**5.15 Safety**

**5.15.1 Safety Philosophy and Requirements**

The safety philosophy for FIRE is to use a graded approach to the
mitigation of hazards. Since FIRE will utilize deuterium-tritium shots
to fulfill part of its operating mission; hazards associated with the
use of tritium and activation of materials from the 14 MeV fusion
neutrons must be considered. In addition, the toxicity of beryllium,
used as a plasma-facing component in FIRE, must also be addressed.

The DOE Fusion Safety Standard[^1] was developed in 1996 to enumerate
the safety requirements and to provide corresponding safety guidance
related to the hazards associated with next step D-T magnetic fusion
devices like FIRE. Furthermore, from a regulatory perspective, the
standard also establishes the design and operational envelopes for next
step fusion facilities. Given the pre-conceptual stage of FIRE design,
we have focused our efforts on implementing the safety-related design
requirements in the DOE Fusion Safety Standard that have the greatest
impact on public safety.

The highest level requirements in the Fusion Safety Standard stem from
DOE policy, namely:

-   The public shall be protected such that no individual bears
    significant additional risk to health and safety from the operation
    of those facilities above the risks to which members of the general
    population are normally exposed.

-   Fusion facility workers shall be protected such that the risks to
    which they are exposed at a fusion facility are no greater than
    those to which they would be exposed at a comparable industrial
    facility.

-   Risks both to the public and the workers shall be maintained as low
    as reasonably achievable (ALARA).

In addition to these requirements, two additional fusion-specific
requirements were developed:

-   The need for an off-site evacuation plan shall be avoided

-   Wastes, especially high-level radioactive wastes, shall be minimized

Radiological release targets for tritium, activated tungsten (e.g.
tokamak dust) and activated air and nitrogen have been established to
meet regulatory dose limits in the DOE fusion safety standard taking
into account the ALARA principle. The design targets are presented in
Table 5.15-1.

**Table 5.15-1.** Radiological Release Targets for FIRE

+------------------+--------------------+-------------+---------------+
|                  | Normal             | No          |               |
|                  | Operation^a^       | -evacuation |               |
|                  |                    | Limit       |               |
+------------------+--------------------+-------------+---------------+
| Dose Limit       | 0.1 mSv/yr         | 10 mSv (1   |               |
|                  |                    | rem) per    |               |
|                  | (10 mrem/yr)       | off normal  |               |
|                  |                    | event       |               |
+------------------+--------------------+-------------+---------------+
| Meteorology      | Yearly average     | Worst case  |               |
|                  |                    |             |               |
|                  |                    | Weather     |               |
+------------------+--------------------+-------------+---------------+
| Site Boundary    | 1 km               | 1 km        | 1 km          |
+------------------+--------------------+-------------+---------------+
| Release Point    | Elevated via 100 m | Ground      | Elevated      |
|                  | stack              |             |               |
|                  |                    |             | via 100 m     |
|                  |                    |             | stack         |
+------------------+--------------------+-------------+---------------+
| Tritium as HTO   | 8 g/a              | 13 g        | 130 g         |
+------------------+--------------------+-------------+---------------+
| Activated W dust | 5 kg/a             | 0.5 Mg      | 5.3 Mg        |
+------------------+--------------------+-------------+---------------+
| Ar-41            | 5 Ci/hr            | b           | b             |
+------------------+--------------------+-------------+---------------+
| N-13             | 8 Ci/hr            | b           | b             |
+------------------+--------------------+-------------+---------------+
| C-14             | 0.1 Ci/hr          | b           | b             |
+------------------+--------------------+-------------+---------------+

a.  Release targets have been reduced by a factor of \~ 10 relative to
    regulatory limits as an implementation of the ALARA principle.

b.  Not considered an accident hazard because of low inventory in FIRE

Values in Table 5.15-1 have become more restrictive than when the FIRE
project was initiated. This has occurred due to additional guidance from
DOE on emergency planning zone selection. DOE direction is now to use
conservative weather in dose calculations to determine the size of the
emergency planning zone, and to demonstrate that an evacuation plan in
not needed, we must also use conservative (worst-case) weather in the
dose calculations. This interpretation of the DOE guidance is described
more fully in a burning plasma experiment paper.[^2]

Radiological confinement is implemented as a key safety function to
ensure that the release targets are met and that the overall high-level
safety requirements are satisfied. Figure 5.15.1-1 gives a preliminary
sketch of confinement boundaries for FIRE. In the figure, volume A1 is
the vacuum vessel, and volume C1 is the cryostat.

![](media/image1.pct){width="3.1in" height="3.870833333333333in"}

**Figure 5.15.1-1**. Preliminary version of FIRE radiological
confinement boundaries.

Following the approach of the fusion safety standard, potential safety
concerns that could affect the radiological confinement safety function
are also examined to determine events that could lead to releases in
excess of the targets. In Section 5.15.2, the methodology used to
implement radiological confinement is discussed. The potential safety
concerns that could threaten radiological confinement are addressed in
Section 5.15.3. An interim safety assessment is provided in Section
5.15.4.

**5.15.2 Radiological Confinement**

Because of the use of tritium and the presence of activated materials in
FIRE, some degree of radiological confinement is needed to protect the
public and the workers at the facility. Our philosophy is to minimize
inventories of tritium and activated material where possible and to use
a graded approach in establishing the number of confinement barriers
needed for each system/component.

FIRE has as its goal to keep the total on-site tritium inventory below
30 g, so that it can be classified as a low hazard nuclear facility
based on current DOE hazard classification rules.[^3] Such a
classification allows the greatest flexibility in applying the graded
approach methodology in the management of hazards at the facility. We
propose to use the graded safety approach for confinement implementation
developed for ITER.[^4] Thus, mobilizable inventories in excess of 100 g
of tritium require at least two highly reliable (typical failure rate
less than 10-3 per demand) confinement barriers. Mobilizable
inventories, less than 1 g of tritium, require two barriers of moderate
reliability (typical failure rate less than 10-1 per demand).
Inventories between these extremes require at least one highly reliable
barrier and one barrier of moderate reliability. The confinement
barriers should be independent and as passive as possible with minimal
dependence on new components that cannot practically be tested in the
appropriate service environment before FIRE construction.

Table 5.15-2 provides a preliminary estimate of the radiological
inventories in the FIRE facility. Nightly regeneration of the vacuum
vessel cryopumps is expected; this will keep the vacuum vessel daily
inventory in the \< 2 g tritium range.[^5] Based on the tritium and
other in-vessel inventory values in Table 5.15-2, two confinement
barriers are needed. The vacuum vessel outer wall will be the highly
reliable primary confinement barrier for the in-vessel inventories. The
thermal shield will serve as a moderately reliable secondary barrier.
Double confinement (e.g., a combination of valves, windows or other
barriers of moderate reliability) will be implemented in all
penetrations attached to the FIRE vacuum vessel. In terms of the
ex-vessel inventories, two moderately reliable barriers (e.g., the
vessel, process piping, or component containing the inventory and a
glovebox or other secondary boundary) will be used. Acceptable leak
rates for these boundaries will be established as the design progresses,
in accordance with DOE tritium design guidance.[^6][^7]

**Table 5.15-2.** **Radionuclide Inventories in the FIRE Facility**

+-----------------------------------+----------------------------------+
| **Location**                      | **Tritium Inventory**            |
+-----------------------------------+----------------------------------+
| In-vessel                         |                                  |
+-----------------------------------+----------------------------------+
| -   Bred in Be                    | 0.02 g                           |
+-----------------------------------+----------------------------------+
| -   Cryopumps                     | \~ 2 g                           |
|                                   |                                  |
|                                   | (daily regeneration)             |
+-----------------------------------+----------------------------------+
| Ex-vessel                         | 13 g limit per system            |
+-----------------------------------+----------------------------------+
| -   Pellet injector               | TBD                              |
+-----------------------------------+----------------------------------+
| -   Tritium Cleanup               | TBD                              |
+-----------------------------------+----------------------------------+
| **Location**                      | **Activated Material Inventory** |
+-----------------------------------+----------------------------------+
| Torus                             | \< 200 kg of W dust              |
+-----------------------------------+----------------------------------+
| Inside cryostat                   | **5 pCi C-14/pulse^a^**          |
|                                   |                                  |
|                                   | **2.4 Ci N-13**                  |
+-----------------------------------+----------------------------------+
| Air outside cryostat              | **0.16 pCi C-14/pulse^a^**       |
|                                   |                                  |
|                                   | **0.5 µCi N-13**                 |
|                                   |                                  |
|                                   | **5.3 µCi Ar-41**                |
+-----------------------------------+----------------------------------+

a\. Even with 10000 pulses, the inventories would be only on the order
of tens of microcuries

**5.15.3 Potential Safety Concerns**

The DOE Fusion Safety StandardError: Reference source not found
identified five potential energy sources that could threaten the
confinement safety function:

a.  decay heat

b.  coolant internal energy

c.  plasma energy

d.  chemical energy and combustible gas generation, and

e.  magnet energy.

We are in the process of examining each of these potential energy
sources and their impact on the FIRE design.[^8] The MELCOR code was
used to analyze the consequences of loss of control of these energy
sources. These calculations are scoping in nature and detailed accident
event sequences with estimated probabilities have not yet been
developed.

MELCOR is being developed at the Sandia National Laboratory (SNLA) to
analyze severe accidents in fission reactors.[^9] MELCOR tracks the flow
of two-phase water during such accidents, as well as any radioactive
aerosols that may exist in either water phase. Structure temperatures
are determined by one-dimensional heat conduction equation solutions.
Heat transfer to both phases is considered. External (walls) or internal
(pipes) flow configurations are considered during forced, natural,
boiling, and condensation heat transfer modes. Modifications have been
made to MELCOR at the INEEL for fusion specific
analyses.[^10]^,^[^11]^,^[^12]^,^[^13]

To analyze these events, a MELCOR model was developed that includes the
in-vessel PFC components, the vacuum vessel, the toroidal field (TF)
magnets, and the thermal shield. A detailed description of this model
appears in the Appendix to this report. Cooling systems characteristics
for the divertor, baffles and VV were assumed for these analyses,
because design information for these cooling systems is not yet
available. Plasma heating of the PFCs (particle, nuclear and decay
heating) was included in this model as presented in Section 5.7. Heat
transfer from the back of the FW and inboard divertors is by radiative
heat transfer to the VV. The outboard divertor, and baffle cooling
system has a water inventory of 35 m^3^, pressure of 10 MPa, temperature
of 50°C, and a pump head of 0.8 MPa. This system provides coolant
through the divertor tubes at a velocity of 10 m/s, and through the
baffle tubes at 3 m/s.

The VV walls, shielding, and Solimide insulation were included in this
model. The nuclear heating of this structure is that given in Section
5.7. The VV cooling system model has an inventory of 24 m^3^, pressure
of 10 MPa, temperature of 100°C, and pump head of 0.27 MPa. This system
is a scaled down version (based on VV water inventory) of the model
developed for ITER, and provides a loop coolant inventory transit time
of about 250 s. In addition to this cooling, thermal radiation and
natural convection to the TF magnets was modeled.

If no heat were added to the water jetting into the vacuum vessel during
an in-vessel LOCA, the pressure would rise to that of the saturation
pressure at the divertor coolant temperature. For 50°C water this
pressure is only 0.0123 MPa. However, the PFC's of the vacuum vessel
will superheat this water, resulting in higher pressures. Based on tests
performed in the Japanese Ingress-of-Coolant (ICE) Experiments, it was
estimated that for FIRE the water impingement heat transfer coefficient
would be 20,000 W/m^2^-K over an area of 0.8 m^2^.[^14] This area was
assumed to be part of the inboard top divertor and outboard FW surface
areas. To simulate the temperature rise following a plasma disruption
produced by the injected water, 16 MJ of thermal energy was deposited on
the PFCs over a 100 ms period. The partitioning of this energy among the
PFCs was the same as that during a normal pulse.

We have examined the long-term thermal response of FIRE and the passive
decay heat removal capability of the design under a complete loss of
coolant condition. The safety concern is the mobilization of activated
PFC material by oxidation in air. It is assumed that following a FIRE
plasma pulse the coolant in the divertor and VV cooling systems is
completely lost. The only means of heat removal that remains is the
radial conduction and radiation of the decay heat to the environment.
Figure 5.15.3-1 contains temperatures from different radial locations in
FIRE for this event. The maximum temperature (inboard divertor) drops
from 900°C to 400°C within two hours after the pulse, and then steadily
drops to nearly ambient temperature by ten days. By ten days, the magnet
and thermal shield temperatures are still below ambient temperature.
Since the decay heat burden has dropped to about 0.5 kW by this time,
these temperatures are not likely to dramatically change beyond this
time. Given these results, decay heat is not a serious concern in FIRE
and long-term oxidation of the activated PFC surfaces will not be
significant.

![](media/image2.pct){width="2.946527777777778in"
height="2.5256944444444445in"}

**Figure 5.15.3-1.** Thermal response of FIRE due to decay heating under
complete loss of cooling.

The internal energy of the divertor coolant pose a potential
pressurization threat to the vacuum vessel (the primary confinement
boundary) if an in-vessel leak develops in this system, either because
of thermal fatigue, disruption erosion, and disruption forces. Thus,
in-vessel loss-of-coolant accident (LOCA) calculations have been
performed for the FIRE design. These accidents involve a break in the
divertor cooling system inside of the vacuum vessel (VV), allowing
coolant to jet into the VV. This coolant impinges on hot plasma facing
component (PFC) surfaces, producing VV pressurization in excess of the
coolant saturation pressure. The safety concerns are the possible
over-pressurization of the VV, and the production and possible
combustion of hydrogen produced by the chemical reaction of first wall
(FW) beryllium with the injected steam.

For divertor system breaks, the LOCA was assumed to occur at the end of
a plasma pulse when PFC temperatures were at a maximum. In addition,
this LOCA was assumed to induce a plasma disruption. The coolant was
allowed to impinge on the inboard divertor surface (a radiatively cooled
PFC) and on a portion of the outboard FW. Three different break sizes
were assumed: a single cooling tube, 10 cooling tubes, and 100 cooling
tubes. Figure 5.15.3-2 contains VV pressure for these events. As can be
seen, the VV pressure resulting from all three break sizes is fairly
similar for the first 1000 seconds. Beyond this time, the single tube
break continues to rise, reaching 0.19 MPa by 2000 s. The larger breaks
give a final pressure that is approximately 0.12 MPa. The reason for the
difference in final pressures is due to the amount of water that is
injected into the VV during these LOCAs. The water injection continues
until the pressure in the divertor cooling system equilibrates with that
inside the VV. For the 1, 10, and 100 tubes breaks, the amount of mass
injected into the VV is 3190 kg, 11,600 kg, and 18,050 kg, respectively,
while the injection time for these water masses were 1200 s, 830 s, and
180 s, respectively. Apparently the quantities of water injected into
the VV during the larger break LOCAs (e.g., the 10 and 100 tube break)
was enough mass to result in a lower final water temperature inside of
the VV, and thereby a lower final VV pressure.

There are two additional cooling systems that could pose a
pressurization risk for the VV, which are the FW and VV cooling systems.
Both of these systems are located in a low power load region of the
reactor and are not expected to produce coolant temperatures as high as
those of the divertor and baffle cooling system. Therefore, the maximum
pressure in the VV during in-vessel LOCAs is predicted to be slightly
below the 0.2 MPa design pressure of the VV and are not expected to
cause failure of this structure. However, these results are highly
dependent on design details of the heat transport systems, the designs
of which have yet to be completed. Therefore, a more detailed assessment
of VV pressurization will have to be performed once design information
of these cooling systems becomes available.

In all of the events examined thus far, because of the low VV steam
pressures and low FW temperatures, insignificant amounts of hydrogen are
generated from Be-steam and W-steam interactions (\~0.2 gm). Thus, the
chemical energy from these reactions does not threaten the radiological
confinement function of the vacuum vessel.

Another concern with hydrogen production is deflagration and/or
detonation upon mixing with air. Keeping the inventory of all hydrogenic
species below the deflagration limit for the FIRE plasma chamber and
extensions would reduce the threat to the radiological confinement
barrier. For the 35 m^3^ FIRE VV, the deflagration limit is 60 gmoles of
hydrogenic species. From the accident perspective, hydrogen from
Be/steam and W/steam reactions is not the concern, however the tritium
on the cryopumps must be controlled. The 30 gmoles translates into a
deflagration limit of \~ 300 g DT. Regeneration will be scheduled
frequently enough to stay well below this
limit.![](media/image3.pct){width="3.0625in" height="2.625in"}

We have not yet fully examined the control of plasma energy, magnet
energy, loss of vacuum accident (LOVA) events, or potential
cryogen/water interactions as means of challenging the radiological
confinement of the vacuum vessel. These events will be examined as the
design evolves.

The metal dust inventories have been estimated for the FIRE design to
support LOVA calculations. Some assumptions were made for this stage of
the design, but the dust mass estimates should be bounding values. The
lifetime tungsten dust inventory has been estimated to be 197 kg, and
the beryllium 7 kg. These estimates do not include vessel cleanings that
would occur for each of the two anticipated divertor changeouts.^5^
Radiologically, the tungsten dust estimate is less than half of the
radiological release limit to avoid an evacuation plan. The beryllium
does not activate to any great extent. Regarding chemical toxicity, the
beryllium and tungsten release concentrations are below the DOE
Temporary Emergency Exposure Limit-2; greatly less than the limit for
stacked releases and about a factor of 10 below for ground level
releases. Other dust safety issues are metal dust explosions and
chemical reactions. The beryllium inventory (\~0.2 kg/m^3^ of vacuum
vessel) is much less than the beryllium lower explosive limit of 3
kg/m^3^; there is no beryllium dust explosion concern. Tungsten dust
(5.6 kg/m^3^ of vacuum vessel) has had a few combustion experiments;
these experiments have test results that show the submicron dust is
weakly explosive, while larger micron dust (5 to 40 microns) is not
ignitable. From dust tests, the peak pressure obtainable from submicron
tungsten dust deflagration is 3.3 atmospheres. A peak force from a
0.5-micron tungsten dust deflagration would be 25 MN. The vessel handles
comparable force loads on the PFCs from plasma disruptions that occur
over much shorter time intervals; however, the FIRE vessel penetrations
must be analyzed for internal pressurization to verify leaktightness if
a dust deflagration were to occur. Chemical reactions may occur if a
dust explosion does not occur. Considering the reaction rates of
metal-air combustion, such as a dust layer fire, the thermal power
produced would be less than 17 MW; if this energy radiates to the vessel
walls the heat deposition is 0.2 MW/m^2^. This heat loading is similar
to low power FIRE pulse operation and does not pose safety concerns to
the vacuum vessel designed to accommodate 150 MW of fusion power.

**5.15.4 Interim Safety Assessment**

An interim assessment of the safety of FIRE has been made relative to
the project\'s release targets and the overall safety requirements of
the DOE Fusion Safety Standard.

Examination of the inventories in Table 5.15-2 and the release targets
in Table 5.15-1 indicates that none of the inventories in FIRE pose a
serious concern for normal/routine effluents from the facility.
Activated material inventories are orders of magnitude below the release
targets. For tritium, the yearly release limit of 8 g/a is easily
achievable given the modest inventories involved in FIRE and the current
state of the art in tritium technology.

For off-normal events, as long as any one releasable tritium inventory
remains below 13 g, then complete release of that inventory would not
threaten the ability of FIRE to meet the no-evacuation objective. The
tritium site inventory goal of \< 30 g is feasible, which would allow
FIRE to receive a low hazard category designation from DOE.

Implementation of the radiological confinement safety function is
consistent with the overall graded approach philosophy of the Fusion
Safety Standard. The use of multiple barriers improves the overall
ability of FIRE to ensure that the confinement safety function is
maintained over a broad range of conditions and is a good implementation
of the defense-in-depth nuclear safety philosophy.

Examination of the potential safety concerns associated with the
different energy sources in FIRE has not yet revealed any events that
pose a serious challenge to the radiological confinement function

In terms of radioactive waste generation, the low fluence of the FIRE
machine would allow all components to either be disposed of as low level
waste or recycled for other fusion experiments. The waste disposal
ratings of the vessel and magnet materials are all much less than 1.0,
as seen in Table 5.10-III, verifying that they are low level waste.
Table 5.10-IV gives the radioactive waste amounts for FIRE at
end-of-life, the total volume of waste from the FIRE vacuum vessel and
magnets is 95 m^3^. The two additional divertor changeouts add another
\~2 m^3^ of waste.

# REFERENCES

[^1]: [Safety of Magnetic Fusion Facilities: Requirements]{.underline},
    DOE STD 6002-96, US Department of Energy, May 1996.

[^2]: L. C. Cadwallader and D. A. Petti, "Safety in the Design of Three
    Burning Plasma Experiments," [Fusion Science and
    Technology]{.underline}, **44** (2003) 388-392.

[^3]: [Hazard Categorization and Accident Analysis Techniques for
    Compliance with DOE Order 5480.23, Nuclear Safety Analysis
    Reports]{.underline}, DOE STD 1027, US Department of Energy,
    December 1992.

[^4]: [Technical Basis for the ITER Final Design Report, Cost Review and
    Safety Analysis (FDR)]{.underline}, ITER EDA Documentation Series
    No. 16, IAEA, Vienna, 1998.

[^5]: D. M. Meade, "FIRE, a next step option for magnetic fusion,"
    [Fusion Engineering and Design]{.underline}, **63-64** (2002)
    531-540.

[^6]: [Tritium Handling and Safe Storage]{.underline}, DOE-HDBK-1129, US
    Department of Energy, March 1999.

[^7]: [Design Considerations]{.underline}, DOE-HDBK-1132, US Department
    of Energy, April 1999.

[^8]: D. A. Petti and B. J. Merrill, "Safety and Environmental
    Considerations in the Design of the Fusion Ignition Research
    Experiment," [Proceedings of the 18^th^ Symposium on Fusion
    Engineering (SOFE 99)]{.underline}, October 25-29, 1999,
    Albuquerque, NM, IEEE, New York, 1999, pages 479-483.

[^9]: R. M. Summers, et al., [MELCOR 1.8.0: A Computer Code for Severe
    Nuclear Reactor Accident Source Term and Risk Assessment
    Analyses]{.underline}, NUREG/CR-5531, Sandia National Laboratories
    report SAND-90-0364, January 1991.

[^10]: B. J. Merrill, [Initial Modifications to the MELCOR
    Code]{.underline}, ITER/US/95/TE/SA-18, US Home Team engineering
    design file, June 30, 1995.

[^11]: B. J. Merrill and D. L. Hagrman[,]{.underline} [MELCOR Aerosol
    Transport Module Modifications for NSSR-1]{.underline},
    ITER/US/96/TE/SA-03, US Home Team engineering design file, February
    21, 1996.

[^12]: R. L. Moore, [Documentation of New MELCOR Flow Boiling, EOS, and
    Diffusion Coefficient Subroutines]{.underline}, ITER/US/97/TE/SA-6,
    US Home Team engineering design file, April 24, 1997.

[^13]: B. J. Merrill, [An Enclosure Thermal Radiation Heat Transport
    Model for the MELCOR code]{.underline}, ITER/US/97/TE/SA-04, US Home
    Team engineering design file, January 31, 1997.

[^14]: H.-W. Bartels, editor, \"Accident Analysis Specifications for
    NSSR-2 (AAS),\" version 2, S 81 RI 19 97-05-04 W1.1, SEHD 8.1.C-1,
    ITER Joint Central Team, San Diego, May 6, 1997.