Professional Documents
Culture Documents
Radiological Safety Assessment of Brazilian Industrial Facilities With Electron Accelerators
Radiological Safety Assessment of Brazilian Industrial Facilities With Electron Accelerators
net/publication/7800448
CITATION READS
1 40
4 authors, including:
SEE PROFILE
Some of the authors of this publication are also working on these related projects:
All content following this page was uploaded by Jose Marcus Godoy on 14 April 2016.
Abstract
Industrial electron accelerators are used by eight installations in Brazil, with a
total of 14 machines generating electron beams. These facilities are classified
into categories I or II, according to the International Atomic Energy Agency
(IAEA) system. In category I are included the facilities with an integrally
shielded unit with interlocks, where human access during operation is not
physically possible owing to the configuration of the shielding. In category
II are included the facilities with a unit housed in a shielded room that is
kept inaccessible during operation by an entry control system. Of the 14
accelerators operational in Brazil, 11 belong to category I and three to category
II. In the present work a methodology for the assessment of the radiological
safety of these accelerator facilities was developed and applied, mainly on the
basis of specific recommendations from the IAEA. The main safety items were
evaluated at those eight installations. According to the results obtained here,
no inadequacies were observed at the three installations in category II, from
the radiological safety and radioprotection points of view. Nevertheless, two
out of the five installations in category I showed several deficiencies. Most of
these inadequacies have been corrected during this work, and the rest are in the
course of being corrected.
(Some figures in this article are in colour only in the electronic version)
1. Introduction
Particle accelerators are machines used to accelerate charged elementary particles or ions
to high energies. All particle accelerators have the same three basic parts: (a) a source of
elementary particles or ions; (b) a tube pumped to a partial vacuum in which the particles
can travel freely; and (c) some means of speeding up the particles. They accelerate charged
1 Author to whom any correspondence should be addressed.
Figure 1. Examples of self-shielding accelerators (category I): (a) for the sterilisation of medical
and pharmaceutical products; (b) for polymer modification (cross-linking).
particles—or ions—through an electric field in a hollow, evacuated tube. The paths of the
accelerating particles may be linear, spiral, or circular. Both the cyclotron—spiral path—and
the synchrotron—circular path—use strong magnetic fields to control the paths of particles.
The linear accelerator—linac—is the simplest type of accelerator, and was first conceived
in the late 1920s. Fundamentally it is a long line of coils—or drift tubes—through which
charged particles are accelerated. The simplest type of linear accelerator is the standing-
wave accelerator, in which particles travel along a cylindrical vacuum tank through a series
of drift tubes, separated by gaps. As the particles cross the gaps, standing electromagnetic
waves accelerate them. This type of accelerator can accelerate particles to 200 MeV, i.e. 200
million electron volts. Physicists mainly use them as a primary accelerator that feeds into a
synchrotron. In industry and medicine they can be used as powerful x-ray machines.
Accelerators are common in research, medical and industrial applications. The most
widespread industrial uses of electron beam facilities are for the sterilisation of medical
and pharmaceutical products, preservation of foodstuffs, polymer synthesis and modification,
eradication of insect infestation and even radiography. For example, the welded joints in
pipes that are used in critical applications can be x-rayed to make sure there are no unsafe
imperfections.
The main differences between the kinds of electron accelerators are in the mode of
accelerating the electron beam and in the method of producing the necessary high voltages.
According to the International Atomic Energy Agency—the IAEA—in its publication Safety
Series 107 (1992), electron irradiation facilities are divided into two categories: (a) category I—
the accelerator is a self-shielding unit, i.e. the shield is integrated into the accelerator structure,
with interlocks; due to the configuration of the shielding (see figure 1) human access during
operation is allowed to the accelerator room but is not physically possible to the accelerator
itself; and (b) category II—the accelerator unit is housed in a larger shielded room that is
kept inaccessible while in operation by an entry control system which forbids access during
operation (see figure 2).
The safety record of the electron accelerator industry has been very good. Nevertheless,
there is a potential for accidents with serious consequences. Electron beam facilities produce
very high dose rates during irradiation, so a person accidentally present in the irradiation
chamber can receive a lethal dose within minutes or seconds. Precautions against any
unauthorised entry must therefore be taken. Indeed, as reported by IAEA (1996a), serious
accidents have in fact occurred in IL, USA, in 1965; in MD, USA, in 1991; and in Hanoi,
Vietnam, in 1991 (IAEA 1996b).
Safety assessment of Brazilian industrial facilities 171
Figure 2. Example of a safety fence around a shielded room (accelerator in category II).
For the design of an irradiation facility, the main design principles that should be applied,
if necessary in combination, to achieve and maintain the required reliability are the following.
Defence in depth—this concept shall be applied to all safety activities to ensure that they
are covered by a series of provisions so that if a failure should occur it would be compensated
for or corrected.
Redundancy—the use of more than the minimum number of items needed to accomplish
a given safety function. Redundancy enables the failure or unavailability of one item to be
tolerated without loss of the function. For example, three or four interlocks might be provided
for a particular function when any two would be capable of carrying it out. For the purposes
of redundancy, identical or diverse components may be used.
Diversity—the term applied to redundant systems or components that perform the same
safety function by incorporating different attributes into the systems or components. Such
attributes can be different principles of operation, different physical variables, different
operating conditions, production by different manufacturers etc. The causes of potential
failures should be examined to determine where the principle of diversity could be applied
effectively.
Independence—this can be achieved in the design of systems through functional isolation
and physical separation. The reliability of systems can be improved by applying the following
principles for independence in design: (a) maintaining independence among redundant system
components; (b) maintaining independence between system components and the equipment
designed to mitigate the effects of incidents; (c) maintaining appropriate independence of
systems or components of different importance to safety; and (d) maintaining independence
between items important and not important to safety.
Programmable electronic systems (PES)—these are very much used in safety control
applications (HMSO 1987, IEC 1998). As problems can arise relating to the integrity of
the hardware and validation of the software, leading to faults in the system, it is extremely
important that only fully trained staff be allowed to alter software.
Safety analysis—each component within the system should be considered in turn. The
likely types of failure and their consequences for the system as a whole should be taken
into account. Examples include: (a) loss of access control; (b) malfunctions and failures
172 M J M Lourenço et al
of structures, systems and components; (c) electrical distribution faults, from very localised
faults to complete loss of external energy sources; (d) failure resulting from external causes;
(e) failure of personnel to observe proper, safe procedures; (f) breakdown of procedures for
preventing access to the facility by unauthorised persons; (g) breakdown of administrative
procedures, leading to unsafe practices.
For electron irradiation facilities the risk of accidental exposures can be kept to a minimum
by proper design and construction, with specific attention to such matters as shielding and
interlocks, and a good radiation protection programme with special emphasis on training
and access control. It is therefore essential that adequate radiation safety measures be taken
according to the objectives laid down in the BSS (IAEA 1996c). The system integrity level
(SIL) category that the protection system should be designed to meet is a very important matter.
It is the duty of the manufacturers and users of the safety systems to perform this decision.
Before commissioning an installation, the Brazilian National Commission of Nuclear Energy
(CNEN), which is responsible for the licensing, studies the safety features and devices of
the facilities, as well as the fault tree analysis provided by the manufacturers. Thus, CNEN
approves (or does not approve) them.
For electron accelerators of energies less than or equal to 10 MeV, the induced radioactivity
in any part of the equipment is insignificant. However, electron beam facilities operating
above 10 MeV also require monitoring for neutrons (BSI 1988b, IAEA 1979, NCRP 1976,
1977).
The maximum range of the electrons is small compared with that of the x-rays that are
generated as a consequence of the interaction between the electrons and the matter they strike.
Therefore in calculations of the shielding requirements of electron accelerator facilities, only
the x-rays generated need to be taken into account.
There are two kinds of x-rays generated by the interaction of electrons with matter:
bremsstrahlung and characteristic x-radiation. Characteristic x-radiation is an important factor
to consider only with electron accelerators up to 300 keV that are self-shielded with a heavy
element such as lead or depleted uranium. In most cases bremsstrahlung is more important
for radiation shielding. Shielding calculations should be performed under the assumption that
all electrons are absorbed by the heaviest element that may be exposed to the beam. Account
should be taken of the composition of the structural materials and products that might be
irradiated in the facility.
Attention should also be paid to ‘spurious’ x-radiations, particularly in accelerators
operating at high voltage levels. There are several causes for this spurious radiation. First,
backscattered electrons can possess sufficient energy to stream back through the accelerator
tube. This effect is particularly pronounced when high energy electrons impinge on a high
atomic number target for x-ray conversion. Second, during conditioning of the electron
accelerator and during operation under relatively poor vacuum conditions, dark currents in
the accelerator tube occur which generate x-rays.
Inadvertent exposure may result from investigation of equipment failure and maintenance
of operating accelerator subsystems with the accelerating stages improperly or only partially
disabled. As long as the acceleration capability remains there is the possibility of x-ray
generation from dark currents. While reliability of operation reduces the risk of inadvertent
exposure by reducing the need for repair and maintenance, a further reduction in that risk can be
achieved by designing for ease of troubleshooting. This may well reduce the chance of other
hazardous occurrences such as electric shock or overexposure to radiofrequency radiation.
Therefore—besides other requirements—the following features should be considered in
industrial accelerator design: (a) positive means of disabling the main acceleration system;
(b) built-in machine parameter monitoring; and (c) built-in remote machine diagnostics.
Safety assessment of Brazilian industrial facilities 173
2. Methodology
Industrial linear accelerators are used by eight installations in Brazil,with a total of 14 machines
generating electron beams. These facilities are classified into categories I or II, according to
the IAEA (1992). From the 14 accelerators in use in Brazil, 11 belong to category I and three
to category II. The main characteristics of those 14 facilities are described in table 1.
Regulatory inspections were conducted at those eight operative Brazilian electron
accelerator installations. Those inspections were carried out to: (a) check that the operation
of the facility meets all the conditions of the pertinent regulations issued by CNEN (1988a,
1988b, 1995, 1998) and that the facility is well maintained; (b) review the results of surveys,
maintenance programmes, personal dosimetry, medical surveillance and the timetable adopted
for the periodic testings carried out during operation; and (c) check the emergency plans
and preparedness and conduct a survey of the availability and appropriateness of emergency
equipment.
The following items were checked during the compliance inspections. This methodology
was based on the main specific recommendations from IAEA (1992). The standards IEC 61508
(1998) describe the current level of technology related to functional safety, which depends on a
system or equipment operating correctly in response to its inputs. However, the safety systems
and devices studied in the present work were manufactured before this year. Therefore, they
do not support automatic presumption of compliance with these standards.
174 M J M Lourenço et al
2.1. Shielding
Penetrations of the shield are necessary for personnel and product entry and exit and for
ventilation and other ducting. Radiometric surveys were carried out to ensure that there was
no direct radiation leakage path and that the use of maze entrances was sufficient to reduce the
radiation fields at the point of exit to acceptable levels. Thus, all significant radiation paths
were fully evaluated.
2.8. Ventilation
Ozone (O3 ), oxides of nitrogen and other noxious gases are produced by radiolysis. Measures
shall be taken to protect personnel against exposure to concentrations of such gases above the
threshold limit values prescribed by health authorities. The plant should be designed to prevent
the migration of the ozone produced in an irradiator into areas that may be occupied and where
the concentration could potentially build up to exceed the currently accepted limit, which is
0.1 ppm (OSHA 2004). This can be achieved by using a ventilation system that creates a
negative pressure in the radiation room. Ozone, being very reactive, is readily reduced to the
normal form of oxygen (O2 ). When a large capacity, continuously operated ventilation system
is used, the radiation room can normally be entered a few minutes after the termination of
irradiation. For controlling personnel access until the ozone level is at an acceptable level in
the radiation room, a time delay interlock mechanism which prevents personnel access doors
from being opened before a preset time has elapsed after termination of irradiation must be
provided.
2.11. Records
The results of all tests related to the items described above, maintenance tasks, modifications
or changes to the irradiator shall be recorded on a formal checklist signed by the radiation
protection officer who has witnessed the tests. All use of the irradiator shall also be recorded.
During the compliance inspections performed, particular attention was paid to those records,
since failure of the safety systems can lead to serious radiation exposure to personnel.
3. Results
After the compliance inspections performed at the eight facilities operative in Brazil, no
inadequacies were observed in the three installations in category II, i.e. in those that possess a
radiation room. However, in two out of the five installations in category I, i.e. self-shielding
units, several inadequacies were observed, described in table 2.
The total number of occupationally involved individuals at the eight accelerator
installations operative in Brazil is around 120. Nevertheless, none of the individuals had any
monthly recorded dose in excess of the lower limit of detection of the individual monitoring
technique employed (film badge or thermoluminescent dosimeters—TLD).
During the compliance inspections, data about the periodicity for the testings put into
practice by each installation were collected. There was little agreement observed among the
different installations regarding the tests of the safety interlock components and the radiation
survey monitoring. However, the most prevalent timetable for the testings adopted by the
installations are presented in table 3.
Also included in table 3 is a new timetable with the recommended periodicities for the
testings that should be performed by industrial electron accelerator facilities. It was created
mainly on the basis of recommendations of the IAEA (1992). Disagreement between the
current practice and the recommended periodicity was observed in about half of the items.
4. Discussion
Table 3. Periodicity observed and recommended timetable for the periodic tests (Note:
W = weekly; M = monthly; T = trimestrial).
Current Recommended
Tests of safety interlock components and radiation survey practice periodicity
Programmable electronic systems (PES) for the accelerator operation W W
Fixed radiation monitor with alarms W W
Interlocks (category I): contacts of mobile shielding M W
Interlocks (category II): personnel access door; product entry and exit ports M W
System against electrical power failure M M
Ventilation system for O3 exhaustion M M
Safety delay timer with alarms M M
Heat and smoke sensing devices with visible and audible alarms (category II) M M
Irradiation device warning signals (visible and audible) M M
Control console: emergency stop device M W
Emergency exit device inside radiation room (category II) M W
Control console: indicators T W
Control console: access key T M
Radiation survey around shielding T M
the present work we developed and put into practice a methodology for the assessment
of the radiological safety of the operating Brazilian industrial electron linear accelerator
facilities. Indeed, several non-compliances were observed in two out of eight installations,
thus corroborating the need for such compliance inspections. The most critical inadequacies
have already been corrected and the remainder are in the process of being dealt with.
No inadequacies were observed in the three installations in category II, i.e. in those that
possess a radiation room. Installations in category II present higher risk compared to those
in category I. Perhaps this makes the former installations exert more strict control over safety
aspects.
The timetable currently recommended for the periodic testing that shall be performed by
the industrial accelerator installations can serve as guidance to persons who operate electron
beam facilities and also to the Brazilian regulatory authority responsible for regulating the use
of them.
The standards IEC 61508 (1998) describe the current level of technology related to
functional safety, which is part of the overall safety that depends on a system or equipment
operating correctly in response to its inputs. The safety systems and devices studied at the
present work were manufactured before this year. Therefore, they do not support automatic
presumption of compliance with these standards. Thus, it is strongly recommended that
the installations with accelerators should review equipment in detail against these up-to-date
standards, in order to identify major weaknesses.
Its is also the installation’s duty, as well as the regulators’, to decide which system integrity
level (SIL) category the protection systems should be designed to meet, and to perform the
assessment of the systems using something like fault tree analysis.
For electron accelerators of energies less than or equal to 10 MeV the induced radioactivity
is insignificant; thus the operation manuals do not recommend that the inside of the enclosures
should be monitored with a portable monitor on each entry. However, implementing such a
final check with a portable monitor would be the only absolute test to guarantee that all is well
and a major overexposure is not about to happen.
Failed bulbs are detected by the system during the period of start-up. Any detected failed
bulb must be replaced in order for the system to work. However, once the irradiation starts,
Safety assessment of Brazilian industrial facilities 179
a failed bulb, even if detected, will not interrupt irradiation, in order not to spoil the products
under irradiation. Nevertheless, past experience has shown that failed indicators are one of the
main causes of incidents. Therefore, for important signs, multiple bulbs are recommended.
Acknowledgments
The authors are grateful to IRD/CNEN and to all of those who, direct or indirectly, collaborated
in the preparation of this manuscript.
References
BSI (British Standards Institution) 1986 Electrical Equipment of Industrial Machines BS 2771 (London: BSI)
BSI (British Standards Institution) 1988a Code of Practice for Safety of Machinery BS 5304 (London: BSI)
BSI (British Standards Institution) 1988b Recommendation for Data on Shielding from Ionizing Radiation BS 4094
(London: BSI)
CNEN (Comissão Nacional de Energia Nuclear) 1988a Diretrizes Básicas de Radioproteç ão CNEN-NE-3.01
(Rio de Janeiro: CNEN)
CNEN (Comissão Nacional de Energia Nuclear) 1988b Serviços de Radioproteç ão CNEN-NE-3.02 (Rio de Janeiro:
CNEN)
CNEN (Comissão Nacional de Energia Nuclear) 1995 Certificaç ão da Qualificaç ão de Supervisores de Radioproteção
CNEN-NN-303 (Rio de Janeiro: CNEN)
CNEN (Comissão Nacional de Energia Nuclear) 1998 Licenciamento de Instalações Radiativas CNEN-NE-6.02
(Rio de Janeiro: CNEN)
HMSO (Health and Safety Executive) 1987 An Introductory Guide to Programmable Electronic Systems in Safety
Related Applications (London: Health and Safety Executive)
IAEA (International Atomic Energy Agency) 1979 Radiological safety aspects of the operation of electron linear
accelerators IAEA Technical Report Series TRS 188 (Vienna: IAEA)
IAEA (International Atomic Energy Agency) 1989 Emergency planning and preparedness for accidents involving
radioactive materials used in medicine, industry, research and teaching IAEA Safety Series 91 (Vienna: IAEA)
IAEA (International Atomic Energy Agency) 1992 Radiation safety of gamma and electron irradiation facilities Safety
Guides Safety Series 107 (Vienna: IAEA)
IAEA (International Atomic Energy Agency) 1996a Lessons Learned from Accidents in Industrial Irradiation Facilities
STI/PUB/1015 (Vienna: IAEA)
IAEA (International Atomic Energy Agency) 1996b An Electron Accelerator Accident in Hanoi, Vietnam (Vienna:
IAEA)
IAEA (International Atomic Energy Agency) 1996c International basic safety standards for protection against ionizing
radiation and for the safety of radiation sources—BSS IAEA Safety Series 115 (Vienna: IAEA)
IEC (International Electrotechnical Commission) 1998 Functional Safety of Electrical/Electronic/Programmable
Electronic Safety-Related Systems. Part 1: General Requirements IEC 61508-1 (Available at:
http://www.iec.ch/zone/fsafety/Preview.htm)
NCRP (National Council on Radiation Protection and Measurements) 1976 Structural Shielding Design and
Evaluation for Medical use of X-rays and Gamma Rays of Energies up to 10 MeV (Report 49) (Bethesda,
MD: NCRP)
NCRP (National Council on Radiation Protection and Measurements) 1977 Radiation Protection Design Guidelines
for 0.1–100 MeV Particle Accelerator Facilities (Report 51) (Washington, DC: NCRP)
OSHA (Occupational Safety & Health Administration) 2004 Occupational Safety and Health Standards Part 1910.1000
Limits for Air Contaminants (Available from: http://www.osha.gov/pls/oshaweb/owadisp.show document?p
table=STANDARDS&p id=9992)