ESS Target Safety System Design

The purpose of the Target Safety System (TSS) is to protect the public from exposure to unsafe levels of radiation, prevent the release of radioactive material beyond permissible limits, and bring the neutron spallation function into a safe state. In order to fulfill the necessary safety functions, the TSS continually monitors critical parameters within target station systems. If any parameter exceeds an acceptable level, the TSS actuates contactors to cut power to components at the front end of the accelerator and prevent the beam from reaching the target. The TSS is classified as a safety structure, system and component, relevant for the safety of the public and the environment. As such, it requires the highest level of rigor in design and quality for interlock systems at the ESS. Standards are applied to provide a guideline for building the TSS architecture and designing in resistance to single failures and common cause failures. This paper describes the system architecture and design of the TSS, including interfaces with target station and accelerator systems, and explains how the design complies with authority conditions and requirements imposed by development standards. TSS SAFETY FUNCTIONS The ESS target radiation safety functions were derived from the hazard and accidents analyses of target station systems and areas. A qualitative hazard analysis was performed to identify and evaluate potential radiological accidents, from which a collection of bounding events was selected for further analysis. The accident analysis detailed the identified accidents to determine the related level of risk. This involves quantification of severity, as measured by the dose consequences to both workers and the public, and definition of appropriate control actions to enable an acceptable level of risk. To mitigate consequences of the accidents, different functions were identified in different levels of defence in depth (DiD) for systems in the target station. Functions to be fulfilled by the TSS were identified in DiD level three. Depending on the level, different constraints shall be applied on the design in terms of conditions from SSM (Swedish Nuclear Safety Authority) and design guidance from applicable standards. Since the target contains a high inventory, many of the accident analyses address scenarios that could affect the target material or the helium cooling system. The most critical hazards tend to be related to increased temperature of the target wheel tungsten, which, if accompanied by oxidation of the tungsten and a loss of confinement, might have consequences of radiological releases. The following accident scenarios require TSS functions in order to prevent or mitigate the unacceptable consequences: AA1: Target wheel rotation stop during beam on target AA2: Proton beam events on target and proton beam window (non-rastered & focused beam) AA3: Loss of target wheel cooling during beam on target wheel In these accident scenarios, the increase of temperature in the target material leads to unacceptable radioactive material releases. Since the target is designed so that the decay heat can be dissipated by passive means, removing the beam removes the source of heat and puts the spallation process into the safe-state. The following safety functions are dedicated to the TSS. The TSS shall monitor process variables in the wheel, helium cooling, and monolith systems to identify if the: Target helium cooling outlet velocity is below a certain limit Target helium cooling outlet pressure is below a certain limit Target helium cooling inlet temperature is above a certain limit Target wheel rotational speed is below a certain limit Monolith atmosphere pressure is above a certain limit If any of the above conditions occur, the TSS shall bring the ESS spallation process to a safe-state (in terms of radioactive releases) by turning off the proton beam to prevent escalation of the situation. Figure 1 illustrates the location of the process variable monitored for radiation safety function. Figure 1: TSS process variables for safety functions. † atefeh.sadeghzadeh@esss.se 16th Int. Conf. on Accelerator and Large Experimental Control Systems ICALEPCS2017, Barcelona, Spain JACoW Publishing ISBN: 978-3-95450-193-9 doi:10.18429/JACoW-ICALEPCS2017-THPHA105