Home

INES User's Manual

1. Inadvertent withdrawal of a control rod during reactor operation at power Loss of main feedwater flow Failure of reactor pressure control Leakage from main steam system Reactor coolant system leakage that would not prevent a controlled reactor shutdown and cooldown Loss of off site power AC including consideration of voltage and frequency disturbances Operation with a fuel assembly in any misoriented or misplaced position Inadvertent withdrawal of any single control rod assembly during refuelling Minor fuel handling incident Loss of forced reactor coolant flow II 2 2 Category 2 Possible Small LOCA Rupture of main steam piping 175 Drop of spent fuel assembly involving only the dropped assembly Leakage from spent fuel pool in excess of normal make up capability Blowdown of reactor coolant through multiple safety or relief valves II 2 3 Category 3 Unlikely Major LOCA up to and including the largest justified pipe rupture in the reactor coolant pressure boundary Single control rod drop Major rupture of main steam pipe Drop of a spent fuel assembly onto the other spent fuel assemblies H 3 CANDU PRESSURIZED HEAVY WATER REACTORS II 3 1 Category 1 Expected Reactor trip Inadvertent chemical shim dilution Loss of main feedwater flow Loss of reactor coolant system pressure control hig
2. 163 164 TABLE 21 D VALUES FOR A RANGE OF ISOTOPES cont D Radionuclide TBq Co 57 4 E 02 Co 60 3 E 01 Cs 137 2 E 01 Fe 55 8 E 02 Gd 153 8 E 01 Ge 68 2 E 01 H 3 2 E 03 1 125 2 E 01 1 131 2 E 01 Ir 192 2 E 01 Kr 85 2 E 03 Mo 99 2 E 01 Ni 63 6 E 01 P 32 2 E 01 Pd 103 1 E 02 Pm 147 4 E 01 Po 210 6 E 02 Pu 238 6 E 02 Pu 239 Be 6 E 02 Ra 226 7 E 02 Ru 106 Rh 106 1 E 01 Se 75 2 E 02 Sr 90 Y 90 1 E 00 Tc 99 7 E 02 TI 204 2 E 01 Tm 170 2 E 01 Yb 169 3 E 01 II 2 D VALUES FOR RADIONUCLIDES FOR USE WITH SECTION 4 CRITERIA TABLE 22 D VALUES FOR A RANGE OF ISOTOPES Radionuclide D TBq Am 241 6 E 02 Am 241 Be 6 E 02 Au 198 2 E 01 Cd 109 2 E 01 Cf 252 2 E 02 Cm 244 5 E 02 Co 57 7 E 01 Co 60 3 E 02 Cs 137 1 E 01 Fe 55 8 E 02 Gd 153 1 E 00 Ge 68 7 E 01 H 3 2 E 03 1 125 2 E 01 1 131 2 E 01 Ir 192 8 E 02 Kr 85 3 E 01 Mo 99 3 E 01 Ni 63 6 E 01 P 32 1 E 01 Pd 103 9 E 01 Pm 147 4 E 01 Po 210 6 E 02 Pu 238 6 E 02 Pu 239 Be 6 E 02 165 TABLE 22 D VALUES FOR A RANGE OF ISOTOPES cont Radionuclide B TBq Ru 106 Rh 106 3 E 01 Se 75 2 E 01 Sr 90 Y 90 1 E 00 Tc 99 7 E 01 TI 204 2 E 01 Tm 170 2 E 01 Yb 169 3 E 01 II 3 CALCULATION OF AGGREGATE VALUES Where a number of radioactive sources or transport packages are relevant an aggregate D value should be calculated Based on the guidance in Categorization of Radioactive Sources 1 and Regulations for the Safe
3. FIG 9 Procedure for rating the impact on defence in depth for reactors at power 150 See Note for treatment of potential events Including structural defects Determine the maximum potential consequences Section 6 2 1 jallenge to sai vision akiita of the Identify the remaining safety provisions and their dependencies Yes Section 6 2 2 safety lai available TO Oe a See Table 11 to determine the basic rating Section 6 2 3 1 Number of ay 2 G Remaining INES level INES level INES level Safety Layers SOT 3 4 1or2 ME E EE 3 Ee E 2 o too 3 Reduce rating by one level if the period of unavailability was very short compared with the test interval 5A Basic Rating Consider need to increase rating by one level due to additional factors Section 6 2 4 Below Scale Level 0 e ee ee a E For a potential event assume that the potential event has actually occurred and evaluate the rating of the potential event using this flowchart Then reduce the rating depending on the likelihood that the failure could have occurred See section 6 2 3 2 FIG 10 Procedure for rating the impact on defence in depth for fuel cycle facilities research reactors accelerators or facilities with Category 1 sources and reactors not at power 151 19497 Jegjonu e ze syw Bupesado jo yoeasg Ajewouy uolejs
4. Possible Minor depressurization Inadvertent withdrawal of a group of control rods Full boiler tube rupture Dropped fuel stringer AGR only Closure of circulator inlet guide vanes IGVs AGR only Gag closure faults AGR only II 5 3 Category 3 Unlikely Major depressurization Failure of steam pipework Failure of feed pipework 179 Annex III LIST OF PARTICIPATING COUNTRIES AND ORGANIZATIONS Argentina Armenia Australia Austria Bangladesh Belarus Belgium Brazil Bulgaria Canada Chile China Congo Democratic Republic of the Costa Rica Croatia Czech Republic Denmark Egypt Finland France Germany Greece Guatemala Hungary 180 Iceland India Iran Islamic Republic of Ireland Italy Japan Kazakhstan Korea Republic of Kuwait Lebanon Lithuania Luxembourg Mexico Montenegro Netherlands Norway Pakistan Peru Poland Portugal Romania Russian Federation Saudi Arabia Slovakia Slovenia Turkey South Africa Ukraine Spain United Kingdom Sri Lanka United States of America Sweden Vietnam Switzerland The Former Yugoslav Syrian Arab Republic Republic of Macedonia INTERNATIONAL LIAISON European Commission European Atomic Forum Foratom World Association of Nuclear Operators World Nuclear Association 181 GLOSSARY This section provides definitions for important words or phrases used in this manual Many of them are ta
5. If the defect is in a safety system applying Section 5 1 4 will give the basic rating of the potential event The possibility of common mode failure may need to be considered If failure of the component containing the defect could have led to an initiator then applying Section 5 1 3 will give the basic rating of the potential event Although the defect may have been found during shutdown its significance must be considered over the time during which it is likely to have existed The rating of the potential event derived in this way should then be adjusted depending on the likelihood that the defect would have led to component failure and by consideration of the additional factors discussed in Section 5 2 5 1 6 Below Scale Level 0 events In general events should be classified Below Scale Level 0 only if application of the procedures described above does not lead to a higher rating However provided none of the additional factors discussed in Section 5 2 are applicable the following types of events are typical of those that will be categorized as Below Scale Level 0 80 Reactor trip proceeding normally Spurious operation of the safety systems followed by normal return to operation without affecting the safety of the installation Coolant leakage at rate within OL amp C Single failures or component inoperability in a redundant system discovered during scheduled periodic inspection or test 5 2 CONSIDERATI
6. Indeed it was lost shortly afterwards It is not appropriate therefore to downrate the event Final rating Level 3 Example 39 Unit scram caused by grid disturbances due to tornado Level 3 Event description As a result of a tornado transmission lines were damaged The unit was tripped by system emergency protection due to strong frequency oscillations in the system Unit auxiliary power was supplied from the service transformer Main steam header pressure was maintained and residual heat removed Core cooling was maintained through natural circulation On voltage decrease the diesel start signal was initiated but diesel generators DGs failed to connect to essential buses Since the signal for DG start persisted periodic restarts followed Subsequent attempts to supply power to auxiliary buses from DGs were unsuccessful due to absence of air in the start up bottles 100 Four hours after the trip total loss of power occurred for a period of 30 min Throughout the transient the core status was being monitored with the help of design provided instrumentation Rating explanation Criteria Explanation 2 and 3 Actual consequences There were no actual consequences from the event 5 1 1 Initiator frequency A real initiator occurred loss of off site power The frequency of this initiator is expected The initiator was caused by a tornado but section 5 1 3 states that the hazard itself should not be used as
7. The quantity of plutonium present on both the pipe and the floor did not exceed the minimum critical mass for the concentration of the material being 141 handled at the time but had the event taken place when more concentrated material was being handled then the critical mass may have been exceeded Rating explanation The event needs to be considered in two parts First with respect to releases from the facility and second with respect to doses to workers Possible release from the facility Criteria Explanation 2 and 3 Actual consequences 6 2 1 Maximum potential consequences 6 2 2 Identification of number of safety layers 6 2 3 Assessment of the basic rating 6 2 4 Additional factors Overall rating There were no actual consequences from the event Dispersion of all the material accumulated in the cell could result in an environmental release equivalent to Level 5 There are at least two safety layers available to prevent such a release The concrete structure of the cell containing the plutonium which would not have failed from the energy that would have been generated had the material gone critical and The remaining building structure together with the ventilation abatement system which itself consists of primary and secondary ventilation systems A basic rating of Level 2 is appropriate from Table 11 There are no additional factors that would justify an increase i
8. carried out at each facility Thus the maximum potential rating should be specific to the type of facility at which the event occurred and the type of operations being undertaken at the time of the event However the maximum potential consequences are not specific to the event but apply to a set of operations at a facility It is necessary to consider both the radioactive inventory that could potentially have been involved in the event the physical and chemical properties of the material involved and the mechanisms by which that activity could have been dispersed The consideration should not focus on the scenarios considered in the safety justification of the facility but should consider physically possible accidents had all the safety provisions related to the event been deficient When considering consequences related to worker exposure the maximum potential consequences should generally be based on exposure of a single inidividual as it is highly unlikely that several workers would all be exposed at the maximum credible level 105 1 2 3 4 5 6 106 These principles can be illustrated by the following examples For events associated with maintenance cell entry interlocks the maximum potential consequences are likely to be related to unplanned worker exposure If the radiation levels are sufficiently high to cause deterministic effects or death if the cell is entered and no mitigative actions are
9. equipment and procedures to prevent the escalation of anticipated operational occurrences and to maintain the effectiveness of physical barriers placed between a radiation source or radioactive material and workers members of the public or the environment 16 See the introduction to Sections 4 5 6 Annex I and INSAG 10 17 for further information deterministic effect A health effect of radiation for which generally a threshold level of dose exists above which the severity of the effect is greater for a higher dose 14 Note The level of the threshold dose is characteristic of the particular health effect but may also depend to a limited extent on the exposed individual Examples of deterministic effects include erythema and acute radiation syndrome radiation sickness dose A measure of the energy deposited by radiation in a target 16 Whenever the word is used in specific definitions it needs further detail such as absorbed dose effective dose whole body exposure RBE weighted dose dose constraint A prospective restriction on the individual dose delivered by a source which serves as the upper bound on the dose in optimization of protection and safety for the source 16 dose limit The value of the effective dose or the equivalent dose to individuals from controlled practices that is required not to be exceeded 14 There are a range of limits that all need to be considered including whole body effective dose doses t
10. include events involving reactors during shutdown or reactors being decommissioned whether or not the fuel is still on site and other events at reactor sites such as those associated with waste storage or maintenance facilities It is based on what is known as the Safety Layers Approach Defence in depth provisions such as interlocks cooling systems physical barriers are provided at all installations dealing with radioactive materials They cover protection of the public and the workforce and include means to prevent the transfer of material into poorly shielded locations as well as to prevent the release of radioactive material The concept of defence in depth is not explained in detail here as it will be familiar to the majority of those applying this manual to events at facilities However Annex I does give some additional background material This section is divided into four main parts The first gives the general principles that are to be used to rate events under defence in depth As they need to cover a wide range of types of installations and events they are general in nature In order to ensure that they are applied in a consistent manner Section 6 2 goes on to give more detailed guidance including the guidance associated with uprating events Section 6 3 gives some specific guidance for certain types of events and Section 6 4 provides a number of worked examples 6 1 GENERAL PRINCIPLES FOR RATING OF EVENTS Although I
11. including the transport of radioactive material In 2001 an updated edition of the INES User s Manual was issued to clarify the use of INES and to provide refinement for rating transport and fuel cycle related events However it was recognized that further guidance was required and work was already under way particularly in relation to transport related events Further work was carried out in France and in Spain on the potential and actual consequences of radiation source and transport related events At the request of INES members the IAEA and the OECD NEA Secretariat coordinated the preparation of an integrated manual providing additional guidance for rating any event associated with radiation sources and the transport of radioactive material This new edition of the INES User s Manual consolidates the additional guidance and clarifications and provides examples and comments on the continued use of INES This publication supersedes earlier editions It presents criteria for rating any event associated with radiation and radioactive material including transport related events This manual is arranged in such a way as to facilitate the task of those who are required to rate the safety significance of events using INES for communicating with the public The INES communication network currently receives and disseminates information on events and their appropriate INES rating to INES National Officers in over 60 Member States Each country par
12. involved and the short half lives of the radioisotopes 62 A substantial amount of decontamination equipment was deployed Two tracks were closed for a day and the locomotive was decontaminated Rating explanation Criteria Explanation 2 3 Doses to individuals Doses received were below the value for Level 1 4 2 1 Maximum potential The D value of Mo is 300 GBq and this includes the consequences effects of the daughter product Tc giving an A D ratio between 0 01 and 1 and hence the sources were Category 4 4 2 2 Effectiveness of safety As a source container was broken there were no safety provisions provisions remaining and section C of Table 7 is appropriate giving a rating of Level 1 Final rating Level 1 Example 23 Supposedly empty shipping containers found to contain nuclear material Level 1 Event description A fuel manufacturing plant routinely receives uranium oxide slightly enriched in U from overseas The material travels in special cans mechani cally sealed within a sea container After taking out the material the fuel manufacturer sends the empty cans back to their provider Upon receiving a container of 150 cans that were supposed to be empty the uranium oxide provider discovered that two cans were in fact full containing a total of 100 kg of uranium oxide The estimated activity of the material was 8 GBq The outer surface of the cans and the sea container were found to be clean
13. operability of the safety functions Addressed by considering the operability of the safety functions Addressed by considering the operability of the safety functions Not considered as part of defence in depth These actions affect the actual consequences as considered in the earlier sections of the INES User s Manual Considered as one or more safety layers Considered as ne or more safety layers Considered as one or more safety layers Not considered as part of defence in depth These actions affect the actual consequences as considered in the earlier sections of the INES User s Manual 173 Annex II EXAMPLES OF INITIATORS AND THEIR FREQUENCY Each reactor has its own list and classification of initiators as part of its safety justification This Appendix gives some typical examples of design basis initiators that have been used in the past for power reactors categorized into Expected Possible Unlikely II 1 PRESSURIZED WATER REACTORS PWR AND WWER II 1 1 Category 1 Expected Reactor trip Inadvertent chemical shim dilution Loss of main feedwater flow Reactor coolant system depressurisation by inadvertent operation of an active component e g a safety or relief valve Inadvertent reactor coolant system depressurisation by normal or auxiliary pressurizer spray cooldown Power conversion system leakage that would not prevent
14. 1 58 Example 18 Various radioactive sources found in scrap metal Level 1 Event description The regulator was notified by a scrap metal company that it had a radiation alarm from its portal detector Using handheld survey equipment the regulator measured an elevated radiation level at the surface of a 12 m container of 30 uSv h The container was unloaded by a firm specializing in tracing and recovering radioactive sources in scrap Three identical stainless steel source holders were found each containing a Cs source but with no shutter mechanisms Two of the source holders had identification marks which enabled the sources to be characterized as 2 GBq of Cs and 8 GBq of Cs The dose rate at the surface of the three separate source holders was about 4 5 4 2 and 17 mSv h and the activity of the separate sources was approximately 1 85 GBq 1 85 GBq and 7 4 GBq The container had been in transit for nearly one month but the origin of the three sources could not be determined The sources were secured and transported to an appropriate radioactive waste facility Rating explanation Criteria Explanation 2 3 Doses to individuals Considering the potential doses during transportation and handling of these sources it is not considered credible that doses above 10 mSv could have been received or that ten or more people could have been exposed i e Level 1 4 2 1 Maximum potential Two of the sources were known t
15. Although INES allocates three levels for the impact on defence in depth the maximum potential consequences for some practices even if all the safety provisions fail are limited by the inventory of the radioactive material and the release mechanism It is not appropriate to rate events associated with the defence in depth provisions for such practices at the highest of the defence in depth levels If the maximum potential consequences for a particular practice cannot be rated higher than Level 4 on the scale a maximum rating of Level 2 is appropriate under defence in depth Similarly if the maximum potential consequences cannot be rated higher than Level 2 then the maximum rating under defence in depth is Level 1 Having identified the upper limit to the rating under defence in depth it is then necessary to consider what safety provisions still remain in place i e what additional failures of safety provisions would be required to result in the maximum potential consequences for the practice This includes consideration of hardware and administrative systems for prevention control and mitigation including passive and active barriers Consideration is also given as to whether any underlying safety culture issues are evident in the event that might have increased the likelihood of the event maximum potential consequences occurring The following steps should therefore be followed to rate an event 1 The upper limit to the rating under defenc
16. Challe fey them with respective Frequency caregonas Section 5 1 2 freque les ewes Using Table 9 determine the asig rating from the Andin Using Table 10 determine the combination of initiator ai ic rating from the limiting se Spaey Eo cree Se Section 5 1 4 Initiator Frequent Initiator Frequenc Operability Expected Possible Uniikel Operability Expected Possible Uniikel fr ir Min required Min required e by OL amp C Ae 25 a a by OL amp C PC Adequate 12 tt 10 inadequate 3 do 3 dl D inadequate d 3 do 2 d 1 Reduce rating by one level if the period of unavailability was very short compared with the test interval Box A Take maximum from all assessed initiators and Basic rating safety functions Basic rating with real initiator operability without an initiator Consider need to increase rating by one level due to additional factors Section 5 2 Figure 4 Box 3 For a potential event assume that the potential event has actually occurred and evaluate the rating of the potential event using this flowchart Then reduce the rating depending on the likelihood that the potential event could have occurred See section 5 1 5 Events can be a combination of initiators and degradation of safety functions Therefore it may be necessary to go through this flowchart several times to identify the initiator and safety function pairing that gives the highest rating See section 5 1
17. Jamod Jeanu y ye swa s s uonelje sul Oy UlU IM Ayojes jo ssoj ul Bupjns os Aq pasned paulejuod jevayewW aAOeOIped zo AyQUeNb ageyiene sajdwexa oy 19497 juapioge JE N 696 uledg soljapueA aBue Jo aseajay GOOZ MN PIOYLI S aes cli a OHS OU PIS NO SL J OU U IM JO eAI Ayoey seajonu Y 19497 y ul n Jo j uueyo BuO Jo Huna e Je JUBA yjeouo e Hulmo jo SIaYIOM JO s su nb suoo 086 eoueI4 xneg s p ju sne q uies s nsodx jeje4 666 Ueder emnwieyo 1290 y m u pooy d p u eouajeq sjo1 uo9 pue s4 eq e9100 pey yu wuonua pue jdo d S4ILITIOV4 AVATONN LV SLNYAY ONILVY YOA VINALTIAO SANI ONILVALSATTII SYIJWYXY ZI ATAVL 152 aneb Ajisuep sunj siow e jo Yeu Ayyloe J0pe19 999e ye SwaysAs JOujUOd SS 99E Jo aIN Ie4 GEE eoueI4 9DJNOS 09 09 sANeOIpeI A ybiy e jo Sso7 6664 AON OHH yujdap ul aduajaq SI9YJOM UONEIpEJ 10 yw j jenuue y Buipaaox seydesBoipes e Jo nsodx I3AQ S0OZ WSN suunq uoljelpel 8J9A9S Ul Buljnses sonos Aydesboipes e UUM JUSPIOU G66 Neg obueue UOI eIPeJ JO Sasop ybiy jo jns 4 e se Apioes uonepe JEIOJOLUWOD E e JOYIOM E JO S 9 4 y e y 1 4 9 900Z wNnIBjeg snine 4 JUSWUOJIAUD pue jdo d Z 19497 yuaplou 19497 yuapioul snolas p 19497 s su nb suo e20 yum juaplooy LYOdSNVUL ANV SHOUNOS NOILVIAV YA ONIATOANI SLNYAY ONILVY
18. Level 1 definitions are based on defence in depth criteria explained in Sections 4 6 but they are included here for completeness b 2 4 WORKED EXAMPLES The purpose of these examples is to illustrate the rating guidance contained in this section of the manual The examples are based on real events but have been modified slightly to illustrate the use of different parts of the guidance The rating derived in this section is not necessarily the final rating as it would be necessary to consider the criteria in Sections 3 to 6 before defining the final rating Example 1 Overexposure of an electrician at a hospital Level 2 Event description While a service person was installing and adjusting a new radiotherapy machine in a hospital he was not aware of an electrician working above the ceiling He tested the machine pointing the radiation beam towards the ceiling and the electrician was probably exposed The estimated whole body exposure range was between 80 mSv and 100 mSv effective dose The electrician had no symptoms but as a precaution a blood test was undertaken As would be expected for this level of dose the blood test was negative 22 Rating explanation Criteria Explanation 2 2 1 Activity released Not applicable No release 2 3 Doses to individuals One person not an occupational radiation worker received an effective dose greater than 10 mSv but less than ten times the statutory annual whole body dose limit
19. NEA and with the support of more than 60 designated National Officers who officially represent the INES member States in the biennial technical meeting of INES Initially the scale was applied to classify events at nuclear power plants and then was extended and adapted to enable it to be applied to all installations associated with the civil nuclear industry More recently it has been extended and adapted further to meet the growing need for communication of the signi ficance of all events associated with the transport storage and use of radioactive material and radiation sources This revised manual brings together the guidance for all uses into a single document 1 2 GENERAL DESCRIPTION OF THE SCALE Events are classified on the scale at seven levels Levels 4 7 are termed accidents and Levels 1 3 incidents Events without safety significance are classified as Below Scale Level 0 Events that have no safety relevance with respect to radiation or nuclear safety are not classified on the scale see Section 1 3 For communication of events to the public a distinct phrase has been attributed to each level of INES In order of increasing severity these are anomaly incident serious incident accident with local consequences accident with wider consequences serious accident and major accident The aim in designing the scale was that the severity of an event would increase by abou
20. No worker or member of the public received any unanticipated dose from this event 63 Rating explanation Criteria Explanation 2 3 Doses to individuals There were no doses reported from this event 4 2 1 Maximum potential Criticality was not an issue here because of the low consequences enrichment and therefore the event should be categorized based on A D See final bullet of Section 4 2 1 The D value is not specified in Appendix III but is given in 5 For enrichments of less than 10 which is the case here the D value is so high as to be unlimited Therefore the A D value is lt 0 01 which means the material can be treated as Category 5 sources 4 2 2 Effectiveness of safety Although the packaging for empty cans was the same as provisions if they were full mechanical seal as well as container conditions labelling for the transport was less demanding and precautions for handling were slightly relaxed The key point is that authorized limits were breached There were significant safety culture issues associated with the event and some of the provided safety provisions failed Therefore based on the third paragraph of Section 4 2 2 the event is rated at Level 1 Final rating Level 1 Example 24 Suspicious dose on film badge Level 1 Event description A radiation technician s annual cumulative exposure level was indicated to be 95 mSv by her film badge record This was found in the course of an ins
21. Nuclide Facility contamination Atmospheric release Am 241 2000 8000 Co 60 2 50 Cs 134 0 9 3 Cs 137 0 6 40 H 3 0 002 0 02 1 131 1 1 Ir 192 0 4 2 Mn 54 0 1 4 Mo 99 0 05 0 08 P 32 0 3 0 2 Pu 239 3000 10 000 Ru 106 3 6 Sr 90 7 20 Te 132 0 3 0 3 U 235 S 600 1000 U 235 M 200 600 U 235 F 50 500 U 238 S P 500 900 U 238 M gt 100 600 U 238 F 50 400 U 600 1000 nat Multiplication factors are rounded to one significant figure b value 158 Lung absorption types S slow M medium F fast If unsure use the most conservative Appendix II THRESHOLD LEVELS FOR DETERMINISTIC EFFECTS The criteria related to deterministic effects in Section 2 3 1 are intended to relate to observable deterministic effects However if it is not known at the time of rating whether a deterministic effect will actually occur the data in this appendix can be used to determine a rating based on dose II 1 FATAL DETERMINISTIC EFFECTS Based on Ref 10 the likelihood of acute death from radiation with medical treatment is provided in Table 17 for a range of exposures II 2 OTHER DETERMINISTIC EFFECTS In the evaluation of external exposure threshold levels are expressed in terms of RBE weighted absorbed dose and are given in Table 18 For internal exposure threshold levels are expressed in terms of committed RBE weighted absorbed dose and are given in Table 19 RBEs are provided in Table 20 All tables are simplified f
22. Spain Department of Atomic Energy India International Atomic Energy Agency Eskom Holding Limited South Africa Ministry of Housing Spatial Planning and Environment Netherlands Nuclear Regulatory Agency Bulgaria Sellafield Ltd United Kingdom INES NATIONAL OFFICERS as of 30 June 2008 Agapov A M Al Suleiman K M Ministry of the Russian Federation for Atomic Energy Russian Federation King Abdulaziz City for Science and Technology Saudi Arabia 201 Ananenko A Assi M Basaez Pizarro H Belamari N Bermudez Jimenez L A Breuskin P Cao S Chande S K Ciurea Ercau C M Coenen S Freire de Nave D Y Glazunov A Gonzalez V Grimaldi G Gulol O O Guterres R Heilbron P Hofer P Hornkjol S 202 State Nuclear Regulatory Committee of Ukraine Ukraine Lebanon Atomic Energy Commission Lebanon Comision Chilena de Energia Nuclear Chile State Office for Radiation Protection Croatia Comision de Energia Atomica Costa Rica Ministry of Health Luxembourg China Atomic Energy Authority China Atomic Energy Regulatory Board India National Commission for Nuclear Activities Control Romania Federal Agency for Nuclear Control Belgium General Directorate of Nuclear Energy Guatemala Ignalina Nuclear Power Plant Lithuania Comision Nacional de Seguridad Nuclear y Salvaguardias Mexico Institute for Environmental Protection and Research It
23. The operability of a safety function can be full the minimum required by OL amp C adequate or inadequate depending upon the operability of the individual redundant and diverse safety systems and components operability of equipment Capability of performing the required function in the required manner operational limits and conditions A set of rules setting forth parameter limits the functional capability and the performance levels of equipment and personnel approved by the regulatory body for safe operation of an authorized facility 16 In most countries for nuclear power plants these are included within Technical Specifications operating area Operating areas are areas where worker access is permitted without specific permits It excludes areas where specific controls are required beyond the general need for a personal dosimeter and or coveralls due to the level of contamination or radiation operating organization An organization applying for authorization or authorized to operate an authorized facility and responsible for its safety Note In practice for an authorized facility the operating organization is normally also the licensee or registrant See also operator operating personnel Individual workers engaged in the operation of an authorized facility operator Any organization or person applying for authorization or authorized and or responsible for nuclear radiation radioactive waste or transport safet
24. Transport of Radioactive Material 6 the aggregate value is calculated as 1 D S D where D is the aggregate value of D f is the fraction of isotope i and D is the D value for isotope i or A D EAD where A is the total activity and A is the activity of the isotope 166 Appendix IV RADIOACTIVE SOURCE CATEGORIZATION BASED ON COMMON PRACTICE Information taken from the IAEA s Categorization of Radioactive Sources 1 TABLE 23 CATEGORIZATION OF COMMON PRACTICES Category Categorization of common practices Typical isotopes 1 Radioisotope thermoelectric Sr 90 Pu 238 generators RTGs Irradiators Co 60 Cs 137 Teletherapy Co 60 Cs 137 Fixed multi beam teletherapy Co 60 gamma knife 2 Industrial gamma radiography Co 60 Se 75 Ir 192 Yb 169 Tm 170 High medium dose rate brachytherapy Co 60 Cs 137 Ir 192 3 Fixed industrial gauges Level gauges Co 60 Cs 137 Dredger gauges Co 60 Cs 137 Conveyor gauges containing high Cs 137 Cf 252 activity radioactive sources Spinning pipe gauges Cs 137 Well logging gauges Am 241 Be Cs 137 Cf 252 4 Low dose rate brachytherapy I 125 Cs 137 Ir 192 Au 198 except eye plaques and permanent implant sources Thickness fill Level gauges Portable gauges e g moisture density gauges Bone densitometers Static eliminators Ra 226 Cf 252 Kr 85 Sr 90 Cs 137 Am 241 Pm 147 Cm 244 Cs 137 Ra 226 Am 241 Be Cf 252 Cd 109 1 125 Gd 153 Am
25. by consideration of the additional factors discussed in Section 6 2 4 6 2 3 3 Below Scale Level 0 events In general events should be classified Below Scale Level 0 only if application of the procedures described above does not lead to a higher rating However provided none of the additional factors discussed in Section 6 2 4 are applicable the following types of events are typical of those that will be categorized Below Scale Level 0 Spurious operation of the safety systems followed by normal return to operation without affecting the safety of the installation No significant degradation of the barriers leak rate less than authorized limits Single failures or component inoperability in a redundant system discovered during scheduled periodic inspection or test 19 Spurious operation in this respect would include operation of a safety system as a result of a control system malfunction instrument drift or individual human error However the actuation of the safety system initiated by variations in physical parameters that has been caused by unintended actions elsewhere in the plant would not be considered as spurious initiation of the safety system 112 6 2 4 Consideration of additional factors Particular aspects may simultaneously challenge different layers of the defence in depth and are consequently to be considered as additional factors that may justify an event having to be rated one level above the one resu
26. carried out It was concluded that neither the driver nor the delivery personnel received measurable doses The D value of Co is 0 03 TBq giving an A D ratio between 0 01 and 1 and hence a Category 4 source Based on the 5 bullet of section C of Table 7 packaging found with inadequate or no shielding where there is significant potential for exposures the rating is Level 1 Level 1 Example 21 Spillage of radioactive material in a nuclear medicine department Level 1 Event description A trolley used to transfer radionuclides from the radiopharmacy to the injection treatment room in a hospital was involved in a collision The event occurred in a hospital corridor and a single dosage of I 4 GBq in liquid form was spilled on the floor Two persons a nurse and a patient were contaminated hands outer clothing and shoes each by an estimated activity of 10 MBq of I Staff from the nuclear medicine department were called and the two people were decontaminated within an hour of the event 61 Estimated doses to the two persons involved were minimal less than 0 5 mSv committed effective dose The area of the spill was temporarily closed for two weeks equivalent to two half lives and was then successfully decontaminated by nuclear medicine staff Rating explanation Criteria Explanation 2 3 Doses to individuals Doses received were below the value for Level 1 3 2 Radiological barriers and Not a
27. countries or territories of their authorities and institutions or of the delimitation of their boundaries The mention of names of specific companies or products whether or not indicated as registered does not imply any intention to infringe proprietary rights nor should it be construed as an endorsement or recommendation on the part of the IAEA CONTENTS SUMMARY OF INES o kreci pira paa eiai eapi a Il Backeround erareco irens ck trir RAINEN ERE EN dies 1 2 General description of the scale 000000 13e SCOPE Ol THE SCALES ers sie waste ipt genus aradgcar gem dghuemnaladadeeisnog leas 1 4 Principles of INES criteria 0 0 0 0 1 4 1 People and the environment 1 4 2 Radiological barriers and controls 1 4 3 Defence in depth 0 0 eee eee eee ee 1 4 4 The final rating 0 0 eee eee eee 1 5 Usine thE SCALE scacincsc Ph viee Mh aae pete aE E E i a ES 1 6 Communicating event information 1 6 1 General principles 0 002 1 6 2 International communications 1 7 Structure of the manual 0 0 0 cece eee eee IMPACT ON PEOPLE AND THE ENVIRONMENT 2 1 General description o 4s cieee veri eeesn TR bet ada eee 22 ACUVILY released ii sneak eed eee eee tee aes 2 2 1 Methods for assessing releases 004 2 2 2 Definition of levels based on activity releas
28. deterministic effects Level 3 is the minimum level for events that result in 1 The occurrence or likely occurrence of a non lethal deterministic effect see Appendix II for further details or 2 Exposure leading to an effective dose greater than ten times the statutory annual whole body dose limit for workers Level 2 is the minimum level for events that result in 1 Exposure of a member of the public leading to an effective dose in excess of 10 mSv or 2 Exposure of a worker in excess of statutory annual dose limits Level 1 is the minimum level for events that result in 1 Exposure ofa member of the public in excess of statutory annual dose limits or 2 Exposure of a worker in excess of dose constraints or gt Where high LET radiation is significant the absorbed dose should take into account the appropriate RBE The RBE weighted absorbed dose should be used to determine the appropriate INES rating The dose limits to be considered are all statutory dose limits including whole body effective dose doses to skin doses to extremities and doses to lens of the eye 7 Dose constraint is a value below the statutory dose limit that may be established by the country 19 3 Cumulative exposure of a worker or a member of the public in excess of statutory annual dose limits 2 3 2 Criteria for consideration of the number of individuals exposed If more than one individua
29. essential cooling systems can be rated in a similar way to failures in electrical systems by taking account of the maximum potential consequences the number of safety layers remaining and the time delay that is acceptable before restoration of cooling is required 122 In the case of failures in the cooling systems of high level liquid waste or plutonium storage Level 3 is likely to be appropriate for events where only a single safety layer remains for a significant period of time 6 4 WORKED EXAMPLES 6 4 1 Events on a shutdown power reactor Example 41 Loss of shutdown cooling due to increase in coolant pressure Below Scale Level 0 Event description Shutdown cooling was being provided by circulation of coolant through two residual heat removal RHR heat exchangers via separate suction lines each with two isolation valves The valves in each line were controlled by separate pressure transducers and were operable from the control room The primary circuit was closed The steam generators were also available ensuring that any temperature increases from loss of RHR would be very slow Safety injection was not available high pressure safety injection HPSI pumps are separate from the charging pumps and relief valves were available to control primary circuit pressure The safety provisions are illustrated in Fig 1 The event occurred when a rise in coolant pressure caused the isolation valves to close Alarms in the control ro
30. failure Unplanned bulk increase in reactivity Loss of service water low pressure high pressure service water or recir culated cooling water Loss of instrument air Loss of on site electrical power Class IV HI II or I II 3 3 Category 3 Unlikely Major LOCA up to and including the largest justified pipe rupture in the reactor coolant pressure boundary Major power conversion system pipe rupture up to and including the largest justified pipe rupture H 4 RBMK REACTORS LWGR II 4 1 Category 1 Expected Reactor trip Malfunction in the system of neutron control of reactor power Loss of main feedwater flow Reactor coolant system primary circuit depressurisation due to inadvertent operation of an active component e g a safety or relief valve Primary circuit leak not hindering normal reactor trip and cooldown 177 Reduced coolant flow through a group of fuel channels and reactor protection system channels Reduced helium mixture flow in the reactor graphite stacking Loss of off site AC power including voltage and frequency disturbances Operation with a fuel assembly in any misoriented or misplaced position Minor fuel handling incident Depressurization of the fuel channel in the course of refuelling II 4 2 Category 2 Possible Small LOCA Spent fuel assembly drop Leakage from spent fuel pool in
31. in depth rating Overall rating Level 2 Example 54 Power excursion at research reactor during fuel loading Level 2 Event description A power excursion which resulted in a reactor trip on overpower occurred at a research reactor during a refueling operation The reactor is a small pool type research reactor Following replacement of a shim safety rod control assembly the fuel assemblies were being returned to the core After loading the fifth fuel assembly the shim safety rods were withdrawn to check that the reactor was not critical The rods were then driven to the 85 withdrawn position instead of the required 40 safeguard position On insertion of the 6th fuel assembly a blue glow was seen and the reactor tripped on overpower The neutron flux trip system had been bypassed to avoid spurious trips while moving irradiated fuel into position for loading into the core and the bypass had not been turned off The power transient maximum was estimated to be about 300 of full power Procedures related to refueling are being reviewed and revised 140 Rating explanation Criteria Explanation 2 and 3 Actual consequences There were no actual consequences from the event 6 2 1 Maximum potential It had been shown that the maximum potential rating consequences for this reactor would not exceed Level 4 6 2 2 Identification of number The one barrier preventing a significant release was the of safety layers overpow
32. is appropriate otherwise this section is appropriate It may be necessary to consider an event using both sections if an initiator occurs and reveals a reduced operability in a system not challenged by the real initiator e g if a reactor trip without loss of off site power reveals a reduced operability of diesels For events involving potential failures that could have led to inoperability of safety systems e g discovery of structural defects a similar approach is used but it is necessary to take into account the likelihood of inoperability of the safety system This is explained in Section 5 1 5 5 1 4 1 Basis of rating The appropriate ratings for events without a real initiator are given in Table 10 The basis of the values given in the table is as follows The rating of an event will depend on the extent to which the safety functions are degraded and on the likelihood of the initiator for which they are provided Strictly speaking it is the likelihood of the initiator occurring during the period of safety function degradation but in general the methodology does not take account of the time period However if the period of degradation is very short a level lower than that provided in Table 10 may be appropriate see Section 5 1 4 2 If the operability of a safety function is inadequate then an accident was only prevented because an initiator did not occur For such an event if the safety function is required for expected initia
33. long times being available to repair or mitigate the fault highly reliable safety layer In some cases the time available may be such that there are a whole range of potential safety layers that can be made available and it has not been considered necessary in the safety justifi cation to identify each of them in detail or to include in the procedure the detail of how to make each of them available In such cases provided there are a range of practicable measures that could be implemented this long time available itself provides a highly reliable safety layer incident In the context of the reporting and analysis of events the word incident is used to describe events that are less severe than accidents For communicating the significance of events to the public INES rates events at one of seven levels and uses the term incident to describe events up to and including Level 3 Events of greater significance are termed accidents initiator initiating event An initiator or initiating event is an event identified in the safety analysis that leads to a deviation from the normal operating state and challenges one or more safety functions 187 internal exposure Exposure to radiation from a source within the body 16 investigation level The value of a quantity such as effective dose intake or contamination per unit area or volume at or above which an investigation is recommended to be conducted operability of a safety function
34. of Level 2 or 3 As explained in that section the level chosen depends on the extent to which the operability is greater than just adequate In this event because of the availability of natural circulation and the limited time for which forced circulation was unavailable Level 2 is appropriate Regarding possible uprating there are two issues to be considered both identified in Section 5 2 1 The fault involved common mode failure of all the circulators However this fact has already been taken into account in the basic rating and to uprate the event would be double counting see introduction to Section 5 2 item 2 The other relevant factor is the difficulties caused by absent indications However these were more relevant to controlling the initial transient and could not have led to a worsening of the post trip cooling situation Furthermore from item 3 of the introduction to Section 5 2 Level 3 would be inappropriate as a single further component failure would not have led to an accident Level 2 Example 37 Small primary circuit leak Level 2 Event description A very small leak detected only by humidity measurement was discovered in the non isolatable part of one safety injection line owing to defects that were not expected by the surveillance programme the area was not inspected by the surveillance programme Similar but smaller defects were present in the other safety injection lines 97 Rating exp
35. operation of pressure sensors caused the isolation valves to close Alarms in the control room notified the operating personnel of the valve closure and having checked that the pressure rise was a spurious signal the valves were re opened Temperatures did not rise above the limits in OL amp C 128 Rating explanation Criteria Explanation 2 and 3 Actual consequences 6 2 1 Maximum potential consequences 6 2 2 Identification of number of safety layers 6 2 3 Assessment of the basic rating Overall rating There were no actual consequences from the event The maximum potential consequences for an event associated with a shutdown power reactor are Level 5 7 The only safety layer is cooling of the primary coolant through the single RHR suction pipe Again it is necessary to consider both the hardware and procedural aspects of the safety layer Consider first the actions required in order to restore cooling The operating personnel must ensure that the pressure signal was spurious and that if the rise in coolant temperature has caused a subsequent rise in pressure the pressure needs to be reduced A procedure for re instating RHR after closure of the valves did exist The operation can be carried out in the time available but not with a large margin From the hardware viewpoint failure of either valve to re open will result in the unavailability of the safety layer Also there is certainly not sufficient
36. other hand this time available for manual actions may replace part of the safety provisions in terms of redundancy or diversity i e depending on the status of the plant a reduction in the redundancy of safety equipment and or barriers may be acceptable during some periods of cold shutdown In such shutdown conditions the configurations of the barriers are sometimes also quite different e g an open primary coolant system or an open containment It is for these reasons that an alternative approach to rating events is provided for shutdown reactors i e the safety layers approach The main factors affecting rating are the number of trains of cooling provided the time available for corrective actions and the integrity of any pipework for cooling vessels Some examples based on pressurized water reactors during cold shutdown are given in section 6 4 1 Example 41 to Example 46 to give guidance for rating events following the safety layers approach For other reactor types it will be necessary to use this as illustrative guidance together with Section 6 2 to rate such events 6 3 2 Events involving failures in cooling systems affecting the spent fuel pool After some years of operation the radioactive inventory of the spent fuel pool may be high In this case the rating of events affecting the spent fuel pool with respect to impact on defence in depth may span the full range up to Level 3 116 Because of the large water inventory and
37. reacted with air and started burning The first indication of an abnormal condition was provided by air samplers about 800 m away Radioactivity levels were 10 times that normally found in air 26 Sampling closer to the reactor building confirmed radioactivity releases were occurring Inspection of the core indicated the fuel elements in approximately 150 channels were overheated After several hours of trying different methods the fire was extinguished by a combination of water deluge and switching off the forced air cooling fans The plant was cooled down The amount of activity released was estimated to be between 500 and 700 TBq of I and 20 to 40 TBq of Cs There were no deterministic effects and no one received a dose approaching ten times the statutory annual whole body dose limit for workers Rating explanation Criteria Explanation 2 2 Activity released The factor for the radiological equivalence of 137Cs from Table 2 is 40 so the total release was radiologically equivalent to between 1300 and 2300 TBq I As the upper limit is well below 5000 TBq this is rated at Level 5 equivalent to hundreds to thousands of TBq I 2 3 Doses to individuals Not applicable Actual individual doses are not given but as no one received doses approaching the Level 3 criteria the individual dose criteria cannot give rise to a higher rating than that already derived from the large release criteria Rating for impact on people
38. research reactors accelerators or facilities with Category 1 sources and reactors MOU At POWE s soscccasatesvdasevszcecesssscdeslosstscacestescsased utaeseacasveateascessies 193 Table 1 Table 2 Table 3 Table 4 Table 5 Table 6 Table 7 Table 8 Table 9 Table 10 Table 11 Table 12 Table 13 Table 14 Table 15 Table 16 Table 17 Table 18 Table 19 Table 20 Table 21 Table 22 Table 23 LIST OF TABLES General criteria for rating events in INES Radiological equivalence to I for releases to THe AtMOSPH E A T A Summary of rating based on doses to individuals Radiological equivalence for facility contamination Relationship between A D ratio source category maximum potential consequences and defence in depth tating esseen enaar NEE AE EET Event rating for lost or found radioactive sources devices or transport packages eseseresererrrerrressrerererreees Event rating for events involving degradation of safety PLOVISIONS criaria s r E AEAEE Rating for other safety relevant events secsec Events with a real initiator sisien Events without a real initiator eee eeeeeeeeeeeeeees Rating of events using the safety layers approach Examples illustrating INES criteria for rating events at NUCICAr facilities siscesssssvssrstess sesisissesionstesestcasiveieccusebeestaeasisy Examples illustrating INES for rating events involving radiati
39. sources is assured by good design well controlled operation administrative controls and a range of protection systems e g interlocks alarms and physical barriers A defence in depth approach is applied to these safety provisions so that allowance is made for the possibility of equipment failure human error and the occurrence of unplanned developments Defence in depth is thus a combination of conservative design quality assurance surveillance mitigation measures and a general safety culture that strengthens each of the other aspects The INES rating methodology considers the number of safety provisions that still remained functional in an event and the potential consequences if all the safety provisions failed As well as considering these factors INES methodology also considers additional factors i e those aspects of the event that may indicate a deeper degradation within the management or the arrangements controlling the operations associated with the event This section is divided into three main sections The first Section 4 1 gives the general principles that are to be used to rate events under defence in depth Because they need to cover a wide range of types of events they are general in nature In order to ensure that they are applied in a consistent manner Section 4 2 gives more detailed guidance The third section Section 4 3 gives a number of worked examples 42 4 1 GENERAL PRINCIPLES FOR RATING OF EVENTS
40. tables of examples Tables 12 and 13 are provided to illustrate how some actual events are rated 144 Event related to radiation or nuclear safety Yes Impact on People and Environment Maximum level for impact on people and environment criteria FIG 4 General INES rating procedure radioactive material at facilities incl fuel damage Yes Impact on Radiological Barriers and oe at facilities Go to Figure 6 Chapter 3 Reactor fuel damage Loss of confinement High radiation Contamination Maximum level for impact on radiological barriers and controls criteria Go to Figure 7 Chapter 4 to6 i Transport and radiation sources Chapter 4 Reactors at 7 rsa power Specific facilities Chapter 6 Maximum level for defence in depth criteria Check if rating is consistent with the general description of the scale in Table 1 145 Calculate radiological equivalence Table 2 or use D value Section 2 2 1 radioactive material to the environment Equivalent to more than thousands of TBq of I 1317 quivalent to gt than hundreds of TBq Are there doses to z Determine level from 131 or 2500 D individuals ji Table 3 Equivalent to gt than tens of TBq l 131 or 250 D7 ma PTT Below Scale Level of Exposure Number of Individuals Level 0 The occurrence of a lethal deterministic effect or Fe
41. taken then the rating of the maximum potential consequences is Level 3 or 4 from the individual dose criteria in Section 2 3 For events on small research reactors power of about 1 MW or less although the physical mechanisms exist for the dispersal of a significant fraction of the inventory either through criticality events or loss of fuel cooling the total inventory is such that the rating of the maximum potential consequences could not be higher than Level 4 even if all the safety provisions fail For events on power reactors during shutdown the inventory and physical mechanisms that exist for the dispersal of a significant fraction of that inventory through loss of cooling or criticality events are such that the rating of the maximum potential consequences could exceed Level 4 if all the safety provisions fail For reprocessing facilities and other facilities processing plutonium compounds the inventory and physical mechanisms that exist for the dispersal of a significant fraction of that inventory either through criticality events chemical explosions or fires are such that the rating of the maximum potential consequences could exceed Level 4 if all the safety provisions fail For uranium fuel fabrication and enrichment facilities releases may have chemical and radiation safety aspects It has to be emphasized that the chemical risk posed by the toxicity of fluorine and uranium predominates over the radiological risk INES
42. the comparably low decay heat there is usually plenty of time available for corrective actions to be taken for events involving degradation of spent fuel pool cooling This is equally true for a loss of coolant from the spent fuel pool since the leakage from the pool is limited by design Thus a failure of the spent fuel pool cooling system for some hours or a coolant leakage will not usually affect the spent fuel Therefore minor degradation of the pool cooling system or minor leakages should be typically rated at Below Scale Level 0 Operation outside the OL amp C or a substantial increase in temperature or decrease of the spent fuel pool coolant level should be rated as Level 1 An indication of Level 2 could be widespread boiling of coolant or fuel elements becoming uncovered Substantial fuel element uncovering clearly indicates Level 3 6 3 3 Criticality control The behaviour of a critical system and its radiological consequences are heavily dependent on the physical conditions and characteristics of the system In homogeneous fissile solutions the possible number of fissions the power level of the criticality excursion and the potential consequences of a criticality excursion are limited by these characteristics Experience with criticality excursions in fissile solutions shows that typically the total number of fissions is in the order of 10 7 10 Heterogeneous critical systems such as fuel rod lattices or dry solid critical sy
43. the initiator 5 1 2 Safety function Even though no diesels were available the availability operability of the safety function was just adequate due to the limited time of loss of off site supplies 5 1 3 and 5 1 4 Basic rating There was a real initiator From Section 5 1 3 box C 1 of Table 9 is appropriate giving a basic rating of Level 2 or 3 As the safety function was only just adequate Level 3 was chosen 5 2 Additional factors There are no reasons for uprating Final rating Level 3 Example 40 Complete station blackout owing to a fire in the turbine building Level 3 Event description A fire occurred in the turbine building The PHWR was tripped manually and a cooldown of the reactor was initiated Due to the fire many cables and other electrical equipment were damaged which resulted in a complete station blackout Core decay heat removal was through natural circulation Water was fed to the secondary side of the steam generators using diesel fire pumps Borated heavy water was added to the moderator to maintain the reactor in a sub critical state at all stages 101 Rating explanation Criteria Explanation 2 and 3 Actual consequences 5 1 1 Initiator frequency 5 1 2 Safety function operability 5 1 3 and 5 1 4 Basic rating 5 2 Additional factors Final rating There were no actual consequences from the event Loss of on site electrical power Class IV HI TI or I i
44. to carry out the required actions Because of the long time available the operating procedure and actions by operating personnel can be regarded as more reliable than a single safety layer The limiting aspect of the safety provisions is now the two hardware layers 6 2 3 Assessment of the basic Based on Table 11 the existence of two hardware layers rating means that the event should be rated at Level 2 Overall rating Level 2 127 Valves on 1st line Valves on 2nd line of RHR open of RHR open Operating Procedure to Reduce Pressure and open valves FIG 2 Illustration of safety layers for Examples 44 and 46 Example 45 Loss of shutdown cooling due to spurious operation of pressure sensors Level 3 Event description The design is the same as in Example 42 but the event occurred soon after shutdown Shutdown cooling was being provided by circulation of coolant through an RHR heat exchanger via a single suction pipe with two isolation valves The primary circuit was closed In the event of closure of the isolating valves the coolant temperature will rise but will take approximately one hour to reach unacceptable temperatures The valves are operable from the control room Steam generators are open for work and therefore unavailable Safety injection is not available HPSI pumps are separate from the charging pumps and relief valves are available to control primary circuit pressure The event occurred when spurious
45. to restore the RHR cooling with alternative systems The number of remaining layers being two the event would have then been rated at Level 2 It would not have been increased to Level 3 as one further failure would not have led to an accident see section 6 2 4 126 Example 44 Loss of shutdown cooling due to increase in coolant pressure Level 2 Event description The design is identical to that in Example 41 but the steam generators were open for work and therefore unavailable The safety provisions are illustrated in Fig 2 The event occurred some time after the reactor had been shut down when a rise in coolant pressure caused the RHR isolation valves to close Alarms in the control room notified the operating personnel of the valve closure and having reduced the pressure the valves were re opened Tempera tures did not rise above the limits in OL amp C Decay heat was sufficiently low that it would have taken five hours to reach the operational limits Rating explanation Criteria Explanation 2 and 3 Actual consequences There were no actual consequences from the event 6 2 1 Maximum potential The maximum potential consequences for an event consequences associated with a shutdown power reactor are Levels 5 7 6 2 2 Identification of number The safety provisions are illustrated in Fig 2 There are of safety layers two hardware safety layers and a software safety layer in series and there are at least 5 h
46. 100 1400 Vienna Austria fax 43 1 2600 29302 tel 43 1 2600 22417 email sales publications iaea org http www iaea org books IAEA 2009 Printed by the IAEA in Austria May 2009 IAEA INES 2009 FOREWORD The need for easily communicating the significance of any event related to the operation of nuclear facilities or the conduct of activities that give rise to radiation risks arose in the 1980s following some accidents in nuclear facilities that attracted international media attention In response and based on previous national experience in some countries proposals were made for the development of an international event rating scale similar to scales already in use in other areas such as those comparing the severity of earthquakes so that communication on the radiation risks associated with a particular event could be made consistent from one country to another The International Nuclear and Radiological Event Scale INES was developed in 1990 by international experts convened by the IAEA and the OECD Nuclear Energy Agency OECD NEA with the aim of communicating the safety significance of events at nuclear installations Since then INES has been expanded to meet the growing need for communication on the significance of any event giving rise to radiation risks In order to better meet public expectations INES was refined in 1992 and extended to be applicable to any event associated with radioactive material and or radiation
47. 1996 INTERNATIONAL ATOMIC ENERGY AGENCY Generic procedures for assessment and response during a radiological emergency IAEA TECDOC 1162 IAEA Vienna 2000 INTERNATIONAL ATOMIC ENERGY AGENCY IAEA Safety Glossary Terminology Used in Nuclear Safety and Radiation Protection 2007 Edition IAEA Vienna 2007 INTERNATIONAL NUCLEAR SAFETY ADVISORY GROUP Defence in Depth in Nuclear Safety INSAG 10 IAEA Vienna 1996 INTERNATIONAL ATOMIC ENERGY AGENCY Basic Safety Principles for Nuclear Power Plants Safety Series No 75 INSAG 3 IAEA Vienna 1999 INTERNATIONAL ATOMIC ENERGY AGENCY Code of Conduct on the Safety and Security of Radioactive Sources IAEA Vienna 2004 Annex I DEFENCE IN DEPTH It has often been said that the safe operation of nuclear power plants is assured by maintaining three basic safety functions 1 Reactivity control 2 Cooling the fuel d Confinement This can be generalized to apply to the safe operation of any activity involving the use of radioactive material by stating that safe operation is assured by maintaining three basic safety functions 1 Controlling the reactivity or the process conditions 2 Cooling the radioactive material 3 Radiological control e g confinement of radioactive material and shielding For some practices not all of these safety functions are relevant e g for industrial radiography only the third function is relevant Each of the safety func
48. 2 4 item 3 Level 1 138 Example 53 Failure of a shield door interlocking system Level 2 Event description The event occurred when a container of highly radioactive vitrified waste was moved into a cell while the shield doors to the cell were open following a maintenance operation The opening of the doors was controlled by a key exchange system installed interlocks based on gamma detectors and programmable logic controllers The original design of the cell access system was modified twice during the commissioning period in an attempt to improve it All of these systems failed to prevent the transfer of highly radioactive material into the cell while the shield doors were open Entry of personnel to this area is controlled by a permit that requires each person to wear a personal alarming dosimeter Personnel who might have been present in the cell or adjacent areas could have received a serious radiation exposure if they had failed to respond to either the container movement or their personal alarming dosimeter sounding a warning In the event the operating personnel quickly observed the problem and closed the shield doors No one received any additional exposure The facility design concerning access to the cells had been modified during commissioning and the consequences of these changes had been inadequately considered In particular The commissioning of the interlock key exchange system for the cell shield doors
49. 241 Po 210 Am 241 167 TABLE 23 CATEGORIZATION OF COMMON PRACTICES cont Category Categorization of common practices Typical isotopes 5 Low dose rate brachytherapy eye plaques and permanent implant sources X ray fluorescence devices Electron capture devices Mossbauer spectrometry Positron emission tomography PET check sources Sr 90 Ru Rh 106 Pd 103 Fe 55 Cd 109 Co 57 Ni 63 H 3 Co 57 Ge 68 168 REFERENCES INTERNATIONAL ATOMIC ENERGY AGENCY Categorization of Radioactive Sources IAEA Safety Standards Series No RS G 1 9 IAEA Vienna 2005 INTERNATIONAL ATOMIC ENERGY AGENCY The International Nuclear Event Scale INES User s Manual 2001 Edition IAEA Vienna 2001 INTERNATIONAL ATOMIC ENERGY AGENCY Rating of Transport and Radiation Source Events Additional Guidance for the INES National Officers Working Material IAEA INES WM 04 2006 IAEA Vienna 2006 INTERNATIONAL ATOMIC ENERGY AGENCY Clarification for Fuel Damage Events Working Material IAEA INES WM 03 2004 IAEA Vienna 2004 INTERNATIONAL ATOMIC ENERGY AGENCY Dangerous Quantities of Radioactive Material D Values Emergency Preparedness and Response EPR D Values 2006 IAEA Vienna 2006 INTERNATIONAL ATOMIC ENERGY AGENCY Regulations for the Safe Transport of Radioactive Material 2005 Edition IAEA Safety Standards Series No TS R 1 IAEA Vienna 2005 INTERNATIONAL NUCLEAR SAFETY ADVISORY GROUP Sa
50. INES The International Nuclear and Radiological Event Scale User s Manual 2008 Edition 7 MAJOR ACCIDENT 6 SERIOUS ACCIDENT 5 ACCIDENT WITH WIDER CONSEQUENCES LWIGIDs9VW 4 ACCIDENT WITH LOCAL CONSEQUENCES 3 SERIOUS INCIDENT 2 INCIDENT 1 ANOMALY ANZGIoawn CS IAEA International Atomic Energy Agency INES THE INTERNATIONAL NUCLEAR AND RADIOLOGICAL EVENT SCALE USER S MANUAL 2008 Edition INES THE INTERNATIONAL NUCLEAR AND RADIOLOGICAL EVENT SCALE USER S MANUAL 2008 EDITION CO SPONSORED BY THE INTERNATIONAL ATOMIC ENERGY AGENCY AND OECD NUCLEAR ENERGY AGENCY INTERNATIONAL ATOMIC ENERGY AGENCY VIENNA 2009 COPYRIGHT NOTICE All IAEA scientific and technical publications are protected by the terms of the Universal Copyright Convention as adopted in 1952 Berne and as revised in 1972 Paris The copyright has since been extended by the World Intellectual Property Organization Geneva to include electronic and virtual intellectual property Permission to use whole or parts of texts contained in IAEA publications in printed or electronic form must be obtained and is usually subject to royalty agreements Proposals for non commercial reproductions and translations are welcomed and considered on a case by case basis Enquiries should be addressed to the IAEA Publishing Section at Sales and Promotion Publishing Section International Atomic Energy Agency Wagramer Strasse 5 P O Box
51. Level 5 and the environment Example 6 Overheating of high level waste storage tank in a reprocessing facility Level 6 Event description The cooling system of a highly radioactive waste storage tank failed resulting in a temperature increase of the contents of the tank The subsequent explosion of dry nitrate and acetate salts had a force of 75 tons of TNT The 2 5 m thick concrete lid was thrown 30 m away Emergency measures including evacuation were taken to limit serious health effects The most significant component of the release was 1000 TBq of Sr and 13 TBq of Cs A large area measuring 300 x 50 km was contaminated by more than 4 kBq m of Sr 27 Rating explanation Criteria Explanation 2 2 Activity released The factors for the radiological equivalence of Sr and Cs from Table 2 are 20 and 40 respectively so the total release was radiologically equivalent to 20 500 TBq I This is rated at Level 6 equivalent to thousands to tens of thousands of TBq I 2 3 Doses to individuals Not necessary to consider as event is already rated at Level 6 Rating for actual consequences Level 6 Example 7 Major release of activity following criticality accident and fire Level 7 Event description Design weaknesses and a poorly planned and conducted test led to a reactor going supercritical Attempts were made to shut the reactor down but an energy spike occurred and some of the fuel rods be
52. NES allocates three levels for the impact on defence in depth the maximum potential consequences for some facilities or practices even if all the safety provisions fail are limited by the inventory of the radioactive material and the release mechanism It is not appropriate to rate events 103 associated with the defence in depth provisions for such practices at the highest of the defence in depth levels If the maximum potential consequences for a particular practice cannot be rated higher than Level 4 on the scale a maximum rating of Level 2 is appropriate under defence in depth Similarly if the maximum potential consequences cannot be rated higher than Level 2 then the maximum rating under defence in depth is Level 1 One facility can cover a number of practices and each practice must be considered separately in this context For example waste storage and reprocessing should be considered as separate practices even though they can both occur at one facility Having identified the upper limit to the rating under defence in depth it is then necessary to consider what safety provisions still remain in place i e what additional failures of safety provisions would be required to result in the maximum potential consequences for the practice This includes consideration of hardware and administrative systems for prevention control and mitigation including passive and active barriers The approach to rating is based on assessing the likelihoo
53. NUTES Level 2 cc scccves snccrcnedenveceaysosasearsxevenserespecssvessonenenss Small primary circuit leak Level 2 oe Partial blockage of the water intake during cold weather Leyel A ashssecebeusstsstvaccsytiiess cusstsstite TE Unit scram caused by grid disturbances due to tornado E E E E E E casteen sn Complete station blackout owing to a fire in the turbine building Level 3 oo eeeseeseeeeseeseseeeeeeeeceeeeeseeeens Loss of shutdown cooling due to increase in coolant pressure Below scale Level 0 00 0 cece ceeeseeeeseseeeeeeseee Loss of shutdown cooling due to spurious operation of pressure sensors Below scale Level 0 Complete loss of shutdown cooling Level 1 Loss of shutdown cooling due to increase in coolant pressure Level 2 oiiedecsatine rarna kasaenan autdxcatancthdyoeias sdeassitass Loss of shutdown cooling due to spurious operation of pressure sensors Level 3 oe eeeeeeteeceteeceeeeeeneeeeeeeaeeeens Loss of shutdown cooling due to increase in coolant pressure Level Sri scgecssteascasadecnsscenshsavchthy satavensancetsbsttes cabessasues Pressurization of the void above the liquid level in a fuel element dissolver vessel Below scale Level 0 Loss of cooling at a small research reactor Below Scale Levell Ov ccsc ccsscovsesseressvssvsvevsovecssesenrasenecacissersvenesions Example 49 Example 50 Example 51 Example 52 Example 53 Example 54 Example 55 High
54. ON OF ADDITIONAL FACTORS Particular aspects may challenge simultaneously different layers of the defence in depth and are consequently to be considered as additional factors that may justify an event having to be rated one level above the one resulting from the previous guidance The main additional factors that act in such a way are Common cause failures Procedural inadequacies Safety culture issues Because of such factors it is possible that an event could be rated at Level 1 even though it is of no safety significance on its own without taking into account these additional factors When assessing the increase of the basic rating due to these factors the following aspects require consideration 1 Allowing for all additional factors the level of an event can only be increased by one level 2 Some of the above factors may have already been included in the basic rating e g common mode failure It is therefore important to take care that such failures are not double counted 3 The event cannot be increased beyond Level 3 and this upper limit for defence in depth should only be applied to those situations where had one other event happened either an expected initiator or a further component failure an accident would have occurred 17 Spurious operation in this respect would include operation of a safety system as a result of a control system malfunction instrument drift or individual human error However
55. RATING BASED ON DOSES TO INDIVIDUALS Minimum Number of Actual Level of exposure a ei f rating individuals rating The occurrence of a lethal deterministic effect 4 Few tens or more 6 or Between several 5 the likely occurrence of a lethal deterministic effect as a result of a whole body absorbed dose of the order of a few Gy Less than several 4 and a few tens The occurrence or likely occurrence of a 3 Few tens or more 5 non lethal deterministic effect Between several 4 and a few tens Less than several 3 Exposure leading to an effective dose greater 3 100 or more 5 than ten times the statutory annual whole Co 4 body dose limit for workers Less than ten 3 Exposure of amember of the public leading to 2 100 or more 4 an effective dose in excess of 10 mSv 10 or more 3 or Less than ten 2 Exposure of a worker in excess of statutory annual dose limits 21 TABLE 3 SUMMARY OF RATING BASED ON DOSES TO INDIVIDUALS cont Minimum Number of Actual Level of exposure ree rating individuals rating Exposure of a member of the public in excess 1 100 or more 3 of statutory annual dose limits 10 of more 2 or i Exposure of a worker in excess of dose Less than ten 1 constraints Cumulative exposure of workers or members 1 1 or more 1 of the public in excess of statutory annual dose limits Level 6 is not considered credible for any event involving radiation sources As explained in Section 2 3 the
56. S terminology This more specific INES definition is used to aid public understanding of safety significance actual consequences In this manual this refers to consequences rated using these criteria for assessing the impact on people and the environment as well as radiological barriers and controls at facilities This is in contrast to events rated using the criteria for degradation of defence in depth which covers those events with no actual consequences but where the measures put in place to prevent or cope with accidents did not operate as intended 183 additional factors Factors that can result in an increase in the basic event rating Additional factors allow for those aspects of the event that may indicate a deeper degradation of the plant or the organizational arrange ments of the facility Factors considered are common cause failures procedural inadequacies and safety culture deficiencies annual dose The dose due to external exposure in a year plus the committed dose from intakes of radionuclides in that year 16 authorized facilities Facilities for which a specific form of authorization has been given These include nuclear facilities irradiation installations some mining and raw material processing facilities such as uranium mines radioactive waste management facilities and any other places where radioactive materials are produced processed used handled stored or disposed of or where radiation generators are
57. Sv per Bqm Bqsm Bqsm Bqs m Am 241 6 40E 06 1 01E 08 9 60E 05 3 17E 08 4 17E 08 8100 Co 60 1 70E 07 2 55E 10 3 10E 08 1 02E 11 2 65E 10 51 Cs 134 5 10E 09 7 65E 11 2 00E 08 6 60E 12 1 43E 11 2 8 Cs 137 1 30E 07 1 95E 10 3 90E 08 1 29E 11 2 08E 10 40 H 3 0 00E 00 0 00E 00 2 60E 10 8 58E 14 8 58E 14 0 020 1 131 2 70E 10 2 70E 12 7 40E 09 2 44E 12 5 14E 12 1 0 Ir 192 4 40E 09 6 60E 09 6 60E 09 2 18E 12 8 78E 12 1 7 Mn 54 1 40E 08 2 10E 11 1 50E 09 4 95E 13 2 15E 11 4 2 Mo 99 6 10E 11 9 15E 14 9 90E 10 3 27E 13 4 18E 13 0 08 P 32 6 80E 12 1 02E 14 3 40E 09 1 12E 12 1 13E 12 0 22 Pu 239 8 50E 06 1 28E 08 1 20E 04 3 96E 08 5 24E 08 10 000 Ru 106 4 80E 09 7 20E 12 6 60E 08 2 18E 11 2 90E 11 5 6 Sr 90 2 10E 08 3 15E 11 1 60E 07 5 28E 11 8 43E 11 16 Te 132 6 90E 10 1 04E 12 2 00E 09 6 60E 13 1 70E 12 0 33 U 235 S 1 50E 06 2 25E 09 8 50E 06 2 81E 09 5 06E 09 980 U 235 M 1 50E 06 2 25E 09 3 10E 06 1 02E 09 3 27E 09 640 U 235 F 1 50E 06 2 25E 09 5 20E 07 1 72E 10 2 42E 09 470 U 238 S 1 40E 06 2 10E 09 8 00E 06 2 64E 09 4 74E 09 920 U 238 M 1 40E 06 2 10E 09 2 90E 06 9 57E 10 3 06E 09 590 U 238 F 1 40E 06 2 10E 09 5 00E 07 1 65E 10 2 27E 09 440 Uki 1 80E 06 2 70E 09 1 04E 05 3 42E 09 6 12E 09 1200 Noble gases Negligible effectively 0 a value Lung absorption types S slow M medium F fast If unsure use the most conservative 157 TABLE 16 RADIOLOGICAL EQUIVALENCES Multiplication factors
58. TERNATIONAL NUCLEAR SAFETY ADVISORY GROUP Basic Safety Principles for Nuclear Power Plants Safety Series No 75 INSAG 3 IAEA Vienna 1999 I 2 INTERNATIONAL NUCLEAR SAFETY ADVISORY GROUP Defence in Depth in Nuclear Safety INSAG 10 IAEA Vienna 1996 172 TABLE I 1 DEFENCE IN DEPTH IN DESIGN AND OPERATION Objective Means of Treatment within INES implementation For power reactors For other facilities Section 5 Section 6 Prevention of Conservative Addressed by Each well abnormal operation design and high considering the designed system and failures quality in likelihood of the is considered as construction and initiator one or more operation safety layers Control of abnormal operation and detection of failures Control of accidents within the design basis Control of severe plant conditions including prevention of accident progression and mitigation of the consequences of severe accidents Mitigation of radiological consequences of significant releases of radioactive materials Control limiting and protection systems and other surveillance features Engineered safety features and accident procedures Complementary measures and accident management Off site emergency response Control and surveillance features are addressed by considering the likelihood of the initiator Protection systems are included as safety systems and hence addressed by considering the
59. Table 9 However the occurrence of a possible or unlikely initiator even though there may be considerable redundancy in the safety systems represents a failure of one of the important parts of defence in depth namely the prevention of initiators For this reason Table 9 shows Level 1 for possible initiators and Level 2 for unlikely initiators If the operability of safety functions is the minimum required by OL amp C then in some cases as already noted for possible and particularly for unlikely initiators there will be no further redundancy Therefore Level 2 or 3 is appropriate depending on the remaining redundancy For expected initiators there will be additional redundancy and therefore a lower rating is proposed Table 9 shows Level 1 or 2 where again the value chosen should depend on the additional redundancy within the safety function Where the safety function availability is greater than the minimum required by OL amp C but less than full there may be considerable redundancy and diversity available for expected initiators In such cases Below Scale Level 0 would be more appropriate TABLE 9 EVENTS WITH A REAL INITIATOR Initiator frequency Safety function operability 1 2 3 Expected Possible Unlikely A Full 0 1 2 B Minimum required by operational limits Lose 2 or3 20 3 and conditions C Adequate 2 or 3 2 or3 2 or3 Inadequate 3 3 3 T3 5 1 3 2 Rating procedure With the background described in the pre
60. The event rating will be the highest of the ratings associated with each initiator For example a power excursion in a reactor could be an initiator challenging the protection function Successful operation of the protection system would then lead to a shutdown It would then be necessary to consider the reactor trip as an initiator challenging the fuel cooling function 5 1 2 Safety function operability The three basic safety functions for reactor operation are 1 controlling the reactivity 2 cooling the fuel and 3 confining the radioactive material These functions are provided by passive systems such as physical barriers and by active systems such as the reactor protection system Several safety systems may contribute to a particular safety function and the function may still be achieved even with one system unavailable Following an initiator non safety systems may also contribute to a particular safety function see explanation under definition of Adequate C Equally support systems such as electrical supplies cooling and instrument supplies will be required to ensure that a safety function is achieved It is important to evaluate the operability of the safety function when events are rated not the operability of an individual system A system or component is considered operable when it is capable of performing its required function in the required manner The operational limits and conditions OL amp C of a plant gover
61. Threshold level Exposure Eff Target organ pathway ect or tissue Value Commitment period Gy Footnote d Inhalation and Haematopoietic Red marrow 0 2 30 ingestion syndrome 24 Inhalation Pneumonitis Alveolar interstitial 30 30 region or respiratory tract Inhalation and Gastrointestinal Colon 20 30 ingestion syndrome Inhalation and Hypothyroidism Thyroid 2 365 ingestion a b For cases of supportive medical care Radionuclides with Z 2 90 compared with Z lt 89 have different biokinetic processes hence different dynamics of dose formation in red marrow due to internal exposure Therefore radio nuclides have been divided into two groups to avoid the over conservatism in evaluating the risk of the health effect concerned For radionuclides with Z gt 90 For radionuclides with Z lt 89 The value from Appendix A of Ref 9 was used Considering the biological and physical half life of the radionuclides that result in significant thyroid dose isotopes of I and Te these dose factors were in fact for a commitment period of much less than 365 days however the commitment period of 365 days is assigned to this reference level a oa o 161 TABLE 20 RBEs USED FOR SEVERE DETERMINISTIC HEALTH EFFECTS Health effect Critical organ Exposure RBE External y 1 Red External n 3 Haematopoietic syndrome Internal B y 1 marrow Internal a 2 Internal B y 1 Pneumonitis Lung In
62. VALUES FOR A RANGE OF ISOTOPES Information is taken from the IAEA s Categorization of Radioactive Sources 1 In that publication and its supporting reference 5 two types of D values are considered The D values are a level of activity above which a source is considered to be dangerous and has a significant potential to cause severe deterministic effects if not managed safely and securely The D value is the activity of a radionuclide in a source that if uncontrolled but not dispersed i e it remains encapsulated might result in an emergency that could reasonably be expected to cause severe deterministic health effects The D value is the activity of a radionuclide in a source that if uncontrolled and dispersed might result in an emergency that could reasonably be expected to cause severe deterministic health effects The recommended D values are then the most limiting of the D and D values To be consistent with this approach two sets of D values are provided in this Appendix For Section 2 where the criteria related to dispersed material the D values are used Table 21 For Section 4 where the criteria relate to defence in depth the overall D values should be used Table 22 HI 1 D VALUES FOR RADIONUCLIDES FOR USE WITH SECTION 2 CRITERIA TABLE 21 D VALUES FOR A RANGE OF ISOTOPES D Radionuclide TBq Am 241 6 E 02 Am 241 Be 6 E 02 Au 198 3 E 01 Cd 109 3 E 01 Cf 252 1 E 02 Cm 244 5 E 02
63. YOA SANI ONILVALSATIHI SHIANYXY EIl ATEAVL 153 Appendix I CALCULATION OF RADIOLOGICAL EQUIVALENCE 1 1 INTRODUCTION This Appendix shows calculations for multiplying factors that can be applied to the activity released of a specified radionuclide to give an activity that may be compared with those given for I In this analysis values of inhalation coefficients have been taken from the BSS 14 while the dose factors for ground deposition have been taken from IAEA TECDOC 1162 15 Both publications are in the process of being updated but such updates are unlikely to have a large impact on the one significant figure radiological equivalence numbers given in Table 14 While other parts of this manual makes use of D values to compare the relative significance of different isotopes this appendix uses another approach This is because the D value calculations are specifically based on scenarios that are only appropriate for the handling and transport of radioactive sources The radiological equivalence factors calculated here use assumptions based on scenarios more appropriate to accidents at facilities I 2 METHOD The scenarios and methodology are summarized below For airborne releases of activity the following two components were added Effective dose to adult members of the public D from inhalation of unit airborne concentration 14 with a breathing rate of 3 3 x 10 m s and Effective dose to adults from grou
64. a controlled reactor shutdown and cooldown Steam generator tube leakage in excess of plant technical specifications but less than the equivalent of a full tube rupture Reactor coolant system leakage that would not prevent a controlled reactor shutdown and cooldown Loss of off site AC power including consideration of voltage and frequency disturbances Operation with a fuel assembly in any misoriented or misplaced position Inadvertent withdrawal of any single control assembly during refuelling Minor fuel handling incident Complete loss or interruption of forced reactor coolant flow excluding reactor coolant pump locked rotor II 1 2 Category 2 Possible Small loss of coolant accident LOCA Full rupture of one steam generator tube 174 Drop of a spent fuel assembly involving only the dropped assembly Leakage from spent fuel pool in excess of normal make up capability Blowdown of reactor coolant through multiple safety or relief valves II 1 3 Category 3 Unlikely Major LOCA up to and including the largest justified pipe rupture in the reactor coolant pressure boundary Single control rod ejection Major power conversion system pipe rupture up to and including the largest justified pipe rupture Drop of a spent fuel assembly onto other spent fuel assemblies Il 2 BOILING WATER REACTORS II 2 1 Category 1 Expected Reactor trip
65. a liquid there was no significant exposure of personnel 3 2 Radiological barriers and The laboratory was not designed to contain spillages controls at facilities The value for Level 2 from liquid spillages is defined as radiologically equgivalent to ten terabecquerels of Mo From section 3 3 2 3 GBq Pu 130 TBq Mo The Level 3 definition involves a few thousand terabecquerels of activity so 2 3 GBq is well below this level Rating for actual consequences Level 2 Example 11 Plutonium uptake at a reprocessing facility Level 2 Event description Four employees entered a controlled radiation zone to perform work on a ventilation system The work involved the removal of a component baffle box in a room located in a building that contained a plutonium processing facility The facility had been non functional since 1957 and had remained in a dormant state in preparation for decommissioning The workers were wearing protective and monitoring equipment Cutting of the baffle box proceeded for an hour and 40 minutes and dust was observed falling from the box When they stopped work and left the area personal contamination monitors detected contamination on the clothing of all the workers Immediate actions included placing work restrictions on affected personnel and initiating dose assessment through bioassay techniques Initial exposure estimates were less than 11 mSv effective dose Subsequently maximum committed doses of b
66. afety systems the initiator is an occurrence that challenges the safety systems and requires them to function Events involving an impact on defence in depth will generally be of two possible forms 69 1 Either they include an initiator initiating event which requires the operation of some particular safety systems designed to cope with the consequences of this initiator or 2 They include the degraded operability of one or more safety systems without the occurrence of the initiator for which the safety systems have been provided In both cases the level of operability of safety systems leads to a level of operability for the overall safety function noting that several safety systems may contribute to one safety function It is this level of safety function operability that is important in determining the rating In the first case the event rating depends principally on the extent to which the operability of the safety function is degraded However the rating also depends on the anticipated frequency of the particular initiator that has occurred In the second case no deviation from normal operation of the plant actually occurs but the observed degradation of the operability of the safety function could have lead to significant consequences if one of the initiators for which the degraded safety systems are provided had actually occurred In such a case the event rating depends on both The anticipated frequency of the pote
67. al loss of electrical power supplies in some facilities additional safety provisions such as the use of inerting gas or backup generators will be provided In order to rate events involving loss of off site power supplies or failures of on site supply systems it is necessary to use the guidance in Section 6 2 taking account of the extent of any remaining supplies the time for which the supplies were unavailable and the maximum potential consequences It is particularly important to take account of the time delay acceptable before restoration of supplies is required For some facilities there will be no adverse safety effects even with a complete loss of power supplies lasting several days and such events at these facilities should generally be rated at Below Scale Level 0 or Level 1 as there should be several means available to restore supplies within the available time Level 1 would be appropriate if the availability of safety systems had been outside the authorized limits Partial loss of electric power or loss of electric power from the normal grid with available power supply from standby systems is expected over the life of the facility and therefore should be rated Below Scale Level 0 121 6 3 10 Fire and explosion A fire or explosion within or adjacent to the facility that does not have the potential to degrade any safety provisions would either not be rated on the scale or would be rated Below Scale Level 0 Fires that ar
68. ale is required to know or estimate the actual consequences of the event In these circumstances a provisional rating should be given with a final rating provided at a later date Events are posted in the system by the INES national officers who are officially designated by the Member States The system includes event descrip tions ratings in INES press releases in the national language and in English 10 and technical documentation for experts Event descriptions ratings and press releases are available to the general public without registration Access to the technical documentation is limited to nominated and registered experts The main items to be provided for a specific event are summarized in the ERF The information being made available to the public should follow the principles listed in Section 1 6 1 When the scale is applied to transport of radioactive material the multinational nature of some transport events complicates the issue however the ERF for each event should only be provided by one country The ERF which itself is not available to the public is posted by the country where the event occurs The principles to be applied are as follows It is expected that the country in which the event is discovered would initiate the discussion about which country will provide the event rating form As general guidance if the event involves actual consequences the country in which the consequences occur is likely to b
69. ality assurance process An accumulation of human errors A failure to maintain proper control over radioactive materials including releases into the environment spread of contamination or a failure in the systems of dose control or The repetition of an event where there is evidence that the operator has not taken adequate care to ensure that lessons have been learned or that corrective actions have been taken after the first event It is important to note that the intention of this guidance is not to initiate a long and detailed assessment but to consider if there is an immediate judgement that can be made by those rating the event It is often difficult immediately after the event to determine if the rating of the event should be increased due to safety culture A provisional rating should be provided in this case based on what is known at the time and a final rating can then take account of the additional information related to safety culture that will have arisen from a detailed investigation 4 2 2 2 Events involving a lost or found radioactive source device Table 6 should be used for those events involving radioactive sources devices and transport packages that have been misplaced lost stolen or found If a source device or transport package cannot be located it may in the first instance be regarded as missing If however a search of the likely alternative locations is unsuccessful it should be considered
70. aly Turkish Atomic Energy Authority Turkey Commiss o Nuclear de Energia Nuclear Brazil Commiss o Nuclear de Energia Nuclear Brazil Federal Ministry of Agriculture Forestry and Water Management Austria Norwegian Radiation Protection Authority Norway Huang F Isasia Gonzalez R Jones R Jones C G Jouve A Jovanovic S Kampmann D Kim S Koskiniemi T Larsson N Lavalle Heilbron P F Linhart O Linsenmaier B Maltezos A Malu wa Kalenga Mansoor F Maqua M Melkumyan A Research Institute of Nuclear Power Operation China Consejo de Seguridad Nuclear Spain Nuclear Safety Directorate United Kingdom of Great Britain and Northern Ireland Nuclear Regulatory Commission United States of America Autorit de S ret Nucl aire France University of Montenegro Faculty of Sciences Montenegro Emergency Management Agency Denmark Ministry of Science and Technology Republic of Korea Radiation and Nuclear Safety Authority Finland Swedish Radiation Safety Authority Sweden Commiss o Nuclear de Energia Nuclear Brazil State Office for Nuclear Safety Czech Republic Swiss Federal Nuclear Safety Inspectorate Switzerland Greek Atomic Energy Commission Greece Commissariat General a Energie Atomique Democratic Republic of the Congo Pakistan Atomic Energy Commission Pakistan Gesellschaft f r Anlagen und Reaktorsicherheit Germany Armenian Nuc
71. an accident Level 3 is appropriate b In cell B1 of Table 9 the lower value would be appropriate if there is still considerable redundancy and or diversity available c In some reactor designs there is a large amount of redundancy diversity available for expected initiators If the safety function operability is considerably greater than the minimum required by OL amp C but slightly less than full Below Scale Level 0 would be more appropriate Beyond design initiators are not included specifically in Table 9 If such an initiator occurs then an accident may occur requiring rating based on actual consequences If not Level 2 or 3 is appropriate under defence in depth depending on the redundancy of the systems providing protection 76 The occurrence of internal and external hazards such as fires floods tsunamis explosions hurricanes tornados or earthquakes may be rated using Table 9 The hazard itself should not be considered as the initiator as the hazard may cause either initiators or degradation of safety systems or both but the safety systems that remain operable should be assessed against an initiator that occurred and or against potential initiators 5 1 4 Assessment of the basic rating for events without a real initiator As discussed in the previous section in order to obtain a basic rating firstly decide whether there was an actual challenge to the safety systems a real initiator If so then Section 5 1 3
72. ance alone does not provide a safety layer The means to implement corrective action are also required It is difficult to give more explicit guidance and inevitably judgement must be used In general a safety layer would be expected to have a failure rate 107 approaching 10 per demand To help in the identification of the number of independent safety layers the following list gives some examples of safety layers that may be available depending on the circumstances of the event and the design and operational safety justification for the facility Electronic personal alarming dosimeters provided that the personnel are trained in their use that the dosimeter is reliable and that personnel can and will respond appropriately and quickly enough Installed radiation and or airborne activity detectors and alarms provided that they can be shown to be reliable and that personnel can and will respond appropriately and quickly enough Presence of a Radiation Protection technician to detect and alert others to any abnormal levels of radiation or the spread of contamination Leak detection provisions such as containment which direct materials toa sump provided with appropriate level measuring instrumentation and or alarms Surveillance by operating personnel to provide assurance of the safe condition of the facility provided the surveillance frequency is adequate to identify performance shortfalls and that the correct
73. appropriate if the facility has some appropriate radiation safety 49 contain high integrity defence in depth provisions As noted in the introduction to this section events related to degradation of safety provisions at such facilities should be rated using Section 6 TABLE 7 EVENT RATING FOR EVENTS INVOLVING DEGRADATION OF SAFETY PROVISIONS Event rating depending on the source Type of events category Cat 4 Cat 3 or Cat 2 Cat 1 A No degradation of safety provisions Although an abnormal event may have occurred it has no significance in terms of the effectiveness of the existing safety provisions Typical events include Superficial damage to shielding 1 and or source containers or leaking sources resulting in minor surface contamination and spillage where low level contamination of persons has occurred Superficial damage to shielding Oor1 and or source containers or leaking sources resulting in minor surface contamination and spillage where the resulting contamination is unusual but of little or no radiological significance Contamination in areas designed Oorl to cope with such events Oorl Oorl Oorl Oorl 15 Wherever there is a choice of rating a significant factor is whether there are safety culture implications as discussed in Section 4 2 2 1 50 TABLE 7 EVENT RATING FOR EVENTS INVOLVING DEGRADATION OF SAFETY PROVISIONS cont Event rating depen
74. are a number of safety provisions remaining with no significant safety culture implications Where there is essentially only a single safety layer remaining the higher rating should be used Rating of events involving partial degradation of the safety provisions for Category 1 sources installed in facilities should be based on the safety layer approach to ratings described in Section 6 Rating of other events involving Category 1 sources should be rated Level 1 or 2 the lower rating being more appropriate if there are a number of safety provisions still remaining with no significant safety culture implications The upper level would be appropriate unless the level of degradation is very low The maximum potential consequences for a Category 3 source installed in a fixed location within a facility cannot be higher than Level 2 Therefore for events at such facilities the maximum under defence in depth should be Level 1 Level 3 is only appropriate when the maximum potential consequences can be greater than Level 4 Facilities using category 1 sources should be rated using the guidance in Section 6 Application of that guidance would give a rating of Level 3 only if there is the potential for dispersion of the radioactive material If the event relates only to degradation of safety provi sions for preventing overexposure of workers the guidance would give a rating of Level 2 4 2 2 4 Other safety relevant events Table 8 should be used for other
75. bout 20 TBq comprised about 10 I 5 Cs and the rest noble gases 39 Rating explanation Criteria Explanation 2 2 Activity released The fact that evacuation was undertaken is not relevant to rating Based on Table 2 1 TBq of Cs is radiologically equivalent to 40 TBq I so that the total release is radiologically equivalent to 42 TBq 131 which is close to the value for rating under the release criteria at Level 4 of tens to hundreds of terabecquerels of l 2 3 Doses to individuals All doses were less than 1 mSv so rating based on individual dose is Level 0 3 2 Radiological barriers and The release from the fuel reaches the value for controls at facilities Level 4 more than about 0 1 of the core inventory of a power reactor has been released from the fuel assemblies but is less than the definition for Level 5 more than a few per cent of the core inventory of a power reactor has been released from the fuel assemblies Rating for actual consequences Level 4 Example 13 Reactor core melt Level 5 Event description A valve in the condensate system failed closed which reduced the amount of water being supplied to the steam generator The main feedwater pumps and the turbine tripped within seconds The emergency feedwater pumps which started as expected were unable to inject water into the steam generators because several valves in the system were closed The reactor coolant pumps conti
76. cant conse quences to people and the environment In both cases there are no significant consequences to individuals outside the site boundary but in the first case there is an increased likelihood of such consequences to individuals and in the second case such failures represent a major failure in the management of radiological controls It is important that the rating of such events on INES takes appropriate account of these issues The criteria addressing these issues only apply at authorized facilities handling major quantities of radioactive materials These criteria together with the criteria for worker doses were previously referred to as on site criteria For events involving radiation sources and the transport of radioactive material only the criteria for people and the environment and for defence in depth need to be considered 1 4 3 Defence in depth INES is intended to be applicable to all radiological events and all nuclear or radiation safety events the vast majority of which relate to failures in equipment or procedures While many such events do not result in any actual consequences it is recognized that some are of greater safety significance than others If these types of events were only rated based on actual consequences all such events would be rated at Below scale Level 0 and the scale would be of no real value in putting them into perspective Thus it was agreed at its original inception that INES
77. ce to National Officers 3 and the clarification for fuel damage events approved in 2004 4 13 2 IMPACT ON PEOPLE AND THE ENVIRONMENT 2 1 GENERAL DESCRIPTION The rating of events in terms of their impact on people and the environment takes account of the actual radiological impact on workers members of the public and the environment The evaluation is based on either the doses to people or the amount of radioactive material released Where it is based on dose it also takes account of the number of people who receive a dose Events must also be rated using the criteria related to defence in depth Sections 4 5 or 6 and where appropriate using the criteria related to radio logical barriers and controls at facilities Section 3 in case those criteria give rise to a higher rating in INES It is accepted that for a serious incident or an accident it may not be possible during the early stages of the event to determine accurately the doses received or the size of a release However it should be possible to make an initial estimate and thus to assign a provisional rating It needs to be remembered that the purpose of INES is to allow prompt communication of the significance of an event In events where a significant release has not occurred but is possible if the event is not controlled the provisional level is likely to be based on what has actually occurred so far using all the relevant INES criteria It is possible that subsequ
78. cee eee eee eee 6 3 2 Events involving failures in cooling systems affecting the spent fuel pool iis ct scaddsdindatde cde A 6 3 3 Criticality control 0 00 eee 6 3 4 Unauthorized release or spread of contamination 6 3 5 Dose control icc ciacicodinvoseriseaaaa eae 6 3 6 Interlocks on doors to shielded enclosures 6 3 7 Failures of extract ventilation filtration and cleanup SYSTEMS rear aE a deme ortin cd E phate geace 6 3 8 Handling events and drops of heavy loads 6 3 9 Loss of electrical power supply 0 6 3 10 Fire and explosion 0 2 cee e cece eee ees 6 3 11 Extermal hazards oas ce ce c eee ce eee eee eee eae 6 3 12 Failures in cooling systems 00 eee eee Worked exainples s sras dont y eai a aed odie aecha eed 6 4 1 Events on a shutdown power reactor 6 4 2 Events at facilities other than power reactors T RATING PROCEDURE wisccisiacicaedteennniea eee ee cee APPENDIX I CALCULATION OF RADIOLOGICAL EQUIVALENCE resso siete gard iut meio eaeeniitarest APPENDIX II THRESHOLD LEVELS FOR DETERMINISTIC EFFECTS s nc04 aves peces deetunkees s oeatig eaten APPENDIX III D VALUES FOR A RANGE OF ISOTOPES APPENDIX IV RADIOACTIVE SOURCE CATEGORIZATION BASED ON COMMON PRACTICE REFERENCES 24 tasinaeeievatnaeeted tie in Meet a be nad ANNEX I DEFENCE IN DEPTH iisdpa si ucecnaeacdignnebausi
79. ch of the instrumentation and automatic control on the boilers and on Reactor 1 was lost Manual rod insertion was possible and was attempted but the rate was insufficient to prevent rising temperatures resulting in Reactor 1 being automatically tripped on high fuel element 95 temperature approximately 16 C rise It appeared to the operating personnel that all the rod control systems were rendered inoperable The battery backed essential instrumentation and the reactor protection system remained functional together with some of the normal control and instrumentation systems All gas circulators ran down as the steam to their turbines deteriorated The instrument power supplies fault prevented engagement of gas circulator pony motors either automatically or manually Low pressure feed was maintained throughout to three out of four boilers and was restored to the fourth boiler by manual action After the initial transient leading to the reactor tripping fuel element temperatures fell but then rose as forced gas circulation failed These temperatures stabilized at about 50 C below normal operational levels before falling once again when gas circulator pony motors were started on engagement of standby instrument supplies Reactor 2 was unaffected and operated at full output throughout Reactor 1 was returned to power the following day Rating explanation Criteria Explanation 2 and 3 Actual consequences There were no actual conse
80. chnical Specifications the event should be rated as described in Section 6 2 3 1 but should not be increased as the requirements of the Technical Specifications have been followed In addition to the formal authorized limits some countries introduce into their Technical Specifications further requirements such as limits that relate to the long term safety of components For events where such limits are exceeded for a short time Below Scale Level 0 may be more appropriate For reactors in the shutdown state Technical Specifications will again specify minimum availability requirements but will not generally specify recovery times or fall back states as it is not possible to identify a safer state The requirement will be to restore the original plant state as soon as possible The reduction in plant availability below that required by the Technical Specifications should not be regarded as a violation of authorized limits unless time limits are exceeded Other safety culture issues Other examples of indicators of a deficiency in the safety culture could be A violation of a procedure without prior approval A deficiency in the quality assurance process An accumulation of human errors Exposure of a member of the public from a single event in excess of annual statutory dose limits Cumulative exposure of workers or members of the public in excess of annual statutory dose limits A failure to maintain proper con
81. ctly how national communications should be carried out there are some general principles that can be applied These are provided in this section Guidance on international communications is provided in Section 1 6 2 When communicating events using the INES rating it needs to be remembered that the target audience is primarily the media and the public Therefore Use plain language and avoid technical jargon in the summary description of the event Avoid abbreviations especially if equipment or systems are mentioned e g main coolant pump instead of MCP Mention the actual confirmed consequences such as deterministic health effects to workers and or members of the public Provide an estimate of the number of workers and or members of the public exposed as well as their actual exposure Affirm clearly when there are no consequences to people and the environment Mention any protective action taken The following elements are relevant when communicating events at nuclear facilities Date and time of the event Facility name and location Type of facility Main systems involved if relevant A general statement saying that there is is not release of radioactivity to the environment or there are are not any consequences for people and the environment In addition the following elements are relevant parts of the event description for an event related to radiation sources or the transport
82. d load threatens a spillage of radioactive material either from the dropped load itself or from affected pipework or vessels should be rated by considering the maximum potential consequences and the likelihood that such a spillage might have occurred Events where a dropped load only causes limited damage but had a relatively high probability of causing worse consequences should be rated at the maximum level under defence in depth appropriate to the maximum potential consequences Similarly events where only one safety layer prevented the damage should also be rated at the maximum level unless that layer is considered to be of especially high reliability or integrity Events where the likelihood is lower or there are additional safety layers should be rated following the guidance in Section 6 2 Minor handling events which would be expected over the lifetime of the facility should be rated at Below Scale Level 0 6 3 8 2 Fuel handling events Events during handling of unirradiated uranium fuel elements with no significant implications for the handling of irradiated fuel should typically be rated as Below Scale Level 0 if there has been no risk of damaging spent fuel elements or safety related equipment For irradiated fuel the radioactive inventory of a single fuel element is very much lower than the inventory of the spent fuel pool or the reactor core and hence the maximum potential consequences are less As long as the cooling of the sp
83. d release or spread of contamination Any event involving transfer of radioactive material that results in a contamination level above the investigation level for the area may justify a rating of Level 1 based on safety culture issues Section 6 2 4 failure to maintain proper control over radioactive materials Contamination levels in excess of the authorized limit for the area should be rated at Level 1 More significant failures in safety provisions should be rated by considering the maximum potential consequences should all the safety provisions fail and the number of safety layers remaining Breaches of discharge authorizations should be rated at least at Level 1 6 3 5 Dose control Occasionally situations may arise when the radiological control procedures and managerial arrangements are inadequate and employees receive unplanned radiation exposures internal and external Such events may justify a rating of Level 1 based on Section 6 2 4 failure to maintain proper control over radioactive materials If the event results in the cumulative dose exceeding authorized limits the event should be rated at least at Level 1 as a violation of authorized limits In general the guidance in Section 6 2 4 should not be used to uprate events related to dose control failure from a basic rating of Level 1 Otherwise events where dose was prevented will be rated at the same level as those where significant doses in excess of dose limits were ac
84. d that the event could have led to an accident not by using probabilistic techniques directly but by considering what additional failures of safety provisions would be required to result in an accident Thus a basic rating is determined by taking account of the maximum potential consequences and the number and effectiveness of safety provisions available To allow for any underlying additional factors consideration is also given to increasing the basic rating This increase allows for those aspects of the event that may indicate a deeper degradation of the plant or the organiza tional arrangements of the facility Factors considered are common cause failures procedural inadequacies and safety culture issues Such factors are not included in the basic rating and may indicate that the significance of the event with respect to defence in depth is higher than the one considered in the basic rating process Accordingly in order to communicate the true significance of the event to the public increasing the rating by one level is considered The following steps should therefore be followed to rate an event 1 The upper limit to the rating under defence in depth should be established by taking account of the maximum potential radiological consequences i e the maximum potential rating for the relevant practices at that facility based on the criteria in Sections 2 and 3 Further guidance on establishing the maximum potential conseq
85. d the technical community 11 The event rating form also includes the basis of the rating Although this is not part of the material communicated to the public it is helpful for other national officers to understand the basis of the rating and to respond to any questions The rating explanation should clearly show how the event rating has been determined referring to the appropriate parts of the rating procedure 1 7 STRUCTURE OF THE MANUAL The manual is divided into seven main sections Section 1 provides an overview of INES Section 2 gives the detailed guidance required to rate events in terms of their impact on people and the environment A number of worked examples are provided Section 3 provides the detailed guidance required to rate events in terms of their impact on radiological barriers and controls at facilities Several worked examples are also provided Sections 4 5 and 6 provide the detailed guidance required to rate events in terms of their impact on defence in depth Section 4 provides the defence in depth guidance for all events associated with transport and radiation sources except those occurring at Accelerators Facilities involving the manufacture and distribution of radionuclides Facilities involving the use of a Category 1 source 1 These are all covered in Section 6 Section 5 provides the defence in depth guidance for events at power reactors It only relates to events while the reac
86. d to the correct value for operation at full power The trip effectiveness of this parameter for both shutdown systems was therefore reduced for approximately six hours An alternative trip parameter with redundancy was available throughout 90 Rating explanation Criteria Explanation 2 and 3 Actual consequences There were no actual consequences from the event 5 1 1 Initiator frequency There was no real initiator The reactor protection system was required for expected initiators 5 1 2 Safety function The operability of the protection system was reduced operability The operability was less than the minimum allowed by OL amp C but greater than just adequate as a second trip parameter with redundancy remained available The wrongly calibrated detectors would also have provided protection for most fault conditions 5 1 3 and 5 1 4 Basic rating There was no real initiator From Section 5 1 4 box C 1 of Table 10 is appropriate giving Level 1 or 2 Level 1 was chosen as the operability was considerably more than just adequate 5 2 Additional factors In considering whether the basic rating should be adjusted it is relevant to consider that the fault only existed for a short time On the other hand there were deficiencies in the procedure It was decided to keep the rating at Level 1 Final rating Level 1 Example 33 Failure of safety system train during routine testing Level 1 Event description The
87. d to these tests Unit 1 remained in the cold shutdown condition for refuelling and Unit 2 resumed power operation on 14 October On 1 November it was discovered during the monthly check of the safeguard valves that the four valves on the discharge side 86 of the containment spray pumps were closed It was concluded that these valves had not been reopened after the tests on 9 October in contradiction to the requirements of the related test procedure Unit 2 had thus operated for 18 days with spray unavailable It was concluded that the cause of the event was human error However it was recognized that the error occurred at the end of a test period that was longer than usual as a result of troubleshooting and that a more formal reporting of actions accomplished could be very useful Rating explanation Criteria Explanation 2 and 3 Actual consequences There were no actual consequences from the event 5 1 1 Initiator frequency There was no real initiator The initiator that would challenge the degraded safety function was a large LOCA unlikely 5 1 2 Safety function The operability of the safety function confinement was operability degraded The operability was less than the minimum required by OL amp C but more than just adequate as a diverse system was available 5 1 3 and 5 1 4 Basic rating There was no real initiator From Section 5 1 4 box C 3 of Table 10 is appropriate giving a basic rating of Leve
88. ding on the source Type of events category Cat 4 Cat 3 or Cat 2 Cat 1 Foreseeable events where safety Oorl Oorl Oorl procedures were effective in preventing unplanned exposures and returning conditions to normal This could include events such as the non return of exposed sources e g industrial radiography gamma source or brachytherapy source provided they are safely recovered in accordance with existing emergency procedures No damage or minor damage to Oor1 Oorl Oorl transport package with no increase in dose rate B Safety provision partially remaining One or more safety provisions have failed for whatever reason but there is at least one safety provision remaining Typical events include Failure of part of an installed warning Oorl lor2 or safety system designed to prevent Footnote a Footnote a Footnote b exposures to high dose rates Failure to follow safety procedures Oorl lor2 including radiological monitoring Rogtnot2 Footnote a Footnote and safety checks but where other existing safety provisions hardware remain effective 51 TABLE 7 EVENT RATING FOR EVENTS INVOLVING DEGRADATION OF SAFETY PROVISIONS cont Event rating depending on the source Type of events category Cat 4 Cat 3 or Cat 2 Cat 1 Significant degradation of Oor1 lor2 containment systems or defective Fogtnotea Footnoteia Footnote b closures Faulty packaging
89. during the period since the dosimeter was issued 2 Colleagues who were always near her during potential exposure periods and whose dosimeters showed normal readings 3 Additional dosimeters worn during some of the period of interest It was ultimately concluded that she did not receive the radiation exposure and that the dose should be removed from her record Not applicable Although the event involves no real dose there are other factors involved in the event such as the failure to monitor personnel radiation exposure records and to follow up on unusual readings Based on row 3 of Table 8 the event is rated at Level 1 Level 1 65 Example 25 Melting of an orphan source Level 2 Event description An orphan source of 1 TBq of Cs inadvertently included in scrap metal was melted in a steel factory Fifty employees at the factory received an estimated dose of 0 3 mSv each Rating explanation Criteria Explanation 2 2 Activity release It was estimated that 10 of the activity was released due to the melting which resulted in an airborne activity release of 0 1 TBq of Cs The D value for 7Cs is 0 1 TBq so the release is far less than the criterion for Level 5 of 2500 times the D value section 2 2 2 2 3 Doses to individuals Doses received were below the value for Level 1 4 2 1 Maximum potential The D value for Cs is 1 x 10 TBq and the source consequences activity A is 1 TBq result
90. e was put in a pipe and the owner of the company was contacted after which the source was recovered The time elapsed between identifying that the source was radioactive and the source recovery was about half an hour The three construction staff members were sent for medical examination including cytogenetics examination and were admitted to hospital One of them showed some deterministic effects severe radiation burns to one hand Five employees from the industrial radiography company had blood samples taken 24 for analysis at a cytogenetics laboratory however no abnormalities were observed Rating explanation Criteria Explanation 2 2 Activity released Not applicable 2 3 Doses to individuals One person showed deterministic effects from the radiation This gives a rating of Level 3 Rating for impact on people Level 3 and the environment Example 4 Breakup of an abandoned highly active source Level 5 Event description A private radiotherapy institute moved to new premises taking with it a Co teletherapy unit and leaving in place a 51 TBq Cs teletherapy unit They failed to notify the licensing authority as required under the terms of the institute s licence The former premises were subsequently partly demolished As a result the Cs teletherapy unit became totally insecure Two people entered the premises and not knowing what the unit was but thinking it might have some scrap value removed the source as
91. e best placed to provide the event rating form If the event only involves failures in administrative controls or packaging the country consigning the package is likely to be best placed to provide the event rating form In the case of a lost package the country where the consignment originated is likely to be the most appropriate one to deal with rating and communicating the event Where information is required from other countries the information may be obtained via the appropriate competent authority and should be taken into account when preparing the event rating form For events related to nuclear facilities it is essential to identify the facility its location and type For events related to radiation sources it may be helpful to include some technical details about the source device or to include device registration numbers as the INES system provides a rapid means for disseminating such information internationally For events involving transport of radioactive material it may be helpful to include the identification of the type of package e g excepted industrial Type A B For nuclear facilities the basic information to be provided includes the facility name type and location and the impact on people and the environment Although other mechanisms already exist for international exchange of operational feedback the INES system provides for the initial communication of the event to the media the public an
92. e eee 5 1 1 Identification of initiator frequency 5 1 2 Safety function operability 0 000 0 5 1 3 Assessment of the basic rating for events with a real IMPALOL a scci edn ril nie mee ath ieee sg 5 1 4 Assessment of the basic rating for events without a real INIT ALOR espire iiaa hae gees ade E easy eda aon 5 1 5 Potential events including structural defects 5 1 6 Below Scale Level Q events 0000000 5 2 Consideration of additional factors 0000 5 2 1 Common cause failures 0000004 5 2 2 Procedural inadequacies 0s eee eee 5 2 3 Safety culture issues 0 c ccc A eee eee 5 3 Workediexamples 4 044 cc dinaa ciudad etre anee een eens ASSESSMENT OF IMPACT ON DEFENCE IN DEPTH FOR EVENTS AT SPECIFIED FACILITIES 6 1 General principles for rating of events 0 6 2 Detailed guidance for rating events 000 6 2 1 Identification of maximum potential consequences 6 2 2 Identification of number of safety layers 6 2 3 Assessment of the basic rating 6 2 4 Consideration of additional factors 6 3 Guidance on the use of the safety layers approach for specific types Of eVents s 5 csc orrn cede dea ae babes eae a 6 4 6 3 1 Events involving failures in cooling systems during reactor shutdown 00
93. e extinguished by the installed protection systems functioning as intended by design should be rated similarly The significance of fires and explosions at installations depends not only on the material involved but also on the location and the ease with which firefighting operations can be undertaken The rating depends on the maximum potential consequences as well as the number and effectiveness of the remaining safety layers including fire barriers fire suppression systems and segregated safety systems The effectiveness of remaining safety layers should take account of the likelihood that they could have been degraded Any fire or explosion involving low level waste should be rated at Level 1 owing to deficiencies in procedures or safety culture issues 6 3 11 External hazards The occurrence of external hazards such as external fires floods tsunamis external explosions hurricanes tornados or earthquakes may be rated in the same way as other events by considering the effectiveness of remaining safety provisions For events involving failures in systems specifically provided for protection against hazards the number of safety layers should be assessed including the likelihood of the hazard occurring during the time when the system was unavailable For most facilities owing to the low expected frequency of such hazards a rating greater than Level 1 is unlikely to be appropriate 6 3 12 Failures in cooling systems Failures in
94. e in depth should be established by determining the rating for the maximum potential conse quences of the relevant practices based on the criteria in Sections 2 and 3 of this manual Detailed guidance on establishing the maximum potential consequences is given in Section 4 2 1 2 The actual rating should then be determined a firstly by taking account of the number and effectiveness of safety provisions available hardware and administrative for prevention surveillance and mitigation including passive and active barriers b secondly by considering those safety culture aspects of the event that may indicate a deeper degradation of the safety provisions or the organizational arrangements Detailed guidance on these two aspects of the rating process is given in Section 4 2 In addition to considering the event under defence in depth each event must also be considered against the criteria in Sections 2 and 3 if applicable 43 4 2 DETAILED GUIDANCE FOR RATING EVENTS 4 2 1 Identification of maximum potential consequences The maximum potential consequences are derived from the source category based on the activity of the source A and the D value for the source from the AEA s Categorization of Radioactive Sources 1 and its supporting reference 5 The maximum potential consequences do not depend on the detailed circumstances of the actual event The D values are given in terms of an activity above which a source is conside
95. e installation in areas not expected an 33 by design and requiring corrective action n3 FIG 6 Procedure for rating the impact on radiological barriers and controls at facilities 147 Initiator Frequency Safety Functions Operability Additional Factors Maximum Potential Consequences Effectiveness of Safety Provisions Additional Factors NES not applicable Section 1 3 Tables Maximum Potential Consequences Effectiveness of Safety Provisions Safety Culture ria A ah FIG 7 General procedure for rating impact on defence in depth 148 Event involving a Determine inventory h 2 involved in the event single source ion 4 2 1 Calculate A D ratio and determine category Section 4 2 1 radation of safety provisions Determine event rating Table amp Section 4 2 2 4 Other safety relevant event Ye Please see also Appendices and IV FIG 8 Procedure for rating the impact on defence in depth for transport and radiation source events 149 See Note for treatment of potential events including structural defects Section 5 1 5 Yes Yes Identify initiators occurred Determine the operability of B Min required by OL amp C and frequency categories degrad fety functions C Adequate Section 5 1 1 Section 5 1 2 For each degraded safety She operably of safey inate that challenge e Of ity of sai ini unaions
96. e should be rated using the guidance in Section 6 This section of the manual is specific to events associated with the operation of power reactors The approach to rating is based on assessing the likelihood that the event could have led to an accident not by using probabilistic techniques directly but by considering whether safety provisions were challenged and what additional failures of safety provisions would be required to result in an accident Thus a basic rating is determined by taking account of the number and effectiveness of safety provisions available hardware and administrative for prevention control and mitigation including passive and active barriers 68 To allow for any underlying additional factors consideration is also given to increasing the basic rating This increase allows for those aspects of the event that may indicate a deeper degradation of the plant or the organiza tional arrangements of the facility Factors considered are common cause failures procedural inadequacies and safety culture issues Such factors may not have been included in the basic rating and may indicate that the significance of the event with respect to defence in depth is higher than the one considered in the basic rating process Accordingly in order to communicate the true significance of the event to the public increasing the rating by one level is considered The other two sections on defence in depth include guidance re
97. e staff were called in at 18 00 but they too failed to find the source of the leak During this time the pressure and temperature inside the pressurizer relief tank continued to rise Temperatures were maintained below 50 C by means of feed and bleed operations i e injections of cold make up water and drainage into the reactor coolant drain recovery tank Two pumps installed in parallel direct this effluent out of the reactor building towards the boron recycle system tank At around 09 00 the activity sensors indicated an increase in radioactivity in the reactor building At 09 56 the set point for partial isolation of the containment was reached This resulted notably in closure of the valves inside the containment on the nuclear island vent and drain system At this point effluent could no longer be routed to the boron recycle system Pressure inside the pressure relief tank continued to rise until at 21 22 the rupture disks blew To maintain the temperature in the pressurizer relief tank at around 50 C water make up had to be continued until 23 36 At 01 45 activity levels inside the reactor building fell below the set point for containment isolation At 02 32 the reactor coolant system was at a pressure of 25 bar The unit had been brought to subcritical hot shutdown conditions with heat being removed by the steam generators but the RHR system was still unavailable The RHR system was reinstated at 10 54 and at 11 45 the leaking
98. e table gives the rating based on actual conse quences i e taking account of the criteria in Sections 2 and 3 It is not necessarily the final rating as it would be necessary to consider the defence in depth criteria before defining the final rating 34 TABLE 4 RADIOLOGICAL EQUIVALENCE FOR FACILITY CONTAMINATION Isotope Multiplication Multiplication Multiplication factor for airborne factor for solid factor for liquid contamination contamination contamination based on based on based on 131 equivalence 137Cs equivalence Mo equivalence Am 241 2000 4000 50 000 Co 60 2 0 3 30 Cs 134 0 9 1 20 Cs 137 0 6 1 12 H 3 0 002 0 003 0 03 1 131 1 2 20 Ir 192 0 4 0 7 9 Mn 54 0 1 0 2 2 Mo 99 0 05 0 08 1 P 32 0 3 0 4 5 Pu 239 3000 5000 57 000 Ru 106 3 5 60 S1 90 7 11 140 Te 132 0 3 0 4 5 U 235 S 600 900 11 000 U 235 M 200 300 3000 U 235 F 50 90 1000 U 238 S 500 900 10 000 U 238 M 100 200 3000 U 238 F 50 100 1000 Unat 600 900 11 000 Noble gases Negligible Negligible Negligible effectively 0 effectively 0 effectively 0 a Lung absorption types S slow M medium F fast If unsure use most conservative value 35 Example 8 Event at a laboratory producing radioactive sources Below scale Level 0 Event description An event occurred at a laboratory in which Cs sources are produced As a result of rebuilding work in another part of the laboratory building there were problems with keeping a negati
99. e used by operating personnel in the case of safety injection actuation were not appropriate for the particular situation of a loss of coolant in the steam phase of the pressurizer Deficiencies in the surveillance programme highlighted by anomalies not discovered during normal procedures or system equipment unavailabilities well in excess of the test interval 5 2 3 Safety culture issues Safety culture has been defined as that assembly of characteristics and attitudes in organizations and individuals which establishes that as an overriding priority protection and safety issues receive the attention warranted by their significance A good safety culture helps to prevent incidents but on the other hand a lack of safety culture could result in operating personnel performing in ways not in accordance with the assumptions of the design Safety culture has therefore to be considered as part of the defence in depth and consequently safety culture issues could justify increasing the rating of an 82 event by one level INSAG 4 7 provides further information on safety culture To merit increasing the rating due to safety culture issues the event has to be considered as a real indicator of an issue with the safety culture 5 2 3 1 Violation of OL amp C One of the most easily defined indicators of a safety culture issue is a violation of OL amp C OL amp C describe the minimum operability of safety systems such that operatio
100. ect the probability of occurrence of which is greater for a higher radiation dose and the severity of which if it occurs is independent of dose 16 191 Note Stochastic effects generally occur without a threshold level of dose Examples include various forms of cancer and leukaemia worker Any person who works whether full time part time or temporarily for an employer and who has recognized rights and duties in relation to occupational radiation protection A self employed person is regarded as having the duties of both an employer and a worker 14 192 Figure 1 Figure 2 Figure 3 Figure 4 Figure 5 Figure 6 Figure 7 Figure 8 Figure 9 Figure 10 LIST OF FIGURES Illustration of safety provisions for Example 41 eesse Illustration of safety layers for Examples 44 and 46 Diagram of cooling system for Example 48 0 0 eee General INES rating procedure uu eect eects tees Procedure for rating the impact on people ANG HE Cnviron mentse ee EE Procedure for rating the impact on radiological barriers and controls at facilities ssisssissssissssisrsrsosesissassssuseinviss General procedure for rating impact on defence in depth Procedure for rating the impact on defence in depth for transport and radiation source events s src Procedure for rating the impact on defence in depth for r actors at POWEL cenne a a Procedure for rating the impact on defence in depth for fuel cycle facilities
101. ed 2 3 Doses to individuals seisis eas persti erii PEE E 2 3 1 Criteria for the assessment of the minimum rating when one individual is exposed 2 3 2 Criteria for consideration of the number of individuals exposed 0 0c ee ritsins eee eee 2 3 3 Dose estimation methodology 004 2 34 SUMMALY es sis cea cans he aes Mae Read RNA 24 Worked examples 0 0 cee cece eee amsi IMPACT ON RADIOLOGICAL BARRIERS AND CONTROLS AT FACILITIES 00 05 3 1 General description 2 006 00c ieee eee een c atiera oi 32 Definition OLLEVEIS acces sgt nire cited oe Stab dears aay ace eed 3 3 Calculation of radiological equivalence 0 3 4 Worked examples 20 0 cece eee eee eee eee OOANDNANN BRR ASSESSMENT OF THE IMPACT ON DEFENCE IN DEPTH FOR TRANSPORT AND RADIATION SOURCE EVENTS 0 2 cece eee eee eee 4 1 General principles for rating of events 0 0 4 2 Detailed guidance for rating events 000 4 2 1 Identification of maximum potential consequences 4 2 2 Rating based on effectiveness of safety provisions 4 3 Wotkediexamples cerie csv ndaden aaa beeen eae nee ASSESSMENT OF IMPACT ON DEFENCE IN DEPTH SPECIFICALLY FOR EVENTS AT POWER REACTORS WHILE AT POWER 5 1 Identification of basic rating taking account of the effectiveness of safety provisions 0e ee
102. effects were observed nor would they be expected Level 2 Even taking account of the possible shielding of the dosimeter the effective dose was well below the criteria for Level 3 Rating for impact on people Level 2 and the environment Example 3 Overexposure of an industrial radiographer Level 3 Event description Three workers were carrying out industrial radiography using a source of 3 3 TBq of Ir on a 22 5 m high tower platform For some reason the Ir source pigtail was disengaged or never engaged from the driver At the end of the job one of the workers unscrewed the guide tube and the source fell on the platform without anyone noticing no radiation pagers or pocket dosimeters were used The workers left the work site and the next evening 23 00 an employee found the source and tried to identify it He showed the source to another employee and this latter employee noticed that the first employee had a swollen cheek The first employee handed the source to his colleague and went down to wash his face The second employee went down the tower with the source in his hand When both employees decided to hand the source to their supervisor in his office the alarming dosimeter of a worker from another company started to alarm indicating a high radiation field The source was identified and the employees were advised that the piece of metal was a dangerous radioactive source and to put it away immediately The sourc
103. eies ANNEX II EXAMPLES OF INITIATORS AND THEIR FREQUENCY 0050 5050 dead ead cee aba lt ANNEX III LIST OF PARTICIPATING COUNTRIES AND ORGANIZATIONS 0 0 cee eee eee GLOSSARY seiery sane atta ae a a eke eee dolores 183 LIST OF TABLES saratan pistedcs hagecdo dye aia baat A AEA 193 LIST OB FIGURES eramana EE E E E A Ha ee ea ee ad 195 LIST OF EXAMPLES serar s s00dsecverh cane a E seat aa ekead ea 197 CONTRIBUTORS TO DRAFTING AND REVIEW 201 1 SUMMARY OF INES 1 1 BACKGROUND The International Nuclear and Radiological Event Scale is used for promptly and consistently communicating to the public the safety significance of events associated with sources of radiation It covers a wide spectrum of practices including industrial use such as radiography use of radiation sources in hospitals activities at nuclear facilities and the transport of radioactive material By putting events from all these practices into a proper perspective use of INES can facilitate a common understanding between the technical community the media and the public The scale was developed in 1990 by international experts convened by the IAEA and the OECD Nuclear Energy Agency OECD NEA It originally reflected the experience gained from the use of similar scales in France and Japan as well as consideration of possible scales in several countries Since then the IAEA has managed its development in cooperation with the OECD
104. eived by three persons as a result of the event including the recovery of the source were all below 1 mSv 55 Rating explanation Criteria Explanation 2 3 Doses to individuals 4 2 1 Maximum potential consequences 4 2 2 Effectiveness of safety provisions Overall rating Doses received were below the value for Level 1 The D value for Ir is 0 08 TBq so the A D ratio was 12 i e a Category 2 source This is a foreseeable event in industrial radiography and contingency plans and equipment to deal with such events are expected to be available The monitoring by the radiographer was also effective Based on the fourth bullet of section A of Table 7 Foreseeable events where safety procedures were effective in preventing unplanned exposures and returning conditions to normal the rating could be either Below scale Level 0 or Level 1 Below scale Level 0 is chosen as there were no indications of safety culture issues Below Scale Level 0 Example 15 Derailment of a train carrying spent fuel Below Scale Level 0 Event description A train with three wagons each containing a package of spent fuel derailed at a speed of 28 km h The rail broke when the train went over it Two of the rail wagons were derailed but remained upright the other was leaning over and had to be made stable Thirty six hours later the wagons were on their way again There were no radiological consequences 56 Rat
105. el 4 or above but the assessment of radiological equivalence would be site specific and therefore detailed guidance cannot be provided here 16 2 2 2 Definition of levels based on activity released Level 7 An event resulting in an environmental release corresponding to a quantity of radioactivity radiologically equivalent to a release to the atmosphere of more than several tens of thousands of terabecquerels of I This corresponds to a large fraction of the core inventory of a power reactor typically involving a mixture of short and long lived radionuclides With such a release stochastic health effects over a wide area perhaps involving more than one country are expected and there is a possibility of deterministic health effects Long term environmental consequences are also likely and it is very likely that protective action such as sheltering and evacuation will be judged necessary to prevent or limit health effects on members of the public Level 6 An event resulting in an environmental release corresponding to a quantity of radioactivity radiologically equivalent to a release to the atmosphere of the order of thousands to tens of thousands of terabecquerels of T With such a release it is very likely that protective action such as sheltering and evacuation will be judged necessary to prevent or limit health effects on members of the public Level 5 An event resulting in an environmental release corres
106. ences There were no actual consequences from the event 5 1 1 Initiator frequency A full loss of off site power LOOP did not occur but is an expected initiator 5 1 2 Safety function Assuming the LOOP led to an overvoltage transient operability which was probable the diesels would have started but there would have been no supplies to connect them Operating personnel would have had about 40 minutes to find a way of manually connecting the diesels On that basis the safety function operability was just adequate 5 1 3 and 5 1 4 Basic rating There was no real initiator From Section 5 1 4 box C 1 of Table 10 is appropriate giving a basic rating of Level 1 or 2 Because all of the cooling systems were actually available subject to being able to switch in the diesel supplies the lower rating was chosen 5 2 Additional factors This analysis already assumes failure of all the UPS systems so there is no basis for further uprating Final rating Level 2 based on the first analysis with a real initiator Example 36 Loss of forced gas circulation for between 15 and 20 minutes Level 2 Event description A single phase fault on the instrument power supplies to Reactor 1 was not cleared automatically and persisted until supplies were changed over manually The fault caused both high pressure and low pressure feed trip valves to close on one boiler leading to rundown of the corresponding steam driven gas circulator Mu
107. ent fuel element is guaranteed this provides an important safety layer since the integrity of the fuel matrix will not be degraded by overheating In general there will be very long timescales associated with fuel overheating Depending on the facility configuration containment will also provide a safety layer in most cases Events expected over the lifetime of the facility that do not affect the cooling of the spent fuel element and only result in a minor release or no release typically should be classified as Below Scale Level 0 120 Level 1 should be considered for events Not expected over the lifetime of the facility Involving operation outside the authorized limits Involving limited degradation of cooling not affecting the integrity of the fuel pins Involving mechanical damage of the fuel pin integrity without degradation of cooling Level 2 may be appropriate for events in which there is damage to the fuel pin integrity as a result of substantial heat up of the fuel element 6 3 9 Loss of electrical power supply At many facilities it is often necessary to provide a guaranteed electrical supply to ensure its continued safe operation and to maintain the availability of monitoring equipment and surveillance instruments Several independent electrical supply routes and diverse supply means are used to prevent common cause failure While most facilities will be automatically shut down to a safe condition on tot
108. ent re evaluation of the consequences would necessitate revision of the provisional rating The scale should not be confused with emergency classification systems and should not be used as a basis for determining emergency response actions Equally the extent of emergency response to events is not used as a basis for rating Details of the planning against radiological events vary from one country to another and it is also possible that precautionary measures may be taken in some cases even where they are not fully justified by the actual size of the release For these reasons it is the size of release and the assessed dose that should be used to rate the event on the scale and not the protective actions taken in the implementation of emergency response plans Two types of criteria are described in this section Amount of activity released applicable to large releases of radioactive material into the environment Doses to individuals applicable to all other situations 14 The procedure for applying these criteria is summarized in the flowcharts in Section 7 However it should be noted that for events associated with transport and radiation sources it is only necessary to consider the criteria for doses to individuals when there is a significant release of radioactive material 2 2 ACTIVITY RELEASED The highest four levels on the scale Levels 4 7 include a definition in terms of the quantity of activity released defining
109. ential consequences 6 2 2 Identification of number of safety layers 6 2 3 Assessment of the basic rating 6 2 4 Additional factors Overall rating Explanation There were no actual consequences from the event The maximum potential consequences of a criticality in the fuel store would be rated at Level 4 Remaining safety layers related to flooding were Several controls in place to prevent flooding assumed in the safety case Safety justification that flooding would not lead to criticality Remaining safety layers related to other materials were Clear procedures training and labelling to prevent the addition of hydrogenous material Inspections to detect deviations from assumptions made in the safety case There are two safety layers remaining and the basic rating from Table 11 is Level 1 Level 1 would also be an appropriate rating because The operations were outside OL amp C The safety culture failed to ensure adequate assessments and documentation It is not considered appropriate to uprate the event to the maximum under defence in depth because several failures were still required before an accident would have occurred see Section 6 2 4 item 3 Level 1 136 Example 52 Prolonged loss of ventilation at a fuel fabrication facility Level 1 Event description Following a loss of normal and emergency ventilation and non compliance with procedures the o
110. ently transferred into the scrap metal trade The scale can also be used for events involving the unplanned exposure of individuals in other regulated practices e g processing of minerals The scale is only intended for use in civil non military applications and only relates to the safety aspects of an event The scale is not intended for use in rating security related events or malicious acts to deliberately expose people to radiation When a device is used for medical purposes e g radiodiagnosis and radiotherapy the guidance in this manual can be used for the rating of events resulting in actual exposure of workers and the public or involving degradation of the device or deficiencies in the safety provisions Currently the scale does not cover the actual or potential consequences on patients exposed as part of a medical procedure The need for guidance on such exposures during medical procedures is recognized and will be addressed at a later date The scale does not apply to every event at a nuclear or radiation facility The scale is not relevant for events solely associated with industrial safety or other events which have no safety relevance with respect to radiation or nuclear safety For example events resulting in only a chemical hazard such as a gaseous release of non radioactive material or an event such as a fall or an electrical shock resulting in the injury or death of a worker at a nuclear facility would not be classified usi
111. ents at power reactors while at power but it should also be used to rate events in hot shutdown or startup conditions as the safety case is quite similar to that for power operation However once the reactor is in cold shutdown while some of the safety systems are still required to assure the safety functions usually more time is available Also in shutdown conditions the configurations of the barriers are sometimes quite different for example open primary coolant system open containment For these reasons a different approach to rating events is proposed and events during reactor shutdown should generally be rated using the guidance in Section 6 However if a facility has an approved safety case based on the initiator and safety system approach it may be possible to use the initiator approach described in this section for rating events Events on reactors that are being decommissioned where the fuel has been removed from the reactor should also be rated using Section 6 as should events at research reactors in order to take proper account of the range of maximum potential consequences and design philosophy One facility can of course cover a number of practices and each practice must be considered separately in this context For example reactor operations work in hot cells and waste storage should be considered as separate practices even though they can all occur at one facility Rating events associated with hot cells or waste storag
112. equivalent dose is the sievert Sv equal to 1 J kg The rem equal to 0 01 Sv is sometimes used as a unit of equivalent dose and effective dose event Any occurrence that requires a report to the regulator or the operator or a communication to the public exposure The act or condition of being subject to irradiation 16 186 Note Exposure should not be used as a synonym for dose Dose is a measure of the effects of exposure external exposure Exposure to radiation from a source outside the body 16 fissile material U 7 U Pu Pu or any combination of these radio nuclides Excepted from this definition are a Natural uranium or depleted uranium that is unirradiated and b Natural uranium or depleted uranium that has been irradiated in thermal reactors only 16 high integrity safety layer A high integrity safety layer has all of the following characteristics a The safety layer is designed to cope with all relevant design basis faults and is explicitly or implicitly recognized in the plant safety justi fication as requiring a particularly high reliability or integrity b The integrity of the safety layer is assured through appropriate monitoring or inspection such that any degradation of integrity is identified c If any degradation of the layer is detected there are clear means of coping with the event and of implementing corrective actions either through pre determined procedures or through
113. er of transport packages it is necessary to consider whether to use the inventory of a single item or the total inventory of the packages sources If the reduction in safety requirements has the potential to affect all the items e g a fire then the total inventory should be used If the reduction in safety requirements can only affect a single item e g inadequate labeling of one transport package the inventory used should be that of the package affected Appendix III gives the methodology for calculating an aggregate D value In order to allow for the wide range of possible events covered by this guidance the steps below should be followed to take into account the maximum potential consequences when assessing an event If the activity is known the A D value should be determined by dividing the activity A of the radionuclide by the defined D value The A D ratio should be compared to the A D ratios in Table 5 and a category assigned If the actual activity is not known e g an unidentified source found in scrap metal the activity should be estimated from known or measured dose rates and by identification of the radionuclide The category should then be assigned based on the A D ratio 45 If the actual activity is not known and no measurements of dose rate are available a source category should be estimated based on any available knowledge about the use of the source Appendix IV gives examples of the different uses of
114. er trip Details of that protection are not provided but unless it can be shown that there are two or more redundant trains of protection that remain effective under the prevailing operating conditions it should be assumed that there was only one safety layer preventing a significant release 6 2 3 Assessment of the basic The rating from Table 11 is Level 2 rating 6 2 4 Additional factors The rating cannot be updated beyond the maximum defence in depth rating Overall rating Level 2 Example 55 Near criticality at a nuclear recycling facility Level 2 Event description At a plutonium recycling facility a pipe carrying hot plutonium nitrate developed a leak and over a period of about 24 h a total of 31 kg leaked into the cell housing the pipe The leak was identified at the daily visual inspection The hot plutonium nitrate ran over the outer surfaces of a hot plutonium evaporator and dripped onto the sloping stainless steel clad floor beneath As the liquid ran over the various surfaces it evaporated and deposited the plutonium in a crystalline form on the lowest part of the pipe and on the floor beneath forming structures like a stalactite and stalagmite The leak rate was such that the material failed to reach the detection sump as a liquid and was only identified through surveillance tours The cell was subsequently decontaminated the pipeline and evaporator replaced and the facility brought back into use
115. er via a single suction pipe with two isolation valves The valves are operable from the control room The primary circuit was open with the cavity flooded The reactor had been shutdown for one week so that any coolant temperature increase would be very slow Steam generators were open for work and therefore unavailable Safety injection was not available high pressure steam injection HPSI pumps are separate from the charging pumps and relief valves were available to control primary circuit pressure The event occurred when spurious operation of pressure sensors caused the isolation valves to close Alarms in the control room notified the operating personnel of the valve closure and having checked that the pressure rise was a spurious signal the valves were re opened Temperatures did not rise above the limits in Operational Limits and Conditions it would have taken 10 hours to reach the operational limits 124 Rating explanation Criteria Explanation 2 and 3 Actual consequences There were no actual consequences from the event 6 2 1 Maximum potential The maximum potential consequences for an event consequences associated with a shutdown power reactor are Levels 5 7 6 2 2 Identification of number Considering the safety function of fuel cooling there of safety layers are two safety layers The first is the RHR system and the second is the very long time available to add water so as to maintain the water level as water and
116. etween 24 and 55 mSv effective dose were assessed for the individuals involved The annual limit at the time was 50 mSv 38 Rating explanation Criteria Explanation 2 2 Activity released Not applicable No release to the environment 2 3 Doses to individuals One worker received a dose greater than the annual limit The number receiving such a dose was less than 10 so the rating is not increased due to the number of people involved Rating Level 2 3 2 Radiological barriers and The contamination occurred during the controls at facilities decommissioning of a specific item in an area which had been prepared for the potential contamination i e an area expected by design The criteria are therefore not applicable Rating for actual consequences Level 2 Example 12 Evacuation near a nuclear facility Level 4 Event description An accident at a nuclear power station involving overheating of the fuel led to failure of about half of the fuel pins and a subsequent release of radioactive material Failure of about half the fuel pins without significant fuel melting would release about 0 5 of the total core inventory Local police in consultation with the licensee and the regulatory authority took the immediate decision to evacuate people within a 2 km radius of the facility and as a result no one received doses above 1 mSv Assessment of the release by experts at the facility suggested that the total activity was a
117. excess of normal make up capability Primary coolant leak through multiple safety or relief valves Fuel channel or RPS channel rupture Loss of water flow in any fuel channel Loss of water flow in RPS cooling circuit Total loss of helium mixture flow in the reactor graphite stacking Emergency in the course of on load refuelling machine operation Total loss of auxiliary power Unauthorized supply of cold water from emergency core cooling system ECCS into reactor II 4 3 Category 3 Unlikely Major LOCA up to and including the largest justified pipe rupture in the reactor coolant pressure boundary Main steam pipe break before the main steam isolation valve MSIV including the largest justified pipe rupture Drop of a spent fuel assembly onto other spent fuel assemblies Total loss of service water flow Fuel assembly ejection from the fuel channel including ejection from the fuel channel while in the refuelling machine 178 II 5 GAS COOLED REACTORS II 5 1 Category 1 Expected Reactor trip Loss of main feedwater flow Very small depressurization Boiler tube leak Loss of off site AC power including consideration of voltage and frequency disturbances Inadvertent withdrawal of one or more control rods Minor fuel handling incident Some loss of interruption of forced reactor coolant flow II 5 2 Category 2
118. exposure was 0 8 mSv effective dose Worker doses were well below the annual statutory limits Rating explanation Criteria Explanation 2 2 Activity released Although detailed quantities are not provided it can be inferred from the small doses that the level of release to the environment was orders of magnitude below the value for Level 4 2 3 Doses to individuals Doses to members of the public were less than 1 mSv and the doses to workers did not reach the statutory annual dose limit 3 2 Radiological barriers and More than a few per cent of the core was molten controls at facilities giving a rating of Level 5 Rating for actual consequences Level 5 41 4 ASSESSMENT OF THE IMPACT ON DEFENCE IN DEPTH FOR TRANSPORT AND RADIATION SOURCE EVENTS This section deals with those events where there are no actual conse quences but some of the safety provisions failed The deliberate inclusion of multiple provisions or barriers is termed defence in depth Annex I gives more background on the concept of defence in depth particularly for major facilities The guidance in this section is for practices associated with radiation sources and the transport of radioactive material Guidance for accelerators and for facilities involving the manufacture and distribution of radionuclides or the use of a Category 1 source is given in Section 6 The safety of the public and workers during the transport and use of radiation
119. f communicating the safety significance of events This edition of the INES User s Manual is designed to facilitate the task of those who are required to rate the safety significance of events using the scale It includes additional guidance and clarifications and provides examples and comments on the continued use of INES With this new edition it is anticipated that INES will be widely used by Member States and become the worldwide scale for putting into proper perspective the safety significance of any event associated with the transport storage and use of radioactive material and radiation sources whether or not the event occurs at a facility INTERNATIONAL ATOMIC ENERGY AGENCY VIENNA
120. fety Culture Safety Series No 75 INSAG 4 IAEA Vienna 1992 INTERNATIONAL ATOMIC ENERGY AGENCY Development of an Extended Framework for Emergency Response Criteria Interim Report for Comment IAEA TECDOC 1432 IAEA Vienna 2006 NUCLEAR REGULATORY COMMISSION Health Effects Models for Nuclear Power Plant Accident Consequence Analysis Low LET Radiation Rep NUREG CR 4214 Rev 1 Part II SAND85 7185 NRC Washington DC 1989 HOPEWELL J W Biological Effects of Irradiation on Skin and Recommen dation Dose Limits Radiat Prot Dosimetry 39 1 3 1991 11 24 INTERNATIONAL COMMISSION ON RADIOLOGICAL PROTECTION The Biological Basis for Dose Limitation in the Skin Publication 59 Ann ICRP 22 2 Pergamon Press Oxford 1991 INTERNATIONAL COMMISSION ON RADIATION UNITS AND MEASUREMENTS Dosimetry of External Beta Rays for Radiation Protection ICRU Report 56 ICRU Bethesda MD 1996 INTERNATIONAL ATOMIC ENERGY AGENCY Diagnosis and Treatment of Radiation Injuries Safety Reports Series No 2 IAEA Vienna 1998 169 14 17 18 19 170 FOOD AND AGRICULTURE ORGANIZATION OF THE UNITED NATIONS INTERNATIONAL ATOMIC ENERGY AGENCY INTERNATIONAL LABOUR ORGANISATION OECD NUCLEAR ENERGY AGENCY PAN AMERICAN HEALTH ORGANIZATION WORLD HEALTH ORGANIZATION International Basic Safety Standards for Protection against Ionizing Radiation and for the Safety of Radiation Sources Safety Series No 115 IAEA Vienna
121. ficient to achieve the safety function challenged by the initiator being considered In some cases categories B and C may be the same i e the operability is inadequate unless all the safety systems meet the OL amp C requirements In other cases Category C will correspond to a level of operability lower than that required by OL amp C One example would be where diverse safety systems are each required to be operable by OL amp C but only one is operable Another would be where all safety systems that are designed to assure a safety function are inoperable for such a short time that the safety function can still be assured even though the safety systems do not meet the OL amp C requirements For example the safety function cooling of the fuel may be assured if a total station blackout occurs for only a short time In identifying the effectiveness of such provisions it is important to take account of the time available and the time required for identifying and implementing appropriate corrective action 73 It is also possible that the safety function may be adequate due to the operability of non safety systems see Example 40 Non safety systems can be taken into account if they have been demonstrated or are known to be operable during the event However care must be taken in including non safety systems as their operability is not generally controlled and tested in the same way as it is for safety systems D Inadequate This
122. for workers There were no deterministic health effects Rating Level 2 Rating for impact on people Level 2 and the environment Example 2 Overexposure of a radiographer Level 2 Event description A radiographer was disconnecting the source guide tube from a radio graphic camera and noticed that the source was not in the fully shielded position The exposure device contained an 807 GBq Ir sealed source The radiographer noticed that his pocket ion chamber was off scale and notified the radiation safety officer RSO of the company Because extremity dosimeters are not commonly used during radiographic operations the RSO conducted a dose reconstruction Based on the dose reconstruction one individual may have received an extremity dose in the range of 3 3 3 6 Gy which is in excess of the statutory annual dose limit of 500 mSv to the skin or the extremity Whole body dosimeter results revealed that the radiographer received a whole body dose of approximately 2 mSv The radiographer was admitted to the hospital for observation and was later released No deterministic effects were observed Subsequent information obtained indicated that the individual had worn his dosimeter on his hip and his body may have shielded the dosimeter 23 Rating explanation Criteria Explanation 2 2 Activity released Not applicable No release 2 3 Doses to individuals One worker received a dose in excess of the annual limit No deterministic
123. g 6a yoaye yyeay oI sIUIWWa ap eU 9 UON SJBYJOM JO yw enuue Ajojnye s ay saw ua Jo sseoxe Ul einsodxy 19497 yuaploul snou ainsodxe o1ljqnd jueoyluBbis jo Ayjiqeqoid ysy e uM uogejjezsu Ue UUM JeuayewW sAqoeolpel Jo s yuenb zueoyiu s Jo aseajay AJOJUBAUL 9109 JO BSea ol L O uey s10W ut Bunjnsas jan 0 aBewep Jo yaw Jany yd p ul souajeq seniors ye sjo1 uo9 pue sialueg jesbojoipey uoveipes Wo YyJeep auo Sea Jy 01 U0D poo e90 uey 134 0 SainseewwajuNnoo pauue d Jo uoyezusawajdw Ul NsaJ 0 AjayljUN jevayewW AYILOIPELI JO aseajal JOUIN yUSWUOIAUd By pue jdo d t 19497 s u nb suo 1230 y m Juapiooy 19497 S NI pue uonduos q SANI NI SENHA ONILVY YOA VINALINO TVYANAD I ATaV Although INES covers a wide range of practices it is not credible for events associated with some practices to reach the upper levels of the scale For example events associated with the transport of sources used in industrial radiography could never exceed Level 4 even if the source was taken and handled incorrectly 1 3 SCOPE OF THE SCALE The scale can be applied to any event associated with the transport storage and use of radioactive material and radiation sources It applies whether or not the event occurs at a facility It includes the loss or theft of radioactive sources or packages and the discovery of orphan sources such as sources inadvert
124. gan to fracture placing fragments of the fuel rods in line with the control rod columns The rods became stuck after being inserted only one third of the way and were therefore unable to stop the reaction The reactor power increased to around 30 GW which was ten times the normal operational output The fuel rods began to melt and the steam pressure rapidly increased causing a large steam explosion Generated steam traveled vertically along the rod channels in the reactor displacing and destroying the reactor lid rupturing the coolant tubes and then blowing a hole in the roof After part of the roof blew off the inrush of oxygen combined with the extremely high temperature of the reactor fuel and graphite moderator sparked a graphite fire This fire was a significant contributor to the spread of radioactive material and the contamination of outlying areas The total release of radioactive material was about 14 million TBq which included 1 8 million TBq of I 85 000 TBq of Cs and other caesium radio isotopes 10 000 TBq of Sr and a number of other significant isotopes 28 Rating explanation Criteria Explanation 2 2 Activity released 2 3 Doses to individuals Rating for impact on people and the environment The factors for the radiological equivalence of Sr and Cs from Table 2 are 20 and 40 respectively so the total release was radiologically equivalent to 5 4 million TBq I This is rated at the highest le
125. h clad failure or if there is damage to a significant fraction 10 of the clad thereby releasing the gap inventory For research reactors the fraction of fuel affected should be based on quantities of a 3000 MW th power reactor Fuel damage or degradation that does not result in a release of more than 0 1 of the core inventory of a power reactor e g very localized melting or a small amount of clad damage should be rated at Below scale Level 0 under this criterion and then considered under the defence in depth criteria 11 High probability implies a similar probability to that of a release from the containment following a reactor accident 32 For other facilities An event involving the release of a few thousand terabecquerels of activity from their primary containment with a high probability of significant public overexposure Level 3 An event resulting in a release of a few thousand terabecquerels of activity into an area not expected by design which require corrective action even with a very low probability of significant public exposure or An event resulting in the sum of gamma plus neutron dose rates of greater than 1 Sv per hour in an operating area dose rate measured 1 metre from the source Events resulting in high dose rates in areas not considered as operating areas should be rated using the defence in depth approach for facilities see Example 49 Level 2 An event re
126. h or low due to failure or inadvertent operation of an active component e g feed bleed or relief valve Steam generator tube leakage in excess of plant operating specification but less than the equivalent of a full tube rupture Reactor coolant system leakage that would not prevent a controlled reactor shutdown and cooldown Power conversion system leakage that would not prevent a controlled reactor shutdown and cooldown Loss of off site power AC including consideration of voltage and frequency disturbances Operation with fuel bundle s in any misplaced position Minor fuel handling incident Reactor coolant pump s trip Loss of main feedwater flow to one or more steam generators Flow blockage in an individual channel less than 70 Loss of moderator cooling Loss of computer control Unplanned regional increase in reactivity 176 II 3 2 Category 2 Possible Small LOCA including pressure tube rupture Full rupture of one steam generator tube Blowdown of reactor coolant through multiple safety or relief valves Damage to irradiated fuel or loss of cooling to fuelling machine containing irradiated fuel Leakage from irradiated fuel bay in excess of normal make up capability Feedwater line break Flow blockage in an individual channel more than 70 Moderator failure Loss of end shield cooling Shutdown cooling
127. h the event and of implementing corrective actions either through pre determined procedures or through long times being available to repair or mitigate the fault An example of a high integrity layer would be a vessel or a vault Admin istrative controls would not normally meet the requirements of a high integrity layer though as noted above certain operating procedures can also be regarded as high integrity safety layers if there are very long timescales available to perform the actions required to correct errors by operating personnel should they occur and if there are a wide range of available actions 109 6 2 2 4 Time available In some situations the time available to carry out corrective actions may be significantly greater than the time required for those actions and may therefore allow additional safety layers to be made available These additional safety layers may be taken into account provided that procedures exist for carrying out the required actions Where several such layers are made effective by operator action in response to alarms or indications the reliability of the procedure itself must be considered The time available to implement the procedure is considered to have a significant impact on the reliability that can be claimed from operating procedures See examples in Section 6 4 1 In some cases the time available may be such that there are a whole range of potential safety layers that can be made available and i
128. had failed to show that the system was inadequate A programmable logic control system had not been programmed and commissioned correctly The modifications were poorly assessed and controlled because their safety significance was not classified correctly Designers and commissioning staff did not communicate properly A permit to work authorization had been closed indicating that the facility had been returned to its normal state but in fact it had not The temporary plant modification proposal TPMP system was too frequently used in this facility and inadequately controlled and the full PMP system in use required improvement Training and supervision of active cell entries was inadequate 139 Rating explanation Criteria Explanation 2 and 3 Actual consequences There were no actual consequences from the event 6 2 1 Maximum potential The maximum potential consequences for such consequences practices are rated at Level 4 fatal radiation dose 6 2 2 Identification of number Despite the failure of a number of safety layers there of safety layers was one remaining safety layer namely the permit to work authorization procedure for entry to the cells requiring the use of personal alarm dosimeters 6 2 3 Assessment of the basic Based on Table 11 the maximum rating under defence rating in depth of Level 2 is appropriate 6 2 4 Additional factors The rating cannot be updated beyond the maximum defence
129. heat is lost through evaporation The second layer can be considered as a highly reliable layer Section 6 2 2 4 for the following reasons there are long times available for action at least 10 h to reach operational limits there are a number of ways of adding additional water e g low pressure safety injection fire hoses though boron concentration must be controlled this safety layer is recognized in the safety justification as a key safety feature In addition the time available is such that there is adequate time for repair of the RHR system if necessary 6 2 3 Assessment of the basic The guidance in Section 6 2 3 1 gives a rating of Below rating Scale Level 0 Overall rating Below Scale Level 0 Example 43 Complete loss of shutdown cooling Level 1 Event description The shutdown cooling of the reactor vessel was completely lost for several hours when the suction isolation valves of the RHR system which was in operation automatically closed These valves closed due to the loss of the power supply to Division 2 of the nuclear safety protection system as a result of inappropriate maintenance The alternate power supply had already been isolated for maintenance The unit had been in the shutdown condition for a long time about 16 months and the decay heat was very low During the period of time the shutdown cooling was unavailable water in the reactor 125 vessel began to heat up at a rate of ap
130. hen take account of the additional information related to safety culture that will have arisen from a detailed investigation 5 3 WORKED EXAMPLES Example 27 Reactor scram following the fall of control rods Below Scale Level 0 Event description The unit was operating at rated power During the movement of a bank of shutdown rods which was carried out as a periodic control rod surveillance test the reactor was scrammed as a result of a high negative rate signal of the power range neutron flux This also caused automatic turbine and generator trip The control rod operation was promptly stopped and rod positions checked on the control rod position detector It was found that the four control rods of the shutdown bank being tested had fallen prior to the reactor shutdown The high negative rate signal had been provided to protect against instrument failure and was not claimed as protection against any design basis faults 84 An inspection of the control circuit of the control rod drive mechanism showed that the cause of the malfunction was a defective printed circuit board The relevant faulty board was replaced with a spare board and after the integrity of the control circuit had been checked normal operation was resumed Rating explanation Criteria Explanation 2 and 3 Actual consequences There were no actual consequences from the event 5 1 1 Initiator frequency The accidental falling of control rods does
131. hould be based on quantities of a 3000 MW th power reactor Release here is used to describe the movement of radioactive material from its intended location but still contained within the facility boundary 10 Since the extent of fuel damage is not easily measurable utilities and regulators should establish plant specific criteria expressed in terms of symptoms e g activity concentration in the primary coolant radiation monitoring in the containment building to facilitate the timely rating of events involving fuel damage 31 For other facilities An event resulting in a major release of radioactive material at the facility comparable with the release from a core melt with a high probability of significant overexposure Examples of non reactor accidents would be a major criticality accident or a major fire or explosion releasing large quantities of radioactive material within the installation Level 4 For events involving reactor fuel including research reactors An event resulting in the release of more than about 0 1 of the core inventory of a power reactor from the fuel assemblies as a result of either fuel melting and or clad failure Again this definition is based on the total inventory of the core not just the gap inventory and does not depend on the state of the primary circuit A release of more than 0 1 of the total core inventory could occur if either there is some fuel melting wit
132. however is only related to the assessment of the radiological hazard Thus no severe consequences exceeding a rating of Level 4 are conceivable from a release of uranium or its compounds For accelerators the maximum potential consequences are likely to be related to unplanned individual exposure If the radiation levels are sufficiently high to cause deterministic effects or death in the event of entry into restricted areas then the rating of the maximum potential consequences is Level 3 or 4 from the individual dose criteria in Section 2 3 7 For irradiators most events will be associated with unplanned radiation doses If the potential radiation levels in the event of failure of all the protective measures are sufficiently high to cause deterministic effects or death then the rating of the maximum potential consequences is Level 3 or 4 from the individual dose criteria in Section 2 3 For events at facilities with Category 1 sources that have safety systems intended to prevent dispersion of radioactive material e g fire protection systems the potential release may be large enough to give maximum potential consequences rated at Level 5 6 2 2 Identification of number of safety layers 6 2 2 1 Identifying safety layers There are a wide range of safety provisions used in the different facilities covered by this section Some of these may be permanent physical barriers others may rely on interlocks others may be active enginee
133. ical An adjective referring to both radiation and contamination surface and airborne radiological barriers Physical barriers which contain radioactive material and or shield individuals from the radiation emanating from the material RBE weighted absorbed dose A product of the absorbed dose in an organ or tissue and the RBE of the radiation imparting the dose AD De XRBER R where D is the organ dose from radiation R in tissue T and RBE is the relative biological effectiveness of radiation R in producing a specific effect in a particular organ or tissue T The unit of RBE weighted absorbed dose is J kg termed the gray equivalent Gy Eq The RBE weighted absorbed dose is intended to account for differences in biological effectiveness in producing deterministic health effects in organs or tissues of reference man due to the quality of the radiation 5 safety case A collection of arguments and evidence in support of the safety of a facility or activity 190 safety culture The assembly of characteristics and attitudes in organizations and individuals which establishes that as an overriding priority protection and safety issues receive the attention warranted by their significance 14 safety functions The three basic safety functions are a controlling the reactivity or the process conditions b cooling the radioactive material c confining the radioactive material safety layers Passive systems auto
134. idered in the design of the plant which are less likely than the above lt 10 per year 4 Beyond design These are initiators of very low frequency not normally included in the conventional safety analysis of the plant When protection systems are introduced against these initiators they do not necessarily include the same level of redundancy or diversity as measures against design basis initiators Each reactor has its own list and classification of initiators as part of its safety analysis and these should be used in rating events Typical examples of 71 design basis initiators that have been used in the past for different reactor systems are given in Annex II categorized into the previous frequency categories These may provide a guide in applying the rating process but it is important wherever possible to use the initiators and frequencies specific to the plant where the event occurred Small plant perturbations that are corrected by control as opposed to safety systems are not included in the initiators However if the control systems fail to stabilize the reactor that will eventually lead to an initiator For these reasons the initiator may be different from the occurrence that starts the event see Example 36 on the other hand a number of different event sequences can often be grouped under a single initiator For many events it will be necessary to consider more than one initiator each of which will lead to a rating
135. igher rating is appropriate based on assessing the doses to people within the facility using Table 3 T Level 6 is not considered credible for any event involving radiation sources T as explained in section 2 4 the Level definitions are based on defence in depth criteria explained in Chapters 4 to 6 but they are included here for completeness FIG 5 Procedure for rating the impact on people and the environment 146 Preder core siemens power reactor has been released from the fuel assemblies ing a major release of radioactive material at the facility the release from a core melt with a high probability of icant overexposure tion 3 2 Level 5 An event where fuel melting and or clad failure results in more than about otal Bie sore Or of power OAST being relapsed froin the fuel assem Events involving the release of a few thousand teral uerels of activity from their primary containment with a high probability of signifi nt public A release of a few thousand TBq of activi design but requiring corrective action evel a baat there hig radiation in an lus neutron dose rates of greater than 1 Sv per hour in operating area i rate measured 1 metre from the source Section 3 2 The sum of gamma plus neutron dose rates of greater than 50 mSv per hour in an operating area dose rate measured 1 metre from the source Level 3 fis soni Presence of agnitione quantities of radioactive al material in th
136. iled and the only barriers preventing a very large release are the remaining containment systems Without specific criteria to address such events they would only be rated at Level 3 under defence in depth the same level as a near accident with no redundancy remaining The criteria for Level 4 and Level 5 specifically address this situation The second type of event is where the primary barriers preventing a large release remain intact but a major spillage of radioactive materials or a significant increase in dose rate occurs at facilities handling large quantities of radioactive material Such events could well be rated at Level 1 under defence in depth due to the large numbers of barriers that would still be in place However these events represent a major failure in the management controls for handling radioactive material and hence in themselves suggest an underlying risk of events with significant impact on people and the environment The criteria for Levels 2 and 3 specifically address this second type of event The significance of contamination is measured either by the quantity of activity spread or the resultant dose rate These criteria relate to dose rates in an operating area but do not require a worker to be actually present They should not be confused with the criteria for doses to workers in Section 2 3 which relate to doses actually received 30 Contamination levels below the value for Level 2 are considered insignifica
137. ing area boundary wall to prevent back diffusion of radioactive material In addition cleanup systems such as high efficiency particulate air HEPA filters or scrubbers are provided to reduce discharges to atmosphere to below pre defined limits and to prevent back diffusion into areas of lower activity The first step in rating events associated with the loss of such systems is to determine the maximum potential consequences should all the safety provisions fail This should consider the material inventory and the possible means for its dispersion both inside and outside the facility It is also necessary to consider the potential for decrease in the concentration of inerting gases or the buildup of explosive mixtures In most cases unless an explosion is possible it is unlikely that the maximum potential consequences would exceed Level 4 and therefore the maximum under defence in depth would be Level 2 The second step is to identify the number of remaining safety layers including procedures to prevent the generation of further activity by cessation of work The rating of such events is illustrated by Example 52 in Section 6 4 2 119 6 3 8 Handling events and drops of heavy loads 6 3 8 1 Events not involving fuel assemblies The impact of handling events or failure of lifting equipment depends on the material involved the area in which the event occurred and the equipment which was or could have been affected Events where a droppe
138. ing explanation Criteria Explanation 2 3 Doses to individuals 4 2 1 Maximum potential consequences 4 2 2 Effectiveness of safety provisions Overall rating There were no doses reported Spent fuel packages should be rated using the guidance for Category 1 sources Based on the fifth bullet of section A in Table 7 no damage or minor damage to transport package with no increase in dose rate the rating could be either Below scale Level 0 or Level 1 Below scale Level 0 is chosen as there were no indications of safety culture issues Below Scale Level 0 Example 16 Package damaged by forklift Below Scale Level 0 Event description A Type A package was reported as damaged at an airport Early reports suggested that the package had only been scuffed by the wheel of a fork lift truck The consignor was requested to assess the damage to the package and determine what should be done with it The consignor was able to repackage the contents two Cf sources 1 98 MBq each and enable the package to continue They were also equipped to overpack the Type A package and return it to its origin It was confirmed that there was minimal damage to the original outer packaging 57 Rating explanation Criteria Explanation 2 3 Doses to individuals 4 2 1 Maximum potential consequences 4 2 2 Effectiveness of safety provisions Overall rating Doses received were below the value f
139. ing in an A D ratio of 1000 gt A D 10 Therefore it is classified as a Category 2 source 4 2 2 Effectiveness of safety Based on the second row of Table 6 the rating should provisions be Level 1 or 2 Considering that the source was melted the final rating should be Level 2 based on footnote a in Table 6 Final rating Level 2 Example 26 Loss of a high activity radiotherapy source Level 3 Event description A source inventory check at a hospital that had been closed for some time revealed that a teletherapy head containing a 100 TBq Co source was missing The unit had been stored in a dedicated facility but an inventory check had not been carried out for several weeks It was suspected that the unit had been taken out of the hospital by unauthorized persons A search was carried out and one day later the source was located on open land two kilometers away 66 The unit had been dismantled and the source was unshielded but not breached It was recovered by the national authorities The subsequent investigation indicated that several people had been exposed as a result of the event as follows One person 20 Gy to the hands 500 mSv effective dose Radiation injuries observed on one hand requiring skin grafts and the amputation of one finger Two persons 2 Gy to hands 400 mSv effective dose Twelve persons 100 mSv effective dose The statutory annual whole body dose limit for workers was 20 mS
140. installed on such a scale that consideration of protection and safety is required authorized limit A limit on a measurable quantity including equipment opera bility established or formally accepted by a regulatory body sometimes these limits are established within what are called OL amp C basic rating The rating prior to consideration of additional factors It is based purely on the significance of actual equipment or administrative failures common cause failure Failure of two or more structures systems or components due to a single specific event or cause 16 For example a design deficiency a manufacturing deficiency operation and maintenance errors a natural phenomenon a human induced event saturation of signals or an unintended cascading effect from any other operation or failure within the plant or from a change in ambient conditions confinement Prevention or control of releases of radioactive material to the environment in operation or in accidents 16 Note Confinement is closely related in meaning to containment but confinement is used to refer to the safety function of preventing the escape of radioactive materials whereas containment refers to the means for achieving that function containment Methods or physical structures designed to prevent or control the release and the dispersion of radioactive materials 16 184 defence in depth A hierarchical deployment of different levels of diverse
141. ion in the process conditions of safety layers the process was automatically shut down All hutdown steps proceeded normally No safety layers failed 6 2 3 Assessment of the basic Based on point 1 of Section 6 2 3 1 the rating is Below rating Scale Level 0 6 2 4 Additional factors There are no reasons to uprate the event Overall rating Below scale Level 0 Example 48 Loss of cooling at a small research reactor Below Scale Level 0 Event description The event occurred at a 100 kW research reactor with a large cooling pool and a heat exchanger purification system as shown in Fig 3 In the event of loss of cooling any heating of the water will be extremely slow The event occurred when the pipework downstream of the pump failed and coolant was pumped out to the bottom of the suction pipe The pump then failed due to cavitation 131 Rating explanation Criteria Explanation 2 and 3 Actual consequences 6 2 1 Maximum potential consequences 6 2 2 Identification of number of safety layers 6 2 3 Assessment of the basic rating 6 2 4 Additional factors Overall rating There were no actual consequences from the event There are two safety functions to be considered One is the cooling of the fuel and the other is the shielding to prevent high worker doses For both safety functions due to the low inventory the maximum potential consequences cannot exceed Level 4 and therefore the maxi
142. ion of number of safety layers 6 2 3 Assessment of the basic rating 6 2 4 Additional factors Overall rating There were no actual consequences from the event The ventilation system is designed to cascade air flows from areas of low contamination to areas of successively higher or potentially higher contamination Had there been a coincident event such as a fire leading to pressurization some radioactivity which should otherwise have been discharged through a filtration system would be discharged to the plant operating area and then to the atmosphere without the same degree of filtration The maximum potential consequence would be Level 4 based on the potential release to atmosphere Remaining independent safety provisions not including ultimate emergency procedures were Automatic firefighting systems The building structure that provided both containment and decontamination to reduce exposures to less than 0 1 mSv There were at least two effective safety layers and the basic rating from Table 11 is Level 1 Although the procedures were violated work continued without ventilation and there were common cause issues with the electrical supplies it is not considered appropriate to update the event to the maximum under defence in depth because several failures a fire failure of the firefighting systems problems with containment were still required before an accident would have occurred see Section 6
143. ions Table 11 should be used to determine the basic rating a If only one safety layer remains but that safety layer meets all the requirements of a high integrity safety layer Section 6 2 2 3 or the long time available provides a highly reliable safety layer Section 6 2 2 4 a basic rating of Below Scale Level 0 would be more appropriate b If the period of unavailability of a safety layer was very short compared to the interval between tests of the components of the safety layer e g a couple of hours for a component with a monthly test period consideration should be given to reducing the basic rating of the event TABLE 11 RATING OF EVENTS USING THE SAFETY LAYERS APPROACH Maximum potential consequences Number of remaining safety layers 1 2 3 Levels Levels Levels 5 6 7 3 4 2or1 A More than 3 0 0 0 B 3 1 0 0 C 2 2 1 0 D 1or0 3 2 1 These ratings cannot be increased due to additional factors because they are already the upper limit for defence in depth This approach inevitably requires some judgement but Section 6 3 gives guidance for specific types of events and Section 6 4 provides some worked examples of the use of the safety layers approach 6 2 3 2 Potential events including structural defects Some events do not of themselves reduce the number of safety layers but do correspond to an increased likelihood of a reduction Examples are 18 If the operability of safety layers was outside
144. is when the operability of the safety systems is such that none of them is capable of achieving the safety function challenged by the initiator being considered It should be noted that although operability categories C and D represent arange of plant states categories A and B represent specific operabilities Thus the actual operability may be between that defined by operability categories A and B i e the operability may be less than full but more that the minimum allowed for continued operation at power This is considered in Section 5 1 3 5 1 3 Assessment of the basic rating for events with a real initiator In order to obtain a basic rating firstly decide whether there was an actual challenge to the safety systems a real initiator If so then this Section is appropriate otherwise Section 5 1 4 is appropriate It may be necessary to consider an event using both sections if an initiator occurs and reveals a reduced operability in a system not challenged by the real initiator e g if a reactor trip without loss of off site power reveals a reduced operability of diesels For events involving potential failures that could have led to an initiator e g discovery of structural defects or small leaks terminated by operator action a similar approach is used but it is also necessary to take into account the likelihood of the potential initiator occurring This is explained in Section 5 1 5 5 1 3 1 Basis of rating The appropriate ra
145. its size by its radiological equivalence to a given number of terabecquerels of I The method for assessing radiological equivalence is given in Section 2 2 1 The choice of this isotope is somewhat arbitrary It was used because the scale was originally developed for nuclear power plants and I would generally be one of the more significant isotopes released The reason for using quantity released rather than assessed dose is that for these larger releases the actual dose received will very much depend on the protective action implemented and other environmental conditions If the protective actions are successful the doses received will not increase in proportion to the amount released 2 2 1 Methods for assessing releases Two methods are given for assessing the radiological significance of a release depending on the origin of the release and hence the most appropriate assumptions for assessing the equivalence of releases If there is an atmospheric release from a nuclear facility such as a reactor or fuel cycle facility Table 2 gives conversion factors for radiological equivalence to I that should be used The actual activity of the isotope released should be multiplied by the factor given in Table 2 and then compared with the values given in the definition of each level If several isotopes are released the equivalent value for each should be calculated and then summed see examples 5 7 The derivation of these factors is explai
146. ive actions required will be reliably carried out Ventilation systems that encourage airborne activity to move through the facility in a safe and controlled manner Shield doors and interlock entry systems Natural ventilation stack effect or passive cooling ventilation Actions instructions or routines that have been developed to mitigate consequences Provision of a diverse system provided there are not common aspects in supply or control systems Provision of redundancy provided there is not a non redundant support system Inerting gas systems as a means of mitigating the evolution of hydrogen in some radioactive waste storage facilities 6 2 2 2 Confinement In some situations confinement will itself provide one or more safety layers but it must be used with care As explained in Section 6 2 1 the rating process requires the maximum potential consequences to be placed into one of three categories Levels 5 7 Levels 3 4 and Levels 1 2 If following failure of the other safety provisions successful operation of the confinement system reduces the maximum potential consequences into a lower category of 108 maximum potential consequences then it should be considered as a safety layer On the other hand if the effect of containment is not sufficient to change the category of maximum potential consequences then it should not be counted as an additional safety layer For example a small resea
147. ive sources 44 D values do not apply specifically to irradiated nuclear fuel However events involving the transport of irradiated nuclear fuel should be assessed using the guidance in Section 4 2 2 for Category 1 sources As stated earlier rating of events at accelerators uses the guidance in Section 6 For other machine sources the guidance in this section is relevant However there is no simple method for categorizing machine sources based on their size etc Therefore it is necessary to use the general principles of INES For machines where no event can result in any deterministic effects even when all the safety provisions fail the events should be rated using the guidance in Section 4 2 2 for Category 4 sources For machines where deterministic effects could occur if all the safety provisions fail events should be rated using the guidance in Section 4 2 2 for Category 2 and 3 sources Category 5 sources are not included in Table 5 nor are they considered in the rating tables of section 4 2 2 The AEA s Categorization of Radioactive Sources 1 explains that Category 5 sources cannot cause permanent injury to people Thus events involving the failure of safety provisions for such sources need only be rated at Below scale Level 0 or Level 1 under defence in depth Some simple guidance on whether Below scale Level 0 or 1 is appropriate is given in the introduction to Section 4 2 2 Where an event involves a number of sources or a numb
148. ken from the Basic Safety Standards 14 and the IAEA Safety Glossary 16 In many cases more detailed explanation is provided within the manual absorbed dose The fundamental dosimetric quantity D defined as D de dm where deis the mean energy imparted by ionizing radiation to matter in a volume element and dm is the mass of matter in the volume element The SI unit of absorbed dose is the joule per kilogram J kg termed the gray Gy 14 accident In the context of the reporting and analysis of events an accident is an event that has led to significant consequences to people the environment or the facility Examples include lethal effects to individuals large radio activity release to the environment reactor core melt For communicating the significance of events to the public INES rates events at one of seven levels and uses the term accident to describe events at Level 4 or above Events of lesser significance are termed incidents Note In safety analyses and the IAEA safety standards the term accident has been used much more generally to mean Any unintended event including operating errors equipment failures or other mishaps the consequences or potential consequences of which are not negligible from the point of view of protection or safety 14 Thus events that would be considered accidents according to the safety standards definition may be accidents or incidents in public communication and INE
149. l 1 5 2 Additional factors The fault was caused by human error but it is not considered appropriate to increase the rating of the event due to safety culture issues Section 5 1 4 explains that the choice of Level 1 rather than zero for the basic rating already took account of the fact that OL amp C had been violated Final rating Level 1 Example 30 Primary system water leak through a rupture disc of the pressurizer discharge tank Level 1 Event description The unit had been brought to hot shutdown The residual heat removal RHR system had been isolated and partially drained for system tests after modification work and was therefore not available 87 The periodic test of pressurizer spray system efficiency was under way and the reactor coolant system was at a pressure of 159 bars At about 16 00 the pressurizer relief tank high pressure alarm was actuated The level in the volume control tank fell indicating leakage of reactor coolant at an estimated rate of 1 5 m per hour A worker went into the reactor building in an attempt to discover where the leak was located and concluded that it was coming from the stem of a valve on the reactor coolant system from a manual valve located on the temperature sensor bypass line The worker checked that the valve was leaktight by placing it in its back seat position by means of the handwheel in fact the valve was still not correctly seated The leakage continued and maintenanc
150. l assembly from its cell during refuelling spontaneous pull out of the refuelling machine telescopic beam occurred and a fresh fuel assembly slumped onto the central tube of the refuelling machine flask Interlocks operated as designed and no fuel damage or depressurization occurred 89 Rating explanation Criteria Explanation 2 and 3 Actual consequences There were no actual consequences from the event 5 1 1 Initiator frequency Although the event only involved unirradiated fuel it could have occurred with irradiated fuel Dropping a single fuel assembly is identified as a possible initiator 5 1 2 Safety function The provided safety systems were fully available operability 5 1 3 and 5 1 4 Basic rating There was a real initiator From Section 5 1 3 box A 2 of Table 9 is appropriate giving a basic rating of Level 1 Application of the guidance in section 6 3 8 would give the same rating 5 2 Additional factors There are no reasons for uprating Final rating Level 1 Example 32 Incorrect calibration of regional overpower detectors Level 1 Event description During a routine calibration of the regional overpower detectors for shutdown systems 1 and 2 an incorrect calibration factor was applied The calibration factor used was for 96 power although the reactor was at 100 power This error in calibration was discovered approximately six hours later at which time all detectors were recalibrate
151. l is exposed the number of people falling into each of the defined levels in Section 2 3 1 should be assessed and in each case the guidance given in the following paragraphs should be used to increase the rating as necessary For exposures that do not cause or are unlikely to cause a deterministic effect the minimum rating assessed in Section 2 3 1 should be increased by one level if doses above the value defined for the level are received by 10 or more individuals and by two levels if the doses are received by 100 or more individuals For exposures that have caused or are likely to cause deterministic effects a more conservative approach is taken and the rating should be increased by one level if doses above the value defined for the level are received by several individuals and by two levels if the doses are received by a few tens of individuals A summary table of the criteria in this section and the preceding section is presented in Section 2 3 4 Where a number of individuals are exposed at differing levels the event rating is the highest of the values derived from the process described For example for an event resulting in 15 members of the public receiving an effective dose of 20 mSv the minimum rating applicable to that dose is Level 2 Taking into consideration the number of individuals exposed 15 leads to an increase of one level giving a rating at Level 3 However if only one member of the public received an effective dose
152. l recycling trade As a consequence it is increasingly common for metal dealers and steel smelters to check for such sources in incoming consignments of scrap metals The most appropriate rating for such events is determined by using the found orphan source row of Table 6 If the source has been melted the higher rating should be used If the source is discovered prior to melting the rating should depend on whether any safety provisions remain as explained in footnote 1 For events associated with contaminated metal it may not be practical to identify the category of the source based on the guidance in Section 4 2 1 In these cases the dose rate should be measured and the doses to people in the area estimated The rating should then be based on these potential doses 4 2 2 3 Events involving degradation of safety provisions Table 7 should be used for those events where the radiation source device or transport package is where it is expected to be but there has been a degradation of safety provisions These include a range of hardware provisions such as the transport packaging or source housing other shielding or containment systems interlocks or other safety warning devices They also include administrative controls such as labelling of transport packages transport documentation working and emergency procedures radiological monitoring and use of personal alarm dosimeters Facilities such as irradiators using a Category 1 source te
153. lanation Criteria Explanation 2 and 3 Actual consequences There were no actual consequences from the event 5 1 1 Initiator frequency Following section 5 1 5 if the defect had led to failure of the component a large loss of coolant accident LOCA unlikely initiator would have occurred 5 1 2 Safety function The safety function operability for this postulated operability initiator was full 5 1 3 and 5 1 4 Basic rating Following the methodology for structural defects leads to using Section 5 1 3 Box A 3 of Table 9 gives an upper value to the basic rating of 2 As only a leak occurred no actual failure of the pipework the rating should be reduced by one level 5 2 Additional factors As the defects could have led to common mode failure of all safety injection lines the rating was upgraded to Level 2 Final rating Level 2 Example 38 Partial blockage of the water intake during cold weather Level 3 Event description This event affected both units at the station but to simplify the explanation only the impact on Unit 2 is considered here On site electrical supplies could be provided either by the other unit or by four auxiliary turbine generator sets The source of the event was the cold weather prevailing in the area at the time Ice flows blocked the water intake while the low temperatures contributed to the tripping of the conventional unit followed by a voltage reduction on the transmission g
154. lated to the maximum potential consequences of events However this aspect does not need to be considered here as the inventory of a power reactor is such that should all the safety provisions fail an accident with a rating of Level 5 or above is possible The maximum level under defence in depth is therefore Level 3 This section of the manual is divided into three main sections The first gives the guidance for assessing the basic rating for events occurring while the reactor is at power known as the initiator approach The second section Section 5 2 gives the guidance associated with uprating events Section 5 3 provides a number of worked examples 5 1 IDENTIFICATION OF BASIC RATING TAKING ACCOUNT OF THE EFFECTIVENESS OF SAFETY PROVISIONS Because the safety analysis for reactor installations during power operation follows a common international practice it is possible to give fairly specific guidance about how to assess the safety provisions for events involving reactors at power The approach is based on consideration of initiators safety functions and safety systems These terms will be familiar to those involved in safety analysis but further explanation of the terms is provided below An initiator or initiating event is an identified event that leads to a deviation from the normal operating state and challenges one or more safety functions Initiators are used in safety analysis to evaluate the adequacy of installed s
155. ld be much lower than expected The severity of an event affecting a component that identifies a potential common cause failure affecting other similar components is therefore higher than an event involving the random failure of the component 113 Events in which there is a difficulty in operating some systems that is caused by absent or misleading information can also be considered for uprating on the basis of a common cause failure 6 2 4 2 Procedural inadequacies The simultaneous challenge to several layers of the defence in depth may arise because of inadequate procedures Such inadequacies in procedures are therefore also a possible reason for increasing the basic rating 6 2 4 3 Events with implications for safety culture Safety culture has been defined as that assembly of characteristics and attitudes in organizations and individuals which establishes that as an overriding priority protection and safety issues receive the attention warranted by their significance A good safety culture helps to prevent incidents but on the other hand a lack of safety culture could result in operating personnel performing in ways not in accordance with the assumptions of the design Safety culture has therefore to be considered as part of the defence in depth and consequently safety culture issues could justify upgrading the rating of an event by one level INSAG 4 7 provides further information on safety culture To merit increasing
156. lear Regulatory Authority Armenia 203 Metke E Morishita Y Mottl V Muller A Nemec T Nhi Dien N Nyisztor D Oliveira Martins J Palsson S E Perez S Pollard D Popov B Rahman M Ramirez R Rashad S Ragheb H Rastkhah N Sharipov M Silva W A P 204 Nuclear Regulatory Authority of the Slovak Republic Slovakia Nuclear and Industrial Safety Agency Japan Australian Radiation Protection and Nuclear Safety Agency Australia National Nuclear Regulator South Africa Slovenian Nuclear Safety Administration Slovenia Nuclear Research Institute Vietnam Hungarian Atomic Energy Authority Hungary Ag ncia Portuguesa do Ambiente Portugal Icelandic Radiation Protection Institute Iceland Autoridad Regulatoria Nuclear Argentina Radiological Protection Institute of Ireland Ireland Institute of Energy Problems of the Academy of Sciences of Belarus Belarus Bangladesh Atomic Energy Commission Bangladesh Instituto Peruano de Energia Nuclear Peru Atomic Energy Authority Egypt Canadian Nuclear Safety Commission Canada Atomic Energy Organization of Iran Islamic Republic of Iran Kazakhstan Atomic Energy Committee Kazakhstan Atomic Energy Authority Sri Lanka Skarzewski M Suman H Suyama K Thielen G Valcic I van Iddekinge F Vinhas L Vlahov N Wild V Yousef S Zhang F Zhuk Y State Inspectorate for Radiation a
157. letherapy units or linear accelerators are likely to 48 TABLE 6 EVENT RATING FOR LOST OR FOUND RADIOACTIVE SOURCES DEVICES OR TRANSPORT PACKAGES Type of events Event rating depending on the source category Cat 4 Cat 3 or Cat 2 Cat 1 Missing radioactive source device 1 or transport package subsequently recovered intact within an area under control Found source device including 1 orphan sources and devices or transport package Lost or stolen radioactive source 1 device or transport package not yet recovered Lost or stolen radioactive source 1 device or transport package subsequently located with confirmation that no unplanned exposures occurred but where a decision has been made and approved not to recover the source as it is in a safe or inaccessible location e g underwater Misdelivered transport package Oorl but receiving facility has all the radiation safety procedures required to handle the package Misdelivered transport package 1 but receiving facility does not have all the radiation safety procedures required to handle the package a 1 lor2 Footnote a lor2 Footnote b 1 2or3 Footnote a 2or3 Footnote b The lowest proposed rating is more appropriate where it is clear that some safety provisions have remained effective e g a combination of shielding locking devices and warning signs procedures The lower rating may be more
158. llage of significant quantities of radioactive material resulting from failures of radio logical barriers thereby threatening the safety of people and the environment Those events rated using these two areas people and environment and radio logical barriers and controls are described in this manual as events with actual consequences Reduction in defence in depth principally covers those events with no actual consequences but where the measures put in place to prevent or cope with accidents did not operate as intended Level 1 covers only degradation of defence in depth Levels 2 and 3 cover more serious degradations of defence in depth or lower levels of actual consequence to people or facilities Levels 4 to 7 cover increasing levels of actual consequence to people the environment or facilities 1 For example a release from a facility likely to result in some protective action or several deaths resulting from an abandoned large radioactive source 0 JaAa7T A e9S MOjag eaueDyIUBIs Ajajes ON J jpuey 0 aoe u sainpadoid UOHeIpes ayenbape jNoyyM soinos pajees aayoeoipes A YyBiy paleAljapsi 901nOs p je s aAqoeoipes jysiy u 0 S 10 S07 Bululewias suorsjaosd Ajayes ou y m ued s mod Jegjonu e ye Juapiooe Je N ainsodxa diiqnd jueoyiuBbis Jo Ayiqeqoid moj e UyM usap Aq peyoadxe jou vale ue Ul UOeUIWe UOD aleneg eae Bunesado ue ul JU AS UeU ao Jo syed ainsodxg uoneipel wou suin
159. lmost simultaneously unsuccessful house load operation causing rod drop and reactor scram as well as loss of off site power tripping of line circuit breakers At this time only two of the four auxiliary turbine generators had been brought back into service Consequently only two of the four turboblowers remained in operation to provide core cooling The power lines linking Unit 2 to the grid were restored after 10 and 26 minutes so that the other turboblowers were brought back into service 99 Rating explanation Criteria Explanation 2 and 3 Actual consequences There were no actual consequences from the event 5 1 1 Initiator frequency This is a complex set of events but the event being rated is the operation of Unit 2 without any on site essential electrical supplies due to the loss of cooling water following ice formation There was no initiator but the initiator that would challenge on site electrical supplies is loss of off site power expected 5 1 2 Safety function The safety function cooling of the fuel was degraded operability The operability of the safety function was inadequate as there were no on site electrical supplies 5 1 3 and 5 1 4 Basic rating There was no real initiator From section 5 1 4 box D 1 of Table 10 is appropriate giving a basic rating of Level 3 5 2 Additional factors Although the time of unavailability was short 1 h the likelihood of loss of off site power was high
160. lost or stolen in accordance with national requirements The loss of a radioactive source device or transport package should be rated in terms of degradation of defence in depth If the radioactive source device or transport package is subsequently found the earlier loss and subsequent discovery of the source should be considered as a single event The original rating should be reviewed and the event could be re rated up or 47 down on the basis of any extra information available Relevant information to be considered should include The location in which the source device or transport package was found and how it got there The condition of the source device or transport package The length of time the source device or transport package was lost The number of persons exposed and possible doses The revised rating should cover both the original defence in depth rating and the actual consequences In most cases it will be necessary to estimate or calculate the doses that have been received using realistic assumptions rather than worst case scenarios A found radioactive source and a found device are considered together in Table 6 The former is intended to describe an unshielded source A found device on the other hand is intended to describe the discovery of an orphan source still within an intact shielded container There have been many examples of lost or found orphan sources being transferred into the meta
161. lting from the previous guidance The main additional factors that act in such a way are Common cause failures Procedural inadequacies Safety culture issues Because of such factors it is possible that an event could be rated at Level 1 even though it is of no safety significance on its own without taking into account these additional factors When assessing the increase of the basic rating due to these factors the following aspects require consideration 1 Allowing for all additional factors the rating of an event can only be increased by one level 2 Some of the above factors may have already been included in the basic rating e g common mode failure It is therefore important to take care that such failures are not double counted 3 The event should not be increased above the upper limit derived in accordance with Section 6 2 1 and this upper limit should only be applied to those situations where had one other event happened either an event expected within the plant lifetime or a further component failure an accident would have occurred 6 2 4 1 Common cause failures A common cause failure is the failure of a number of devices or components to perform their functions as a result of a single specific event or cause In particular it can cause the failure of redundant components or devices intended to perform the same safety function This may imply that the reliability of the whole safety function cou
162. ly again such an event would be rated at Below Scale Level 0 However if during operation at power it was discovered that all diesels had been unavailable for a month then even though off site power had been available and the diesels were not required to operate an accident was relatively likely as the chance of losing off site power was relatively high such an event would probably be rated at Level 3 provided there were no other safety provisions The rating procedure therefore considers whether the safety functions were required to work i e had an initiator occurred what was the assumed likelihood of the initiator and what was the operability of the relevant safety functions The basic approach to rating events is to identify the frequency of the relevant initiators and the operability of the affected safety functions Two tables are then used to identify the appropriate basic rating see Sections 5 1 3 and 5 1 4 Detailed guidance on each aspect of rating is given below 5 1 1 Identification of initiator frequency Four different frequency categories have been defined 1 Expected This covers initiators expected to occur once or several times during the operating life of the plant i e gt 10 per year 2 Possible These are initiators that are not expected but have an anticipated frequency f during the plant lifetime of greater than about 1 i e 104 lt f lt 107 per year 3 Unlikely These are initiators cons
163. matically or manually initiated safety systems or administrative controls that are provided to ensure that the required safety functions are achieved 16 A safety layer is to be considered as a safety provision that cannot be broken down into redundant parts See Section 6 2 2 for a detailed definition of how the term is used in this particular document safety provisions Safety provisions can be either procedures administrative controls or passive or active systems which are usually provided in a redundant way with their availability controlled by Operational Limits and Conditions safety systems Systems important to safety that are provided to ensure the safety functions source Anything that may cause radiation exposure such as by emitting ionizing radiation or by releasing radioactive substances or materials and can be treated as a single entity for protection and safety purposes 16 For example materials emitting radon are sources in the environment a sterilization gamma irradiation unit is a source for the practice of radiation preservation of food an X ray unit may be a source for the practice of radiodiagnosis a nuclear power plant is part of the practice of generating electricity by nuclear fission and may be regarded as a source e g with respect to discharges to the environment or as a collection of sources e g for occupational radiation protection purposes stochastic effect A radiation induced health eff
164. mum potential The maximum potential consequences for an event consequences associated with a worker dose are rated at Level 4 6 2 2 Identification of number The basic rating is Below Scale Level 0 as there was no of safety layers degradation of the safety layers provided to prevent significant doses to workers 6 2 3 Assessment of the basic Based on Table 11 the rating is Below Scale Level 0 rating 6 2 4 Additional factors Since the annual limit of the cumulative whole body dose was exceeded the event should be rated at Level 1 Section 6 2 4 3 Overall rating Level 1 Example 51 Failure of criticality control Level 1 Event description A routine check of compliance with the operating rules in a fuel fabrication facility showed that six samples of fuel pellets had been incorrectly packaged In addition to the permitted packaging each sample had been placed in a plastic container The additional plastic container contained the requirement that no hydrogenous material in addition to the permitted wrapping had to be 135 introduced to the store However this requirement was not clearly specified for this fuel store Subsequent investigation showed that the criticality clearance certificate was difficult to interpret and the related criticality assessment was inadequate to allow full understanding of the safety requirements Rating explanation Criteria 2 and 3 Actual consequences 6 2 1 Maximum pot
165. mum under defence in depth is Level 2 Considering the cooling function by design there are three safety layers One is the heat exchanger system another is the large volume of water in the pool and the third is the ability to cool the fuel in air The suction side has been deliberately designed so as to ensure a large volume of water remains in the pool should the pipe fail Furthermore it is clear that the main safety layer is the volume of water This can therefore be considered as a high integrity safety layer for the following reasons The heat input is small compared to the volume of the water such that any temperature rise will be extremely slow It should take many days for the water level to decrease significantly Any reduction in water level would be readily detected by the operating personnel and the water level could be simply topped up via a number of routes The safety justification for the facility recognizes this as the key safety layer and demonstrates its integrity The suction pipe to the heat exchanger was carefully designed to ensure that adequate water remained The basic rating is considered to be zero because there are two safety layers remaining and one is of high integrity Considering the shielding safety function there is only one safety layer remaining but it is of high integrity as the level of water remaining at the bottom of the suction pipe provides adequate shielding There are no reas
166. n remains within the safety requirements of the reactor They may also include operation with reduced safety system availability for a limited time In most countries the OL amp C are included within the Technical Specifications Furthermore in the event that the OL amp C are not met the Technical Specifica tions describe the actions to be taken including times allowed for recovery as well as the appropriate fallback state If the system availability is discovered to be less than that defined for Category B e g following a routine test but the reactor is taken to a safe state in accordance with the Technical Specifications the event should be rated as described in Sections 5 1 3 and 5 1 4 but the basic rating should not be increased as the requirements of the Technical Specifications have been followed If the safety function operability is within that defined for Category B but the operating personnel stay more than the allowed time as defined in the Technical Specification in that availability state the basic rating is Level 0 but the rating should be increased to Level 1 because of safety culture issues Equally if operating personnel take deliberate action that leads to plant availability being outside OL amp C consideration should be given to increasing the basic rating of the event because of safety culture issues In addition to the formal OL amp C some countries introduce into their Technical Specifications further requirement
167. n the operability of each safety system In most countries they are included within a plant s Technical Specifications 72 The operability of a safety function for a particular initiator can range from a state where all the components of the safety systems provided to fulfil that function are fully operable to a state where the operability is insufficient for the safety function to be achieved To provide a framework for rating events four categories of operability are considered A Full This is when all the safety systems and components that are provided by the design to cope with the particular initiator in order to limit its conse quences are fully operable i e redundancy diversity is available B Minimum required by operational limits and conditions This is when the operability of each of the safety systems required to provide the safety function meets the minimum level for which operation at power can be continued possibly for a limited time as specified in the Operational Limits and Conditions This level of operability will generally correspond to the minimum operability of the different safety systems for which the safety function can be achieved for all the initiators considered in the design of the plant However for certain particular initiators redundancy and diversity may still exist C Adequate This is when the operability of at least one of the safety systems required to provide the safety function is suf
168. n the basic rating Level 2 142 Possible worker doses Criteria Explanation 2 and 3 Actual consequences There were no actual consequences from the event 6 2 1 Maximum potential The maximum potential consequence would be rated at consequences Level 4 fatal radiation exposure 6 2 2 Identification of number There were no remaining safety layers to protect of safety layers against a criticality 6 2 3 Assessment of the basic Based on Table 11 the rating is Level 2 rating 6 2 4 Additional factors The rating cannot be uprated beyond the maximum defence in depth rating Overall rating Level 2 143 7 RATING PROCEDURE The flowcharts provided in the following pages Figs 4 10 briefly describe INES rating procedure for rating any event associated with radiation sources and the transport storage and use of radioactive material The flow charts are intended to show the logical route to be followed to assess the safety significance of any event It provides an overview for those new to rating events and a summary of the procedure to those familiar with the INES User s Manual Explanatory notes and tables are added to the flowcharts as needed however the flowcharts should not be used in isolation from the detailed guidance provided in this manual The IAEA has also developed a web tool based on the flow charts to support training on the use of INES rating methodology In addition to the flowcharts two
169. nal exposure pathways or extends exposure to additional people or modifies the network of exposure pathways from existing sources so as to increase the exposure or the likelihood of exposure of people or the number of people exposed 14 Note Terms such as authorized practice controlled practice and regulated practice are used to distinguish those practices that are subject to regulatory control from other activities that meet the definition of practice but do not need or are not amenable to control radiation generator Device capable of generating radiation such as X rays neutrons electrons or other charged particles which may be used for scientific industrial or medical purposes 14 189 radiation source A radiation generator or a radioactive source or other radioactive material outside the nuclear fuel cycles of research and power reactors 16 radioactive material Material designated in national law or by a regulatory body as being subject to regulatory control because of its radioactivity radioactive source Radioactive material that is permanently sealed in a capsule or closely bonded and in a solid form and which is not exempt from regulatory control It also includes any radioactive material released if the radioactive source is leaking or broken but does not include material encapsulated for disposal or nuclear material within the nuclear fuel cycles of research and power reactors 19 radiolog
170. nd Nuclear Safety Poland Atomic Energy Commission Syrian Arab Republic Ministry of Education Culture Sports Science and Technology Japan Gesellschaft fiir Anlagen und Reaktorsicherheit Germany State Office for Nuclear Safety Croatia Ministry for Housing Spatial Planning and Environment Netherlands Commissao Nacional de Energia Nuclear Brazil Nuclear Regulatory Agency Bulgaria Gesellschaft fiir Anlagen und Reaktorsicherheit Germany Ministry of Health Kuwait China Atomic Energy Authority China All Russian Research Institute for Nuclear Power Plant Operation Russian Federation INTERNATIONAL ORGANIZATIONS O Donovan M Tallebois C Welsh G European Atomic Forum European Atomic Forum World Association of Nuclear Operators 205 IAEA REVIEWERS Baciu F Buglova E Czarwinski R Dodd B IA EA consultant Eklund M Friedrich V Mc Kenna T Spiegelberg Planer R Wangler M Wheatley J Technical Committee Meetings Vienna Austria 1 4 July 2008 Consultants Meetings Cape Town South Africa 9 13 October 2006 Vienna Austria 4 8 June 2007 10 21 September 2007 18 22 February 2008 Meetings of the INES Advisory Committee Vienna Austria 19 23 March 2007 17 20 March 2008 206 09 14041 INES the International Nuclear and Radiological Event Scale was developed in 1990 by experts convened by the IAEA and the OECD Nuclear Energy Agency with the aim o
171. nd deposition of radionuclides integrated over 50 years including consideration of resuspension weathering and ground roughness 15 Ground deposition is related to airborne concentration using deposition velocities V of 10 m s for elemental iodine and 1 5 x 10 m s for other materials The integrated dose over 50 years from unit ground deposition of each radionuclide is used Dna Sv per Bq m 154 Ingestion doses are not included in this calculation as the food inter vention levels will prevent any significant doses to individuals affected by the accident The total dose D resulting from an activity release Q and time integrated ground level airborne radionuclide concentration of X Bq s m per Bq released is Diot Q X Dinbreathing rate V yD pna For each radionuclide the relative radiological equivalence to I was calculated as the ratios of D Q X Facility contamination considers only the inhalation pathway and the inhalation coefficients are for workers 13 BASIC DATA The inhalation coefficients for the calculations were taken from the BSS 14 apart from U which is not listed in that document Values for Uat were calculated by summing the contributions from U U U and their main decay products using the ratios U 48 9 U 2 2 and SU 48 9 Where a radionuclide has a number of lung absorption rates the maximum value of the inhalation coefficient was used except for u
172. ne effective safety layer i e an operating procedure requiring pressure reduction and re opening of the isolation valve 6 2 3 Assessment of the basic Based on Table 11 Level 3 is appropriate rating Overall rating Level 3 6 4 2 Events at facilities other than power reactors Example 47 Pressurization of the void above the liquid level in a fuel element dissolver vessel Below Scale Level 0 Event description The detection of a small pressurization of the space above the liquid level in a reprocessing facility dissolver resulted in the automatic shutting down of the process The dissolver heating system was switched off and cooling water 130 applied The nitric acid feed to the vessel was stopped and the dissolution reaction suppressed by the addition of water to the vessel contents No release of airborne contamination to the plant operating area or the environment occurred Subsequent investigations indicated that the pressurization was due to an abnormal release of vapour and an increased rate of nitrous vapour production as a result of a short term enhanced rate of dissolution of the fuel Rating explanation Criteria Explanation 2 and 3 Actual consequences There were no actual consequences from the event 6 2 1 Maximum potential The maximum potential consequences for an event consequences associated with a reprocessing facility areLevels 5 7 6 2 2 Identification of number Because of the deviat
173. ned in Appendix I If the release occurs during the transport of radioactive material or from the use of radiation sources D values should be used The D values are a level of activity above which a source is considered to be dangerous and has a significant potential to cause severe deterministic effects if not managed safely and securely The D value is the activity of a radionuclide in a source that if uncontrolled and dispersed might result in an emergency that could reasonably be expected to cause severe deterministic health effects 5 Appendix III lists D values for a range of isotopes 15 TABLE 2 RADIOLOGICAL EQUIVALENCE TO I FOR RELEASES TO THE ATMOSPHERE Isotope Multiplication factor Am 241 8 000 Co 60 50 Cs 134 3 Cs 137 40 H 3 0 02 1 131 1 Ir 192 2 Mn 54 4 Mo 99 0 08 P 32 0 2 Pu 239 10 000 Ru 106 6 S1 90 20 Te 132 0 3 U 235 S 1 000 U 235 M 600 U 235 F 500 U 238 S 900 U 238 M 600 U 238 F 400 U nat 1 000 Noble gases Negligible effectively 0 Lung absorption types S slow M medium F fast If unsure use the most conservative value For events involving releases that do not become airborne e g aquatic releases or ground contamination due to spillage of radioactive material the rating based on dose should be established using Section 2 3 Liquid discharges resulting in doses significantly higher than that appropriate for Level 3 would need to be rated at Lev
174. needed to cover not only actual consequences but also the potential consequences of events A set of criteria was developed to cover what has become known as degradation of defence in depth These criteria recognize that all applications involving the transport storage and use of radioactive material and radiation sources incorporate a number of safety provisions The number and reliability of these provisions depends on their design and the magnitude of the hazard Events may occur where some of these safety provisions fail but others prevent any actual consequences In order to communicate the significance of such events criteria are defined which depend on the amount of radioactive material and the severity of the failure of the safety provisions Since these events only involve an increased likelihood of an accident with no actual consequences the maximum rating for such events is set at Level3 i e a serious incident Furthermore this maximum level is only applied to practices where there is the potential if all safety provisions failed for a significant accident i e one rated at Levels 5 6 or 7 in INES For events associated with practices that have a much smaller hazard potential e g transport of small medical or industrial radioactive sources the maximum rating under defence in depth is correspondingly lower One final issue that is addressed under defence in depth is what is described in this document as additional fact
175. ng the sampling operation and advise accordingly This was not required since the operating personnel were already evacuating Each of these required the operating personnel to respond appropriately to the alarm or verbal advice It was confirmed that the operating personnel were regularly trained and had no experience of poor response There was more than one person and an additional radiation protection technician and in view of the specific nature of the activity and the training and briefing required it is judged that they can be considered as at least three independent safety layers The likelihood of all the individuals ignoring all the alarms is vanishingly small Using Table 11 there being three safety layers the basic rating is Level 1 There are no reasons to uprate the event Below Scale Level 0 134 Example 50 Worker received cumulative whole body dose above dose limit Level 1 Event description The whole body dose received by a facility manager from operations at the end of December was higher than authorized or expected but below the dose constraint As a result while the dose from those operations was low it made his cumulative whole body dose exceed the annual dose limit Rating explanation Criteria Explanation 2 and 3 Actual consequences The dose level from the actual event was below the value given in Section 2 for actual consequences i e less than the dose constraint 6 2 1 Maxi
176. ng this scale Similarly events affecting the availability of a turbine or generator if they did not affect the reactor at power would not be classified on the scale nor would fires if they did not involve any possible radiological hazard and did not affect any equipment associated with radiological or nuclear safety 1 4 PRINCIPLES OF INES CRITERIA Each event needs to be considered against each of the relevant areas described in Section 1 2 namely people and the environment radiological barriers and controls and defence in depth The event rating is then the highest level from consideration of each of the three areas The following sections briefly describe the principles associated with assessing the impact on each area 1 4 1 People and the environment The simplest approach to rating actual consequences to people would be to base the rating on the doses received However for accidents this may not be an appropriate measure to address the full range of consequences For example the efficient application of emergency arrangements for evacuation of members of the public may result in relatively small doses despite a significant accident at an installation To rate such an event purely on the doses received does not communicate the true significance of what happened at the installation nor does it take account of the potential widespread contami nation Thus for the accident levels of INES 4 7 criteria have been developed based
177. not challenge the safety functions and is therefore not an initiator The reactor trip is an initiator frequency category expected 5 1 2 Safety function The safety function cooling of the fuel was full operability 5 1 3 and 5 1 4 Basic rating There was a real initiator From Section 5 1 3 box A 1 of Table 9 is appropriate giving a basic rating of Below scale Level 0 5 2 Additional factors There are no reasons for uprating Overall rating Below Scale Level 0 Example 28 Reactor coolant leak during on power refuelling Level 1 Event description During routine refuelling at full power a heavy water reactor coolant leak of 1 4 t h developed in the fuelling vault Operating personnel determined that the east fuelling bridge had dropped 0 4 m The reactor was shut down and cooled Coolant pressure was maintained by transfer from other units and recovery from the sump Total leakage was 22 t approximately 10 of the inventory No safety system operation was required with the exception of containment box up on high activity after one hour There was no abnormal release of radioactivity to the environment The cause of the problem was failure of an interlock which was not checked by the surveillance programme 85 Rating explanation Criteria Explanation 2 and 3 Actual consequences There were no actual consequences from the event 5 1 1 Initiator frequency Although there was a very small reactor co
178. nt description An electrical fault in the 400 kV switchyard caused by errors during a test procedure resulted in the unit being disconnected from the grid The excitation of the generators caused an increase in the voltage level on the generator bus 93 bars to about 120 This overvoltage caused two out of four uninterruptible power supply UPS DC AC inverters to trip About 30 s later in the sequence when house load mode of operation on both turbo generators was lost the trip of the UPS DC AC inverters prevented connection of two out of four emergency diesel generators to the 500 V bus bars Approximately 20 min after the initial event the 500 V diesel bus bars in the affected divisions were manually connected to the 6 kV system supplied by the off site auxiliary power and all electrical systems were thereby operational The scram of the reactor was successful and all control rods were inserted as expected Two valves in the pressure relief system opened because of unwarranted initiation of safety trains The emergency core cooling system in two out of four trains was however more than sufficient to maintain the reactor level above the core as there was no additional LOCA The control room staff had difficulties in supervising the plant properly during the event as many indications and readings were lost due to the loss of power in the two trains that supplied much of the control room instrumen tation Subsequent investigations showed tha
179. nt for the purpose of rating an event under this criterion it is only the impact on defence in depth which has to be considered at these lower levels It is accepted that the exact nature of damage and or contamination may not be known for some time following an event with consequences of this nature However it should be possible to make a broad estimate in order to decide an appropriate provisional rating on the event rating form It is possible that subsequent re evaluation of the situation would necessitate re rating the event For all events the criteria related to people and the environment Section 2 and defence in depth Sections 4 5 and 6 must also be considered as they may give rise to a higher rating 3 2 DEFINITION OF LEVELS Level 5 For events involving reactor fuel including research reactors An event resulting in the melting of more than the equivalent of a few per cent of the fuel of a power reactor or the release of more than a few per cent of the core inventory of a power reactor from the fuel assemblies The definition is based on the total inventory of the core of a power reactor not just the free fission product gases the gap inventory Such an amount requires significant release from the fuel matrix as well as the gap inventory It should be noted that the rating based on fuel damage does not depend on the state of the primary circuit For research reactors the fraction of fuel affected s
180. ntaining ESF equipment installation of check valves in selected floor drain lines and installation of circuitry to trip the circulating water pumps on high water level in the turbine building basement Rating explanation In general design deficiencies identified during periodic safety reviews or life extension programmes would not be considered as individual events to be rated with INES However errors in analysis discovered during other work might well be reported as events This manual does not seek to define what events should be reported to the public rather to give guidance on how to rate events that are communicated to the public This event is included to show how such events can be rated Criteria Explanation 2 and 3 Actual consequences There were no actual consequences from the event 5 1 1 Initiator frequency There was no initiator The safety systems were required against the initiator of a major power conversion system pipe rupture an unlikely initiator 5 1 2 Safety function The safety function of post trip cooling was inadequate operability 5 1 3 and 5 1 4 Basic rating There was no real initiator From Section 5 1 4 box D 3 of Table 10 is appropriate giving a basic rating of Level 1 5 2 Additional factors There are no reasons for uprating Final rating Level 1 Example 35 Two emergency diesel generators did not start following disconnection from the main grid supplies Level 2 Eve
181. ntial initiator The operability of the associated safety function assured by the operability of particular safety systems It should be noted that one particular event could be categorized under both cases See Sections 5 1 3 and 5 1 4 as well as Example 35 To illustrate the above principles consider a reactor where the protection against loss of off site power is provided by four essential diesels In order for an accident to occur the event must challenge the safety of the reactor in this example loss of off site power LOOP and the protection must fail in this example all diesels fail to start The initial challenge to plant safety LOOP in the example is termed the initiator and the response of the diesels is defined by the Operability of the safety function post trip cooling in this example Thus for an accident to occur there needs to be an initiator and inadequate operability of a safety function The rating under defence in depth assesses how near the accident is to happening i e whether the initiator has occurred how likely it was and what the operability of the safety functions were In the previous example if off site power had been lost but all diesels started as intended an accident was unlikely such an event would be rated at Below Scale Level 0 Similarly if one diesel 70 had failed under a test but the others were available and off site supplies were available then an accident was unlike
182. nued circulating the water to the steam generators but no heat could be removed by the secondary side since there was no water in the steam generators Pressure rose in the reactor cooling system until the reactor shutdown A power operated relief valve opened in the line between the pressurizer and the quench tank but unknown to the operator this valve failed to reclose allowing steam to continue discharging to the quench tank Pressure dropped in the reactor cooling system The quench tank rupture disc opened and steam was released to the containment As coolant pressure dropped eventually water in 40 the upper most area of the reactor about 3 5 m above the fuel flashed to steam The operators turned off the emergency water injection pumps because they thought there was still water in the pressurizer The operators also turned off the reactor cooling pumps because they were concerned about damage due to potential excessive vibration This resulted in a steam void forming in the reactor coolant loop In addition a steam bubble formed in the upper part of the reactor above the fuel Eventually as the fuel heated this void expanded the fuel cladding material overheated and more than 10 of the fuel melted The containment system remained intact Water was eventually added to the reactor cooling system and cooling of the reactor was assured Studies indicated that the release from the site was small and the maximum potential offsite
183. o be Cs and based consequences on the dose rates and activity measurements the third source appeared to be the same as the smaller of the two identified sources The D value for Cs is 1 x 10 TBq and the total source activity was 11 1 GBq resulting in an A D ratio of 0 01 lt A D lt 1 Therefore it was a Category 4 source 4 2 2 Effectiveness of safety The event was the discovery of three orphan sources provisions From the second row of Table 6 Level 1 is appropriate Overall rating Level 1 59 Example 19 Loss of a density gauge Level 1 Event description A moisture density gauge was lost and presumed stolen from a truck at a construction site The gauge contained a Cs source 0 47 GBq and an Am 241 Be neutron source 1 6 GBq It was reported to the national authorities a press release was issued and an investigation of the surrounding areas was undertaken The gauge was recovered a few days later with no signs of damage Rating explanation Criteria Explanation 2 3 Doses to individuals There were no doses from the event 4 2 1 Maximum potential It is necessary to calculate the aggregate A D value as consequences explained in Appendix II The D value for Cs is 0 1 TBq compared to a source activity of 0 47 GBq and the D value for Am Be is 0 06 TBq compared to a source activity of 1 6 GBq giving an aggregate A D of 0 47 100 1 6 60 0 031 Thus the aggregate A D ratio is between 0 01 and 1 and
184. o skin doses to extremities and doses to lens of the eye effective dose A measure of dose designed to reflect the amount of radiation detriment likely to result from the dose Values of effective dose from any type s of radiation and mode s of exposure can be compared directly It is defined as the summation of the tissue equivalent doses each multiplied by the appropriate tissue weighting factor E wrH T 185 where His the equivalent dose in tissue T and wy is the tissue weighting factor for tissue T From the definition of equivalent dose it follows that E yor WeDre T R where wp is the radiation weighting factor for radiation R and Dy pis the average absorbed dose in the organ or tissue T 14 The unit of effective dose is the sievert Sv equal to 1 J kg The rem equal to 0 01 Sv is sometimes used as a unit of equivalent dose and effective dose equivalent dose A measure of the dose to a tissue or organ designed to reflect the amount of harm caused Values of equivalent dose to a specified tissue from any type s of radiation can be compared directly It is defined as the quantity Hrg where AyR WrDrpR where Dyp is the absorbed dose delivered by radiation type R averaged over a tissue or organ T and we is the radiation weighting factor for radiation type R When the radiation field is composed of different radiation types with different values of Wp the equivalent dose is Ay weDrp R The unit of
185. of radioactive material The radionuclides involved in the events The practice for which the source was used and its IAEA Category 1 The condition of the source and associated device and if it is lost any information that will be helpful in identifying the source or device such as the registration serial number s 1 6 2 International communications As explained in Section 1 5 the IAEA maintains a system to facilitate international communication of events It is important to recognize that this service is not a formal reporting system and the system operates on a voluntary basis Its purpose is to facilitate communication and understanding between the technical community industry and regulators the media and the public on the safety significance of events that have attracted or are likely to attract interna tional media interest There are also benefits in using the system to communicate transboundary transport events Many countries have agreed to participate in the INES system because they clearly recognize the importance of open communication of events in a way that clearly explains their significance All countries are strongly encouraged to communicate events interna tionally within 24 hours if possible according to the agreed criteria which are Events rated at Level 2 and above or Events attracting international public interest It is recognized that there will be occasions when a longer time sc
186. of 20 mSv and 14 received effective doses between one and 10 mSv the rating based on those receiving an effective dose of 20 mSv would be Level 2 minimum rating not increased as only one person affected and the rating based on those receiving an effective dose of more than one but less than 10 mSv would be Level 2 minimum rating of Level 1 increased by one as more than 10 people were exposed Thus the overall rating would be Level 2 8 As guidance to help with a consistent approach to the application of these criteria it may be considered that several is more than three and a few tens is more than 30 These values correspond to approximately half an order of magnitude on a logarithmic basis 20 2 3 3 Dose estimation methodology The methodology for estimation of doses to workers and the public should be realistic and follow the standard national assumptions for dose assessment The assessment should be based on the real scenario including any protective action taken If it cannot be known for certain whether particular individuals received a dose e g a transport package subsequently found to have inadequate shielding the probable doses should be estimated and the level on INES assigned based on a reconstruction of the likely scenario 2 3 4 Summary The guidance in Section 2 3 is summarized in Table 3 showing how the level of dose and the number of people exposed are taken into account TABLE 3 SUMMARY OF
187. olant leak there was no challenge to the safety functions because action by operating personnel maintained water inventory Thus there was no real initiator 5 1 2 Safety function Had the leak developed into a small loss of coolant operability accident LOCA all the required safety systems were fully available 5 1 3 and 5 1 4 Basic rating There was no real initiator From Section 5 1 4 row A of Table 10 is appropriate giving a basic rating of 0 Using the guidance in section 5 1 5 had the leak not been controlled it would have led to a small LOCA frequency possible From Box A 2 of Table 9 the rating of the potential event would have been Level 1 As the likelihood of operators failing to control the leak is low the rating should be reduced to Level 0 5 2 Additional factors The interlock was not checked by the surveillance programme Also this deficiency was known before the event For these reasons the event was uprated to Level 1 Final rating Level 1 Example 29 Containment spray not available due to valves being left in the closed position Level 1 Event description This two unit station has to shut down both its reactors annually in order to perform the required tests on the common emergency core cooling system ECCS and the related automatic safety actions These tests are usually performed when one of the two reactors is in cold shutdown for refuelling On 9 October Units 1 and 2 were subjecte
188. om notified the operating personnel of the valve closure and having reduced the pressure the valves were re opened Temperatures did not rise above the limits in Operational Limits and Conditions 1 Line of RHE 2 Line of RHR Procedure to reduce pressure and open valves FIG 1 Illustration of safety provisions for Example 41 123 Rating explanation Criteria Explanation 2 and 3 Actual consequences There were no actual consequences from the event 6 2 1 Maximum potential The maximum potential consequences for an event consequences associated with a shutdown power reactor are Levels 5 7 6 2 2 Identification of number There were four hardware layers and provided the of safety layers steam generators remained available there was plenty of time for the required actions sufficient even to allow repairs to the RHR system to be carried out As a result of the long timescales available the procedure to re open the valves can be regarded as more reliable than a single layer and all four layers can be considered as independent 6 2 3 Assessment of the basic Based on Table 11 the rating is Below scale Level 0 rating Overall rating Below Scale Level 0 Example 42 Loss of shutdown cooling due to spurious operation of pressure sensors Below Scale Level 0 Event description Shutdown cooling was being provided by circulation of coolant through a single residual heat removal RHR heat exchang
189. ome events do not of themselves result in an initiator or a degraded safety system operability but do correspond to an increased likelihood of such an event Examples are discovery of structural defects or a leak terminated by 79 operating personnel The general approach to rating these events is as follows First the significance of the potential event should be evaluated by assuming it had actually occurred and applying Section 5 1 3 or 5 1 4 based on the operability of safety provisions that existed at the time The choice of section depends on whether the potential event was an initiator or a degradation of a safety system Secondly the rating should be reduced depending on the likelihood that the potential event could have developed from the event that actually occurred The level to which the rating should be reduced must be based on judgement One of the most common examples of potential events is the discovery of structural defects The surveillance programme is intended to identify structural defects before their size becomes unacceptable If the defect is within this size then Below Scale Level 0 would be appropriate If the event is the discovery of a defect larger than expected under the surveillance programme rating of the event needs to take account of two factors Firstly the rating of the potential event should be determined by assuming that the defect had led to failure of the component and applying Section 5 1 3 or 5 1 4
190. on in areas not expected by design and requiring corrective action In this context significant quantity should be interpreted as a A spillage of liquid radioactive material radiologically equivalent to a spillage of the order of ten terabecquerels of Mo b A spillage of solid radioactive material radiologically equivalent to a spillage of the order of a terabecquerel of Cs if in addition the surface and airborne contamination levels exceed ten times those permitted for operating areas c A release of airborne radioactive material contained within a building and radiologically equivalent to a release of the order of a few tens of gigabecquerels of I 3 3 CALCULATION OF RADIOLOGICAL EQUIVALENCE Table 4 gives the isotope multiplication factors for the radiological equivalence of facility contamination The actual activity released should be multiplied by the factor given and then compared with the values given in the definition of each level for the isotope being used for comparison If several isotopes are released the equivalent value for each should be calculated and then summed The derivation of these factors is given in Appendix I 3 4 WORKED EXAMPLES The purpose of these examples is to illustrate the rating guidance contained in this section of the manual The examples are based on real events but have been modified slightly to illustrate the use of different parts of the guidance The final row of th
191. on sources ANC transport wee eeeeeeeseeeteeceneeeeeeeeneeeens Factors for facility contamination inhalation only Atmospheric release Dose from ground deposition and inhalation eeeeeseeeeseeceeeeeeeeeeeeeeeseeeeeeeees Radiological equivalences ccsssesceeeeseeeeseeeeceeeeseeeeeseeeeaees Likelihood of fatal deterministic effects TOM OVELERP OSULE isinara ero Haves sides dansusssuestesnesiessieseesbass Threshold levels of RBE weighted dose from external CXPOSULS eniin iao aa oan T EEE ERRES E Threshold levels of committed RBE weighted dose from internal CXPOSUTE siseste RBEs used for severe deterministic health effects D values for a range Of isotope Ssni D values for a range Of iSOtOPeS 0 eeeeeeeeeseeseteeeeeeeeeeeeneeeenees Categorization of COMMON practices eee 44 195 Example 1 Example 2 Example 3 Example 4 Example 5 Example 6 Example 7 Example 8 Example 9 Example 10 Example 11 Example 12 Example 13 Example 14 Example 15 Example 16 Example 17 Example 18 Example 19 Example 20 Example 21 Example 22 Example 23 Example 24 Example 25 Example 26 Example 27 LIST OF EXAMPLES Overexposure of an electrician at a hospital Level 2 Overexposure of a radiographer Level 2 Overexposure of an industrial radiographer Level 3 Break up of an abandoned highly active source Overheating of high level
192. on the quantity of radioactive material released rather than the dose received Clearly these criteria only apply to practices where there is the potential to disperse a significant quantity of radioactive material In order to allow for the wide range of radioactive material that could potentially be released the scale uses the concept of radiological equivalence Thus the quantity is defined in terms of terabecquerels of and conversion factors are defined to identify the equivalent level for other isotopes that would result in the same level of effective dose For events with a lower level of impact on people and the environment the rating is based on the doses received and the number of people exposed The criteria for releases were previously referred to as off site criteria 1 4 2 Radiological barriers and controls In major facilities with the potential however unlikely for a large release of activity where a site boundary is clearly defined as part of their licensing it is possible to have an event where there are significant failures in radiological barriers but no significant consequences for people and the environment e g reactor core melt with radioactive material kept within the containment It is also possible to have an event at such facilities where there is significant contamination spread or increased radiation but where there is still considerable defence in depth remaining that would prevent signifi
193. ons to uprate the event Below Scale Level 0 132 FIG 3 Diagram of cooling system for Example 48 Example 49 High radiation levels at a nuclear recycling facility Below Scale Level 0 Event description Operating personnel and a radiation protection technician were undertaking a sampling operation at a facility storing highly radioactive liquid Specific instructions and equipment were provided for the task and the individuals concerned had been suitably trained and briefed In order for the operation to proceed other personnel were excluded from a large clearly identified and barred area around the actual work area During the operation an equipment fault led to a small quantity of the highly radioactive liquid being directed to an unshielded pipe causing high levels of radiation in the surrounding areas All personnel were equipped with personal alarming dosimeters and when these alarmed together with several installed detection systems in the area the people immediately evacuated the area Subsequent assessment showed that the most exposed person was subjected to a dose rate of 350 mSv h and received an effective dose of 350 uSv 133 Rating explanation Criteria Explanation 2 and 3 Actual consequences 6 2 1 Maximum potential consequences 6 2 2 Identification of number of safety layers 6 2 3 Assessment of the basic rating 6 2 4 Additional factors Overall rating The sampling o
194. or Level 1 The D value for Cf is 0 02 TBq giving an A D ratio of lt 0 01 Thus the package contained Category 5 sources There was no degradation of safety provisions According to the introduction to Section 4 2 2 the rating is Below scale Level 0 Below Scale Level 0 Example 17 Stolen industrial radiography source Level 1 Event description An industrial radiography device containing a 4 TBq Ir source was reported as stolen to the national authorities A press release was issued and inves tigation of the surrounding areas was carried out Twenty four hours later the device was found in a ditch adjacent to a highway with no damage to the shielding and completely intact No individuals were believed to have been exposed Rating explanation Criteria 2 3 Doses to individuals 4 2 1 Maximum potential consequences 4 2 2 Effectiveness of safety provisions Overall rating Explanation There were no doses from the event or activity released The D value for Ir is 0 08 TBq so the A D ratio was 50 i e a Category 2 source The initial event is a lost or stolen Category 2 source which according to row three of Table 6 gives a rating of Level 2 When the device was found a review of the rating was possible Since the device was found with all the safety provisions remaining and no indication that they had been breached a final rating of Level 1 was appropriate based on row 2 of Table 6 Level
195. or tie downs Oor1 Oorl Oorl Tamper indicating devices ineffective Forme Footnotes ootnote C No safety provision remaining Event producing a significant potential for unplanned exposures or which produce a significant risk of spreading contamination into areas where controls are absent Typical events include Loss of shielding e g due to fire or 1 lor2 2 or 3 severe impact making direct Footnote d Footnote exposure to the source possible Failure of warning and safety devices 1 lor2 2 or 3 such that entry into areas of high dose KFoomote d Footnote rate is possible Failure to monitor radiation levels 1 1or2 2 or3 where no other safety provisions Somoe Fomore remain or all other safety provisions have failed e g to check that gamma sources are fully retracted after site radiography exposures Events where a source remains 1 1or2 2 or 3 Footnote d Footnote e accidentally exposed and there are no effective procedures in place to cope with the situation or where such procedures are ignored 52 TABLE 7 EVENT RATING FOR EVENTS INVOLVING DEGRADATION OF SAFETY PROVISIONS cont Event rating depending on the source Type of events category Cat 4 Cat 3 or Cat 2 Cat 1 Packaging found with inadequate or 1 lor2 2or3 no shielding where there is significant Footrioteid Footnotes potential for exposures The lower rating may be appropriate if there
196. ors covering as appropriate common cause failure issues with procedures and safety culture To address these additional factors the criteria allow the rating to be increased by one level from the rating derived solely by considering the significance of the actual equipment or administrative failures It should be noted that for events related to radiation sources and transport of radioactive material the possibility of increasing the level due to additional factors is included as part of the rating tables rather than as a separate consideration The detailed criteria developed to implement these principles are defined in this document Three specific but consistent approaches are used one for transport and radiation source events one specific to events at power reactors in operation and one for events at other authorized facilities including events at reactors during cold shutdown research reactors and decommissioning of nuclear facilities It is for this reason that there are three separate sections for defence in depth one for each of these approaches Each section is self contained allowing users to focus on the guidance relevant to events of interest The criteria for transport and radiation source events are contained in a set of tables that combine all three elements of defence in depth mentioned earlier i e the amount of radioactive material the extent of any failure of safety provisions and additional factors The criteria fo
197. pection of the hospital at which she worked The regulatory authority inspected the hospital thoroughly and found one of the individual s monthly records indicating 54 mSv However the hospital had not taken any special actions until the inspection The hospital has no radiation generator such as a linear accelerator LINAC and no obvious reason for the single over exposure was found There was some possibility of mischief by a colleague but no direct evidence was found According to a medical examination which included blood tests no abnormalities were found The person also had no symptom suggesting a deterministic effect The person was transferred to 64 another section and was provided with additional training Making the worst case assumption that the dose was real she was also barred from entering controlled areas Rating explanation Criteria Explanation 2 3 Doses to individuals 4 2 1 Maximum potential consequences 4 2 2 Effectiveness of safety provisions Final rating There were no deterministic effects observed on the technician While the blood tests showed that no serious doses had been received it could not be proved that no radiation exposure had taken place A detailed investigation was carried out to determine whether the radiation exposure took place or not The investigation took into account 1 The lack of any sources of high radiation in her normal workplace or anywhere she went
198. perating personnel worked for over an hour without dynamic containment The ventilation performs a dual role Firstly it directs radioactivity that might be released in a closed room to the controlled release and filtration circuits and secondly it creates a slight negative pressure gradient in such a closed room in order to avoid the transfer of radioactivity into other areas This form of containment is called dynamic containment The event started with the loss of electrical power supply to the normal ventilation system The emergency ventilation system which should have taken over did not start up Subsequent investigation indicated that the breakdown of the normal ventilation system and the failure of the emergency ventilation system to come into operation were linked to the presence of a common mode between the electrical power supplies to these ventilation systems The alarm was signaled in the guard post but the information reached neither the supervisory staff nor the operating personnel The operating personnel were only informed that the alarm had been triggered one hour after a new shift had started The results of measurements of atmospheric contamination taken at all the work stations being monitored did not provide any evidence of an increase in atmospheric contamination 137 Rating explanation Criteria Explanation 2 and 3 Actual consequences 6 2 1 Maximum potential consequences 6 2 2 Identificat
199. peration was being carried out in an area where there were specific access controls and safety provisions due to the potential for high activity Therefore the Level 2 dose rate criteria applicable within an operating area do not apply See Section 3 2 which defines operating areas as areas where worker access is allowed without specific permits It excludes areas where specific controls are required beyond the general need for a personal dosimeter and or coveralls due to the level of contamination or radiation The maximum potential consequences for this activity were exposures greater than ten times the statutory annual limit i e Level 3 In considering the number of independent safety layers it is necessary to consider the indications detectors and alarms and the response by operating personnel separately There were four independent safety layers of indications and alarms present These are Electronic personal dosimeters It was confirmed that these were in full working order and operated appropriately Installed gamma detectors and alarms These were in full working order and alarmed during the event Installed airborne activity alarms These respond to high gamma radiation and alarms from them require the prompt evacuation of personnel in the area Presence of a radiation protection technician with a radiation detector The primary purpose of the technician was to monitor the radiation levels duri
200. ponding to a quantity of radioactivity radiologically equivalent to a release to the atmosphere of the order of hundreds to thousands of terabecquerels of I or These criteria relate to accidents where early estimates of the size of release can only be approximate For this reason it is inappropriate to use precise numerical values in the definitions of the levels However in order to help ensure consistent interpre tation of these criteria internationally it is suggested that the boundaries between the levels are about 500 5000 and 50 000 TBq I 17 An event resulting in a dispersed release of activity from a radioactive source with an activity greater than 2500 times the D value for the isotopes released As a result of the actual release some protective action will probably be required e g localized sheltering and or evacuation to prevent or minimize the likelihood of health effects Level 4 An event resulting in an environmental release corresponding to a quantity of radioactivity radiologically equivalent to a release to the atmosphere of the order of tens to hundreds of terabecquerels of I or An event resulting in a dispersed release of activity from a radioactive source with an activity greater than 250 times the D value for the isotopes released For such a release protective action will probably not be required other than local food controls 2 3 DOSES TO INDIVIDUALS The mos
201. pping documents package labels Oorl Oorl Oorl or vehicle placards incorrect or absent Marking of packages incorrect or absent Radioactive material in a supposedly 1 lor2 1 20r3 empty package Footnote b Footnote b Radioactive material in the wrong Oorl lor2 2 or3 Footnote c Footnote c Footnote c type or an inappropriate packaging The rating should take into account the degree of inadequacy of the surveys as well as any safety culture implications The choice of rating should take into account the safety provisions that might still be in place even though the package was supposed to be empty The higher rating in each category reflects situations where the wrong or inappropriate packaging could reasonably result in inadvertent exposures 4 3 WORKED EXAMPLES Example 14 Detachment and recovery of an industrial radiography source Below Scale Level 0 Event description Industrial radiography was being undertaken at a petrochemical plant using a 1 TBq Ir source During an exposure the source became detached in the exposed position This was recognized when the radiographer re entered the area with a survey meter The controlled area barriers were checked and left in place and assistance was sought from the national authorities The authorities and the radiographers jointly planned the source recovery operation Twelve hours after the event was first identified the source was successfully recovered Doses rec
202. pplicable as the facility did not handle large controls at facilities quantities of radioactive material see 1 paragraph of Section 3 1 4 2 1 Maximum potential The D value of T is 0 2 TBq giving an A D ratio of consequences between 0 01 and 1 hence it was a Category 4 source 4 2 2 Effectiveness of safety As the source container was broken there were no provisions safety provisions remaining and section C of Table 7 is appropriate giving a rating of Level 1 Final rating Level 1 Example 22 Train collision with radioactive material packages Level 1 Event description A collision occurred between a train and a baggage truck that was crossing the railway line in a station Type A packages were amongst the luggage There were seven cartons containing a range of radionuclides and two drums each containing a technetium generator using molybdenum with an activity of 15 GBq 30 GBq at the start of the journey Being light the cartons were only slightly damaged and no radioactive material was lost from them On the other hand the two drums were thrown from the packages and one source container broke contaminating the cab of the locomotive and the gravel under the track There were 291 persons screened for contamination and 19 had positive results which were not found to be significant All doses received were less than 0 1 mSv The resulting contamination was no reason for concern in view of the small quantities
203. proximately 0 3 C h The RHR system was restarted approximately 6 h after the initial event Rating explanation Criteria Explanation 2 and 3 Actual consequences 6 2 1 Maximum potential consequences 6 2 2 Identification of number of safety layers 6 2 3 Assessment of the basic rating 6 2 4 Additional factors Overall rating There were no actual consequences from the event The maximum potential consequences for an event associated with a shutdown power reactor are Levels 5 7 For this particular event a very long time was available before any significant consequences such as core degradation or significant radiation exposures could occur This available time allows implementation of a wide range of measures to correct the situation and can therefore be considered as a highly reliable safety layer as mentioned in Section 6 2 2 4 The basic rating of the event is Below Scale Level 0 The inappropriate maintenance took the reactor outside the OL amp C so the rating was increased to Level 1 Level 1 If the decay heat had not been very low the available time would have been much shorter and it could not have been considered as a high integrity layer In such a case the effective safety layers are the following Procedures and actions by operating personnel to restore the power supply to Division 2 of the Nuclear Safety Protection system Procedures and actions by operating personnel
204. ption A regulatory inspection identified that the consequences of internal flooding had not been adequately addressed Documentation addressing specific flooding events from postulated failures of plant equipment did exist but a complete internal plant flooding analysis had not been developed during or subsequent to the plant s original design In response to the inadequate plant design some physical changes had been made to minimize challenges to plant equipment and personnel in combating potential flooding events However it was not clear that the plant design provided adequate protection against the consequences of non safety related piping system failures in the turbine building High water level in the turbine building would result in water flowing into certain engineered safety feature ESF equipment rooms because they are only separated from the turbine building by non water tight doors and have a common floor drain system The ESF equipment rooms contain the auxiliary feedwater system AFW emergency diesel generators and both 480 V and 4160 V ESF switchgear 92 As a result of the inspection the design and licensing basis for internal flooding was compiled and seismic qualification of selected piping and components was completed Design modifications to protect Class 1 plant systems and components as defined in the updated Safety Analysis Report were completed This included installation of flood barriers at the doors to rooms co
205. quences from the event 5 1 1 Initiator frequency This event needs to be considered in two parts The first initiator was the transient caused by loss of feed to one boiler together with loss of indications This challenged the protection system which was still fully available This part of the event would therefore be rated at Below scale Level 0 It should be noted that although the first occurrence in the event was a fault in the instrument supplies this is not the initiator The instrument fault caused feed to be lost to one boiler but did not directly challenge any safety systems It is not therefore to be considered as an initiator The transient that followed challenged the protection system and is therefore an initiator The second initiator was the reactor trip and rundown of the steam driven gas circulators This challenged the safety function cooling of the fuel 96 Criteria Explanation 5 1 2 Safety function operability 5 1 3 and 5 1 4 Basic rating 5 2 Additional factors Final rating The operability of this safety function was less than the minimum required by OL amp C as none of the pony motors could be started but more than adequate as natural circulation provided effective cooling and forced circulation was restored before temperatures could have risen to unacceptable levels There was a real initiator From Section 5 1 3 box C 1 of Table 9 is appropriate giving a basic rating
206. r power reactors in operation give a basic rating from two tables and allow additional factors to increase the rating by one level The basic rating from the tables depends on whether the safety provisions were actually challenged the extent of any degradation of the safety provisions and the likelihood of an event that would challenge such provisions The criteria for events at reactors in cold shutdown research reactors and other authorized facilities give a basic rating from a table depending on the maximum consequences were all the safety provisions to fail and the extent of the remaining safety provisions This latter factor is accounted for by grouping safety provisions into what are called independent safety layers and counting the number of such safety layers Additional factors are then considered by allowing a potential increase in the basic rating by one level 1 4 4 The final rating The final rating of an event needs to take account of all the relevant criteria described above Each event should be considered against each of the appropriate criteria and the highest derived rating is the one to be applied to the event A final check for consistency with the general description of the levels of INES ensures the appropriateness of the rating The overall approach to rating is summarized in the flow charts of Section 7 1 5 USING THE SCALE INES is a communication tool Its primary purpose is to facilitate commu nication and unde
207. radiation levels at a nuclear recycling facility Below scale Level 0 scissssissssesteciscsesiexsisvevsetercscvessesosossveoeaneveaseveds 133 Worker received cumulative whole body dose above dose limit Leyol A dviis sci cadesssesssoecsessassdssncsensetebsesnestosseeapesecotones 135 Failure of criticality control Level 1 eeeeeeeeeeeeeeeeees 135 Prolonged loss of ventilation at a fuel fabrication Facility Level 1 wiccissscscsscisiscecssdecisdectecesendesvassestsatsiensstcaesaceestass 137 Failure of a shield door interlocking system Level 2 139 Power excursion at research reactor during TUCITOAGING LEVEL 2D iss scesesrshevsstassvadesthsdssevvetetsssoessiads caaeteisaes 140 Near criticality at a nuclear recycling facility Level 2 141 199 CONTRIBUTORS TO DRAFTING AND REVIEW MEMBERS OF THE INES ADVISORY COMMITTEE as of 30 June 2008 Abe K Dos Santos R Gauvain J OECD NEA liaison Jones C G Jouve A Ramirez M L Sharma S K Spiegelberg Planer R IAEA INES Coordinator Stott A K van Iddekinge F Vlahov N Woodcock C Japan Nuclear Energy Safety Organization Japan National Nuclear Energy Commission Instituto de Radioprotecao e Dosimetria Brazil Nuclear Energy Agency Organisation for Economic Co operation and Development Nuclear Regulatory Commission United States of America Autorit de S ret Nucl aire France Consejo de Seguridad Nuclear
208. ranium where all of them are provided The 50 year integrated doses from ground deposition were taken from IAEA TECDOC 1162 15 14 RESULTS The multiplying factors applicable to both facility contamination and atmospheric releases are obtained by dividing the value for each radionuclide by that for I These are given in Table 14 and 15 Table 16 lists the results as they should be used in INES i e rounded to one significant figure 155 TABLE 14 FACTORS FOR FACILITY CONTAMINATION INHALATION ONLY Nuclide Inhalation coefficient Ratio to BH Sv per Bq 14 workers Am 241 2 70E 05 2454 5 Co 60 1 70E 08 1 5 Cs 134 9 60E 09 0 9 Cs 137 6 70E 09 0 6 H 3 1 80E 11 0 002 1 131 1 10E 08 1 0 Ir 192 4 90E 09 0 4 Mn 54 1 20B 09 0 1 Mo 99 5 60E 10 0 05 P 32 2 90E 09 0 3 Pu 239 3 2E 05 2909 1 Ru 106 3 50E 08 3 2 Sr 90 7 70E 08 7 0 Te 132 3 00E 09 0 3 U 235 S 6 10E 06 554 5 U 235 M 1 80E 06 163 6 U 235 F 6 00E 07 54 5 U 238 S 5 70E 06 518 2 U 238 M 1 60E 06 145 5 U 238 F 5 80E 07 52 7 U 6 25E 06 567 9 nat Lung absorption types S slow M medium F fast If unsure use the most conservative value 156 TABLE 15 DEPOSITION AND INHALATION ATMOSPHERIC RELEASE DOSE FROM GROUND Dose 50 year Dose Inhalation Total dose Ratio to I factor for ground factor for dose 50 year deposition inhalation dose from dose 14 ground public deposition 15 Nuclide Sv per Sv per SvperBq Syper
209. rch reactor would have maximum potential consequences of Level 4 based on fuel melting and maximum release Successful operation of any containment would not reduce the category of maximum potential consequences as fuel melting is already Level 4 For this reason the containment would not be considered as an additional safety layer On the other hand Example 52 and Example 55 show situations where it is appropriate to take account of containment as a safety layer 6 2 2 3 High integrity safety layers In some situations a high integrity safety layer may be available e g a reactor pressure vessel or a safety provision based on proven and naturally occurring passive phenomena such as convective cooling In such cases because the layer is demonstrated to be of extremely high integrity or reliability it would clearly be inappropriate to treat such a layer in the same way as other safety layers when applying this guidance A high integrity safety layer should have all the following characteristics The safety layer is designed to cope with all relevant design basis faults and is explicitly or implicitly recognized in the facility safety justification as requiring a particularly high reliability or integrity The integrity of the safety layer is assured through appropriate monitoring or inspection such that any degradation of integrity is identified If any degradation of the layer is detected there are clear means of coping wit
210. re provided to give guidance on the specific factors to be taken into account Events associated with Category 5 sources are not included in the sections below because they are generally rated at Below Scale Level 0 However a rating of Level 1 would be appropriate if all intended safety provisions had clearly been lost or there is evidence of a significant safety culture deficiency Where there was no intent to provide specific controls over the location of Category 5 sources their loss should only be rated at Below Scale Level 0 4 2 2 1 Consideration of safety culture implications Safety culture has been defined as that assembly of characteristics and attitudes in organizations and individuals which establishes that as an overriding priority protection and safety issues receive the attention warranted by their significance 7 A good safety culture helps to prevent incidents but 46 on the other hand a lack of safety culture could result in employees performing in ways not in accordance with the assumptions of the design Safety culture has therefore to be considered as part of the defence in depth To merit the choice of the higher rating due to safety culture issues the event has to be considered as a real indicator of an issue with the safety culture Examples of such indications could be A violation of authorized limits or requirements or a violation of a procedure without prior approval A deficiency in the qu
211. re an accident could occur e g loss of off site power plus failure of all essential diesels It is the latter approached that is adopted within INES rating procedure Within the safety justification for the facility operational systems may be distinguished from safety provisions If operational systems fail then additional safety provisions will operate so as to maintain the safety function Safety provisions can be either procedures administrative controls or passive or active systems which are usually provided in a redundant way with their availability controlled by OL amp C The frequency of challenge of the safety provisions is minimized by good design operation maintenance and surveillance For example the frequency of failure of the primary circuit of a reactor or of key pipe work and vessels in a reprocessing plant is minimized by such things as design margins quality control operational constraints and surveillance Similarly the frequency of reactor transients is minimized by operational procedures and control systems Normal operational and control systems contribute to minimizing the frequency of challenges to safety provisions INSAG 10 I 2 written since the development of INES provides much more detail on the implementation of defence in depth in design and operation and Table I 1 shows how the concepts described in INSAG 10 are incorporated into INES assessment of defence in depth REFERENCES TO ANNEX I I 1 IN
212. red systems such as cooling or injection systems and others may be based on administrative controls or actions by operating personnel in response to alarms The methodology for rating events involving such a wide range of safety provisions is to group the safety provisions into separate and independent safety layers Thus if two separate indications are routed through a single interlock the indications and interlock together provide a single safety layer On the other hand if cooling is provided by two separate 100 pumps it should be considered as two separate safety layers unless they have a common non redundant support system When considering the number of safety layers it is necessary to ensure that the effectiveness of a number of separate hardware layers is not reduced by a common support system or a common action by operating personnel in response to alarms or indications In such cases although there may be several hardware layers there may be only one effective safety layer When considering administrative controls as safety layers it is important to check the extent to which separate procedures can be considered independent and to check that the procedure is of sufficient reliability to be regarded as a safety layer The time available is considered to have a significant impact on the reliability that can be claimed from operating procedures Safety layers can include surveillance procedures though it should be noted that surveill
213. red to be a dangerous source and has a significant potential to cause severe deterministic effects if not managed safely and securely The D values from the Safety Guide 1 which contains the more common isotopes are reproduced in Appendix III If D values for other isotopes are required they can be found in the supporting Ref 5 Table 5 shows the relationship between A D value source category and the rating of the maximum potential consequences should all the safety provisions fail It also shows the maximum rating under defence in depth for each source category in accordance with the general principles for rating events described earlier The actual ratings will be equal to or less than those shown in the bottom row of this table when the rating guidance given in Section 4 2 2 is applied Since the maximum rating under defence in depth is the same for Category 2 and 3 sources they are considered together in the rest of this section TABLE 5 RELATIONSHIP BETWEEN A D RATIO SOURCE CATEGORY MAXIMUM POTENTIAL CONSEQUENCES AND DEFENCE IN DEPTH RATING A D Ratio 0 01 lt s A D lt 1 1 lt A D lt 10 10 lt A D lt 1000 1000 lt A D Source category Category 4 Category 3 Category 2 Category 1 Rating for the maximum 2 3 4 5 potential consequences for a practice should all safety provisions fail Maximum rating using 1 2 2 3 defence in depth criteria Higher levels are not considered credible for events involving radioact
214. rid 98 Ice slipped under the skimmer reaching the trash racks of the Unit 1 pumping station Further ice formation probably turned the ice flows into a solid block partially obstructing the trash racks shared by the two screening drums of the Unit 1 pumping station This would have produced a significant reduction in raw water intake at the pumping station There was no clear alarm signal indicating the drop in level As a result of the drop in level vacuum loss at the condensers led to automatic tripping of the four auxiliary turbine generator sets at the site between 09 30 and 09 34 the four corresponding busbars were each resupplied from the grid within one second The main turbine generator sets for Unit 1 were switched off at 09 28 and 09 34 and the reactor was shutdown Unit 2 remained in operation although from 09 33 to 10 35 no auxiliary turbine generator set at the site was available situation not foreseen or permitted in the Technical Specifications and the only power supplies consisted of the transmission grid and the two main turbine generator sets for the unit From 10 55 onwards when a second auxiliary turbine generator was reconnected to its switchboard two turboblowers were fed by the auxiliary turbine generators in operation and the two other turboblowers drawing from one of the two 400 kV lines At 11 43 following voltage reduction in the transmission grid the two main turbine generator sets at Unit 2 tripped a
215. rom the IAEA EPR D values 2006 5 TABLE 17 LIKELIHOOD OF FATAL DETERMINISTIC EFFECTS FROM OVEREXPOSURE Short term whole body dose Gy Likelihood of acute death from radiation with medical treatment 0 5 0 1 0 1 5 lt 5 2 lt 5 3 15 30 6 50 10 90 159 TABLE 18 THRESHOLD LEVELS OF RBE WEIGHTED DOSE FROM EXTERNAL EXPOSURE Exposure Effect Organ or tissue Threshold level value Gy Local exposure from Necrosis of soft tissue Soft tissue 25 an adjacent source Contact exposure from Moist desquamation Derma or skin 10 surface contamination Total body exposure Footnote Torso 1 from a distant source or immersion Soft tissue over an area of 100 cm and to a depth of about 0 5 cm below the body surface The value is the minimum threshold dose for developing any severe deterministic effect from uniform irradiation of the whole body The threshold level of 1 Gy was selected because it is the lower bound of the threshold levels for onset of severe deterministic effects in the red bone marrow thyroid lens of the eye and reproductive organs as shown in Table I 3 of IAEA TECDOC 1432 8 Exposure at this level to at least 100 cm of the skin is assumed to be required to result in severe deterministic health effects The dose is to skin structures at a depth of 40 mg cm or 0 4 mm under the surface b 160 TABLE 19 THRESHOLD LEVELS OF COMMITTED RBE WEIGHTED DOSE FROM INTERNAL EXPOSURE
216. rstanding between the technical community the media and the public on the safety significance of events Some more specific guidance on the use of INES as part of communicating event information is given in Section 1 6 It is not the purpose of INES or the international communication system associated with it to define the practices or installations that have to be included within the scope of the regulatory control system nor to establish requirements for events to be reported by the users to the regulatory authority or to the public The communication of events and their INES ratings is not a formal reporting system Equally the criteria of the scale are not intended to replace existing well established criteria used for formal emergency arrange ments in any country It is for each country to define its own regulations and arrangements for such matters The purpose of INES is simply to help to put into perspective the safety significance of those events that are to be communicated It is important that communications happen promptly otherwise a confused understanding of the event will occur from media and public speculation In some situations where not all the details of the event are known early on it is recommended that a provisional rating is issued based on the information that is available and the judgement of those understanding the nature of the event Later on a final rating should be communicated and any differences explained For
217. s Level 1 is shown in Table 10 for both possible and unlikely initiators If the safety function operability is full or within OL amp C the plant has remained within its safe operating envelope and Below Scale Level 0 is appropriate for all frequencies of initiators Thus Table 10 shows Below Scale Level 0 for each cell of rows A and B TABLE 10 EVENTS WITHOUT A REAL INITIATOR Initiator frequency Safety function operability 1 2 3 Expected Possible Unlikely A Full 0 0 0 B Minimum required by OL amp C 0 0 0 C Adequate lor2 1 1 D Inadequate 3 2 1 5 1 4 2 Rating procedure With the background described in the previous section events should be rated using the following procedure 78 1 2 3 Determine the category of safety function operability a If the operability is just adequate but still within OL amp C operability category B should be used as the plant has remained within its safe operating envelope b In practice safety systems or components may be in a state not fully described by any of the four categories The operability of the safety function may be less than full but more than the minimum required by OL amp C or a complete system may be available but degraded by loss of indications In such cases the relevant categories should be used to give the possible range of the rating and judgement used to determine the appropriate rating Determine the category of frequency of the ini
218. s a possible initiator for PHWRs which actually occurred i e real As in the previous example the hazard itself should not be taken as the initiator The safety function cooling was just adequate because the secondary side was fed using a diesel fire pump which is not a normal safety system There was a real initiator From Section 5 1 3 box C 2 of Table 9 is appropriate giving a basic rating of Level 2 or 3 Level 3 was chosen because there were no safety systems available and many indications were lost A number of potential further single failures could have resulted in an accident Level 3 102 6 ASSESSMENT OF IMPACT ON DEFENCE IN DEPTH FOR EVENTS AT SPECIFIED FACILITIES This section deals with those events where there are no actual consequences but some of the safety provisions failed The deliberate inclusion of multiple provisions or barriers is termed defence in depth The guidance in this section is for all events at fuel cycle facilities research reactors accelerators e g linear accelerators and cyclotrons and events associated with failures of safety provisions at facilities involving the manufacture and distribution of radionuclides or the use of a Category 1 source It also covers many events at reactor sites While Section 5 provided guidance for events occurring on power reactors during operation this section provides guidance on a wide range of other events at reactor sites These
219. s such as limits that relate to the long term safety of components For events where such limits are exceeded for a short time Below scale Level 0 may be more appropriate 5 2 3 2 Other safety culture issues Other examples of indicators of safety culture issues could be A violation of a procedure without prior approval A deficiency in the quality assurance process An accumulation of human errors 83 Exposure of a member of the public from a single event in excess of annual statutory dose limits Cumulative exposure of workers or members of the public in excess of annual statutory dose limits A failure to maintain proper control over radioactive materials including releases into the environment spread of contamination or a failure in the systems of dose control The repetition of an event if there is evidence that the operator has not taken adequate care to ensure that lessons have been learnt or that corrective actions have been taken after the first event It is important to note that the intention of this guidance is not to initiate a long and detailed assessment but to consider if there is an immediate judgement that can be made by those rating the event It is often difficult immediately after the event to determine if the rating of the event should be increased due to safety culture A provisional rating should be provided in this case based on what is known at the time and a final rating can t
220. safety relevant events that are not covered by the previous tables 53 TABLE 8 RATING FOR OTHER SAFETY RELEVANT EVENTS Event rating depending on the source category Type of events Cat 4 Cat 3 or Cat 2 Cat 1 Member of the public receiving a dose 1 1 1 from a single event in excess of annual statutory dose limits Workers or members of the public 1 1 1 receiving cumulative doses in excess of annual statutory dose limits Absence of or serious deficiency in 1 1 1 records such as source inventories breakdowns in dosimetry arrangements Discharges to the environment in 1 1 1 excess of authorized limits Non compliance with licence 1 1 1 conditions for transport Inadequate radiological survey of Oorl Oorl Oorl transport Footnote a Footnote a Footnote a Contamination on packages Oorl Oorl Oorl conveyance where the resulting contamination is of little or no radiological significance Contamination on packages 1 1 1 conveyance where a number of measurements reveal excessive contamination above the applicable limits and there is potential for the public to be contaminated 16 Wherever there is a choice of rating a significant factor is whether there are safety culture implications as discussed in Section 4 2 2 1 54 TABLE 8 RATING FOR OTHER SAFETY RELEVANT EVENTS cont Event rating depending on the source category Type of events Cat 4 Cat 3 or Cat 2 Cat 1 Shi
221. sembly from the machine They took it home and tried to dismantle it In the attempt the source capsule was ruptured The radioactive source was in the form of caesium chloride salt which is highly soluble and readily dispersible As a result several people were contaminated and irradiated After the source capsule was ruptured the remnants of the source assembly were sold for scrap to a junkyard owner He noticed that the source material glowed blue in the dark Several persons were fascinated by this and over a period of days friends and relatives came and saw the phenomenon Fragments of the source the size of rice grains were distributed to several families This continued for five days by which time a number of people were showing gastrointestinal symptoms arising from their exposure to radiation from the source The symptoms were not initially recognized as being due to irradiation However one of the persons irradiated made the connection between the illnesses and the source capsule and took the remnants to the public health department in the city 25 This action began a chain of events which led to the discovery of the accident A local physicist was the first to monitor and assess the scale of the accident and took actions on his own initiative to evacuate two areas At the same time the authorities were informed upon which the speed and the scale of the response were impressive Several other sites of significant contami nation
222. shs Supposedly empty shipping containers found to contain nuclear material Level 1 oe Suspicious dose on film badge Level 1 Melting of an orphan source Level 2 si Loss of a high activity radiotherapy source Level 3 Reactor scram following the fall of control rods Below scale Level Qsscisiscisssciscsciscssiiensasesscsssessessveaiesecesvveasvesvevesss 197 Example 28 Example 29 Example 30 Example 31 Example 32 Example 33 Example 34 Example 35 Example 36 Example 37 Example 38 Example 39 Example 40 Example 41 Example 42 Example 43 Example 44 Example 45 Example 46 Example 47 Example 48 198 Reactor coolant leak during on power refuelling DoW ID oii css sesscse siete sicaeesscesiesveiaossicesediessisvexescthasvene ssvandseaveseareassvens Containment spray not available due to valves being left in the closed position Level Low eeeseeeeteeeeteeeenees Primary system water leak through a rupture disk of the pressurizer discharge tank Level 1 0 0 Fuel assembly drop during refuelling Level 1 Incorrect calibration of regional overpower detectors Plant design for flooding events may not mitigate the consequences of piping system failures Level 1 Two emergency diesel generators did not start following disconnection from the main grid supplies SS VELD EE E Loss of forced gas circulation for between 15 and 20 MI
223. sources and their likely category For events involving packages containing fissile material which is not fissile excepted as defined in the Transport Regulations 6 e Where safety provisions necessary to prevent criticality are affected the event should be rated as if the package was a Category 1 source e Where there is a failure of a provision that does not relate to criticality safety for unirradiated fuel the rating should be based on the actual activity involved using the A D ratio For irradiated fuel the column for Category 1 sources should generally be used though the actual A D value could be calculated and used if the quantities of irradiated material are extremely small 4 2 2 Rating based on effectiveness of safety provisions The following sections give guidance on the rating of a number of types of events associated with degradation of safety provisions Section 4 2 2 2 covers events involving lost or found radioactive sources devices or transport packages Section 4 2 2 3 covers events where intended safety provisions have been degraded and Section 4 2 2 4 covers a number of other safety related events In all cases where there is a choice of rating an issue for consideration will be the underlying safety culture implications Therefore further guidance on this aspect is given in Section 4 2 2 1 In some of the cases where there is a choice of rating other factors also need to be considered and footnotes a
224. stems have the potential for high power peaks leading to explosive release of energy and the release of large amounts of radioactive material due to substantial damage to the installation For such facilities the maximum potential consequences could exceed Level 4 For other facilities the main hazard from a criticality excursion is exposure of personnel due to high radiation fields from direct neutron and gamma radiation A second consequence might be a release to the atmosphere of short lived radioactive fission products and potentially severe contamination within the facility For these two scenarios the maximum potential conse quences would be Level 3 or 4 In accordance with the general guidance Minor deviations from the criticality safety regime that are within the authorized limits should be rated at Below Scale Level 0 Operation outside authorized limits should be rated at least at Level 1 An event where a criticality event would have occurred had there been one further failure in the safety provisions or had conditions been slightly 117 different should be rated at Level 2 for facilities with maximum potential consequences of Levels 3 or 4 If the maximum potential consequences could have been Level 5 or higher the event should be rated at Level 3 If more than one safety layer remains then a lower level would be appropriate and Table 11 should be used to determine the appropriate rating 6 3 4 Unauthorize
225. sulting in the sum of gamma plus neutron dose rates of greater than 50 mSv per hour in an operating area dose rate measured 1 metre from the source 12 In this context the terms primary and secondary containment refer to contain ment of radioactive materials at non reactor installations and should not be confused with the similar terms used for reactor containments 3 Areas not expected by design are those whose design basis for either permanent or temporary structures does not assume that during operation or following an incident the area could receive and retain the level of contamination that has occurred and prevent the spread of contamination beyond the area Examples of events involving contamination of areas not expected by design are Contamination by radioactive material outside controlled or supervized areas where normally no such material is present for example floors staircases auxiliary buildings and storage areas Contamination by plutonium or highly radioactive fission products of an area designed and equipped only for the handling of uranium 14 Operating areas are areas where worker access is allowed without specific permits It excludes areas where specific controls are required beyond the general need for a personal dosimeter and or coveralls due to the level of contamination or radiation 33 or An event resulting in the presence of significant quantities of radioactive material in the installati
226. t an order of magnitude for each increase in level on the scale i e the scale is logarithmic The 1986 accident at the Chernobyl nuclear power plant is rated at Level 7 on INES It had widespread impact on people and the environment One of the key considerations in developing INES rating criteria was to ensure that the significance level of less severe and more localized events were clearly separated from this very severe accident Thus the 1979 accident at the Three Mile Island nuclear power plant is rated at Level 5 on INES and an event resulting in a single death from radiation is rated at Level 4 The structure of the scale is shown in Table 1 Events are considered in terms of their impact on three different areas impact on people and the environment impact on radiological barriers and controls at facilities and impact on defence in depth Detailed definitions of the levels are provided in the later sections of this manual The impact on people and the environment can be localized i e radiation doses to one or a few people close to the location of the event or widespread as in the release of radioactive material from an installation The impact on radiological barriers and controls at facilities is only relevant to facilities handling major quantities of radioactive material such as power reactors reprocessing facilities large research reactors or large source production facilities It covers events such as reactor core melt and the spi
227. t has not been considered necessary in the safety justification to identify each of them in detail or to include in the procedure the detail of how to make each of them available In such cases provided there are a range of practicable measures that could be implemented this long time available itself provides a highly reliable safety layer 6 2 3 Assessment of the basic rating 6 2 3 1 The rating process Having identified the maximum potential consequences and the number of effective safety layers the basic rating should be determined as follows 1 The safety analysis for the facility will identify a wide range of events that have been taken into account in the design It will recognize that a subset of these could reasonably be expected to occur over the life of the facility i e they will have a frequency greater that 1 N per year where N is the facility life If the challenge to the safety provisions that occurred in the event was such an expected event and the safety systems provided to cope with that event were fully available before the event and behave as expected the basic rating of the event should be Below Scale Level 0 2 Similarly if no actual challenge to the safety provisions occurred but they were discovered to be degraded the basic rating of the event should be Below Scale Level 0 if the degraded operability of the safety provisions was still within authorized limits 110 3 For all other situat
228. t straightforward criterion is that of dose received as a result of the event and Levels 1 to 6 include a definition based on that criterion Unless specifically stated see Level 1 criteria they apply to doses that were received or could have easily been received from the single event being rated i e excluding cumulative exposure They define a minimum rating if one individual is exposed above the given criteria section 2 3 1 and a higher rating if more individuals are exposed above those criteria section 2 3 2 3 The Level 1 definitions are based on the defence in depth criteria explained in Sections 4 6 but they are included here for completeness 4 The intention here is not to invent scenarios different than the one that occurred but to consider what doses might reasonably have occurred unknowingly For example if a radioactive source has become separated from its shielding and transported doses to drivers and package handlers should be estimated 18 2 3 1 Criteria for the assessment of the minimum rating when one individual is exposed Level 4 is the minimum level for events that result in 1 The occurrence of a lethal deterministic effect or 2 The likely occurrence of a lethal deterministic effect as a result of whole body exposure leading to an absorbed dose of the order of a few Gy Appendix II presents further details on the likelihood of fatal deterministic effects and the thresholds for non lethal
229. t the overvoltage on the generator bus bars could easily have prevented all four UPS systems working Rating explanation Criteria Explanation 2 and 3 Actual consequences There were no actual consequences from the event 5 1 1 Initiator frequency A reactor trip occurred which is a frequent initiator There was also a partial loss of off site power requiring initial operation of diesels followed by manual connection to auxiliary supplies 5 1 2 Safety function All cooling systems were available but the supplies for operability switching were not available on two trains Unavailability of two out of four trains was permitted for a limited time and so was within OL amp C 5 1 3 and 5 1 4 Basic rating There was a real initiator From Section 5 1 3 box B 1 of Table 9 is appropriate giving a basic rating of Level 1 or 2 As all cooling systems were actually available subject to manual switching the lower rating was chosen 5 2 Additional factors There was clearly a common mode failure issue as all four UPS systems were subject to the same overvoltage problems For this reason the basic rating was increased by 1 level Final rating Level 2 94 The event also showed that the safety systems were vulnerable to a loss of off site power with an associated overvoltage Therefore it also needs to be rated based on assessing this identified reduction in operability Criteria Explanation 2 and 3 Actual consequ
230. ternal a 7 Internal B y 1 GI syndrome Colon Internal a 0 External n 3 Moist desquamation Skint External B y 1 Intake of some iodine isotopes 0 2 Acute radiation thyroiditis Thyroid Other thyroid seekers 1 Necrosis Soft tissue External B y 1 a External yexposure includes the dose from bremsstrahlung produced within the source mate rials For cases with supportive medical treatment For alpha emitters uniformly distributed in the contents of the colon it is assumed that irradia tion of the walls of the intestine is negligible For askin area of 100 cm which is considered life threatening 9 the skin dose should be calcu lated for a depth of 0 4 mm as recommended in Ref 10 para 305 306 and 310 in Ref 11 and Section 3 4 1 in Ref 12 Uniform irradiation of the critical tissue of the thyroid gland is assumed to be five times more likely to produce deterministic health effects than internal exposure to low energy beta emitting isotopes of iodine such as I 11 151 I and I 9 Thyroid seeking radionuclides have a heterogeneous distribution in thyroid tissues lodine 131 emits low energy beta particles which leads to a reduced effectiveness of irradiation of critical thyroid tissues due to the dissipation of their energy in other tissues Tissue at a depth of 0 5 cm below the body surface over an area of more than 100 cm results in severe deterministic effects 8 13 162 Appendix III D
231. the actuation of the safety system initiated by variations in physical parameters which have been caused by unintended actions elsewhere in the plant would not be considered as spurious initiation of the safety system 81 5 2 1 Common cause failures A common cause failure is the failure of a number of devices or components to perform their function as a result of a single specific event or cause In particular it can cause the failure of redundant components or devices intended to perform the same safety function This may imply that the reliability of the whole safety function could be much lower than expected The severity of an event affecting a component that identifies a potential common cause failure affecting other similar components is therefore higher than an event involving the random failure of the component Events in which there is a difficulty in operating some systems as a result of absent or misleading information can also be considered for uprating on the basis of a common cause failure 5 2 2 Procedural inadequacies The simultaneous challenge to several layers of the defence in depth may arise because of inadequate procedures Such inadequacies in procedures are therefore also a possible reason for increasing the basic rating Examples include Wrong or inadequate instructions given to operating personnel for coping with an event e g This happened during the Three Mile Island accident in 1979 The procedures to b
232. the authorized limits the guidance in Section 6 2 4 3 may lead to a rating of Level 1 111 discovery of structural defects a leak terminated due to action by operating personnel or faults discovered in process control systems The approach to rating such events is as follows First the significance of the potential event should be evaluated by assuming it had actually occurred and applying the guidance of Section 6 2 3 1 based on the number of safety layers that would have remained Second the rating should be reduced depending on the likelihood that the potential event could have developed from the event that actually occurred The level to which the rating should be reduced must be based on judgement One of the most common examples of potential events is the discovery of structural defects The surveillance programme is intended to identify structural defects before their size becomes unacceptable If the defect is within this size then Below scale Level 0 would be appropriate If the defect is larger than expected under the surveillance programme rating of the event needs to take account of two factors Firstly the rating of the potential event should be determined by assuming that the defect had led to failure of the component and applying the guidance of Section 6 2 3 1 The rating of the potential event derived in this way should then be adjusted depending on the likelihood that the defect would have led to the potential event and
233. the rating due to a safety culture issue the event has to be considered as a real indicator of an issue with the safety culture Violation of authorized limits One of the most easily defined indicators of a safety culture issue is a violation of authorized limits which may also be referred to as OL amp C In many facilities the authorized limits include the minimum operability of safety systems such that operation remains within the safety requirements of the plant They may also include operation with reduced safety system availability for a limited time In some facilities Technical Specifications are provided and include authorized limits and furthermore in the event that the requirements are not met the Technical Specifications describe the actions to be taken including times allowed for recovery as well as the appropriate fallback state If the operating personnel stay more than the allowed time in a reduced availability state as defined in the Technical Specification or if they take deliberate action that leads to plant availability being outside an allowed state 114 consideration should be given to increasing the basic rating of the event because of safety culture issues If the system availability is discovered to be less than that allowed by the authorized limits e g following a routine test but the operating personnel immediately take the appropriate actions to return the plant to a safe state in accordance with the Te
234. the source can be categorized as Category 4 4 2 2 Effectiveness of safety From the second row of Table 6 Level 1 is appropriate provisions Its recovery allowed the event to be reassessed as a Lost or stolen radioactive source subsequently located fourth row which for a Category 4 source remains at Level 1 Overall rating Level 1 Example 20 Radioactive source stolen during transport Level 1 Event description When a package of a sealed 1 85 GBq Co source was delivered by the shipper it was found to be empty The source was found seven hours later in a delivery truck The package had been intentionally opened 1 85 GBq of Co delivers a dose rate of 0 5 mSv h at a distance of 1 m 60 It appeared that the event was a direct result of failure to comply with the regulations for the transport of radioactive materials The security seal required by the regulations was not affixed to the package The shipping declaration had not been completed and The radioactive label did not appear to have been fixed to the container although this was never clearly established Rating explanation Criteria Explanation 2 3 Doses to individuals 4 2 1 Maximum potential consequences 4 2 2 Effectiveness of safety provisions Overall rating Based on interviews of personnel involved and postulation of likely scenarios of what might have happened to the source dose assessments were
235. the vast majority of events such communications will only be of interest in the region or country where the event occurs and participating countries will have to set up mechanisms for such communications However in order to facilitate international communications for events attracting or possibly attracting wider interest the IAEA and OECD NEA have developed a communications network that allows details of the event to be input on an event rating form ERF which is then immediately disseminated to all INES member States Since 2001 this web based INES information service has been used by the INES members to communicate events to the technical community as well as to the media and public It is not appropriate to use INES to compare safety performance between facilities organizations or countries Arrangements for reporting minor events to the public may be different and it is difficult to ensure precise consistency in rating events at the boundary between Below scale Level 0 and Level 1 Although information will be available on events at Level 2 and above the statistically small number of such events which also varies from year to year makes it difficult to put forth meaningful international comparisons 1 6 COMMUNICATING EVENT INFORMATION 1 6 1 General principles INES should be used as part of a communications strategy locally nationally and internationally While it is not appropriate for an international document to define exa
236. tiator for which the safety function is required a If there is more than one relevant initiator then each must be considered and the one giving the highest rating should be used b If the frequency lies on the boundary between two categories both categories can be used to give the possible range of the rating and then some judgement will need to be applied c For systems specifically provided for protection against hazards the hazard should be considered as the initiator The event rating should be determined from Table 10 a Ifthe period of inoperability was very short compared to the interval between tests of the components of the safety system e g a couple of hours for a component with a monthly test period consideration should be given to reducing the basic rating of the event In cell C1 of the table where choice of rating is given the choice should be based on whether the operability is just adequate or whether redundancy and or diversity still exist for the initiator being considered b wa Beyond design initiators are not included specifically in Table 10 If the operability of the affected safety function is less than the minimum required by OL amp C Level 1 is appropriate If the operability is within the requirements of OL amp C or the OL amp C do not provide any limitations on the system operability Below Scale Level 0 is appropriate 5 1 5 Potential events including structural defects S
237. ticipating in INES has set up a network that ensures that events are promptly rated and communicated inside or outside the country The IAEA provides training services on the use of INES on request and encourages Member States to join the system This manual was the result of efforts by the INES Advisory Committee as well as INES National Officers representing INES member countries The contributions of those involved in drafting and reviewing the manual are greatly appreciated The IAEA and OECD NEA wish to express their gratitude to the INES Advisory Committee members for their special efforts in reviewing this publication The IAEA expresses its gratitude for the assistance of S Mortin in the preparation of this publication and for the cooperation of J Gauvain the counterpart at the OECD NEA The IAEA also wishes to express its gratitude to the Governments of Spain and the United States of America for the provision of extrabudgetary funds The IAEA officer responsible for this publication was R Spiegelberg Planer of the Department of Nuclear Safety and Security EDITORIAL NOTE Although great care has been taken to maintain the accuracy of information contained in this publication neither the IAEA nor its Member States assume any responsibility for consequences which may arise from its use The use of particular designations of countries or territories does not imply any judgement by the publisher the TA EA as to the legal status of such
238. time to carry out any repairs should the valves fail to open For these reasons the single layer is not regarded as a highly reliable safety layer even though it was the only layer provided by design The need to be able to open both of the isolating valves in order to restore supplies clearly limits the reliability of the safety layer There is only a single safety layer available and therefore based on Table 11 the rating is Level 3 Level 3 129 Example 46 Loss of shutdown cooling due to increase in coolant pressure Level 3 Event description The plant design is the same as in Example 44 but the event occurred soon after shutdown when a rise in coolant pressure caused the isolating valves to close The safety provisions are illustrated in Fig 2 Rating explanation Criteria Explanation 2 and 3 Actual consequences There were no actual consequences from the event 6 2 1 Maximum potential The maximum potential consequences for an event consequences associated with a shutdown power reactor are Levels 5 7 6 2 2 Identification of number There now appear to be two safety layers as far as of safety layers hardware is concerned However both still rely on the operating personnel to re open the valves The reliability of the safety provisions is limited by the need for action by operating personnel Given the complexity of the operation and the limited time available it is considered that there is only o
239. tings for events with a real initiator are given in Table 9 The basis of the values given in the table is as follows Clearly if the safety function is inadequate an accident will have occurred and it will need to be rated based on its actual consequences Such a rating could well exceed Level 3 However in terms of defence in depth Level 3 represents the highest rating This is expressed by 3 in Table 9 74 If the safety function is just adequate then again Level 3 is appropriate because a further failure would lead to an accident However in other cases even though the operability is less than that required by the OL amp C it may be considerably greater than just adequate particularly for expected initiators because OL amp C requirements often still incorporate significant redundancy or diversity Therefore in Table 9 Level 2 or 3 is shown for expected initiators and adequate safety function the choice depending on the extent to which the operability is greater than just adequate For unlikely initiators the operability required by the OL amp C is likely to be just adequate and therefore in general Level 3 would be appropriate for adequate operability However there may be particular initiators for which there is redundancy and therefore Table 9 shows Level 2 or 3 for all initiator frequencies If there is full safety function operability and an expected initiator occurs this should clearly be Below Scale Level 0 as shown in
240. tion was determined to be acceptable Based upon the reactor coolant activity the operator entered the refueling outage expecting to find a small number of the 3400 fuel rods failed The actual inspection however revealed that about 200 6 of the total rods had failed though there was no fuel melting or significant release of radio nuclides from the fuel matrix The cause was found to be foreign material present in the reactor coolant causing local overheating of the fuel Rating explanation Criteria Explanation 2 2 Activity released Not applicable No release 2 3 Doses to individuals Not applicable No doses 3 2 Radiological barriers and 6 of the fuel rods failed leads to about 0 06 of the controls at facilities core inventory released into the coolant This is less than the criterion for Level 4 giving a rating of Level 0 based on this criterion Rating for actual consequences Below Scale Level 0 defence in depth criteria would give a higher rating Example 10 Spillage of plutonium contaminated liquid onto a laboratory floor Level 2 Event description A flexible hose feeding cooling water to a glass condenser in a glove box became detached Water flooded the glove box and filled the glove until it burst The spilled water contained about 2 3 GBq of Pu 37 Rating explanation Criteria Explanation 2 2 Activity released Not applicable 2 3 Doses to individuals Because the spillage occurred as
241. tions is assured by good design well controlled operation and a range of systems and administrative controls A defence in depth approach is generally applied to each of these aspects and allowance is made for the possibility of equipment failure human error and the occurrence of unplanned developments Defence in depth is thus a combination of conservative design quality assurance surveillance mitigation measures and a general safety culture that strengthens each of the successive levels Defence in depth is fundamental to the design and operation of major nuclear and radiological facilities IAEA Safety Series No 75 INSAG 3 I 1 Basic Safety Principles for Nuclear Power Plants states To compensate for potential human and mechanical failures a defence in depth concept is implemented centred on several levels of protection including successive barriers preventing the release of radioactive material to the environment The concept includes protection of the barriers by averting damage to the plant and to the barriers themselves It includes further measures to protect the public and the environment from harm in case these barriers are not fully effective 171 Defence in depth can be considered in a number of different ways For example one can consider the number of barriers provided to prevent a release e g fuel clad pressure vessel containment Equally one can consider the number of systems that would have to fail befo
242. tor is at power Events on power reactors while in shutdown mode permanently shutdown or being decommis sioned are covered in Section 6 Events at research reactors are also covered in Section 6 Section 6 provides the defence in depth guidance for events at fuel cycle facilities research reactors accelerators e g linear accelerators and cyclotrons and events associated with failures of safety provisions at facilities involving the manufacture and distribution of radionuclides or the use of a Category 1 source It also provides the guidance for rating events on nuclear power reactors while in cold shutdown mode during outage permanently shutdown or under decommissioning 12 The purpose of providing three separate sections for defence in depth is to simplify the task of those determining the rating of events While there is some duplication between chapters each chapter contains all that is required for the rating of events of the appropriate type Relevant worked examples are included in each of the three defence in depth sections Section 7 is a summary of the procedure to be used to rate events including illustrative flowcharts and tables of examples Four appendices two annexes and references provide some further scientific background information Definitions and terminology adopted in this manual are presented in the Glossary This manual supersedes the 2001 edition 2 the 2006 working material published as additional guidan
243. tors Level 3 is appropriate If the inadequate safety function is only required for possible or unlikely initiators a lower level is clearly appropriate because the likelihood of an accident is much lower For this reason Table 10 shows Level 2 for possible initiators and Level 1 for unlikely initiators The level chosen should clearly be less when the safety function is adequate than when it is inadequate Thus if the function is required for 77 expected initiators and the operability is just adequate Level 2 is appropriate However in a number of cases the safety function operability may be considerably greater than just adequate but not within the Operational Limits and Conditions This is because the minimum operability required by Operational Limits and Conditions will often still incorporate redundancy and or diversity against some expected initiators In such situations Level 1 would be more appropriate Thus Table 10 shows a choice of Level 1 or 2 The appropriate value should be chosen depending on the remaining redundancy and or diversity If the safety function is required for possible or unlikely initiators then reduction by one from the level derived above for an inadequate system gives Level 1 for possible initiators and Below scale Level 0 for unlikely initiators However it is not considered appropriate to categorize at Below Scale Level 0 a reduction in safety system operability below that required by the OL amp C Thu
244. trol over radioactive materials including releases into the environment spread of contamination or a failure in the systems of dose control The repetition of an event if there is evidence that the operator has not taken adequate care to ensure that lessons have been learnt or that corrective actions have been taken after the first event It is important to note that the intention of this guidance is not to initiate a long and detailed assessment but to consider if there is an immediate 115 judgement that can be made by those rating the event It is often difficult immediately after the event to determine if the event should be uprated due to safety culture A provisional rating should be provided in this case based on what is known at the time and a final rating can then take account of the additional information related to safety culture that will have arisen from a detailed investigation 6 3 GUIDANCE ON THE USE OF THE SAFETY LAYERS APPROACH FOR SPECIFIC TYPES OF EVENTS 6 3 1 Events involving failures in cooling systems during reactor shutdown Most reactor safety systems have been designed for coping with initiators occurring during power operation Events in hot shutdown or startup condition are quite similar to events in power operation and should be rated using Section 5 Once the reactor is shut down some of these safety systems are still required to assure the safety functions but usually more time is available On the
245. tually incurred However Level 2 would be appropriate under defence in depth if one or no safety layers remain and the maximum potential consequences should the safety provisions fail are Level 3 or 4 6 3 6 Interlocks on doors to shielded enclosures Inadvertent entry to normally shielded locations is generally prevented by the use of radiation activated interlocking systems on the entrance doors 118 the use of entry authorization procedures and pre entry checks on radiation dose rates Failure of the shield door interlocking protection can result from loss of electrical supply and or defects in either the detector s or the associated electronic equipment or human error As the maximum potential consequences for such events are limited to Level 4 events where a further failure in the safety provisions would result in an accident should be rated at Level 2 Events where some provisions have failed but additional safety layers remain including administrative arrange ments governing authorization for entry should generally be rated at Level 1 6 3 7 Failures of extract ventilation filtration and cleanup systems In facilities working with significant quantities of radioactive material there could be up to three separate but interrelated extract ventilation systems They maintain a pressure gradient between the various vessels cells glove boxes and operating areas as well as adequate flow rates through apertures in the cell operat
246. uences is given in Section 6 2 1 2 The basic rating should then be determined by taking account of the number and effectiveness of safety provisions available hardware and administrative In identifying the number and effectiveness of such 104 provisions it is important to take account of the time available and the time required for identifying and implementing appropriate corrective action Further guidance on the assessment of safety provisions is provided in Section 6 2 2 c The final rating should be determined by considering whether the basic rating should be increased because of additional factors as explained in Section 6 2 4 However the final rating must still remain within the upper limit of the defence in depth rating established in 1 Clearly as well as considering the event under defence in depth each event must also be considered against the criteria in Sections 2 and 3 6 2 DETAILED GUIDANCE FOR RATING EVENTS 6 2 1 Identification of maximum potential consequences As stated above the inventory of radioactive material and timescales of events at installations covered by INES vary widely The rating process identifies three categories of maximum potential consequences Levels 5 7 Levels 3 4 and Levels 1 2 In assessing the INES level for the maximum potential consequences the following general principles should be taken into account Any one site may contain a number of facilities with a range of tasks
247. unit was operating at nominal power During the routine testing of one diesel generator a failure of the diesel generator control system occurred The diesel was taken out of service for about six hours for maintenance and then returned to service The Technical Specifications require that if one diesel generator is taken out of service the other two safety system trains should be tested This testing was not carried out at the time Subsequently the other safety system trains were tested and shown to be available 91 Rating explanation Criteria Explanation 2 and 3 Actual consequences There were no actual consequences from the event 5 1 1 Initiator frequency There was no initiator The diesel generators were required for a loss of off site power expected 5 1 2 Safety function The operability was not less than the minimum allowed operability by OL amp C as two trains remained available The additional testing eventually carried out did show that two trains were available 5 1 3 and 5 1 4 Basic rating There was no real initiator From Section 5 1 4 box B 1 of Table 10 is appropriate giving a basic rating of Below scale Level 0 5 2 Additional factors Workers violated the Technical Specifications without justification so the event was uprated to Level 1 Final rating Level 1 Example 34 Plant design for flooding events may not mitigate the consequences of piping system failures Level 1 Event descri
248. v Rating explanation Criteria Explanation 2 3 Doses to individuals 4 2 1 Maximum potential consequences 4 2 2 Effectiveness of safety provisions Final rating Three people received doses greater than ten times the statutory annual whole body dose limit for workers One of these people suffered a health effect Both these aspects give a rating of Level 3 Twelve persons received doses higher than 10 mSv According to the dose received the rating is Level 2 and it should be uprated to Level 3 due to the number of persons affected The D value for Co is 0 03 TBq and the A D ratio is greater than 1000 i e it was a Category 1 source device The initial rating was made before the source was found Thus the event is a lost or stolen source device Using Table 6 the event would be rated at Level 3 Level 3 67 5 ASSESSMENT OF IMPACT ON DEFENCE IN DEPTH SPECIFICALLY FOR EVENTS AT POWER REACTORS WHILE AT POWER This section deals with those events where there are no actual conse quences but some of the safety provisions failed The deliberate inclusion of multiple provisions or barriers is termed defence in depth The concept of defence in depth is not explained in detail here as it will be familiar to the majority of those applying this manual to events at power reactors However Annex I does give some additional background material This section applies specifically to rating ev
249. valve on the reactor coolant system was disconnected from its remote control to allow it to be reseated thereby stopping the leak 88 Rating explanation Criteria Explanation 2 and 3 Actual consequences 5 1 1 Initiator frequency 5 1 2 Safety function operability 5 1 3 and 5 1 4 Basic rating 5 2 Additional factors Final rating There were no actual consequences from the event No real initiator occurred as the emergency core cooling safety systems were not challenged The initial leakage was controlled by the normal make up systems see Section 5 1 1 Had the leak developed into a small LOCA all the required safety systems were fully available There was no real initiator From Section 5 1 4 row A of Table 10 is appropriate giving a basic rating on Below scale Level 0 Using the guidance in Section 5 1 5 had the leak worsened with no action by operating personnel it would have led to a small LOCA frequency possible From Box A 2 of Table 9 the rating of the potential event would have been Level 1 As the likelihood of the potential event is low the rating should be reduced to Level 0 The spurious initiator of containment isolation caused operating difficulties and gave misleading information For these reasons the event was uprated to Level 1 see Section 5 2 1 Level 1 Example 31 Fuel assembly drop during refuelling Level 1 Event description After lifting a new fue
250. ve pressure differential in the laboratory This led to airborne contamination with Cs of the laboratory and a conduit connected to the laboratory The event resulted in low doses lt 1 mSv to both workers and members of the public Measurements showed that the quantity of activity spread within the facility was approximately 3 4 GBq of Cs and that the quantity of activity released to the environment through the ventilation system was approximately 1 10 GBq Rating explanation Criteria Explanation 2 2 Activity released Based on Table 2 1 10GBgq of Cs is radiologically equivalent to 40 400GBgq J which is much less than the value for rating under the release criteria of tens to hundreds of terabecquerels of I 2 3 Doses to individuals All doses are less than 1 mSv so rating based on individual doses is Level 0 3 2 Radiological barriers and Based on Table 4 airborne release of 4 GBq of Cs controls at facilities is radiologically equivalent to 2 4 GBq I which is much less than the value for rating under the contamination spread criterion of a few tens of gigabecquerels of 1 Rating for actual consequences Below Scale Level 0 36 Example 9 Fuel damage at a reactor Below Scale Level 0 Event description During reactor operation a slight increase in coolant activity was detected indicating that some minor damage to the fuel was occurring However the level was such that continued opera
251. vel on the scale Level 7 equivalent to more than several tens of thousands of TBq I Although other isotopes would have been present there is no need to include them in the calculation as the isotopes listed are already equivalent to a Level 7 release Not necessary to consider as event is already rated at Level 7 Level 7 29 3 IMPACT ON RADIOLOGICAL BARRIERS AND CONTROLS AT FACILITIES 3 1 GENERAL DESCRIPTION The guidance in this section is only applicable to events within authorized facilities where a site boundary is clearly defined as part of their licensing It is only applicable at major facilities where there is the potential however unlikely for a release of radioactive material that could be rated at Level 5 or above Every event needs to be considered against the criteria for impact on people and the environment and the criteria for impact on defence in depth and it could be argued that those two sets of criteria cover all the issues that need to be addressed in rating an event However if this were done then two key types of events would not be rated at a level appropriate to their significance The first type of event is where significant damage occurs to the primary barriers preventing a large release e g a reactor core melt or loss of confinement of very large quantities of radioactive material at a nuclear fuel reprocessing facility In this type of event the principle design protection has fa
252. vious section events should be rated using the following procedure 1 Identify the initiator that has occurred 2 Determine the category of frequency allocated to that initiator In deciding the appropriate category it is the frequency that was assumed in the safety case the justification of the safety of the plant and its operating envelope for the plant that is relevant 3 Determine the category of operability of the safety functions challenged by the initiator a It is important that only those safety functions challenged by the initiator are considered If the degradation of other safety systems is discovered it should be assessed using the section on events without a real initiator in Section 5 1 4 using the initiator that would have challenged that safety system b In deciding whether the operability is within OL amp C it is the operability requirements prior to the event that must be considered not those that apply during the event c If the operability is within OL amp C but also just adequate operability category C should be used as there is no additional redundancy see earlier paragraphs in this section 4 The event rating should then be determined from Table 9 Where a choice of rating is given the choice should be based on the extent of redundancy and diversity available for the initiator being considered a If the safety function operability is just adequate i e one further failure would have lead to
253. waste storage tank in a reprocessing facility Level 6 essees Major release of activity following criticality accident AMG MNCS VOLT soassstecstecaseactyis E Event at a laboratory producing radioactive sources Below scale Level On cccsssccecsccnssenssnsessosesencstesnssersapecacvecvexosense Fuel damage at a reactor Below Scale Level 0 0 0 0 Spillage of plutonium contaminated liquid onto a laboratory floor Level 2 0 eeseeesseeeeeeeeceeeeeeeeeeeeeeseeeens Plutonium uptake at a reprocessing facility Level 2 Evacuation near a nuclear facility Level 4 eee Reactor core melt Level 5 0 eee eeeeeeeneeeeeeeeee Detachment and recovery of an industrial radiography source Below scale Level 0 wo scee sess eesseeeseeeeeeeeees Derailment of a train carrying spent fuel IBElOW SCale LeVel Ovicsschesscccssssesseseisedesseetesdassssnestsesstesedecasstdveshses Package damaged by forklift Below scale Level 0 Stolen industrial radiography source Level 1 Various radioactive sources found in scrap metal Do OUD cas casiesscie seve stexeenscssveapesieseis nkan EA saben svaesseansivaners Loss of a density gauge Level 1 oo eeeseeeeteeeereeeeeeeenees Radioactive source stolen during transport Level 1 Spillage of radioactive material in a nuclear medicine department Level Lirska a aa ais Train collision with radioactive material packages a E S a A E A E R A axe aae
254. were quickly identified and residents evacuated As a result of the event eight people developed acute radiation syndrome and four people died from radiation exposure Rating explanation Criteria Explanation 2 2 Activity released The source was broken up and therefore the bulk of the activity was released into the environment The D value for Cs from Appendix III is 20 TBq so the release was about 2 5 times the D value which is well below the value for Level 4 greater than 250 times the D value 2 3 Doses to individuals A single death from radiation would be rated at Level 4 Because four people died the rating should be increased by one Rating for impact on people Level 5 and the environment Example 5 Iodine 131 release from reactor Level 5 Event description The graphite moderator of an air cooled plutonium production reactor had a fire which resulted in a significant release of radioactive material The fire started during the process of annealing the graphite structure During normal operation neutrons striking the graphite result in distortion of the crystal structure of the graphite This distortion results in a buildup of stored energy in the graphite A controlled heating annealing process was used to restore the graphite structure and release the stored energy Unfortunately in this case excessive energy was released resulting in fuel damage The metallic uranium fuel and the graphite then
255. wtensormore 6 the likely occurrence of a lethal deterministic effect Between severd and a as a resut of a whole body absorbed dose of the fewtens order of a fewGy Less than several 4 Fewtensormore S The occurrence or likely occurrence of a non4ethal m y detenninistic effect fewtens Lessthanseveral 3 100 ormore 5 Exposure leading to an effective dose greater than 0omore 4 ten times the statutory annual whole body dose limit for workers tesieni ten Exposure of a member of the public leading to an mamn effective dose in excess of 10 mSv or exposure J i0ormore 3 a worker in excess of statutory annual dose limits 2 Hia than ten E Exposure of a member of the public in excess of f moe statutory annual limits or Exposure of a worker in excess of dose constraints Less than ten E Cumulative exposure of workers or members ofthe public in excess of statutory annual dose limits Figure 4 1 or more Box 1 Below Scale Level 0 These criteria relate to accidents where early estimates of the size of release can only be approximate For this reason it is inappropriate to use precise numerical values in the definitions of the levels However in order to help ensure consistent interpretation of these criteria internationally it is suggested that the boundaries between the levels are about 5000 and 50 000 TBq 1311 t Tt is also necessary to consider whether a h
256. y when undertaking activities or in relation to any nuclear facilities or sources of ionizing radiation This includes inter alia private individuals governmental bodies consignors or carriers licensees hospitals self employed persons 16 188 Note Operator includes either those who are directly in control of a facility or an activity during use of a source such as radiographers or carriers or in the case of a source not under control such as a lost or illicitly removed source or a re entering satellite those who were responsible for the source before control over it was lost Note Synonymous with operating organization orphan source A radioactive source that is not under regulatory control either because it has never been under regulatory control or because it has been abandoned lost misplaced stolen or otherwise transferred without proper authorization 19 package The packaging with its radioactive contents as presented for transport There are several types of packages 1 Excepted package 2 Industrial package Type 1 Type IP 1 3 Industrial package Type 2 Type IP 2 4 Industrial package Type 3 Type IP 3 5 Type A package 6 Type B U package 7 Type B M package 8 Type C package The detailed specifications and requirements for each package type are specified in the Transport Regulations 6 practice Any human activity that introduces additional sources of exposure or additio

INES User's Manual

Contents

Download Pdf Manuals

Related Search

Related Contents