Radiation accident or radiation incident? When are IRR17 contingency plans appropriate?
Published: Feb 04, 2024
Prelim
The end of 2023 and start of 2024 has been a busy time for Ionactive. We have been heavily involved in helping radiation users prepare their safety assessments (SA) for consent renewal (at the request of the HSE). If you would like to review this process then please head over to New UK Consent process for users of Ionising Radiation. One of the question on the SA relates to contingency and will say something like 'Give a summary of possible radiation accident situations as identified in the radiation risk assessment, their likelihood and potential severity'. Where you have a radiation accident, the Ionising Radiations Regulations 2017 (IRR17) will require you to have a contingency plan which is rehearsed at suitable intervals - IRR17 (13) - Contingency Plans.
Whilst looking over the risk assessment and consent safety assessment application form for an industrial irradiation facility, it become apparent that the radiation accident section would be on the light side. This is despite the fact that the plant in question is a high hazard facility (but with low exposure risk in terms of occupational exposure and reasonably foreseeable accidents - or do we mean incidents?).
Following this a random selection of local rules were examined from a variety of medium hazard (registration level) and high hazard (consent level) - over a diverse range of ionising radiation use. In practically all cases there was a contingency section. This section is expected, is a favourite of our regulators (HSE, ONR, HSENI), and is rehearsed in some way (from table top discussion through to full workplace demonstration). The local rules were then cross-referenced with their risk assessment, and sure enough, radiation incidents (or accidents ?!) were identified. This got us thinking.
The use of incident (or accident) in the above text is deliberate and this will become obvious as this blog article proceeds.
So let's go back to some definitions first, and then explore some radiation incidents (incidents with some radiation safety significance), and see how many of these meet the definition of a radiation accident. If there are no radiation accidents identified in the risk assessment then the local rules will not contain a contingency plan.
But - local rules will probably contain contingency arrangements - because they always do. However, are these arrangements a "plan" as defined by IRR17 (13). Let's have a look.
Radiation accident and contingency - interpretation
First some definitions (interpretation), direct from IRR17, and then a look at the ACoP for these regulations.
The regulations (and ACoP) for IRR17 can be downloaded from our radiation resources section - IRR17 ACoP (this will open in a new tab).
First we consider the definitions presented at IRR17 (Regulation 2).
'Radiation Accident' - means an accident where immediate action would be required to prevent or reduce the exposure to ionising radiation of employees or any other persons.
Look carefully at the above definition. Note immediate action (i.e. right now). This means the accident occurs and you need to immediately take action to prevent or reduce exposure to ionising radiation. Not in the next hour, day or week.
Now let's look at contingency plans (Reg 13) - and note that you often see these in local rules in their own section, or a reference to them. They might be called a contingency plan, contingency arrangements, emergency plan etc - but only contingency plan is specified directly in IRR17 (Reg 13).
Regulation (13) of IRR17 states: 'Where an assessment made in accordance with regulation 8 shows that a radiation accident is reasonably foreseeable (having regard to the steps taken by the employer under paragraph (3) of that regulation), the employer must prepare a contingency plan designed to secure, so far as is reasonably practicable, the restriction of exposure to ionising radiation and the health and safety of persons who may be affected by such accident'.
It is clear from Regulation (13) that a contingency plan is required where a radiation accident is reasonably foreseeable. So if you need a contingency plan, then call it so, and nothing else. If you do not need a contingency plan, but have identified some radiation safety related incidents / events, then call your 'plan' something else (e.g. contingency arrangements or similar).
IRR 17 (13) - Contingency plans - a walk through the ACoP
It is useful to look through some of the ACoP (and guidance) wording - you might think it's not as clear as it could be. [It might be helpful to have the IRR17 ACoP open in another browser tab- IRR17 ACoP]. The is a significant use of bold text in this section - this is deliberate and highlights key words of phrases we need to consider.
[Para 237] This paragraph explains that the aim of the contingency plan is to restrict exposures that rise from an accident (so far as is reasonably practicable). Note it does not specify 'radiation accident' only 'accident'. This might seem pedantic, but please read on and you will see why we feel this is not helpful. It states that the plan applies during the incident, clean-up and any associated recovery. Whilst this might appear correct, recall the interpretation of a radiation accident (see above) - it is for immediate actions. For some accidents, clean-up and recovery may be a longer process (weeks / months) where new risk assessments, procedures, and training (etc) need to be implemented. Also note that the paragraph introduces the word 'incident' - together with accident.
[Para 238] This paragraph starts by considering reasonably foreseeable accidents. It states that accidents are less than likely, but realistically possible. This is an important sentence since Ionactive has had many discussions in the past regarding what is possible, vs what is realistically possible. [Ionactive comment - it is possible to stand inside an industrial irradiator cell and watch 37 PBq of Co-60 rise out of the water and deliver 10,000 Gy/hour. However, based on our experience with such plants, it is not realistically possible. Note this is our opinion].
This paragraph then notes that actions should be proportionate to the risk (including likely magnitude of exposure). It then provides an example involving a small spill of radioactive material, stating that this and other 'incidents' that cannot result in exposures of concern are not radiation accidents.
The paragraph then states that an 'exposure of concern' is where an accident (note, not 'incident') could result in significant exposure. It states that a significant exposure is an exposure which exceeds normal planned exposure. The ACoP uses planned exposure and not occupational exposure in this paragraph. It further states that in these circumstances (small spill) it is not proportionate to have a contingency plan.
Note the use of incident and accident in the paragraph 238 - this is partly why we used both terms in the title of this blog article. The phrase exposures of concern is interesting - the ACoP example considers use of radioactive material, but this could equally by applied to many other uses of ionising radiation as we will explore later.
[Para 239] This starts as follows (word for word) 'For radiation accidents where there is a risk of significant exposure, such as those involving industrial radiography or medical radiotherapy sources, a contingency plan must be prepared'. We don't have an issue with this paragraph as such - but the implication here is that industrial radiography and medical radiotherapy sources will have a contingency plan, whereas this should (will) be determined by risk assessment.
[Ionactive comment: Consider visiting this earlier Ionactive blog article: - When is an 'industrial radiography walk-in enclosure' not an industrial radiography enclosure (and therefore does not require an HSE consent)? . You will see that the radiation risks present in an x-ray imagining room may be exactly the same as those in an industrial radiography x-ray room, but one requires a registration, and the other a consent. What does this say (if anything) about the requirement for contingency arrangements ?].
Also note in paragraph 239 the specific wording '... For radiation accidents where there is a risk of significant exposure ... a contingency plan must be prepared..'. By definition (interpretation) there will always be a risk of significant exposure if we are using the term radiation accident. Note that the requirement for immediate action is not mentioned here.
[Para 240] This paragraph now uses the term 'event'. It includes the line: 'Examples of events that could be reasonably foreseeable and could cause significant exposure and therefore require contingency plans are ...'.
Some examples are then given, that could in certain circumstances, be defined as a radiation accident:
- Failure of shielding or interlocks.
- Failure of control measures or PPE.
- Contamination spread.
- Fire (e.g. causing dispersal of radioactive material or melting lead shielding).
- Faulty radiation generators.
- User error, not following procedures.
- Loss of theft of radioactive material.
We agree that any of the above might need a contingency plan, but only if immediate actions are required to control exposures (i.e. avoid or minimise) - i.e. where a radiation accident is reasonably foreseeable. Note that not all of the above would create a significant exposure which exceeds normal planned exposure (this should be determined by risk assessment).
[Ionactive comment - we are not suggesting that an incident (or event etc) should not be covered by emergency / incident arrangements (or equivalent). Bad practice which leads to an event where ALARP is not demonstrated should be stopped, investigated, persons involved should receive further training etc. We are just working with interpretations (definitions) given in IRR17, and suggest that radiation accidents (and therefore the need for contingency plan as defined in IRR17 - (Reg 13) should be tightly and accurately defined].
Classic example - x-ray generator which fails to terminate upon demand
We will start with a classic. This appears to be a favourite of our regulators (HSE et al) - and in many cases for good reason. Consider an X-ray industrial radiography room. If you are not so familiar with this type of installation then consider visiting the following Ionactive resource for an overview - When is an 'industrial radiography walk-in enclosure' not an industrial radiography enclosure (and therefore does not require an HSE consent)?
In the above work practice, in some cases it would be reasonably foreseeable that a person may be present in the x-ray room at the moment that x-ray generation is about to start (this is a likely breach of local rules and work procedures, but might still occur). If they are present, and pushing / pulling an emergency button / wire does not terminate the potential exposure (i.e. the x-ray prewarn continues), then a radiation accident may be underway. Perhaps they maximise their distance from the radiation generator and / or make it to a maze refuge area where radiation exposures are much lower. They need to take immediate action to prevent the exposure or minimise it, and this is clearly a radiation accident.
[Ionactive comment: The fact that they are in the area and need to do 'something' to mitigate or reduce an exposure, also fulfils the definition of a radiation accident. So even if the emergency stop / pull wire worked as intended, this scenario can still be considered a radiation accident].
However, over the years we have found that 'failure to terminate radiation on demand' has crept into every type of radiation generator local rules. Examples include:
- X-ray screening equipment (cabinet x-ray system) in the food industry.
- X-ray screening equipment (cabinet x-ray system) for determining fill level in the beverage industry.
- X-ray quality assurance equipment (e.g. looking for faults) in industry.
- X-ray component counting system (cabinet x-ray system) in electronics industry.
- X-ray cargo screening system (cabinet x-ray system) in the cargo and freight industry.
- X-ray security screening (cabinet x-ray system) in the aviation industry (checked bags and carry on bags).
- X-ray XRF (cabinet x-ray system) in electronics / quality assurance.
- X-ray XRD (cabinet x-ray system) in research and industry.
- X-ray system used in medical screening (note that we are NOT looking at patient exposures in this particular blog article).
Let's take an example from the list above. X-ray screening equipment in the food industry. This will involve passing food items, normally via a conveyor system, through some leaded (or lead equivalent) shielding curtains, transiting through the x-ray cabinet where an image is formed, exiting via another set of shielding curtains, and onwards down the conveyor line.
Consider a fault - operator selects "off" on the control panel and x-rays fail to terminate. This is often found in local rule contingency sections - it is reasonably foreseeable (though in the 25 years of Ionactive we have never seen this, and most x-ray unit manufactures we have worked with have suggested this just does not happen). Often the sequence in the contingency arrangement (note - should not be a plan as defined above for this particular scenario) will go like this:
- Press "stop" again to terminate x-rays. If this does not work then -
- Push "emergency stop" to terminate x-rays. If this does not work then -
- Turn the x-ray "inhibit key" and remove to terminate x-rays. If this does not work then -
- Remove power supply to x-ray system - this WILL terminate x-rays.
There is nothing wrong with going straight for removing the power supply - we are just illustrating a potential graded contingency arrangement.
Was the above a radiation accident? - NO! Was the above a radiation safety related incident (yes) - but this does not need a contingency plan. The actions to be taken could be written into the general work instructions for use of the x-ray system. There were no immediate actions required to avoid or minimise radiation exposure to the operator, other persons or members of the public.
However, in some client cases, the regulator has indicated that the above should be in a contingency plan - we disagree, it has to depend on the type of x-ray generator in use and the findings of the radiation risk assessment. Or, we might agree that the action is written into a contingency section of the local rules as long as it is clear that this is not the same as that required by IRR17 (13).
[Ionactive comment - as RPA we intend to look after our clients. However following a regulator visit there are times where our client would rather say "yes" (within an enforcement / FFI regime), rather than debate the issues. So it is quite possible following a regulator visit, that a contingency plan for this event is added regardless of definitions etc].
Overall the question to ask is this (for x-rays failing to terminate on demand) - was this a radiation accident? The answer for our above example is no - there are no immediate actions require to prevent or reduce radiation exposures.
Other examples of potential radiation incidents / events - where they may not be radiation accidents
Industrial irradiator example
Imagine a large concrete shielded vault over the top of a water filled pond, 5m deep. Stored at the bottom of this pond is 37 PBq of Co-60, in the form of a number of source pencils locked into a rack. Access is only permitted into the vault (via an interlocked security door and maze) when the sources are at the bottom of the pond (safely shielded). When the sources are lifted out of the water (by pneumatic lifting systems) no one has access to the vault - this is assured by several independent and diverse safety systems. Each of these systems are so designed that radiation exposure to a person inside the vault could only take place if every one of the systems failed at the same time. With engineered defence in depth it has been shown that such a failure is not reasonably foreseeable.
When all the safety systems are in place irradiation can take place. At the end of the process the Co-60 source rack is lowered to the bottom of the pond. Only when several independent and diverse safety systems are aligned (to demonstrate that the sources are at the bottom of pond and that radiation dose rates in the vault are no greater than background), is person access allowed.
You don't have to entirely imagine this - it will look something like the following.
Imagine, that for some undetermined reason, the source rack has become jammed in the raised position, it will not lower back into the pond - even under gravity (which it is designed to do). From a irradiation company perspective this is not good news. The plant cannot be operated as intended, no irradiation of product can take place whilst the plant is not responding as required.
For interest - let's consider the approximate dose rate that might be present 1 m from the source rack with 37 PBq of Co-60 (exposure in air). The dose rate will be in the order of 11300 Sv/h (11300 Gy/h) [188 Sv/minute or 3.1 Sv / second]. Not something to be messed with.
The multiple safety systems noted earlier will keep the vault locked - there can be no access under there circumstances. This is true for all failure modes, including complete power loss etc.
There are no immediate actions to be taken to prevent or minimise radiation exposures to operators, other persons or members of the public.
This is not a radiation accident (as defined). Is is a plant fault (a serious one).
[Ionactive comment: What about clean-up and any associated recovery - does this not make this a radiation accident?
In our view, no. There are no immediate actions required to avoid or minimise radiation exposures. At the moment this incident occurs, the plant is safely locked tight. There are no radiation exposures above background. Apart from the Co-60 rack failing to lower into the pond (a serious plant problem), the radiation exposures are no different than if the plant was working as intended. In our view 'associated recovery' is most meaningful when a radioactive source / radioactive contamination is already uncontrolled in the wider environment. Recovery suggests making an uncontrolled source or radioactive material safe, or as safe as is reasonably practicable. This is not relevant to our irradiator at the moment the incident occurs, the sources are not causing an uncontrolled radiation exposure. Perhaps an irradiator fault is a better way of expressing the problem? It is true that eventual recovery from this situation will require a risk assessment, method statements and contingency plans (if a radiation accident is reasonably foreseeable). But until an intervention is made, possibly days or weeks after the incident (during which time a solution will be developed), there is no risk of a radiation exposure to anyone. Note: such an incident could be reportable under Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013].
University gamma cell irradiator example - stuck source sample holder (carousel)
Radioactive source based irradiators in universities, research establishments and blood banks etc are still widely used, but their numbers are dropping (slowly being replaced with x-ray technology) . All small radioactive source irradiators use HASS sources (normally Cs-137) and this means the security provisions can be onerous and costly.
A typical irradiator of the type considered in this example is shown below (there are other makes and types available).
An irradiator of this type will typically feature the following:
- Source - Cs-137.
- An activity of 20-100 TBq (in one or two source pencils) - HASS (High Activity Sealed Sources).
- Sources are special form (doubly encapsulated).
- Shielding performance generally < 10 micro Sv/h measured from the surface, a little more above the unit.
- Sample is loaded via a front interlocked door. Sample holder access is via the open door.
- Sources do not move, instead the sample holder is mounted into a rotating shielded carousel which is located in a nonconcentric larger shielding block. The sample is exposed to the source by rotating the sample carousel through 180 degrees (see above diagram).
- The central sample dose rate is around 14 Gy/min (for the largest activity).
- The irradiator features door interlocks, exposure timer, irradiation controls, password lock etc.
- Irradiator is mains operated with battery backup.
- Carousel can be rotated independently of control panel (non routine), and via manual manipulation of the drive motor gear system (accessed via removable panel, not being a routine procedure).
Scenario
A researcher loads a sample into the irradiator and starts the irradiation process. At the end of the process the sample container fails to move back to the loading / unloading position. Despite system resets, and trying a manual carousel rotation, the sample is still in the irradiation position.
This is a unit fault - not a radiation accident. There is no requirement to put into effect immediate actions to prevent or mitigate exposures to employees, other persons or members of the public. So this scenario should not be in a contingency plan. It would be in captured in a unit failure contingency procedure (or equivalent).
How about a fire in the room containing the irradiator?
The sources are special form and are unlikely to melt or disperse when heated to a temperature of 800 C for at least 10 minutes or more. Due to the thermal mass of the lead carousel and steel surrounding the sources, it is unlikely the sources would reach a high temperature for a significant period of time.
Whilst significant heat could cause lead shielding within the irradiator to be damaged, the lead is contained within steel so is unlikely to flow and compromise the overall shielding available. In a fire scenario, the action is to follow the fire evacuation procedure. There is unlikely to be any increase in radiation exposures, hence no immediate radiation safety related actions required.
Immediate actions to avoid or mitigate radiation exposures are not required - the immediate action is to get away from the area, since fire and smoke are clearly the major hazard at the moment of the incident.
The requirement for clean-up and recovery in this situation makes the definition of a radiation accident perhaps more demonstrable compared to the other examples so far considered - so as long as it is appreciated that the overall risk of radiation exposure (giving consideration to the source integrity) is still low compared to the fire (and potential toxic chemical environment created by the fire). Any clean-up and recovery intervention is likely to be based on radiation monitoring which proves that the radiation source and shielding has not been compromised. Certainly the fire is a radiation safety related incident, but not necessarily a radiation accident.
Baggage / cargo / freight / aviation security screening with x-ray system. Screening baggage trapped / jammed in unit
If you work in any of these industries, where baggage / cargo / freight are screened by x-ray systems for security, then a jam from time to time will occur. In this section we will use 'baggage' from now on, but this equally applies to cargo, freight and similar.
Despite baggage handling systems having infrared detectors, and delay enabled conveyors to allow trapped baggage to free itself and continue its journey, jams will occur. This might be on the conveyor system into or out of the x-ray system, or inside x-ray system. It is not a design fault, just a compromise between speed, efficiency and avoiding blockages. Often the jam might be caused by baggage itself where it is poorly packed or secured, and it "springs apart" and catches on the conveyor bends etc. So it can be said that baggage jams, although not a constant occurrence, are an expected event from time to time - they are no accident.
The exact behaviour of a baggage x-ray system when a jam event occurs will vary between makes, models and the conveyor system. However, the expectation is that the system will stop - and some level of human intervention will be required. In some cases the jammed baggage may be pushed / pulled by hand / stick (etc) to free it (for example from between x-ray shielding curtains) - this intervention can be executed by the employee remaining outside the x-ray unit. However, on occasions it will require entry into the x-ray unit to free the baggage. [Ionactive comment: These systems are much larger than the carry-on baggage screening units seen in the departure security lanes at airports].
At this point the x-ray generators of the x-ray unit will be off. The "x-ray on" lights (normally illuminated red) will also be off. Although unlikely on a baggage handling system at an airport (which is one long continuous system), in the cargo / freight sector it is possible that an emergency stop might have been pressed at the moment that a freight / cargo jam was realised. Some of these features are shown in the picture below!
If entry is required into the screening system beyond the curtains then there is a requirement to ensure the x-rays are off, and remain off during baggage retrieval. So there is an intention to restrict exposure - one sure way of doing this is to remove the x-ray inhibit key (if fitted) and carry it with you whilst you make entry into the x-ray unit. However, restricting exposure in this way is not an immediate action which would be required to prevent or reduce exposure to ionising radiation. It is clearly not a radiation accident and the response to trapped / jammed baggage should not appear in a contingency plan. Instead, removal of an inhibit key (or other equally robust method) should appear in the operational arrangements (which may be included in the local rules).
Small radioactive material spill vs significant radioactive material spill
What constitutes a small or significant radioactive spill will depend on many factors. Perhaps more importantly, for this blog article we remain committed to see where this is valid : where immediate action would be required to prevent or reduce the exposure to ionising radiation (i.e. radiation accident). In turn this may be influenced by any or all of the following factors (which would be assessed as part of a radiation risk assessment):
- The radionuclide.
- The emission properties (alpha, beta, gamma etc).
- Stock level of radioactivity being used, and how this is partitioned into small sub-dilutions.
- The half life of the radioactive material.
- The physical form (liquid, gas, powder etc).
- The chemical form (i.e. its affinity to stick to skin, surfaces etc).
- The biochemical form (i.e. how it would be carried through the body after inhalation and ingestion).
- The annual limit on intake - ALI (i.e. formed by combining the above factors).
- The physical process taking place (i.e. heating, stirring, cooling, shaking, filtering etc).
- The physical engineered protective features (e.g. containment trays, ventilation etc).
Not withstanding the above important factors, the spill is illustrated best by the following graphics.
Obviously the small spill depicted is something a radiochemist (etc) would deal with from time to time. This is not a radiation accident, it is something expected - especially if many manipulations (e.g. aliquoting) are required in a short period. It should still be radiation risk assessed and an exposure potential identified.
The significant spill is another matter. Radioactive material is all over the place - including over the worker and their environment. Immediate actions are required to restrict exposure (move away from area, remove contaminated clothing, minimise intake of radioactive material by inhalation and ingestion etc). Even when the situation is stabilised, intervention to clean up the area and minimise spread of contamination into the wider area is vital. Overall, this is very much a perfect example of a radiation accident.
[Ionactive comment: The above conclusion (radiation accident) does not imply huge radiation exposures are possible. Rather it meets the definition of radiation accident given earlier - dose reduction (or avoidance) can be achieved by immediate actions].
X-ray screening unit, hands beyond curtain
This could apply to screening systems used in security, food, beverages and similar. Firstly, let's look at what we are talking about. The following image looks specifically at an x-ray screening system in the food industry. The monitor shown is simulating a hand being placed beyond the curtain. Some systems would stop as this would cause an inhibit by breaking an infrared light beam (these are quite clever and can detect the difference between moving product and a slower hand).
In this particular example we can state the following.
- Dose rate just beyond the curtain - 5 micro Sv/h.
- Dose rate further still - maximum extent - 41 micro Sv/h (measured, not estimated).
For the record (and this is clearly set out in the local rules), operators DO NOT (and do not need) to place their hands beyond the outer shielding curtains.
But - suppose they did. Let's assess the extremity dose to the hands at the opening and at the furthest reach for 30 seconds (somewhat exaggerated , but a realistic worse case):
- Total dose at the opening (for 30 seconds) - 0.042 micro Sv.
- Total dose at furthest extent (for 30 seconds) - 0.34 micro Sv.
In real world situations, neither of these are measurable above background radiation exposure.
This is an 'incident' - it is bad practice and in contravention of local rules and training. It is poor practice and fails to meet standards required by the ALARP principle. However, we can look at earlier definitions such as ' significant exposure is an exposure which exceeds normal planned exposure'. In this case, the dose to the hands from this event is materially no different to the dose to the hands if it had not occurred (and recall we have generously used a whole 30 seconds of exposure, in reality we would expect much less).
Therefore - this is not a radiation accident, and should not be mitigated by a contingency plan. This poor practice should be captured as a blatant disregard of standard operating procedures and treated accordingly.
X-ray screening unit (security / food / etc), partial curtain failure
All of the events featured in this article should be risk assessed, and this event is no exception. Overall, it should not be for the ionising radiation user (or the regulator) to assume anything (such as contingency plans are mandatory) without valid assessment.
Consider the two scenarios.
In the examples given, and after radiation exposure assessment, neither lead to a radiation accident. Yes there is an incident response (unit failure); turning off the unit completely removes the radiation hazard. However, this is unlikely to be a radiation accident.
In many radiation monitoring surveys, a partial or complete failure of the outer curtains will still leave inner curtains in place. Regardless, the dose rates at the entrance / exit prior to terminating x-ray exposure do not lead to exposures to persons measurable above background - but should be treated as a radiation incident that requires a timely response (turn the system off and isolate).
[Ionactive Comment: Over many years UK health and safety regulation has moved from prescriptive to goal setting - via risk assessment. For radiation safety, there has been an evolution through IRR85, IRR99 and IRR17 where we have reached the graded approach (via notify, registration and consent). It is therefore somewhat depressing that we get the feeling our regulators might be moving back in a more prescriptive direction - we hope this is not the case].
Mark Ramsay
Radiation Protection Adviser for Ionactive Consulting Limited.
Chartered Radiation Protection Professional.
February 2024