5. DESCRIPTION OF THE PRECLOSURE SAFETY ASSESSMENT
This section describes the analytical methods and summarizes the results of the preclosure safety assessment for a potential repository at Yucca Mountain. Section 5.1 describes how facilities and systems for the potential repository would use established commercial technologies and nuclear industry technologies to reduce the risk of Category 1 and Category 2 event sequences, since these technologies are well understood. Section 5.2 describes the approach used in assessing the preclosure operational safety of a potential repository at Yucca Mountain. It also discusses event identification, event sequence categorization, event sequence consequence analysis, use of features and controls important to radiological safety, and quality assurance classification. Section 5.3 provides a description of events and the results of consequence analyses and evaluations. Section 5.4 describes the testing and evaluation program planned for the potential repository's preclosure period.5.1 KNOWN TECHNOLOGY AND OPERATING SYSTEMS
A repository at Yucca Mountain would use commercial and nuclear industry technologies for preclosure construction and operations. The methods these technologies use to reduce the risk of event sequences are well understood. Over the past 50 years, large nuclear facilities have been designed, constructed, and operated by the commercial nuclear industry and the U.S. government. Incorporated into the design of these facilities are features and controls that prevent or reduce the consequences of accidents. The repository design draws upon this extensive experience and is based on proven technology in use at nuclear installations worldwide. For example, high-efficiency particulate air filters have been used for many years to reduce atmospheric emissions from nuclear facilities. Monitoring systems have also been used for many years to measure atmospheric effluents. Computer codes to estimate exposure from effluents have been developed and are widely used. The principles of radiation shielding are well known, and computer codes are available to aid in shielding design. The principles of time, distance, and shielding are used to keep radiation doses as low as is reasonably achievable (ALARA) (e.g., Health Physics Manual of Good Practices for Reducing Radiation Exposure to Levels that are As Low As is Reasonably Achievable [Munson et al. 1988]). Spent nuclear fuel transportation casks are routinely loaded and unloaded in the United States. Heavy loads are routinely moved by bridge cranes at nuclear facilities, as they would be at a repository at Yucca Mountain. Across the United States, commercial nuclear power reactors currently operate spent nuclear fuel pools. At all operating nuclear plants, handling spent nuclear fuel is a routine activity. For example, from 1968 to 1994, about 105,000 spent nuclear fuel assemblies were discharged from commercial nuclear power reactors (DOE 1996b, Table 5). The lessons learned from these experiences would be incorporated into the design and concept of operations for any repository.5.2 BASIC SAFETY ASSESSMENT METHOD
The two basic elements of any safety assessment are event identification and consequence analysis. The first element involves performing a systematic review of relevant site and facility features and processes in order to define the types of events that can occur. Events identified include the full range of probable events, from normal operational events that might occur to very low-probability events. Events are identified by first evaluating potential hazards applicable to the site and facility design, then developing a detailed site- and design-specific event scenario in which event sequences are defined and the anticipated frequency of occurrence of events is established. Based on the frequency of occurrence, events are categorized as Category 1 or Category 2 event sequences. Event sequences with lower frequencies of occurrence are considered beyond Category 1 and Category 2 event sequences and were not analyzed further. The second element of the safety assessment involves estimating the consequences of the event sequences that are identified as a Category 1 or Category 2 event sequences in the first process. The safety assessment performs an important role in the design process. It plays a key role in the identification of facility design features and controls important to safety and is a primary input to the quality assurance classification process. In some cases, alternative design approaches or additional design features may be identified based on safety assessment results, which are then considered as part of an iterative design process. Based on the insights and results obtained from the safety assessment, the acceptability of the design can be established.5.2.1 Event Identification Process
Events are identified based on a review of repository site characteristics, facility design features, and operational processes to be performed. An analysis of the internal and external hazards associated with preclosure operations is performed. Internal hazards are presented by the operation of the facility and associated processes. External hazards involve natural phenomena and outside man-made hazards, such as those posed by aircraft and nearby government or industrial facilities. The methodology used in the event identification analysis provides a systematic means to identify facility hazards and associated events that may result in radiological consequences to the public and workers during the repository preclosure period. The first step in the hazard identification process is to develop a list of generic internal and external events that could result in radiological consequences to the public or workers. This generic list is not facility-specific and attempts to identify potentially hazardous events by providing a comprehensive list of possible events. The generic lists developed for the internal and external hazard analyses are based on established hazard evaluation techniques (Stephans and Talso 1997; American Institute of Chemical Engineers 1992). Tables 5-1 and 5-2 list these generic internal and external events. Once the site characteristics, facility design, and operational processes are defined, they are evaluated against specified criteria to determine the credibility of generic hazard events that could result in radiological consequences. Event applicability criteria are developed for the generic events to support the applicability determination. If the criteria are satisfied, the generic event has the potential for a radiological consequence and is added to a list of specific initiating events to be considered in the design and safety analysis. The criteria used to determine the applicability of internal hazards as initiators of event sequences are listed below for each event category. Applicability to a functional area of design is determined by a positive response to all questions within a hazard category or subcategory, as appropriate:
10-2 per year and potentially allow more event sequences to be compared with the less restrictive Category 2 dose limits. After the operational phase, when the waste has been emplaced in the subsurface facility, the potential for internal and external events is still possible. Assuming a preclosure period of 325 years would lower the Category 1 cutoff to 3.1 10-3 per year and lower the Category 2 cutoff to 3.1 10-7 per year. However, it was determined that with a 325-year preclosure period, no new events would be included (BSC 2001f, Section 4.4.1.2.1). Note that Preliminary Preclosure Safety Assessment for Monitored Geologic Repository Site Recommendation (BSC 2001f) describes Category 1 and Category 2 design basis events. There is no difference between Category 1 and Category 2 design basis events and Category 1 and Category 2 event sequences.
5.2.2 Event Sequence Categorization Process
The result of the event sequence identification process is a list of event sequences with a corresponding frequency of occurrence. The frequency of occurrence for each event sequence is determined using fault tree analysis or data from historical events. The frequency of occurrence is usually expressed in terms of the chance of the particular event sequence occurring during facility operations, for example, "3 chances in 100 of occurring before permanent closure of the repository." In this example, if the repository operates for 100 years and the event sequence frequency is uniform over the entire period, it can be expressed as 0.0003 per year or 3.0 10-4 per year. Initially, when postulating the event sequence, no credit is given to design features that could prevent or mitigate the event (i.e., the most severe consequences are evaluated). If the radiation dose consequences of an event sequence are unacceptable, design features are added to prevent or mitigate the event.
Based on frequency of occurrence, event sequences are categorized as a Category 1 or Category 2 event sequence or beyond Category 1 and Category 2 event sequences, consistent with 10 CFR 63.2 (66 FR 55732). Category 1 event sequences are expected to occur one or more times before permanent closure. This is about equal to an annual frequency of one chance in one hundred (0.01 per year)1, based on a 100-year preclosure operational period (BSC 2001f, Section 4.4.1.2.1). Category 2 event sequences are other event sequences that have at least 1 chance in 10,000 of occurring before permanent closure. This is about equal to an annual frequency of one chance in one million (0.000001 per year), based on a 100-year preclosure operational period (BSC 2001f, Section 4.4.1.2.1). Event sequences that have less than 1 chance in 10,000 of occurring before permanent closure of the repository are considered beyond Category 1 and Category 2 event sequences. The consequences of some of these types of events are presented in Final Environmental Impact Statement for a Geologic Repository for the Disposal of Spent Nuclear Fuel and High-Level Radioactive Waste at Yucca Mountain, Nye County, Nevada (DOE 2002, Tables H-6 and H-7).
Event sequences are developed using event trees, which are diagrams that depict the chronological sequence of events. Figure 5-1 shows an example of a typical event tree used to define event sequences and quantify frequency of occurrence. In this example, Event Sequence 1 begins with an unsealed disposal container drop as the initiating event. The second event represents a breach of the spent nuclear fuel assembly. The last event in this branch represents a fully functional ventilation system and associated high-efficiency particulate air filtration. This event sequence has a frequency of 0.0084 per year, classifying it as a Category 2 event sequence. Event Sequence 2 represents a release scenario in which the ventilation system and the high-efficiency particulate air filtration system are nonfunctional. This event sequence has a frequency of 1.4 10-9 per year, which is considered to be a beyond Category 1 and Category 2 event sequence; this would be the case even if the probability of the high-efficiency particulate air filtration system not functioning were increased a hundredfold. Event Sequence 3, with zero probability, represents an unsealed disposal container drop that does not breach the enclosed spent nuclear fuel assemblies and does not result in a release.
As illustrated in Figure 5-1, the scenario development process involves the analysis of all facility features or controls that can affect the progression of an event sequence, including the effects of successful operation or failure of the heating, ventilation, and air conditioning systems with high-efficiency particulate air filters, where appropriate. Insights gained from evaluating the frequency and consequences of such failure sequences are especially useful as inputs to the design and quality assurance classification processes.
5.2.3 Event Sequence Consequence Analysis Process
Category 1 Event Sequences—Three sources are expected to contribute to the annual radiation dose to the public or repository workers from Category 1 event sequences during the facility's preclosure operational lifetime: (1) operational effluents from the Waste Handling Building, (2) operational effluents from the subsurface areas of the repository, and (3) event sequences anticipated to occur at a frequency of 0.01 per year or higher. Section 5.3.5.4.1 in Preliminary Preclosure Safety Assessment for the Monitored Geologic Repository Site Recommendation (BSC 2001f) describes the models used to estimate the radiation doses from Category 1 event sequences. Appendix A of Preliminary Preclosure Safety Assessment for the Monitored Geologic Repository Site Recommendation (BSC 2001f) considers the influence of flexible thermal operating modes with preclosure periods of up to 325 years on Category 1 event sequence selection. Category 2 Event Sequences—The radiation doses from Category 2 event sequences come from event sequences anticipated to occur with frequencies between 0.01 and 0.000001 per year. This frequency range assumes a 100-year preclosure period that is associated with the higher-temperature repository operating mode. The Category 2 event sequences all involve drops or collisions while handling fuel assemblies, disposal containers, and transportation casks. Section 5.3.5.4.2 in Preliminary Preclosure Safety Assessment for the Monitored Geologic Repository Site Recommendation (BSC 2001f) describes the models used to estimate the radiation doses from Category 2 event sequences. The influence on the selection of Category 2 event sequences of the flexible thermal operating modes with preclosure periods of up to 325 years is discussed in Appendix A of Preliminary Preclosure Safety Assessment for the Monitored Geologic Repository Site Recommendation (BSC 2001f). Several dosimetric quantities were calculated for Category 1 and Category 2 event sequences: (1) the total effective dose equivalent; (2) the radiation dose for various organs and tissues, such as the thyroid, lungs, and bone marrow; and (3) the radiation dose for the skin. Consistent with Standard Review Plan for Spent Fuel Dry Storage Facilities (NRC 2000a, Section 9.5.2.2), the sum of the skin dose equivalent and the total effective dose equivalent was used to indicate the lens of the eye dose.5.2.4 Use of Features and Controls Important to Radiological Safety
The repository design incorporates a combination of prevention and mitigation features and operational controls. Prevention is the use of design features to reduce the frequency of events that result in radiological release. Mitigation involves the use of design features to reduce the consequences of a postulated radiological release event sequences, and includes those features intended to reduce releases from routine operations that are included in the Category 1 event sequences annual dose summation. The safety assessment is used to identify preventive and mitigative features. The repository design emphasizes prevention features because prevention provides design and operational benefits. From an operations perspective, surveillance and maintenance of active safety features have been demonstrated to add to the operational complexity of existing nuclear facilities. Prevention features are incorporated in the design by performing the safety assessment as an integral part of the design process in a manner consistent with a performance-based, risk-informed philosophy. A risk-informed approach uses risk insights, engineering analysis and judgment, and equipment performance history to focus attention on the most important facility activities and to establish design criteria and management controls based upon these risk insights. This approach ensures that design features and operational controls important to radiological safety are selected in a manner that ensures safety while minimizing operational complexity through the use of proven technology. The repository would be designed, constructed, and operated to withstand external events and natural phenomena for Category 1 and Category 2 event sequences. For example, Section 2.2.4.2.2 of this report discusses requirements for designing the surface facilities to withstand the vibratory motion associated with earthquakes. As an example, in the assembly transfer system and canister transfer system, overhead cranes and assembly transfer machines would be designed so that they would not become dislodged from their rails during a Category 1 or Category 2 event sequence earthquake. Section 2.2.5 also discusses the design processes used to keep radiation doses to workers ALARA. For accidents involving internal events, the analysis in Design Basis Event Frequency and Dose Calculation for Site Recommendation (BSC 2001u, Table 9) shows that drops of a spent nuclear fuel assembly or canister were important contributors to event sequences. To prevent these types of accidents, the assembly transfer system would be designed, constructed, and operated so that the probability of the dry assembly transfer machine dropping an assembly is low (CRWMS M&O 2000v, Section 1.2.2.1.1). In addition, to reduce the probability that the assembly or canister would be breached because of a drop, the lift heights for fuel assemblies and canisters would be limited, as is standard practice in nuclear facility design and operations. The analyses in Design Basis Event Frequency and Dose Calculation for Site Recommendation (BSC 2001u, Section 5.2.5) show that the availability of the Waste Handling Building heating, ventilation, and air conditioning system with high-efficiency particulate air filters plays a large role in mitigating the consequences of accidents. Therefore, the ventilation system would be designed to be highly reliable. For example, it would be designed to withstand earthquakes, impacts from flying debris (referred to as missiles), fires, or loss of offsite electrical power and still perform its intended safety functions. The key prevention and mitigation methods rely on the use of:5.2.5 Quality Assurance Classification Process
The safety assessment provides valuable input to the quality assurance classification process. Repository features credited as event prevention or mitigation features in the safety assessment are "important to safety," and the safety assessment is useful in determining an item's functional role as part of the repository preclosure safety strategy. Classification is performed in a separate analysis, in accordance with formal quality assurance classification procedures. Structures, systems, and components important to safety are classified in a graded fashion to ensure quality assurance controls are implemented over the facility life cycle commensurate with an item's importance to safety. The classification process consists of establishing the configuration and function of structures, systems, and components and their effect on repository radiological safety. It is limited to structures, systems, and components procured as a part of the repository system (e.g., transportation casks are not included). This information is then evaluated against criteria provided in the classification procedure to determine the quality assurance classification of the particular item. The following classification categories are specified by Section 3.1.3 of QAP-2-3, Classification of Permanent Items, consistent with Section 2 of Quality Assurance Requirements and Description (DOE 2000a). Quality Level (QL)-1—Structures, systems, and components whose failure could directly result in a condition adversely affecting public safety are classified as QL-1. These items have a high safety or waste isolation significance. QL-1 structures, systems, and components include those items, which:5.3 PRELIMINARY DESCRIPTION OF potential hazards, EVENT Sequences, AND CONSEQUENCES
This section presents the preliminary description of potential hazards, event sequences, and consequences of event sequences. Section 5.3.1 identifies the external events and natural phenomena that are the initiating events that could lead to a radiological release. Section 5.3.2 describes internal initiating events, including those that could result in a potential radiological release, no release, or a beyond Category 1 and Category 2 event sequence. Section 5.3.3 presents the consequence evaluations for Category 1 and Category 2 event sequences.5.3.1 Preliminary Description of External Events
The general strategy for managing external initiating events is to design those structures, systems, and components important to safety to withstand the initiating events so that no release scenarios are initiated and no loss of isolation of radioactive material results. Table 5-5 lists the external events and natural phenomena initiating events considered in this evaluation. The events in Table 5-5 are appropriate for preclosure period of 100 years as well as 325 years (BSC 2001f, Appendix A). Loss of Offsite Power—This event results in the total loss of external alternating current power to the potential repository for any period of time. It is postulated to occur as a result of an external event (e.g., lightning or downed power line) or an internal event (e.g., fire or random equipment failure). Loss of offsite power would, at a minimum, temporarily halt the transfer of waste. Loss of offsite power at the potential repository is assumed to occur one or more times during preclosure operations; therefore, it is a Category 1 event sequence. The strategy for this event is to prevent Category 1 or Category 2 release scenarios by providing reliable power through redundant standby power sources (onsite), uninterruptible power, redundant emergency equipment where needed, redundant distribution systems, and mechanical backup controls for components important to safety. Structures, systems, and components important to safety are designed to prevent load drops during a loss of offsite power. Onsite backup power sources with staged loading controls and potential redundant offsite power lines and sources may be used to ensure continuous power is supplied to structures, systems, and components important to safety. The potential repository design would also include such features as external lightning rods to protect against a lightning-initiated loss of offsite power. Earthquake—Vibratory Ground Motion—An earthquake is the result of sudden relative motions, or slip, between two adjacent rock surfaces in the earth's crust. The sudden slip results in the release of seismic energy, in the form of vibratory ground motion, that propagates from the location of the earthquake to the earth's surface. This ground motion can impact structures, systems, and components in the surface and subsurface facilities and lead to a radiological release. The possible consequences of an earthquake include a collapse of structures, concrete cracking, loss of offsite power, ground displacement, and subsurface rockfall. The U.S. Department of Energy (DOE) would use proven engineering techniques to design structures to withstand potential earthquakes in the site area. The repository surface facilities, where waste would be received, prepared for emplacement, and moved into the repository, would be subject to stronger earthquake ground shaking than subsurface facilities, where waste would be emplaced. Preclosure Seismic Design Methodology for a Geologic Repository at Yucca Mountain (YMP 1997, Section 3.1) establishes seismic hazard probability reference values to be used in determining two levels of design basis vibratory ground motion. The two reference values correspond to Category 1 and Category 2 event sequences and are defined as mean annual exceedance probabilities of 10-3 and 10-4, respectively. The mean annual probabilities were used in the disaggregation of probabilistic seismic hazard estimates (CRWMS M&O 2000fd, Section 6.5.3) to identify those earthquakes that control the seismic hazard at the reference probabilities. Ground motion inputs used for preclosure design analyses are described in Section 4.3.2.2.3 (Figure 4-165). These inputs are based on a mean annual exceedance probability of 10-4 and were developed for generic locations at the repository elevation (i.e., a depth of 300 m [1,000 ft]) and at a hard-rock outcrop directly above the potential repository. The safety strategy for the surface facilities is to design the structures, systems, and components important to safety to withstand the effects of a design basis earthquake. The design and construction attributes necessary to ensure that structures and systems are not compromised during a seismic event are well understood and would be applied to the repository facilities. The following NRC documents related to design basis seismic events were among the sources considered in the repository design process:5.3.2 Preliminary Description of Internal Event Sequences
Radiological consequences for the bounding internal event sequences were evaluated. Bounding event sequences include groups of similar event sequences that result in the maximum radiological consequences to a member of the public at the preclosure controlled area boundary or to a worker onsite. Collectively, the bounding event sequences establish constraints on the facility design to ensure that structures, systems, and components important to safety would perform their intended function during an event sequence, and that any radiological releases would remain within established dose limits. Internal event sequences were screened into one of three groups, based on their frequency of occurrence and potential to result in a radiological release:5.3.2.1 Internal Event Sequences with Potential Releases
These events could potentially result in a release of radionuclides, and would therefore be mitigated by the facility design. These events have been classified as Category 1 or Category 2 event sequences. In Preliminary Preclosure Safety Assessment for Monitored Geologic Repository Site Recommendation (BSC 2001f, Section 4.4.1.2.1), the impact of preclosure operational periods of up to 325 years on the internal events screening frequency thresholds (see Section 5.2.2) were investigated. For internal events that could impact the surface facility, the conclusion was that the results of using a 100-year preclosure period to screen internal event sequences would be unchanged by extending the period to 325 years since surface fuel handling operations would be completed after approximately 24 years. There would be no waste forms in the surface facility once the waste package subsurface emplacement operations are completed. Preliminary Preclosure Safety Assessment for Monitored Geologic Repository Site Recommendation (BSC 2001f, Appendix A2.1) considered the increased number of waste packages for the lower-temperature thermal operating mode with de-rated or smaller waste packages (see Section 2.1.5.2, Table 2-2) and judged that the effect of additional waste package handling could increase the likelihood of some event sequences but would not change the selection of bounding event sequences that result in radionuclide releases. One potential approach to lowering the thermal output of waste packages is to age fuel by placing it into the fuel blending inventory (see Section 2.1.4). Preliminary Preclosure Safety Assessment for Monitored Geologic Repository Site Recommendation (BSC 2001f, Appendix A6) judged that the handling and storage of fuel in this scenario is not expected to change the selection of bounding event sequences that result in radionuclide releases. For the subsurface facility, extension of preclosure operations to 325 years does impact the screening criteria. However, Preliminary Preclosure Safety Assessment for Monitored Geologic Repository Site Recommendation (BSC 2001f) examined the selection of internal event sequences based on an extended preclosure period and found no new internal events that would impact the selection of bounding event sequences. For example, the extended forced circulation ventilation activities in the subsurface facility after emplacement is completed, but before permanent closure, would not be expected to result in a loss of waste package containment. All the thermal operating modes evaluated periods of forced ventilation (see Section 2.1.5.2, Table 2-2). Forced ventilation system failures are not expected to prevent the waste package from providing containment during the preclosure period. After waste emplacement is completed, it would take about 3 weeks without forced cooling before emplacement drift wall temperature limits are approached. Therefore, temperature goals supporting postclosure performance can be maintained by repairing and restarting the forced circulation equipment within about 3 weeks (see Section 2.3.4.3.1.3).5.3.2.1.1 Category 1 Event Sequences—Internal
The Category 1 event sequences evaluated in Preliminary Preclosure Safety Assessment for Monitored Geologic Repository Site Recommendation (BSC 2001f, Section 5.3.2) occurred during the handling of uncanistered commercial spent nuclear fuel assemblies or spent nuclear fuel assembly baskets in the assembly transfer system. Table 5-6 identifies the Category 1 event sequences that could potentially result in radiological releases. Sequences Involving Individual Spent Nuclear Fuel Assemblies—Unconfined spent nuclear fuel assemblies (i.e., assemblies not in containers) will be handled remotely, underwater and individually, during transfer from the cask to the assembly transfer system basket staging rack. Then they will be handled in a dry environment during transfer from the assembly transfer system dryer to the disposal container. While underwater, spent nuclear fuel assemblies could be dropped or impacted as a result of a mechanical or control system failure of the wet assembly transfer machine, or as a result of operator error. These event sequences would occur in the assembly transfer system pool area, which is a confinement area with high-efficiency particulate air filtration. Individual spent fuel assembly event sequences that occur underwater are identified in Table 5-6 by sequence numbers 1-01 through 1-04. During transfer from the dryer to the disposal container, individual spent fuel assemblies could be dropped or impacted as a result of a mechanical or control system failure of the dry assembly transfer machine, or operator error. These event sequences would occur in the assembly transfer system cell, which is a confinement area with high-efficiency particulate air filtration. Individual spent fuel assembly event sequences in the cell are identified in Table 5-6 by sequence numbers 1-12, 1-13, and 1-14. The strategy is to confine particulate releases within the Waste Handling Building and maintain offsite radiological doses ALARA using the high-efficiency particulate air filters in the ventilation system. Spent Fuel Assembly Basket Event Sequences—Spent nuclear fuel assembly baskets would first be handled underwater, during transfer out of the basket staging rack. From there the assembly baskets, which would contain a maximum of four pressurized water reactor spent nuclear fuel assemblies or eight boiling water reactor spent nuclear fuel assemblies, could be transferred and staged in the pool storage area to facilitate aging and blending or loaded directly into the incline transfer cart. Baskets that are staged in the pool area would have an additional step of movement from the storage pool to the incline transfer cart. Once loaded onto the incline transfer cart, assembly baskets would be transported out of the pool and into the assembly drying stations, where up to six baskets could be loaded into each of the two assembly dryers. The assembly transfer system pool and cell would both be located in confinement areas with high-efficiency particulate air filtration. Spent nuclear fuel assembly baskets could be dropped or impacted in the pool during lifting out of the basket staging racks, during transport to the pool storage area, or during transport up the inclined transfer canal as a result of mechanical failures, control system failures, or operator error. Event sequences that occur underwater involving spent nuclear fuel assembly baskets are identified in Table 5-6 by sequence numbers 1-05 through 1-09. The primary safety strategy is to confine radionuclide particulate releases to the assembly transfer system pool water by designing the pool system consistent with ANSI/ANS-57.7-1988, American National Standard Design Criteria for an Independent Spent Fuel Storage Installation (Water Pool Type). The water treatment system will provide the capability to filter radioactive material, purify the water, and remove floating debris from the surfaces of pools. Workers will be able to use vacuums to remove particles from pool walls and floors (see Section 2.2.4.2.9). This same system provides the capability for cleanup of any radionuclide particulate releases into the pool water. In addition, spent nuclear fuel assembly baskets can be dropped or impacted onto the floor or in one of the assembly dryers as a result of mechanical or control system failure of the dry assembly transfer machine or operator error. Spent nuclear fuel assembly basket sequences that occur in the cell are identified in Table 5-6 by sequence numbers 1-10 and 1-11.5.3.2.1.2 Category 2 Event Sequences—Internal
The Category 2 event sequences evaluated in the Preliminary Preclosure Safety Assessment for Monitored Geologic Repository Site Recommendation (BSC 2001f, Section 5.3.3) would occur as a result of drops or collisions among handling equipment, unsealed disposal containers, or unsealed shipping casks. The bounding Category 2 internal event sequences that are expected to result in radiological releases are identified in Table 5-7. Spent Nuclear Fuel Assembly Basket Collision During Transfer—A spent nuclear fuel assembly basket collides with a wall or other heavy object in the assembly transfer system pool, causing a breach and subsequent release. This event could occur during transfer either from the assembly basket rack to the pool area or from the pool area to the incline transfer cart. The pool water serves as a barrier to particulate release, so only the radioactive gases are released to the Waste Handling Building environment. The primary safety strategy is to confine particulate releases within the assembly transfer system pool by designing the pool system consistent with ANSI/ANS-57.7-1988. Uncontrolled Descent of Incline Transfer Cart—A remotely operated incline transfer cart containing a spent fuel assembly basket loses control during ascent up the incline transfer canal, resulting in an uncontrolled descent and impact with the assembly transfer system pool, which causes a breach and subsequent release. The pool water serves as a barrier to particulate release, so only the radioactive gases are released to the Waste Handling Building environment. The primary safety strategy is to confine particulate releases within the assembly transfer system pool by designing the pool system consistent with ANSI/ANS-57.7-1988. Handling Equipment Drop onto Spent Fuel Assembly Basket in Pool—A lifting yoke (or other heavy object) is dropped onto an uncanistered spent fuel assembly in the assembly transfer system pool, causing a breach and subsequent release. The pool water serves as a barrier to particulate release, so only the radioactive gases are released to the Waste Handling Building environment. The primary safety strategy is to confine particulate releases within the assembly transfer system pool by designing the pool system consistent with ANSI/ANS-57.7-1988. Handling Equipment Drop onto Spent Fuel Assembly Basket in Cell—A lifting yoke (or other heavy object) is dropped onto an uncanistered spent fuel assembly in the assembly transfer system cell, causing a breach and subsequent release. The strategy is to confine particulate releases within the Waste Handling Building by relying on the high-efficiency particulate air filters in the heating, ventilation, and air conditioning system. Unsealed Disposal Container Collision—A loaded, unsealed disposal container collides with a wall, shield door, or other heavy object, resulting in the release of a fraction of its radiological contents. The strategy is (1) to confine particulate releases within the Waste Handling Building and maintain offsite radiological doses ALARA by using the high-efficiency particulate air filters in the heating, ventilation, and air conditioning system and (2) to provide design features (e.g., limit switches, redundant controls, emergency switch) and safe load paths that would minimize the likelihood of a collision that could result in a radiological release. Unsealed Disposal Container Drop and Slapdown—A loaded, unsealed disposal container is dropped by the disposal container bridge crane onto a welding or staging fixture. After dropping, the unsealed disposal container is presumed to slap down onto the floor and release a fraction of its radiological contents. The drop height for this event is the normal handling height in the disposal container handling cell. The strategy is (1) to confine particulate releases within the Waste Handling Building and maintain offsite radiological doses ALARA by using the high-efficiency particulate air filters in the heating, ventilation, and air conditioning system and (2) to provide design features (e.g., limit switches for lift height, interlocks, redundant controls, redundant cables, physical restraints) that would minimize unsealed disposal container drops and potential radiological releases. Handling Equipment Drop onto Unsealed Disposal Container—A lifting yoke (or other heavy object) is dropped onto a loaded, unsealed disposal container, resulting in the release of a fraction of its radiological contents. The strategy is (1) to confine particulate releases within the Waste Handling Building and maintain offsite radiological doses ALARA by using the high-efficiency particulate air filters in the heating, ventilation, and air conditioning system and (2) to provide design features that would minimize handling equipment drops onto spent nuclear fuel inside a disposal container. Unsealed Transportation Cask Drop into Cask Preparation Pit—A transportation cask, without impact limiters and with its lid unbolted, is dropped from the normal lift height into the cask preparation pit in the assembly transfer system pool area. The strategy is (1) to confine particulate releases within the Waste Handling Building and maintain offsite radiological doses ALARA by using the high-efficiency particulate air filters in the heating, ventilation, and air conditioning system and (2) to provide design features that prevent or minimize cask drops (e.g., limit switches, interlocks, redundant control circuitry, cable restraints) or reduce the impact of a drop (e.g., a shock absorber at the base of the pit). Unsealed Transportation Cask Drop into Cask Unloading Pool—A transportation cask, without impact limiters and with its lid unbolted, is dropped by the cask bridge crane into the assembly transfer system cask unloading pool. The strategy is to confine particulate releases within the assembly transfer system pool by designing the pool system consistent with ANSI/ANS-57.7-1988. In addition, particulate mitigation in the assembly transfer system pool area is provided by the secondary heating, ventilation, and air conditioning confinement ventilation system.5.3.2.2 Internal Event Sequence with No Radioactive Material Release
For these event sequences, features of the design either prevent the event sequence from occurring or prevent a radionuclide release if the event occurs. Design features to prevent the event sequence can either physically prevent the event from occurring (e.g., by eliminating, at certain steps, the lifting of transportation casks or canistered waste) or reduce the event sequence frequency below the cutoff frequency of one in one million per year (e.g., by using redundant control features in cranes and control systems). Design features that prevent a release are based on the premise that Category 1 and Category 2 event sequences will occur and that affected structures, systems, and components must be designed to prevent the waste form from releasing radioactivity during such an event sequence. Prime examples of this include the waste package event sequences, which establish design bases for the waste package to ensure that the waste package will not breach as a result of Category 1 or Category 2 event sequences. Section 3.5 of this report provides waste package event sequence analyses. Table 5-7 of Preliminary Preclosure Safety Assessment for Monitored Geologic Repository Site Recommendation (BSC 2001f, Section 5.3.4) identifies these events.5.3.2.3 Beyond Category 1 and Category 2 Event Sequences
Beyond Category 1 and Category 2 event sequences are event sequences that have less than 1 chance in 10,000 of occurring before permanent closure. This corresponds to an annual frequency of less than 10-6 per year, based on an assumed preclosure lifetime of 100 years. Such event sequences are not analyzed further. However, structures, systems, and components reducing event sequences below 10-6 per year are considered in the design basis. Appendix A in Preliminary Preclosure Safety Assessment for Monitored Geologic Repository Site Recommendation (BSC 2001f) considers the impact of lower-temperature operating modes on the identification of beyond Category 1 and Category 2 event sequences. The frequency of two events were found to be influenced by the thermal operating modes. These events are aircraft crash into the surface facility and rockfall onto a waste package in the subsurface facility. Aircraft hazards are impacted by increases in the surface facility's size, which would accompany an operating mode in which spent nuclear fuel is aged before being emplaced underground. However, Appendix A4.2 of Preliminary Preclosure Safety Assessment for Monitored Geologic Repository Site Recommendation (BSC 2001f) considered the influence of the thermal operating modes on the surface facility size and concluded that the aircraft hazards are likely to remain beyond a Category 1 or Category 2 event sequence. Rockfall onto a waste package in the subsurface becomes more likely with increases in the preclosure period, which would accompany an operating mode with extended forced ventilation. However, Appendix A4.1 of Preliminary Preclosure Safety Assessment for Monitored Geologic Repository Site Recommendation (BSC 2001f) considered the possible increase in the preclosure period and changes in the thermal operating modes on the drift temperature and concluded rockfall is likely to remain beyond a Category 1 or Category 2 event sequence with design optimization (e.g., optimized ground support features, waste package emplacement strategy). Table 5-12 of Preliminary Preclosure Safety Assessment for Monitored Geologic Repository Site Recommendation (BSC 2001f, Section 5.4) identifies these events.5.3.3 Consequence Evaluations
5.3.3.1 Category 1 Event Sequence Consequences
Design Basis Event Frequency and Dose Calculation for Site Recommendation (BSC 2001u) evaluated the consequences of Category 1 event sequences. Offsite radiation doses for Category 1 event sequences and normal operational effluents and emissions were based on the following (BSC 2001u, Section 6.1.1):5.3.3.2 Category 2 Event Sequence Consequences
Design Basis Event Frequency and Dose Calculation for Site Recommendation (BSC 2001u) evaluated the consequences of Category 2 event sequences. Offsite radiation doses (i.e., in the uncontrolled area) for Category 2 event sequences were based on the following (BSC 2001u, Section 6.1.2):5.4 PRECLOSURE SAFETY: TEST AND EVALUATION PROGRAM
The Monitored Geologic Repository Test and Evaluation Program will include planning, execution, and documentation of the testing, examination, analyses, and demonstrations necessary to verify safe and efficient operation of the repository. The preclosure components of this comprehensive program address all aspects of verification, from the development of test requirements and acceptance criteria to the performance, recording, and reporting of test procedures. The following discussion of the test and evaluation program is based on Monitored Geologic Repository Test & Evaluation Plan (CRWMS M&O 2000fj). The test and evaluation plan will be revised at the time of preparation of any license application for conformance of the plan to more specific design information and any additional performance related testing. This test and evaluation program would include the following activities and objectives.5.4.1 Development Testing
Development testing supports design activities by confirming design concepts, evaluating alternative design concepts, and investigating the availability of needed technology. For example, development testing will help evaluate and demonstrate the suitability of ground support systems proposed for the emplacement drifts. Development testing will also help evaluate the suitability, adequacy, and availability of instrumentation, monitoring, and control technologies for use in the subsurface environment. The repository systems would use microprocessor-based instrumentation and control equipment, including operator control stations, digital data acquisition, data processing, network and communications equipment, borehole instrumentation, air sampling instruments, and infrared cameras. Having a good understanding of the reliability of these systems in a high-temperature and high-radiation repository environment is important to ensure public and worker safety during emplacement activities. Field testing of candidate technologies would investigate how to minimize downtime from failures.5.4.2 Prototype Testing
Prototype testing includes proof of concept testing and mockup testing. Proof of Concept Testing—Proof of concept prototype testing is performed for the following cases:5.4.3 Component Testing
Component testing, if needed, would be performed as part of the procurement process to establish equipment qualification according to the applicable quality level. Component testing, which includes qualification and acceptance testing, would be used for any unique (not off-the-shelf) equipment. Qualification testing verifies, on a limited sampling basis, the proper operation of the component with respect to extreme bounds (as defined by specifications). Acceptance testing, performed for key parameters, establishes confidence that the manufacturing process is producing the correct product. The component vendor, with quality assurance oversight and concurrence, performs component testing. This testing starts at the beginning of fabrication and is completed before installation. Compliance with identified safety and radiological requirements would be assessed during component testing to document the appropriate details for test performance. Examples of component testing include shock, vibration, and environmental testing for performance of sensors and alarms that have or support safety functions.5.4.4 Construction and Preoperational Testing
Construction and preoperational testing would begin during repository construction and end before receipt of waste. This test activity includes the following subactivities:5.4.5 Hot Startup Testing
To the extent practicable, the preoperational testing described previously would verify compliance with repository performance requirements, including ALARA considerations. Hot startup testing would verify that operation and maintenance systems work properly and confirm that exposure times and radiation levels fall within acceptable limits during actual repository operations. Hot startup testing would begin after the successful completion of construction and preoperational test activities. It would include the following subactivities:5.4.6 Periodic Performance Testing and Surveillance
Periodic performance testing would verify system performance and ensure continued proper functioning of structures, systems, and components important to radiological safety, waste isolation, fire protection, nonnuclear safety, and repository operations. Periodic testing would be performed at the Waste Handling Building and the Waste Treatment Building in the surface facilities and at the emplacement drift panels in the subsurface facilities. This testing would also be performed after maintenance and repair activities.