|Licence holder||Australian Nuclear Science and Technology Organisation (ANSTO) Centre for Accelerator Science|
|Location inspected||Lucas Heights, NSW 2234|
|Licence number||F0316 and F0290|
|Date of inspection||15-16 February and 14 March 2023|
An inspection was conducted as part of ARPANSA’s baseline inspection program to assess compliance with the Australian Radiation Protection and Nuclear Safety Act 1998 (the Act), the Australian Radiation Protection and Nuclear Safety Regulations 2018 (the Regulations) and conditions of facility licences F0316 & F0290.
The scope of the inspection included an assessment of ANSTO’s performance at the Centre for Accelerator Science (CAS) against the Performance Objectives and Criteria (POC). The inspection consisted of a review of records, interviews, and physical inspection of the accelerators operated by CAS under licences F0316 and F0290 with special focus on the ANTARES facility.
CAS is authorised under section 30 of the Act to operate particle accelerators and section 31 of the Act to deal with Group 1 sealed sources for calibration purposes. Operation of accelerators ANTARES, STAR & VEGA is authorised under F0316, and operation of SIRIUS is authorised under F0290 with 2 beamlines still in hot commissioning.
CAS conducts applied research in a diverse range of activities including material analysis, biological and environmental studies, space electronics testing and radiation damage studies.
The inspection was originally planned as a general assessment of compliance against the POC. However, after being notified by ANSTO of an incident in November 2022 attention focused on the ANTARES facility.
On 3 February 2023 ANSTO reported a potential breach of subsection 60(1) of the Regulations and possibly section 57A. Information was provided about the incident, ANSTO’s immediate response, and a copy of Concise Investigation Report 14036 dated 17 January 2023. It should be noted that this was not a notifiable incident under section 58 of the Regulations and no individual was exposed to radiation as a result.
The two areas for improvement identified at the last inspection in September 2019 were confirmed with the lead inspector as closed.
The inspection was conducted with the full cooperation of ANSTO. Staff spoke frankly about their roles and the ANTARES incident in November 2022. The inspection team acknowledges the thorough investigation conducted by the ANSTO team and makes references to the resulting actions.
The inspection team confirmed the findings made in ANSTO’s investigation report and noted the potential breaches formally reported by ANSTO on 3 February 2023. Further enquiries were made with the officers involved.
Nine areas for improvement are discussed and presented in a table at the end of this report. They are presented in relation to the CAS Action Plan making it evident which ones were also identified by ANSTO investigators and those identified by the inspection team.
C1 Accountabilities and responsibilities
Accountabilities and responsibilities for safety and security are identified for all key functions and operations
Roles and responsibilities for regulatory compliance and safety management are established in 3 key documents:
- AG-5419 Accelerator Facilities Plans and Arrangements Rev.9 (P&As)
- G-7037 CAS Safety Analysis Report Rev.2 (SAR)
- P-1062 Accelerator Operations Management Rev.10 (P-1062)
These documents define responsibilities of the CAS Leader as the Licence Nominee, the Facility Officer (FO) and the Licensing Officer (LO). An organisation chart showing the relationship between these roles appears in the P&As.
The responsibilities of the FO and LO are not in the position descriptions of the officers performing these roles. The responsibilities are additional to those of their substantive technical roles. The division of responsibilities between the two roles and the delegation of these roles to ensure continuity of responsibilities needs to be clarified. It is recommended that the position descriptions and workloads of key safety and compliance positions be reviewed, and responsibilities and delegations clearly defined [Ref 1].
The SAR (5.5.3) sets out the responsibilities of accelerator operators. Typically, the operator is responsible for developing the Safe Work Method and
Environmental Statement (SWMES) - a risk assessment for a particular experiment. According to P-1062 (1.7) the licensed operator is responsible for ensuring the accelerator is operated in direct compliance with the accelerator procedures, work instructions and licensing conditions. Despite these requirements there is no process to ensure compliance. Operators are given full control of the accelerator and this was taken by the operator at the time of the incident to mean there are no limits.
It is recommended that consideration is made to the level of authority given to operators and whether there is sufficient independence in the SWMES approval process.
CAS Action 1 CAS operations management framework, Action 2 Improvements to SWMES management, and Action 4 Review of accelerator safety documentation may address the oversight issues. However, unless there is a dedicated time for operators, FO, technicians and radiation protection advisers (RPA) to communicate and develop a shared, agreed understanding of the specific experimental conditions- there is a risk of unanticipated changes. This should be considered and designed into the process [Ref 2]. The RPA should also be actively involved in the planning of experiments and the training of operators.
The ANTARES investigation report identified a lack of questioning attitude displayed by the operator, and this was confirmed during the inspection. As well as the issues around compliance responsibilities and delegation of key roles, scheduling and workload concerns were also noted in the report and confirmed during interviews. This is discussed further in C4.
Seeking to understand the reasons behind the differences in staff attitudes to safety would assist management to validate the recommendations from the investigation report [Ref 3]. Further understanding of the attitudes to safety between different staff groups could assist ANSTO evaluate the effectiveness of recommendations and whether they will ultimately support a culture for safety [Ref 4].
ANSTO’s Annual Performance Evaluation Appraisal system (APEA) was reported to not fully support the needs of some staff such as accounting for regulatory responsibilities or reinforcing behaviour for safety culture, despite there being mandatory objectives related to safety culture and behaviour. It is recommended that this business process be adapted to enhance culture for safety. These actions should foster a common understanding of safety and include measures to encourage accountability, questioning, learning and commitment [Ref 3].
C2 Management commitment
Management is committed to maintaining safe and secure operations and work environment
The CAS Leader’s commitment to safety was evident in the actions taken in response to the incident. Operations were suspended and a thorough investigation was conducted which identified contributing factors. This demonstrated organisational and management commitment to learning lessons and improving organisational practice including culture for safety.
Management commitment to positive changes was demonstrated during the inspection. Evidence of toolbox talks and meetings conducted after the incident were provided.
Participation in the inspection was open, and areas that could be improved were acknowledged. The investigation report identified the importance of learning across the organisation, and this is supported by the Holistic Safety Guide [Ref 4].
The CAS Leader has set ambitious timeframes for completion of the required actions. The facility utilisation KPI has been reduced by 10% until the end of June so actions can be prioritised.
C3 Statutory and regulatory compliance
Statutory and regulatory compliance underpins all operations
Commitment to compliance is expressed in key safety documents. Unfortunately, breakdowns in procedures and insufficient oversight during the ANTARES experiment resulted in non-compliance. However, when the incident was identified, appropriate processes were followed to investigate and report to ARPANSA.
A process to monitor and verify compliance with key safety documents and approved SWMES should be considered [Ref 1].
Resources are adequately allocated and controlled
Resource constraints existed at the time of the incident including staff vacancies, extended leave, and an increase in demand for services. The FO admitted feeling under pressure to prioritise operations in the period before the incident. Since the incident there have been a further two resignations.
CAS regularly engages contractors to boost resources.
CAS Action 1 aims to ensure resourcing and scheduling issues are better managed, and safety and regulatory tasks prioritised.
Supply chain issues were noted with respect to acquiring certain components to proactively enhance safety. It is recommended that a process be established to assess and mitigate risks caused by supply chain limitations [Ref 3].
Communication demonstrates situational awareness and teamwork to effectively support safe and secure operations
Preparation for the experiment that led to the incident was a key factor identified and discussed during the inspection. This experiment was conducted by an operator external to the CAS group and the type of research differed from standard operations.
Assumptions and miscommunications between the operator and FO during the setup of the experiment contributed to some of the outcomes. The FO and operator had different interpretations of accelerator beam energies, experimental dose rates, limits, and monitor location. They also had a different understanding of the purpose and use of radiation alarms. The operator stated that alarms are informative as a signal to adjust the beam as well as being an audible signal that radiation is present.
CAS Action 4 addresses the need to review alarms and ensure alarms are not sounding for long periods without action. These differences in interpretation should be addressed through an alarm system characterisation to understand the functional purposes of all alarms and the appropriate treatment [Ref 5]. Specifically, the appropriateness of depending on radiation monitors to indicate changes in operating conditions should be investigated.
Another area of concern is the operator’s ability to change the way information is displayed on control room monitors without consultation or approval. Currently dose rate alarms and other alerts can be removed from the screen. The FO confirmed this issue is being addressed by strengthening access controls.
C6 Process implementation
Operations, processes, functions, and activities are adequately controlled
The SAR (4.5) describes Accelerator Operations and lists ‘two types of applications’ - accelerator mass spectrometry (AMS) and ion beam analysis (IBA). These types of experiments are regarded as ‘routine’ due to conditions being known and relatively stable. The CAS Leader described irradiations as the third type of experiment. These are regarded as ‘non-routine’ experiments and are not specifically considered in the SAR. The inspection team were told that non-routine experiments are managed through the SWMES process.
The CAS Leader advised that demand for non-routine experiments is increasing with irradiations currently accounting for 20% of CAS operations. This type of experiment was being conducted when the ANTARES incident occurred. Conditions resulting when the operator increased the beam energy beyond the experimental limits were not considered during the planning process.
ANSTO’s investigation report noted that there is no documented process of how non-routine experiments and projects are carried out in the CAS Facility.
It is important that anticipated operational occurrences and accident conditions that could challenge safety be identified in the safety analysis [Ref 2]. Had this been done for the full range of conditions - energies, beam types, and target materials - the high dose rates encountered may not have been so unexpected.
The SAR is a living document and should keep pace with changes to the operating environment. A full
analysis of the potential risks arising from irradiations and other non-routine experiments should be undertaken (including worse case scenarios) and documented. P-1062 (7.2) Control of Modifications is relevant to any changes to the SAR.
ANSTO guide AG2397 states: The ANSTO Responsible Worker for the task is responsible for coordinating the completion of the SWMES and for arranging review by relevant stakeholders. The ANSTO Responsible Worker must approve the document for issue after consultation.
The ‘Responsible Worker’ in the case of the ANTARES incident was the operator. The operator failed to follow procedures, did not seek the required expert review, there were 2 different versions of the SWMES neither of which was signed or approved yet the operator proceeded with the experiment unchallenged. Most of these failings resulted from a lack of appropriate oversight as noted in C1.
There is a clear expectation in key documents that experiments will be conducted in accordance with the SWMES and P-1062 but there is no process to monitor compliance. This is of particular concern when the operator is not part of the CAS group or when the experiment is not routine. The operator at the time of the incident (who was not CAS staff) told the inspection team he saw no issue exceeding experimental limits to ensure the success of the experiment. This indicates that safety was not front of mind. The ANSTO investigators reached a similar conclusion.
C7 Documentation and document control
Documentation is organised and effectively managed
The quality manager explained how controlled documents are managed on the sitewide ANSTO Content Server. Internal compliance audits are undertaken, and quarterly quality meetings held with business unit leaders. An internal audit against P-1062 is scheduled for March 2023 (previous audit was Feb 2020).
The inspection team identified numerous issues relating to document control and records management. There are inconsistencies within and between the 3 key safety documents such as referring to superseded documents and processes, and obsolete references. The Accelerator Operator Training Information document (I-7027) should reflect the current facility dose constraint and the inappropriate reference to RPS G-2 should be removed. There are also differences in the organisational/management charts presented in P-1062 and the P&As.
A sample of radiation surveys were reviewed prior to the inspection. It was noted that there are different templates used for each accelerator; the required information differs and several of the forms were incomplete. Consideration should be given to using a standard template and the management of survey records improved.
The approach to record keeping is not systematic. Records are managed locally in different forms (electronic and paper) and in different locations. Prior to the incident, completed SWMES were stored as hard copies. Although P-1062 is silent on the management of completed SWMES, section 5 of AG-2397 (SWMES guide) recommends records be stored in various locations and there is no system to manage version control. It is noted that temporary measures have been implemented since the incident pending review and upgrade of procedures under CAS Action 4. Improvements to document control and record keeping practices are recommended [Ref 3].
P&As, P-1062 and the SAR have been revised in the past 3 years as required by section 61 of the Regulations.
C9 Risk assessment and mitigation
Risks are reduced to acceptable levels by applying risk assessment and mitigation strategies
As mentioned in C6, the SAR does not consider potential hazards and safety management issues arising from irradiation experiments.
Dose rates from irradiations under certain conditions with particular target materials (especially those that produce neutrons) can be orders of magnitude higher in the target room than in the accelerator hall. Conversations with staff during the inspection revealed that dose rates in the target room from the ANTARES irradiation experiment were much higher than they anticipated.
The risk assessment for the experiment identified a high risk that - according to AG-2397 Explanatory Notes to SWMES - should have triggered ANSTO’s Safety and Reliability Assurance (SRA) and High-Risk processes. This is the system underpinning safety management across the organisation approved by ARPANSA in 2019 to replace the former Safety Assessment Committee approval process.
Under this process the operator was required to complete AF-7454 High Risk Identification and Notification form but failed to do so. No explanation was provided. The breakdown in this key safety management process supports ANSTO’s report of a potential breach of the Regulations.
ANSTO’s investigation of the ANTARES incident revealed that because no operating limits and conditions (OLCs) are defined, this was interpreted by the operator to mean that the accelerator can be operated without limits. The operator confirmed this to be his understanding. ANSTO has committed to a review of alarms under CAS Action 4.
C10 Monitoring and mitigation
Operations are tracked, monitored, and measured
Outputs from fixed radiation detectors around each accelerator are relayed from the control room and displayed on LCD screens in foyers, control rooms & other areas, providing real time display of operating conditions. Dose rates from fixed detectors are electronically logged allowing retrospective review. This proved useful to analyse the conditions during the ANTARES experiment.
Monitors must be able to accurately detect the range and type of radiation present so that risks can be appropriately managed [Ref 6, 2]. The detection range of one of the monitors used during the experiment was exceeded which meant an accurate dose rate could not be recorded.
C11 Managing change
A formal change management policy and process is in place when making changes for example to plant, equipment, operating processes, and management arrangements
The process for managing change is described in P-1062 (7.2) Control of Modifications with references to section 63 the Regulations determination and the requirements for ARPANSA approval. This screening process should be applied to all modifications including changes to plant, SCADA HMI and control logic.
There is no requirement for a review of proposed modifications (including non-routine experiment proposals) against the safety analysis in the SAR to ensure bounding conditions are not exceeded. This should be included when documents are revised under CAS Action 4.
Any changes to the SAR and other safety documentation made under CAS Action 4 will need to consider how the processes and procedures described in P-1062 apply, as well as other relevant site-wide procedures and guidance. Revised safety documents should clearly describe the SRA process and when and how it must be implemented.
A system for tracking the progress and closure of actions from safety reviews including changes to SWMES and modifications of experiments should be considered as part of the operational framework.
C12 Training and education
Staff are provided with relevant safety training and education programs
Appropriate training in protection and safety as well as periodic retraining must be given to individuals to perform their duties competently [Ref 7].
Training requirements are defined in P-1062 for various users and in more detail for operators in I-7027 Accelerator Operator Training Information. However, a systematic approach to retraining should be implemented and the intervals for retraining clearly defined and managed.
Site-wide training and training records are managed through ANSTO’s Learning Management System (LMS) while CAS-specific training and operator training records are managed locally. CAS is committed to a review of training and training records management and to establish an operations training framework under CAS Action 3.
In addition to the site-wide training, the FO believes specific local training for staff performing regulatory and compliance roles would be beneficial. This should also be considered under CAS Action 3.
Procedures require a radiation survey to be performed prior to starting an experiment to ensure the conditions are as anticipated and experimental limits are not exceeded. Operators have the option of calling a health physics surveyor (HPS) or doing the survey themselves. However, there is no facility-specific practical training provided to operators on how to conduct such surveys and interpret results (see C16). Conversations with staff revealed that such training had been discussed in the past but has not eventuated. This training should be considered in the new framework.
Staff should be trained on revised policies and procedures to ensure they are aware of operational changes and regulatory updates. A process for this should be embedded in the training framework and a process for evaluating the effectiveness of training should also be considered to monitor how training translates into performance [Ref 3].
C17 Planning and design of the workplace
Design of the workplace is optimised for radiation protection
The FO indicated that control room screens (Human Machine Interface) were customised to display experimental limits and radiation doses and that it was undergoing a series of updates some of which involve changing the screens for specific experiments. During the ANTARES incident the operator was able to ignore the experimental limits displayed on the screen and increase the beam energy without restriction.
There does not seem to be a formalised process for human factors engineering in the design process to manage both safety and usability aspects. There should be controls to stop operators exceeding experimental limits.
There is no direct line of sight from the ANTARES control room to the target room or accelerator hall. Consequently, there is no way to monitor entry/egress during experiments. CCTV is progressively being
installed to rectify this situation. In the other accelerators, operators have direct view of the accelerator & beamlines from the control room.
The only engineered safety feature designed as a shutdown system in ANTARES is in the accelerator hall. There are no fixed gates or other engineered safety features in the target room where dose rates can be much higher. Protection in the target room relies on administrative controls including the use of temporary barriers, shielding, and signage. Consideration should be given to a shutdown system or other trip mechanism in the target room.
The ANTARES target room is classified as a white radiation area. Radiation monitors are set to alarm at 10 µSv/h to signal that the area is now a restricted blue zone. During the planning of experiments the dose rates are estimated. In the case of the ANTARES irradiation experiment the expected dose rate was 300 µSv/h. By positioning a radiation monitor at the end of the beam line in an unshielded position, an alarm early in the experiment was inevitable. Consideration should be given to area classification, positioning of monitors, and alarm trigger levels during these types of experiments.
The RPA was asked about protection measures used in similar facilities. Comparison was drawn with the Australian Centre for Neutron Scattering (ACNS) where beamlines have fixed enclosures and built-in interlocks however, it is noted that the ACNS is not an accelerator-based facility.
It is recommended that CAS look to learn from strengths elsewhere in the organisation in particular, the use of alarms, area classification, alarm trigger levels, and control measures [Ref 3].
C20 Monitoring of the workplace
Regular radiation and contamination monitoring of the workplace is conducted where appropriate
As discussed in C10, fixed radiation monitors are installed around each accelerator and data from certain monitors is electronically logged 24/7.
The choice of monitors and shielding for certain experiments should be considered for adequacy particularly if neutrons are unexpectedly generated. The monitor used at the end station during the ANTARES experiment exceeded its detection range making it impossible to record an accurate dose rate.
Section 6.3 of P-1062 describes the requirements for radiation surveys. Involvement of HPS is currently ad hoc. Operators have discretion to request HPS or do the surveys themselves but there is no facility-specific training provided. This is discussed in C12.
A sample of radiation survey results was reviewed by the inspection team. No issues were raised apart from the document control and record keeping issues discussed in C7.
A summary of magnetic field surveys for each accelerator was provided. Results were well below the occupational exposure limit. The risk was assessed as medium and the consequence as major to persons with implanted electrical devices. Appropriate hazard signage is used to warn of the dangers of static magnetic fields in the vicinity of the magnets.
C21 Inspection, testing and maintenance
Inspection, testing, and maintenance is undertaken in a manner which ensures the safe operation of the facility
One day per month is scheduled for maintenance on each accelerator but daily maintenance can often be required on aging components. Maintenance and faults are recorded and tracked in the SAP system. This includes the calibration of radiation monitors. All monitors sighted during the inspection were within calibration.
Extracts from the planned & unplanned maintenance log were provided prior to the inspection. The investigation report noted there had been unplanned maintenance immediately prior to the incident. A review of maintenance records for that period did not show anything relevant to the incident.
The most recent wipe test results and local arrangements form were reviewed for the one sealed source (Cs-137) held by CAS and no issues identified.
P&As (2.8) commits to periodic safety reviews but does not commit to a time frame. Consider defining the period for such reviews when the document is updated.
C22 Monitoring of individuals
Individual monitoring is undertaken where appropriate; dosimetry is appropriate for the work undertaken
P-1062 (6.2.1) requires accelerator operators to wear a personal dosimeter. The SAR (9.2.2) gives accelerator personnel the option of wearing either a TLD or EPD. The RPA reviews doses received by personnel and will advise CAS management of any unexpected results.
Personal dosimetry records provided prior to the inspection show doses less than 1 mSv. Dose records for Q4 2022 (the period when the incident occurred) showed nothing unusual.
Despite the low doses recorded on TLDs, the use of EPDs should be considered for additional protection during irradiations and other non-routine experiments when dose rates can be unpredictable.
Policies, plans and arrangements are made and implemented to decrease the likelihood of unauthorised access, damage, theft, loss or unauthorised use
The only controlled material held by CAS is a Group 1 sealed source. The storage arrangements are appropriate for this type of source as per RPS 11 [Ref 8].
Currently operators can alter the way information is displayed in the ANTARES control room - alarms and other alerts can be removed from the screen. CAS is engaging with the ANSTO IT group to secure this vulnerability.
As previously stated, CCTV is being progressively installed in ANTARES to improve oversight of the accelerator hall and target room from the control room. This has both safety and security benefits.
Plans and arrangements are in place to ensure that an adequate capability exists for effective on-site preparedness and response in any radiological emergency
CAS is subject to the ANSTO site-wide emergency arrangements. General emergency arrangements are described in the P&As, section 6. Details of local emergency arrangements are found in P-1062, section 5.
Annual emergency exercises are conducted. The most recent was a building evacuation exercise in January 2023 for B22 which houses the STAR accelerator. Exercises are also conducted for fire and low oxygenemergencies. Records of exercises are maintained in the SAP system.
AP-2372 Safety Incident response and notification describes the procedure in the event of a safety incident. Incidents & events are logged and managed in GRC. This procedure was used for the ANTARES incident.
This report identifies 9 areas for improvement. They are presented in the table below mapped against the CAS Action Plan arising from ANSTO’s investigation. Only additional actions identified by the inspection team will formally be recorded as areas for improvement.
In terms of the ANTARES incident, the inspection confirmed the findings of ANSTO’s investigation.
While it is acknowledged that no person was exposed to radiation above the statutory limit, insufficient oversight resulted in multiple human performance and organisational issues. Breakdowns in effective control and safety management processes indicate that not all reasonably practicable steps were taken to:
- manage the safety of the facility as required by subsection 60(1) of the Regulations.
- prevent and minimise human errors and organisational failures involving controlled facilities described in the licence as required by s57A of the Regulations.
These findings confirm the potential breach self-reported by ANSTO on 3 February 2023. ARPANSA is dealing with this as a separate matter.
Areas for improvement from CAS inspection 15-16 February and 14 March 2023
Actions in italics reflect areas for improvement identified during the inspection that differ from actions previously identified by ANSTO
|Action||Is action included in CAS Action Plan|
Oversight of operations including:
PartiallyAction 2 includes improvements to the management of SWMES
Revise Safety Analysis Report to include:
PartiallyAction 4 includes consideration of OLCs
Safety management in ANTARES target room including:
Action 4 includes consideration of engineered controls
Use and response to alarms including consideration of:
PartiallyAction 4 includes review of alarms
Resource management including:
PartiallyAction 1 includes delegation of responsibilities & improvements to scheduling
Physical oversight of target room & security of data
NoBut improvements are in progress to address (1) & (2)
Document control and records management including:
Action 2 includes management of SWMES recordsAction 3 includes management of training records
Culture for safety including:
Action 3 includes definition of retraining requirements & management of training records
- International Atomic Energy Agency (IAEA), 2014. Radiation Protection and Safety of Radiation Sources: International Basic Safety Standards. General Safety Requirements GSR Part 3 - para 3.15; 3.38; 6.8
- International Atomic Energy Agency (IAEA), 2016. Safety Assessment for Facilities and Activities GSR Part 4 (Rev.1) - Requirement 11; para 4.51; para 4.36
- International Atomic Energy Agency (IAEA), 2016. Leadership and Management for Safety GSR Part 2 - Requirement 14; para 4.35; para 4.18-4.19; Requirement 3,5,6; Requirement 12; para 4.23
- Australian Radiation Protection and Nuclear Safety Agency (ARPANSA), 2017. Regulatory Guide - Holistic Safety (ARPANSA-GDE-1753) - Characteristic 6 Safety Culture; para 5.4 & 6.5
- United States Nuclear Regulatory Commission (USNRC), 2020. Human-System Interface Design Review Guidelines, NUREG-0700 (Rev 3) - Part 4
- Standards Australia, 2018. Safety in laboratories Part 4: Ionising radiations, AS/NZS 2243.4:2018 – para 6.17 & Appendix D <This standard is a licence condition>
- Australian Radiation Protection and Nuclear Safety Agency (ARPANSA), 2020. Code for Radiation Protection in Planned Exposure Situations (Rev.1) RPS C-1 - para 3.2.9 <This Code is a licence condition>
- Australian Radiation Protection and Nuclear Safety Agency (ARPANSA), 2019. Code of Practice for the Security of Radioactive Sources RPS 11 <This Code is a licence condition>