Despite the intrinsic safety features of fusion and its fundamental difference with fission, there are still shared, and unique risks involved with fusion energy compared to fission power plants. The Safety and Environmental Assessment of Fusion Power (SEAFP) was a series of studies conducted within the European Union s Commission s Fusion Programme and by other parties during years [11]. The SEAFP-report was published in 1995 (SEAFPreport) [11]. The SEAFP studies focused on the safety aspects of two different conceptual tokamak type magnetic fusion power plant designs, Model 1 and Model 2 both with 3000 MW fusion power from D-T reactions [11]. The assessments were done using conservative assumptions to achieve results that would create sturdy basis for future decisions regarding fusion [11]. The design of both conceptual power plant models based on the database used for the design of ITER [11]. Main differences between the two models were that Model 1 utilized vanadium alloy structures for components near the plasma, lithium ceramic pebbles for tritium breeding, and helium coolant [11]. Model 2 was based around a less ambitious design and utilized technologies and materials that existed or were foreseeable in the near future [11]. Model 2 utilized reduced activation martensitic steel as structural material, lithium-lead alloy as a tritium breeder, and water as coolant [11]. The Safety and Environmental Impact of Fusion (SEIF) -report is a summary report on the SEAFP-1 and a series its subsequent studies [32]. The SEIF-report includes results from safety studies with two hypothetical fusion reactor types, helium-cooled MINERVA-H and water-cooled MINERVA-W [32]. Apart from the coolant, the main difference between these reactor designs is the breeding blanket design as MINERVA-H employed a pebble-bed blanket and MINERVA-W a liquid lithium-lead blanket [32]. A few other designs were studied alongside the two MINERVA models but in less detail and included more advanced materials chosen to find if there were additional safety and environmental advantages to be gained [32]. 4.2 Exposure to radiation during normal operation The SEAFP-report includes occupational (radiation) dose estimates for the two different fusion power plant designs [11]. The estimates presented in Table 4.1 show the distribution of occupational (radiation) exposure to radiation between tritium and activation products Model 1 and Model 2 plant designs and indicates that occupational exposure is almost entirely due to activation products in the coolant [11]. The studies estimated a collective occupational dose of 0.2 mansv/year for helium cooled Model 1 and up to 15 mansv/year for the water-cooled Model 2 design [11]. The occupational dose estimates for Model 2 originated almost in its entirety from activated steel corrosion products from the coolant loop [11]. This dose estimate is very high because of a lack of data from fusion operating experience that lead to conservative assumptions in the calculations [11]. The calculations didn t include water-chemistry measures or non-corroding pipe linings in high neutron flux sections of the coolant loop for reducing the presence of activation [11]. The report suggested that the measures would have significantly reduced worker exposure [11]. A study implicates

39 31 that the occupational exposure from the coolant loop at the helium-cooled Model 1 reactor could be reduced to 0.13 mansv/year by reasonable means [36]. Table 4.1 Occupational collective dose estimates from the two different plant designs in SEAFP [10]. Occupational dose [mansv/year] Model 1 Model 2 Tritium Activation products Total In the SEIF-report, results from simulations with two hypothetical fusion reactor types, helium-cooled MINERVA-H and water-cooled MINERVA-W, were included [32]. The helium-cooled MINERVA-H showed estimated collective occupational doses for workers of about 0.2 mansv/year [32]. The report states that this collective dose is similar to or lower than the doses gained from operating modern PWRs [32]. According to a report of the International System on Occupational Exposure (ISOE) programme, the average collective dose for operating PWRs in 16 countries partaking in the programme was 0.49 mansv/year in year 2014 [37]. Average collective doses for other reactor types also included in the report can be seen in Table 4.2 [37]. MINERVA-W simulations showed higher doses for workers than best practices in fission power plants have been shown to result in [32]. The increased worker dose from MINERVA-W compared to MINERWA-H was mainly due to activated steel corrosion products in the coolant loop [32]. The estimated collective dose of 2 mansv/year is mainly due to activation products in the cooling water [32]. The dose would be multiple times higher without the implementation of water-chemistry measures to control the corrosion and erosion of the cooling circuits [32]. The SEIF-report indicates that the dose of 2 mansv/year could be reduced with the implementation of cooling circuit clean-up systems to reduce the presence of activation products in the coolant loops [32]. A study implicates that the occupational exposure from the coolant loop at helium- and water-cooled reactors based on Model 1 and Model 2 of the SEAFP-studies could be further reduced by reasonable means from 0.18 mansv/year (Table 4.1) to 0.13 mansv/year for the helium-cooled Model 1 and to 1.2 mansv/year for the water-cooled Model 2 design [36]. However, the study identifies additional radiation sources, such as the fusion fuel cycle, which would contribute to the radiation exposure of workers so that the overall occupational dose for Model 1 would be 0.78 mansv/year and 1.86 mansv/year for Model 2 [36]. These dose estimates are slightly higher than the average doses from fission power plants in the ISOE programme presented in Table 4.2. However, the occupational doses at nuclear power plants have decreased significantly in the last decades and the estimated doses from fusion power plants do not differ from those at fission power plants at the time the study was published [37]. Operational experience gained from operating the fusion facilities would result in optimization of radiological protection thus leading to lower doses for workers.

40 32 Table 4.2 Average collective doses from occupational exposure to radiation in different types of operating nuclear power plants. Dose data was collected from reactors in 29 countries partaking in the ISOE programme. [37] Controlling radioactivity of the coolant loop is an important part of radiation protection in fission power plants as a major part of radiation exposures are a result of activated corrosion products from corrosion in the coolant loop components, such as piping and heat exchangers, and fission products originating from leaks in the fuel rods [8, p. 147], [38]. Fusion power plants would share this as the fusion neutrons would activate the coolant similarly as the same phenomenon in fission reactors. However, fusion avoids the presence of fission products in the coolant since there s no fission fuel present at the plant. Additionally, the utilization of helium coolant in fusion reactors instead of water would practically remove coolant system corrosion and thus eliminate the presence of activated corrosion products and be a substantial improvement in terms of reducing radiation exposure from the coolant loop [36]. 4.3 Activated materials Materials become activated when neutrons created in the fusion reaction interact with surrounding components and structures [39]. Bulk of the activated materials created during a fusion reactor s operation would be located in the vacuum vessel s Plasma-Facing Components (PFCs) and the breeding blanket [11]. These parts need to be replaced periodically during the reactor s lifetime and replacement operations could pose radiation risks to personnel [11]. Structural materials in the vacuum vessel and its surroundings will also be activated but may not require handling until the plant s decommissioning [11]. In Model 1 power plant studied in the SEAFP-studies, a vanadium alloy was used as a structural material for its low activation in the reactor s neutron flux [11]. Cooling the reactor with helium instead of water avoided chemical reactions between the coolant and the reactor material [36]. This would have minimized the presence corrosion products in the coolant loop that would become radioactive in the reactor s neutron flux [36]. In Model 2 the use of water as coolant involved the presence of these activated corrosion products [36]. The activated corrosion products in the coolant loop would be responsible for a majority of occupational exposure in the Model 2 design, as shown in Table 4.1. This is a common hazard in waster cooled nuclear reactor designs, both fusion and fission. Another potential hazard is the PFCs erosion dust which has been activated and tritiated by the fusion reactions and the plasma. The dust composing mainly from beryllium and tungsten could be mobilized in postulated accidents [40] Tritiated materials Tritium in the reactor s coolant could originate from permeation from the breeding blanket to the coolant, from direct generation in the coolant by neutrons interacting with 3 He, or from

41 33 T generation in the pipe walls of the coolant system [11], [32]. Another source of unwanted T is the T found in in-vessel armor materials and dust found in the vacuum vessel [11], [32]. Tritium in the armor material beryllium is created when it interacts with fusion neutrons [11], [32]. This can become a problem when the armor material erodes into dust particles [11], [32]. Oher PFC materials would also contain T, but in much lower concentrations [11], [32]. T could of course also be found with relatively high concentrations in the components of the tritium fuel cycle [11], [32]. Structural steels, which would be in contact with the aforementioned parts, would also be contaminated with T [11], [32]. 4.4 Radioactive effluents Small amounts of gaseous and liquid radioactive effluents in the form of tritium and activation products would be released from fusion power plants to the atmosphere and water systems in normal operation [11]. Tritium effluents could be released from reactor coolant loops, the fuel cycle and tritium systems and inventories [11], [32]. In the helium-cooled Model 1 reactors of the SEAFP studies, gaseous tritium effluents originated from leakage in the reactor cooling loops and the fusion fuel cycle and liquid effluents only from the fuel systems [11]. Both gaseous and liquid tritium effluents from the water-cooled Model 2 originated from the coolant loop and fuel systems [11]. Gaseous activation product effluents in the reactor coolant loop originate from neutron sputtering from pipe walls in the heliumcooled model, where the neutrons detach atoms from the metal surface, and from corrosion and erosion product activation in the coolant of the water-cooled design of the SEAFPstudies [11]. Other sources present in both helium- and water-cooled models were direct coolant activation, cryostat shroud gas activation, and dust activation in the vacuum vessel [11]. The use of nitrogen rather than argon as the inert shroud gas in the cryostat surrounding the vacuum vessel would result in lower should gas activity [11]. Liquid activation product effluent for the helium-cooled model weren t identified and for the water-cooled design they originate from activation of corrosion and erosion products in the coolant loops mostly from steel components [11]. 4.5 Loss of coolant accident and decay heat The loss of cooling can damage the fusion reactor by resulting in the overheating of its components if the fusion plasma is not terminated [11]. The decay heat generated by the radioactive decay of activated materials in the vacuum vessel is so low, that if active decay heat removal would be lost, the heat would be removed through natural coolant circulation and coolant boil off [11]. It s also concluded that in the event of a total loss of active decay heat removal and the aforementioned natural circulation the vacuum vessel components wouldn t exceed temperatures that would result in significant damage to the vacuum vessel [11]. The SEAFP-report concludes that loss of cooling of the vacuum vessel cannot lead to a meltdown or rather a melting of the vacuum vessel structures that would damage the integrity of the vessel [11]. The accidents normally characterized as LOCA in fission power plants were divided into three subgroups in the SEAFP-studies. These were Loss Of Flow Accidents (LOFA), in-vessel LOCA, and ex-vessel LOCA [11]. A LOFA could occur if power is lost to the primary coolant circulators or primary coolant pumps or if the coolant flow is blocked [11]. If the LOFA is not detected and plasma operation is allowed to continue, the temperature of the PFCs inside the vacuum vessel will start to rise [11]. The fusion plasma is highly sensitive to impurities and will inherently shut down in a total loss of cooling scenario as the temperature of PFCs of the vacuum vessel rises so high that they

42 34 start to evaporate and interfere with the plasma [11]. The SEAFP-studies estimate that the plasma is terminated when the temperature of the PFC surfaces reaches 1000 C C. This temperature would first be achieved at the divertor, since it experiences the highest heat load from the plasma compared to other PFCs [11]. This kind of passive plasma shut-down could happen in a LOFA and ex-vessel LOCA but not in an in-vessel LOCA, because the coolant leaking to the inside of the vacuum vessel would immediately terminate the plasma [11]. In the SEAFP-report, the in-vessel LOCA is assumed to happen at one coolant loop as coolant is released to the inside of the vacuum vessel [11]. The coolant ingress would immediately shut down the plasma [11]. In an in-vessel LOCA in the helium-cooled model 1 reactor the pressure inside the vacuum vessel would rapidly rise beyond the design pressure of the vacuum vessel, as the high pressure helium flows into the vessel, and would require pressure relief [11]. In the water-cooled model 2 reactor, the ingress of coolant water to the vacuum vessel would increase the pressure inside the vacuum vessel close to or above the design pressure depending on where the break would occur [11]. 4.6 Vacuum vessel accidents Loss of vacuum (LOVA) accidents involve a break in the vacuum of the reactor vessel (or vacuum vessel) leading to air entering the inside of the vessel [11]. A LOVA doesn t have a corresponding event in the fission world as there s no corresponding component to the reactor vessel of a fusion power plant at a fission power plant. The vacuum vessel acts as the first confinement barrier for the radioactive tritium fuel component and the neutron activated dust arising from the reactor s operation. The first barrier in a fission power plant setting would be the fuel rod cladding surrounding the uranium fuel. These barriers are fundamentally different, and the vacuum vessel is highly more complex in its structure and functionality. However, they share integrity as their most important functional requirement. Tritium in the armor material and activated dust in the vacuum vessel form a greater risk than activated structural materials because of their potential high mobility [32]. Activation products in structural materials could become mobile only at very high temperatures due to melting or vaporization [32]. Calculations performed within the SEAFP and SEIF-studies show that the temperature of structural materials due to decay heat of activation products do not exceed the melting point of the materials in case of no safety system intervention or mitigating action, such as decay heat removal [32]. Highest temperatures would be reached at the plasma facing first-wall, since it is most subject to activation due to higher neutron flux compared to other structures [32]. 4.7 Confinement integrity The reactor s confinement barriers could be breached by events connected to the release of magnet energy in the form of accelerated loose objects or electric arcing and the formation of hydrogen and its possible combustion and explosion, which could create pressures that pass the confinement s design pressure [11]. Accidents including the mobilization of radioactive material within the confinement and a possible low release of radioactive material to the environment would in the worst-case accident scenario analyzed lead to doses well below the level which would require evacuation of population near the plant [32]. Dose to the most exposed individual depending on the reactor type and armor material were calculated to be as shown in Table 4.3 [32].

43 35 Table 4.3 Dose estimates to the most exposed individual of the public from worst-case accidents depending on reactor type and armor material [32]. Reactor designs with tungsten armor have a higher dose potential than beryllium armor. Tungsten armor Beryllium armor MINERVA-W 1.6 msv msv MINERVA-H 2.6 msv msv 4.8 Electromagnets and electromagnetic fields The superconducting magnet system used to confine the plasma forms a major part of the fusion reactor system. Accidents related to magnet malfunctions are unique to fusion power plants as the presence of high energy electromagnets and magnetic fields isn t present at fission power plants. The high energy electric fields and forces from the abrupt expansion of cryogenic helium used for keeping the magnets at superconducting temperature may pose risks to the integrity of the different confinement levels [32]. Accidents caused by magnet malfunctions could result in the release of radioactive materials if they damage the vacuum vessel, coolant piping, or the tritium fuel cycle etc. [32]. The spreading of the radioactive material released from these accidents to the outside of the confinement would be stopped by the confinement barriers, which couldn t be damaged by the energies present in magnet accident scenarios [32]. Loose objects accelerated by the strong electromagnetic fields of the magnet system could in theory damage the lining of the cryostat [32]. However, sudden acceleration could only be induced by large variations in the reactor s magnetic field, which are rare during normal operation [32]. Breach of the outermost confinement from accelerated objects was deemed inconceivable [32]. One of the causes for magnet related accidents is the quenching of the superconducting magnets [32]. A quench happens in a superconducting electromagnet, when the superconductivity of the magnet is lost and the elevated resistance along with the high current of the magnet system heats the magnet s conductor excessively. Quenching could in theory lead to the melting or softening of the magnet coil and cause a mechanical failure of the magnet and surrounding systems, such as the vacuum vessel [32]. However, melting and mechanical failures cause my magnet quenching were deemed unrealistic in the SEAFstudies [32]. The electric energy in the coils of the magnet system could be released as electric arcs, which could damage the systems, structures, or components to which they are discharged [32]. The electric arcs could be diverted by the magnetic fields of the coils into vacuum vessel components, possibly initiating a LOVA [32]. Preventing accidents caused by electric arcing would require arc discharge systems to protect the components at risk from arcing damage [32]. Cryogenic helium used for the cooling for the superconducting electromagnets could cause problems if released from the cryostat s multiple cooling loops [32]. The release of helium from a single loop and the expansion of the helium from that loop on the inside of the cryostat wouldn t exceed the design pressure of the cryostat and thus endanger the confinement integrity [32]. The failure of multiple loops was deemed a beyond design basis event due to its very low probability [32].

44 Chemical reactions Reactions including hydrogen were investigated in the SEAFP-studies [11]. The watercooled Model 2 reactor included the possibility of hydrogen creation from reactions with water and the armor material [11]. The creation of a few kilograms of hydrogen from these reactions could be possible [11]. However, the vacuum or inert gas environment to which the hydrogen could be released prevents combustion [11]. If in some case the hydrogen would come in contact with oxygen and combust, the explosion of just a few kilograms of hydrogen wouldn t pose a risk of containment failure [11]. In the ITER reactor, hydrogen could be formed when steam reacts with beryllium or tungsten located in the breeding blanket [40]. Hydrogen isotopes, D and T, from the fusion fuel cycle don t pose a risk for confinement integrity if they were somehow to be combusted [40]. Lithium, which is used for tritium breeding in the breeding blanket, is highly reactive with air, nitrogen, water, and concrete [11]. In the SEAFP-studies helium-cooled Model 1 power plant, the breeding blanket material used to create tritium was a Li2O ceramic pebbles [11]. Using a lithium ceramic allowed tritium breeding without the need for an additional neutron multiplier material [11]. Pure lithium in liquid metal form was also considered as a breeder as it also didn t need an additional neutron multiplier and had other favorable properties [11]. However, pure lithium is highly reactive with water and air and also reacts with nitrogen, hydrogen, and concrete and thus would have posed a high risk for lithium fires and created the need for additional safety features [11]. The lithium-lead alloy Pb-17Li (consisting of 17 parts lithium and 83 parts lead) chosen as the breeder material for Model 2 functioned both as a tritium breeder and a neutron multiplier [11]. The lithium component functioned as the breeder and the lead component has good neutron multiplying properties and thus eliminated the need for a separate neutron multiplier in the blanket [11]. The lithium-lead alloy has a significantly lower reaction rate with water than pure liquid lithium [11] External events The SEAFP-report and the following SEIF-report do not give much consideration to accidents caused by external events [11], [32]. SEAFP-report handles the case of an extremely energetic external event, such as an earthquake of hitherto unexpected magnitude [11]. Countermeasures to these kinds of external events were not included in the basis of the safety design of the model power plants analyzed in the studies [11]. In accidents caused by beyond design basis events of this magnitude almost all confinement may be lost [11]. This would lead into the maximum release of approximately 1 kg of T from the vulnerable T inventories including the fusion fuel cycle and PFCs [11]. According to the SEAFP-report, at the plant s proximity, this release would result in a maximum dose msv to the most exposed member of the public [11], [32]. In this estimate, T would be in the form of HTO, which stands for water with one of the hydrogen atoms ( 1 H) replaced with a T atom, and the release would last for an hour [11]. The SEAFP-report does not include the release of activated dust from the reactor [11] Waste management and classification Activated materials would arise from the operation of the fusion power plant when components exposed to the neutron flux of the reactor are removed and replaced, and from the decommissioning of the facility [11]. About 10% of radioactive waste from ITER would originate from the operation phase and 90% from decommissioning [39]. The radioactivity and half-life of the materials would be much lower than that of the corresponding materials

45 37 from fission power plants [11]. The most radioactive components would however need to be stored in interim storage before handling to allow their activity to decay to safer levels [11]. Waste at ITER is to be classified by French standards to Intermediate-Level Long Lived waste (ILW-LL), Low- and Intermediate-Level Short Lived waste (LILW-SL), and Very Low-Level Waste (VLLW) according the French ANDRA radioactive waste classification system [41]. The ANDRA waste classification also includes higher, more radiotoxic waste classes not applied to ITER radioactive waste, those being High-Level Waste (HLW) and Intermediate-Level Short Lived Waste (ILW-SL) [42]. The radioactive waste classes expected from ITER during its operation and later from its decommissioning are the three lowest waste classes determined for nuclear installations [42]. It s important to note, that ITER is not a fusion power plant but an experimental reactor with a lower power than a demonstration fusion power reactor or a fully developed fusion power reactor. This means that the irradiation periods and intensities are by and large lower and lead to a lower level of radioactivity in structures and components. The ITER waste that would be classified in the highest level ILW-LL would originate from the reactor s breeding blanket and divertor modules, which are the components most exposed to the high energy neutrons and tritium originating from the fusion plasma [42]. ILW-LL also arises from decommissioning of components and component replacements in the PFC related to fusion material experiments and in lower amounts from cleaning activities and various processes [42]. The vacuum vessel would be classified as LILW-SL along with wastes originating from processes, cleaning, liquid effluents, and decommissioning of components and structures [42]. VLLW would originate from the magnet system and cryostat and from maintenance operations done to various systems [42]. The bulk of the decommissioning waste would be classified as VLLW [42]. LILW-SL and VLLW originating from ITER operations would be stored in intermediate storage for ca. 50 years to allow the activity from tritium to decay to a safer level in order to allow the waste to be sent to its final repository [43]. The half-life of tritium is 12.3 years so this would lead to a tritium activity of 6% from the original level as the tritium amount would be halved approximately four times in 50 years [43]. ILW-LL and materials and components that are contaminated purely with tritium and are not activated or contaminated with activation products, i.e. purely tritiated waste, produced during ITER operation would be stored in interim storage to allow their activity to decay to a level that will allow them to be sent to Andra, the French national radioactive waste management agency [43]. The shares of different radioactive waste classes that would originate from ITER are illustrated in Figure 4.1 [39]. Detritiation of tritiated materials and components when they are decommissioned is necessary for lowering their radioactivity to acceptable limits and to minimize the costs of storage and the disposal in a final repository [11], [32]. The materials and components contaminated purely tritiated wastes are anticipated to be stored as LILW-SL after a period of radioactive decay [42]. Another motivation for detritiation procedures is tritium recovery from wastes and decommissioned materials and components in order to recycle the tritium and minimize tritium losses [11]. ILW-LL which has been both tritiated and activated would go through a detritiation process to recover the tritium [43]. This would be done mainly for economic reasons rather than reasons associated with radiation protection [43].

46 38 Purely tritiated waste; 1% ILW-LL; 10% VLLW; 56% LILW-SL; 33% Figure 4.1 Shares of Purely tritiated waste, Intermediate-Level Long Lived Waste (ILW-LL), Low- and Intermediate-Level Short Lived Waste (LILW-SL), and Very Low-Level Waste (VLLW) that are expected to originate from ITER's operation and decommissioning [39] Proliferation aspects of fusion Fusion itself doesn t pose a proliferation risk, because, unlike fission energy, it doesn t involve the use or creation of fissile or fertile material which could later be used in the manufacturing of nuclear weapons. However, proliferation is still an issue in fusion that needs to be resolved. The proliferation aspect of fusion related to the possibility of illegitimately breeding fissile material in fusion reactors and the presence of tritium and lithium-6, isotopes used in thermonuclear weapons [11]. However, activities with tritium and lithium-6 aren t under the constraints of the international non-proliferation treaty but are monitored by the IAEA [11]. The SEAFP and the SEIF-reports speculate that these activities may in the future be subjected to the nuclear non-proliferation treaty [11], [32]. The detection of illegitimate activities with fertile or fissile materials in fusion power plants is straight forward since such materials shouldn t be present at the plants in the first place, unlike in fission power plants, and their presence of would directly indicate the illicit use of the facility for the creation of fissile material [11]. This is fundamentally different than in fission facilities in which the nuclear fuel contains fissile uranium-235, fertile uranium-238, and used nuclear fuel containing also fissile plutonium-239 [8, p. 325]. The breeding of fissile material in fusion reactors could, in theory, be done by introducing fertile material, such as uranium-238 or thorium-232, to the breeding blanket where it would capture neutrons and transmute into fissile material, plutonium-239 or uranium-233 [11]. SEAFP-report [11] and a paper in to the proliferation aspects of magnetically confined fusion by Glaser and Goldston [44] mention two possible methods of breeding significant quantities of fissile material in a fusion reactor, a significant quantity being an IAEA safeguards term for a minimum amount of nuclear material needed for the manufacturing of a nuclear weapon [45]. One significant quantity of plutonium-239 or uranium-233 is 8kg [45]. One method of producing significant quantities of fissile material is to replace normal blanket modules with special modules containing fertile material and another is to introduce particles of fertile material into the coolant to absorb neutrons [11], [44]. In [44] Glaser and Goldston address

47 39 three possible scenarios where magnetically confined D-T fusion could be exploited to produce fissile material, plutonium-239 or uranium-233. The scenarios are: (1) clandestine production of weapon-usable material in an undeclared facility, (2) covert production of such material in a declared facility and (3) use of a declared facility in a breakout scenario, in which a state begins production of fissile material without concealing the effort. [44] In their study, Glaser and Goldston conclude that because of its size, power consumption, and emittance of detectable amounts of tritium and fertile and fissile materials to its environment, a fusion facility that is used to breed nuclear material couldn t be built or operated clandestinely [44]. The study covers the possibility for covert production in a declared facility by simulating the operation of a lithium-lead breeding module with fertile uranium or thorium added into the coolant [44]. The fertile material would be injected to the coolant as approximately 1mm diameter graphite coated kernels [44]. These kernels would then breed fissile material in the coolant as the reactor operated and collection the fissile material could be done by filtering the kernels out of the coolant [44]. However, introducing fertile material into the breeding blanket decreases the blanket s tritium breeding rate and increases the heat load in the blanket from fission reactions initiated by neutron capture of uranium or thorium atoms as they decay into their corresponding fissile isotopes [44]. To put this more clearly, the uranium or thorium in the coolant would steal neutrons that would otherwise contribute to tritium breeding reactions in the breeding blanket and the additional heat from the nuclear reactions would destabilize the fusion reactor s heat balance. The simulations showed the limiting factor for using uranium-238 to breed plutonium-239 is the additional heat load from the fission reactions [44]. The drop in tritium breeding rate was partly compensated by the neutron production from fast fission reactions in the uranium as the additional neutrons would help boost the tritium breeding rate in the blanket [44]. The additional heat load needs to be compensated by operating the reactor at a significantly reduced fusion power, which according to the authors may not be possible [44]. On the other hand, the simulations showed that using thorium-232 in the blanket wouldn t create as high an additional heat load but would decrease the blanket s tritium breeding capabilities as it absorbs neutrons that would otherwise be absorbed in tritium breeding reactions [44]. Thus, the limiting factor for thorium would be the reactors tritium breeding rate, as the reactor needs to create tritium to fuel its own operation [44]. The breakout scenario is addressed by postulating that a rogue state that denounces its non-proliferation agreements and expels international inspectors uses the aforementioned method for breeding fissile material in a fusion reactor [44]. Making modifications to the reactor to enable the use of kernels of fertile material would take at least around one month, the authors presume [44]. Another method would be replacing a blanket module with a module containing fertile material during a reactor outage and extracting it during another outage [44]. The existence of test blanket module ports, such as in ITER for materials testing, could be exploited for inserting fertile material blanket modules into the reactor [44]. The study finds that the time needed to produce significant amounts of fissile material after breakout would be 1 to 2 months [44]. Discovering covert operations with illegitimate materials in fusion reactors could be done by various means. If the nuclear material has been injected into the lithium-lead coolant, its gamma radiation could be detected [44]. Injection and extraction systems for the nuclear

48 material could also be looked for in the plant [44]. Ultimately, the inspectors could sample the coolant for traces of nuclear material. If the nuclear material has been introduced into the reactor as a solid in special breeder blanket modules, sampling the material during operation wouldn t be possible and detection would need to be done on the input and output of the reactor facility, possibly by making gamma or neutron radiation measurements on the material traffic [44]. Since no fertile or fissile materials should be present at fusion facilities at all, the illicit presence of such materials can be found by making environmental radiological measurements in the plant s vicinity [44]. If a breakout of nuclear material manufacturing is found to be happening in some nation, the international community would have time to react diplomatically and ultimately the facility could be disabled with military means by targeting the various auxiliary systems without a significant risk of breaching the confinement and releasing radioactivity to the environment [44]. All in all, the authors state that fusion has a lower proliferation risk when compared with fission but propose that further research would need to be carried out to define the adequacy of current IAEA safeguards measures for future fusion facilities [44]. 40

49 41 5 Applying nuclear regulation to fusion facilities 5.1 Fundamental safety functions Despite the fundamental differences of fission and fusion nuclear energy production, such as the amount of radioactive material present at the facility and the radiotoxicity of the radioactive material released in possible accidents, fission and fusion power plants share some of the same risks which could be regulated with the existing nuclear safety regulation. Some existing nuclear regulation could apply directly to future fusion power plants, but fusion s intrinsic safety features, low energies, and the miniscule amount of radioactive material compared to fission would make some regulation not appropriate as it wouldn t consider the fundamental differences in fusion advantage. This would make transferring existing nuclear to directly apply to fusion power plants impracticable and adapting them to consider fusion or creating new regulation must be done before a legal basis for commercial fusion energy production can be established. The Fundamental Safety Functions form the backbone of international nuclear safety regulation. The functions are described in detail in chapter However, they address the main safety issues of fission which are far less significant if not non-existent in fusion Control of reactivity Fission nuclear reactors contain several tens of tonnes of uranium fuel all of which is located inside the reactor core during the operation with additional fuel in the pools of the reactor building. Reactivity excursion, where the chain reaction gets out of control and produces extra heat, could damage the fuel and result in the emission of fission products. The intrinsic safety features of fusion make reactivity excursion or similar events impossible. The fusion plasma inside the vacuum vessel only has a few grams of fusion fuel at a time, which is only enough for a couple of minutes of energy production. The reaction also requires very specific conditions in terms of confinement, density, temperature etc. If these conditions are disrupted by an unwanted increase in fusion power the plasma would become unstable and terminate instantly. Interaction with the first wall of the vacuum vessel would also create impurities to enter the plasma and terminate it. These intrinsic safety features make accidents resulting from reaction rate excursions impossible in fusion power plants. However, transient plasma instabilities may damage the vacuum vessel, which acts as the first confinement barrier for the tritium and activated dust inside the reactor. Controlling these disruptions and preventing them from damaging the integrity of the vacuum vessel is necessary to ensure nuclear safety in fusion power plants. The materials activated by the fusion neutrons or the spent fuel, helium-4, cannot initiate or sustain a chain reaction. [46] The inability to shut down the fusion reactor isn t that great a risk as the fusion reaction would run out of fuel shortly if the fuel supply can be stopped and because the unwanted increase in fusion power or a loss of cooling of the first wall would terminate the plasma as impurities would enter the plasma [46]. In conclusion, the Fundamental Safety Function of the control of reactivity wouldn t be applicable to fusion power plants.

50 Removal of decay heat When a fission reactor is shut down and the chain reaction stops, the fuel will still generate thermal power corresponding to ca. one percent of the thermal power produced by the reactor during normal operation. This heat is the result of radioactive decay of the fission products in the fuel produced by the chain reaction. If cooling of the fuel is not carried out after reactor shut down the buildup of decay heat will result in the temperature of the fuel becoming so high that the fuel can be damaged and release fission products. In a worst case the reactor can be damaged by melting fuel assemblies. A complete failure in the removal of decay heat could result in a loss of confinement and large radioactive releases to the environment. Fusion neutrons from D-T fusion activate the first wall materials of the fusion reactor. As the highly irradiated materials that have experienced long term irradiation decay radioactively, they release decay heat. This heat builds up in the walls of the fusion reactor and causes their temperature to increase significantly which could damage the integrity of the vacuum vessel. The decay heat of the PFCs inside the vacuum vessel is estimated to be about 0.6% of the fusion power. However, the decay heat power is spread out in a much larger volume of the vacuum vessel compared to the fuel rods of a fission reactor. Analyses have indicated that the temperature of the walls wouldn t surpass the melting point of the materials if active cooling is lost. [46] Yet, it cannot be definitively said that the requirement for the removal of decay heat doesn t apply to fusion power plants. Fusion power reactors are still in such an early stage of development that material choices, neutron fluxes, and plasma durations etc. could still affect the rate of activation in the first wall area and decay heat powers could rise to levels, which would need active cooling. The ensuring of the removal of decay heat from the vacuum vessel with active or passive cooling is required to secure that the integrity of the vacuum vessel isn t damaged by decay heat. If it can be proven that decay heat doesn t endanger nuclear safety, the requirement could be less stringent than with NPPs. [46] Confinement of radioactive material In fission power plants the nuclear fuel is confined from the environment behind multiple barriers which would need to fail before the radioactive material could escape to the environment. The confinement barriers include the ceramic fuel pellet, the fuel rod cladding, the reactor vessel and the primary circuit, and the containment building. In addition to this, the defence in depth principle includes safety functions present to prevent and mitigate accidents which could endanger the integrity of these barriers. In fusion power plants the fuel is in gaseous form and isn t itself a containment barrier. The first confinement barrier in FPPs is the vacuum vessel, which would compare the fuel rod cladding in NPPs. Tritium exists outside the vacuum vessel in the fusion fuel cycle and possible leaks need to be mitigated. These other systems would also function as a first barrier since they are outside the vacuum vessel and contain radioactive material [46]. Different detritiation systems need to be introduced to remove tritium from the air of the buildings if it escapes [46]. The containment building would function as the second confinement barrier [46]. However, the cryostat surrounding the vacuum vessel could also form a pressure tight barrier around the vacuum vessel and function as a confinement barrier resulting in three levels of barriers [11].

51 43 Although the radiological consequences of worst case FPP accidents are several magnitudes lower than those of NPPs and aren t deemed to require evacuation of the public, the confinement integrity of all barriers has to be ensured in the case of postulated accidents [32]. The workers in FPPs need to be protected from tritium and activation products. The criteria for the requirement of confinement of radioactive material are also relevant in the case of FPPs [46]. 5.2 Fusion requirements conclusions As fusion power plants are still a thing of the future there are no operational experiences to base safety requirements on. Experimental reactors like JET and ITER have some similarities to future fusion power plant concepts, but the scale of their operations is much smaller. The D-T fusion pulses of 400 seconds producing 500 MW of thermal power intended to take place in ITER create very different conditions for the vacuum vessel compared to DEMO which would have a few times more fusion power and continuous plasma pulses. The neutron irradiation of the vacuum vessel would be much greater and activate more material which would generate more decay heat [12]. Fission regulation has largely been developed on the operational experiences gained throughout the decades. Such experience has not yet been gained in fusion. FPPs will include many new technologies and materials, such as liquid metals, 14 MeV neutrons, and powerful magnets and magnetic fields, which don t exist in NPPs. The phenomena involved in using these technologies creates new risks which may have to be mitigated with new fusion specific safety regulation. The Fundamental Safety Functions which govern the safety design of NPPs aren t wholly applicable to FPPs. Reactivity is not an issue with FPPs because of the intrinsic shut down feature of the plasma. However, plasma instabilities could somewhat damage the first barrier, the vacuum vessel. Decay heat on the other hand exists in FPPs and needs to be considered in the design. The possible consequences of decay heat related vacuum vessel accidents are very minor compared to melt downs of NPPs. The requirement for decay heat removal would have to somewhat modified to consider the more benign nature of fusion accidents compared to fission. The requirement for the confinement of radioactive material from the environment is universal and applies directly to FPPs. Fusion power plants will also produce intermediate- and low-level radioactive waste and will have to adhere to existing regulation concerning radioactive waste handling and disposal.

52 44 6 IFMIF-DONES 6.1 The IFMIF-DONES facility The IFMIF-DONES abbreviation comes from International Fusion Materials Irradiation Facility Demo Oriented NEutron Source. Alongside with ITER, the IFMIF-DONES facility is an important part on the path to the demonstration fusion power plant DEMO. The main function of the facility is to produce neutron irradiated samples of the different materials planned for use in DEMO. The material samples are irradiated with neutrons, which will have an energy similar to those released in a D-T fusion reaction inside a fusion reactor. The properties of the irradiated materials are to be tested in a laboratory. This testing is crucial for the licensing of future fusion reactors as the materials used need to be proven to withstand the high neutron flux and high temperature conditions of the insides of a fusion reactor. IFMIF-DONES will be used to validate the materials that will be used in a fusion power plant. The validation of materials is crucial for safety and for acquiring a license from the national nuclear regulatory authority when the project of building DEMO begins. [47] IFMIF-DONES will comprise three main systems or facilities, those being the Accelerator System, the Test System, and the Lithium Target System (Figure 6.1). The facility will share many similarities with fusion reactors as it involves 14 MeV neutrons, liquid lithium, tritium, and highly neutron irradiated materials. In addition to IFMIF s research object as an irradiation facility, experience gained from the aforementioned similarities could be used with ITER and DEMO. It s suggested that IFMIF-DONES will be built in Granada, Spain. Figure 6.1 Systems in the IFMIF-facility. [48] 6.2 Accelerator System The Accelerator System (AS) will house one linear particle accelerator, which will be used to accelerate deuterium ions, deuterons. The deuterons will collide with the lithium target and create neutrons with energies similar to those created in D-T fusion. The accelerator is a linear accelerator and produces a continuous 125 ma 40 MeV deuteron beam. The

53 45 acceleration of deuterons is staged by multiple systems contributing to the acceleration of the particles. [47] The accelerator is located inside a vacuum. The deuteron beam is focused to have a crosssection of 100 mm 50 mm to 200 mm 50 mm as it collides with the lithium target. A prototype of the accelerator has been built and tested in Rokkasho, Japan. The deuteron beam is powerful and could damage its target under the wrong conditions. If for example the lithium target has been compromised, the beam will be guided to a beam dump that will absorb its energy and mitigate the heat damage and radiation that would result from an uncontrolled beam. [48] 6.3 Lithium Target System The Lithium Target System (LS) comprises a target system, a heat removal system, and an impurity control system. The main function of the LS is to deliver a liquid lithium target for the deuteron beam. The target system is located inside the test cell, where the test samples are irradiated. At the beam s target, a liquid lithium jet will flow on the surface of a concave backplate exposed to the vacuum of the accelerator facility. The inertia of the lithium flowing fast of a concave surface will prevent it from evaporating despite the vacuum and the heat it receives from the beam. The flow of lithium is achieved with an electromagnetic pump (EMP). The energy absorbed in the lithium from the deuteron beam heats the lithium. Excess heat is removed with the heat removal system, which comprises three heat exchangers (HX). Heat is removed from the lithium loop by the primary HX and transferred to the secondary loop and from there to the tertiary loop through the secondary HX, both loops containing heat transfer oil as the fluid to avoid unwanted reactions with lithium and water. The tertiary HX transfers the heat to the plant s cooling water system. An impurity control system will monitor the impurities and removes them from the liquid lithium. A fraction of the liquid lithium will be guided to the impurity control system during operation to maintain a desired level of purity in the lithium. [48] 6.4 Test System The Test System (TS) includes test cell which houses the test modules and some of the lithium system s components. The test module is located behind the beam target and houses the different irradiation test subjects. The neutrons used for the irradiation of test samples are created inside the test cell, where the deuterons and the lithium atoms undergo a neutron stripping reaction. The deuterons interact with lithium atoms and strip neutrons from them as depicted in Equation 6.1. [48] Li(D, xn) (6.1) The test cell has thick concrete walls to protect the surroundings from the high energy neutrons generated in the stripping nuclear reaction. The samples in the test modules are heated to temperatures ranging from 250 to 550 C to simulate the temperatures the materials would experience inside a fusion reactor. The neutron flux and high temperatures replicate the conditions inside DEMO. [48] 6.5 Radiation safety IFMIF-DONES will include radioactive material and neutron irradiation and will require an emphasis on radiation safety. The deuteron beam and the created neutrons will lead to the

54 creation of radioactive byproducts, such as tritium, beryllium, and argon. Workers will also have to protected from direct neutron radiation. Radiation safety has been included in the design of the facility to protect the workers, people, and the environment from radiation. As IFMIF-DONES is a radiation facility it will have to follow national radiation and nuclear regulation and to be granted a license by the national regulatory authority. The licensing process will demand a clear documentation of safety analyses and the fulfillment of radiation and nuclear safety regulation before a license can be acquired. For example, the high-level requirement for confinement of radioactive material, shielding against radiation, and the control of radioactive releases applies directly to IFMIF-DONES. The irradiated test subjects will be activated by the neutron irradiation as well as the test cell itself, leading to high temperatures from decay heat, but the controlled test environment makes the risks involved fundamentally smaller than those of fission reactors or future fusion reactors. [48] 46

55 47 7 Requirements management 7.1 Requirements management as a subfield of systems engineering Before delving into the nuances of requirements management let s look a little into its origins and definitions. Requirements management itself is a subfield of requirement engineering, which itself is a subfield of systems engineering. A system is a combination of interacting elements organized to achieve one or more stated purposes [49]. Systems engineering is a field of engineering that focuses on the design and management of highly complex engineering systems. The definition of systems engineering can be a little vague, but in the standard ISO/IEC/IEEE 15288:2015 it s stated as an interdisciplinary approach governing the total technical and managerial effort required to transform a set of stakeholder needs, expectations, and constraints into a solution and to support that solution throughout its life [50]. A more comprehensive definition for systems engineering can be found in the International Council on Systems Engineering, INCOSE s Systems Engineering Handbook, where it s defined as an interdisciplinary approach to creating a successful system, where the interdisciplinarity is elaborated as a structured development process that encompasses all the disciplines and groups involved in the development of the system [51]. Further, it emphasizes the importance of including aspects, such as documentation, costs management, scheduling, testing, manufacturing, and disposal etc., in the system s life-cycle [51]. Systems engineering was first introduced after the Second World War in the United States [51]. The main driver behind the introduction of systems engineering was the management of the increasingly complex engineering projects related to the arms and space race between the US and the Soviet Union [51]. Systems engineering and its sub fields, requirements engineering and requirements management, have subsequently been most associated with software development [5]. Most engineering products or systems today from electrical appliances to cars to large industrial installations, such as power plants, contain software that perform different functions with the hardware of the system. The more complicated the system is, the more interconnections there are between software and hardware. A system that depends or functions on software is called a software intensive system [52, p. 4]. Probably one of the most prominent types of software intensive systems are information systems, computer systems the basic functionality of which is to provide the user with the information they need in the right way [52, p. 4]. A software intensive system which involves interactions between software and hardware to perform physical functions is called an embedded software intensive system [52, p. 4]. In nuclear industry a requirements management tool, which for example helps the user to trace safety requirements for their correspondence in plant design, would be considered a software intensive information system. Embedded software intensive systems can be found in process engineering systems, and for example an automated safety function in a nuclear power plant would be considered an embedded software intensive system. Complex engineering systems are usually designed to meet certain numerous requirements set by stakeholders, such as a customer or in the case of nuclear facilities also the regulatory body. A requirement is defined in [49] as: a condition or capability that must be met or possessed by a system, system component, product, or service to satisfy an agreement,

56 48 standard, specification, or other formally imposed documents. Requirements for a system come in various forms, but three main types of system requirements can be identified; Functional requirements, Quality requirements, and Constraints [52, p. 17]. Functional requirements are the requirements that express in detail what functionality the system needs to provide, i.e. what the system is supposed to do [52, p. 17]. A detailed description of the functional requirement would cover the inputs and outputs of that function and expectations for its operation [52, p. 17]. For example, a functional requirement related to nuclear safety could be a requirement for a LOCA mitigation system. A functional requirement for a system dedicated to mitigate a LOCA in a certain pipeline could be characterized as something that follows: If the system detects a loss of flow in the pipeline indicating a break, it shall initiate reactor trip, engage the shut off valves to isolate that pipeline, and signal the backup cooling system to start. Quality requirements are different from functional requirements in that they don t set requirements for how a system should function, but rather set it quality goals, such as reliability, availability, and safety, that need to be fulfilled one way or another [52, p. 18]. The quality requirements for high availability and reliability of critical safety systems in a nuclear power plant are in part ensured by redundancy, separation, and diversity of safety systems. Constraints are requirements that give technological or organizational restrictions for the development and operation of the system [52, p. 22]. Constraints limit the alternatives available for complying with functional and quality requirements [52, p. 22]. Constraints may be imposed on the system from outside or from the stakeholders in the form of performance requirements, regulations, or staffing constraints etc. [53]. The system s interaction with other systems may also pose constrains on the system s design [53]. Quality requirements and constraints are sometimes referred to as non-functional requirements to differentiate them from functional requirements, because they don t set requirements on how the system should function, but rather set expectations, boundaries, and constraints on the systems functionality [54]. Requirements engineering is defined in [53] as: interdisciplinary function that mediates between acquirer and supplier to establish and maintain the requirements to be met by the system of interest and additionally Requirements engineering is concerned with discovering, eliciting, developing, analyzing, verifying, validating, communicating, documenting, and managing requirements. Requirements engineering aims to define all relevant requirements for the system, negotiate the system requirements between the different stakeholders to resolve possible conflicting views about the requirements, and to ensure that requirements are documented and specified adequately [52, p. 47]. To differentiate documented requirements from general needs and expectations, documented requirements are sometimes called requirements artefacts [52, p. 16]. Requirements management should be present in the requirements engineering processes and its purpose is to manage the huge number of requirements, analyze the effects of requirements and their

57 49 changes on the system, and to co-ordinate the requirements engineering processes [52, p. 595]. The main requirements processes defined in [55] are; business or mission analysis process, stakeholder needs and requirements definition process, and system requirements definition process. The requirements engineering processes result to a set of requirements that function as the basis for the system s further development [55]. The business or mission analysis process aims to define the problem the system needs to solve or the purpose of the system in development, and to explore and define possible solutions to the problem that would suit the stakeholders business and/or mission [55]. The analysis results in a defined problem and a controlled space for possible solutions [55]. The process also brings out solution candidates to the defined problem from which preferred solution alternatives are chosen [55]. In a managed business or mission analysis process the traceability between the solutions and the problems is maintained by documenting the way business problems, business needs and requirements, and the preferred solution alternatives relate [55]. The stakeholder needs and requirements definition process identifies the different stakeholder involved in the system through its life-cycle, and their needs [55]. This includes the identification of e.g. regulatory bodies and their specific requirements or constraints. The process analyzes the needs of different stakeholders and turns them into a common set of stakeholder requirements [55]. The requirements are then reviewed, negotiated, and agreed upon by the stakeholders and the supplier and documented [55]. The traceability between the stakeholder requirements and stakeholder needs to be stablished and maintained throughout the lice-cycle of the system [55]. Requirements management is recommended to be done with a requirements management tool that can trace linkages between relevant stakeholder and system requirements and their origins and facilitate a systematic management of all requirements [55]. The system requirements definition process turns the stakeholder requirements into technical requirements for the system in question [55]. In other words, the process translates the different requirements stakeholders have for the properties and capabilities of system into definite functional and performance requirements etc. the supplier needs to impose on the system in order to satisfy the stakeholders requirements [55]. Once the system requirements are defined, stakeholders should review and validate them to ensure that the stakeholders requirements point of view is realized in the system or solve possible issues in co-operation with the system s supplier [55]. After requirements verification and validation, the supplier and stakeholders agree on the requirements [55]. Traceability of the system requirements to the stakeholder requirements and back is needed ensure that all stakeholder requirements are met and to make sure that effective requirements management is possible [55].

58 50 The same requirements processes are in some other instances commonly divided to and named as: Requirements elicitation, Requirements analysis, and Requirements specification [54]. Requirements elicitation process corresponds to the business or mission analysis process and stakeholder needs and requirements definition process and results in a set of stakeholder requirements [54]. The goal of requirements elicitation is to gather all necessary requirements form stakeholders for the system s development [52, p. 394]. Requirements analysis and requirements specification processes cover the areas mentioned in the stakeholder requirements definition and system requirements definition processes and result in a set of defined system requirements [54]. In requirements analysis requirements are classified, conflicts between requirements are solved, and requirements are prioritized, among others [54]. In the requirements specification process system requirements are defined and documented [54]. After the system requirements have been specified, they need to be verified and validated. In the requirements verification process the requirements are reviewed to ensure that they are complete, well formulated and organized, and correspond to higher level requirements, regulations, or standards etc. [54], [56]. The requirements validation process checks that the system requirements correctly portray the stakeholders needs and requirements are correctly addressed to ensure that the system that s designed on the basis to the requirements will turn out right [53], [54]. Requirements verification and validation are a form of quality assurance in place detect possible problems before the allocation of resources for the realization of the system in question [54]. 7.2 Requirements management principles In [53], requirements management is defined in short as: activities which ensure requirements to be identified, documented, maintained, communicated, and traced throughout the lifecycle of a system, product, or service. Although requirements management is only a single area of systems engineering, it plays a large role in the licensing process of nuclear installations. The main purpose of requirements management is the management of requirements artefacts (including requirements tracing), requirements change and configuration management, and the management of the other requirements engineering processes, such as requirements elicitation, definition, and verification and validation processes [5], [52, p. 594]. Additionally, in [52, p. 594] requirements management is divided to the areas as follows: Managing requirements engineering artefacts, Observing the system context, and Manage the requirements engineering processes. The management of requirements engineering artefacts, or requirements artefacts in short, encompasses mostly the tracing and change and configuration management of the requirements. Observing the system context is used to detect changes in the system s environment and discover their effects on the system s requirements. Possible changes in

59 51 system context could be new emerging technologies, new laws, standards or regulations, or new stakeholders. Managing the requirements engineering processes functions somewhat as the project management part of requirements engineering, deciding when to transition from one process to the next and observing if the process flow needs to be adjusted based on challenges or changes in the system context. In this thesis, the management of requirements engineering artefacts area is emphasized as it forms the majority of requirements management activities. [52, p. 594] Complex systems are engineered based on a large number of requirements artefacts that need to be kept track of which makes the managing of requirement artefacts form the bulk of requirements management activities. The requirements need to have attributes like a unique id number, name, type, and version and increment number, whose requirement it is, priority etc. [52, p. 596], [53]. This information makes it possible to organize the requirements in a systematic manner and to find the requirement that has relevant information attributes. Linkages between different level requirements and their origins make it possible to trace requirements to their origins and place of use. Requirement traceability is realized if the requirement s development path can be followed backwards to its origin and forwards to its use in the system s development process [52, p. 606]. Pre-tracing requirements means tracing requirements to their origins, such as stakeholder needs or higher level requirements from which it was derived from [52, p. 608], [53]. Post-tracing again means tracing requirements to lower-level requirements, system architecture that satisfies the requirement, system elements that implement the requirement, and to proof of the requirement s satisfaction, such as supporting analysis [53]. Pre- and post-tracing are illustrated in Figure 7.1. Maintaining requirements traceability helps determine if all stakeholder requirements are realized in the system, helps change management by providing information on how a change in one requirement affects other requirements or the system, and helps document the relationships of different level requirements and their correspondence in the design etc. [53]. If regulatory acceptance of the system is needed, the traceability of regulatory requirements to requirements artefacts and ultimately to system elements and validating analyses is crucial for ensuring a smooth regulatory process. Requirements usually change and evolve during the lifetime of the system and it s important to keep track of the changes and analyze their impacts on the system. Usually, large number of the requirements will change during the development of the project affecting the system in some way [53], [54]. Changes to the requirements for a system may be imposed by a need to correct errors in requirements analysis or emerge from the environment in the form of market changes or new regulation etc., or problems encountered during system operation [54]. Change management in requirements engineering doesn t implement changes in the system but focuses only on managing the changes in the requirements context [52, p. 646].

60 52 Figure 7.1 Requirement traceability is realized when a documented requirement artefact can be traced back to its origin (pre-tracing) and forward to its successor artefacts (post-tracing). Changes in the requirements need to be managed rigorously in order to ensure that the required changes are implemented correctly. A good change management process would start by establishing a change control board, which is responsible for deciding which proposed requirement changes are implemented, as emphasized in [52, p. 653]. The board should comprise all relevant stakeholders along with the supplier s relevant experts. When a need for a requirements change is recognized, the change is then analyzed and categorized based on its nature and effects on the system. Impact analysis of the requirement change is then carried out to estimate how much effort is required to carry out the requirement change. A basic cost-benefit analysis should be employed to determine is the change is truly necessary. If the change is then agreed upon, the request for requirement change is then prioritized based on its importance and its implementation is then assigned to the project. The board should then monitor the status of the change request until it s implemented. The change management process described above is illustrated in Figure 7.2. [52, p ] Configuration management of requirements can be defined as the technical side of requirements change management. Its main purpose keeping track of the changes on the requirements in an orderly fashion. Configuration management keeps track of different requirement versions and configurations. In order to implement configuration management, a set configuration that forms the basis for future changes and their documentation needs to be established. This is called a requirements baseline and it s the accepted, fixed requirements configuration, into which requirement changes are imposed. Different baselines can be established through the lifecycle of the system. Changes to the baseline should be done through the change management process illustrated in Figure 7.2. It s important to note, that when changes are added to the baseline the baseline isn t changed, but a new configuration is created. [52]

61 53 Figure 7.2 Requirements change management process as illustrated in [52, p. 656]. Prioritization of requirements is necessary for differentiating between high-importance and lower-importance requirements to allocate requirements engineering resources accordingly. Prioritization is present at all stages of requirements engineering, from requirements elicitation to change management. During the elicitation process, needs and requirements of different stakeholder are prioritized based on the level of stakeholder involvement in the system and the importance individual stakeholder needs and requirements. In requirements analysis, possible conflict between requirements can be resolved by prioritizing the conflicting requirements and solving the conflict in favor of the higher priority requirement. Prioritizing requirements for the validation process can help allocate resources for the validation of the most critical requirements, determine the intensity at which different requirements need to be validated, and at which order the validation of requirements should be done. In the requirements management area, prioritization is used e.g. to prioritize change requests in the change management process as illustrated in Figure 7.2. [52, p ]

62 54 8 Requirements management in the licensing of nuclear installations 8.1 Basic licensing process for nuclear installations Licensing is the process of obtaining regulatory authorization to the nuclear installation from the national nuclear regulatory authority, where the license applicant demonstrates to the regulatory authority, that safety and requirements have been adequately accounted for during the plant s lice-cycle, including the plant s siting and site evaluation, design, construction, commissioning, operation, decommissioning, and its eventual release from regulatory control [57]. A nuclear installation, as defined in IAEA s Safety Glossary [21], is a NPP or a facility that s part of the nuclear fuel cycle. IAEA s guide No. SSG-12 Licensing Process for Nuclear Installations provides recommendations for national regulatory bodies in the forming of a national nuclear licensing process [57]. Aspects in the requirements for a license may include plant design, radiation protection, operational limits and conditions, the management system etc. [57]. To obtain a license, the applicant sends predefined documents to the regulatory authority which demonstrate the fulfillment of the license requirements [57]. One main aspect of the licensing process is to ensure that safety is prioritized in plant design and operations, i.e. the ALARA principle is followed [57]. Figure 8.1 shows the different stages of a nuclear installation s lifetime and the arrows illustrate different points where licensing is required [57]. The following describes the steps in a nuclear installation s licensing process recommended by the IAEA. Native licensing processes for nuclear installations have their own distinctions, which differ from the IAEA guide, but the guide forms the basis for national requirements. Figure 8.1 Stages in the lifetime of a nuclear installation; the arrows indicate where hold points may be imposed [57]. The hold points are points in the installations lifetime where regulatory approval is required before continuing to ensure safety. [57] Siting and site evaluation, environmental impact assessment Siting starts with selecting a site from a set of candidates. The site must be approved by the regulatory body. After the site has been selected it needs to be evaluated for its applicability for a nuclear installation. The evaluation includes a safety assessment and an environmental impact assessment. The site safety assessment involves factors, such as natural phenomena, like earthquakes and floods and human induced risks, such as aircraft crashes or nearby

63 55 industrial accidents. The site s impact on the local population and local emergency preparedness also needs to be evaluated. The environmental impact assessment looks at the installation s possible impacts on local flora and fauna, waterbodies, groundwater, soil, air quality, effects of possible toxic or radiological gaseous or liquid effluents, and the potential for heat removal in normal operation or accident conditions. Preparatory work, such as road building and excavation, on an accepted site can be done, but the construction of the nuclear installation cannot start before the granting of a construction permit. [57] Design The licensee needs to submit the installation s basic design documentation to the regulatory body for approval before construction can start. The design basis of the proposed installation needs to adhere to safety requirements issued by the national regulatory authority. The installation s Preliminary Safety Analysis Report (PSAR) should be inspected by the regulator. The PSAR includes documents and analysis, such as safety analyses of internal events, internal hazards, and external hazards, operational limits, list of confinement barriers, defence in depth, methods and computer codes used in the analyses, radiation exposures of workers and the public and radioactive releases to the environment, the verification and validation of the aforementioned activities etc. Arrangements for the treatment and storage of spent fuel and radioactive waste should be proposed by the licensee. The licensee should provide certification of suppliers and contractors of safety-related Systems, Structures, and Components (SSC) to the regulatory authority for approval. Ageing management of the installation during its lifetime should also be accounted for by the licensee. A configuration management programme for ensuring the installation s modifications comply with regulations and the design basis should be required. [57] Construction Construction of the installation can only start after the regulatory authority or government grants the licensee a construction permit. It s important for the licensee to maintain control over the supply-chains, manufacturers, contractors, sub-contractors, suppliers, and vendors involved in the construction process to ensure that the SSCs are manufactured and constructed according to requirements. Contractors and sub-contractors involved with the installation s safety-important SCCs should be under regulatory oversight. [57] Commissioning Commissioning is the process, where the installation is made operational and verified to adhere to the approved design and performance criteria [21]. The commissioning is carried out through a series of tests that are meant to verify that the SSCs function correctly. The construction and commissioning phases may overlap, as some SSCs may be commissioned when ready while the installation is still not completely constructed. The commissioning is divided in to non-nuclear and nuclear commissioning. In non-nuclear commissioning the quality and operation of safety systems, and structures and components are ensured by testing. If the testing reveals problems with some systems, the problems need to be corrected and it has to be proven that they don t inflict safety issues in the installation s operation. The results and experience from the non-nuclear commissioning tests should be utilized in the developing of the installation s operating instructions. The nuclear regulator should inspect the installations as-built design, non-nuclear commissioning testing results, the licensee s organization and management system; testing, maintenance, and inspection programmes; radiation protection arrangements, operating instructions, emergency preparedness, and nuclear and radioactive material accounting measures, among others, before nuclear or

64 56 radioactive material can be introduced to the installation. Nuclear commissioning is intended to ensure the installation s safe operation when fuel is loaded, or other radioactive material is introduced. The tests may relate to monitoring and controlling the installations normal operation and responding to deviations from normal operation. The regulator should address possible problems encountered during these tests and require that they are dealt with. [57] Operation Operation of the installation shouldn t start before all requirements leading to the operational phase have been met, including the completion of commissioning tests and the reviewing of their results by the regulatory authority. In addition to the commissioning test results the licensee should submit the installations Final Safety Analysis Report (FSAR) and documents including the operational limits and operational conditions of the installation, operating instructions and proof of staffing adequacy, and emergency and preparedness arrangements to the regulatory authority before operating license may be granted. During the installation s operation, the safety of the installation and the adequacy of the licensee s organization to uphold the installation s safe operation should be demonstrated periodically as a condition for the continuation of the operating license. All deviations from the installation s normal operation should be reported to the authority. [57] Decommissioning When the installation has reached the end of its operating life, it s time for its decommissioning. The decommissioning of a nuclear installation is a long and high cost task. The decommissioning work shouldn t start before the licensee has provided a detailed decommissioning plan for the regulatory authority. Decommissioning includes decommissioning work, (such as the dismantling of the installation and removal of nuclear fuel) waste management and radioactive waste management, and preparing the safety documentation to correspond to the installation s decommissioned state. An important hold point in the decommissioning is the approval of the waste management plant, which includes the plans for the management of radioactive waste. Decommissioning may be deferred if deemed necessary in order to allow for radioactive decay to limit the exposure of decommissioning workers. The safety of the installation and the decommissioning expertise of staff should be maintained during the deferral period. [57] Release from regulatory control Before the installation can be released from regulatory control, it needs to be ensured, that the area has been decontaminated, the installation has been dismantled, and all radioactive material, including radioactive waste and activated or contaminated structures and components have been removed. The installation and the site should be surveyed to ensure that decommissioning activities have been completed and the radiological status of the site satisfies the requirements for release from regulatory control. Some environmental monitoring or restriction of access may stay on the site. [57] 8.2 Applying requirements management in the design and licensing of nuclear installations The motivation for applying requirements engineering management in the design and licensing of nuclear installations is to reduce the risks of delays and cost runoffs related to possible obstacles in the licensing of the installation. Obstacles arise both from regulatory processes and from the licensee s own challenges. Studies relating to the use of requirements engineering practices in software engineering projects by The Standish Group have shown

65 57 that inadequate requirements engineering practices have accounted for 48% of the reasons for project cost overruns or partially failed projects [52, p. 7], [58]. Other studies relating to industrial control systems have found that 40% of the faults and incidents encountered have fundamentally been caused by inadequate requirements specification, the requirements engineering process, which should result in well-formed and unambiguous documented requirements for a system [59], [60]. Problems the system s supplier or licensee encounters relating to inadequate requirements engineering practices or processes are tackled with the implementation of well-formed requirements engineering management practices in the supplier s or licensee s design organization. Table 8.1 shows some of the main regulatory and licensing risks of nuclear installations relating to the installation s life and licensing stages, which need to be avoided to achieve a successful licensing process. These risks can be mitigated with effective requirements management. Table 8.1 Regulatory and licensing risks for nuclear power plants [3]. Delays and cost overruns in licensing To put it simply, problems in licensing create delays and which increase the costs of the project. To ensure a smooth licensing process, the licensee needs to have a clear picture of the regulatory requirements that it needs to account for. Requirements management plays a major role in the licensing process, especially in correspondence between the regulatory authority and the licensee related to proving the fulfillment of safety requirements in the plant s design. This correspondence related to the fulfillment of requirements and their interpretation can be very time-consuming and often create unexpected delays. Making it faster and easier for the regulatory authority to interpret the required design documentation and to determine if safety requirements are fulfilled is key in reducing the risks related to licensing. The licensee s design process also benefits from traceability of requirements to the safety design and documentation as it s simpler for the designers to see which requirements are related to which systems. A major work load in the beginning of a nuclear new build project is the partial re-design of the supplier s design to account for native nuclear requirements [5]. Reducing the time and costs related to this process can be achieved to some extent through requirements management by recognizing the changes needed early, systematically managing the changes and configuration, and by reducing the hassle related to interpreting and translating native requirements to technical requirements, e.g. by utilizing requirements tracing to create clear linkages between high-level regulatory requirements and