Annals of Nuclear Energy 119 (2018) 106–116

Contents lists available at ScienceDirect

Annals of Nuclear Energy

journal homepage: www.elsevier.com/locate/anucene

Risk analysis of high level radioactive waste storage tank based on

HAZOP
Shuliang Zou a,b,⇑, Ya Kuang a,b, Dewen Tang a, Zan Guo a,b, Shoulong Xu a,b
a
Hunan Provincial Key Laboratory of Emergency Safety Technology and Equipment for Nuclear Facilities, Hengyang 421000, Hunan, China
b
Environment and Safety Engineering School of the University of South China, Hengyang 421000, Hunan, China

a r t i c l e i n f o a b s t r a c t

Article history: High-level radioactive liquid waste tanks have the possibility of releasing radioactivity, and thus it is of
Received 7 June 2017 great importance to identify hazards in such storage tanks and take measures to improve their safety. In
Received in revised form 30 November 2017 this paper, a hazard and operability (HAZOP) methodology is used to identify the hazards in a double-
Accepted 10 April 2018
shell stainless-steel tank for high-level radioactive liquid waste storage for which a risk matrix was
implemented to assess the risks posed by the hazard. First, during the HAZOP process, appropriate pro-
cess parameters and guidewords were selected to describe the deviation of the storage tank, and the
Keywords:
causes and possible consequences of deviations as well as existing protection measures were analyzed.
HAZOP
Risk matrix
The risk matrix then was used to evaluate the risk level of the deviation identified, combined with the
High-level radioactive liquid waste storage consequences of the deviation as well as the associated likelihood of its occurrence. Results showed that
tank primary tank leaks and hydrogen combustion or explosion in tanks are undesirable risks, and thus cor-
Hazard identification responding countermeasures were put forward. The analysis results could be used to provide guidance
Safety analysis for safe operation of, and rectification of hidden dangers in, high-level radioactive liquid waste storage
tanks.
Ó 2018 Elsevier Ltd. All rights reserved.

1. Introduction
The development of nuclear weapons and later of nuclear
power has resulted, over the past several decades, in a substantial
accumulation of high level radioactive liquid waste (HLLW) cur-
rently stored in tanks prior to its eventual solidification (Vitrifica-
tion is the approach currently used). HLLW contains the bulk of the
nonvolatile fission products from reprocessed fuel, actinides, and
trace amounts of uranium and plutonium (approximately 1% of
the amount in spent fuel), as well as other corrosion products,
and is predominantly composed of the aqueous raffinates from
the primary solvent extraction separation stage. Each ton of spent
fuel would produce 5 m3 of raffinates via the plutonium uranium
refining by extraction (PUREX) process; these raffinates usually
are concentrated by evaporation and are stored as an aqueous
nitric acid solution in high-integrity stainless-steel tanks. The
appropriate volume reduction assumed for the design of the stor-
age tank capacity at a reprocessing plant is a reduction to approx-
imately 0.6 m3 per ton of spent fuel (Dobson and Phillips, 2006).
HLLW exhibits the features of high-level radioactivity, strong cor-
⇑ Corresponding author at: Hunan Provincial Key Laboratory of Emergency Safety
Technology and Equipment for Nuclear Facilities, Hengyang 421000, Hunan, China.
E-mail address: zousl2013@126.com (S. Zou).
rosive properties, high heat load, and toxicity. The characteristic
of HLLW indicate that it has potentially disastrous hazards, and
the safety storage, treatment, and permanent disposal of HLLW is
a troublesome question for countries possessing nuclear power
sources and weapons.
Liquid storage can be considered an interim step between
reprocessing and solidification, and it is accepted that storage of
HLLW in tanks for aging to reduce the residual radioactivity
through decay of short-lived radioisotopes before reprocessing is
a necessity. It is therefore necessary to carry out a safety analysis
of HLLW storage tanks because of the possibility of accidental
radioactive substance diffusion. The storage facilities must be able
to handle multi-megacuries daily and must be designed and oper-
ated to the highest standards of integrity and containment. The
system must be constructed so that significant quantities of activ-
ity cannot escape from the shielded complex either in normal oper-
ation or as a result of any conceivable malfunction.
Historically, there had been a serious chemical explosion acci-
dent in the HLLW storage tank. The accident, which occurred in
1957 at the Maya Production Association (PA) in the Russian Fed-
eration, was also known as the ‘‘Kyshtym Incident”, which ranked
as Level 6 of the INES (International Nuclear event classification
standard). The accident was caused by technical failures coupled
with violation of the tank cooling regime and the event chain is

https://doi.org/10.1016/j.anucene.2018.04.021
0306-4549/Ó 2018 Elsevier Ltd. All rights reserved.
 S. Zou et al. / Annals of Nuclear Energy 119 (2018) 106–116
as follows (Batorshin and Mokrov, 2013): Failure of devices moni-
toring temperature and cooling water level
- Cessation of cooling water feed
- Evaporation of water out of liquid saline solution followed by
formation of dry nitrate and acetate salts
- Chemical explosion of the dry residue due to spontaneous
ignition.
The tank was totally destroyed due to the chemical explosion,
and two neighboring tanks were partially damaged in this acci-
dent. The accident resulted in the release of the 20MCi (740PBq)
of radionuclides to up to 1 km of air, causing serious radioactive
contamination in the East Urals (Akleyev et al., 2017).
In order to store the HLW generated by the national defense
project, the United States began using single-shell tanks to store
radioactive waste from the 50’s. However, since the 70’s, the Uni-
ted States has used double-shell tanks to store HLLW since there
are potential leakage risk in single-shell tanks (Sixty-six tanks have
leaked an estimated 2800 cubic meters of liquid at the Hanford
site). The structure of the tank used in China is similar to that of
double-shell storage tank. In August 2012, tank AY-102, the first
double-shell radioactive waste storage tank constructed at Hanford
(Washington, USA), was discovered to have an accumulation of
material at two locations on the floor of the annulus that separates
the primary tank from the secondary liner. The material was
radioactive, and its composition was consistent with tank AY-102
waste. The total leakage volume from the primary tank, estimated
on February 7, 2013, was 190–520 gallons. A significant portion of
the liquid has since evaporated, leaving 20–50 gallons of dry waste
in the tank annulus. The leak assessment concluded that a leak had
occurred at the bottom of the primary tank. The probable cause
was identified as corrosion at high temperatures in a tank whose
waste-containment margins had been reduced by construction dif-
ficulties. The consequence of this accident was the loss of use of a
3785-m3 double-shell tank (Engeman et al., 2012).
The past few decades of engineering practice have indicated
that there is no leakage in the HLLW storage tanks in China, but
some observed phenomena show that there are potential safety
hazards associated with China’s HLLW storage tanks, and exacer-
bation of the risks and safety uncertainties of these storage tanks
could gradually increase over time.
The International Atomic Energy Agency (IAEA) has defined, in
Non-Reactor Nuclear Facility Implementation Probability Safety
Assessment (PSA) Procedures(International Atomic Energy Agency,
2002) that the risk level of HLLW storage facilities is high, and
many hazard analysis methods like hazard and operability
(HAZOP), failure mode and effects analysis (FMEA), and safety
checklist (SC) are recommended in the risk identification stage
when executing a probabilistic safety assessment (PSA) method.
In 1998, staff from Los Alamos National Laboratory (New Mexico,
USA) performed a comprehensive PSA for the 18 tank farms at
Hanford Tank Farm (Sullivan et al., 1998). In their PSA study,
HAZOP, master logic development, and external events analysis
were used to identify candidate-initiating events. HAZOP is a com-
monly used technique in the nuclear industry to identify the qual-
itative potential of hazards and operating problems associated
with an existing or new system or piece of equipment, specific pro-
duction errors, and equipment failures that can lead to various
accidents (Rimkevicius et al., 2016). The HAZOP method has good
directivity in systematically checking processes, and it is focused
on investigating deviations from the intent of the original design
process that may cause harm or operational problems, to deter-
mine the cause and consequence of the deviations, and to assess
the consequential effects on the facility as a whole, and thus to pro-
vide the basis for the system’s risk management.
107
HAZOP does not try to provide quantitative results, but in many
situations, it is necessary to rank the identified risks mainly to pri-
oritize the actions to mitigate them, and this decision depends on
the risk level. For this purpose, HAZOP is combined with other
techniques. In these cases, quantitative techniques like fault trees
or event trees, or semi-quantitative techniques such as
probability-consequence matrices, have been applied (Fuentes-
Bargues et al., 2016). Because of the lack of failure data of subsys-
tems and components of HLLW storage tanks, this paper uses the
risk matrix, a form of semi-quantitative technique, for risk analysis.
The purpose of this paper is to identify and analyze risks in
HLLW storage tanks based on a combination of risk identification
through the HAZOP approach and risk assessment using a risk
matrix. In addition, the paper also analyzes the sufficiency of the
existing protection measures for the safety control of HLLW stor-
age tanks. Safety improvement measures are proposed as guidance
for the safe operation and hazards rectification of such storage
tanks. The paper is organized as follows: Section 2 describes the
features of tank structure and safety design of HLLW storage tanks.
The HAZOP method and risk matrix used in this study are intro-
duced in Section 3. Section 4 describes the HAZOP method and risk
matrix used for risk identification and risk ranking in HLLW storage
tanks and presents the analysis results and discussion. Finally, con-
clusions are drawn in Section 5.
2. System description
HLLW in China is characterized by strong corrosive properties
and high salt content, and it is a kind of a high-level liquid waste,
which mainly is stored in underground stainless-steel tanks at two
nuclear plants, with a small amount stored at research institutions
(Song, 1995; Sun, 2012). The operational storage experience of
HLLW in the United States, Britain, and other countries has proved
that a stainless-steel tank is the only large-scale application of the
interim storage technology for HLLW (Zhang, 2013). An HLLW stor-
age tank is generally a vertical, cylindrical stainless-steel storage
vessel placed in an underground concrete-walled equipment room.
The tank material is either carbon steel or stainless steel; carbon-
steel storage tanks were more common in the early stage of
nuclear waste storage engineering.
Because of the possibility of leakage, many countries including
China use double-shell tanks rather than single-shell tanks for
safety. A typical double-shell tank consists of three concentric
structures, as shown in Fig. 1: (1) an outer reinforced concrete tank
designed to sustain induced loads from soil and seismicity; (2) a
secondary stainless-steel tank that lines the concrete tank and is
designed to serve as a barrier to primary tank leaks; and (3) a
Fig. 1. Structural diagram of HLLW double-shell tank: 1, stainless-steel primary
tank; 2, stainless-steel cladding; 3, reinforced concrete cell.
108 S. Zou et al. / Annals of Nuclear Energy 119 (2018) 106–116
free-standing stainless-steel primary tank that rests on an insu-
lated concrete pad within the secondary tank. The primary tank
contains the waste material; the secondary tank, which is larger
than the primary tank, encloses the primary tank to create a sur-
rounding annular space. The annular space is large enough for
the unlikely event of a leak and is equipped with sumps and level
detection instrumentation to detect leaks from the primary tank
(Luo, 1993). Several penetrations, or risers, of various sizes exist
at the top of the secondary liner, which allows access into the
annular space. This access is used for a variety of activities, includ-
ing the installation and maintenance of visual inspection cameras,
sampling, and the introduction and retrieval of ultrasonic testing
crawlers and leak detection instruments.
The basic requirements for an HLLW storage tank system are
outlined in Regulations for designing storage building of high level
radioactive liquid waste (Chinese National Standard GB 11929-
2011, 2011); in short, a tank must deal with the following chal-
lenges (Dobson and Phillips, 2006):

Shielding and containment

Removal of fission product decay heat

Agitation of suspended solids

Corrosion

Disentrainment of radioactivity from exhausted air streams

Hazardous fault conditions
According to the design requirements outlined in Chinese
National Standard (GB 11929-2011, 2011), three independent
safety systems are required in an HLLW storage facility:
(1) Agitation system. An agitation system is an important tech-
nical system designed to keep solids in suspension and to
minimize the amount of solids present and ensure that the
crystallization point is not exceeded, particularly on the base
or on cooling surfaces of the facility (International Atomic
Energy Agency, 1979) (otherwise, the solids can lead to hot-
spots, resulting in the acceleration of the corrosion rate).
Storage tanks have two kinds of agitation systems: jet-
ballast agitation systems and air-lift recirculation units. Jet
ballasts are agitation devices that operate by using com-
pressed air to periodically blow the liquid in each jet-
ballast tube out through a nozzle at the base, creating a jet
of liquid that swirls across the base of the tank. Air-lift recir-
culation units use compressed air to create an air-lift system
within the tank, to provide a slow and thorough turnover of
material at reasonable gas-flow rates (Zhang and Lu, 2009;
Dobson and Phillips, 2006). The combination of the two
types of agitators keeps the solids in the waste liquid in a
suspended state and completely homogenizes the tank con-
tents. In addition, air stirring can be used to keep the hydro-
gen produced by the radiation sufficiently diluted (Zhang
and Lu, 2009).
(2) Cooling-water system. HLLW storage facilities are equipped
with cooling-water systems to remove the fission product
decay heat, thus keeping the temperature of the waste at
approximately 55–60 °C to prevent evaporation and ulti-
mately boiling and a possible release of radioactivity into
the environment. In addition to a plurality of independent
water-cooled cooling coils and heat exchanger, the cooling
water system is designed with standby cooling coil. To pre-
vent the radioactive material from being transferred to the
external cooling water, a two-circuit design is adopted in a
cooling-water system, which is shown schematically in
Fig. 2 (Luo, 1993). The cooling water in the primary circuit,
which is demineralized water, flows continuously through
internal coils to control the waste temperature, which is of
particular significance to maintaining the safety of nuclear
storage tanks. Cooling-water outlet temperature is inter-
locked with the water flow in the second circuit, and will
automatically increase the cooling-water flow of the second
circuit when the outlet temperature is higher 26 °C (Zhang
and Lu,2009).
(3) Ventilation system. An active induced-draft ventilation sys-
tem for a storage tank has two completely separate subsys-
tems: a primary tank ventilation system and an annulus
ventilation system. The tank is connected to the two subsys-
tems by manifolds, which maintain a slightly negative pres-
sure within the tank and annulus (Stewart et al., 1998). In
addition, the ventilation system is sampled for radionuclide
particulate matter before releasing air to the ambient
environment.
Because of the radiolytic properties of water and organic mate-
rials in the waste tanks, hydrogen and other organic vapors are
generated, and these combustible vapors can accumulate in the
tank vapor space and create an explosion hazard. Thus, each tank
is equipped with a purge ventilation system designed to continu-
ously remove hydrogen gas and vapors from the primary tank, par-
tially cool the tank contents, and prevent the release of
radionuclides to the atmosphere. The primary tank ventilation sys-
tem has an inlet high-efficiency particulate (HEPA) filter and two
outlet HEPA filters in parallel. The inlet HEPA filter prevents
radionuclide escape in breach conditions and prevents contami-
nants in the air (dust, dirt, etc.) from entering the tank during nor-
mal ventilation system operation, thereby minimizing the amount
of foreign matter that enters the tank. The outlet HEPA filter min-
imizes the release of radionuclides in the event that the exhaust
system becomes blocked or the exhaust fan fails (Subramanian
and Jenkins, 2004). The off-gas from the tanks consists of air used
for agitation and air used to dilute the hydrogen and vapors pass-
ing through the condensers, a scrubbing column, a cooler-heater,
and finally HEPA filters. Radioactivity and hydrogen concentration
are monitored before discharge through a stack. Note that the
hydrogen detector is capable of measuring hydrogen concentra-
tions of 1% (the accepted lower limit of the flammability of hydro-
gen in air is 4%). If the concentration is >2%, it will alert human
operators and aid in their diagnosis of the emergency and in deter-
mining corrective measures. The amount of air used for agitation is
sufficient to keep the concentration of hydrogen in the tank far less
than 4.1% by calculation (Zhang and Lu, 2009).
Operation of the annulus ventilation system in high-heat tanks
can lower the temperature of the primary steel, and thus, it mini-
mizes the potential for corrosion degradation of the steel or ther-
mal degradation of the concrete. The annulus ventilation system
is a significant contributor in keeping the tank bottom tempera-
tures cool (Stokes, 2013) (The temperature data available indicate
that the in-tank waste temperatures are influenced by annulus
ventilation outage events, with the center bottom of the tank
showing the largest temperature increases during outage periods
(Engeman et al., 2012). If a leak occurs from the primary tank,
the annulus ventilation system would serve a similar purpose as
the purge ventilation system.
In addition, all of the storage tanks are fitted with liquid sam-
pling systems that enable samples to be drawn from different
points in the tanks. All of the tank’s internal equipment, such as
cooling coils, agitators, and instruments, are accessible from the
working holes on the top of the tank and are placed suspended
without contact with the bottom of the tank. This arrangement
minimizes the chance of solids settling in the gap between the
devices and tank bottom and prevents the development of hot-
spots. Some tanks are retained as spares to ensure that if a serious
problem occurs, such as a leak, the waste of the leaking tank could
 S. Zou et al. / Annals of Nuclear Energy 119 (2018) 106–116
Fig. 2. Cooling- water system.
be transferred into this spare capacity. Thus, the storage tanks are
fitted with transfer systems to transfer waste in case of tank leak-
age or the subsequent treatment of waste liquid.
According to the safety storage requirements of HLLWs outlined
in Chinese National Standard (GB 11929-2011, 2011), the instru-
mentation in the tank should have anti-radiation protection, be
treated for corrosion resistance, and be highly reliable. All the
instrumentation should meet the requirements of regular inspec-
tion, maintenance, and replacement. For some important process
parameters, such as temperature, liquid level, and hydrogen con-
centration, multiple or redundant measuring instruments should
be set up in case any equipment failure occurs, and alarms and
warnings should be provided to signal any abnormal situation.
According to Chinese National Standard (GB 11929-2011, 2011),
safety monitoring points in a storage tank must include the
following:

Continuous level measurement

Signal and alarm of waste liquid excess

Acidity of waste liquid

Waste liquid temperature and high-temperature alarm

Temperature of cooling water at inlet and outlet

Vapor space pressure in the tank

Continuous detection and alarm of hydrogen concentration in
tank

Monitoring of cooling-water stream leaving the tank

Monitoring of ventilation extract system gas flow
3. Methodology and framework
The HAZOP technique is normally a team-based structured
method of identifying hazards, contributory causes, and operability
problems in plants and procedures, aimed at stimulating the imag-
ination of participants in a systematic way to identify hazards and
operability problems. The HAZOP process consists of four basic
steps: definition, preparation, examination, and documentation
and follow-up (International Electrotechnical Commission
International Standard IEC 61882-2016, 2016). Executing this
method relies on the use of guidewords (such as, no, more, less)
combined with process parameters that aim to reveal deviations
from the design intent. Having determined the deviations, the
expert team explores their feasible causes and their possible conse-
quences. Multidisciplinary experts should review whether the
safety measures are sufficient, and if such measures are insuffi-
cient, they should propose additional ones (Ahn and Chang.2016).
The HAZOP study procedure is illustrated in Fig. 3 and consists
of five main steps (IEC 61882-2016, 2016):
1. Determine the study object and select a part of the system for
analysis.
2. Determine the parameters, define the guidewords, and agree
whether a guideword is used directly for the parameter itself
or for the individual feature of the parameter.
109
3. Combine the guidewords (such as, no, more, less) with param-
eters (e.g., temperature, flow, pressure) that aim to reveal
deviations.
4. Analyze the causes and consequences of the deviations.
5. Identify existing protection ad mitigation measures for each
deviation, and generate recommendations for further risk
reduction where necessary.
3.1. Nodes
To carry out a systematic study, it is necessary to divide the
plant, modification design, or procedure into individual items,
operational steps, or areas having a single functional intent. These
may be plant items or steps in procedures, and they are referred to
as nodes. Each node is given a unique identifying number during
the course of the study (Rimkevicius et al., 2016).
3.2. Parameters
The parameters can be classified into two categories: (1) speci-
fic parameters, that is, variables describing physical and chemical
aspects of the process that can be measured or detected [the out-
come of deviations on predetermined design conditions could
cause a hazardous scenario in the absence of safeguards (such as
flow and temperature controls)]; and (2) general parameters, that
is, a group of situations that, by their absence or qualitative mod-
ifications may engender a hazardous process condition, and,
although they are the causes of specific parameter deviations, their
independent analysis is essential for ensuring the desired level of
detail in hazard identification (additions, containment, etc.)
(Dunjó et al., 2011).
3.3. Guidewords
The guideword is a specific word or phrase in the HAZOP
method used to describe the deviation of design purpose (inten-
tion). The standard HAZOP guidewords in the process industry
are no, more, less, as well as, part of, and other than; these basic
guidewords and their meanings are listed in Table 1 (IEC 61882-
2016, 2016). The guidewords are selected in accordance with the
process parameters and operational conditions and should be
tested against the system to confirm their adequacy (Ahn and
Chang, 2016).
3.4. Deviations
The combination of guidewords and parameters can form a ser-
ies of hypothetical situations that deviate from system design
intentions; a meaningful deviation is one that is physically possible
and could lead to potential hazards to safety, health, or the envi-
ronment. For each deviation identified, a team of experts must con-
sider ‘‘Is the deviation possible?” and attempt to find possible
causes and expected results for the deviation by a series of
110 S. Zou et al. / Annals of Nuclear Energy 119 (2018) 106–116

Fig. 3. Flowchart of HAZOP examination procedures.

Table 1 Table 2
Basic guidewords and their generic meanings (IEC 61882-2016, 2016). List of standard and most common process parameter deviations used in HAZOP
analysis (DOE-HDBK, 2004).
Guideword Meaning
No Complete negation of the design intent Process Deviation Process Deviation
More Quantitative increase parameter parameter
Less Quantitative decrease Flow (rate) No flow Time Too long
As well as Qualitative modification/increase High flow Too short
Part of Qualitative modification/decrease Low flow Too late
Reverse Logical opposite of the design intent Reverse flow Too soon
Other than Complete substitution
Flow (quantity) Too much Sequence Omit a step
Too little Steps reversed
questions like the following ‘‘What causes the system temperature Extra step
to be too high?” and ‘‘What could happen if the temperature to be Pressure High pressure pH High pH
too high in the system?” Each deviation is then considered to Low pressure Low pH
decide how it could be caused and what the potential conse- Temperature High temperature Viscosity High viscosity
quences would be. In this way, all the deviations of the system Low temperature Low viscosity
are obtained. The expert team also identifies and records those Level High level/ Heat value High-heat value
safeguards that currently are built into the design or form normal overflow
practice and suggests possible ways to protect it (Kościelny et al., Low level/empty Low-heat value

2017). Mixing Too much mixing Phases Extra phase

A list of the standard and most common process parameter Not enough Phase missing
mixing
deviations used in HAZOP methodology are detailed in Table 2 Loss of agitation
(the U.S Department of Energy Standard, DOE-HDBK, 2004). In Reverse mixing
addition, the HAZOP group can propose more deviations if Composition Component Location Additional source
required. The meanings of a set of deviations to analyze continuous missing
chemical process nodes that include the specific parameters and High Additional
general parameters can be found in the work by Dunjó, et al., 2011. concentration destination
Low Wrong source
concentration
3.5. Risk assessment Wrong destination
Purity Impurities present Reaction No reaction
Risk is often expressed in terms of a combination of the conse- Catalyst Too little reaction
quences of an event together with the associated likelihood of its Deactivated/ Too much reaction
occurrence. To make decisions about the acceptance of risk of each inhibited
Reaction too slow
deviation and prioritize the risks requiring the most attention after Reaction too fast
HAZOP analysis, it is recommended that the risk ranking be
 S. Zou et al. / Annals of Nuclear Energy 119 (2018) 106–116 111

performed using a risk matrix. A risk matrix is a typical semi- Table 4

quantitative and simple assessment tool used to rank and prioritize Severity classification.

risk of (generally adverse) events and to make decisions about Description Definition
whether certain risks can be tolerated based on historically statis- C1 Negligible Negligible effect on the safety operation, but deserves close
tic data (Ni et al., 2010; Duijm, 2015). From the assessment result, attention, but no safety concerns for the facility workers, as
in which the criticalities of risks are ranked, the different priorities well as no environmental effect.
of risks are indicated, suggesting which risk is highly dangerous C2 Minor Potential effects on the safety operation of the facility, but
no safety concerns for the facility workers, as well as no
and that requires more attention, and which risk can be ignored. environmental effect.
Hence, the assessment result is also the foundation for further con- C3 Moderate Potential significant damage of the tank, partial loss of
trol and mitigation measures (Ni et al., 2010). function or negligible safety concerns for the facility
The application of a risk matrix requires the use of discrete cat- workers, and no significant environmental effect outside
the facility confinement systems.
egories or classes for likelihood and severity. The likelihood cate-
C4 Serious The loss of use of the tank or low radiological exposure dose
gories in this study are referred to as the hazard scenario consequences to the facility workers, and limited
likelihood classification in the U.S Department of Energy Standard environmental discharge of hazardous material outside the
(DOE –STD -3009 -2014, 2014), which is shown in Table 3. The facility.
severity categories are designed with consideration of the person- C5 Critical The integrity of the tank has been damaged with potential
significant radiological dose consequences to on-site
nel (staff, public) radiation dose, environmental damage, and
workers located outside the facility, and large
equipment damage which are referred to (HNF-6527, 2000; Buck environmental discharge of hazardous material within or
et al., 1995) as shown in Table 4. outside the plant site boundary.
The risk matrix is designed according to the International Orga-
nization for Standardization requirement (ISO 31010:2009, 2010);
this matrix also refers to additional reports (Duijm, 2015; HNF- Table 5
Risk matrix.
6527, 2000; Buck et al., 1995). Within the matrix, as shown in
Table 5 and Fig. 4, the green zone denotes reasonably acceptable Risk Risk Risk qualitative description
risk, the yellow zone denotes risk that is acceptable with control, level description

and the orange and red zones denote undesirable risk and intoler- Red Intolerable Risk must be mitigated; either decreases the
able risk, respectively. When the causes and consequences of each probability or relieves the consequences.
Orange Undesirable Undesirable and only accepted when risk
deviation are obtained through HAZOP analysis, the level of likeli-
reduction is impracticable.
hood and severity of each deviation can be determined by referring Yellow Acceptable Acceptable after review, and regular safety
to Tables 3 and 4, and thus the risk level of each deviation can be with control assurance measurement shall be imposed.
obtained. Green Reasonably Risk reduction not needed.
acceptable

4. HAZOP and risk-matrix application for the safety analyses of

HLLW tanks

4.1. Target system

An HLLW storage tank is considered the target system. The

safety monitoring parameters in the HLLW storage tank are the
key objects of study.

4.2. Determine the nodes, process parameters, and guidewords

Fig. 4. Risk matrix.
We selected the nodes according to the system composition of
the HLLW storage facility, and the nodes in the study are listed
in Table 6. The main monitoring parameters in the system are in
tion, cooling-water, and ventilation systems are adopted to reflect
reference to the design requirements outlined in Chinese National
system deviations.
Standard (GB11929-2011, 2011); the key parameters in the agita-
According to the list of the standard and most common process
parameter deviations used in HAZOP analysis (DOE-HDBK, 2004),
Table 3 the parameters as well as guidewords in a HAZOP study of an
Qualitative likelihood classification (DOE-STD-3009-2014, 2014). HLLW storage tank are listed in Table 6.
Description Likelihood range (/year) Definition
6
L1 Improbable Likelihood less than 10 Events are so unlikely that 4.3. Results
they generally do not require
special controls.
L2 Extremely 104 > likelihood > 106 Events that will probably not The results of a HAZOP study are normally recorded in a HAZOP
Unlikely events that will probably occur during the lifetime of worksheet. Table 7 summarizes the safety results of an HLLW stor-
not occur during the the facility. age tank analyzed using the HAZOP method combined with a risk
L3 Unlikely 102 > likelihood > 104 Events that are not matrix. Here, we define the deviation frequency level and conse-
anticipated to occur during
the lifetime of the facility.
quence level considering safety measures as the frequency and
L4 Anticipated Likelihood > 102 Events that may occur consequence for risk analysis.
several times during the According to the HAZOP analysis, the process parameters of
lifetime of the facility high-level radioactive liquid waste tank are mostly interrelated,
(incidents that commonly
and the deviations of one parameter usually lead to the change
occur).
of the other parameter. Therefore, it is possible to get the causes
112 S. Zou et al. / Annals of Nuclear Energy 119 (2018) 106–116

Table 6
Sheet of HAZOP deviation.

Node Parameters More Less No As well as Part of Reverse Other than

p p p 1)
1. Primary tank Liquid surface level – – – –
p p
Vapor space pressure – – – – –
p p p 1)
Hydrogen concentration – – – –
p p
Acidity – – – – –
p p
Waste temperature – – – – –
p p p
2. Agitation system Agitation – – – –
p p
3. Cooling-water system Inlet temperature – – – – –
p p
Outlet temperature – – – – –
p 2) p p p2)
Flow – – –
p
Outlet purity – – – – – –
p 2) p p
4. Purge ventilation system Flow of exhaust pipe – – – –
p
Outlet purity – – – – – –
p 2) p p
5. Annulus ventilation system Flow of exhaust pipe – – – –
p
Outlet purity – – – – – –
1)
Deviation not available.
2 )
There are no credible causes or significant consequences.

of abnormal conditions from the change trend between
parameters.
The instrument failure is not considered in the HAZOP analysis
of this paper. Pluralities of monitoring devices with different work-
ing principles are set up for the important parameters of the tank,
which can be judged as malfunction when the same trend of mon-
itoring occurs.
(1) Deviations with high frequency of occurrence
After HAZOP analysis, the highest-frequency deviations in the
high-level waste storage tank are as follows:

Low liquid level caused by evaporation of water in the tank.

More acidity caused by evaporation of water in the tank.

Less acidity caused by the volatilization of acid in the HLLW.
HLLW acidity is an important process parameter and also is one
of the main factors affecting the corrosion rate of the tank. Exces-
sive acidity will accelerate the corrosion rate of the entire tank,
whereas low acidity will lead to the precipitation of nitrates and
local concentration of fissile material, which has the possibility of
inducing a critical accident. The agglomerations of solids will lead
to hotspots, which would cause partial corrosion in the tank, or
even result in a critical event in the waste. However, the water
evaporation rate and volatilization rate of acid in the liquid waste,
which are main factors affecting the liquid acidity, are influenced
by the liquid temperature, ventilation conditions in the tank, and
composition of the solution; thus, it is difficult to estimate the
acidity of HLLW in the tank. To maintain the acidity at a level that
produces minimum sludge formation and also limits the corrosion
of the stainless steel, acidometers are adopted to determine the liq-
uid acidity, and an acid-adding unit and a water-adding unit are
provided to adjust the liquid acidity.
(2) Deviations with severe consequence
It is obvious that the most severe consequence in an HLLW stor-
age tank is radioactivity release. Radioactivity also will be released
because of HEPA filter failure in the purge ventilation system, but
once the radioactive material is detected in the exhaust air from
the tank, the failed ventilation system would be cut off as soon
as possible, and the emergency ventilation system would be
started to prevent further radioactivity release. Thus, the conse-
quence of a HEPA filter failure is not serious.
Form the results of HAZOP, the causes that lead to the most sev-
ere deviations consequence is the rupture of tank’s vapor space,
which would lead to a uncontrolled release of radioactive material.
In the case of the integrity of the primary tank being damaged, the
tank vapor space pressure would increase, and the hydrogen con-
centration would decrease at the same time. Thus, the tank vapor
space pressure as well as hydrogen concentration can be joint indi-
cators for the destruction of tank integrity.
Once the reason for the liquid level rising in the primary tank or
for the low waste temperature is identified as natural water intru-
sion, then it is certain that the integrity of the primary tank is dam-
aged. A large amount of radioactive aerosols would escape from
the primary tank before natural water intrusion into it, and imme-
diate measures should be taken to prevent the spread of contami-
nation and exposure of the operating staff.
In addition, the radioactive liquid waste has a tendency to gen-
erate hydrogen through radiolysis of water and other compounds
in the waste containing hydrogen. If the ventilation system fails,
and then the concentration of flammable gases might be high
enough to combust or even explode, and uncontrolled release of
radioactive material could occur due to dome failure, leading to
onsite or offsite radiation exposure resulting in serious conse-
quences. Thus it is an important safety measures to monitor and
control hydrogen concentration in the HLLW storage tank.
(3) Undesirable risks in an HLLW storage tank
From the risk-matrix analysis, there is no intolerable risk in the
HLLW storage tank, but two undesirable risks do require risk-
reduction measures:

The primary tank leaks.

Hydrogen combustion or explosion in tanks.
Once a primary tank leak has been identified, the waste in the
tank should be immediately transferred to the standby tank, and
measures to decommission the leaking tank should be taken. The
most likely reason for the tank leak is corrosion, which is affected
by waste temperature, waste acidity, and irradiation. If solids are
allowed to remain in contact with the tank surface for an extended
period, localized heating and corrosion rates much higher than
anticipated can occur. Therefore, the temperature and acidity of
the tank should be continuously monitored. To test the corrosion
rate, corrosion coupons are suspended inside the tank to monitor
the corrosion rates and corrosion types at different locations. For-
tunately, the chance of radioactive material being released into the
environment because of primary HLLW tank leakage is negligible
thanks to the tank’s double-shell design. Leakage from the primary
tank can be detected very early because of the contamination of
Table 7
HAZOP worksheet.
Node Deviation Possible cause
1 1. High liquid level. 1.1 Cooling coils rupture and
water in cooling system enters
liquid waste.
1.2 Waste retains large amount
of gas.
1.3 Natural water intrusion.
2. Low liquid level. 2.1 Primary tank leak.
2.2 Evaporation losses.
3. High vapor space pressure. 3.1 Purge ventilation system fails
or is blocked.
3.2 Temperature in tank too
high.
3.3 Vapor space of tank ruptured.
3.4 Waste retains gas because
the agitation system fails and
large amounts are released
suddenly.
Consequences
① Primary cooling water circuit becomes
contaminated.
② Tank is topped with liquid.
③ Amount of liquid waste to be treated
increased.
Large amount of gas released suddenly,
likely to swamp ventilation system,
causing radioactivity release.
① Tank is topped with liquid.
② Amount of liquid waste to be treated
increased.
③ Radioactive aerosol escapes from crack.
Waste in tank leaks into second barrier,
causing loss of use of tank.
Nitrate is precipitated in waste, and then
forms hotspots if HLLW evaporates too
quickly.
① Tank may explodes because of
excessive pressure thus resulting
radioactivity release.
② Flammable gases may combust or
explode once there are ignition sources.
①, ②, ③ Same as above.
④ Corrosion rate increases.
① Radioactive aerosol escapes because of
excessive pressure in tank.
② Natural water intrusion into tank.
Likely to swamp ventilation system,
causing radioactivity release.
Safeguard/interlocks P S R Recommendations
① Liquid level monitoring by continuous L3 C3 Y
level gauge.
② Signal and alarm of waste liquid excess.
③ Continuous c-ray monitoring device in
cooling-water outlet pipeline.
④ Cooling-water system is designed with
multiple independent water-cooled
cooling coils and standby cooling coil.
⑤ Cooling-water flow monitoring and
automatic operation to stop cooling-water
supply.
⑥ Waste temperature monitoring device.
① Liquid level monitoring by continuous L2 C3 Y
level gauge.
② Using agitation devices to stir HLLW.
① Liquid level monitoring by continuous L1 C5 Y
level gauge.
S. Zou et al. / Annals of Nuclear Energy 119 (2018) 106–116
② Signal and alarm of waste liquid excess.
③ Tank maintains negative pressure to
prevent radioactive aerosol escape and
has negative pressure indication.
④ Waste temperature monitoring device.
① Liquid level monitoring by continuous L3 C4 O ① Periodic inspecting of primary
level gauge. tank wall and annulus floor by
② Corrosion monitoring of tank. using remote inspection
③ Sampling from air and water from techniques (video and ultrasonic
annulus space. inspections).
④ Waste transport system and waste can ② Tank structural analysis and
be transported into spare tank once studies for thermal, operating,
primary tank leaks. and seismic loads.
③ Waste chemistry sampling
and adjustments for corrosion
mitigation.
④ Perform corrosion coupon
testing periodically.
① Liquid level monitoring by continuous L4 C1 Y
level gauge.
② Tank equipped with water supply unit
and water added to tank regularly.
① Tank maintains negative pressure and L3 C3 Y
has negative pressure indication.
② Emergency ventilation system.
③ Stainless-steel tanks can withstand
great pressure.
①, ②, ③ Same as above. L2 C3 Y
④ Interlocked between cooling-water
outlet temperature and water flow in
second circuit.
⑤ Emergency cooling-water system once
cooling-water system fails.
① Tank maintains negative pressure and L1 C5 Y
has negative pressure indication.
② Liquid level monitoring by continuous
level gauge.
Use agitation devices to stir HLLW. L2 C3 Y
113
(continued on next page)

Table 7 (continued)
Node Deviation
4. Less vapor space pressure.
5. High hydrogen concentration.
6. Less hydrogen concentration.
7. More acidity.
8. Less acidity.
9. High waste temperature.
10. Low waste temperature.
Possible cause
4.1 Ventilation inlet blockage.
4.2 Agitation system fails.
5.1 Active ventilation
interruption or ventilation
system blockage.
5.2 Temperature in tank
increases, accelerating
hydrogen-generation rate.
6.1 Vapor space of tank ruptured
7.1 Evaporation of water
8.1 Acid in waste liquid is
volatile
9.1 Primary cooling-water
system outage or low flow.
9.2 Excessive crystals deposited
on cooling coils, thus reducing
heat-removal efficiency of
cooling system.
9.3 Annulus ventilation system
outage or low flow.
10.1 Cooling coils rupture and
water in cooling systems enter
liquid waste.
10.2 Natural water intrusion.
114
Consequences Safeguard/interlocks P S R Recommendations
No obvious consequence. L3 C2 Y Air inlet pipes and agitation
Consequence is same as deviations ‘‘Loss L2 C3 Y system should be checked in
of agitation” and ‘‘Not enough agitation.” time once pressure is lower than
design.
Flammable gases combust or explode ① Hydrogen concentration monitoring L2 C5 O ① Operate with restrictions that
once there are ignition sources. and alarm. eliminate potential ignition
② Emergency ventilation system. sources.
③ Air from agitation device can also dilute ② Using inert gases, e.g., helium,
hydrogen. to assist ventilation.
① Flammable gases combust or explode ①, ② Same as above. L2 C5 O
once there are ignition sources. ③ Interlocked between cooling-water
② Tank may explodes because of outlet temperature and water flow in
excessive pressure resulted by excessive second circuit.
temperature. ④ Emergency cooling-water system once
cooling-water system fails.
⑤Stainless-steel tanks can withstand
great pressure.
① Radioactive aerosol may escape once ① Tank maintains negative pressure and
S. Zou et al. / Annals of Nuclear Energy 119 (2018) 106–116
L1 C5 Y
pressure is same as atmospheric pressure. has negative pressure indication.
② Natural water intrusion. ② Hydrogen concentration monitoring.
Results in more corrosive medium. ①Acidity monitoring device. L4 C2 Y
② Set water supply unit and add water to
tank regularly.
① Nitrate is precipitated in waste, and ① Acidity monitoring device. L4 C2 Y
then forms hotspots. ② Acidity through regular sampling and
② Plutonium is deposited, thus resulting analysis, counteracted by addition of nitric
in critical nuclear event in waste. acid.
③ Agitation device to prevent solid
deposition in waste.
① HLLW in tank boils, and tank may ① Temperature of tank contents L3 C3 Y
explode because of high pressure. monitored at different levels in tank and
② Corrosion rate increases. around base; tank equipped with high-
③ Accumulation of hydrogen because of temperature alarm.
generation-rate increase. ② Water flow monitoring device.
③ Duplicate pumps and stand-by
emergency power supply.
④ Emergency cooling-water system.
Consequence same as above. ①Temperature of tank contents is L2 C3 Y
monitored at different levels in tank and
around base; tank equipped with high-
temperature alarm.
②Cooling-water system is designed with
multiple independent water-cooled
cooling coils and standby cooling coil.
Corrosion rate of tank bottom increases. ①Temperature of tank contents L3 C3 Y
monitored at different levels in tank and
around base; tank equipped with high-
temperature alarm.
② Emergency annulus ventilation system.
①, ②, ③ Same as consequence of Cause Safeguards same as safeguard against L3 C3 Y
1.1 in node 1. Cause 1.1 in node 1.
①, ②, ③ Same as consequence of Cause ①, ②, ③ Same as safeguards against L1 C5 Y
1.3 in node 1. Cause 1.3 in node 1.
2 1. Loss of agitation.
2. Not enough agitation.
3 1. No flow in cooling-water system.
Jet-ballast agitation system and
air-lift recirculation unit outage.
Partial failure of jet-ballast
agitation systems and air-lift
recirculation units.
1.1 Cooling-water pipes
experience large breaks or are
blocked.
① Excessive sludge formation in tank, Duplicate pumps and stand-by emergency L2 C3 Y
which may increase tank-bottom power supply.
temperature, thus significantly increasing
corrosion rate.
② Solids in waste deposited on cooling
water coils, resulting in localization
corrosion as well as reduction of heat-
transfer coefficients of cooling-water
system.
③ Solids in waste deposited on
monitoring device in waste makes device
lose functionality.
④ Waste may retain large amount of gas.
①, ②, ③, ④ Same as above, but less L3 C2 Y
severe.
Cooling system loses cooling function, ① Automatic operation to stop cooling- L3 C3 Y
causing liquid temperature to be too high. water supply.
② Flow monitoring.
③ Emergency cooling water system.

S. Zou et al. / Annals of Nuclear Energy 119 (2018) 106–116

2. Low flow in cooling-water system.
3. Radioactive material present in
cooling water.
4 1. No flow in exhaust pipe.
2. Low flow in exhaust pipe.
2. Radioactive material present in
outlet air.
5 1. No flow or low flow in the exhaust
pipe.
2. Radioactive material present in
outlet air.
1.2 Power failure or pump failure Consequence same as above. ①, ②, ③Same as above. L3 C3 Y
of cooling-water system. ④Duplicate pumps and stand-by
emergency power supply.
Cooling coils break. ①, ②, ③ Same as consequence of Cause Same as safeguard of Cause 1.1 in node 1. L3 C3 Y
1.1 in node 1.
Cooling coils break. ①,②,③ Same as consequence of Cause 1.1 Same as safeguard of Cause 1.1 in node 1. L3 C3 Y
in node 1.
1.1 Purge ventilation system fails ① Flammable gases concentrate, leading ① The emergency ventilation system. L3 C3 Y
or is blocked because of to combustion or even explosion once ② Flow monitoring.
ventilation exhaust filter there are ignition sources.
blockage, vent fan failure, or vent ② Supersaturated liquid condenses on
line breach. parts of ventilation system, increasing
corrosion of ventilation system.
1.2 Tank loses agitation system ①, ② Same as above, and may also lead to L1 C3 G
and air inlet system at same same consequences as ‘‘Loss of agitation”
time. in node 2.
Ventilation inlet blockage or ①, ② Same as consequences of Cause 1.1 ① The emergency ventilation system. L3 C3 Y
failure of agitation system or in node 4, but less severe. ② Flow monitoring.
partial failure of exhaust system.
Outlet high-efficiency Radioactive aerosols escape into Monitoring of the ventilation extract L3 C3 Y
particulate (HEPA) filter atmosphere. system gas flow.
malfunctioned.
Purge ventilation system fails or ① Accumulation of stagnant water in ① The emergency annulus ventilation L3 C3 Y
is blocked because of the annulus, thereby increasing risk of system.
following: ventilation exhaust corrosion. ② Flow monitoring.
filter blockage, ventilation inlet ② Supersaturated liquid condenses on
blockage, vent fan failure, vent parts of ventilation system, increasing
line breach. corrosion of ventilation system.
③ Increasing temperature of liquid in
primary tank.
Primary tank leaks and outlet Radioactive aerosols escape into ① Monitoring of the ventilation extract L1 C4 Y
high-efficiency particulate atmosphere. system gas flow.
(HEPA) filter malfunctioned. ② The emergency annulus ventilation
system.

115
116 S. Zou et al. / Annals of Nuclear Energy 119 (2018) 106–116
the air and liquid inside the annular space; the installation of
remotely operated visual-inspection devices may assist in deter-
mining the exact location of a leak.
In order to prevent hydrogen from burning or exploding in the
tank, it is necessary to ensure that all kinds of monitoring devices
in the tank as well as equipment in the ventilation system do not
produce electric spark to eliminate the ignition source of the tank.
In addition, hydrogen detectors in tanks would aid operators in
their diagnosis of the emergency and in deciding on corrective
measure.
It is clear that risk matrices can be used to analyze the potential
risks of the system and to rank risk levels to assist operators in
developing safety management strategies. However, some draw-
backs of the risk matrix must be noted, such as the existence of
subjectivity in classifying probabilities and severities, therefor an
experienced panel is needed when using this method.
5. Conclusions
Large amounts of high-level radioactive liquid waste that have
not yet been disposed of that are stored in double-shell stainless
steel storage tanks pose a potential risk of environmental pollution,
and thus the safe storage of such waste is very important.
The HAZOP analysis methodology and risk-matrix approach
described in this paper are applicable to HLLW storage tanks and
provide useful and meaningful analysis outcomes. This work iden-
tified the causes and consequences of deviations of key process
parameters during the long-term storage of HLLW and analyzed
the risks of deviations through the determination of the deviation
frequency and severity of resulting consequences. The results of
analysis reflect that primary tank leakage and hydrogen combus-
tion or explosion in tanks are the main risks that must be moni-
tored and strictly controlled to avoid catastrophic events caused
by HLLW storage tank failures. The analysis results provide a good
guidance for the daily operation, maintenance and safety manage-
ment for the HLLW storage tanks.
It is suggested that in the process of HAZOP analysis, it is best to
determine the value for specific parameters and propose an accept-
able range of fluctuations, so as to identify the harmful deviation of
the system.
Acknowledgment
The paper was supported by University of South China Innovation
Foundation For Postgraduate (2016XCX03).
We would like to thank LetPub (www.letpub.com) for providing
linguistic assistance during the preparation of this manuscript.
References
Ahn, J., Chang, D., 2016. Fuzzy-based HAZOP study for process industry [J]. J. Hazard.
Mater. 317, 303–311.
Akleyev, A.V., Krestinina, L.Y., Degteva, M.O., Tolstykh, E.I., 2017. Consequences of
the radiation accident at the Mayak production association in 1957(the
’Kyshtym Accident’). J. Radiol. Prot. 37, R19–R42.
Batorshin, G.Sh., Mokrov, Y.G., 2013. Experience in eliminating the consequence of
the 1957 accident at the Mayak Production Association, International Experts’
Meeting on Decommissioning and Remediation After a Nuclear Accident. IAEA,
Vienna, Austria.
Buck, J.W., Gelston, G.M., Farris, W.T., 1995. Scoring methods and results for
qualitative evaluation of public health impacts from the Hanford high-level
waste tanks. Integrated risk assessment program. Office of Scientific & Technical
Information Technical Reports.
Dobson, A.J., Phillips, C., 2006. High level waste processing in the U.K. - hard won
experience that can benefit U.S. nuclear cleanup work. Waste Manage. (Oxford)
43 (6), 755–765.
DOE-HDBK-1100-2004: DOE Handbook: Chemical Process Hazards Analysis, 2004.
U.S.Department of Energy, Washington, DC.
DOE –STD -3009 -2014, 2014. Preparation of nonreactor nuclear facility
documented safety analysis. U.S. Department of Energy, Washington, DC.
Duijm, N.J., 2015. Recommendations on the use and design of risk matrices [J].
Safety Sci. 76, 21–31.
Dunjó, J., Fthenakis, V., Darbra, R.M., Vilchez, J., Arnaldos, J., 2011. Conducting
HAZOPs in continuous chemical processes: part II. A new model for estimating
HAZOP time and a standardized approach for examining nodes [J]. Process
Safety Environ. Protection 89 (4), 224–233.
Engeman, J.K., Girardot, C.L., Harlow, D.G., Rosenkrance, C.L., 2012. RPP-ASMT-
53793, Rev. 0: Tank 241- AY- 102 leak assessment report. Washington River
Protection Solutions.
Fuentes-Bargues, J.L., González-Gaya, C., González-Cruz, M.C., Cabrelles-Ramírezc,
V., 2016. Risk assessment of a compound feed process based on HAZOP analysis
and linguistic terms [J]. J. Loss Prev. Process Ind. 44, 44–52.
GB11929-2011, 2011. Regulations for designing storage building of high level
radioactive liquid waste[S]. (National standard of China).
HNF-6527 Revision 0, 2000. Hazard Evaluation for Storage of Spent Nuclear Fuel
Sludge at the Solid Waste Treatment Facility .U.S. Department of Energy,
Washington, DC.
International Atomic Energy Agency, 1979. Technical reports series No 191:
handling and storage of high-Level radioactive liquid wastes requiring
cooling. IAEA, VIENNA.
International Atomic Energy Agency, 2002. IAEA-TECDOC-1267: procedures for
conducting probabilistic safety assessment for non-reactor nuclear facilities.
IAEA, VIENNA.
International Electrotechnical Commission, 2016. IEC 61882:2016 Hazard and
operability studies (HAZOP studies) - application guide. IEC, Geneva,
Switzerland.
ISO, 2009. IEC/ISO 31010:2009. Risk management – risk assessment techniques.
2010E ed. CENELEC. Brussels.
Kościelny, J.M., Syfert, M., Fajdek, B., et al., 2017. The application of a graph of a
process in HAZOP analysis in accident prevention system [J]. J. Loss Prev.
Process Ind. 2017 (50), 55–66.
Luo, W., 1993. The design, construction and inspection of storage tanks for high-
level liquid radioactive waste [J]. Atomic Energy Sci. Technol. 27 (5), 465–474
[in Chinese].
Ni, H., Chen, A., Chen, N., 2010. Some extensions on risk matrix approach. Safety Sci.
48, 1269–1278.
Rimkevičius, S., Vaišnoras, M., Babilas, E., Ušpuras, E., 2016. HAZOP application for
the nuclear power plants decommissioning projects [J]. Ann. Nucl. Energy 111,
22–30.
Song, C., 1995. The concept flow sheet of partitioning process for the Chinese high-
level liquid waste. Atomic Energy Sci. Technol. 29 (3), 201–209 [in Chinese].
Stewart, T.L., Frey, J.A., Geiser, D.W., Manke, K.L., 1998. Overview of U.S. radioactive
tank problem. In: Schulz, W.W., Lombardo, N.J. (Eds.), Science and Technology
for Disposal of Radioactive Tank Wastes. Springer, Boston, MA.
Stokes, S.A., 2013.Defense Nuclear Facilities Safety Board Staff Issue Report: Safety
and integrity implications of decanting liquid from Hanford Tank 241一AY-102.
Sullivan, L.H., MacFarlane, D.R., Stack, D.W., 1998. Probabilistic safety assessment
for high-level waste tanks at Hanford. In: Stenhouse M.J., Kirko V.I. (eds)
Defence Nuclear Waste Disposal in Russia: International Perspective. NATO ASI
Series (Series 1: Disarmament Technologies), vol 18. Springer, Dordrecht.
Sun, B., 2012. Technology study and analysis safety store of HLLW from certain
reprocessing plant. Hengyang, the University of South China [in Chinese].
Subramanian, K.H., Jenkins, C.F., 2004. Failure analysis of high-level radioactive
waste tank purge ventilation vent pipe. J. Fail. Anal. Prev. 4 (4), 68–77.
Zhang, L., 2013. The predicament and countermeasures of nuclear waste
management. East China Institute of Technology, Fuzhou [in Chinese].
Zhang, Y., Lu, S., 2009. Safety measures for storage of high level waste liquid. Progr.
Rep. China Nucl. Sci. Technol., 71–74 [in Chinese]