Annals of Nuclear Energy 43 (2012) 123–130

Contents lists available at SciVerse ScienceDirect

Annals of Nuclear Energy

journal homepage: www.elsevier .com/locate /anucene

Probabilistic safety assessment for food irradiation facility

R.B. Solanki ⇑, M. Prasad, A.U. Sonawane, S.K. GuptaAtomic Energy Regulatory Board, Niyamak Bhavan, Anushaktinagar, Mumbai 400 094, India

a r t i c l e i n f o a b s t r a c t

Article history:Received 29 September 2011Received in revised form 4 January 2012Accepted 7 January 2012Available online 4 February 2012

Keywords:Probabilistic safety assessmentNon-Reactor Nuclear FacilitiesFood irradiation facilitySafety evaluationSafety culture

0306-4549/$ - see front matter � 2012 Elsevier Ltd. Adoi:10.1016/j.anucene.2012.01.002

⇑ Corresponding author. Address: Safety Analysis aAtomic Energy Regulatory Board, Niyamak Bhavan-B,094, India. Tel.: +91 22 25990459; fax: +91 22 25990

E-mail addresses: rajsolanki@aerb.gov.in (R.B. So(M. Prasad), ausonawane@aerb.gov.in (A.U. Sona(S.K. Gupta).

Probabilistic safety assessment (PSA) is widely used for safety evaluation of Nuclear Power Plants (NPPs)worldwide. The approaches and methodologies are matured and general consensus exists on using theseapproaches in PSA applications. However, PSA applications for safety evaluation for non-reactor facilitiesare limited. Due to differences in the processes in nuclear reactor facilities and non-reactor facilities, theconsiderations are different in application of PSA to these facilities. The food irradiation facilities utilizegamma irradiation sources, X-ray machines and electron accelerators for the purpose of radiation pro-cessing of variety of food items. This is categorized as Non-Reactor Nuclear Facility. In this paper, theapplication of PSA to safety evaluation of food irradiation facility is presented considering the ‘fatalitydue to radiation overexposure’ as a risk measure. The results indicate that the frequency of the fatal expo-sure is below the numerical acceptance guidance for the risk to the individual. Further, it is found that theoverall risk to the over exposure can be reduced by providing the adequate operator training and observ-ing good safety culture.

� 2012 Elsevier Ltd. All rights reserved.

1. Introduction

The safety evaluation for Nuclear Power Plants (NPPs) is carriedout using both deterministic and probabilistic methods. The gen-eral design principles, safety objectives and other guidance docu-ments are available in literature for nuclear reactor basedfacilities and hence the approaches and methodology for safetyevaluation has matured. International experience shows that thepractices and methodologies used to perform safety assessmentsand periodic safety re-assessment for Non-Reactor Nuclear Facili-ties (NRNFs) differs significantly from county to country. Manycountries have different types of nuclear facilities. Hence, thegeneral consensus for the safety evaluation of NRNFs has not beenreached. Typically the safety evaluation for the facility is based on acase-by-case assessment as suggested by Adrian et al. (2000).

NRNFs differ from nuclear reactor based plants (i.e. NPPs) inseveral important aspects. NRNFs employ a greater diversity oftechnologies and processes. Fissile material and wastes in NRNFsare handled, processed, treated, and stored throughout the nuclearinstallations. The operations and processes in the NRNFs are morefrequently changed due to new product development, research anddevelopment, and continuous improvement in process perfor-mance. The range of hazards in some NRNFs can include

ll rights reserved.

nd Documentation Division,Anushaktinagar, Mumbai 400499.lanki), mprasad@aerb.gov.inwane), guptask@aerb.gov.in

inadvertent criticality events, and these events can occur in differ-ent locations, and in association with different operations. Due tothese differences, the PSA approach would be different than thosenormally adopted for NPPs. Major differences in these PSAs are asgiven below:

(a) No differentiation is made between Level-1, 2 and 3 PSA asdone for NPPs.

(b) The initiating events tend to be much simpler. These initiat-ing events are more varied in nature; hence grouping isdifficult as done in PSAs for NPP. The generic initiating eventlist is also not available due to such differences.

(c) The dominant hazardous source(s) in NRNFs can be widelydistributed throughout the installations unlike NPPs, wherethe hazardous source is very centralized (i.e. reactor coreor spent fuel storages).

(d) The fault trees are much simpler than that of NPPs.

The radiation processing technology is increasingly being usedworldwide as a proven and effective method for preservation offood products. The irradiation facilities utilize gamma irradiationsources, X-ray machines and electron accelerators for the purposeof radiation processing of variety of food items such as spices,onion, potato, rice and mangoes. The food irradiation facilitiesare categorized under Non-Reactor Nuclear Facilities (NRNFs).The typical Co-60 based food irradiation facility is considered inthe present analysis. The brief description of the facility is givenin Section 2. The procedural steps for carrying out PSA for this facil-ity and the PSA results have been presented in this paper.

124 R.B. Solanki et al. / Annals of Nuclear Energy 43 (2012) 123–130

2. Description of the food irradiation facility

The food irradiation facility uses Co-60 gamma source for thepurpose of exposing the food material to radiation to increase shelflife. The source is kept in a pool of water and is brought out of thewater for food irradiation. The source and water pool is in aconcrete cell. Fig. 1 shows the typical layout of a food irradiationfacility. There are two entries to the cell, one by main door and an-other by product door through which food material is moved intothe cell. The food materials are moved into the cell in metallic con-tainers (product boxes) via a system of conveyor. The product boxcarriers, suspended on roller trolleys from fixed hoists, are drivenalong straight sections of track by projecting arms attached tothe chain conveyor. Each carrier has two shelves on which theproduct boxes are carried round the cell. The product boxes occupytop and the bottom shelf in two rounds into the cell and each prod-uct box receives equal radiation dose. The product door is keptopen during the time the process of transfer of boxes occurs inthe carrier takes place.

The cell is constructed of concrete and access to its interior isvia a labyrinth and a hinged steel personnel entry door. The per-sonnel entry door is provided with mechanical, electrical, hydrau-lic, radiation as well as water level interlocks. Mechanical Interlockensures that the door cannot be opened when the source is in theraised position. If the source is in shielded position, it ensures thatthe source cannot be raised when the door is open, even if thesource raise hydraulic cylinder gets pressurized. Electrical Inter-lock ensures that the source cannot be raised when the personnelentry door is open. In addition, it brings down the source in casethe door is opened accidentally or otherwise, when the source isin the exposed position. Hydraulic Interlock cuts off the oil supplyto the cylinder responsible for raising the source to ‘‘exposed’’ con-dition, when the door is open, thus inhibiting the raising of thesource. If the radiation level exceeds 2.0 mR/h in the labyrinth/radiation zone when the source is in shield/transit condition thenthe plunger of door locking solenoid is programmed to drop intothe slot of the mechanical latch bar thus disabling the opening ofthe door as long as the radiation level is above 2.0 mR/h.

Fig. 1. Typical layout of the

The radiation source is kept deep under the de-mineralized(DM) water (up to 6 m) when not used. The DM plant maintainssafe water level and electrical conductivity of the pool water. Theplant consists of two water pumps, cation and anion exchange col-umns, electrically operated solenoid valves and water conductivitymonitor. Water from municipal supply system, before entering thepool, passes through the DM unit to buffer storage tank. An over-head tank is provided to store the municipal water as reserve.Fig. 2 shows the schematic of pool water supply system. The waterlevel in the pool is monitored and controlled through a program-mable logic controller (PLC). When the water level reaches belowcertain minimum level, entry into radiation room is prevented bya solenoid plunger dropping into a slot in the latch bar meant forlocking the personnel entry door. An audio-visual alarm is alsoactivated under this condition.

Several interlocks are also provided at the product door. A metalplate has been designed and strategically located to prevent entryof personnel into the cell via product door. It is impossible for anyone trying to proceed towards the radiation room to negotiate thisplate without stepping on to it. When anyone steps over, it gets de-pressed and actuates a series of limit switches. Four limits switchesare provided with this plate. When any one plate switch actuates,it will send the signal to the control system logic for lowering thesource.

3. Procedure for application of PSA for Non-Reactor NuclearFacility

The step-wise procedure for application of PSA for Non-ReactorNuclear Facility can be given as indicated below:

Step 1: For PSA for food irradiation facilities, the risk measurecan be considered in the form of ‘‘fatal death due to over expo-sure’’ of personnel working in the irradiation facilities. Thepotential exposure of the personnel can be anticipated as aresult of equipment failure, departures from planned operatingprocedures that lead to accidents. Such over exposures can be inexcess of limits set by regulatory agencies however; they do not

food irradiation facility.

Main Line Water Pool

Pump-A Pump-B

SV-1

V-1

V-2

NRV

Anion & cat ion Beds

Path-2

Path-1

JN-X SV-4

SV-2

V-6 H-1

H-2

SV-3

NRV-3

Storage tank

V-3

Fig. 2. Schematic of pool water supply system.

Operator enters the radiation room

Source is kept in the ‘shielded’ condition

Trip wire action successful

Pool water level is maintained at ‘safe’ level

Frequency Consequence

ENTRY IN RR SOURCE SHIELDED

TRIP WIRE POOL WATER LEVEL

1.32E+03

4.77E-08

2.45E-14

8.88E-25

2.45E-18

Safe

Unsafe

Safe

Unsafe

Unsafe

Fig. 3. Operator enters the radiation room.

Source is in “Exposed” condition

Operators entry prevented into RR through personnel door

Mechanical Latch Bar prevents entry

‘Source lower’ action successful to prevent exposure to operator

Frequency Consequence

SOURCE EXPOSED-1

ENTRY IN RR – PL DR

LATCH BAR

SOURCE LOWER - PL

1.16E+03

1.16E-01

3.48E-05

1.06E-13

Safe

Safe

Safe

Unsafe

Fig. 4. Source is exposed and operator enters in RR through personnel door.

R.B. Solanki et al. / Annals of Nuclear Energy 43 (2012) 123–130 125

Source is in “Exposed” condition

Operators entry prevented into RR through product door

‘Source lower’ action successful to prevent exposure to operator

Frequency Consequence

SOURCE EXPOSED-2

ENTRY IN RR – PT DR SOURCE LOWER - PT

1.16E+03

1.16E-01

3.78E-07

Safe

Safe

Unsafe

Fig. 5. Source is exposed and operator enters in RR through product door.

Fig. 6. Fault tree for ‘‘Safe water level is not maintained in the water pool’’.

126 R.B. Solanki et al. / Annals of Nuclear Energy 43 (2012) 123–130

necessarily lead to fatalities. In the present analysis, only theover exposure resulting into fatality is considered.Step 2: The analysis team should get familiar with the facility tobe analyzed, and should collect the required information forcarrying out PSA. The potential ways of radiation exposureand the initiating events that could result in such exposuresare also determined in this step.Step 3: In this step, the safety measures and features incorpo-rated in the facility that could be challenged by the initiating

events are identified. The necessary details (i.e. component reli-ability data, operating procedures, test and maintenance data,etc.) for fault tree (FT) modeling of these safety systems needto be obtained. Using this information, FT models aredeveloped.Step 4: Actions performed by operators need to be identifiedand Human Error Probabilities (HEPs) for these actions needto be evaluated and integrated in FTs or in the event trees(ETs), which are discussed in Step 5.

Fig. 7. Fault tree for ‘source raise’ not prevented.

R.B. Solanki et al. / Annals of Nuclear Energy 43 (2012) 123–130 127

Step 5: The fourth procedural step deals with the developmentof accident sequences using ETs, which are the combination ofinitiating event and failure of relevant safety measures.Depending upon the success and failure of the mitigationmeasures, the end states of the accident sequences can beassigned as ‘OK’ or with some undesirable consequences.Step 6: In the final step the risk for fatal death due to over expo-sure needs to be estimated.

4. PSA for food irradiation facility

The PSA study has been carried out applying the methodologydescribed in the previous section to food irradiation facility. Themajor procedural and modeling aspects and the analysis resultsare brought out in this section.

4.1. Identification of the risk measure

For PSA of NPPs, the risk measure can be defined as Core Dam-age Frequency (CDF), Large Early Release Frequency (LERF) andhealth risk to the public for Level-1, Level-2 and Level-3 PSA stud-ies respectively. There is no differentiation between the Level 1,Level 2 or Level 3 PSAs for food irradiation facility. Instead, the risk

measure can be considered in the form of ‘‘fatal death due to po-tential over exposure’’ of personnel working in the irradiation facil-ities. The potential exposure of the personnel can be anticipated asa result of equipment failure, departures from planned operatingprocedures that lead to accidents. The human health risk is theresult of two random events: first, the occurrence of the event thatcauses over exposure, and second, the appearance of harmful ef-fects. In the present study, the likelihood of the scenarios for overexposure is calculated. Considering the high strength of the radia-tion source used in the food irradiation facility, the death of aperson is certain if exposed.

4.2. Identification of initiating events

There are various possible ways by which personnel can get ex-posed to the radiation source. These can be as described below:

� The radiation source is unshielded and operator enters the‘‘Radiation Room’’ via personnel entry door.� The radiation source is unshielded and operator enters the

‘‘Radiation Room’’ via product entry door.� Person is inside the ‘‘Radiation Room’’ and the source moves out

from the shielded position.

Fig. 8. Fault tree for ‘‘Source lower’’ action failure when operator tries to enter theRR via personnel door

128 R.B. Solanki et al. / Annals of Nuclear Energy 43 (2012) 123–130

� Person is inside the ‘‘Radiation Room’’ and the source poolwater gets drained out, which causes direct exposure of person-nel to the radiation source.

Fig. 9. Fault tree for ‘‘Source lower’’ action failure whe

4.3. Event sequence analysis

Irradiation Plant has been provided with safety features andinterlocks to ensure adequate protection for the personnel workingin the plant against harmful effects of radiation. Operating manualprovides the safe procedures for handling normal and abnormaloperating conditions. However, there could be scenarios wherethese multiple safety barriers/interlocks may fail and personnelmay be subjected to fatal radiation dose. The likelihood of suchscenarios is analyzed in the PSA by event sequence analysis. Inthe present study, event trees are used for event sequence analysisdepicting two scenarios.

In the first scenario, operator enters into radiation room for rou-tine maintenance work or during emergency trip conditions. Thereare two ways by which the operator may be exposed to fatal radi-ation dose: (i) ‘‘radiation source’’ can inadvertently be raised fromits shielded position (i.e. from the pool water) and (ii) water levelmay drop below the emergency level (i.e. 450 mm below groundlevel). This event scenario is modeled in Fig. 3.

Initiating event frequency has been calculated based on plantoperating experience. The following assumptions are made:

1. Irradiation Plant is operating with 90% availability factor.2. There are 4 entries into the radiation room per day.3. Duration of operator remaining in the radiation room is 0.5 h.4. 50% of the time operator remains inside the radiation room dur-

ing the annual shutdown.

Hence, the operator entry in radiation room/year = (4 � 365 �0.90) + 1 = 1315

Various safety interlocks are provided to prevent the operatorentry into radiation room when source is in exposed conditions.However, the scenario have been postulated in the study that thesesafety interlocks may fail or ‘‘bypassed’’ by an operator based onthe events taken place at irradiation facilities worldwide. The sec-ond scenario is sub-divided in two parts. In the first part, thesource is raised to exposed condition inside the radiation room

n operator tries to enter the RR via product door.

Table 1Component failure data used in the analysis.

Sr.No.

Componentname

Failure mode Failure data Source

Failurerate (/h)

Failureprobability

1 Relays Fails toremain open

8.0E�08 IEEE500

2 Electricalinterlock

Fails tofunction

3.0E�04 TECDOC478

3 Hydraulicinterlock

Fails toremain close

2.6E�06 TECDOC478

4 Radiationinterlock

Fails tofunction

1.0E�04 TECDOC478

5 Valve Fails to open 1.0E�04 TECDOC4786 PLC PLC failure 4.9E�06 TECDOC4787 Pressure

PlateFails tofunction

1.0E�04 TECDOC478

8 Pumps Fails to run 7.1E�06 TECDOC4789 Pumps Fails to start 4.7E�03 TECDOC47810 Solenoid

valveFails to open 1.6E�06 IEEE500

11 Water levelswitch

Fails tofunction

3.0E�08 TECDOC478

12 Tank Tank rupture 2.6E�08 TECDOC47813 Pipe Pipe rupture 1.0E�10 TECDOC478

Table 2Results of PSA for Food irradiation Facility.

Sr.no.

Minimal cut set Relativecontribution toexposure risk (%)

1 (Source exposed) � (Operator tries to enterthrough product door) � (emergency trip relayfails to function)

43.61

2 (Source exposed) � (Operator tries to enterthrough product door) � (emergency trip relayactuation relay fails to function)

43.61

3 (Entry in the radiation room) � (main tankrupture) � (water pool rupture)

8.94

4 (Source exposed) � (Operator tries to enterthrough product door) � (Common cause failureof pressure switches)

2.76

5 (Entry in the radiation room) � (main tank 0.89

(continued on next page)

R.B. Solanki et al. / Annals of Nuclear Energy 43 (2012) 123–130 129

for the food irradiation and operator tries to enter in the radiationroom through personnel door. This event scenario is modeled inFig. 4.

In the second part, the source is raised to exposed condition in-side the radiation room for the food irradiation and operator triesto enter in the radiation room through product door. This eventscenario is modeled in Fig. 5.

4.4. System reliability analyses

Four mitigation measures are identified during the event se-quence analysis in order to avoid the operator over exposure tothe radiation. The fault tree analysis has been carried out for thesefour mitigation measures using the Risk Spectrum computer codeVersion 2.1. The fault trees are developed for:

1. ‘‘Safe water level is not maintained in the water pool’’

This situation can arise when there is a leakage the water pooland make-up water system fails. This scenario is developed furtherthrough fault tree analysis technique. The major fault tree blocksare shown in Fig. 6.

1. ‘‘Source raise’’ is not prevented when operator is inside the radi-ation room

This situation can arise in two conditions namely: (i) ‘Sourceraise’ conditions satisfied when hydraulic solenoid valve failureand (ii) ‘Source raise’ conditions satisfied when hydraulic solenoidvalve remains healthy. Both of these conditions are developed inthe fault tree as shown in Fig. 7.

1. ‘‘Source lower’’ action failure when operator tries to enter theRR via personnel door

This situation can arise due to failure of ‘Figure Key’ interlockfailure or failure of other safety interlocks. The fault tree for thisevent is shown in Fig. 8.

1. ‘‘Source lower’’ action failure when operator tries to enter theRR via product door

This situation can arise due to failure of ‘emergency trip’ circuitor failure of pressure plates. The fault tree for this event is shown inFig. 9.

Common cause failures (CCFs) among the redundant compo-nents have been considered in the reliability analysis. The ‘betafactor’ CCF model has been used in the analysis. In the presentPSA analysis, human errors are considered wherever appropriateand screening values have been used as basic human error proba-bility for the preliminary analysis. In the present PSA study, genericcomponent data have been used for different component as recom-mended by Babar et al. (2006) and a technical document preparedby Tomic and Lederman (1988). The failure data for the major com-ponents have been given in Table 1. Initiating event frequencieshave been calculated based on plant operating experience.

4.5. Analysis results

The total frequency of the fatal exposure is estimated to be4.76E�07/year. The major contributors to the over exposure isthe minimal cut sets as given in Table 2.

The food irradiator facility uses very high radiation source andfatal death is certain if person gets an over exposure during theaccident scenario. The likelihood of death is considered as 1.0.The risk to the personnel (risk of the fatal death) is calculated asfollows:

Risk of the Fatal Death ¼ ðFrequency of potential exposureÞ� ðlikelihood of deathÞ

¼ ð4:764E� 07Þ � ð1:0Þ¼ 4:764E� 07=year

4.6. Discussion

The event scenario when the source is in exposed condition andoperator tries to enter the radiation room through the product doorcontributes to the risk of the fatal death to about 89%. The eventscenario when the operator is inside radiation room and pool waterlevel not maintained at safe level contributes to the risk of fataldeath to about 10.19%. The results are dominated by the operatorwillfully/inadvertently violating the operating procedure to enterthrough product door. The negligible contribution from the sce-nario of operator trying to enter through personal door indicatesthat sufficient interlocks are provided to prevent such actionswhen the ‘source’ is in ‘unshielded’ position. The overall risk tothe over exposure can be reduced by providing the adequate oper-ator training and observing good safety culture.

130 R.B. Solanki et al. / Annals of Nuclear Energy 43 (2012) 123–130

5. Conclusion

The likelihood of the over exposure has been estimated by car-rying out PSA for food irradiation facility. The analysis results showthat the risk of the fatal exposure is 4.76E�07/year. The numericalguidance (i.e. 1.0E�06/year) as suggested by Cunningham et al.(1997) indicates that the risk to an individual would be consideredas ‘acceptable’. The overall risk to the over exposure can be reducedby providing the adequate operator training and observing goodsafety culture.

Acknowledgment

We are thankful to Mr. Pravin Patil, RSD, AERB and the operat-ing staff of food irradiation facility under study for providing nec-essary information regarding the operation of the facility.

References

Adrian, H., Audet, M.C., Benito, M., Damon, D.R., Drake, S., Ferjecik, M., Ford, P.J.,Giannone, B., Gibson, I.K., Groche, K., Grozovosky, G., 2000. Procedure forConducting PSA for Non-Reactor Nuclear Facilities, TECDOC-1267, Vienna.

Babar, A.K., Hajra, P., Ghosh, A.K., Zende, P.G., Rao, V.V.V.S.S., Varde, P.V., Gupta, R.,Paul, U.K., Solanki, R.B., 2006. Compendium of Standard Generic ReliabilityDatabase for Probabilistic Safety Assessment of Nuclear Power Plants, AERB/NPP/TD/O-1, India.

Cunningham, R.E., Birkhofer, A., Cool, D.A., Gozalez, A.J., Hogberg, L., Winkler, B.C.,1997. Protection from Potential Exposures: Application to selected RadiationSources, ICRP Publication 64, Ottawa.

Tomic, B., Lederman, L., 1988. Component Reliability Database for use in PSA,TECDOC-478, Vienna.