ML14357A364

From kanterella
Jump to navigation Jump to search
Attachment 9 - Shine Medical Technologies, Inc., Application for Construction Permit Response to Request for Additional Information, Preliminary Safety Analysis Report Changes (Mark-Up)
ML14357A364
Person / Time
Site: SHINE Medical Technologies
Issue date: 12/03/2014
From:
SHINE Medical Technologies
To:
Office of Nuclear Reactor Regulation
Shared Package
ML14356A527 List:
References
SMT-2014-040
Download: ML14357A364 (84)
v • d • e


Text

ENCLOSURE 2 ATTACHMENT 9 SHINE MEDICAL TECHNOLOGIES, INC.

SHINE MEDICAL TECHNOLOGIES, INC. APPLICATION FOR CONSTRUCTION PERMIT RESPONSE TO REQUEST FOR ADDITIONAL INFORMATION PRELIMINARY SAFETY ANALYSIS REPORT CHANGES (MARK-UP) 83 pages follow

Preliminary Safety Analysis Report Master Table of Contents 12.10a REACTOR OPERATOR TRAINING AND REQUALIFICATION.............................. 12-14 12.10b PRODUCTION FACILITY OPERATOR TRAINING AND REQUALIFICATION ................................................................................................ 12-15 12.11 STARTUP PLAN...................................................................................................... 12-16 12.12 VACATED................................................................................................................ 12-17 12.13 MATERIAL CONTROL AND ACCOUNTABILITY PROGRAM ................................ 12-18 12.14 REFERENCES ........................................................................................................ 12-19 APPENDIX 12A EMERGENCY PLAN...................................................................................... 12A-1 APPENDIX 12B SECURITY PLAN........................................................................................... 12B-1 APPENDIX 12C QUALITY ASSURANCE PROGRAM DESCRIPTION ................................... 12C-1 APPENDIX 12D CONDUCT OF OPERATIONS PROGRAM DESCRIPTION ......................... 12D-1 CHAPTER 13 ACCIDENT ANALYSIS 13a1 HETEROGENEOUS REACTOR ACCIDENT ANALYSIS ....................................... 13a1-1 13a2 IRRADIATION FACILITY ACCIDENT ANALYSIS................................................... 13a2-1 13a2.1 ACCIDENT-INITIATING EVENTS AND SCENARIOS ............................................ 13a2-1 13a2.2 ACCIDENT ANALYSIS AND DETERMINATION OF CONSEQUENCES .................................................................................................. 13a2-36 13a3

SUMMARY

AND CONCLUSIONS .......................................................................... 13a3-1 13a4 REFERENCES ........................................................................................................ 13a4-1 13b RADIOISOTOPE PRODUCTION FACILITY ACCIDENT ANALYSES .................... 13b-1 13b.1 RADIOISOTOPE PRODUCTION FACILITY ACCIDENT ANALYSIS METHODOLOGY .................................................................................................... 13b-1 13b.2 ANALYSES OF ACCIDENTS WITH RADIOLOGICAL CONSEQUENCES .................................................................................................. 13b-4 13b.3 ANALYSIS OF ACCIDENTS WITH HAZARDOUS CHEMICALS PRODUCED FROM LICENSED MATERIAL........................................................... 13b-397 13b.4 REFERENCES ........................................................................................................ 13b-521 CHAPTER 14 TECHNICAL SPECIFICATIONS 14a1 HETEROGENEOUS REACTOR TECHNICAL SPECIFICATIONS......................... 14a1-1 14a2 IRRADIATION FACILITY TECHNICAL SPECIFICATIONS .................................... 14a2-1 14a

2.1 INTRODUCTION

..................................................................................................... 14a2-2 14a2.2 SAFETY LIMITS AND LIMITING SAFETY SYSTEM SETTINGS ........................... 14a2-3 14a2.3 LIMITING CONDITIONS FOR OPERATION........................................................... 14a2-4 14a2.4 SURVEILLANCE REQUIREMENTS ....................................................................... 14a2-5 14a2.5 DESIGN FEATURES............................................................................................... 14a2-6 14a2.6 ADMINISTRATIVE CONTROLS.............................................................................. 14a2-7 14a

2.7 REFERENCES

........................................................................................................ 14a2-18 14b TECHNICAL SPECIFICATIONS OF PROCESSES OUTSIDE THE IRRADIATION FACILITY......................................................................................... 14b-1 14b.1 INTRODUCTION ..................................................................................................... 14b-1 14b.2 SAFETY LIMITS AND LIMITING SAFETY SYSTEM SETTINGS ........................... 14b-2 14b.3 LIMITING CONDITIONS FOR OPERATION........................................................... 14b-3 14b.4 SURVEILLANCE REQUIREMENTS ....................................................................... 14b-4 SHINE Medical Technologies v Rev. 1

Chapter 1 - The Facility General Description of the Facility Confinement is achieved through RV, radiological integrated control system (RICS), and biological shielding provided by the steel and concrete structures comprising the walls, roofs, and penetrations of the hot cells. Shielding of the hot cells is discussed in detail in Subsection 4b.2.2.

Confinement is also achieved by berms that limit the spread of hazardous chemical spills.

SSCs that perform an ESF function are classified as safety-related.

1.3.5 INSTRUMENTATION, CONTROL, AND ELECTRICAL SYSTEMS The TSV process control system (TPCS) controls the operation of the TSV. The TSV is protected by the TSV reactivity protection system (TRPS). These are addressed in Sections 7a2.3 and 7a2.4, respectively.

Control and protection systems associated with the RPF are addressed in Section 7b.

Design features of the control consoles and display instrumentation, and the radiation monitoring systems for both the IU and the RPF, are addressed in Chapter 7. Radiation monitoring systems include the criticality accident and alarm system (CAAS), the radiation area monitoring system (RAMS), and the continuous air monitoring system (CAMS).

The SHINE facility has one common normal electrical supply system, which provides power to the IF, the RPF, and other support buildings. Power service is provided by the local utility via off-site feeds. A standby diesel generator provides power for asset protection to selected loads in the event of a loss of off-site power. These systems are described in Section 8a2.1.

Emergency electrical power for the SHINE facility is provided by a common emergency power system. A Class 1E uninterruptible electrical power supply system (UPSS) is provided for the facility. This system consists of two independent trains, each consisting of a 250 volts-direct current (VDC) battery system with associated charger, inverter, and distribution system. This system is described in Section 8a2.2.

1.3.6 TSV COOLING AND OTHER AUXILIARY SYSTEMS Primary cooling for the TSV and related components is provided by the LWPS and the primary closed loop cooling system (PCLS). The TSV and related components are submerged in the light water pool. The LWPS is addressed in Sections 5a2.2 and 4a2.4. The PCLS is addressed in Section 5a2.2. The light water pool and primary closed loop cooling make-up system (MUPS) supports the LWPS and the PCLS. This system is addressed in Section 5a2.5.

Primary cooling for the RPF and removal of heat from both the LWPS and the PCLS is provided by the radioisotope process facility cooling system (RPCS). This system is discussed in Section 5a2.3.

Ventilation for both the IF and the RPF is provided by the RV. This ventilation system is described in Section 9a2.1.

Equipment and processes related to handling and storage of target solution are addressed in Section 9a2.2. Equipment and processes related to handling and storage of byproduct material and SNM are addressed in Section 9a2.5.

SHINE Medical Technologies 1-11 Rev. 2

Chapter 3 - Design of Structures, Systems, and Components Systems and Components Table 3.5-1 System Classifications (Sheet 2 of 4)

Highest Safety Classification System Within System Seismic Quality System Name Code Scope(a) Classification(b) Group Uranyl Nitrate Conversion UNCS SR Category I QL-1 System Target Solution Cleanup (UREX)

Thermal Denitration Production Facility Biological PFBS SR Category I QL-1 Shield System Radioactive Drain System RDS SR Category I QL-1 Radioactive Liquid Waste RLWE SR Category I QL-1 Evaporation and Immobilization Aqueous Radioactive Liquid RLWS SR Category I QL-1 Waste Storage RCA Material Handling RMHS SR Category I QL-1 Systems Other Facility Systems and Components Hot Cell Fire Detection and HCFD SR NSR Category II QL-12 Suppression System Facility Instrument Air System FIAS NSR Category III QL-2 Facility Control Room FCR NSR Category III QL-2 Stack Release Monitoring SRM NSR Category III QL-2 Facility Fire Detection and FFPS NSR Category III QL-2 Suppression Neutron Driver Assembly NDAS NSR Category III QL-2 System Primary Closed Loop Cooling PCLS NSR Category II QL-2 System Primary Closed Loop Cooling MUPS NSR Category III QL-2 and Light Water Pool Makeup System Health Physics Monitors HPM NSR Category III QL-2 TSV Process Control System TPCS NSR Category II QL-2 Normal Electrical Power Supply NPSS NSR Category II QL-2 System Inert Gas Control IGS NSR Category III QL-2 Material Handling MHS NSR Category II QL-2 Solid Radioactive Waste SRWP NSR Category II QL-2 Packaging SHINE Medical Technologies 3-53 Rev. 2

Chapter 3 - Design of Structures, Systems, and Components Radioisotope Production Facility b) The CAAS is capable of detecting a criticality accident that produces and absorbed dose in soft tissue of 20 rads of combined neutron or gamma radiation at an unshielded distance of 2 meters from the reacting material within one minute, except for events occurring in areas not normally accessed by personnel and where shielding provides protection against a criticality.

3.5b.1.8 Continuous Air Monitoring System Refer to Section 7a2.7 for a detailed description.

3.5b.1.8.1 CAMS Design Basis Functions a) CAMS provide real time local and remote annunciation of airborne contamination in excess of preset limits.

b) Remain functional through DBAs.

3.5b.1.8.2 CAMS Design Basis Values To be provided in the FSAR.

3.5b.1.9 Confinement Barriers Confinement is provided by a combination of the hot cell structures, the supporting ventilation systems, and isolation valves or bubble-tight dampers on all hot cell penetrations.

3.5b.1.9.1 RCA Ventilation System Zone 2 3.5b.1.9.1.1 RVZ2 Design Basis Functions a) Maintain pressure gradients throughout the Zone 2 areas to ensure the proper flow of air from the least potentially contaminated areas to the most potentially contaminated areas, thereby limiting the spread of airborne radioactive materials.

b) Provide confinement of airborne radioactive materials by providing for the rapid, automatic closure of isolation dampers at the at the RCA boundary for various accident conditions.

c) Provide confinement of hazardous chemical fumes.

d) The isolation dampers remain functional for DBA.

e) Provide conditioned air to ensure suitable environmental conditions for personnel and equipment in the RCA.

f) The system has sufficient redundancy to perform its safety function in the event of a single failure.

3.5b.1.9.1.2 RVZ2 Design Basis Values a) The RVZ2 has a 30-year design life.

b) Maintain air quality with the occupied RVZ2 areas that complies with the dose limits of 10 CFR 20 for normal operations and shutdown.

c) Maintain air quality with the occupied RVZ2 areas that complies with the dose limits of 10 CFR 20 for DBAs.

d) Maintain its leakage rate performance for 40 days post-accident (Subsection 11.1.1.1).

SHINE Medical Technologies 3-97 Rev. 1

Chapter 3 - Design of Structures, Systems, and Components Radioisotope Production Facility 3.5b.1.9.2 Production Facility Biological Shielding Refer to Section 4b.2 for a detailed description.

3.5b.1.9.2.1 PFBS Design Basis Functions a) Provide biological shielding from radiation sources in the hot cells for workers in the occupied areas of the facility.

b) Limit physical access to the hot cells.

c) Design to survive DBEQ effects, without loss of structural integrity.

d) Remain functional through DBAs.

3.5b.1.9.2.2 PFBS Design Basis Values a) The PFBS has a 30-year design life.

b) Provide dose rates at 12 in. (30.48 cm) from surface of shielding of 0.25 mrem/hr or less for normally-occupied areas. Localized dose rates at penetrations and during some planned operations, may be higher and are posted appropriately.

3.5b.1.10 Hot Cell Fire Detection and Suppression System Refer to Subsection 9a2.3.4.4.2.4 for a description of the HCFD.

3.5b.1.10.1 HCFD Design Basis Functions a) Provide fire detection in hot cells and enclosures and initiate fire-rated damper closure.

b) Remain functional through DBAs.

3.5b.1.10.2 HCFD Design Basis Values a) The HCFD has a 30-year design life.

3.5b.1.11 Radiological Integrated Control System Refer to Subsection 7b.2.3 for a description of the RICS.

3.5b.1.11.1 RICS Design Basis Functions a) Monitors valve positions for inter-equipment process fluid transfers.

b) Monitors and controls inter-equipment process fluid transfers in the RPF.

c) Controls the RPF components for transfer of target solution from the TSV dump tank in an IU cell to one of the MEPS.

d) Controls the transfer of prepared target solution from the TSPS in the RPF to the TSV hold tank.

e) Controls the transfer of recycled target solution from the target solution recycle holding tank in the RPF to the TSV hold tank.

f) Initiate ESF actuation of isolation dampers and valves for RPF hot cells, glove boxes or other cells that require isolation upon measured parameters exceeding setpoints.

g) Initiate ESF actuation of isolation dampers for the RCA ventilation system in the RPF, upon measured parameters exceeding setpoints.

SHINE Medical Technologies 3-98 Rev. 1

Chapter 6 - Engineered Safety Features Summary Description Engineered Safety Features Table 6b.1-1 Summary of RPF Design Basis Events and ESF Provided for Mitigation Detailed Engineered Safety Description Feature Radioisotope Production Facility Design Basis Event Section or (ESF) Mitigated by ESF SSCs which provide ESF Subsection

  • Hot cells including penetration seals
  • RCA ventilation system Zone 1 (including ductwork up to filters and filters) and Zone 2
  • Critical equipment malfunction Confinement
  • Tank vaults 6b.2.1
  • Accidents with hazardous chemicals
  • Radiological integrated controls system (RICS)
  • Isolation valves on piping systems penetrating hot cells
  • Berms SHINE Medical Technologies 6b-2 Rev. 1

Chapter 6 - Engineered Safety Features Confinement 6b.2.1 CONFINEMENT 6b.2.1.1 Introduction Confinement describes the low-leakage boundary surrounding radioactive or hazardous chemical materials released during an accident and parts of RVZ1 and RVZ2. Confinement systems localize releases of radioactive or hazardous materials to controlled areas and mitigate the consequences of DBAs. Personnel protection control features such as adequate shielding and RV minimize hazards normally associated with radioactive or chemical materials. The principal design and safety objective of the confinement system is to protect the on-site personnel, the public, and the environment. The second design objective is to minimize the reliance on administrative or complex active engineering controls and provide a confinement system that is as simple and fail-safe as reasonably possible.

This subsection describes the confinement systems for the RPF. The RPF confinement areas include hot cell enclosures for process operations and trench and vault enclosures for process tanks and piping.

Confinement is achieved through RV, RICS, and biological shielding provided by the steel and concrete structures comprising the walls, roofs, and penetrations of the hot cells. Shielding of the hot cells is discussed in detail in Subsection 4b.2.

Confinement is also achieved by berms to confine the spills of hazardous chemicals.

6b.2.1.2 Confinement System and Components The RV serving the RCA, outside of the IF, includes components whose functions are designated as nonsafety-related and safety-related. The ductwork, the isolation dampers, and the filter trains of RVZ1 are designated as safety-related. Refer to Table 6b.2-1 for a description of the system and component safety functions. Active confinement isolation components are required to operate as described below.

The hot cells employ a combination passive-active confinement methodology. During normal operation, passive confinement is achieved through the contiguous boundary between the hazardous materials and the surrounding environment and is credited with confining the hazards generated as a result of DBAs.

This boundary includes the biological shield (created by the physical construction of the cell itself) and the extension of that boundary through the RVZ1. The intent of the passive boundary is to confine hazardous materials while also preventing the introduction of external energy sources that could disturb the hazardous materials from their steady-state condition. The extent of this passive confinement boundary extends from the upstream side of the intake HEPA filter to the final downstream HEPA filter prior to exiting the building.

In the event of a DBA that results in a release in the hot cells, radioactive material would be confined by the biological shield and physical walls of the cell itself. Each line that connects directly to the hot cell atmosphere and penetrates the hot cell is provided with redundant isolation valves to prevent releases of gaseous or other airborne radioactive material. Confinement isolation valves on piping penetrating the hot cell are located as close as practical to the SHINE Medical Technologies 6b-4 Rev. 2

Chapter 6 - Engineered Safety Features Confinement confinement boundary and active isolation valves are designed to take the position that provides greater safety upon loss of actuating power.

To mitigate the consequences of an uncontrolled release occurring within a hot cell, as well as the off-site consequences of releasing fission products through the ventilation system, the confinement barrier utilizes an active component in the form of bubble-tight isolation dampers (safety-related) on the inlet and outlet ventilation ports of each hot cell. This ESF effectively reduces the amount of ductwork in the confinement volume that needs to remain intact to achieve hot cell confinement. These dampers close automatically (fail-closed) upon loss of power or receipt of a confinement isolation signal generated by the RICS. Following an initiating event, the RICS isolates the hot cells. Refer to Section 7b for a description of the RICS.

Overall performance assurance of the active confinement components is achieved through factory testing and in-place testing. Duct and housing leak tests are performed in accordance with ASME N511, with minimum acceptance criteria as specified in ASME AG-1 (ASME, 2009).

Specific owners requirements with respect to acceptable leak rates are based on the safety analyses.

Berms employ a passive confinement methodology. Passive confinement is achieved through a continuous boundary between the hazardous materials and the surrounding area. In the event of an accidental release, the hazardous liquid is confined to limit the exposed surface area of the liquid.

6b.2.1.3 Functional Requirements Active confinement components are designed to fail into a safe state if conditions such as loss of signal, loss of power, or adverse environments are experienced.

Mechanical, instrumentation, and electrical systems and components required to perform their intended safety function in the event of a single failure are designed to include sufficient redundancy and independence such that a single failure of any active component does not result in a loss of the capability of the system to perform its safety functions.

Mechanical, instrumentation, and electrical systems and components are designed to ensure that a single failure, in conjunction with an initiating event, does not result in the loss of the systems ability to perform its intended safety function. The single failure considered is a random failure and any consequential failures in addition to the initiating event for which the system is required and any failures that are a direct or consequential result of the initiating event.

The design of safety-related systems (including protection systems) is consistent with IEEE Standard 379-2000 and Regulatory Guide 1.53 in the application of the single-failure criterion.

Berms are designed to hold the entire contents of the container in the event that the container fails.

SHINE Medical Technologies 6b-5 Rev. 2

Radioisotope Production Facility Engineered Chapter 6 - Engineered Safety Features Safety Features Technical Specifications Table 6b.2-1 Radioisotope Production Facility Confinement Safety Functions System, Structure, Component Description Classification RVZ1 hot cell isolation Provide confinement isolation at hot SR dampers, ductwork up to cell boundaries filters and filters RVZ2 isolation dampers, Provide confinement isolation at RCA SR ductwork up to filters and boundary filters RICS Provides confinement isolation signal SR Isolation valves on piping Provide confinement at hot cell SR systems boundaries Hot cells, tank vaults, berms Provides confinement SR and pipe trenches SHINE Medical Technologies 6b-10 Rev. 2

Chapter 7 - Instrument & Control Systems Design of ICS

2) The safety program shall ensure that each SR SSC will be available and reliable to perform its intended safety function when needed.

The RICS trip and alarm annunciation are protective functions and are part of the overall protection and safety monitoring systems for the RPF. The specific equipment design basis for the instrumentation and equipment used for the RICS trip and alarming functions are discussed in Section 7b.2.2.

The following discussion relates to the design bases utilized for monitoring specific signal values for RPF trips and alarms, the requirements of performance, the requirements for specific modes of operation of RPF and RICS and the design criteria documents generating the basis noted as a citation.

7b.2.4.1.1 Safety Functions and Corresponding Protective/Mitigative Actions for Design Basis Events Citation - Section 4a and 4b of IEEE-603-2009 The results of the accident analysis for the RPF SSCs are discussed in Section 13b. Conditions that require monitoring and the subsequent action to be taken are detailed in Section 13b.

SR components identified in Section 13b, including the ESFs described in 6b, are monitored and controlled by RICS, as required.

7b.2.4.1.2 Variable Monitored to Control Protective/Mitigative Action Citation - Section 4d of IEEE-603-2009 The following variables are monitored for RPF trip for isolation:

  • The hot cell fire detection and suppression system (HCFD) is monitored for actuation. If tripped, the hot cell is isolated by the ventilation inlet and outlet dampers. This is not a SR Function.
  • The facility fire protection system (FFPS) is monitored for actuation. If tripped, the RCA confinement zone of the affected area is isolated by the zone bubble-tight dampers. This is not a SR function.
  • Hot cell gamma detectors are monitored in the hot cell. If acceptable gamma levels are exceeded, the hot cell is isolated by the ventilation inlet and outlet bubble-tight dampers.

The following is a preliminary list of variables to be monitored in the RPF for alarming to eliminate or reduce the exposure for the operator. The final list of variables to be monitored will be provided in the FSAR.

  • Hot cell temperature - internal environment.
  • Hot cell pressure - internal environment.
  • Uranyl nitrate conversion system (UNCS) outlet temperature - process upset.
  • Radioactive drain system (RDS) sump level - contamination exposure.
  • Primary vessel vent system (PVVS) pressure - internal environment.
  • PVVS flow - internal environment.
  • RCA confinement zone pressure - contamination exposure.

SHINE Medical Technologies 7b-18 Rev. 2

Chapter 7 - Instrument & Control Systems ESF Actuation System 7b.4 ENGINEERED SAFETY FEATURE AND ALARMING 7b.4.1 SYSTEM DESCRIPTION Process control ESFs within the RPF are activated by the RICS. An RPF ESF actuation system does not exist as a standalone system. The RICS performs the following ESF actuation functions:

  • For hot cells, gloveboxes, or other cells (including the noble gas storage cell) that require isolation in the RPF, the RICS monitors parameters designated SR and when appropriate, actuates the ESF for the hot cells, gloveboxes, or other cells. The ESFs that are actively controlled are the isolation inlet and outlet bubble-tight dampers and isolation valves for other penetrations into the enclosure that are determined to require isolation during the final safety analysis. Upon recognition of an off-normal SR parameter, the RICS de-energizes the dampers and isolation valves in the system and the dampers and valves move to a closed safe-state for the affected hot cell, glovebox, or other cell. The ESF dampers and isolation valves within the RPF are designed as fail-closed dampers so that any loss of power results in closure and subsequent isolation of the hot cell, glovebox, or other cell.
  • For the RCA ventilation system in the RPF, the RICS monitors parameters designated as SR and when appropriate, actuates the ESF for the specific RCA ventilation system zone.

For the RCA ventilation system zones, the ESFs that are actively controlled are the inlet and outlet bubble-tight dampers for each zone. Upon recognition of a SR parameter exceeding acceptable limits for isolation, the RICS de-energizes the dampers in the system and the bubble-tight dampers move to a closed safe-state for the affected ventilation zone. The bubble-tight dampers within the RCA zone ventilation system are designed as fail-closed dampers so that loss of power results in closure of the damper and subsequent isolation of the RCA ventilation system zone.

  • The internal logic of the RICS monitors the ESF and provides assurance that the ESF activation goes to completion. The ESF is reset by the operator from the RICS HMI display. The RICS is described in Subsection 7b.2.3.

7b.4.1.1 RICS Trips Description (Functional Performance)

This section identifies the monitored parameters and describes the events for initiating an ESF.

The monitoring and control functions are described on a parameter by parameter basis in the following.

The RICS performs two one automated initiations of ESFs., One is for mitigation of fire and the other for mitigation of radiation contamination. Additionally, in In the event of an activation of the HCFD or the FFPS, the RICS activates dampers to isolate affected areas. The FFPS and HCFD isolation functions are not an SR functions. The other automated response occurs when an active radiation monitored parameter within the isolable cell exceeds a trip level setting. In the case of an individual hot cell, glovebox, or other cell the RICS activates the ESF for bubble-tight damper isolation of the affected hot cell, glovebox, or other cell.

SHINE Medical Technologies 7b-31 Rev. 2

Chapter 7 - Instrument & Control Systems ESF Actuation System 7b.4.1.1.1 HCFD Activation Trip The RICS monitors signals from the HCFD for the individual cell or glovebox. There are two independent signals coming from the HCFD. These signals input to the RICS. The RICS activates the isolation of the cell or glovebox whenever the 1oo2 voted inputs indicate that the HCFD is tripped. The ESF ventilation inlet and outlet isolation dampers close upon HCFD activation in a cell or glovebox. The trip is automatic and not delayed., and is not considered SR, as it duplicates the function performed by gamma detectors for the mitigation of radioactive releases.

7b.4.1.1.2 Hot Cell and other Process Cell Ventilation High Gamma Trip The RICS monitors signals from redundant gamma detectors installed in the ventilation of the individual cells or gloveboxes. Each detector provides an independent channel to the RICS. The RICS activates the ESF for the cell or glovebox whenever the 1oo2 voted signal inputs indicate that the gamma detectors have exceeded the high level setpoint. The ESF ventilation inlet and outlet isolation dampers close upon high gamma detection. The trip is automatic and not delayed.

7b.4.1.1.3 RICS Manual Trip There is a manual trip emergency switch at each hot cell or other confinement zone. Each emergency switch provides the ability for the operator to manually isolate the individual hot cell or confinement zone. The trip of this switch initiates the activation of the ESF inlet and outlet dampers for the individual hot cell or confinement zone independent of the RICS status.

7b.4.1.1.4 RICS Manual Trip Reset Once the isolation for a cell or glovebox has been manually activated, it takes an operator to manually reset the ESF at the hot cell or confinement zone. This is done by resetting the manual switch for the specific ESF.

7b.4.1.1.5 RICS Automatic Trip Reset Once the isolation for a cell or glovebox has been automatically activated, it takes an operator to manually reset the ESF logic within the RICS. This is done from the RICS display panel using the ESF reset switch for the specific ESF on the HMI. The ESF is reset by the RICS.

7b.4.1.2 RICS Alarm Description (Functional Performance)

This subsection identifies the monitored parameters and describes the events for initiating an alarm to the operator as a possible contamination event.

The following subsections describe the preliminary list of variables to be monitored in the RPF for alarming to eliminate or reduce the radiation exposure for the operator. The final list of variables to be monitored will be provided in the FSAR.

SHINE Medical Technologies 7b-32 Rev. 1

Chapter 8 - Electrical Power Systems Emergency Electrical Power Systems isolation between the non-1E NPSS and Class 1E 250 VDC. The AC input breakers on both battery chargers and voltage regulating transformers are qualified as isolation devices using guidance from IEEE 384 (IEEE, 2008).

Each of the redundant Class 1E battery subsystems is capable of delivering required emergency power for the required duration during facility normal and abnormal operations. The scope of compliance encompasses physical separation, electrical isolation, equipment qualification, effects of single active component failure, capacity of battery, battery chargers, instrumentation, protective devices, and surveillance test requirements. Each of the Class 1E battery subsystems is separately housed in a seismically qualified Seismic Category I structure.

Class 1E battery subsystem equipment sizing is designed using guidance from IEEE 485 (IEEE, 2010a) and IEEE 946 (IEEE, 2004a).

8a2.2.3 SHINE FACILITY SYSTEMS SERVED BY THE CLASS 1E UPSS

  • TRPS - TSV reactivity protection system (Section 7a2.4)
  • TRPS/HMI - TSV reactivity protection system/human machine interface (Subsection 7a2.6.8)
  • NFDS - neutron flux detection system (Subsection 7a2.4.3)
  • PVVS - process vessel vent system blower (Section 9b.6.1)
  • HCFD - hot cell fire detection and suppression system (Subsection 9a2.3.4.4.2.4)
  • CAMS - continuous air monitoring system (Subsection 7a2.7.4.1)
  • RAMS - radiation area monitoring system (Subsection 7a2.7.4.2)
  • CAAS - criticality accident and alarm system (Section 7b.6)
  • RICS - radiological integrated control system (Section 7b.2.3)
  • ESFAS - engineered safety features actuation system (Section 7a2.5)
  • ESFAS/HMI - engineered safety features actuation system/human machine interface (Subsection 7a2.5.2)
  • TOGS - TSV off-gas system (Section 4a2.8) 8a2.2.4 NONSAFETY-RELATED LOADS The SHINE facility Class 1E UPSS is primarily designed to serve facility essential monitoring and control functions and safe shutdown of the irradiation units. Under normal operating conditions, a limited use for nonsafety-related loads may be acceptable after approved analysis is established that such use has no adverse impact on the safety function of the system. The non-Class 1E circuits are designed with the independence and isolation guidance from IEEE 384 (IEEE, 2008).

8a2.2.5 MAINTENANCE AND TESTING Maintenance and testing of the UPSS is designed using guidance from IEEE 450 (IEEE, 2010b) and IEEE 336 (IEEE, 2010c).

SHINE Medical Technologies 8a2-10 Rev. 1

Chapter 8 - Electrical Power Systems Emergency Electrical Power Systems 8a2.2-1 UPSS Load List(a)

Nominal Connected Nominal Load Demand Load Description (kW) Load (kW)

TSV Reactivity Protection System (TRPS) 7.20 7.20 Hot Cell Fire Detection and Suppression System (HCFD)(b) 1.2 1.2 Neutron Flux Detection System (NFDS) 1.2 1.2 Continuous Air Monitoring System (CAMS) 2.40 2.40 Radiation Area Monitoring System (RAMS) 2.40 2.40 Criticality Accident and Alarm System (CAAS) 2.40 2.40 Radiological Integrated Control System (RICS) 3.60 3.60 Engineered Safety Features Actuation System (ESFAS) 7.20 7.20 TSV Off-Gas System (TOGS) Recirculating Blower 5.57 13.92 Human Machine Interface (HMI)/ESFAS 2.40 2.40 Process Vessel Vent System (PVVS) Blower 5.57 13.92 HMI/TRPS 3.60 3.60 UPSS Total Nominal Demand Load 61.44 kW a) Load information above is for a single train. The same loads apply to the redundant UPSS train.

b) The hot cell fire detection system (HCFD) is defined as SR. At final design a determination will be made whether additional components of the FFPS/HCFD systems will be safety-related.

SHINE Medical Technologies 8a2-13 Rev. 2

Chapter 9 - Auxiliary Systems Fire Protection Systems and Programs 9a2.3.4.4.2.4 Fire Detection and Alarm Systems Fire alarm and detection systems are provided throughout the SHINE facility and are designed, installed, located, inspected, tested, and maintained in accordance with NFPA 72, National Fire Alarm and Signaling Code (NFPA, 2013e).

Fire detection is provided as part of the facility fire detection and suppression system (FFPS) and the hot cell fire detection and suppression system (HCFD). The HCFD provides fire detection and suppression capabilities for the supercells and the hot cells in the RPF. Fire detectors in the HCFD send a signal to isolate the fire-rated dampers in the supercells and the hot cells in the event of a fire in one of these cells. These dampers reduce the potential release of radioactive materials from the hot cell or supercell due to a fire (see Subsection 13b.2.6) prevent the spread of fire from the hot cell or supercell. The fire detection in the HCFD is classified as SR non-safety related, since radiation detectors and associated interlocks with bubble-tight dampers controlled by RICS perform the SR function of reducing potential release of radioactive materials from the hot cell or supercell due to a fire. The suppression subsystem of the HCFD is classified as nonsafety-related.

The fire detection in the rest of the SHINE facility is part of the FFPS. The FFPS is classified as nonsafety-related.

9a2.3.4.4.3 Fire Barriers and Protection of Penetrations The SHINE facility is generally of reinforced concrete construction. The walls, floors, and ceilings have a 3-hour fire resistive rating where required by a high combustible loading in the room or where adjacent room contains equipment or systems from a different safety train. Stair towers which do not communicate between areas of different divisions may have walls and doors with a 2-hour fire rating for personnel protection during egress from the areas. Non-concrete interior walls are constructed of metal studs and gypsum wallboard to the required fire resistive rating.

The areas within the SHINE facility are subdivided into separate fire areas for the purposes of limiting the spread of fire, protecting personnel, and limiting the consequential damage to the SHINE facility. Determination of fire area boundaries is based on consideration of the following:

  • Types, quantities, density, and location of combustible materials.
  • Location and configuration of equipment.
  • Location of fire detection and suppression systems.
  • Personnel safety/exit requirements.
  • Location of major electrical equipment.
  • Location of process confinement areas.
  • Location of storage areas.
  • Separation of office areas from adjacent areas.

Three-hour fire-rated barriers separate the individual fire areas within the SHINE facility. Fire barrier design and construction is in accordance with NRC regulations and NFPA 221, Standard for High Challenge Fire Walls, Fire Walls, and Fire Barrier Walls (NFPA, 2012f).

Where fire-rated assemblies are partially or fully penetrated by pipes, ducts, conduits, raceways or other such penetrates, fire barrier penetration material is placed in and around the SHINE Medical Technologies 9a2-25 Rev. 2

Chapter 13 - Accident Analysis Table of Contents CHAPTER 13 ACCIDENT ANALYSIS Table of Contents Section Title Page 13a1 HETEROGENEOUS REACTOR ACCIDENT ANALYSIS......................13a1-1 13a2 IRRADIATION FACILITY ACCIDENT ANALYSIS .................................13a2-1 13a2.1 ACCIDENT-INITIATING EVENTS AND SCENARIOS...........................13a2-1 13a2.1.1 MAXIMUM HYPOTHETICAL ACCIDENT ..............................................13a2-2 13a2.1.2 INSERTION OF EXCESS REACTIVITY/INADVERTENT CRITICALITY .........................................................................................13a2-4 13a2.1.3 REDUCTION IN COOLING....................................................................13a2-8 13a2.1.4 MISHANDLING OR MALFUNCTION OF TARGET SOLUTION ............13a2-11 13a2.1.5 LOSS OF OFF-SITE POWER................................................................13a2-13 13a2.1.6 EXTERNAL EVENTS .............................................................................13a2-15 13a2.1.7 MISHANDLING OR MALFUNCTION OF EQUIPMENT AFFECTING THE PSB...........................................................................13a2-16 13a2.1.8 LARGE UNDAMPED POWER OSCILLATIONS....................................13a2-18 13a2.1.9 DETONATION AND DEFLAGRATION IN PRIMARY SYSTEM BOUNDARY ...........................................................................13a2-20 13a2.1.10 UNINTENDED EXOTHERMIC CHEMICAL REACTIONS OTHER THAN DETONATION ...............................................................13a2-22 13a2.1.11 PRIMARY SYSTEM BOUNDARY SYSTEM INTERACTION EVENTS .................................................................................................13a2-22 13a2.1.12 FACILITY-SPECIFIC EVENTS ..............................................................13a2-29 13a2.2 ACCIDENT ANALYSIS AND DETERMINATION OF CONSEQUENCES.................................................................................13a2-36 13a2.2.1 TARGET SOLUTION RELEASE INTO THE IU CELL ...........................13a2-36 13a2.2.2 EXCESS REACTIVITY INSERTION ACCIDENT...................................13a2-44 13a2.2.3 REDUCTION IN COOLING....................................................................13a2-48 13a2.2.4 MISHANDLING OR MALFUNCTION OF TARGET SOLUTION ............13a2-498 13a2.2.5 LOSS OF OFF-SITE POWER................................................................13a2-51 13a2.2.6 EXTERNAL EVENTS .............................................................................13a2-52 13a2.2.7 MISHANDLING OR MALFUNCTION OF EQUIPMENT AFFECTING THE PSB...........................................................................13a2-52 13a2.2.8 LARGE UNDAMPED POWER OSCILLATION ......................................13a2-56 13a2.2.9 DETONATION AND DEFLAGRATION IN PRIMARY SYSTEM BOUNDARY ...........................................................................13a2-56 13a2.2.10 UNINTENDED EXOTHERMIC CHEMICAL REACTIONS OTHER THAN DETONATION ...............................................................13a2-57 13a2.2.11 PRIMARY SYSTEM BOUNDARY SYSTEM INTERACTION EVENTS .................................................................................................13a2-57 SHINE Medical Technologies 13-i Rev. 1

Chapter 13 - Accident Analysis Table of Contents Table of Contents (contd)

Section Title Page 13a2.2.12 FACILITY-SPECIFIC EVENTS ..............................................................13a2-57 13a3

SUMMARY

AND CONCLUSIONS .........................................................13a3-1 13a4 REFERENCES.......................................................................................13a4-1 13b RADIOISOTOPE PRODUCTION FACILITY ACCIDENT ANALYSES ............................................................................................13b-1 13b.1 RADIOISOTOPE PRODUCTION FACILITY ACCIDENT ANALYSIS METHODOLOGY ................................................................13b-1 13b.1.1 PROCESSES CONDUCTED OUTSIDE OF THE IRRADIATION FACILITY................................................................................................13b-1 13b.1.2 ACCIDENT INITIATING EVENTS..........................................................13b-3 13b.2 ANALYSES OF ACCIDENTS WITH RADIOLOGICAL CONSEQUENCES.................................................................................13b-4 13b.2.1 MAXIMUM HYPOTHETICAL ACCIDENT IN THE RPF .........................13b-4 13b.2.2 LOSS OF CONTAINMENT ....................................................................13b-12 13b.2.3 EXTERNAL EVENTS .............................................................................13b-13 13b.2.4 CRITICAL EQUIPMENT MALFUNCTION..............................................13b-14 13b.2.5 INADVERTENT NUCLEAR CRITICALITY IN THE RADIOISOTOPE PRODUCTION FACILITY ..........................................13b-234 13b.2.6 RADIOISOTOPE PRODUCTION FACILITY FIRE.................................13b-320 13b.3 ANALYSIS OF ACCIDENTS WITH HAZARDOUS CHEMICALS PRODUCED FROM LICENSED MATERIAL .........................................13b-397 13b.3.1 CHEMICAL ACCIDENTS DESCRIPTION .............................................13b-397 13b.3.2 CHEMICAL ACCIDENT CONSEQUENCES..........................................13b-431 13b.3.3 CHEMICAL PROCESS CONTROLS .....................................................13b-454 13b.3.4 CHEMICAL PROCESS SURVEILLANCE REQUIREMENTS................13b-465 13b.4 REFERENCES.......................................................................................13b-521 SHINE Medical Technologies 13-ii Rev. 1

Chapter 13 - Accident Analysis List of Tables List of Tables Number Title 13a2.2.1-1 Material at Risk for TSV Source Term 13a2.2.1-2 Parameters Used in the Dose Consequence Assessment 13a2.2.1-3 Public and Worker LPF for each DBA 13a2.2.1-4 Airborne Release and Respirable Fractions for each DBA 13a2.2.7-1 Material at Risk for TOGS Source Term 13a3-1 Potential Consequences of Postulated Accidents in the Irradiation Facility 13a3-2 Irradiation Operations Safety Controls and Accident Applicability 13b.2.1-1 Source Terms for NGRS Storage Tanks 13b.2.1-2 Parameters Used in the Dose Consequence Assessment 13b.2.1-3 Public and Worker LPF for each DBA 13b.2.1-4 Airborne Release and Respirable Fractions for each DBA 13b.2.4-1 MAR for NGRS Storage Tank 13b.2.5-1 Safety-Related SSCs and Technical Specification Administrative Controls (IROFS) to Prevent and Mitigate Criticality Accidents 13b.2.6-1 Material at Risk for RPF Fire Source Term 13b.3-1 Bounding Inventory (lbs) of Significant Process Chemicals 13b.3-2 SHINE Toxic Chemical Source Terms and Concentrations SHINE Medical Technologies 13-iii Rev. 1

Chapter 13 - Accident Analysis Acronyms and Abbreviations Acronyms and Abbreviations Acronym/Abbreviation Definition ARF airborne release fraction AHR aqueous homogenous reactor AMSB ambient molecular sieve bed BR breathing rate BV building volume CAMS continuous air monitoring system CAAS criticality accident and alarm system CEDE committed effective dose equivalent DCF dose conversion factors DCS DC power supply system DDT deflagration detonation transition DBA design basis accident DBT design basis tornado DID defense in depth DR damage ratio DV dispersion value keff effective neutron multiplication factor EDE external dose equivalent ESF engineered safety feature FFPS facility fire detection and suppression system FVZ4 facility ventilation Zone 4 FSAR Final Safety Analysis Report FHA Fire Hazard Analysis GDC General Design Criterion H/X moderator to fissile material ratio SHINE Medical Technologies 13-v Rev. 1

Chapter 13 - Accident Analysis Acronyms and Abbreviations Acronyms and Abbreviations Acronym/Abbreviation Definition HAZOPS hazard and operability study HRR heat release rate HEPA high efficiency particulate air HGL hot gas layer HMI human machine interface IE initiating event IF irradiation facility ISA integrated safety analysis ISG interim staff guidance IU irradiation unit IROFS items relied upon for safety L liter LOOP loss of off-site power LEU low enriched uranium LFL lower flammability limit LPF leak path factor LWPS light water pool system MAR material at risk MHA maximum hypothetical accident Mo-99 molybdenum-99 NDAS neutron driver assembly system NGRS noble gas removal system NSR non-safety related NPSS normal electrical power supply system PCLS primary closed loop cooling system PDP positive displacement pump SHINE Medical Technologies 13-vi Rev. 1

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis

  • Mishandling or malfunction of equipment affecting PSB (Subsection 13a2.2.7).
  • Tritium purification system design basis accident (Subsection 13a2.2.12.3).

Further analysis of the above DBAs involved: (1) Identification of the limiting IE and bounding conditions, (2) Reviewing the sequence of events for functions and actions that change the course of the accident or mitigate the consequences, (3) Identifying damage to equipment or the facility that affects the consequences of the accident, (4) Review of the potential radiation source term and radiological consequences, and (5) Identification of facility-wide safety controls to prevent or mitigate the consequences of the accident.

Results of these analyses in Subsection 13a2.2, taking credit for safety-related SSCs and engineered safety features (ESFs) for each DBA, demonstrate that the mitigated consequences do not exceed the dose limits in 10 CFR 20.

13a2.1.1 MAXIMUM HYPOTHETICAL ACCIDENT In accordance with the guidance in the Final ISG Augmenting NUREG-1537, an MHA that bounds the potential radiological consequences of any accident considered to be credible is analyzed. The basis for selecting an MHA includes assumptions from the ISA Summary described below.

The SHINE facility is divided into two major process areas, the IF and the RPF areas. The IF includes eight IUs each containing, among other components, an SCAS (including the TSV and TSV dump tank), light water pool system (LWPS), and the TSV off-gas system (TOGS). The TSV, TOGS, TSV dump tank, and associated components make up the PSB. The RPF consists of several process areas that extract and purify the molybdenum-99 (Mo-99) product, recycle uranium, and extract other fission products. These include the molybdenum extraction cells, the purification cells, the uranium extraction (UREX) process cells, thermal denitration (TDN) cells, and waste processing areas. A supercell is comprised of a molybdenum extraction area, a purification area, and a packaging area that form one hot cell structure. The RPF contains three supercells.

The MHA is used to demonstrate that the maximum consequences in operating the facility at a specific site are within acceptable regulatory limits of 10 CFR 20.1201 and 10 CFR 20.1301. The MHA is a non-credible accident scenario that results in a release with radiological consequences that bound the DBAs. The Final ISG Augmenting NUREG-1537 specifies several possible MHAs that could be considered.

13a2.1.1.1 Initial Conditions and Assumptions Potential MHA scenarios suggested by the Final ISG Augmenting NUREG-1537 include:

  • Energetic dispersal of contents of the PSB with bypass of scrubbing capacity.
  • Detonation of hydrogen in the recombiner resulting in waste gas tank failure and release of some or all of the target solution and fission-product contents in aerosolized form.
  • Complete loss of target solution inventory (e.g., TSV break).
  • Man-made external event that breaches the PSB of more than one IU.
  • Facility-wide external event that breaches various systems containing radioactive fluids.

SHINE Medical Technologies 13a2-2 Rev. 1

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis 13a2.1.1.2 General Scenario Description Irradiation Facility Postulated MHA The IF postulated MHA general scenario is a release of irradiated target solution to the IU cell as a result of a loss of TSV integrity. No credit is taken for light water pool scrubbing or subcritical assembly support structure (SASS) confinement. Therefore, the first mitigating safety feature is the robust IU cell structure. Because of this robust design, the structure remains intact and confines a majority of the inventory released from the TSV within the IU cell.

The release of irradiated target solution into the IU cell could result in a release to the environment through the facility stack via the RVZ1 flow path. Under accident conditions, the release is mitigated by filters in the RVZ1 and isolation of the IU cell by inlet and outlet dampers.

Radioisotope Production Facility Postulated MHA For the MHA postulated scenario in the RPF, the greatest potential radiological release would be the failure of the five NGRS storage tanks. The result for this scenario is a release of inventory of noble gases from NGRS storage tanks into the noble gas storage cell. The first mitigating safety feature is the robust noble gas storage cell structure that includes the thick concrete walls and ceiling that surround the five noble gas storage tanks. Because of the robust design, the storage cell structure remains intact and confines a majority of the inventory release of the NGRS storage tanks to within the noble gas storage cell. Therefore, the release is mitigated by a holdup of the noble gases in the storage cell, resulting in their further decay before further release.

The release of the noble gas inventory into the NGRS storage cell could result in a radioisotope release to the environment through the facility stack via the RVZ1 flow path. The release is mitigated by isolation of the noble gas storage cell by inlet and outlet dampers on abnormally high radiation levels. HEPA and charcoal filters in RVZ1 are ineffective in the mitigation of accidents involving a release of noble gases.

Based on the detailed consequence analysis in Subsections 13a2.2.1 and 13b.2.1, the RPF postulated MHA provides the bounding consequences to the public. Therefore, this is determined to be the MHA for the SHINE facility.

13a2.1.2 INSERTION OF EXCESS REACTIVITY/INADVERTENT CRITICALITY Both the Final ISG Augmenting NUREG-1537 and the ISA Summary identify have identified the insertion of excess reactivity during normal operations as a potential IE/scenario category that needs to be evaluated as part of the accident analysis. Furthermore, the ISA Summary also identifies identified the potential for an inadvertent criticality during the startup process of the TSV as a scenario that needs to be evaluated.

Three operating conditions were evaluated for the TSV: (1) fill operations with uranyl sulfate (clean or previously irradiated) solution, (2) cold target solution immediately prior to neutron driver startup, and (3) irradiation operations once the neutron driver is started. For the subcritical TSV, excess reactivity is defined as an amount of potential added reactivity above normal conditions.

SHINE Medical Technologies 13a2-4 Rev. 1

[Proprietary Information - Withhold from public disclosure under 10 CFR 2.390(a)(4)]

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis Scenario C - Loss of or Reduced PCLS and LWPS Flow This final scenario assumes both a loss of PCLS and LWPS flow with continued operation of the neutron driver. This could be as a result of failure or damage to electrical supply at a common supply point. It could also be as a result of operator error, coupled with other failures that result in continued operation of the neutron driver or a common mode failure that would result in piping failures in both systems, such as a seismic event. If any of these accidents were to occur, the heat load would be transferred to the light water pool.

13a2.1.4 MISHANDLING OR MALFUNCTION OF TARGET SOLUTION The TSV uses a liquid target solution that generates fission products that are contained by the PSB. The accidents involving the mishandling or malfunction of the target solution, including a failure of the PSB within the IF, are analyzed here. Mishandling or malfunction of target solution within the RPF are addressed in Subsection 13b.2.4.

Within the boundaries of the IF, the target solution is contained in the target solution hold tank, TSV, the TSV dump tank, and associated connected piping. The irradiated target solution transfer pump is also located within the IF, so a malfunction or mishandling of this pump is considered. Note that the TOGS, PCLS, and LWPS are located in the IF, but the mishandling or malfunction of these systems is addressed in Subsections 13a2.1.7 and 13a2.1.3. Also, the insertion of excessive reactivity and inadvertent criticality events involving the target solution are discussed in Subsection 13a2.1.2.

13a2.1.4.1 Identification of Causes, Initial Conditions, and Assumptions The Final ISG Augmenting NUREG-1537 and the ISA Summary identify have identified several initiators: namely, failure to control pH of the target solution, failure to control solution temperature and failure to control solution pressure. The ISA Summary and associated hazard analyses (HAZOPS/PHA) identified several potential IE including:

  • Failure to control pH of the target solution leading to TSV corrosion ultimately leading to spills or leakage outside the TSV and tanks.
  • Excessive cooling of target solution (addressed in Subsection 13a2.1.2).
  • Failure to control pressure thereby initiating target solution boiling (addressed in Subsection 13a2.1.2).
  • Failure of pumps, valves, piping, and tanks.
  • Operator errors associated with inadvertently overflowing tanks or misdirecting flow.

The initial conditions and assumptions associated with mishandling or malfunction of target solution include:

  • Each TSV is operated on a 5.5-day irradiation cycle with an additional [ Proprietary Information ] residence for the target solution in the TSV dump tank following irradiation to allow for decay of short-lived radioisotope fission products.
  • The MAR for this event is conservatively taken to be the TSV inventory at shutdown, following the fourth irradiation cycle. Due to the dump tank being at approximately atmospheric pressure and the slow rate at which solution is pumped from the dump tank, only 25 percent of TSV inventory is assumed to leak to the IU cell prior to facility evacuation.

SHINE Medical Technologies 13a2-11 Rev. 1

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis

  • The TSVs are operated independently, so that an event on one TSV does not affect another TSV or IU cell.
  • Irradiation and target solution transfer operations of the TSVs are controlled by operators.

The mishandling or malfunction of equipment in these systems could potentially result in a spill or a misdirection of the target solution outside of the primary system boundary.

  • The IU cells are isolated from the rest of the facility by robust walls, ceiling, and floor.
  • Penetrations for piping, ducts and electrical cables, and airlocks are sealed within specifications to limit the release of radioactive materials from the facility.
  • Piping systems that are open to the atmosphere of the IU or TOGS shielded cell are isolable by means of redundant, automatic isolation valves or by dual, normally closed manual valves.
  • Ventilation ducts are isolable from the exhaust stack by means of bubble-tight dampers.
  • The RCA ventilation system during normal operations maintains the IU cell at a negative pressure with respect to the rest of the facility.
  • Tanks and piping that have the potential to contain fissile material, except the TSV, are designed with passive measures that prevent an inadvertent criticality of the target solution.
  • Sumps and drains that lead from the pipe trenches and tank vaults are designed with a geometry that prevents an inadvertent criticality of the leaked target solution.
  • RVZ1 is equipped with radiation monitoring to activate the isolation dampers prior to the release of excessive radioactive material.

13a2.1.4.2 General Scenario Description There are four general scenarios that are identified as mishandling or malfunction of the target solution within the IF. Each of these is distinguished from the others by where the target solution is directed. These four scenarios are: TSV overfill, TSV or dump tank leak into the light water pool, TSV leak into the primary cooling system, and a dump tank leak into the IU cell. Each of these scenarios and their potential causes are discussed below:

  • Scenario 1 - TSV Overfill A TSV overfill flows into the dump tank through the TSV overflow lines. TSV level detection is also installed to alert the operator to any TSV overfill conditions. The reactivity insertion from this event is analyzed earlier in Subsection 13a2.1.2. Other than the consequences discussed in 13a2.2.2, this would only result in a process upset.
  • Scenario 2 - TSV or Dump Tank Leak Into the Light Water Pool Leakage from the TSV or TSV dump tank into the light water pool could occur due to corrosion of the TSV, dump line, dump valves, or TSV dump tank. For a TSV leak, a leak in the PCLS would also have to occur in order for the target solution to reach the light water pool. In this scenario, the target solution leakage would be contained in the LWPS and IU cell where it would be contained from any workers in the facility. High area radiation monitor levels would alert the operators for significant leaks of target solution into the light water pool, while periodic sampling of the pool water is utilized to detect very small leaks and initiate corrective action. Dilution of the target solution and the geometry of the light water pool would prevent an inadvertent criticality.

SHINE Medical Technologies 13a2-12 Rev. 1

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis 13a2.1.5.2 General Scenario Description As noted in Subsection 13a2.1.5.1, the worst case scenario is a LOOP. Although the interruption of off-site power is expected to be relatively brief, it is assumed for this analysis that off-site power remains unavailable for an extended period of time. This could potentially occur if the LOOP is due to severe weather or a seismic event that damages substation equipment or associated transmission lines.

The sequence of events for a LOOP is as follows:

  • The UPSS automatically maintains power to the 120 VAC UPS buses A & B, supplying power to the equipment listed in Subsection 8a2.2.3.
  • A LOOP results in the shutdown of all neutron drivers and associated irradiation operations and RPF operations. The uranyl sulfate solution in the operating TSVs drains to their respective TSV dump tanks, as designed.
  • The TSV and primary cooling systems (PCLS and LWPS) lose power to their pumps.

Forced convection cooling ceases and heat is removed by natural convection to the light water pool.

  • The neutron driver assembly system (NDAS) and the tritium purification system (TPS) equipment becomes de-energized on a LOOP. Neither of these systems are required for the safe shutdown of the SHINE facility. Both of these systems contain tritium, which remains contained within their respective pressure boundaries.
  • Hydrogen generation continues to occur due to radiolysis from the decay of fission products. The 120 VAC UPS buses provide backup power to the TOGS.
  • The UPSS supplies essential facility loads for a duration of two hours. The 120 VAC UPS buses automatically maintain power to essential instrumentation and equipment. This includes the TOGS equipment needed to control the build-up of hydrogen.
  • Radiation monitoring systems of the facility continue to operate.

13a2.1.6 EXTERNAL EVENTS The following potential external events have been identified as DBAs for the SHINE facility:

  • Seismic event affecting the IF and RPF (see Section 3.4).
  • Tornado or high-winds affecting the IF and RPF (see Section 3.2).
  • Small aircraft crash into the IF or RPF (see Section 3.4.5).

Plant SSCs, including their foundations and supports, that are designed to remain functional in the event of a design basis earthquake (DBEQ) are designated as Seismic Category I, as indicated in Table 3.5-1. SSCs designated SR or IROFS are classified as Seismic Category I.

SSCs whose failure as a result of a DBEQ could impact an SSC designated as SR or IROFS are classified as Seismic Category I. SSCs that must maintain structural integrity post-DBEQ, but are not required to remain functional are Seismic Category II.

All Seismic Category I SSCs are analyzed under the loading conditions of the DBEQ and consider margins of safety appropriate for that earthquake. The margin of safety provided for safety class SSCs for the DBEQ are sufficient to ensure that their design functions are not jeopardized. For further details of seismic design criteria refer to Section 3.4.

SHINE Medical Technologies 13a2-15 Rev. 1

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis The SHINE production facility building is designed to survive credible wind and tornado loads, including missiles, as described in Section 3.2 and Subsection 3.4.2.6. It is also designed to withstand credible aircraft impacts as discussed in Subsection 3.4.5.

Due to the facility design, there are no consequences to the workers or the public for postulated external events.

13a2.1.7 MISHANDLING OR MALFUNCTION OF EQUIPMENT AFFECTING THE PSB Mishandling or malfunction of equipment has been identified explicitly by the Final ISG Augmenting NUREG-1537 as a category of IEs or accident scenarios that need to be evaluated for potential impact on the PSB, and these scenarios merit additional quantitative analysis.

Furthermore, the Final ISG Augmenting NUREG-1537 and the ISA Summary identify have identified several potential scenarios under this category: namely, failure of the TOGS, leading to release of noble gases and halogens. The accidents involving the mishandling or malfunction of the liquid systems or loss of the pressure boundary are analyzed in Subsection 13a2.1.4. The loss of vessels and line failures for systems within the RPF are analyzed in Subsection 13b.2.4.

The analysis of the mishandling or malfunction of equipment affecting the PSB is, therefore, limited to those systems handling the gaseous radioactive products resulting from irradiation of the target solution and to the neutron driver and its support systems.

13a2.1.7.1 Identification of Causes, Initial Conditions, and Assumptions The ISA Summary and associated HAZOPS/PHA identified several potential IEs for mishandling or malfunction of equipment within the PSB, including failure of valves and tanks, human errors associated with inadvertently releasing the stored noble gases to the building stack, neutron driver and tritium processing malfunctions, and other credible scenarios.

The waste gases from irradiation of the target solution are of two major types: the hydrogen and oxygen produced by radiolysis of water in the target solution, and radioactive fission product gases. The detonation or deflagration of hydrogen within the TOGS or elsewhere within the PSB is addressed in Subsection 13a2.1.9. Other unintended exothermic chemical reactions within the PSB are addressed in Subsection 13a2.1.10. This section analyzes failures that could lead to the release of noble gases and halogens due to other causes.

The PHA identified malfunctions of the NDAS and the associated TPS that include inadvertent actuation of the neutron driver, accelerator misalignment, and loss of tritium.

The initial conditions and assumptions associated with mishandling or malfunction of equipment affecting the PSB include:

  • Fission product gases (e.g., Kr, Xe, and halogens) produced during irradiation operations are monitored, processed, collected, stored, and disposed by TOGS and the NGRS.

Each TSV has a dedicated TOGS.

  • The TOGS flow is retained within the off-gas system until the target solution batch irradiation cycle is completed. As the TOGS circulates sweep gas during the irradiation cycle, a portion of the iodine is removed by the zeolite beds, and hydrogen and oxygen is recombined by the catalytic recombiners, but no other gases are removed or purged.

SHINE Medical Technologies 13a2-16 Rev. 1

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis

  • Since the TOGS is not a pressurized system, it is assumed that only 25 percent of the activity leaves the system prior to evacuation of the facility.
  • Automatic trip of power to the NDAS occurs for several reasons, including TSV overpower and misalignment of the neutron driver beam.

The TPS process is performed in semi-batch steps, treating the contaminated flush gas and purifying the contaminated tritium gas.

13a2.1.7.2 General Scenario Description Scenarios involving the NDAS are mitigated by the system design. Automatic trip of the NDAS power supply occurs by means of safety-related relays and breakers (Subsection 4a2.3.8) actuated by an overpower event within the TSV, as detected by the TRPS. The impact of an overpower event on the integrity of the PSB is mitigated by negative reactivity feedback from voiding in the TSV. In the event of a neutron driver misalignment, the NDAS is shut down.

Interlocks prevent operation of the NDAS if personnel are present. Together, these minimize the potential for an overexposure of facility personnel. Events related to the neutron driver are further evaluated in Subsection 13a2.1.12.1.

Scenarios involving the TPS are mitigated by system and confinement design. The two TPS are contained within separate glovebox enclosures located in the IF. The glovebox atmosphere is inerted with nitrogen and oxygen levels are monitored. Equipment to clean the tritium is located in the glovebox atmosphere recirculation loop (see Subsection 9a2.7.1.3.1). The piping to and from the NDAS is double-walled and designed to maintain its integrity during normal, abnormal, and accident conditions. Any leakage of tritium from the glovebox enclosure or the external piping is detected to ensure facility personnel are protected. Events related to the TPS are further evaluated in Subsection 13a2.1.12.3.

The scenario is an inadvertent venting of the off-gas purge contents from one of the eight TOGS.

In this scenario, a malfunction or human error occurs that releases the off-gas purge volume from one of the eight TOGS to one of the TOGS shielded cells. Further analyses of this scenario and the associated consequences are preserved in Subsection 13a2.2.7.

The following engineering controls either prevent or mitigate this scenario:

  • Integrity of the TOGS.
  • Confinement provided by the cell in which the TOGS is located, including the ability to isolate the ventilation system supporting the cell through the use of bubble-tight isolation dampers upon a signal from the ESFAS.

The TOGS is provided with hydrogen monitors. Gas is only purged from the TOGS to the NGRS if hydrogen concentrations are below acceptable limits. The TOGS has hydrogen recombiner capabilities. The NGRS system is also provided with hydrogen detection.

SHINE Medical Technologies 13a2-17 Rev. 1

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis 13a2.1.9 DETONATION AND DEFLAGRATION IN THE PRIMARY SYSTEM BOUNDARY Both the Final ISG Augmenting NUREG-1537 and the ISA Summary have identified the deflagration and detonation of hydrogen as a potential IE that is evaluated as part of the accident analysis. Further analyses and associated consequences are presented in Subsection 13a2.2.9.

This subsection discusses the effects of a hydrogen deflagration or detonation on the IF.

Irradiation of the uranium-bearing solution produces significant quantities of hydrogen and oxygen and small quantities of fission products. The TOGS is the primary control for mitigating hazards associated with the evolved gases. Functional requirements for the TOGS include maintaining the concentration of hydrogen to less than the LFL, recombining the hydrogen and oxygen as well as fission product gases, and returning the recombined water back to the TSV.

The TOGS functions as a closed loop during the irradiation process and is purged between each irradiation cycle.

13a2.1.9.1 Identification of Causes, Initial Conditions, and Assumptions The formation and release of hydrogen due to radiolytic decomposition is an inherent result of irradiation of water. The ISA Summary and the corresponding HAZOPS/PHA has identified several potential scenarios that could result in the accumulation of hydrogen and potential deflagration or detonation. As indicated identified in the ISA Summary, a deflagration or detonation accident is most likely to occur when the TOGS fails, which allows hydrogen to accumulate in the TSV headspace, dump tank, or off-gas piping. Potential failures that have been identified include a loss of power to the TOGS blowers, plugged zeolite beds, and loss of the recombiner functionality. Hydrogen could also accumulate if there is a partial failure of the TOGS, such as reduced volumetric flow rate due to a partially-obstructed filter or reduced blower capability.

The initial conditions and assumptions associated with a deflagration or detonation of hydrogen gas are:

  • The generation of radiolytic hydrogen for the TSV has been characterized. This analysis shows that during the irradiation cycle, the device is capable of developing flammable concentrations of hydrogen in the TSV headspace within seconds if the TOGS has failed.
  • A hydrogen deflagration/detonation analysis was performed to determine the potential environmental conditions (e.g., overpressures, potential for deflagration detonation transition [DDT]). As part of the analysis, the potential for a DDT was evaluated using the detonation cell size as the basis. The characteristic length and width of the TSV headspace is much larger than the detonation cell size, implying that the potential for a DDT, even though unlikely, cannot be ruled out. The PSB is designed to withstand credible deflagration and detonation events.
  • It is assumed that the risk for deflagration in the IU cell is dominated by the generation and potential accumulation of hydrogen in the headspace of the TSV due to the failure of the TSV off-gas system.
  • Each TSV is serviced by a dedicated and independent TOGS. It is assumed a single TOGS fails, allowing hydrogen to accumulate in one TSV.
  • In the event of failure of the PSB, confinement is provided by the IU cell and TOGS shielded cell.

SHINE Medical Technologies 13a2-20 Rev. 1

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis The second scenario involves a loss of control of combustibles and ignition sources. A reasonable scenario involves the performance of maintenance activities involving hot work, such as grinding, welding, or cutting, without appropriate controls of combustible materials. During performance of such work the generation of weld spatter, slag, or sparks may ignite combustible materials in the area. The impact of this type of fire is minimized through the establishment of administrative controls. Performance of hot work requires establishment of qualified fire watch personnel equipped with hand-held fire extinguishers. Qualification of the fire watch personnel ensures their capability to identify and extinguish fires in their incipient stages. Procedural requirements require minimization of combustible materials in the immediate vicinity of the work.

Accordingly, if such a fire were ignited, it would remain small, due a lack of combustibles and would be quickly extinguished by the fire watch. Fires that are not immediately extinguished are mitigated by the engineering controls discussed above for equipment malfunctions.

The TPS presents a potential for hydrogen release. This system is used to remove protium and deuterium impurities from the facility tritium inventory. The process uses a thermal diffusion column to separate the heavier tritium isotope from the lighter deuterium and protium isotopes by thermal cycling. Tritium is returned from the IUs and processed through the TPS for the purpose of removing deuterium and providing purified tritium gas. Tritium storage is located within the TPS gloveboxes with the bulk of the tritium in solid storage beds and thus unavailable to supply a leak. The glovebox is normally inerted, reducing the potential for hydrogen combustion.

Hydrogen fire in the TPS caused by a simultaneous hydrogen leak from TPS equipment and a loss of inert atmosphere in the glovebox, is prevented by the volume of the glovebox, which is large enough that a full release of tritium inventory would not result in hydrogen concentrations above the LFL. A fire external to the glovebox in the TPS room is mitigated by controls of combustible materials and the facility fire suppression system. Postulated fires are not expected to violate the integrity of the glovebox.

The deuterium source vessel for the accelerator presents a potential for hydrogen release inside the IU cell. The integrity of this deuterium vessel is assured by a periodic inspection program.

The final fire scenario involves fire spread from an area outside of the IF. The construction of the IF walls and associated components (e.g., doors, penetration seals, dampers) is sufficiently robust to provide a three hour fire rating. In some cases, non-fire rated components (e.g., airlock doors) are used to complete these barriers; however, these components provide fire separation equivalent to or greater than their rated counterparts. The postulated scenario would involve defeat of a fire barrier or its components, allowing fire spread into the IF from an external area.

Such a scenario would involve opening of airlock doors, removal of the concrete shield plugs and access doors from the IU cells, or removal of a rated penetration seal from an IF fire area (FA-2) barrier. Fire spread into the IF from an external fire could occur in any of these situations.

The need to remove the concrete shield plug and opening the personnel access door from an IU cell would occur during maintenance or modification activities which could potentially precipitate a fire. A fire under these conditions could involve transient combustibles located in the area to support the work activities. This type of scenario would be mitigated through application of both administrative and engineering controls. To prevent the development of conditions that could lead to fire, fire watch personnel are staged at unprotected fire area openings. These personnel are trained to recognize and eliminate fire hazards, thus preventing fire development. This administrative control prevents the development and/or spread of fire while openings are unprotected. Longer-term protection of openings is ensured through the placement of fire rated temporary penetration seals in barrier openings until the opening is permanently sealed. Finally, SHINE Medical Technologies 13a2-32 Rev. 1

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis exposed group either the BV or DV. Exposure due to surface contamination is only calculated for workers and the factors include areal contamination DCFs and surface areas. Another factor considered for workers in dose calculations is the time of exposure.

  • The DCFs are used to:

- Convert activity inhaled to an internal dose,

- Convert an exposure to an external activity from immersion in air into an external dose and,

- Convert an external activity due to exposure to a contaminated area into an external dose.

  • The BR is the volume rate of air inhaled by a reference person.
  • The BV is the free volume within the enclosed building to determine dose due to immersion.

The values used in this analysis for these factors are listed in Table 13a2.2.1-2.

The resulting dose consequence of this event is a TEDE of 3.06 rem to the workers. The TEDE to a member of the public for this event is 0.0165 rem (site boundary) and 0.0023 rem (nearest residence). The resulting off-site doses are within the 0.1 rem TEDE regulatory limit specified in 10 CFR 20.1301, and on-site doses are within the 5 rem TEDE regulatory limit specified in 10 CFR 20.1201.

Finally, emergency operating procedures, recovery actions, and administrative controls are available to provide additional mitigation of failed isolation SSCs in the event of a release of radioactive material.

13a2.2.1.7 Safety Controls This is a postulated MHA for the IF. Safety-related SSCs and administrative controls for a similar event DBA are listed in Subsection 13a2.2.4.

SHINE Medical Technologies 13a2-39 Rev. 1

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis Table 13a2.2.1-3 Public and Worker LPF for each DBA Event Material Public LPF Worker LPF Particulates 0.0001 0.025 Target Solution Release into the IU Cell (IF Halogens 0.0005 0.025 Postulated MHA)

Noble Gas 0.01 0.025 Particulates NP(a)

Mishandling and Malfunction of Equipment Halogens 0.0005 0.025 Affecting the PSB Noble Gas 0.01 0.025 Particulates 0.0001 0.025 Mishandling or Malfunction of Target Halogens 0.0005 0.025 Solution Noble Gas 0.01 0.025 Tritium Purification System Design Basis Tritium Gas 0.01 0.10 1.0 Event a) NP = Not Present in significant quantity SHINE Medical Technologies 13a2-42 Rev. 1

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis Table 13a2.2.1-4 Airborne Release and Respirable Fractions for each DBA Event Material ARF RF Particulates 0.0002 0.4 Target Solution Release from the Halogens 0.05 1.0 IU Cell (IF Postulated MHA)

Noble Gas 1.0 1.0 Particulates NP(a)

Mishandling and Malfunction of Halogens 0.05 1.0 Equipment Noble Gas 1.0 1.0 Particulates 0.0001 1.0 Mishandling and Malfunction of Halogens 0.05 1.0 Target Solution Noble Gas 0.1 1.0 Tritium Purification System Tritium Gas 1.0 1.0 Design Basis Accident a) NP = Not Present in significant quantities SHINE Medical Technologies 13a2-43 Rev. 1

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis to the criticality-safe TSV dump tank terminating the event. In addition, during a fill/startup evolution, the TRPS trip automatically stops the fill evolution by closing TSV fill valves and opening TSV dump valves. The TRPS serves to prevent an inadvertent criticality in the target solution and there would be minimal increase in the source term due to slightly elevated power.

Fission products are contained within the TSV, TOGS, dump tank and associated piping.

The robust design features of the PSB and remaining facility building are not challenged by an excess reactivity insertion event. The fission product inventory of the target solution and associated fission gases are contained within the TSV and associated systems thereby posing no significant increase in consequences to workers or the public.

13a2.2.2.7 Safety Controls There are several safety-related SSCs and administrative controls that prevent or provide mitigation for the consequences of an excess reactivity insertion event and ensure that the TSV remains subcritical.

Increase in Target Solution Density During Operations:

  • TRPS trip on high hydrogen concentration (SR).
  • TRPS trip on high range high neutron flux (SR).

Target Solution Temperature Reduction:

  • TRPS trip on high neutron flux (high range and source range) (SR).
  • TRPS trip on low PCLS temperature (SR).
  • PCLS low temperature alarms (DID).
  • LWPS low temperature alarms (DID).

Additional Target Solution Injection During Fill/Startup and Irradiation Operations:

  • Target solution uranium enrichment limit and tolerance (potential Technical Specification parameter).
  • Target solution uranium concentration limit and tolerance (potential Technical Specification parameter).
  • Neutron driver high voltage power supply interlocked with TSV startup mode to prevent operation by TRPS (SR).
  • Manual TSV trip capability incorporated into operator control panel (SR).
  • Incorporated operator manual TSV trips in operating procedures as appropriate (DID).
  • TSV dump tank designed with criticality-safe geometry (keff < 0.95) (SR).
  • TSV dump tank at a lower elevation than the TSV (SR).
  • TSV fill valves, fill pipe sizing, and fill pump design (SR).
  • TRPS trip on source range high neutron flux (SR).
  • Two redundant TSV dump tank valves (SR).
  • Administrative controls include an approved, procedural startup process using the 1/M methodology (DID).
  • Administrative controls incorporated in operating procedures for TSV volume hold points to calculate location within 1/M curve acceptable band (DID).
  • Procedural control of startup - Conduct of Operations (Technical Specification Administrative Control)

SHINE Medical Technologies 13a2-47 Rev. 1

[Proprietary Information - Withhold from public disclosure under 10 CFR 2.390(a)(4)]

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis During the fill/startup operation, the TRPS trip signal automatically closes TSV fill valves and opens the TSV dump valves transferring the target solution from the TSV to the criticality-safe TSV dump tanks terminating the event. Only one of these events needs to occur to prevent criticality. The target solution is passively cooled for decay heat removal.

Following fill/startup operation, the TSV fill valves and the fill pump are locked out and de-energized to prevent inadvertent fissile solution transfer to the TSV prior to and during irradiation operation.

During irradiation operations, the TRPS trip signal automatically de-energizes the neutron driver and opens the TSV dump tank valves.

Besides the TRPS, other principle SR design features to prevent or mitigate the consequences of an excess reactivity insertion event include:

  • Robust design of the TSV.
  • Robust design and reliability of the TOGS.
  • Robust design of the dump tank, piping, and valves.

Finally, the instrumentation and monitoring equipment provides the means for the operators to monitor the TSV and assess the condition of the facility both inside and outside the IU cell area.

This includes radiation monitoring and alarms to notify facility personnel of elevated radiation levels for the protection of facility workers, and effluent monitoring to assess impact to the public.

Hydrogen control is also required in order to maintain the hydrogen concentration in the TOGS and TSV headspace below the lower flammability limit. SR Systems include the following:

  • TRPS - TSV Reactivity Protection System.
  • CAMS - Continuous Air Monitoring System.
  • RAMS - Radiation Air Monitoring System.
  • SCADA/HMI - Supervisory Control and Data Acquisition/Human Machine Interface.
  • NGRS - Noble Gas Removal System.

13a2.2.3 REDUCTION IN COOLING The TRPS trips on loss of cooling. The temperature increase prior to TRPS trip results in a negative reactivity insertion within the TSV. The decay heat from the target solution is estimated to be approximately [ Proprietary Information ]. The volume of water in the light water pool is sufficient to act as a passive heat sink for the TSV dump tanks and the decay heat from the uranyl sulfate solution and sensible heat from the other TSV components. Therefore, cooling system operation is not required to remove decay heat from the target solution. Thus, there is no significant increased risk to workers or the public.

Safety Controls The essential safety-related systems that are required to function during a loss of cooling are:

  • TRPS loss of cooling trip (loss of PCLS flow and/or PCLS high temperature) (SR).
  • Light water pool (SR).

SHINE Medical Technologies 13a2-48 Rev. 1

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis Airborne and respirable source terms are used to calculate the TEDE. The factors used to calculate the airborne and respirable source terms are the product of the MAR, the damage ratio (DR), the release fraction from IU cell, the airborne release fraction (ARF), and the respirable fraction (RF). The values used in this analysis for these factors are listed in Table 13a2.2.1-2.

13a2.2.4.6 Radiological Consequence Analysis The radiological dose consequences for this DBA are calculated using the methods described in Subsection 13a2.2.1 and the values in Table 13a2.2.1-2.

The resulting TEDE for workers is 1.50 rem. The TEDE to a member of the public for this event is 2.19E-03 rem at the site boundary and 3.06E-04 rem for the nearest resident. Therefore, the resulting on-site and off-site doses are below the regulatory limits specified in 10 CFR 20.1301, and 10 CFR 20.1201.

13a2.2.4.7 Safety Controls The following engineering controls have been designed to prevent or mitigate the effects of the target solution spill in IU cell.

  • TSV dump tank piping integrity (SR).
  • The structural integrity, biological shielding, and low leakage construction (including penetrations) of the IU cells (SR).
  • RVZ1 isolation bubble-tight dampers, exhaust filters, and ductwork (SR).
  • RAMs high radiation signal (SR).
  • Light water coolant activity monitoring program (TS Administrative Control).
  • TSV overflow line (SR).

Instrumentation and monitoring equipment provides the means for the operators to monitor and assess the condition of the facility in the irradiation operations area. This includes radiation monitoring and alarms to notify facility personnel of elevated radiation levels for the protection of facility workers, and effluent monitoring to assess impact to the public. A 120 VAC UPSS is designed to provide power in the case of LOOP for monitoring of conditions in the IF.

13a2.2.5 LOSS OF OFF-SITE POWER Following a LOOP, the neutron driver is de-energized, however, hydrogen generation continues to occur in the target solution due to radiolysis from the decay of fission products. The UPSS is designed to power the TOGS loads needed to continue to remove hydrogen generated by radiolysis. The effects of loss of cooling due to a LOOP are discussed in Subsection 13a2.2.3.

Thus, there is no significant increased risk to workers or the public.

Safety Controls The following safety-related controls have been designed to prevent or mitigate the effects of a LOOP:

  • TOGS blower (SR).

SHINE Medical Technologies 13a2-51 Rev. 1

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis

  • PVVS blower (IROFS) (SR).
  • Robust design and reliability of TOGS (SR).
  • Process and radiation monitoring equipment needed to monitor the condition of the facility (TRPS, TPCS, CAMS, RAMS, CAAS, SCADA/HMI) (DID) (SR).
  • UPSS and associated 120 VAC buses (SR).

13a2.2.6 EXTERNAL EVENTS The facility is designed to withstand credible external events as described in 13a2.1.6. Thus, there are no consequences to the workers or the public from external events.

Safety Controls The essential systems that are required to function during an external event are:

  • Seismic Category I SSCs (SR).

13a2.2.7 MISHANDLING OR MALFUNCTION OF EQUIPMENT AFFECTING THE PSB This subsection contains the follow-on evaluation for the event identified in Subsection 13a2.1.7.

The conclusion of that subsection was that the release of the off-gas purge volume from one of the eight TOGS to the TOGS shielded cell requires further evaluation.

13a2.2.7.1 Initiating Event In this scenario, a malfunction or human error occurs that releases the off-gas purge volume from one of the eight TOGS to one of the TOGS shielded cells.

13a2.2.7.2 Sequence of Events This scenario is the complete release of the off-gas purge volume into the TOGS shielded cell.

The sequence of events for the postulated scenario is as follows:

a. A release of off-gas purge volume occurs from the TSV directly to the TOGS shielded cell as a result of TOGS pipe rupture.
b. Twenty-five percent of the TOGS activity enters the TOGS shielded cell prior to evacuation of the facility.
c. A high radiation signal activates the bubble-tight isolation dampers after approximately one percent of the total activity is released to the RVZ1.
d. The airborne activity is filtered prior to being released to the environment through the RVZ1 system until the bubble-tight dampers are closed.
e. Ten percent of the airborne activity is released into the RCA through penetrations in the TOGS shielded cell.
f. Radiation alarms are available locally or in the control room to notify facility personnel of any radiation leakage.

SHINE Medical Technologies 13a2-52 Rev. 1

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis The resulting TEDE for workers is 1.87 rem. The TEDE to a member of the public for this event is 1.59E-02 rem at the site boundary and 2.23E-03 rem for the nearest resident. Therefore, the resulting on-site and off-site doses are below the regulatory limits specified in 10 CFR 20.1301, and 10 CFR 20.1201.

13a2.2.7.7 Safety Controls The following engineering safety-related SSCs have been designed to prevent or mitigate the effects of the off-gas purge volume release into the TOGS shielded cell:

  • Robust design and reliability of TOGS (SR).
  • The structural integrity, biological shielding, and leak tight construction (including penetrations) of the TOGS shielded cells (SR).
  • RVZ1 isolation bubble-tight dampers, exhaust filters, and ductwork (SR).
  • RAMs high radiation signal (SR).

Instrumentation and monitoring equipment provides the means for the operators to monitor and assess the condition of the facility in the IF. This includes radiation monitoring and alarms to notify facility personnel of elevated radiation levels for the protection of facility workers, and effluent monitoring to assess impact to the public. A 120 VAC UPSS is designed to provide power in the case of LOOP for monitoring of conditions in the IF.

SHINE Medical Technologies 13a2-54 Rev. 1

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis 13a2.2.8 LARGE UNDAMPED POWER OSCILLATION As described in Subsection 13a2.1.8, operating at a subcritical condition with a low power density and negative temperature and void reactivity coefficients provides TSV stability and self-limiting power oscillations. A TRPS setpoint is designed to activate on high neutron flux level should a large undamped power oscillation occur. Thus, there are no consequences to workers or the public.

Safety Controls The essential features required to function during a large undamped power oscillation are:

  • Target solution properties.

- Negative temperature coefficient (Technical Specifications parameter).

- Negative void coefficient (Technical Specifications parameter).

  • Thermal power limit of the TSV (Technical Specifications parameter).
  • TRPS high neutron flux trip (SR).

13a2.2.9 DETONATION AND DEFLAGRATION IN PRIMARY SYSTEM BOUNDARY As discussed in Subsection 13a2.1.9, hydrogen and oxygen are released by radiolysis from the target solution both during and after irradiation, and high concentrations of hydrogen may result in detonation or deflagration. The TOGS provides ventilation of the headspace above the TSV to maintain hydrogen concentrations below the LFL. A failure of the TOGS to perform this design function may result in conditions that could lead to a hydrogen deflagration/detonation.

The pressure transient caused by a hydrogen deflagration/detonation in the PSB is contained by the construction of the TSV, TOGS, dump tank, and associated piping that constitutes the PSB.

The integrity of the PSB is maintained. The potential damage is limited plastic deformation of components of the PSB or internal to the PSB. The fission product inventory and associated fission gases are contained within the PSB, thereby resulting in no consequences to the workers or the public.

Safety Controls The following safety-related SSCs have been designed to prevent damage to the PSB in the event of hydrogen detonation or deflagration:

  • The integrity of the PSB which has been designed to withstand credible hydrogen detonation or deflagration events (SR).
  • TRPS trip on high hydrogen concentrations in the PSB (SR).

SHINE Medical Technologies 13a2-56 Rev. 1

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis 13a2.2.10 UNINTENDED EXOTHERMIC CHEMICAL REACTIONS OTHER THAN DETONATION As discussed in Subsection 13a2.1.10, because there is no potential for an unintended exothermic chemical reaction within the IF, there are no consequences to address. The potential for a hydrogen detonation is addressed in Subsection 13a2.1.9. Thus, there are no consequences to the workers or the public.

Safety Controls Because there is no potential for an unintended exothermic chemical reaction within the IF, there are no required safety controls to prevent or mitigate the event.

The following control prevents or mitigates the effects of an unintended exothermic chemical reaction other than detonation:

  • Control of chemical inventory in the IF (DID).

13a2.2.11 PRIMARY SYSTEM BOUNDARY SYSTEM INTERACTION EVENTS As discussed in Subsection 13a2.1.11, no releases are expected to occur as a result of PSB interaction events. Thus, there are no consequences to workers or the public.

Safety Controls The following features safety-related SSCs and Technical Specifications prevent or mitigate the effects of PSB interaction events:

  • TSV dump tank valves (SR).
  • UPSS (SR).
  • Emergency exit lighting (DID).
  • TOGS blower (SR).
  • TOGS recombiner beds (SR).
  • PVVS blower (SR).
  • Light water pool (SR).
  • IU cell integrity (SR and fire rated).
  • TOGS cell integrity (SR and fire rated).
  • IF wall (SR and fire rated).
  • NGRS backflow protection (SR).
  • Target solution uranium enrichment (Technical Specifications).
  • Target solution uranium concentration (Technical Specifications).

13a2.2.12 FACILITY-SPECIFIC EVENTS 13a2.2.12.1 Inadvertent Exposure to Neutrons from the Neutron Driver IU cell biological shielding and neutron driver/access door interlock prevent inadvertent exposure to neutrons (see Subsection 13a2.1.12.1). Thus, there are no consequences to workers or the public.

SHINE Medical Technologies 13a2-57 Rev. 1

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis Safety Controls The following features safety-related SSCs and Technical Specification administrative controls prevent an inadvertent exposure to neutrons from the accelerator:

  • IU cell walls and shield plug, biological shield (SR).
  • Light water pool (SR).
  • Neutron driver personnel access door interlock (SR).
  • Lockout/tagout procedures (DID).
  • Administrative controls on crane operation (DID).
  • Neutron driver cutoff switches and audible/visible warning signals (DID).
  • Use of accelerator audible/visual warnings (TS Administrative Control).
  • Accelerator key switch to prevent the activation of the accelerator while personnel are present (SR).
  • Accelerator local kill switch (SR).
  • Accelerator manual shut-off switch (SR).

13a2.2.12.2 Irradiation Facility Fire Event Analysis of the IF fire contained in Subsection 13a2.1.12.2 identified four initiating events:

  • A malfunction of equipment that results in the ignition of a fire.
  • Loss of combustible and ignition control.
  • The spread of a fire from outside of the IF.

The effects of the fires resulting from these IEs are considered to be contained within the IF, with no impact other than fire damage internal to the IF. Fires within the cells of the IF are contained within their respective cells. The FFPS detects fires within the IF and initiates isolation of the fire area. Combustible loading within the IF areas containing radiological materials is limited to reduce the consequences of a fire. Detonation and deflagration within the PSB are addressed in Subsection 13a2.2.9.

Safety Controls The following engineering safety-related SSCs and Technical Specification administrative controls have been designed to prevent or mitigate the effects of fire within the IF:

  • TPS robust design (SR).
  • TPS pressure confinement boundary (DID) (SR).
  • Limited combustible loading within the IU cells, the TOGS shielded cells, and the TPS room (DID) (TS Administrative Control).
  • Limited tritium inventory based on TPS fixed glovebox volume (SR) (TS Administrative Control).
  • Inerted atmosphere of the TPS gloveboxes (DID).
  • FFPS detection of fires within the IF and initiation of isolation functions (DID).
  • IF boundary (FA-2) and components (e.g., doors, penetration seals, dampers)

(Fire-rated).

  • Deuterium source vessel integrity program (TS Administrative Control).

SHINE Medical Technologies 13a2-58 Rev. 1

[Security-Related Information - Withhold Under 10 CFR 2.390]

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis Therefore, there is no need to further analyze consequences of fires within the IF.

13a2.2.12.3 Tritium Purification System (TPS) Design Basis Accident This section contains the follow-on evaluation for the loss of TPS integrity (e.g., a break of the TPS piping that releases the entire tritium inventory of the neutron drivers [ Security-Related Information ].

13a2.2.12.3.1 Initiating Event In this scenario, a malfunction or external event occurs that releases the tritium from eight neutron drivers.

13a2.2.12.3.2 Sequence of Events The sequence of events for the postulated scenario is as follows:

a) A release of the tritium in the neutron driver system directly to the irradiation unit cell.

b) A high radiation signal (e.g., loss of vacuum in TPS piping) or other actuation signal activates the bubble-tight isolation dampers after approximately one percent of the material is released to the RVZ1, and actuates isolation of tritium supply and return piping.

c) The airborne activity is filtered prior to being released to the environment through the RVZ1 system until the bubble-tight dampers are closed.

d) Ten percent of the airborne activity is released into the RCA through penetrations in the IU cell.

ed) Alarms are available locally or in the control room to notify facility personnel of radiation leakage due to loss of TPS integrity.

fe) Facility personnel evacuate the immediate area upon actuation of the radiation area monitor alarms.

13a2.2.12.3.3 Damage to Equipment The postulated scenario is initiated from damage or degradation to the tritium piping on the neutron drivers. The effects of the piping damage are contained within the IU cell.

13a2.2.12.3.4 Quantitative Evaluation of Accident Evolution The airborne release fraction for tritium in the TPS is 1.0. Once the tritium has been released to the IU cell it becomes mixed with the atmosphere inside the cell.

The RVZ1 exhaust is equipped with HEPA and charcoal filters with assumed efficiencies of 99 percent for particulates and 95 percent for halogens, respectively, although not credited for any tritium removal. The isolation dampers are of a fail-safe design, and close on high radiation or other actuation signal within the IU shielded cell or on a loss of power. The total release to RVZ1 through the bubble-tight isolation dampers during the accident is assumed to be no more than one (1) percent of the airborne activity in the IU cell based on design characteristics of the dampers and the response of the actuating system.

SHINE Medical Technologies 13a2-59 Rev. 1

[Security-Related Information - Withhold Under 10 CFR 2.390]

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis Each IU cell is constructed of reinforced concrete walls and ceiling thick enough to contain the released material, provide shielding, and isolate the effects of the rupture or leakage from the other areas of the IF. Due to the decay mode and energy of tritium, the released tritium that stays within the IU cell does not affect workers outside the IU cell. The total release to the RCA through the IU cell penetrations during the accident is assumed to be no more than 10 percent of the inventory available for release. While the confinement features of the IU cell would significantly reduce dose to workers, no reduction due to confinement features was assumed in this analysis.

13a2.2.12.3.5 Radiation Source Term Analysis The source term for this scenario is the tritium inventory of the eight neutron drivers,

[ Security-Related Information ] grams.

13a2.2.12.3.6 Radiological Consequence Analysis The only postulated credible release from the TPS is a break in the tritium piping on the neutron driver. Dose consequence analysis has been performed for a [ Security-Related Information ] g release of tritium. The resulting TEDE for workers is 2.54 rem. The TEDE to a member of the public for this event is 0.06 5.6E-04 rem at the site boundary. The resulting off-site doses are within the 0.1 rem TEDE regulatory limit specified in 10 CFR 20.1301, and on-site doses are within the 5 rem TEDE regulatory limit specified in 10 CFR 20.1201.

13a2.2.12.3.7 Safety Controls Safety-related SSCs and Technical Specification administrative controls to prevent or mitigate a TPS malfunction include:

  • Robust TPS construction and confinement provided by the glovebox and double-wall pipe (SR).
  • TPS confinement system (relief valves or rupture discs, monitoring instrumentation, isolation valves) (SR).
  • Fire detection and suppression (DID).
  • Engineered transport enclosures or containers (SR) (TS Administrative Control).
  • RVZ1, isolation bubble-tight dampers (SR).
  • RAMs, high radiation signal (SR).
  • Administrative controls for TPS system and confinement sampling, inspection, testing and operating procedures (TS Administrative Control).

SHINE Medical Technologies 13a2-60 Rev. 1

Chapter 13 - Accident Analysis Summary and Conclusions 13a3

SUMMARY

AND CONCLUSIONS This section presents the summary and conclusions for the accident analysis for the IF.

The following accident categories were addressed for the irradiation facility:

  • Maximum hypothetical accident (MHA).
  • Excess reactivity insertion.
  • Reduction in cooling events.
  • Mishandling or malfunction of target solution.
  • Loss of off-site power.
  • External events.
  • Mishandling or malfunction of equipment affecting the PSB.
  • Large undamped power oscillations.
  • Detonation or deflagration in the PSB.
  • Unintended exothermic chemical reactions other than detonation.
  • PSB system interaction events.
  • Facility-specific events.

For the consequences of the bounding accident scenarios evaluated for each category, see Table 13a3-1. The consequences of the evaluated bounding accident scenarios are below the limits in 10 CFR 20.

The safety controls for the IF are provided in Table 13a3-2.

SHINE Medical Technologies 13a3-1 Rev. 1

Chapter 13 - Accident Analysis Summary and Conclusions Table 13a3-1 Potential Consequences of Postulated Accidents in the Irradiation Facility Dose Consequences (rem TEDE)

General Public Accident Category (Limit = 0.1 rem) Worker (Bounding Scenario) Site Boundary Nearest Resident (Limit = 5.0 rem)

Postulated Maximum Hypothetical Accident 1.65E-02 2.30E-03 3.06E+00 (Target solution release into the IU cell)

Excess Reactivity Insertion (No consequences)

Reduction in Cooling (No consequences)

Mishandling or Malfunction of Target Solution 2.19E-03 3.06E-04 1.50 (Dump tank leak into an IU cell)

Loss of Off-Site Power (LOOP) (No consequences)

External Events (No consequences)

Mishandling or Malfunction of Equipment Affecting the PSB 1.59E-02 2.23E-03 1.87 Large Undamped Power Oscillations (No consequences)

Detonation and Deflagration in PSB (No consequences)

Unintended Exothermic Chemical Reactions other than (No consequences)

Detonation Primary System Boundary System Interaction Events (No consequences)

Facility-Specific Events (1) Inadvertent Exposure to Neutrons from the Neutron Driver (No consequences)

(2) Irradiation Facility Fire Event (3) Tritium Purification System DBA 5.6E-024 8.0E-035 2.4 SHINE Medical Technologies 13a3-2 Rev. 1

Chapter 13 - Accident Analysis Summary and Conclusions Table 13a3-2 Irradiation Operations Safety Controls and Accident Applicability (Sheet 1 of 3)

Accident Scenario MHA(a) Reactivity(b) Cooling(c) Target(d) LOOP(e) External(f) Equipment(g) Power(h) Detonation (i) Chemical (j) Neutrons (l)

PSB(k) Fire(m) TPS(n)

Classification TRPS Trip on High Hydrogen Safety-Related N/A X X Concentration High Range Safety-Related N/A X X High Flux Trip Source Range Safety-Related N/A X X High Flux Trip TOGS Recombiner Safety-Related N/A X Beds PVVS Blower Safety-Related N/A X X IF Wall Safety-Related N/A X Boundary TRPS Trip on Low PCLS Safety-Related N/A X Temperature NGRS Backflow Safety-Related N/A X Protection Technical Uranium Specification N/A X X Enrichment Parameter Technical Uranium Specification N/A X X Concentration Parameter PCLS Loss of Safety-Related N/A X Flow Trip PCLS High Temperature Safety-Related N/A X Trip TOGS Blower Safety-Related N/A X X NDAS Interlock with TSV Safety-Related N/A X Startup Mode Manual Trip Safety-Related N/A X SHINE Medical Technologies 13a3-3 Rev. 1

Chapter 13 - Accident Analysis Summary and Conclusions Table 13a3-2 Irradiation Operations Safety Controls and Accident Applicability (Sheet 2 of 3)

Accident Scenario Reactivity(b) Cooling(c) Target(d) LOOP(e) External(f) Equipment (g) Power(h) Detonation (i) Chemical (j) Neutrons (l)

MHA(a) PSB(k) Fire(m) TPS(n)

Classification Criticality-Safe Safety-Related N/A X Dump Tank Dump Tank Safety-Related N/A X Elevation Fill System Safety-Related N/A X Design TSV Dump Safety-Related N/A X X Tank Valves TPS Robust Safety-Related N/A X X Design TSV Robust Safety-Related N/A X X Design TOGS Robust Design/ Safety-Related N/A X X X X Reliability Robust Design of Dump Tank, Safety-Related N/A X X X Piping, and Valves TPS Tritium Safety-Related N/A X Inventory Light Water Safety-Related N/A X X X Pool IU Cell Integrity Safety-Related N/A X X X RVZ1 Bubble-tight Dampers, Safety-Related N/A X X X Exhaust Filters, and Ductwork RAMS High Radiation Safety-Related N/A X X X Signal ESFAS Safety-Related N/A X X UPSS Safety-Related N/A X X SHINE Medical Technologies 13a3-4 Rev. 1

Chapter 13 - Accident Analysis Summary and Conclusions Table 13a3-2 Irradiation Operations Safety Controls and Accident Applicability (Sheet 3 of 3)

Accident Scenario Reactivity(b) Cooling(c) Target(d) LOOP(e) External(f) Equipment (g) Power(h) Detonation (i) Chemical (j) Neutrons (l)

MHA(a) PSB(k) Fire(m) TPS(n)

Classification Seismic Category 1 Safety-Related N/A X SSCs Technical TSV Thermal Specification N/A X Power Limit Parameter Technical Target Solution Specification N/A X Properties Parameter NDAS Door Safety-Related N/A X Interlock TOGS Shielded Cell Safety-Related N/A X X Integrity TPS Confinement Safety-Related N/A X System Tritium Transport Safety-Related N/A X Containers (a) Maximum Hypothetical Accident (Subsections 13a2.1.1 and 13a2.2.1)

(b) Insertion of Excess Reactivity/ Inadvertent Criticality (Subsections 13a2.1.2 and 13a2.2.2)

(c) Reduction of Cooling (Subsections 13a2.1.3 and 13a2.2.3)

(d) Mishandling or Malfunction of Target Solution (Subsections 13a2.1.4 and 13a2.2.4)

(e) Loss of Off-Site Power (Subsections 13a2.1.5 and 13a2.2.5)

(f) External Events (Subsections 13a2.1.6 and 13a2.2.6)

(g) Mishandling or Malfunction of Equipment Affecting the PSB (Subsections 13a2.1.7 and 13a2.2.7)

(h) Large Undamped Power Oscillations (Subsections 13a2.1.8 and 13a2.2.8)

(i) Detonation and Deflagration in Primary System Boundary (Subsections 13a2.1.9 and 13a2.2.9)

(j) Unintended Exothermic Chemical Reaction Other Than Detonation (Subsections 13a2.1.10 and 13a2.2.10)

(k) Primary System Boundary System Interaction Events (Subsections 13a2.1.11 and 13a2.2.11)

(l) Inadvertent Exposure to Neutrons from the Neutron Driver (Subsections 13a2.1.12.1 and 13a2.2.12.1)

(m) Irradiation Facility Fires (Subsections 13a2.1.12.2 and 13a2.2.12.2)

(n) Tritium Purification System Design Basis Accident (Subsections 13a2.1.12.3 and 13a2.2.12.3)

SHINE Medical Technologies 13a3-5 Rev. 1

Radioisotope Production Facility Accident Chapter 13 - Accident Analysis Analysis Methodology 13b.1.2 ACCIDENT INITIATING EVENTS The purpose of this section is to identify the postulated IEs and credible accidents that form the design basis for the RPF. The DBAs identified in Section 13b.2.1 range from anticipated events, such as a malfunction of equipment, to a postulated MHA that exceeds the radiological consequences of any accident considered to be credible. The MHA is intended to establish bounding consequences and need not be credible.

The bases for the identification of DBAs and their IEs and associated accident scenarios were:

  • HAZOPS and PHA within the ISA Summary in accordance with NUREG-1520.
  • Experience of the hazard analysis team.
  • Current preliminary design for the processes and facility.

The DBAs that have been identified for potential significant radiological consequences in the RPF include the following:

  • MHA
  • External Events
  • Critical Equipment Malfunction
  • Inadvertent Criticality in RPF
  • Chemical Accidents These DBAs encompass LOOP and operator errors. Qualitative evaluations were performed on the above DBAs to further identify the bounding or limiting accidents and scenarios that could result in the highest potential consequences. These evaluations are based on review of identification of causes, the initial conditions, and assumptions for each accident.

SHINE Medical Technologies 13b-3 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences 13b.2.3 EXTERNAL EVENTS The following potential external events have been identified as DBAs for the SHINE facility:

  • Seismic event affecting the IF and RPF (see Section 3.4).
  • Tornado or high-winds affecting the IF and RPF (see Section 3.2).
  • Small aircraft crash into the IF or RPF (see Subsection 3.4.5).

Plant SSCs, including their foundations and supports, that are designed to remain functional in the event of a design basis earthquake (DBEQ) are designated as Seismic Category I, as indicated in Table 3.5-1. SSCs designated SR or IROFS are classified as Seismic Category I.

SSCs whose failure as a result of a DBEQ could impact an SSC designated as SR or IROFS are classified as Seismic Category I. SSCs that must maintain structural integrity post-DBEQ, but are not required to remain functional are Seismic Category II.

Seismic Category I SSCs are analyzed under the loading conditions of the DBEQ and consider margins of safety appropriate for that earthquake. The margin of safety provided for safety class SSCs for the DBEQ are sufficient to ensure that their design functions are not jeopardized. For further details of seismic design criteria refer to Section 3.4.

The SHINE production facility building is designed to survive credible wind and tornado loads, including missiles, as described in Section 3.2 and Subsection 3.4.2.6. It is also designed to withstand credible aircraft impacts as discussed in Subsection 3.4.5.

The facility is designed to withstand credible external events as described in 13a2.1.6. Thus, there are no consequences to the workers or the public from external events.

Safety Controls The essential systems that are required to function during an external event are the Seismic Category I SSCs (SR).

SHINE Medical Technologies 13b-13 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences Some of these materials are stored for specific minimum periods of time to allow for decay of short-lived isotopes, either in one of the hot cells or in the waste storage area.

  • The RVZ1, RVZ2, and RVZ3 systems are normally operated in an automatic mode to maintain a negative pressure in the RPF with respect to the environment outside of the SHINE facility. Automatic isolation of the system occurs on either a loss of off-site power or on indication of a high radiation condition.
  • Noble gases are received from the TOGS and stored in a bank of five noble gas storage tanks that are filled on a staggered basis. The noble gas storage tanks have enough capacity to store the generated noble gases for at least 40 days.
  • NGRS noble gas storage tanks and associated equipment are located within a shielded cell with isolation and confinement capability.

The eight IUs are in operation for at least as long as required to fill the five noble gas storage tanks. The NGRS contains the TOGS contents for at least 40 days before they are discharged to RVZ1 and then, ultimately, to the stack.

13b.2.4.2 Identification of Causes Most processes covered by this evaluation are performed manually by RPF technicians. The manual nature of these operations makes human error a likely initiator for an event. Another potential cause is failure of the laboratory glassware used in the purification portion of the supercells. The glassware is replaced after every batch, but may possess a manufacturing flaw or sustain undetected damage during handling.

There are several process steps involved in the extraction of the molybdenum product and recycling of the target solution, which are performed in the RPF. A critical equipment malfunction due to human error or other failure in the RPF systems could result in a local liquid spill or release of stored fission product gases. For liquid spills, a vapor release would also be expected, especially for process streams with elevated temperatures. Processes in the RPF were reviewed for the potential of an error or failure that results in a radiological event. The following is a summary of that review:

Spills Inside of a Hot Cell Liquid or vapor releases from process equipment or piping inside a supercell, UREX hot cell, thermal denitration hot cell, or one of the waste treatment hot cells would be contained by the physical design of these enclosures, and their drainage and ventilation systems. These releases could be caused by equipment failures and human errors such as valve or pump leaks/misalignments, contactor failures in UREX, column failures in MEPS, and corrosion.

Workers would be shielded from any direct gamma radiation by the hot cell biological shielding design. A spill of target solution in any of these cells would be directed to a drain or sump with a geometry that is criticality-safe. The area ventilation system would be shut down and isolated by bubble-tight dampers upon detection of excessive radiation to prevent release outside of the facility.

Radiological consequences to workers, the public, or the environment could result from a spill in one of the hot cells through the release of airborne radioactive material into the ventilation system (prior to the bubble-tight dampers isolating the cell) or penetrations into other portions of the RCA. Radiological spills within the hot cells are mitigated by facility and hot cell controls SHINE Medical Technologies 13b-16 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences 13b.2.4.8 Safety Controls There are several safety controls that prevent or provide mitigation for the consequences of an inadvertent release from the NGRS and the other identified critical equipment malfunction scenarios. The following facility systems and components are identified as safety controls:

  • Radiation area monitoring system (RAMS) (SR)
  • Production facility biological shield (PFBS) system (including noble gas storage cell, hot cells, tank vaults, and pipe trenches) (SR)
  • Noble gas removal system (NGRS) (SR)
  • RVZ1 (including bubble-tight dampers for the noble gas storage cell and hot cells) and RVZ2 (SR)
  • Radiological integrated control system (RICS) (SR)
  • MEPS column pressure monitor (SR)
  • Moisture-Leak Detection/Instrumentation and Alarm for tank overflow into PVVS (SR)
  • Procurement and use of waste containers program (TS Administrative Control)
  • Reverse flow indication and alarm for MEPS hot cell (SR)
  • Criticality Safe Geometry Overflow- Part of Radioactive Drain System (SR)
  • Raffinate hold tank level detection (SR)
  • Piping and tank integrity (SR)

The RAMS are designed to alert both the control room operators and the facility staff in the RCA of abnormal radiation levels within the facility. The sensitivity of these radiation monitors will be set such that they will not alarm spuriously due to normal process variations but will be sensitive enough to alarm upon detection of upset conditions. The radiation monitoring components are relied upon to reduce the off-site dose consequences and to alert the facility staff. The RAMS is classified as a safety-related system.

The PFBS also mitigates the consequences of the postulated scenarios by providing a robust and passive barrier for retention of radioactive materials and providing shielding for facility workers. The PFBS is classified as an IROFS a safety-related system.

The NGRS collects TOGS purge gases in storage tanks to allow for decay of noble gases released from the target solution during the irradiation cycle. The radiation level in the decayed gases is verified to be within acceptable criteria prior to release. The NGRS is classified as an IROFS a safety-related system.

RVZ1 and RVZ2 provide confinement capabilities and filtration of halogens and particulates that may be released during postulated normal, abnormal, and accident conditions. The bubble-tight dampers isolate cells and ventilation zones when corresponding high radiation levels are detected. The bubble-tight isolation dampers reduce the off-site dose consequences for the postulated scenario. RVZ1 and RVZ2 are classified as safety-related and IROFS systems, respectively.

RICS monitors IROFS parameters within the RPF and initiates the isolation functions necessary to achieve confinement, including closure of the bubble-tight dampers. The RICS is relied upon to reduce the off-site dose consequences and to alert the facility staff. RICS is classified as an IROFS a safety-related system.

SHINE Medical Technologies 13b-21 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences The MEPS column pressure monitor detects pressure increases from the positive displacement pump transferring solution from the TSV dump tank to prevent a spill.

The moisture-leak detection/instrumentation and alarm detects process tank overflows into the vent system which could allow a release pathway for fission products in a system designed for handling tank vapors.

The procurement and use of waste containers program ensures confinement for radioactive waste in the event of mishandling or other accidents.

Hydrogen monitors in the NGRS alert the operator to excessive hydrogen concentrations in this system so actions can be taken to prevent a hydrogen deflagration or detonation, preventing an inadvertent release from NGRS.

The reverse flow indication and alarm for the MEPS hot cell alerts the operator to unanticipated transfer of target solution into the MEPS, resulting in a spill inside the hot cell. The alarm will allow the operator to secure the transfer and mitigate the spill.

The criticality-safe geometry overflow equipment (part of radioactive drain system) directs tank contents to the criticality-safe sump in the case of an inadvertent tank overflow to prevent excess liquid into inappropriate areas or systems like PVVS.

Raffinate hold tank level instrumentation prevents or mitigates a raffinate spill by alerting the operator of an overflow from the raffinate hold tank, preventing the transfer of fissile material to an unsafe geometry tank downstream.

A tank or piping failure is an initiating event to cause a release, but is unlikely due to the robust nature of tanks and piping containing radioactive materials.

SHINE Medical Technologies 13b-22 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences 13b.2.5 INADVERTENT NUCLEAR CRITICALITY IN THE RADIOISOTOPE PRODUCTION FACILITY An accidental criticality is highly unlikely because the SHINE facility has been designed with passive engineering design features to prevent criticality, including the use of neutron absorbers, such as borated plastic. Additionally administrative controls and IROFS SR SSCs provide control on enrichments and target solution uranium concentration to further prevent inadvertent criticality.

Therefore this subsection identifies areas within the RPF where an inadvertent criticality is possible, and discusses controls that are used to reduce the likelihood of an inadvertent criticality, and discusses the potential consequences of a highly unlikely inadvertent criticality event. This section only considers processes in the RPF that involve SNM.

13b.2.5.1 Initial Conditions and Assumptions Processing, handling, and storage of SNM take place in many areas of the RPF. A brief description of each area is provided along with the general criticality-safety control strategy.

  • Process 1 - Receipt of Uranium Metal and Dissolution in Nitric Acid.

Uranium metal is received into the plant and stored in criticality-safe storage containers in racks. Uranium metal is handled in criticality-safe storage containers and transferred to a criticality-safe vessel, where it is dissolved in nitric acid to produce uranyl nitrate. The uranyl nitrate is further processed through the criticality-safe thermal denitrator to yield uranium oxide. The uranium oxide is transferred to a criticality-safe container and stored in criticality-safe storage racks. Criticality control in this area is provided by passive engineering design features and administrative controls that are defined in the criticality-safety program (see Section 6b.3).

  • Process 2 - Dissolving Uranium Oxide in Sulfuric Acid.

Containers of uranium oxide are transferred into a criticality-safe dissolution vessel (which includes neutron absorbers) and subsequently dissolved in sulfuric acid to create uranyl sulfate. Criticality control in this area is provided by passive engineering design features (including neutron absorbers) and administrative controls.

  • Process 3 - Transfer of Solution to the Target Solution Vessel within the IF.

Solution is transferred to the TSV for subsequent irradiation through criticality-safe transfer piping. Upon transfer into the IF, the solution has left the RPF and is no longer covered by this discussion.

  • Process 4 - Transfer of Irradiated Solution Back to the RPF (Mo-99).

The solution is transferred back to the RPF via criticality-safe piping and enters a number of different processing areas. These processing areas involve criticality-safe geometry (including neutron absorbers) for processing and storage, and are within radiation shielded areas of the facility. Criticality control in these areas is provided by passive engineering design features and administrative controls.

SHINE Medical Technologies 13b-24 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences

  • Process 5 - Processing of Irradiated Solution via UREX Process.

After repeated cycles in the TSV, the irradiated solution is treated in a process known as UREX. There are two outputs from this process: clean uranyl nitrate solution and raffinate (fission and activation products including trace amounts of plutonium removed from the irradiated solution). The equipment used in the UREX process is shown to be geometrically-safe with respect to criticality-safety and is contained in radiation shielded areas of the facility. Criticality control in this area is provided by passive engineering design features and administrative controls.

The main concern for criticality-safety in this process is the transfer of the raffinate to large-capacity vessels that are not geometrically-safe with respect to criticality. Prior to transfer from the post-UREX criticality-safe geometry vessels to vessels that do not have criticality-safe geometry in the waste processing storage area, the raffinate is sampled to ensure that the uranium concentration is below the discharge limit. If an unacceptable concentration of uranium is measured, the transfer between the tanks does not occur.

Criticality control in this area is provided by passive engineering design features and administrative controls.

  • Process 6 - Conversion of Uranyl Nitrate to Uranium Oxide.

The final step in the process is the conversion of uranyl nitrate back to uranium oxide.

This conversion process occurs in criticality-safe geometry vessels. In the final step, the uranium oxide material is transferred into a criticality-safe geometry container and stored in a criticality-safe storage rack. The uranium oxide containers are then used as feed material in the creation of uranyl sulfate (Process 2 above). Criticality control in this area is provided by passive engineering design features and administrative controls.

13b.2.5.2 Identification of Causes Credible scenarios that could lead to an accidental criticality within the RPF have been identified and engineered controls and design features have been included in the facility design to prevent such an event. Furthermore, the IROFS SR SSCs necessary to demonstrate that each credible scenario is highly unlikely have been identified.

There are three four distinct types of criticality scenarios postulated:

  • Scenario 1 - Accumulation of metal or oxide fissile material outside of a radiation shielded area of the facility, resulting in an inadvertent criticality.
  • Scenario 2 - Accumulation of irradiated solution within a radiation shielded area of the facility, resulting in an inadvertent criticality.
  • Scenario 3 - Accumulation of un-irradiated solution outside of a radiation shielded area of the facility, resulting in an inadvertent criticality.
  • Scenario 4 - Accumulation of metal or oxide fissile material within a radiation shielded area of the facility, resulting in an inadvertent criticality.

Each of the above scenarios are developed further to show how these scenarios may evolve to cause an inadvertent criticality accident.

SHINE Medical Technologies 13b-25 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences

  • Scenario 1 - The accumulation of metal or oxide material within the RPF outside of a radiation shielded area caused by a spill or other physical upset condition. Since the metal and oxide powder do not contain radioactive fission products, either can be safely handled without any significant radiation shielding material. Containers of uranium metal and oxide powder are handled routinely when transferred from storage racks to processing equipment and multiple containers could be spilled or accumulate into a configuration such that a critical geometry is achieved given the proper moderation conditions. This scenario would require multiple administrative control failures as well as the introduction of uncontrolled moderating material into the area.
  • Scenario 2 - The accumulation of irradiated solution within a radiation shielded area caused by a spill or other physical upset. The processing and transfer of irradiated fissile material is accomplished within criticality-safe geometry vessels. In the unlikely event of a leak or spill, material is collected in a criticality-safe geometry sump and transferred to another criticality-safe geometry storage vessel. Should these systems fail to divert spilled material to the proper storage vessel, an accumulation of fissile solution in an unsafe geometry could occur. This scenario would require the failure of multiple passive engineered design features as well as the failure of administrative controls.
  • Scenario 3 - The accumulation of un-irradiated solution outside of a radiation shielded area caused by a spill or other physical upset. The processing and transfer of un-irradiated fissile material is accomplished within criticality-safe geometry vessels. In the unlikely event of a leak or spill, material is collected in a criticality-safe geometry sump and transferred to another criticality-safe geometry storage vessel. Should these systems fail to divert spilled material to the proper storage vessel, an accumulation of fissile solution in an unsafe geometry could occur. This scenario would require the failure of multiple passive engineered design features as well as the failure of administrative controls.
  • Scenario 4 - The accumulation of metal or oxide material within the RPF within a radiation shielded area could be caused by the incomplete dissolution of solid material in a process tank, and carry-over of this material further into the process system. This scenario would require the failure of multiple passive engineered design features as well as the failure of administrative controls.

Specific examples of events associated with the scenarios listed above are:

  • Transfer of target solution between the RPF and IF.

Leaks in the piping resulting in target solution collecting in the sump and/or trenches that could lead to a criticality unsafe accumulation of fissile material. Changes in piping design or valve alignment that may result in misdirection to a tank that is not designed to be criticality-safe. Both scenarios may lead to an inadvertent criticality.

Leaks in the piping or extraction process resulting in target solution collecting in the sump, trenches and/or drains that could lead to a criticality-unsafe accumulation of fissile material. Changes in piping design or valve alignment that may result in misdirection to a SHINE Medical Technologies 13b-26 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences tank that is not designed to be criticality-safe. Both scenarios may lead to an inadvertent criticality. Cell waste and shipping containers will have criticality-safe containers.

  • Target solution clean-up via UREX process, uranium storage, and transfer.

Leaks in the piping or UREX process resulting in target solution collecting in the sump, trenches and/or drains that could lead to criticality-unsafe accumulation of fissile material.

Changes to spacing of uranium oxide containers in the uranium container storage racks that may result in a criticality-unsafe condition. Not following procedures and use of container transfer carts when transferring uranium oxide containers to the target solution preparation area. These scenarios may lead to an inadvertent criticality.

  • Fission product waste stream.

Improper monitoring of the raffinate for unacceptable amounts of uranium prior to transfer of the raffinate to criticality unsafe vessels in the waste processing storage area. Failure to hold transfer of raffinate until the unacceptable amount of uranium is removed.

Transfer of waste with an unacceptable amount of uranium to criticality unsafe geometry vessels in the waste storage area may result in an inadvertent criticality.

Improper residence time or acid concentration in the uranium metal dissolution tank (1-TSPS-02T) or the uranyl sulfate preparation tank (1-TSPS-01T) could lead to carry-over of this material further into the process system. This scenario is prevented by the presence of filters downstream of these tanks. A differential pressure monitor is also installed at each filter to alert personnel of a build-up of uranium metal particles or other fissile particles on the filter.

13b.2.5.3 Sequence of Events An inadvertent criticality in the RPF is not credible as it is prevented by the facility design using multiple passive safety-related engineered design features SSCs and administrative controls in the RPF. The SHINE definition for Safety-related SSCs, described in PSAR Section 3.5.1.1.1, assures that required SSCs remain functional during normal conditions and during and following design basis events such that the potential for an inadvertent criticality accident is not credible.

Therefore, a radiological consequence analysis for a criticality accident was not performed.

Failure of these SSCs may lead to an inadvertent criticality event, resulting in a dose to personnel in the vicinity of the criticality event.

13b.2.5.4 Damage to Equipment An inadvertent criticality releases energy in the form of radiation. No equipment involved in the detection of an inadvertent criticality would be damaged; therefore, the event would be detected as required and evacuation alarms would be sounded. No other equipment damage is expected from an inadvertent criticality event in the RPF.

SHINE Medical Technologies 13b-27 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences 13b.2.5.5 Quantitative Evaluation of Accident Evolution There is the possibility that an inadvertent criticality event could occur within either a shielded area of the facility or an un-shielded area of the facility. It could also occur with different fissile material forms: metal, powder, or solution.

The dose from an unshielded criticality event has previously been shown to result in a potentially fatal dose to the worker and no significant consequence to the public (LANL, 2000). It is worthwhile to quantify the potential dose received by a worker who is near an inadvertent criticality event that occurs within a shielded area of the facility. Therefore, the dose consequence due to a worker standing beside or on top of a shielded concrete vault is determined.

The first step in quantifying the potential radiation dose due to an inadvertent criticality within a shielded concrete vault is to define the fissile material involved as well as the potential critical geometry. The most basic critical geometry is a sphere. This allows a criticality to occur with the smallest amount of fissile material.

The next step is to define the fissile material of interest. As described earlier the facility handles, processes, and stores uranium metal, uranium oxide powder, and uranium solution throughout the facility. The specific materials of interest in the facility include: uranium metal, uranium oxide powder, uranyl sulfate, and uranyl nitrate. Fissile material is assumed to be enriched to 21 weight percent U-235. The actual enrichment used is less than 20 weight percent U-235. However, to be conservative, 21 weight percent U-235 is used in the analysis.

Various reflector conditions affect the critical radius of the critical sphere of fissile material. The thickness of the reflector affects the amount of radiation that escapes the critical sphere.

Therefore, three different thicknesses of water reflection are considered: zero water thickness (bare sphere), 1 inch water reflection, and 12 inch water reflection.

A critical radius search was performed for each of the four fissile materials and each of the reflector conditions. The calculations were performed using the 3-D transport Monte Carlo code, MCNP5 v1.4. MCNP is a general-purpose Monte Carlo N-Particle transport code that can be used for neutron, photon, electron, or coupled neutron/photon/electron transport. MCNP was developed by the Los Alamos National Laboratory, Transport Methods Group, to solve a wide variety of transport problems.

Using this critical radius dimension, an additional calculation was performed using MCNP for each combination to determine the percentage of neutrons and photons that escape the critical sphere, the energy spectra of the leaking radiation, and the average number of neutrons produced per fission event. These values are used in the next subsection to determine the radiation source term for both neutrons and photons that are used to determine the final dose outside a shielded concrete vault within the facility.

13b.2.5.6 Radiation Source Term Analysis The previous subsection has determined the fraction of neutrons and photons emitted from a critical sphere of various fissile materials and reflector conditions. Also, the average number of neutrons produced for each fission event was determined. The next step is to determine how SHINE Medical Technologies 13b-28 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences many fission events are expected during the inadvertent criticality event so that the maximum source strength of photons and neutrons produced by the criticality event can be determined.

The duration of a criticality event and the amount of energy released depend in a complex manner on the quantities, physical and chemical form, and concentrations of the fissile material and on the size, configuration, moderation, reflection, and neutron absorption characteristics of the system. The energy generated by the criticality event is directly related to the fission rate.

Worldwide, 20 of the 22 reported criticality accidents occurred in solutions (LANL, 2000).

Although a solid-phase material inadvertent criticality event cannot be ruled out, its likelihood is judged to be well below that for aqueous or solution criticalities. Therefore, the number of fissions produced during an inadvertent criticality event are based on solution criticality excursions.

In general, solution criticality events are characterized by an initial spike followed by a plateau region characterized by a series of smaller spikes of decreasing magnitude. The maximum spike yield that has been observed from a solution criticality event is 2 x 1017 fissions (LANL, 2000).

Each spike typically has a duration on the order of a few seconds. During that time, the fission rate is variable. The spike yield is the total number of fissions that occur during the spike (i.e., the time integral of the fission rate over the spike). The time between spikes is variable and is a complex function of the system.

Twenty-two separate accidental criticalities that occurred in fissile material process operations have been documented (LANL, 2000). Spike yields vary from 3 x 1015 to 2 x 1017 fissions, while total yields vary from 1 x 1015 to 4 x 1019 fissions. It should be noted that the few accidents with estimated total yields greater than 1 x 1018 fissions were events that continued over a long duration of time. Most commonly the system behavior during these excursions was oscillatory, and the total yield corresponded to a number of individual events. It should also be noted there is no criticality accident information for low enriched uranium systems. Accident data are relative to high enriched uranium or plutonium systems.

Although total fissions released during the event will be based on solution criticality events, there are estimates from solid phase systems. Estimates of peak fission rate and total number of fissions for an accidental nuclear criticality in a moderated, reflected solid system may be derived from data from accidents and from experiments with light- and heavy-water-moderated reactors.

Criticality accident data are reported in NRC (1998a), for uranium and plutonium elements of various shapes with water or graphite moderation. Reactor excursion data are also reported in NRC (1998a) for uranium-aluminum and UO2 stainless steel clad fuels. The total number of fissions for the relevant accidental criticalities ranges from 1 x 1015 to 1 x l017fissions while the total number of fissions for reactor excursions is bounded by 5 x 1018 fissions for the reported power levels (NRC, 1998a). Criticality events in moderated, reflected solid systems were characterized by an initial burst with little or no plateau period.

Fission yield has also been estimated for critical experiments (NRC, 1998b). The 24 CRAC experiments covered a limited range of parameters with HEU solutions of volumes from 19 to 134 L, tank diameters of 80 cm (31.52 in.) and 30 cm (11.82 in.), reactivity insertion rates of 0.014 to 0.786 $/s, and densities of 30.6 to 320 grams of U/L. The resulting first pulse fission yields ranged from 3.1 x 1016 to 1.8 x 10 17 fissions.

SHINE Medical Technologies 13b-29 Rev. 1

[Security-Related Information - Withhold Under 10 CFR 2.390]

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences A fission yield cannot be selected for modeling purposes with 100 percent certainty that it will not be exceeded. There are simply too many variables and the problem is so highly situation-dependent that it is impossible to account for all scenarios. With regards to determining the magnitude of the fission yield, NRC (1998a), states:

Thus, the nature and magnitude of possible accidents are assessed individually and conservative analyses are used to evaluate the adequacy of NCS protection systems.

Therefore, it is up to the analyst to choose a fission yield large enough to bound, within reason, an accident that may occur at a site of interest. Based on the previous discussion and the fission yields available from criticality accidents and experiments involving high enriched uranium or plutonium, a total fission yield of 1 x 1018 fissions is chosen to determine the consequences of a criticality event within the shielded concrete vault in the RPF.

Using the total number of fissions produced during the inadvertent criticality event (1 x 1018), the total number of source neutrons and photons escaping the critical sphere can be determined.

The largest neutron source strength was determined to be 9.77 x 1017 resulting from a critical sphere of water-moderated uranium oxide with a moderator to fissile material ratio (H/X) of 200 with no water reflection. The largest photon source strength was determined to be 3.98 x 1018 resulting from a critical sphere of water-moderated uranium metal with an H/X ratio of 700 with 1 inch of water reflection.

13b.2.5.7 Radiological Consequence Analysis With the source magnitude defined for both neutrons and photons escaping the critical sphere, the calculation of the dose outside of a shielded concrete vault within the facility can be determined.

A typical concrete vault was modeled as a room with internal dimensions of 6 feet by 6 feet by 6 feet with walls [ Security-Related Information ]. The room was assumed to be filled with dry air at 1 atm and 32°F.

The surface dose was determined at two locations outside the concrete vault. One location is at the outside surface of the vertical concrete wall. Another location is the outside surface of the vault ceiling.

The dose was determined by calculating three contributors: direct neutron dose, direct photon dose, and indirect photon dose (those photons created by neutron interactions with material causing photons). It is assumed that the ventilation system for the concrete vault handles any fission product gases; therefore, the dose due to fission product gases was not determined.

Total dose calculated at the outer surface of the vertical wall due to an inadvertent criticality inside a concrete vault was 4.60 rem. Total dose calculated at the outer surface of the ceiling due to an inadvertent criticality inside a concrete vault was 4.33 rem. Neither of these values exceed the total worker dose annual limit of 5 rem. Therefore, an inadvertent criticality event inside a shielded concrete vault within the facility is not an event of significant concern.

SHINE Medical Technologies 13b-30 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences 13b.2.5.8 (Will be renumbered to 13b.2.5.4 after deletions accepted) Safety Controls As stated before, the credible accident scenarios that could cause an inadvertent criticality are highly unlikely. This is accomplished by specifying safety controls (IROFS) that reduce the likelihood of such scenarios. A list of safety controls is provided in Table 13b.2.5-1.

SHINE Medical Technologies 13b-31 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences Table 13b.2.5-1 Safety-Related SSCs and Technical Specification Administrative Controls (IROFS) to Prevent and Mitigate Criticality Accidents (Sheet 1 of 2)

Functional (c) (a) (b)

Control Function Qualification Requirement Metal or Oxide Criticality Outside Shielded Cells Criticality-safe P PEC Safe geometry containers and/or volume Fixed spacing P PEC Safe geometry racks /spacing Handling P AC Separate fissile controls material containers; operator training Solution Criticality Outside Shielded Cells Criticality-safe P PEC Safe geometry vessels /spacing Criticality-safe P PEC Safe geometry sumps and/or volume Sump level P AEC Detect high sensors level in sump Sump pumps P PEC Safe geometry and/or volume; AEC Pumps solution from sump upon high level detection Criticality-safe P PEC Safe geometry containers and/or volume Handling P AC Separate fissile controls material containers; operator training Solution Criticality Inside Shielded Cells Criticality-safe P PEC Safe geometry vessels /spacing Criticality-safe P PEC Safe geometry sumps and/or volume Sump level P AEC Detect high sensors level in sump SHINE Medical Technologies 13b-32 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences Table 13b.2.5-1 Safety-Related SSCs and Technical Specification Administrative Controls (IROFS) to Prevent and Mitigate Criticality Accidents (Sheet 2 of 2)

Functional (c) (a) (b)

Control Function Qualification Requirement Sump pumps P PEC Safe geometry and/or volume; AEC Pumps solution from sump upon high level detection Concrete vault M PEC Radiation walls shielding Solution P AC Detect Sampling unacceptable uranium concentration prior to transfer to unsafe geometry Metal or Oxide Criticality Inside Shielded Cells Filters P AC Prevent solid material carry-over Differential P AC Detect solid Pressure material Monitors build-up on filters Solvent Control P AC Ensure Program dissolution is complete prior to transferring solution a) Function: P=Preventive; M=Mitigative b) Qualification: PEC=Passive Engineered Control; AEC=Active Engineered Control; AC=Technical Specification Administrative Control c) SSCs listed are safety-related SHINE Medical Technologies 13b-33 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences 13b.2.6 RADIOISOTOPE PRODUCTION FACILITY FIRE This subsection analyzes the credible accident conditions that could result in a release of radioactive material or hazardous chemicals produced from licensed materials into or outside of the controlled areas of the RPF. This subsection includes development and analysis of fire scenarios that are postulated in the RPF.

The RPF is located in the RCA outside of the IF. The RPF contains processes associated with extraction and purification of the Mo-99 product from irradiated target solution, preparation and recycling of the target solution, and the waste processing. Individual chemical processes are located in hot cells and glove boxes which are connected via piping located in pipe trenches throughout the RPF. Process storage tanks are located in concrete vaults, below grade in the RPF. Batch tanks, supporting various process operations are located within the process hot cell and glove box enclosures.

The equipment and processes in the RPF present a potential for fire. Ignition and fuel sources in this area are primarily small in nature with the greatest hazards located within process enclosures.

The potential exists for the accumulation of hydrogen in a noble gas storage tank because of a failure of the TOGS to recombine the hydrogen produced in the TSV. The deflagration or detonation of the hydrogen in the noble gas storage tank is assumed to cause activity of one noble gas storage tank to be released into the noble gas storage cell. The airborne activity is released to the environment through RVZ1, exposing the public until the bubble tight dampers are isolated after ten percent of the activity is released. In addition to the public exposure, ten percent of the activity is assumed to leak into the RCA through penetrations in the noble gas storage cell, which exposes workers until they exit the RCA. This scenario is the same as the inadvertent release of the contents of the noble gas storage tank into the noble gas storage cell due to a malfunction or mishandling of equipment evaluated in Subsection 13b.2.4. Therefore, this subsection discusses a fire inside a process enclosure such as a hot cell, glove box, or tank vault.

13b.2.6.1 Initial Conditions and Assumptions An RPF fire has been identified as a potential accident-initiating event (IE) by the Final ISG Augmenting NUREG 1537 and the ISA Summary performed for the SHINE facility. Production facility fire-initiating events have the potential to cause damage to IROFS and ESFs SR SSCs located within the RPF. Fires that may damage IROFS or ESFs SR SSCs are evaluated in this section to determine their potential to cause a radioactive release to the environment.

Initial conditions considered for these fires include:

  • Normal RPF operations supporting chemical processing of irradiated target solution within process enclosures,
  • Maintenance activities involving system overhaul or system modification within process enclosures,
  • Normal operations within the RPF, outside of the process enclosures,
  • Maintenance activities performed outside of process enclosures.

Fires postulated in the RPF may result from:

SHINE Medical Technologies 13b-33 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences

  • Equipment malfunction (e.g. electrical equipment or pump fire),
  • Loss of ignition or combustible material control,
  • Fire propagation from areas exterior to the RPF when fire area barriers are breached/open.
  • Exothermic chemical reactions that may lead to a fire.

The following assumptions apply to the fires considered in this section:

  • Small quantities of lubricating or insulating oil are contained in in-situ equipment (less than one gallon [3.8 L]),
  • Tank enclosure and pipe trench shield/access plugs are normally closed; however, they may be removed to support maintenance activities during system outages.
  • Power and control cables for redundant trains of IROFS and/or ESFs SR SSCs are adequately separated to prevent direct fire damage and spread between trains.
  • Procedural controls are in place to administratively limit the admission of transient combustible materials within the RPF to a maximum of 2 lbs/ft2.
  • Electrical cabling exhibits limited combustibility and is self-extinguishing outside the presence of an ignition source.
  • The RCA ventilation system is supplied with fire detection which is interlocked to the RCA ventilation system and isolation dampers to provide isolation when alarmed.
  • Administrative Controls are in place to limit the possibility of unintended incompatible chemicals coming into contact with each other leading to an exothermic chemical reaction.

13b.2.6.2 Identification of Causes Fires occurring in the RPF may be categorized as either a fire in the general area or a fire located inside of a process or system enclosure such as hot cells, glove boxes, tank vaults, and laboratories. The general area outside of these enclosures is open and provides a large volume for deposition of products of combustion. Fires originating inside process or system enclosures may generate a hot-gas-layer (HGL) that is capable of damaging IROFS SSCs or ESFsSR SSCs outside of the immediate area of the fire; this is not likely to occur for fires located in the general area of the RPF.

An additional category involves fires originating outside of the RPF that propagate into the RPF where fire area barriers have been breached for maintenance or similar activities. Administrative control of fire barrier impairments ensures that an additional level of preventative fire protection controls and fire watch personnel are in place to prevent fire spread across compromised barriers. Controls include greater restriction on hot work and constraint of transient combustible storage in the immediate vicinity of any breach. These controls ensure that an IE involving fire spread from outside the RPF is bounded by a fire in the general area of the RPF.

IEs that could generate a fire involve various fire initiators. The capability of these to damage redundant trains of IROFS SSCs and/or ESFsSR SSCs is dependent on their location and potential for fire growth/spread into other combustible materials. Events that could precipitate fire and lead to a fire-related accident are as follows:

  • Electrical Equipment Failure - This event involves an electrical system failure in equipment such as an electrical distribution cabinet, junction box, motor control center, SHINE Medical Technologies 13b-34 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences switchgear, or control cabinet. This IE may be caused by an error during maintenance resulting in a faulted circuit, failure of a fuse or circuit breaker during an overcurrent event, or faulting of a cable due to damaged jacketing.

  • Electric Motor - This event involves failure of a ventilation, hoist, or pump motor. A fire involving an electrical motor involves electrical failure of the motor windings due to a locked rotor condition or bearing failure that ignites collocated secondary combustibles.
  • Pump - This event involves failure of a pump lubrication system such as spillage and ignition of lubricant. This IE involves damage to the pump oilers such that lubricant is spilled to a pump skid. This IE may be caused by breakage of a pump oiler due to operations or maintenance activities in the vicinity of the pump and ignition of pre-heated lubricating oil.
  • Transient Combustible - This event involves a human error that results in ignition of transient combustibles. he transient combustible provides the fuel source for the fire event, coupled with a sufficiently energetic IE such as improperly controlled hot work which results in development of a damaging fire.
  • Exothermic Chemical Reactions - This event involves a human error or other failure that results in mixing chemicals within a hot cell enclosure that when in the presence of each other could lead to an exothermic reaction increasing temperature of the mixture that could increase the severity of a fire or result in a fire or explosion.

13b.2.6.3 Sequence of Events The RPF was reviewed and the design basis fire occurs inside a process enclosure such as a hot cell, glove box, or tank vault. A fire in these locations has the potential to entrain or release radiological materials as a direct result of the fire or damage to important equipment. Fires with the greatest potential for radiological release would involve either the Mo extraction feed tank or the Mo eluate hold tank located in each supercell. These tanks are used for hold up of the target solution prior to being routed to or from the extraction column. These tanks have similar radionuclide inventories. Fire damage that leads to spurious opening of a drain valve or damage to seals could precipitate a release of this material into the supercell. Such a fire may be caused by any of the previously identified IEs. The Mo extraction feed tank is the design basis fire in the RPF.

The potential for a radiological release involving the design basis fire associated with the Mo extraction feed tank is mitigated by several IROFS SR SSCs. The mechanical piping, valves and tank are not directly susceptible to fire damage, thus direct fire damage to these components would not likely lead to a release. Severe fire damage to flange or valve seals could precipitate leaks from the mechanical piping, valves and tank; however, the likelihood of such damage is very low because the low combustible loading of the supercells would prevent development of a severe fire. If a leak were precipitated by a fire it would likely release only small amounts of Mo-99 eluate, thus any radiological release would be bounded by a release of the entire tank.

Also, the chemicals present within this process enclosure cell does not lead to an exothermic reaction causing a fire. Finally the supercell construction and its fire detection and suppression system would limit the effects of any fire occurring within. The supercell is constructed of thick concrete barriers, viewing windows, and access openings. These features are designed to provide radiation shielding however their robust design provides significant fire separation from the general area of the RPF. The hot cell fire detection and suppression system would detect any fire within and close isolation dampers located in the exhaust filter housing, which would limit radiological release through the exhaust stack. The hot cell fire detection and suppression SHINE Medical Technologies 13b-35 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences ensures that fires occurring inside a process enclosure, tank vault, pipe way, or glove box are contained by the construction of the enclosure.

b. Cabling in the RPF is qualified to IEEE 1202 which ensures limited combustibility and limits the potential for fire ignition, growth, and spread. Fire involving this cable does not spread beyond the initiating flame. This design ensures that fires involving electrical cable and fire spread to exposed cables is severely limited.
c. As defined in the fire hazards analysis (FHA), mechanical, electrical and ventilation penetrations into process enclosures are sealed in a manner that the seals provide fire separation equivalent to that provided by the separation barrier.
d. Redundant trains of IROFS SSCs and ESFs SR SSCs are separated by fire barriers.
e. Combustible loading inside RPF and process enclosures, tank vaults, pipe trenches, or glove boxes is maintained at an average of less than 2 pounds per square foot.
f. Automatic or manual fire suppression is provided for vaults and hot cells.
g. Ventilation system isolation is provided by bubble-tight dampers. These dampers are interlocked to process enclosure fire detection systems to ensure system shut down and isolation for detected fires. This design ensures the ability to prevent passage of potentially contaminated products of combustion to the environment. The airborne activity is filtered and released to the environment through the HVAC system prior to isolation of the bubble-tight dampers allowing ten percent of the airborne activity to exit the facility.

The HEPA filter is assumed to have an efficiency of 99 percent for particulates and the charcoal filter is assumed to have an efficiency of 95 percent for halogens.

h. Administrative Controls are in place to prevent unintended chemicals from coming into contact with each other that may lead to an exothermic chemical reaction.
i. Ten percent of the released activity exposes workers in the RCA until they evacuate.

Personnel evacuation from the RCA occurs within 10 minutes.

13b.2.6.6 Radiation Source Term Analysis Tanks 1-MEPS-04T and 1-MEPS-02T were evaluated as potential source terms for this event. It was determined that the worst case fire scenario involves a fire affecting Tank 1-MEPS-02T.

The material at risk from Tank 1-MEPS-02T for isotopes contributing more than one percent of dose is given in Table 13b.2.6-1. Ten percent of the airborne material is assumed to be released through RVZ1 prior to isolation by the bubble-tight dampers. Ten percent of airborne activity is also assumed to be released to the RCA through penetrations in the supercell prior to evacuation of the facility.

13b.2.6.7 Radiological Consequence Analysis The maximum expected dose to a member of the public is 8.77E-04 rem (site boundary) and 1.23E-04 rem (nearest resident) and the maximum expected worker dose is 0.578 rem.

SHINE Medical Technologies 13b-37 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences 13b.2.6.8 Safety Controls Safety controls are credited to mitigate the effects of a design basis fire in the RPF. The following safety controls are identified as IROFS SSCs, ESFs, or defense-in-depth items SR SSCs or Technical Specification administrative controls. As appropriate these items are included in the facility technical specifications pursuant to 10 CFR 50.36.

  • Installed combustible loading in the RPF and process enclosures is low (DID) (TS Administrative Control).
  • Supercells, hot cells, tank enclosures, process enclosures are robustly constructed of non-combustible materials which provide fire resistance and radiological shielding (IROFS) (SR).
  • Interior finish provided in supercells, hot cells, tank enclosures, process enclosures is noncombustible or limited combustible materials (DID).
  • Administrative control of the admission and storage of transient combustible materials and potentially exothermic-reacting chemicals and the performance of hot work is maintained in the RPF (DID) (TS Administrative Control).
  • Use of and storage of flammable and combustible liquids and gases is in accordance with the facility fire protection program (DID) (TS Administrative Control).
  • Penetrations and components installed through fire area boundaries, hot cells, supercells and process enclosure barriers provide separation commensurate with the barrier protection (DID) (SR).
  • Automatic fire detection systems are installed and maintained in hot and supercells (IROFS).
  • Automatic fire suppression systems have the capability to be manually actuated (DID).
  • The hot cell fire detection and suppression system fire detection subsystem is interlocked to the cell ventilation system to provide ventilation isolation when fire is detected (IROFS).
  • Manual fire suppression capability is provided in the RPF through installation of appropriate fire extinguishers and fire hose reels (DID).
  • Firefighting capability is provided by trained firefighting personnel (DID).

The above safety controls provide assurance that radiological releases and consequences to workers and the public are maintained within 10 CFR 20 limits.

SHINE Medical Technologies 13b-38 Rev. 1

[Proprietary Information - Withhold from public disclosure under 10 CFR 2.390(a)(4)]

Chapter 13 - Accident Analysis Analyses of Accidents with Hazardous Chemicals Produced from Licensed Material 13b.3 ANALYSES OF ACCIDENTS WITH HAZARDOUS CHEMICALS PRODUCED FROM LICENSED MATERIAL The Final ISG Augmenting NUREG-1537 and the ISA Summary and the corresponding HAZOPS/PHA identified IEs and scenarios that involve chemical hazards that have the potential for significant consequences to workers, the public, or the environment. Only those hazards associated with chemicals produced from licensed material or that could affect the safety of licensed material will be evaluated for safety controls in this section.

The SHINE facility uses a variety of solid and liquid process chemicals, some of which are toxic chemicals. The chemicals are in relatively small (<1000 lbs) quantities. They include acids, bases, oxidizers, and flammables. Only a limited number of chemicals exceed 1000 lb quantities (e.g., nitric acid, sulfuric acid, and [ Proprietary Information ]).

These hazardous (including toxic) chemicals are used to support a wide variety of operations such as: (1) target solution preparation, (2) radioisotope production, extraction and purification, (3) target solution cleanup and thermal denitration, and (4) waste operations. Most of these operations are conducted in cells that have an inventory well below 100 lb. The bulk of the chemicals associated with licensed materials are stored in storage rooms outside the RCA, and in tank vaults inside the RCA.

This section focuses on identifying and evaluating the potential for chemical accidents involving significant quantities of toxic chemicals hazardous chemicals that are produced from licensed material that could lead to exceeding the Emergency Response Planning Guideline (ERPG) or equivalent levels (Temporary Emergency Exposure Limits [TEEL] or Acute Exposure Guideline Levels [AEGL]) as stated in the SHINE definition of safety-related. It also focuses on identifying chemical process controls that could prevent or mitigate such accidents and thus ensure that workers and the public are protected from such hazards. Based on the potential for exceeding ERPG levels, some of those controls are identified as IROFS and/or ESFs safety-related.

There are other process chemicals that could become fire and/or deflagration/explosion hazards (e.g., n-dodecane, deuterium, tritium), and as such are treated as potential initiators for those postulated accident categories. Only those that could result in the release of toxic chemicals hazardous chemicals that are produced from licensed material are explicitly evaluated in this section. Other process chemicals are considered to be industrial hazards that could lead to asphyxiation, burns, and other commonly accepted industrial consequences. These later type of hazards are not considered in this section, and are assumed to be controlled by industrial safety and hygiene programs.

There are no external chemical safety issues related to plant conditions that affect or may affect the safety of licensed materials and thus do not increase radiation risk to workers, the public, or the environment.

13b.3.1 CHEMICAL ACCIDENTS DESCRIPTION This section identifies the chemical hazards, potential IEs, and accidents that could result in unacceptable consequences to workers and/or the public (e.g., exceed ERPG levels), along with initial conditions and assumptions related to chemical hazards. Postulated accidents are described with respect to the potential interaction of process chemicals with licensed materials, SHINE Medical Technologies 13b-40 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Hazardous Chemicals Produced from Licensed Material confinement vessels, facility SSCs, and facility workers. A brief description of the accident progression is presented with respect to the controls that is designed to prevent or mitigate such chemical accidents. Mitigation of the consequences of chemical accidents will be reflected in the emergency plan, which is provided in the FSAR. A detailed description of these controls is presented in Subsection 13b.3.3.

13b.3.1.1 Initial Conditions and Assumptions The initial conditions and assumptions associated with chemical hazards produced from licensed material or that could affect the safety of licensed material are as follows:

a. Table 13b.3-1 identifies the bounding inventories (lbs) for each predominant process chemical along with their location and process use. The chemicals on this list are only those with ERPG, TEEL, AEGL limits/levels and quantities of more than a few pounds.
b. It is conservatively assumed that all postulated IEs impact the entire inventory in a single location (e.g., storage area, or tank or vessel in a vault or cell).
c. Significant quantities of toxic chemicals (with the potential to exceed ERPG limits at the site boundary) are delivered via DOT-approved containers. The evaluation of chemical hazards near (outside) the facility is provided in Subsection 2.2.3.
d. Tanks or vessels containing liquid chemicals are located within berms capable of holding the entire tank or vessel volumes.
c. Bulk storage outside the RCA is in a dedicated chemical storage area defined as a fire area while Storage in the RCA is exclusively in tank vaults or cells. Uranyl sulfate storage and preparation is in a dedicated fire area.
d. Spills of chemicals within the facility are assumed to take place in a 100 ft2 berm area.

This is a conservative assumption, given that most floor areas where chemicals are stored or present are <100 ft2, with the exception of the UREX hot cell, and waste evaporation cell; however, even for these areas, it is assumed that the berm area is 100 ft2. In the UREX cell the chemicals (e.g., nitric acid, acetohydroxamic acid) are in solution with the irradiated solution, so the hazards are predominantly due to fission products and fissile material, not the chemicals themselves. As a result of the fission product hazards, controls that mitigate radiological releases from this cell also mitigate chemical releases.

A pool evaporation model is used to determine the amount of liquid chemicals that are released.

13b.3.1.2 Identification of Initiating Events and Causes As indicated in the ISA Summary, There are several potential IEs or causes that could lead to toxic chemical releases of hazardous chemicals produced from licensed material, which if left uncontrolled, could potentially challenge the ERPG limits. These IEs and associated causes include:

a. Failure of tanks and/or vessels (including associated valves, piping, and overflow lines) with significant quantities of toxic chemicals inside vaults or cells is assumed to be due to operational mechanical failures, or human errors, or natural phenomena, none that could result in releases of hazardous materials chemicals produced from licensed materials.
b. Failure of tanks and/or vessels with significant quantities of toxic chemicals outside vaults or cells is assumed to be due to operational mechanical failures, or human errors.

SHINE Medical Technologies 13b-41 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Hazardous Chemicals Produced from Licensed Material

b. Failure of tanks and/or vessels with significant quantities of toxic chemicals inside vaults or cells (includes associated valves, piping, and overflow lines) due to fires.
c. Failure of tanks and/or vessels with quantities of toxic chemicals outside vaults or cells is assumed to be due to fires.
d. Exothermic reactions between chemicals leading to damage to tanks or vessels containing significant quantities of toxic materials.
e. Mishap during handling of chemicals leads to breach or spill of chemicals from tanks or vessels.
f. Mishap during handling of chemicals leads to spill of chemicals outside tanks or vessels.
h. Mishap (e.g., spill) during delivery of toxic chemicals outside the facility.
g. Excessive time of process solution in the evaporator creates increased concentrations and temperatures that promote formation of unstable compounds (e.g., reactions between nitric acid, Tri-Butyl Phosphate (TBP), and related decomposition products) that accumulate over time, resulting in an explosion and release of chemicals produced from licensed materials.
h. Degradation products not removed from Strip Solution, lead to solutions transferred for processing in the UN Evaporator and Thermal Denitrator causing a sudden reaction of unstable species giving rise to a chemical explosion in the UN Evaporator or Thermal Denitrator and a release of chemicals produced from licensed materials.

No significant quantities of toxic chemicals (i.e., below Reportable Quantities) hazardous chemicals produced from licensed materials are stored outside the facility.

13b.3.1.3 Sequence of Events The sequence of events following an initiated event that could potentially lead to a release of a toxic chemical depends on the cause of the IE and where it takes place. For scenarios that take place inside vaults or cells, the following sequence of events is likely to occur (as indicated previously, it is conservatively assumed that postulated IEs impact the entire inventory in a single location, e.g., storage area, or tanks or vessels in a vault or cell):

  • The vessel or tank could, depending on the magnitude of the IE, survive or fail.
  • For liquid chemicals, any loss of confinement or containment from a tank or vessel results in a spill into the berm, cell, or vault around the tank or vessel. No significant quantities of dry or powder forms of toxic chemicals are present in the vaults or cells as indicated in Table 13b.3-1.
  • Methods are employed for detection of liquid spills.
  • The vault or cells provide a secondary barrier to protect workers. The RCA ventilation system exhausts releases from the facility.

For scenarios that take place in the chemical storage area(s) outside cells or vaults, the following sequence of events is expected to occur:

a. As with releases within vaults and cells, the tanks or vessels could, depending on the magnitude of the IE, survive or fail.
b. For liquid chemicals, any loss of confinement or containment from a tank or vessel results in a spill into the berm around the tank or vessel. Any failure of a container with dry hazardous chemicals results in a release into the storage area; however the amount of airborne hazardous material is considered to be significantly less than if it were a liquid (due to the difference in the release fractions or rates between these material forms).

SHINE Medical Technologies 13b-42 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Hazardous Chemicals Produced from Licensed Material

c. Methods are employed for detection of liquid spills.
d. The chemical storage rooms or equivalent areas provide barriers to any potential release, with the support of its associated ventilation system (RVZ2 for uranyl sulfate preparation/storage rooms, and facility ventilation Zone 4 [FVZ4] for the chemical storage rooms outside the RCA).

The impacts of these hazardous chemicals are expected to be confined within the vaults or cells, or storage areas. The facility ventilation systems dilute the concentration of such toxic chemicals within these locations, and reduces potential releases by filtering any particulate hazardous chemicals (as long as they are compatible with the filtration media in the ventilation system), and ensure that release under normal operating conditions is released through the facility stack, thus further diluting or reducing the potential concentrations of hazardous toxic chemicals at the site boundary or to the nearest population.

13b.3.1.4 Quantitative Evaluation of Accident Evolution As discussed in Subsection 13b.3.1.2 several potential IEs were postulated that could lead to a release of hazardous chemicals produced from licensed materials. Depending on the IE, there are several facility design and operational controls that protect the tanks, vessels, or containers with hazardous chemicals.

For fire IEs, the low combustible loading, limited availability of ignition sources, and fire detection and suppression in cells and storage areas, along with the berms around the tanks or vessels (preventing flame impingement) and the fire resistant construction of the tanks and vessels themselves make the potential for a chemical release unlikely (between 1E-4 and 1E-5/yr -

according to the NUREG/CR-1520 likelihood categorization).

For natural phenomena IEs (e.g., seismic events), tanks and vessels within the RCA with significant quantities of hazardous toxic materials with the potential for exceeding ERPG levels are seismically anchored and designed not to fail during such events.

Human error IEs that could result in a release of significant amount of hazard chemicals are very limited. Most of these human errors are likely to result in relatively low quantities of chemicals spilled or released due to mishandling activities, filling or transfer operations, with the exception of those taking place outside the facility (e.g., during delivery operations). The limited access of personnel inside vaults and cells make this type of IEs unlikely (<1E-4/yr).

For scenarios caused by exothermic reactions between chemicals, the segregation and/or isolation of chemical storage based on the potential for exothermic reactions along with the integrity of the tanks and vessels themselves makes this type of IE unlikely to occur (between 1E-4 and 1E-5/yr).

See Subsection 2.2.3 for an analysis of chemical hazards near the facility.

SHINE Medical Technologies 13b-43 Rev. 1

[Proprietary Information - Withhold from public disclosure under 10 CFR 2.390(a)(4)]

Chapter 13 - Accident Analysis Analyses of Accidents with Hazardous Chemicals Produced from Licensed Material 13b.3.2 CHEMICAL ACCIDENT CONSEQUENCES The following analysis has been performed for hazardous toxic chemicals within the facility, and not just those produced from licensed materials, since the listed chemicals may or may not be produced from or associated with licensed materials depending on which point in the process or system is being considered. This analysis is therefore bounding for all hazardous chemicals produced from licensed materials. Safety-related or administrative controls have been developed only for those systems or processes where the hazardous chemical is produced from or otherwise associated with licensed materials.

The initial conditions and assumptions, identification of initiating events and causes, sequence of events, and the quantitative evaluation of accident evaluation are preserved in Subsection 13b.3.1. This subsection discusses the consequences of the scenarios described in Subsection 13b.3.1.

In the event of release of hazardous toxic chemicals within the facility, there is a potential for exposure to workers and to the public. Instead of trying to bound the potential releases and associated Chemical Dose (CD - or concentration) for the single most toxic chemical produced from licensed materials based on screening methodologies like the Vapor Hazard Ratio (DOE, 1999), the toxic chemicals with the highest inventories in Table 13b.3-1 and with the highest toxicity (lowest ERPG values) have been evaluated using widely accepted methodologies and/or computer codes, such as ALOHA or EPIcode. Both codes have been verified and validated (V&V) and are commonly used for safety analysis purposes by government agencies such as the Department of Energy (DOE).

A determination has been made as to whether the CD for such chemicals could exceed the ERPG limits for the various frequency categories (as defined in the consequence versus frequency category matrix provided by NUREG/CR-1520). Where ERPG limits are exceeded, IROFS SR controls are identified to prevent or mitigate the consequences from postulated scenarios when they relate to releases of hazardous chemicals produced from licensed materials.

13b.3.2.1 Damage to Equipment The release of toxic chemicals is not expected to result in damage to IROFS SR SSCs, with the exception of the damaged caused by the IE to tanks and vessels themselves. Tanks and vessels are compatible with the chemicals that they contain.

13b.3.2.2 Chemical Source Term Analysis As indicated in Table 13b.3-1, bounding inventories (or material-at-risk [MAR]) for the chemicals of concern have been provided. From this list of chemicals identified in Table 13b.3-1, 11 chemicals were identified for further analysis based on their toxicity, potential dispersibility, and inventory. The selected hazardous chemicals are: nitric and sulfuric acid, calcium hydroxide, caustic soda, [ Proprietary Information ], ammonium hydroxide, [ Proprietary Information ],

n-dodecane, potassium permanganate, tributyl phosphate, and uranium nitrate.

Of concern in a postulated accident is what fraction of the hazardous chemical inventory is impacted by the scenario (damage ratio [DR]), what fraction of the inventory becomes airborne (airborne release fraction [ARF]), and in some cases the respirable fraction (RF), and is readily SHINE Medical Technologies 13b-44 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Hazardous Chemicals Produced from Licensed Material transported outside of the facility (leakpath factor [LPF]). The five-factor formula is being used to determine the source term of dispersible/respirable material that is released to the environment; namely:

Source term = MAR x DR x ARF x RF x LPF (Equation 13b.3-1)

Source terms are evaluated using models and/or computer codes that conform to NUREG/CR-6410s methodologies. Conservatively, it is assumed that IEs impact the entire inventory in the bounding location; that is, a DR of 1.0 is assumed for postulated accidents.

Releases of liquid toxic chemicals are modeled to limit evaporation since none of the tanks or vessels containing toxic chemicals are pressurized. In all cases, the evaporation of the entire inventory takes several hours.

ARFs/RFs for solid or powder chemicals have been selected to bound those in NUREG/CR-6410, namely an ARF/RF of 1E-03/1.0 from a spill of powders. Notice that some chemicals are delivered in solid or powder form (e.g., caustic soda) but are prepared or used in liquid form; however, for conservatism, these were modeled as powders, since the source term is higher than when modeled as being released from an evaporating pool. An LPF of 1.0 has been assumed conservatively at this time for all chemicals except for nitric acid and n-dodecane. For nitric acid and n-dodecane, only those inventories associated with licensed materials have been analyzed for release. These inventories exist inside tank vault or hot cells. As such, an LPF of 0.1 has been assumed for these two release scenarios (see Table 13b.3-1). This LPF corresponds to the most conservative LPF used for the bubble-tight isolation dampers.

13b.3.2.3 Chemical Concentrations and Comparison to Acceptable Limits Consequence or chemical dose modeling are evaluated using dispersion models and/or computer codes that conform to NUREG/CR-6410 methodologies.

Typical computer codes to model chemical releases and determine the chemical dose (or concentration) are the ALOHA and EPIcode; as indicated previously both computer codes are widely used for supporting accident analysis and emergency response evaluations. Both codes have been used and accepted by DOE. V&V for both codes has been performed for modeling chemical hazards for the SHINE facility. Because ALOHA only can readily model only about half of these chemicals, the EPIcode was selected to perform chemical dose calculations in this section, and ALOHA was used to benchmark some of the EPIcode runs.

In running EPIcode, no credit is taken for depletion or plateout of chemicals within the facility or during transport to the site boundary or nearest population location. Dispersion calculations performed are done assuming stable meteorological conditions (i.e., stability F) and 3.3 ft/s (1 m/s) wind speed. These meteorological conditions are typically seen about 15 percent of the time at the site. Ambient temperature was assumed to be 75°F (24°C). A deposition velocity of 3.3 ft/s (1 m/s), a receptor height of 5 ft. (1.5 m) was used to simulate the height of an individual, concentrations are plume centerline values. Releases were conservatively modeled as ground non-buoyant.

Chemical doses or concentrations were determined for the 11 chemicals for a postulated collocated worker within the site boundary (328 ft. [100 m]) at the site boundary and at the nearest residence (1319 817 ft. and 2585 ft. [402 249 m and 788 m], respectively).

SHINE Medical Technologies 13b-45 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Hazardous Chemicals Produced from Licensed Material summarizes the results of the source term and concentration calculations for the 11 chemicals.

The acceptance limits were those identified in NUREG/CR-6410 and correspond to Protective Action Criteria (PAC) values corresponding to AEGLs, ERPGs, or TEELs values for such chemicals.

The chemical dose or concentration for the nearest residence is below the PAC 1, 2 and 3 levels (equivalent to ERPG 2 and 3 ERPG-1, 2 and 3). For the workers postulated to be located within the boundary 328 ft. (100 m) downwind, the concentrations are below the PAC values.

SHINE Medical Technologies 13b-46 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Hazardous Chemicals Produced from Licensed Materials 13b.3.3 CHEMICAL PROCESS CONTROLS The safety controls preventing or mitigating the consequences of a toxic hazardous chemical release produced from licensed materials are:

  • Berms and cell and vault configuration (IROFS and ESF).
  • Separation of chemical storage based on the potential for exothermic reaction (IROFS).
  • Chemical inventory control (IROFS).
  • Fire detection system (DID).
  • Room, Cell, and vault physical barriers (DID) (SR).
  • Thermal Denitrator Vent (SR).
  • Uranyl Nitrate Evaporator Vessel Vent (SR).
  • Solvent Control Program (TS Administrative Control).

SHINE Medical Technologies 13b-47 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Hazardous Chemicals Produced from Licensed Material Table 13b.3-1 Bounding Inventory (lbs) of Significant Process Chemicals (Sheet 2 of 4)

Bounding Chemical Location Inventory (Lbs) Notes n-Dodecane N/A 1596 Facility total Caustics Room 1033 Storage inventory Tank Vault 259 Tank Vault 304 Bounding inventory for n-Dodecane associated with licensed materials. Spills pure n-Dodecane from a tank into a hot cell Hydrochloric Acid Acids Room 3 Hydrogen Peroxide Caustics Room 3 Molybdenum Trioxide Hot Lab 0.66 Nitric Acid N/A 17556 Facility total Acids Room 6229 Storage inventory; assumes stored as received in 1000L IBC at 15.9 M HNO3.

Max inventory of 2 containers Uranyl Sulfate Prep 113 Tank Vault 23 Tank Vault 363 UREX hot cell 7 Consists of the scrub and strip solutions Tank Vault 721 Bounding inventory for nitric acid associated with licensed materials. Spills 12 M nitric acid from a tank into a hot cell.

Tank Vault 4 TDN area 0.03 30L holdup volume Liquid waste storage tank 9648 Assumes both A&B tanks are full.

vaults SHINE Medical Technologies 13b-49 Rev. 1

[Proprietary Information - Withhold from public disclosure under 10 CFR 2.390(a)(4)]

Chapter 13 - Accident Analysis Analyses of Accidents with Hazardous Chemicals Produced from Licensed Material Table 13b.3-2 SHINE Toxic Chemical Source Terms and Concentrations Nearest Hazardous Source Worker MOI MEI Residence Chemical/Release MAR Term(a) Concentration Concentration Concentration Mechanism (lb) ARF/RF (lb) PAC-1 PAC-2 PAC-3 (100 m) (402 249 m) (788 m)

Nitric Acid, 12 M, associated with licensed 6,229 6,229 1.0 0.53 ppm 24 ppm 92 ppm 1 5 0.49 ppm 3.0 0.090 ppm 0.4 0.012 ppm materials 721 721 (Evaporating Liquid)

Sulfuric Acid 0.20 8.7mg/m 160 7,770 1.0 7,770 2.4E-06 ppm 4.7E-07 mg/m3 6.3E-08 mg/m3 (Evaporating Liquid) mg/m3 mg/m3 Calcium Hydroxide 240 1,500 3,182 0.001 3.182 15 mg/m3 0.86 mg/m3 0.16 mg/m3 0.020 mg/m3 (Dispersed Solid) mg/m3 mg/m3 Caustic Soda 0.5 50 (Dispersed as both a 1,488 0.001 1.488 3 5 mg/m3 0.40 mg/m3 0.073 mg/m3 0.010 mg/m3 mg/m mg/m3 powder and liquid)

[ Proprietary Information ] [ Proprietary [ Proprietary [ Proprietary 4,104 0.001 4.104 1.1 mg/m3 0.20 mg/m3 0.026 mg/m3 (Dispersed Solid) Information ] Information ] Information ]

Ammonium Hydroxide 2300 59 0.001 0.059 61 ppm 330 ppm 0.011 ppm 2.0E-03 ppm 2.6E-04 ppm (Evaporating Liquid) ppm

[ Proprietary Information ] [ Proprietary [ Proprietary [ Proprietary 606 0.001 0.606 0.16 mg/m3 0.03 mg/m3 3.9E-03 mg/m3 (Dispersed Solid) Information ] Information ] Information ]

Dodecane associated 1,033 1,033 0.0028 0.031 0.023 0.0023 with licensed materials 1.0 7.9 ppm 4.4E-034ppm 5.9E-045 ppm 304 304 ppm ppm ppm (Evaporating Liquid)

Potassium Permanganate 8.6 14 78 66 0.001 0.001 0.018 mg/m3 3.3E-03 mg/m3 4.2E-04 mg/m3 (Dispersed Solid) mg/m3 mg/m3 mg/m3 Tributyl Phosphate 0.6 3.5 125 333 0.001 0.333 0.0082 ppm 1.5E-03 ppm 2.0E-04 ppm (Evaporating Liquid) mg/m3 mg/m3 mg/m3 Uranyl Nitrate 0.99 5.5 33 480 0.001 0.480 0.024 mg/m3 0.024 mg/m3 3.1E-03 mg/m3 (Dispersed as a powder) mg/m3 mg/m3 mg/m3 a) With the potential for exceeding ERPG-2 limits at site boundary SHINE Medical Technologies 13b-52 Rev. 1

Chapter 14 - Technical Specifications Administrative Controls 14a2.6 ADMINISTRATIVE CONTROLS Administrative controls will be provided in the technical specifications.

Examples of the proposed subjects of administrative controls are provided below:

Procedures Written procedures shall be established, implemented, and maintained covering activities described in the following Programs.

Programs

  • Criticality-safety
  • ALARA (includes use of accelerator and hot cell audible and visual warnings)
  • Procurement and use of transport and waste containers
  • Fire protection (includes installed and transient combustible loading, performance of hot work, deuterium source vessel integrity, fire watch requirements, use and storage of flammable and combustible liquids and gasses)
  • Solvent control (includes control of process residence times, solvent quality control, and solvent solution sampling and analysis)
  • Tritium control (includes inventory control and sampling)
  • Light water coolant activity monitoring
  • Chemical control SHINE Medical Technologies 14a2-7 Rev. 1

Chapter 14 - Technical Specifications Introduction Table 14a2-1 SHINE Facility Proposed Parameters for Technical Specifications (Sheet 1 of 10)

Chapter/

Section/

Subsection Reference per ANSI/ANS-1 5.1-2007 Section Name SLs and LSSS Basis 2 SLs and LSSS 2.1 SLs

  • TSV power 13a2.1.8/13a2.2.8 Large undamped power oscillations
  • Uranium concentration 13a2.1.2/13a2.2.2 Insertion of excess reactivity
  • Uranium enrichment 13a2.1.11/13a2.2.11 PSB System interaction events
  • Quantities of radioactive materials 13b.2.4 Critical equipment malfunction 13b.2.5 Inadvertent nuclear criticality in the radioisotope
  • Quantities of hazardous production facility chemicals 13b.2.6 Radioisotope production facility fire 2.2 Limiting Safety
  • TSV LSSS 13a2.1.2/13a2.2.2 Excess reactivity System a. TSV cover gas hydrogen 13a2.1.8/13a2.2.8 Large undamped power oscillations Settings concentration high 13a2.1.9/13a2.2.9 Detonation and deflagration in primary system boundary
b. TSV neutron flux high, source range
c. TSV neutron flux high, high range SHINE Medical Technologies 14a2-8 Rev. 1

Chapter 14 - Technical Specifications Introduction Table 14a2-1 SHINE Facility Proposed Parameters for Technical Specifications (Sheet 6 of 10)

Chapter/

Section/

Subsection Reference per ANSI/ANS-1 5.1-2007 Section Name LCO or Condition Basis 3.7 Radiation

  • Noble gas storage tank activity 13b.2.4 Critical equipment malfunction Monitoring
  • Target solution transfer decay time Systems and
  • Radiation monitoring systems 13a2.1.4/13a2.2.4 Mishandling or malfunction of target solution Effluents a. Channels and interlocks with 13a2.1.7/13a2.2.7 Mishandling or malfunction of equipment ventilation systems affecting the PSB
b. Monitoring equipment operable 13a2.1.12.3/13a2.2.12.3 TPS design basis accident 3.8 Experiments N/A N/A 3.9 Facility
  • Hot cell fire detection and suppres- 13b.2.6 Radioisotope production facility fire Specific LCOs sion system (detection only)
a. Detection system operable
b. Ventilation system interlock operable
  • Criticality-safe sumps 13b.2.5 Inadvertent nuclear criticality in the radioisotope
a. Sump pump operable production facility
b. Sump level detectors operable
  • Radiological Integrated Control Sys- 13b.2.4 Critical Equipment Malfunction tem (RICS)

SHINE Medical Technologies 14a2-13 Rev. 1

Chapter 14 - Technical Specifications Introduction 14b TECHNICAL SPECIFICATIONS OF PROCESSES OUTSIDE THE IRRADIATION FACILITY This section encompasses the technical specifications for the processes involving special nuclear material (SNM), radioisotopes, and chemicals outside the IF produced from licensed materials.

In accordance with the requirements of 10 CFR 50.34 (a)(5), this section identifies the variables and conditions that will likely be the subjects of technical specifications for the SHINE facility.

These may change with the operating license application. These variables and conditions are based on the preliminary design of the SHINE facility. The technical specifications will be submitted with the operating license application.

These proposed technical specifications have been formulated on the premise that this material presents a sound framework upon which a final, complete set of specifications can be developed with the operating license application.

14b.1 INTRODUCTION The format and content of the Technical Specifications will be written with the guidance provided in ANSI/ANS 15.1 (ANSI/ANS 2007), NUREG-1537, and the Final ISG Augmenting NUREG-1537. The technical specifications for the facility outside the IF will comply with the regulations in 10 CFR 50.36 pertaining to a fuel reprocessing facility, as required by the Final ISG Augmenting NUREG-1537.

SHINE Medical Technologies 14b-1 Rev. 1

Chapter 14 - Technical Specifications Safety Limits and Limiting Safety System Settings 14b.2 SAFETY LIMITS AND LIMITING SAFETY SYSTEM SETTINGS 14b.2.1 SAFETY LIMITS FOR PROCESSING IRRADIATED SPECIAL NUCLEAR MATERIAL OUTSIDE OF THE REACTOR For irradiated SNM outside of the TSV, SLs are derived for criticality accident prevention based on the Nuclear Criticality Safety Program, and also from an Integrated Safety Analysis (ISA).

Limits are specified, using the double-contingency principle, to avoid a criticality accident. Limits are set with a conservative margin.

For irradiated SNM outside of the TSV, appropriate limits are imposed pursuant to 10 CFR 50.36(c)(1) to ensure that fission products will be controlled to prevent excessive releases from the containment components, systems, or structures, particularly those structures, systems, and components containing large inventories of byproduct material.

14b.2.2 SAFETY LIMITS FOR PROCESSING UNIRRADIATED SPECIAL NUCLEAR MATERIAL OUTSIDE OF THE IRRADIATION FACILITY Limits are specified, using the double-contingency principle, to avoid a criticality accident. Limits are set with a conservative margin.

14b.2.3 SAFETY LIMITS FOR RADIOCHEMICAL PROCESSING Safety limits for radiochemical processing are developed to maintain operations within limits pursuant to 10 CFR 50.36 to protect the staff and the public. The amount of radiation is limited so as not to exceed the shielding and confinement capabilities of the systems and components in which the materials are processed or stored.

14b.2.4 SAFETY LIMITS FOR CHEMICAL PROCESSING Safety limits for chemical processing with hazardous chemicals that are conducted coincident to operations with SNM or radioactive material are developed in accordance with 10 CFR 50.36.

These SLs could take the form of item relied on for safety (IROFS) designated in an ISA and defined in 10 CFR 70.4 and described in 10 CFR 70.61(e).

14b.2.5 LIMITING SAFETY SYSTEM SETTINGS For each process variable or parameter for which a SL is specified, and for which monitoring instruments are used, a protective operating limit is set to avoid exceeding the SL. This LSSS is calculated to provide a conservative margin below the SL and to account for overall measurement uncertainty, operating characteristics of control systems, and accuracy of control instrumentation. LSSSs will be established, as much as possible, to ensure adequate safety margins for each of the processes described above.

Refer to Table 14a2-1 for the SLs and LSSSs associated with the processes outside the irradiation facility.

SHINE Medical Technologies 14b-2 Rev. 1

Chapter 14 - Technical Specifications Administrative Controls 14b.6 ADMINISTRATIVE CONTROLS Chemical storage segregation and control of chemical inventories is identified as an IROFS in Chapter 13b.3. A chemical control program will be developed to control chemical segregation and chemical inventories.

Fissile material handling is identified as an IROFS in Chapter 13b.2.5. A nuclear criticality safety program will be developed.

See Section 14a2.6 for examples of Administrative Controls that will be in use at the SHINE Facility.

The remaining administrative controls will be provided in the technical specifications.

SHINE Medical Technologies 14b-6 Rev. 1

ENCLOSURE 2 ATTACHMENT 9 SHINE MEDICAL TECHNOLOGIES, INC.

SHINE MEDICAL TECHNOLOGIES, INC. APPLICATION FOR CONSTRUCTION PERMIT RESPONSE TO REQUEST FOR ADDITIONAL INFORMATION PRELIMINARY SAFETY ANALYSIS REPORT CHANGES (MARK-UP) 83 pages follow

Preliminary Safety Analysis Report Master Table of Contents 12.10a REACTOR OPERATOR TRAINING AND REQUALIFICATION.............................. 12-14 12.10b PRODUCTION FACILITY OPERATOR TRAINING AND REQUALIFICATION ................................................................................................ 12-15 12.11 STARTUP PLAN...................................................................................................... 12-16 12.12 VACATED................................................................................................................ 12-17 12.13 MATERIAL CONTROL AND ACCOUNTABILITY PROGRAM ................................ 12-18 12.14 REFERENCES ........................................................................................................ 12-19 APPENDIX 12A EMERGENCY PLAN...................................................................................... 12A-1 APPENDIX 12B SECURITY PLAN........................................................................................... 12B-1 APPENDIX 12C QUALITY ASSURANCE PROGRAM DESCRIPTION ................................... 12C-1 APPENDIX 12D CONDUCT OF OPERATIONS PROGRAM DESCRIPTION ......................... 12D-1 CHAPTER 13 ACCIDENT ANALYSIS 13a1 HETEROGENEOUS REACTOR ACCIDENT ANALYSIS ....................................... 13a1-1 13a2 IRRADIATION FACILITY ACCIDENT ANALYSIS................................................... 13a2-1 13a2.1 ACCIDENT-INITIATING EVENTS AND SCENARIOS ............................................ 13a2-1 13a2.2 ACCIDENT ANALYSIS AND DETERMINATION OF CONSEQUENCES .................................................................................................. 13a2-36 13a3

SUMMARY

AND CONCLUSIONS .......................................................................... 13a3-1 13a4 REFERENCES ........................................................................................................ 13a4-1 13b RADIOISOTOPE PRODUCTION FACILITY ACCIDENT ANALYSES .................... 13b-1 13b.1 RADIOISOTOPE PRODUCTION FACILITY ACCIDENT ANALYSIS METHODOLOGY .................................................................................................... 13b-1 13b.2 ANALYSES OF ACCIDENTS WITH RADIOLOGICAL CONSEQUENCES .................................................................................................. 13b-4 13b.3 ANALYSIS OF ACCIDENTS WITH HAZARDOUS CHEMICALS PRODUCED FROM LICENSED MATERIAL........................................................... 13b-397 13b.4 REFERENCES ........................................................................................................ 13b-521 CHAPTER 14 TECHNICAL SPECIFICATIONS 14a1 HETEROGENEOUS REACTOR TECHNICAL SPECIFICATIONS......................... 14a1-1 14a2 IRRADIATION FACILITY TECHNICAL SPECIFICATIONS .................................... 14a2-1 14a

2.1 INTRODUCTION

..................................................................................................... 14a2-2 14a2.2 SAFETY LIMITS AND LIMITING SAFETY SYSTEM SETTINGS ........................... 14a2-3 14a2.3 LIMITING CONDITIONS FOR OPERATION........................................................... 14a2-4 14a2.4 SURVEILLANCE REQUIREMENTS ....................................................................... 14a2-5 14a2.5 DESIGN FEATURES............................................................................................... 14a2-6 14a2.6 ADMINISTRATIVE CONTROLS.............................................................................. 14a2-7 14a

2.7 REFERENCES

........................................................................................................ 14a2-18 14b TECHNICAL SPECIFICATIONS OF PROCESSES OUTSIDE THE IRRADIATION FACILITY......................................................................................... 14b-1 14b.1 INTRODUCTION ..................................................................................................... 14b-1 14b.2 SAFETY LIMITS AND LIMITING SAFETY SYSTEM SETTINGS ........................... 14b-2 14b.3 LIMITING CONDITIONS FOR OPERATION........................................................... 14b-3 14b.4 SURVEILLANCE REQUIREMENTS ....................................................................... 14b-4 SHINE Medical Technologies v Rev. 1

Chapter 1 - The Facility General Description of the Facility Confinement is achieved through RV, radiological integrated control system (RICS), and biological shielding provided by the steel and concrete structures comprising the walls, roofs, and penetrations of the hot cells. Shielding of the hot cells is discussed in detail in Subsection 4b.2.2.

Confinement is also achieved by berms that limit the spread of hazardous chemical spills.

SSCs that perform an ESF function are classified as safety-related.

1.3.5 INSTRUMENTATION, CONTROL, AND ELECTRICAL SYSTEMS The TSV process control system (TPCS) controls the operation of the TSV. The TSV is protected by the TSV reactivity protection system (TRPS). These are addressed in Sections 7a2.3 and 7a2.4, respectively.

Control and protection systems associated with the RPF are addressed in Section 7b.

Design features of the control consoles and display instrumentation, and the radiation monitoring systems for both the IU and the RPF, are addressed in Chapter 7. Radiation monitoring systems include the criticality accident and alarm system (CAAS), the radiation area monitoring system (RAMS), and the continuous air monitoring system (CAMS).

The SHINE facility has one common normal electrical supply system, which provides power to the IF, the RPF, and other support buildings. Power service is provided by the local utility via off-site feeds. A standby diesel generator provides power for asset protection to selected loads in the event of a loss of off-site power. These systems are described in Section 8a2.1.

Emergency electrical power for the SHINE facility is provided by a common emergency power system. A Class 1E uninterruptible electrical power supply system (UPSS) is provided for the facility. This system consists of two independent trains, each consisting of a 250 volts-direct current (VDC) battery system with associated charger, inverter, and distribution system. This system is described in Section 8a2.2.

1.3.6 TSV COOLING AND OTHER AUXILIARY SYSTEMS Primary cooling for the TSV and related components is provided by the LWPS and the primary closed loop cooling system (PCLS). The TSV and related components are submerged in the light water pool. The LWPS is addressed in Sections 5a2.2 and 4a2.4. The PCLS is addressed in Section 5a2.2. The light water pool and primary closed loop cooling make-up system (MUPS) supports the LWPS and the PCLS. This system is addressed in Section 5a2.5.

Primary cooling for the RPF and removal of heat from both the LWPS and the PCLS is provided by the radioisotope process facility cooling system (RPCS). This system is discussed in Section 5a2.3.

Ventilation for both the IF and the RPF is provided by the RV. This ventilation system is described in Section 9a2.1.

Equipment and processes related to handling and storage of target solution are addressed in Section 9a2.2. Equipment and processes related to handling and storage of byproduct material and SNM are addressed in Section 9a2.5.

SHINE Medical Technologies 1-11 Rev. 2

Chapter 3 - Design of Structures, Systems, and Components Systems and Components Table 3.5-1 System Classifications (Sheet 2 of 4)

Highest Safety Classification System Within System Seismic Quality System Name Code Scope(a) Classification(b) Group Uranyl Nitrate Conversion UNCS SR Category I QL-1 System Target Solution Cleanup (UREX)

Thermal Denitration Production Facility Biological PFBS SR Category I QL-1 Shield System Radioactive Drain System RDS SR Category I QL-1 Radioactive Liquid Waste RLWE SR Category I QL-1 Evaporation and Immobilization Aqueous Radioactive Liquid RLWS SR Category I QL-1 Waste Storage RCA Material Handling RMHS SR Category I QL-1 Systems Other Facility Systems and Components Hot Cell Fire Detection and HCFD SR NSR Category II QL-12 Suppression System Facility Instrument Air System FIAS NSR Category III QL-2 Facility Control Room FCR NSR Category III QL-2 Stack Release Monitoring SRM NSR Category III QL-2 Facility Fire Detection and FFPS NSR Category III QL-2 Suppression Neutron Driver Assembly NDAS NSR Category III QL-2 System Primary Closed Loop Cooling PCLS NSR Category II QL-2 System Primary Closed Loop Cooling MUPS NSR Category III QL-2 and Light Water Pool Makeup System Health Physics Monitors HPM NSR Category III QL-2 TSV Process Control System TPCS NSR Category II QL-2 Normal Electrical Power Supply NPSS NSR Category II QL-2 System Inert Gas Control IGS NSR Category III QL-2 Material Handling MHS NSR Category II QL-2 Solid Radioactive Waste SRWP NSR Category II QL-2 Packaging SHINE Medical Technologies 3-53 Rev. 2

Chapter 3 - Design of Structures, Systems, and Components Radioisotope Production Facility b) The CAAS is capable of detecting a criticality accident that produces and absorbed dose in soft tissue of 20 rads of combined neutron or gamma radiation at an unshielded distance of 2 meters from the reacting material within one minute, except for events occurring in areas not normally accessed by personnel and where shielding provides protection against a criticality.

3.5b.1.8 Continuous Air Monitoring System Refer to Section 7a2.7 for a detailed description.

3.5b.1.8.1 CAMS Design Basis Functions a) CAMS provide real time local and remote annunciation of airborne contamination in excess of preset limits.

b) Remain functional through DBAs.

3.5b.1.8.2 CAMS Design Basis Values To be provided in the FSAR.

3.5b.1.9 Confinement Barriers Confinement is provided by a combination of the hot cell structures, the supporting ventilation systems, and isolation valves or bubble-tight dampers on all hot cell penetrations.

3.5b.1.9.1 RCA Ventilation System Zone 2 3.5b.1.9.1.1 RVZ2 Design Basis Functions a) Maintain pressure gradients throughout the Zone 2 areas to ensure the proper flow of air from the least potentially contaminated areas to the most potentially contaminated areas, thereby limiting the spread of airborne radioactive materials.

b) Provide confinement of airborne radioactive materials by providing for the rapid, automatic closure of isolation dampers at the at the RCA boundary for various accident conditions.

c) Provide confinement of hazardous chemical fumes.

d) The isolation dampers remain functional for DBA.

e) Provide conditioned air to ensure suitable environmental conditions for personnel and equipment in the RCA.

f) The system has sufficient redundancy to perform its safety function in the event of a single failure.

3.5b.1.9.1.2 RVZ2 Design Basis Values a) The RVZ2 has a 30-year design life.

b) Maintain air quality with the occupied RVZ2 areas that complies with the dose limits of 10 CFR 20 for normal operations and shutdown.

c) Maintain air quality with the occupied RVZ2 areas that complies with the dose limits of 10 CFR 20 for DBAs.

d) Maintain its leakage rate performance for 40 days post-accident (Subsection 11.1.1.1).

SHINE Medical Technologies 3-97 Rev. 1

Chapter 3 - Design of Structures, Systems, and Components Radioisotope Production Facility 3.5b.1.9.2 Production Facility Biological Shielding Refer to Section 4b.2 for a detailed description.

3.5b.1.9.2.1 PFBS Design Basis Functions a) Provide biological shielding from radiation sources in the hot cells for workers in the occupied areas of the facility.

b) Limit physical access to the hot cells.

c) Design to survive DBEQ effects, without loss of structural integrity.

d) Remain functional through DBAs.

3.5b.1.9.2.2 PFBS Design Basis Values a) The PFBS has a 30-year design life.

b) Provide dose rates at 12 in. (30.48 cm) from surface of shielding of 0.25 mrem/hr or less for normally-occupied areas. Localized dose rates at penetrations and during some planned operations, may be higher and are posted appropriately.

3.5b.1.10 Hot Cell Fire Detection and Suppression System Refer to Subsection 9a2.3.4.4.2.4 for a description of the HCFD.

3.5b.1.10.1 HCFD Design Basis Functions a) Provide fire detection in hot cells and enclosures and initiate fire-rated damper closure.

b) Remain functional through DBAs.

3.5b.1.10.2 HCFD Design Basis Values a) The HCFD has a 30-year design life.

3.5b.1.11 Radiological Integrated Control System Refer to Subsection 7b.2.3 for a description of the RICS.

3.5b.1.11.1 RICS Design Basis Functions a) Monitors valve positions for inter-equipment process fluid transfers.

b) Monitors and controls inter-equipment process fluid transfers in the RPF.

c) Controls the RPF components for transfer of target solution from the TSV dump tank in an IU cell to one of the MEPS.

d) Controls the transfer of prepared target solution from the TSPS in the RPF to the TSV hold tank.

e) Controls the transfer of recycled target solution from the target solution recycle holding tank in the RPF to the TSV hold tank.

f) Initiate ESF actuation of isolation dampers and valves for RPF hot cells, glove boxes or other cells that require isolation upon measured parameters exceeding setpoints.

g) Initiate ESF actuation of isolation dampers for the RCA ventilation system in the RPF, upon measured parameters exceeding setpoints.

SHINE Medical Technologies 3-98 Rev. 1

Chapter 6 - Engineered Safety Features Summary Description Engineered Safety Features Table 6b.1-1 Summary of RPF Design Basis Events and ESF Provided for Mitigation Detailed Engineered Safety Description Feature Radioisotope Production Facility Design Basis Event Section or (ESF) Mitigated by ESF SSCs which provide ESF Subsection

  • Hot cells including penetration seals
  • RCA ventilation system Zone 1 (including ductwork up to filters and filters) and Zone 2
  • Critical equipment malfunction Confinement
  • Tank vaults 6b.2.1
  • Accidents with hazardous chemicals
  • Radiological integrated controls system (RICS)
  • Isolation valves on piping systems penetrating hot cells
  • Berms SHINE Medical Technologies 6b-2 Rev. 1

Chapter 6 - Engineered Safety Features Confinement 6b.2.1 CONFINEMENT 6b.2.1.1 Introduction Confinement describes the low-leakage boundary surrounding radioactive or hazardous chemical materials released during an accident and parts of RVZ1 and RVZ2. Confinement systems localize releases of radioactive or hazardous materials to controlled areas and mitigate the consequences of DBAs. Personnel protection control features such as adequate shielding and RV minimize hazards normally associated with radioactive or chemical materials. The principal design and safety objective of the confinement system is to protect the on-site personnel, the public, and the environment. The second design objective is to minimize the reliance on administrative or complex active engineering controls and provide a confinement system that is as simple and fail-safe as reasonably possible.

This subsection describes the confinement systems for the RPF. The RPF confinement areas include hot cell enclosures for process operations and trench and vault enclosures for process tanks and piping.

Confinement is achieved through RV, RICS, and biological shielding provided by the steel and concrete structures comprising the walls, roofs, and penetrations of the hot cells. Shielding of the hot cells is discussed in detail in Subsection 4b.2.

Confinement is also achieved by berms to confine the spills of hazardous chemicals.

6b.2.1.2 Confinement System and Components The RV serving the RCA, outside of the IF, includes components whose functions are designated as nonsafety-related and safety-related. The ductwork, the isolation dampers, and the filter trains of RVZ1 are designated as safety-related. Refer to Table 6b.2-1 for a description of the system and component safety functions. Active confinement isolation components are required to operate as described below.

The hot cells employ a combination passive-active confinement methodology. During normal operation, passive confinement is achieved through the contiguous boundary between the hazardous materials and the surrounding environment and is credited with confining the hazards generated as a result of DBAs.

This boundary includes the biological shield (created by the physical construction of the cell itself) and the extension of that boundary through the RVZ1. The intent of the passive boundary is to confine hazardous materials while also preventing the introduction of external energy sources that could disturb the hazardous materials from their steady-state condition. The extent of this passive confinement boundary extends from the upstream side of the intake HEPA filter to the final downstream HEPA filter prior to exiting the building.

In the event of a DBA that results in a release in the hot cells, radioactive material would be confined by the biological shield and physical walls of the cell itself. Each line that connects directly to the hot cell atmosphere and penetrates the hot cell is provided with redundant isolation valves to prevent releases of gaseous or other airborne radioactive material. Confinement isolation valves on piping penetrating the hot cell are located as close as practical to the SHINE Medical Technologies 6b-4 Rev. 2

Chapter 6 - Engineered Safety Features Confinement confinement boundary and active isolation valves are designed to take the position that provides greater safety upon loss of actuating power.

To mitigate the consequences of an uncontrolled release occurring within a hot cell, as well as the off-site consequences of releasing fission products through the ventilation system, the confinement barrier utilizes an active component in the form of bubble-tight isolation dampers (safety-related) on the inlet and outlet ventilation ports of each hot cell. This ESF effectively reduces the amount of ductwork in the confinement volume that needs to remain intact to achieve hot cell confinement. These dampers close automatically (fail-closed) upon loss of power or receipt of a confinement isolation signal generated by the RICS. Following an initiating event, the RICS isolates the hot cells. Refer to Section 7b for a description of the RICS.

Overall performance assurance of the active confinement components is achieved through factory testing and in-place testing. Duct and housing leak tests are performed in accordance with ASME N511, with minimum acceptance criteria as specified in ASME AG-1 (ASME, 2009).

Specific owners requirements with respect to acceptable leak rates are based on the safety analyses.

Berms employ a passive confinement methodology. Passive confinement is achieved through a continuous boundary between the hazardous materials and the surrounding area. In the event of an accidental release, the hazardous liquid is confined to limit the exposed surface area of the liquid.

6b.2.1.3 Functional Requirements Active confinement components are designed to fail into a safe state if conditions such as loss of signal, loss of power, or adverse environments are experienced.

Mechanical, instrumentation, and electrical systems and components required to perform their intended safety function in the event of a single failure are designed to include sufficient redundancy and independence such that a single failure of any active component does not result in a loss of the capability of the system to perform its safety functions.

Mechanical, instrumentation, and electrical systems and components are designed to ensure that a single failure, in conjunction with an initiating event, does not result in the loss of the systems ability to perform its intended safety function. The single failure considered is a random failure and any consequential failures in addition to the initiating event for which the system is required and any failures that are a direct or consequential result of the initiating event.

The design of safety-related systems (including protection systems) is consistent with IEEE Standard 379-2000 and Regulatory Guide 1.53 in the application of the single-failure criterion.

Berms are designed to hold the entire contents of the container in the event that the container fails.

SHINE Medical Technologies 6b-5 Rev. 2

Radioisotope Production Facility Engineered Chapter 6 - Engineered Safety Features Safety Features Technical Specifications Table 6b.2-1 Radioisotope Production Facility Confinement Safety Functions System, Structure, Component Description Classification RVZ1 hot cell isolation Provide confinement isolation at hot SR dampers, ductwork up to cell boundaries filters and filters RVZ2 isolation dampers, Provide confinement isolation at RCA SR ductwork up to filters and boundary filters RICS Provides confinement isolation signal SR Isolation valves on piping Provide confinement at hot cell SR systems boundaries Hot cells, tank vaults, berms Provides confinement SR and pipe trenches SHINE Medical Technologies 6b-10 Rev. 2

Chapter 7 - Instrument & Control Systems Design of ICS

2) The safety program shall ensure that each SR SSC will be available and reliable to perform its intended safety function when needed.

The RICS trip and alarm annunciation are protective functions and are part of the overall protection and safety monitoring systems for the RPF. The specific equipment design basis for the instrumentation and equipment used for the RICS trip and alarming functions are discussed in Section 7b.2.2.

The following discussion relates to the design bases utilized for monitoring specific signal values for RPF trips and alarms, the requirements of performance, the requirements for specific modes of operation of RPF and RICS and the design criteria documents generating the basis noted as a citation.

7b.2.4.1.1 Safety Functions and Corresponding Protective/Mitigative Actions for Design Basis Events Citation - Section 4a and 4b of IEEE-603-2009 The results of the accident analysis for the RPF SSCs are discussed in Section 13b. Conditions that require monitoring and the subsequent action to be taken are detailed in Section 13b.

SR components identified in Section 13b, including the ESFs described in 6b, are monitored and controlled by RICS, as required.

7b.2.4.1.2 Variable Monitored to Control Protective/Mitigative Action Citation - Section 4d of IEEE-603-2009 The following variables are monitored for RPF trip for isolation:

  • The hot cell fire detection and suppression system (HCFD) is monitored for actuation. If tripped, the hot cell is isolated by the ventilation inlet and outlet dampers. This is not a SR Function.
  • The facility fire protection system (FFPS) is monitored for actuation. If tripped, the RCA confinement zone of the affected area is isolated by the zone bubble-tight dampers. This is not a SR function.
  • Hot cell gamma detectors are monitored in the hot cell. If acceptable gamma levels are exceeded, the hot cell is isolated by the ventilation inlet and outlet bubble-tight dampers.

The following is a preliminary list of variables to be monitored in the RPF for alarming to eliminate or reduce the exposure for the operator. The final list of variables to be monitored will be provided in the FSAR.

  • Hot cell temperature - internal environment.
  • Hot cell pressure - internal environment.
  • Uranyl nitrate conversion system (UNCS) outlet temperature - process upset.
  • Radioactive drain system (RDS) sump level - contamination exposure.
  • Primary vessel vent system (PVVS) pressure - internal environment.
  • PVVS flow - internal environment.
  • RCA confinement zone pressure - contamination exposure.

SHINE Medical Technologies 7b-18 Rev. 2

Chapter 7 - Instrument & Control Systems ESF Actuation System 7b.4 ENGINEERED SAFETY FEATURE AND ALARMING 7b.4.1 SYSTEM DESCRIPTION Process control ESFs within the RPF are activated by the RICS. An RPF ESF actuation system does not exist as a standalone system. The RICS performs the following ESF actuation functions:

  • For hot cells, gloveboxes, or other cells (including the noble gas storage cell) that require isolation in the RPF, the RICS monitors parameters designated SR and when appropriate, actuates the ESF for the hot cells, gloveboxes, or other cells. The ESFs that are actively controlled are the isolation inlet and outlet bubble-tight dampers and isolation valves for other penetrations into the enclosure that are determined to require isolation during the final safety analysis. Upon recognition of an off-normal SR parameter, the RICS de-energizes the dampers and isolation valves in the system and the dampers and valves move to a closed safe-state for the affected hot cell, glovebox, or other cell. The ESF dampers and isolation valves within the RPF are designed as fail-closed dampers so that any loss of power results in closure and subsequent isolation of the hot cell, glovebox, or other cell.
  • For the RCA ventilation system in the RPF, the RICS monitors parameters designated as SR and when appropriate, actuates the ESF for the specific RCA ventilation system zone.

For the RCA ventilation system zones, the ESFs that are actively controlled are the inlet and outlet bubble-tight dampers for each zone. Upon recognition of a SR parameter exceeding acceptable limits for isolation, the RICS de-energizes the dampers in the system and the bubble-tight dampers move to a closed safe-state for the affected ventilation zone. The bubble-tight dampers within the RCA zone ventilation system are designed as fail-closed dampers so that loss of power results in closure of the damper and subsequent isolation of the RCA ventilation system zone.

  • The internal logic of the RICS monitors the ESF and provides assurance that the ESF activation goes to completion. The ESF is reset by the operator from the RICS HMI display. The RICS is described in Subsection 7b.2.3.

7b.4.1.1 RICS Trips Description (Functional Performance)

This section identifies the monitored parameters and describes the events for initiating an ESF.

The monitoring and control functions are described on a parameter by parameter basis in the following.

The RICS performs two one automated initiations of ESFs., One is for mitigation of fire and the other for mitigation of radiation contamination. Additionally, in In the event of an activation of the HCFD or the FFPS, the RICS activates dampers to isolate affected areas. The FFPS and HCFD isolation functions are not an SR functions. The other automated response occurs when an active radiation monitored parameter within the isolable cell exceeds a trip level setting. In the case of an individual hot cell, glovebox, or other cell the RICS activates the ESF for bubble-tight damper isolation of the affected hot cell, glovebox, or other cell.

SHINE Medical Technologies 7b-31 Rev. 2

Chapter 7 - Instrument & Control Systems ESF Actuation System 7b.4.1.1.1 HCFD Activation Trip The RICS monitors signals from the HCFD for the individual cell or glovebox. There are two independent signals coming from the HCFD. These signals input to the RICS. The RICS activates the isolation of the cell or glovebox whenever the 1oo2 voted inputs indicate that the HCFD is tripped. The ESF ventilation inlet and outlet isolation dampers close upon HCFD activation in a cell or glovebox. The trip is automatic and not delayed., and is not considered SR, as it duplicates the function performed by gamma detectors for the mitigation of radioactive releases.

7b.4.1.1.2 Hot Cell and other Process Cell Ventilation High Gamma Trip The RICS monitors signals from redundant gamma detectors installed in the ventilation of the individual cells or gloveboxes. Each detector provides an independent channel to the RICS. The RICS activates the ESF for the cell or glovebox whenever the 1oo2 voted signal inputs indicate that the gamma detectors have exceeded the high level setpoint. The ESF ventilation inlet and outlet isolation dampers close upon high gamma detection. The trip is automatic and not delayed.

7b.4.1.1.3 RICS Manual Trip There is a manual trip emergency switch at each hot cell or other confinement zone. Each emergency switch provides the ability for the operator to manually isolate the individual hot cell or confinement zone. The trip of this switch initiates the activation of the ESF inlet and outlet dampers for the individual hot cell or confinement zone independent of the RICS status.

7b.4.1.1.4 RICS Manual Trip Reset Once the isolation for a cell or glovebox has been manually activated, it takes an operator to manually reset the ESF at the hot cell or confinement zone. This is done by resetting the manual switch for the specific ESF.

7b.4.1.1.5 RICS Automatic Trip Reset Once the isolation for a cell or glovebox has been automatically activated, it takes an operator to manually reset the ESF logic within the RICS. This is done from the RICS display panel using the ESF reset switch for the specific ESF on the HMI. The ESF is reset by the RICS.

7b.4.1.2 RICS Alarm Description (Functional Performance)

This subsection identifies the monitored parameters and describes the events for initiating an alarm to the operator as a possible contamination event.

The following subsections describe the preliminary list of variables to be monitored in the RPF for alarming to eliminate or reduce the radiation exposure for the operator. The final list of variables to be monitored will be provided in the FSAR.

SHINE Medical Technologies 7b-32 Rev. 1

Chapter 8 - Electrical Power Systems Emergency Electrical Power Systems isolation between the non-1E NPSS and Class 1E 250 VDC. The AC input breakers on both battery chargers and voltage regulating transformers are qualified as isolation devices using guidance from IEEE 384 (IEEE, 2008).

Each of the redundant Class 1E battery subsystems is capable of delivering required emergency power for the required duration during facility normal and abnormal operations. The scope of compliance encompasses physical separation, electrical isolation, equipment qualification, effects of single active component failure, capacity of battery, battery chargers, instrumentation, protective devices, and surveillance test requirements. Each of the Class 1E battery subsystems is separately housed in a seismically qualified Seismic Category I structure.

Class 1E battery subsystem equipment sizing is designed using guidance from IEEE 485 (IEEE, 2010a) and IEEE 946 (IEEE, 2004a).

8a2.2.3 SHINE FACILITY SYSTEMS SERVED BY THE CLASS 1E UPSS

  • TRPS - TSV reactivity protection system (Section 7a2.4)
  • TRPS/HMI - TSV reactivity protection system/human machine interface (Subsection 7a2.6.8)
  • NFDS - neutron flux detection system (Subsection 7a2.4.3)
  • PVVS - process vessel vent system blower (Section 9b.6.1)
  • HCFD - hot cell fire detection and suppression system (Subsection 9a2.3.4.4.2.4)
  • CAMS - continuous air monitoring system (Subsection 7a2.7.4.1)
  • RAMS - radiation area monitoring system (Subsection 7a2.7.4.2)
  • CAAS - criticality accident and alarm system (Section 7b.6)
  • RICS - radiological integrated control system (Section 7b.2.3)
  • ESFAS - engineered safety features actuation system (Section 7a2.5)
  • ESFAS/HMI - engineered safety features actuation system/human machine interface (Subsection 7a2.5.2)
  • TOGS - TSV off-gas system (Section 4a2.8) 8a2.2.4 NONSAFETY-RELATED LOADS The SHINE facility Class 1E UPSS is primarily designed to serve facility essential monitoring and control functions and safe shutdown of the irradiation units. Under normal operating conditions, a limited use for nonsafety-related loads may be acceptable after approved analysis is established that such use has no adverse impact on the safety function of the system. The non-Class 1E circuits are designed with the independence and isolation guidance from IEEE 384 (IEEE, 2008).

8a2.2.5 MAINTENANCE AND TESTING Maintenance and testing of the UPSS is designed using guidance from IEEE 450 (IEEE, 2010b) and IEEE 336 (IEEE, 2010c).

SHINE Medical Technologies 8a2-10 Rev. 1

Chapter 8 - Electrical Power Systems Emergency Electrical Power Systems 8a2.2-1 UPSS Load List(a)

Nominal Connected Nominal Load Demand Load Description (kW) Load (kW)

TSV Reactivity Protection System (TRPS) 7.20 7.20 Hot Cell Fire Detection and Suppression System (HCFD)(b) 1.2 1.2 Neutron Flux Detection System (NFDS) 1.2 1.2 Continuous Air Monitoring System (CAMS) 2.40 2.40 Radiation Area Monitoring System (RAMS) 2.40 2.40 Criticality Accident and Alarm System (CAAS) 2.40 2.40 Radiological Integrated Control System (RICS) 3.60 3.60 Engineered Safety Features Actuation System (ESFAS) 7.20 7.20 TSV Off-Gas System (TOGS) Recirculating Blower 5.57 13.92 Human Machine Interface (HMI)/ESFAS 2.40 2.40 Process Vessel Vent System (PVVS) Blower 5.57 13.92 HMI/TRPS 3.60 3.60 UPSS Total Nominal Demand Load 61.44 kW a) Load information above is for a single train. The same loads apply to the redundant UPSS train.

b) The hot cell fire detection system (HCFD) is defined as SR. At final design a determination will be made whether additional components of the FFPS/HCFD systems will be safety-related.

SHINE Medical Technologies 8a2-13 Rev. 2

Chapter 9 - Auxiliary Systems Fire Protection Systems and Programs 9a2.3.4.4.2.4 Fire Detection and Alarm Systems Fire alarm and detection systems are provided throughout the SHINE facility and are designed, installed, located, inspected, tested, and maintained in accordance with NFPA 72, National Fire Alarm and Signaling Code (NFPA, 2013e).

Fire detection is provided as part of the facility fire detection and suppression system (FFPS) and the hot cell fire detection and suppression system (HCFD). The HCFD provides fire detection and suppression capabilities for the supercells and the hot cells in the RPF. Fire detectors in the HCFD send a signal to isolate the fire-rated dampers in the supercells and the hot cells in the event of a fire in one of these cells. These dampers reduce the potential release of radioactive materials from the hot cell or supercell due to a fire (see Subsection 13b.2.6) prevent the spread of fire from the hot cell or supercell. The fire detection in the HCFD is classified as SR non-safety related, since radiation detectors and associated interlocks with bubble-tight dampers controlled by RICS perform the SR function of reducing potential release of radioactive materials from the hot cell or supercell due to a fire. The suppression subsystem of the HCFD is classified as nonsafety-related.

The fire detection in the rest of the SHINE facility is part of the FFPS. The FFPS is classified as nonsafety-related.

9a2.3.4.4.3 Fire Barriers and Protection of Penetrations The SHINE facility is generally of reinforced concrete construction. The walls, floors, and ceilings have a 3-hour fire resistive rating where required by a high combustible loading in the room or where adjacent room contains equipment or systems from a different safety train. Stair towers which do not communicate between areas of different divisions may have walls and doors with a 2-hour fire rating for personnel protection during egress from the areas. Non-concrete interior walls are constructed of metal studs and gypsum wallboard to the required fire resistive rating.

The areas within the SHINE facility are subdivided into separate fire areas for the purposes of limiting the spread of fire, protecting personnel, and limiting the consequential damage to the SHINE facility. Determination of fire area boundaries is based on consideration of the following:

  • Types, quantities, density, and location of combustible materials.
  • Location and configuration of equipment.
  • Location of fire detection and suppression systems.
  • Personnel safety/exit requirements.
  • Location of major electrical equipment.
  • Location of process confinement areas.
  • Location of storage areas.
  • Separation of office areas from adjacent areas.

Three-hour fire-rated barriers separate the individual fire areas within the SHINE facility. Fire barrier design and construction is in accordance with NRC regulations and NFPA 221, Standard for High Challenge Fire Walls, Fire Walls, and Fire Barrier Walls (NFPA, 2012f).

Where fire-rated assemblies are partially or fully penetrated by pipes, ducts, conduits, raceways or other such penetrates, fire barrier penetration material is placed in and around the SHINE Medical Technologies 9a2-25 Rev. 2

Chapter 13 - Accident Analysis Table of Contents CHAPTER 13 ACCIDENT ANALYSIS Table of Contents Section Title Page 13a1 HETEROGENEOUS REACTOR ACCIDENT ANALYSIS......................13a1-1 13a2 IRRADIATION FACILITY ACCIDENT ANALYSIS .................................13a2-1 13a2.1 ACCIDENT-INITIATING EVENTS AND SCENARIOS...........................13a2-1 13a2.1.1 MAXIMUM HYPOTHETICAL ACCIDENT ..............................................13a2-2 13a2.1.2 INSERTION OF EXCESS REACTIVITY/INADVERTENT CRITICALITY .........................................................................................13a2-4 13a2.1.3 REDUCTION IN COOLING....................................................................13a2-8 13a2.1.4 MISHANDLING OR MALFUNCTION OF TARGET SOLUTION ............13a2-11 13a2.1.5 LOSS OF OFF-SITE POWER................................................................13a2-13 13a2.1.6 EXTERNAL EVENTS .............................................................................13a2-15 13a2.1.7 MISHANDLING OR MALFUNCTION OF EQUIPMENT AFFECTING THE PSB...........................................................................13a2-16 13a2.1.8 LARGE UNDAMPED POWER OSCILLATIONS....................................13a2-18 13a2.1.9 DETONATION AND DEFLAGRATION IN PRIMARY SYSTEM BOUNDARY ...........................................................................13a2-20 13a2.1.10 UNINTENDED EXOTHERMIC CHEMICAL REACTIONS OTHER THAN DETONATION ...............................................................13a2-22 13a2.1.11 PRIMARY SYSTEM BOUNDARY SYSTEM INTERACTION EVENTS .................................................................................................13a2-22 13a2.1.12 FACILITY-SPECIFIC EVENTS ..............................................................13a2-29 13a2.2 ACCIDENT ANALYSIS AND DETERMINATION OF CONSEQUENCES.................................................................................13a2-36 13a2.2.1 TARGET SOLUTION RELEASE INTO THE IU CELL ...........................13a2-36 13a2.2.2 EXCESS REACTIVITY INSERTION ACCIDENT...................................13a2-44 13a2.2.3 REDUCTION IN COOLING....................................................................13a2-48 13a2.2.4 MISHANDLING OR MALFUNCTION OF TARGET SOLUTION ............13a2-498 13a2.2.5 LOSS OF OFF-SITE POWER................................................................13a2-51 13a2.2.6 EXTERNAL EVENTS .............................................................................13a2-52 13a2.2.7 MISHANDLING OR MALFUNCTION OF EQUIPMENT AFFECTING THE PSB...........................................................................13a2-52 13a2.2.8 LARGE UNDAMPED POWER OSCILLATION ......................................13a2-56 13a2.2.9 DETONATION AND DEFLAGRATION IN PRIMARY SYSTEM BOUNDARY ...........................................................................13a2-56 13a2.2.10 UNINTENDED EXOTHERMIC CHEMICAL REACTIONS OTHER THAN DETONATION ...............................................................13a2-57 13a2.2.11 PRIMARY SYSTEM BOUNDARY SYSTEM INTERACTION EVENTS .................................................................................................13a2-57 SHINE Medical Technologies 13-i Rev. 1

Chapter 13 - Accident Analysis Table of Contents Table of Contents (contd)

Section Title Page 13a2.2.12 FACILITY-SPECIFIC EVENTS ..............................................................13a2-57 13a3

SUMMARY

AND CONCLUSIONS .........................................................13a3-1 13a4 REFERENCES.......................................................................................13a4-1 13b RADIOISOTOPE PRODUCTION FACILITY ACCIDENT ANALYSES ............................................................................................13b-1 13b.1 RADIOISOTOPE PRODUCTION FACILITY ACCIDENT ANALYSIS METHODOLOGY ................................................................13b-1 13b.1.1 PROCESSES CONDUCTED OUTSIDE OF THE IRRADIATION FACILITY................................................................................................13b-1 13b.1.2 ACCIDENT INITIATING EVENTS..........................................................13b-3 13b.2 ANALYSES OF ACCIDENTS WITH RADIOLOGICAL CONSEQUENCES.................................................................................13b-4 13b.2.1 MAXIMUM HYPOTHETICAL ACCIDENT IN THE RPF .........................13b-4 13b.2.2 LOSS OF CONTAINMENT ....................................................................13b-12 13b.2.3 EXTERNAL EVENTS .............................................................................13b-13 13b.2.4 CRITICAL EQUIPMENT MALFUNCTION..............................................13b-14 13b.2.5 INADVERTENT NUCLEAR CRITICALITY IN THE RADIOISOTOPE PRODUCTION FACILITY ..........................................13b-234 13b.2.6 RADIOISOTOPE PRODUCTION FACILITY FIRE.................................13b-320 13b.3 ANALYSIS OF ACCIDENTS WITH HAZARDOUS CHEMICALS PRODUCED FROM LICENSED MATERIAL .........................................13b-397 13b.3.1 CHEMICAL ACCIDENTS DESCRIPTION .............................................13b-397 13b.3.2 CHEMICAL ACCIDENT CONSEQUENCES..........................................13b-431 13b.3.3 CHEMICAL PROCESS CONTROLS .....................................................13b-454 13b.3.4 CHEMICAL PROCESS SURVEILLANCE REQUIREMENTS................13b-465 13b.4 REFERENCES.......................................................................................13b-521 SHINE Medical Technologies 13-ii Rev. 1

Chapter 13 - Accident Analysis List of Tables List of Tables Number Title 13a2.2.1-1 Material at Risk for TSV Source Term 13a2.2.1-2 Parameters Used in the Dose Consequence Assessment 13a2.2.1-3 Public and Worker LPF for each DBA 13a2.2.1-4 Airborne Release and Respirable Fractions for each DBA 13a2.2.7-1 Material at Risk for TOGS Source Term 13a3-1 Potential Consequences of Postulated Accidents in the Irradiation Facility 13a3-2 Irradiation Operations Safety Controls and Accident Applicability 13b.2.1-1 Source Terms for NGRS Storage Tanks 13b.2.1-2 Parameters Used in the Dose Consequence Assessment 13b.2.1-3 Public and Worker LPF for each DBA 13b.2.1-4 Airborne Release and Respirable Fractions for each DBA 13b.2.4-1 MAR for NGRS Storage Tank 13b.2.5-1 Safety-Related SSCs and Technical Specification Administrative Controls (IROFS) to Prevent and Mitigate Criticality Accidents 13b.2.6-1 Material at Risk for RPF Fire Source Term 13b.3-1 Bounding Inventory (lbs) of Significant Process Chemicals 13b.3-2 SHINE Toxic Chemical Source Terms and Concentrations SHINE Medical Technologies 13-iii Rev. 1

Chapter 13 - Accident Analysis Acronyms and Abbreviations Acronyms and Abbreviations Acronym/Abbreviation Definition ARF airborne release fraction AHR aqueous homogenous reactor AMSB ambient molecular sieve bed BR breathing rate BV building volume CAMS continuous air monitoring system CAAS criticality accident and alarm system CEDE committed effective dose equivalent DCF dose conversion factors DCS DC power supply system DDT deflagration detonation transition DBA design basis accident DBT design basis tornado DID defense in depth DR damage ratio DV dispersion value keff effective neutron multiplication factor EDE external dose equivalent ESF engineered safety feature FFPS facility fire detection and suppression system FVZ4 facility ventilation Zone 4 FSAR Final Safety Analysis Report FHA Fire Hazard Analysis GDC General Design Criterion H/X moderator to fissile material ratio SHINE Medical Technologies 13-v Rev. 1

Chapter 13 - Accident Analysis Acronyms and Abbreviations Acronyms and Abbreviations Acronym/Abbreviation Definition HAZOPS hazard and operability study HRR heat release rate HEPA high efficiency particulate air HGL hot gas layer HMI human machine interface IE initiating event IF irradiation facility ISA integrated safety analysis ISG interim staff guidance IU irradiation unit IROFS items relied upon for safety L liter LOOP loss of off-site power LEU low enriched uranium LFL lower flammability limit LPF leak path factor LWPS light water pool system MAR material at risk MHA maximum hypothetical accident Mo-99 molybdenum-99 NDAS neutron driver assembly system NGRS noble gas removal system NSR non-safety related NPSS normal electrical power supply system PCLS primary closed loop cooling system PDP positive displacement pump SHINE Medical Technologies 13-vi Rev. 1

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis

  • Mishandling or malfunction of equipment affecting PSB (Subsection 13a2.2.7).
  • Tritium purification system design basis accident (Subsection 13a2.2.12.3).

Further analysis of the above DBAs involved: (1) Identification of the limiting IE and bounding conditions, (2) Reviewing the sequence of events for functions and actions that change the course of the accident or mitigate the consequences, (3) Identifying damage to equipment or the facility that affects the consequences of the accident, (4) Review of the potential radiation source term and radiological consequences, and (5) Identification of facility-wide safety controls to prevent or mitigate the consequences of the accident.

Results of these analyses in Subsection 13a2.2, taking credit for safety-related SSCs and engineered safety features (ESFs) for each DBA, demonstrate that the mitigated consequences do not exceed the dose limits in 10 CFR 20.

13a2.1.1 MAXIMUM HYPOTHETICAL ACCIDENT In accordance with the guidance in the Final ISG Augmenting NUREG-1537, an MHA that bounds the potential radiological consequences of any accident considered to be credible is analyzed. The basis for selecting an MHA includes assumptions from the ISA Summary described below.

The SHINE facility is divided into two major process areas, the IF and the RPF areas. The IF includes eight IUs each containing, among other components, an SCAS (including the TSV and TSV dump tank), light water pool system (LWPS), and the TSV off-gas system (TOGS). The TSV, TOGS, TSV dump tank, and associated components make up the PSB. The RPF consists of several process areas that extract and purify the molybdenum-99 (Mo-99) product, recycle uranium, and extract other fission products. These include the molybdenum extraction cells, the purification cells, the uranium extraction (UREX) process cells, thermal denitration (TDN) cells, and waste processing areas. A supercell is comprised of a molybdenum extraction area, a purification area, and a packaging area that form one hot cell structure. The RPF contains three supercells.

The MHA is used to demonstrate that the maximum consequences in operating the facility at a specific site are within acceptable regulatory limits of 10 CFR 20.1201 and 10 CFR 20.1301. The MHA is a non-credible accident scenario that results in a release with radiological consequences that bound the DBAs. The Final ISG Augmenting NUREG-1537 specifies several possible MHAs that could be considered.

13a2.1.1.1 Initial Conditions and Assumptions Potential MHA scenarios suggested by the Final ISG Augmenting NUREG-1537 include:

  • Energetic dispersal of contents of the PSB with bypass of scrubbing capacity.
  • Detonation of hydrogen in the recombiner resulting in waste gas tank failure and release of some or all of the target solution and fission-product contents in aerosolized form.
  • Complete loss of target solution inventory (e.g., TSV break).
  • Man-made external event that breaches the PSB of more than one IU.
  • Facility-wide external event that breaches various systems containing radioactive fluids.

SHINE Medical Technologies 13a2-2 Rev. 1

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis 13a2.1.1.2 General Scenario Description Irradiation Facility Postulated MHA The IF postulated MHA general scenario is a release of irradiated target solution to the IU cell as a result of a loss of TSV integrity. No credit is taken for light water pool scrubbing or subcritical assembly support structure (SASS) confinement. Therefore, the first mitigating safety feature is the robust IU cell structure. Because of this robust design, the structure remains intact and confines a majority of the inventory released from the TSV within the IU cell.

The release of irradiated target solution into the IU cell could result in a release to the environment through the facility stack via the RVZ1 flow path. Under accident conditions, the release is mitigated by filters in the RVZ1 and isolation of the IU cell by inlet and outlet dampers.

Radioisotope Production Facility Postulated MHA For the MHA postulated scenario in the RPF, the greatest potential radiological release would be the failure of the five NGRS storage tanks. The result for this scenario is a release of inventory of noble gases from NGRS storage tanks into the noble gas storage cell. The first mitigating safety feature is the robust noble gas storage cell structure that includes the thick concrete walls and ceiling that surround the five noble gas storage tanks. Because of the robust design, the storage cell structure remains intact and confines a majority of the inventory release of the NGRS storage tanks to within the noble gas storage cell. Therefore, the release is mitigated by a holdup of the noble gases in the storage cell, resulting in their further decay before further release.

The release of the noble gas inventory into the NGRS storage cell could result in a radioisotope release to the environment through the facility stack via the RVZ1 flow path. The release is mitigated by isolation of the noble gas storage cell by inlet and outlet dampers on abnormally high radiation levels. HEPA and charcoal filters in RVZ1 are ineffective in the mitigation of accidents involving a release of noble gases.

Based on the detailed consequence analysis in Subsections 13a2.2.1 and 13b.2.1, the RPF postulated MHA provides the bounding consequences to the public. Therefore, this is determined to be the MHA for the SHINE facility.

13a2.1.2 INSERTION OF EXCESS REACTIVITY/INADVERTENT CRITICALITY Both the Final ISG Augmenting NUREG-1537 and the ISA Summary identify have identified the insertion of excess reactivity during normal operations as a potential IE/scenario category that needs to be evaluated as part of the accident analysis. Furthermore, the ISA Summary also identifies identified the potential for an inadvertent criticality during the startup process of the TSV as a scenario that needs to be evaluated.

Three operating conditions were evaluated for the TSV: (1) fill operations with uranyl sulfate (clean or previously irradiated) solution, (2) cold target solution immediately prior to neutron driver startup, and (3) irradiation operations once the neutron driver is started. For the subcritical TSV, excess reactivity is defined as an amount of potential added reactivity above normal conditions.

SHINE Medical Technologies 13a2-4 Rev. 1

[Proprietary Information - Withhold from public disclosure under 10 CFR 2.390(a)(4)]

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis Scenario C - Loss of or Reduced PCLS and LWPS Flow This final scenario assumes both a loss of PCLS and LWPS flow with continued operation of the neutron driver. This could be as a result of failure or damage to electrical supply at a common supply point. It could also be as a result of operator error, coupled with other failures that result in continued operation of the neutron driver or a common mode failure that would result in piping failures in both systems, such as a seismic event. If any of these accidents were to occur, the heat load would be transferred to the light water pool.

13a2.1.4 MISHANDLING OR MALFUNCTION OF TARGET SOLUTION The TSV uses a liquid target solution that generates fission products that are contained by the PSB. The accidents involving the mishandling or malfunction of the target solution, including a failure of the PSB within the IF, are analyzed here. Mishandling or malfunction of target solution within the RPF are addressed in Subsection 13b.2.4.

Within the boundaries of the IF, the target solution is contained in the target solution hold tank, TSV, the TSV dump tank, and associated connected piping. The irradiated target solution transfer pump is also located within the IF, so a malfunction or mishandling of this pump is considered. Note that the TOGS, PCLS, and LWPS are located in the IF, but the mishandling or malfunction of these systems is addressed in Subsections 13a2.1.7 and 13a2.1.3. Also, the insertion of excessive reactivity and inadvertent criticality events involving the target solution are discussed in Subsection 13a2.1.2.

13a2.1.4.1 Identification of Causes, Initial Conditions, and Assumptions The Final ISG Augmenting NUREG-1537 and the ISA Summary identify have identified several initiators: namely, failure to control pH of the target solution, failure to control solution temperature and failure to control solution pressure. The ISA Summary and associated hazard analyses (HAZOPS/PHA) identified several potential IE including:

  • Failure to control pH of the target solution leading to TSV corrosion ultimately leading to spills or leakage outside the TSV and tanks.
  • Excessive cooling of target solution (addressed in Subsection 13a2.1.2).
  • Failure to control pressure thereby initiating target solution boiling (addressed in Subsection 13a2.1.2).
  • Failure of pumps, valves, piping, and tanks.
  • Operator errors associated with inadvertently overflowing tanks or misdirecting flow.

The initial conditions and assumptions associated with mishandling or malfunction of target solution include:

  • Each TSV is operated on a 5.5-day irradiation cycle with an additional [ Proprietary Information ] residence for the target solution in the TSV dump tank following irradiation to allow for decay of short-lived radioisotope fission products.
  • The MAR for this event is conservatively taken to be the TSV inventory at shutdown, following the fourth irradiation cycle. Due to the dump tank being at approximately atmospheric pressure and the slow rate at which solution is pumped from the dump tank, only 25 percent of TSV inventory is assumed to leak to the IU cell prior to facility evacuation.

SHINE Medical Technologies 13a2-11 Rev. 1

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis

  • The TSVs are operated independently, so that an event on one TSV does not affect another TSV or IU cell.
  • Irradiation and target solution transfer operations of the TSVs are controlled by operators.

The mishandling or malfunction of equipment in these systems could potentially result in a spill or a misdirection of the target solution outside of the primary system boundary.

  • The IU cells are isolated from the rest of the facility by robust walls, ceiling, and floor.
  • Penetrations for piping, ducts and electrical cables, and airlocks are sealed within specifications to limit the release of radioactive materials from the facility.
  • Piping systems that are open to the atmosphere of the IU or TOGS shielded cell are isolable by means of redundant, automatic isolation valves or by dual, normally closed manual valves.
  • Ventilation ducts are isolable from the exhaust stack by means of bubble-tight dampers.
  • The RCA ventilation system during normal operations maintains the IU cell at a negative pressure with respect to the rest of the facility.
  • Tanks and piping that have the potential to contain fissile material, except the TSV, are designed with passive measures that prevent an inadvertent criticality of the target solution.
  • Sumps and drains that lead from the pipe trenches and tank vaults are designed with a geometry that prevents an inadvertent criticality of the leaked target solution.
  • RVZ1 is equipped with radiation monitoring to activate the isolation dampers prior to the release of excessive radioactive material.

13a2.1.4.2 General Scenario Description There are four general scenarios that are identified as mishandling or malfunction of the target solution within the IF. Each of these is distinguished from the others by where the target solution is directed. These four scenarios are: TSV overfill, TSV or dump tank leak into the light water pool, TSV leak into the primary cooling system, and a dump tank leak into the IU cell. Each of these scenarios and their potential causes are discussed below:

  • Scenario 1 - TSV Overfill A TSV overfill flows into the dump tank through the TSV overflow lines. TSV level detection is also installed to alert the operator to any TSV overfill conditions. The reactivity insertion from this event is analyzed earlier in Subsection 13a2.1.2. Other than the consequences discussed in 13a2.2.2, this would only result in a process upset.
  • Scenario 2 - TSV or Dump Tank Leak Into the Light Water Pool Leakage from the TSV or TSV dump tank into the light water pool could occur due to corrosion of the TSV, dump line, dump valves, or TSV dump tank. For a TSV leak, a leak in the PCLS would also have to occur in order for the target solution to reach the light water pool. In this scenario, the target solution leakage would be contained in the LWPS and IU cell where it would be contained from any workers in the facility. High area radiation monitor levels would alert the operators for significant leaks of target solution into the light water pool, while periodic sampling of the pool water is utilized to detect very small leaks and initiate corrective action. Dilution of the target solution and the geometry of the light water pool would prevent an inadvertent criticality.

SHINE Medical Technologies 13a2-12 Rev. 1

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis 13a2.1.5.2 General Scenario Description As noted in Subsection 13a2.1.5.1, the worst case scenario is a LOOP. Although the interruption of off-site power is expected to be relatively brief, it is assumed for this analysis that off-site power remains unavailable for an extended period of time. This could potentially occur if the LOOP is due to severe weather or a seismic event that damages substation equipment or associated transmission lines.

The sequence of events for a LOOP is as follows:

  • The UPSS automatically maintains power to the 120 VAC UPS buses A & B, supplying power to the equipment listed in Subsection 8a2.2.3.
  • A LOOP results in the shutdown of all neutron drivers and associated irradiation operations and RPF operations. The uranyl sulfate solution in the operating TSVs drains to their respective TSV dump tanks, as designed.
  • The TSV and primary cooling systems (PCLS and LWPS) lose power to their pumps.

Forced convection cooling ceases and heat is removed by natural convection to the light water pool.

  • The neutron driver assembly system (NDAS) and the tritium purification system (TPS) equipment becomes de-energized on a LOOP. Neither of these systems are required for the safe shutdown of the SHINE facility. Both of these systems contain tritium, which remains contained within their respective pressure boundaries.
  • Hydrogen generation continues to occur due to radiolysis from the decay of fission products. The 120 VAC UPS buses provide backup power to the TOGS.
  • The UPSS supplies essential facility loads for a duration of two hours. The 120 VAC UPS buses automatically maintain power to essential instrumentation and equipment. This includes the TOGS equipment needed to control the build-up of hydrogen.
  • Radiation monitoring systems of the facility continue to operate.

13a2.1.6 EXTERNAL EVENTS The following potential external events have been identified as DBAs for the SHINE facility:

  • Seismic event affecting the IF and RPF (see Section 3.4).
  • Tornado or high-winds affecting the IF and RPF (see Section 3.2).
  • Small aircraft crash into the IF or RPF (see Section 3.4.5).

Plant SSCs, including their foundations and supports, that are designed to remain functional in the event of a design basis earthquake (DBEQ) are designated as Seismic Category I, as indicated in Table 3.5-1. SSCs designated SR or IROFS are classified as Seismic Category I.

SSCs whose failure as a result of a DBEQ could impact an SSC designated as SR or IROFS are classified as Seismic Category I. SSCs that must maintain structural integrity post-DBEQ, but are not required to remain functional are Seismic Category II.

All Seismic Category I SSCs are analyzed under the loading conditions of the DBEQ and consider margins of safety appropriate for that earthquake. The margin of safety provided for safety class SSCs for the DBEQ are sufficient to ensure that their design functions are not jeopardized. For further details of seismic design criteria refer to Section 3.4.

SHINE Medical Technologies 13a2-15 Rev. 1

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis The SHINE production facility building is designed to survive credible wind and tornado loads, including missiles, as described in Section 3.2 and Subsection 3.4.2.6. It is also designed to withstand credible aircraft impacts as discussed in Subsection 3.4.5.

Due to the facility design, there are no consequences to the workers or the public for postulated external events.

13a2.1.7 MISHANDLING OR MALFUNCTION OF EQUIPMENT AFFECTING THE PSB Mishandling or malfunction of equipment has been identified explicitly by the Final ISG Augmenting NUREG-1537 as a category of IEs or accident scenarios that need to be evaluated for potential impact on the PSB, and these scenarios merit additional quantitative analysis.

Furthermore, the Final ISG Augmenting NUREG-1537 and the ISA Summary identify have identified several potential scenarios under this category: namely, failure of the TOGS, leading to release of noble gases and halogens. The accidents involving the mishandling or malfunction of the liquid systems or loss of the pressure boundary are analyzed in Subsection 13a2.1.4. The loss of vessels and line failures for systems within the RPF are analyzed in Subsection 13b.2.4.

The analysis of the mishandling or malfunction of equipment affecting the PSB is, therefore, limited to those systems handling the gaseous radioactive products resulting from irradiation of the target solution and to the neutron driver and its support systems.

13a2.1.7.1 Identification of Causes, Initial Conditions, and Assumptions The ISA Summary and associated HAZOPS/PHA identified several potential IEs for mishandling or malfunction of equipment within the PSB, including failure of valves and tanks, human errors associated with inadvertently releasing the stored noble gases to the building stack, neutron driver and tritium processing malfunctions, and other credible scenarios.

The waste gases from irradiation of the target solution are of two major types: the hydrogen and oxygen produced by radiolysis of water in the target solution, and radioactive fission product gases. The detonation or deflagration of hydrogen within the TOGS or elsewhere within the PSB is addressed in Subsection 13a2.1.9. Other unintended exothermic chemical reactions within the PSB are addressed in Subsection 13a2.1.10. This section analyzes failures that could lead to the release of noble gases and halogens due to other causes.

The PHA identified malfunctions of the NDAS and the associated TPS that include inadvertent actuation of the neutron driver, accelerator misalignment, and loss of tritium.

The initial conditions and assumptions associated with mishandling or malfunction of equipment affecting the PSB include:

  • Fission product gases (e.g., Kr, Xe, and halogens) produced during irradiation operations are monitored, processed, collected, stored, and disposed by TOGS and the NGRS.

Each TSV has a dedicated TOGS.

  • The TOGS flow is retained within the off-gas system until the target solution batch irradiation cycle is completed. As the TOGS circulates sweep gas during the irradiation cycle, a portion of the iodine is removed by the zeolite beds, and hydrogen and oxygen is recombined by the catalytic recombiners, but no other gases are removed or purged.

SHINE Medical Technologies 13a2-16 Rev. 1

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis

  • Since the TOGS is not a pressurized system, it is assumed that only 25 percent of the activity leaves the system prior to evacuation of the facility.
  • Automatic trip of power to the NDAS occurs for several reasons, including TSV overpower and misalignment of the neutron driver beam.

The TPS process is performed in semi-batch steps, treating the contaminated flush gas and purifying the contaminated tritium gas.

13a2.1.7.2 General Scenario Description Scenarios involving the NDAS are mitigated by the system design. Automatic trip of the NDAS power supply occurs by means of safety-related relays and breakers (Subsection 4a2.3.8) actuated by an overpower event within the TSV, as detected by the TRPS. The impact of an overpower event on the integrity of the PSB is mitigated by negative reactivity feedback from voiding in the TSV. In the event of a neutron driver misalignment, the NDAS is shut down.

Interlocks prevent operation of the NDAS if personnel are present. Together, these minimize the potential for an overexposure of facility personnel. Events related to the neutron driver are further evaluated in Subsection 13a2.1.12.1.

Scenarios involving the TPS are mitigated by system and confinement design. The two TPS are contained within separate glovebox enclosures located in the IF. The glovebox atmosphere is inerted with nitrogen and oxygen levels are monitored. Equipment to clean the tritium is located in the glovebox atmosphere recirculation loop (see Subsection 9a2.7.1.3.1). The piping to and from the NDAS is double-walled and designed to maintain its integrity during normal, abnormal, and accident conditions. Any leakage of tritium from the glovebox enclosure or the external piping is detected to ensure facility personnel are protected. Events related to the TPS are further evaluated in Subsection 13a2.1.12.3.

The scenario is an inadvertent venting of the off-gas purge contents from one of the eight TOGS.

In this scenario, a malfunction or human error occurs that releases the off-gas purge volume from one of the eight TOGS to one of the TOGS shielded cells. Further analyses of this scenario and the associated consequences are preserved in Subsection 13a2.2.7.

The following engineering controls either prevent or mitigate this scenario:

  • Integrity of the TOGS.
  • Confinement provided by the cell in which the TOGS is located, including the ability to isolate the ventilation system supporting the cell through the use of bubble-tight isolation dampers upon a signal from the ESFAS.

The TOGS is provided with hydrogen monitors. Gas is only purged from the TOGS to the NGRS if hydrogen concentrations are below acceptable limits. The TOGS has hydrogen recombiner capabilities. The NGRS system is also provided with hydrogen detection.

SHINE Medical Technologies 13a2-17 Rev. 1

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis 13a2.1.9 DETONATION AND DEFLAGRATION IN THE PRIMARY SYSTEM BOUNDARY Both the Final ISG Augmenting NUREG-1537 and the ISA Summary have identified the deflagration and detonation of hydrogen as a potential IE that is evaluated as part of the accident analysis. Further analyses and associated consequences are presented in Subsection 13a2.2.9.

This subsection discusses the effects of a hydrogen deflagration or detonation on the IF.

Irradiation of the uranium-bearing solution produces significant quantities of hydrogen and oxygen and small quantities of fission products. The TOGS is the primary control for mitigating hazards associated with the evolved gases. Functional requirements for the TOGS include maintaining the concentration of hydrogen to less than the LFL, recombining the hydrogen and oxygen as well as fission product gases, and returning the recombined water back to the TSV.

The TOGS functions as a closed loop during the irradiation process and is purged between each irradiation cycle.

13a2.1.9.1 Identification of Causes, Initial Conditions, and Assumptions The formation and release of hydrogen due to radiolytic decomposition is an inherent result of irradiation of water. The ISA Summary and the corresponding HAZOPS/PHA has identified several potential scenarios that could result in the accumulation of hydrogen and potential deflagration or detonation. As indicated identified in the ISA Summary, a deflagration or detonation accident is most likely to occur when the TOGS fails, which allows hydrogen to accumulate in the TSV headspace, dump tank, or off-gas piping. Potential failures that have been identified include a loss of power to the TOGS blowers, plugged zeolite beds, and loss of the recombiner functionality. Hydrogen could also accumulate if there is a partial failure of the TOGS, such as reduced volumetric flow rate due to a partially-obstructed filter or reduced blower capability.

The initial conditions and assumptions associated with a deflagration or detonation of hydrogen gas are:

  • The generation of radiolytic hydrogen for the TSV has been characterized. This analysis shows that during the irradiation cycle, the device is capable of developing flammable concentrations of hydrogen in the TSV headspace within seconds if the TOGS has failed.
  • A hydrogen deflagration/detonation analysis was performed to determine the potential environmental conditions (e.g., overpressures, potential for deflagration detonation transition [DDT]). As part of the analysis, the potential for a DDT was evaluated using the detonation cell size as the basis. The characteristic length and width of the TSV headspace is much larger than the detonation cell size, implying that the potential for a DDT, even though unlikely, cannot be ruled out. The PSB is designed to withstand credible deflagration and detonation events.
  • It is assumed that the risk for deflagration in the IU cell is dominated by the generation and potential accumulation of hydrogen in the headspace of the TSV due to the failure of the TSV off-gas system.
  • Each TSV is serviced by a dedicated and independent TOGS. It is assumed a single TOGS fails, allowing hydrogen to accumulate in one TSV.
  • In the event of failure of the PSB, confinement is provided by the IU cell and TOGS shielded cell.

SHINE Medical Technologies 13a2-20 Rev. 1

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis The second scenario involves a loss of control of combustibles and ignition sources. A reasonable scenario involves the performance of maintenance activities involving hot work, such as grinding, welding, or cutting, without appropriate controls of combustible materials. During performance of such work the generation of weld spatter, slag, or sparks may ignite combustible materials in the area. The impact of this type of fire is minimized through the establishment of administrative controls. Performance of hot work requires establishment of qualified fire watch personnel equipped with hand-held fire extinguishers. Qualification of the fire watch personnel ensures their capability to identify and extinguish fires in their incipient stages. Procedural requirements require minimization of combustible materials in the immediate vicinity of the work.

Accordingly, if such a fire were ignited, it would remain small, due a lack of combustibles and would be quickly extinguished by the fire watch. Fires that are not immediately extinguished are mitigated by the engineering controls discussed above for equipment malfunctions.

The TPS presents a potential for hydrogen release. This system is used to remove protium and deuterium impurities from the facility tritium inventory. The process uses a thermal diffusion column to separate the heavier tritium isotope from the lighter deuterium and protium isotopes by thermal cycling. Tritium is returned from the IUs and processed through the TPS for the purpose of removing deuterium and providing purified tritium gas. Tritium storage is located within the TPS gloveboxes with the bulk of the tritium in solid storage beds and thus unavailable to supply a leak. The glovebox is normally inerted, reducing the potential for hydrogen combustion.

Hydrogen fire in the TPS caused by a simultaneous hydrogen leak from TPS equipment and a loss of inert atmosphere in the glovebox, is prevented by the volume of the glovebox, which is large enough that a full release of tritium inventory would not result in hydrogen concentrations above the LFL. A fire external to the glovebox in the TPS room is mitigated by controls of combustible materials and the facility fire suppression system. Postulated fires are not expected to violate the integrity of the glovebox.

The deuterium source vessel for the accelerator presents a potential for hydrogen release inside the IU cell. The integrity of this deuterium vessel is assured by a periodic inspection program.

The final fire scenario involves fire spread from an area outside of the IF. The construction of the IF walls and associated components (e.g., doors, penetration seals, dampers) is sufficiently robust to provide a three hour fire rating. In some cases, non-fire rated components (e.g., airlock doors) are used to complete these barriers; however, these components provide fire separation equivalent to or greater than their rated counterparts. The postulated scenario would involve defeat of a fire barrier or its components, allowing fire spread into the IF from an external area.

Such a scenario would involve opening of airlock doors, removal of the concrete shield plugs and access doors from the IU cells, or removal of a rated penetration seal from an IF fire area (FA-2) barrier. Fire spread into the IF from an external fire could occur in any of these situations.

The need to remove the concrete shield plug and opening the personnel access door from an IU cell would occur during maintenance or modification activities which could potentially precipitate a fire. A fire under these conditions could involve transient combustibles located in the area to support the work activities. This type of scenario would be mitigated through application of both administrative and engineering controls. To prevent the development of conditions that could lead to fire, fire watch personnel are staged at unprotected fire area openings. These personnel are trained to recognize and eliminate fire hazards, thus preventing fire development. This administrative control prevents the development and/or spread of fire while openings are unprotected. Longer-term protection of openings is ensured through the placement of fire rated temporary penetration seals in barrier openings until the opening is permanently sealed. Finally, SHINE Medical Technologies 13a2-32 Rev. 1

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis exposed group either the BV or DV. Exposure due to surface contamination is only calculated for workers and the factors include areal contamination DCFs and surface areas. Another factor considered for workers in dose calculations is the time of exposure.

  • The DCFs are used to:

- Convert activity inhaled to an internal dose,

- Convert an exposure to an external activity from immersion in air into an external dose and,

- Convert an external activity due to exposure to a contaminated area into an external dose.

  • The BR is the volume rate of air inhaled by a reference person.
  • The BV is the free volume within the enclosed building to determine dose due to immersion.

The values used in this analysis for these factors are listed in Table 13a2.2.1-2.

The resulting dose consequence of this event is a TEDE of 3.06 rem to the workers. The TEDE to a member of the public for this event is 0.0165 rem (site boundary) and 0.0023 rem (nearest residence). The resulting off-site doses are within the 0.1 rem TEDE regulatory limit specified in 10 CFR 20.1301, and on-site doses are within the 5 rem TEDE regulatory limit specified in 10 CFR 20.1201.

Finally, emergency operating procedures, recovery actions, and administrative controls are available to provide additional mitigation of failed isolation SSCs in the event of a release of radioactive material.

13a2.2.1.7 Safety Controls This is a postulated MHA for the IF. Safety-related SSCs and administrative controls for a similar event DBA are listed in Subsection 13a2.2.4.

SHINE Medical Technologies 13a2-39 Rev. 1

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis Table 13a2.2.1-3 Public and Worker LPF for each DBA Event Material Public LPF Worker LPF Particulates 0.0001 0.025 Target Solution Release into the IU Cell (IF Halogens 0.0005 0.025 Postulated MHA)

Noble Gas 0.01 0.025 Particulates NP(a)

Mishandling and Malfunction of Equipment Halogens 0.0005 0.025 Affecting the PSB Noble Gas 0.01 0.025 Particulates 0.0001 0.025 Mishandling or Malfunction of Target Halogens 0.0005 0.025 Solution Noble Gas 0.01 0.025 Tritium Purification System Design Basis Tritium Gas 0.01 0.10 1.0 Event a) NP = Not Present in significant quantity SHINE Medical Technologies 13a2-42 Rev. 1

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis Table 13a2.2.1-4 Airborne Release and Respirable Fractions for each DBA Event Material ARF RF Particulates 0.0002 0.4 Target Solution Release from the Halogens 0.05 1.0 IU Cell (IF Postulated MHA)

Noble Gas 1.0 1.0 Particulates NP(a)

Mishandling and Malfunction of Halogens 0.05 1.0 Equipment Noble Gas 1.0 1.0 Particulates 0.0001 1.0 Mishandling and Malfunction of Halogens 0.05 1.0 Target Solution Noble Gas 0.1 1.0 Tritium Purification System Tritium Gas 1.0 1.0 Design Basis Accident a) NP = Not Present in significant quantities SHINE Medical Technologies 13a2-43 Rev. 1

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis to the criticality-safe TSV dump tank terminating the event. In addition, during a fill/startup evolution, the TRPS trip automatically stops the fill evolution by closing TSV fill valves and opening TSV dump valves. The TRPS serves to prevent an inadvertent criticality in the target solution and there would be minimal increase in the source term due to slightly elevated power.

Fission products are contained within the TSV, TOGS, dump tank and associated piping.

The robust design features of the PSB and remaining facility building are not challenged by an excess reactivity insertion event. The fission product inventory of the target solution and associated fission gases are contained within the TSV and associated systems thereby posing no significant increase in consequences to workers or the public.

13a2.2.2.7 Safety Controls There are several safety-related SSCs and administrative controls that prevent or provide mitigation for the consequences of an excess reactivity insertion event and ensure that the TSV remains subcritical.

Increase in Target Solution Density During Operations:

  • TRPS trip on high hydrogen concentration (SR).
  • TRPS trip on high range high neutron flux (SR).

Target Solution Temperature Reduction:

  • TRPS trip on high neutron flux (high range and source range) (SR).
  • TRPS trip on low PCLS temperature (SR).
  • PCLS low temperature alarms (DID).
  • LWPS low temperature alarms (DID).

Additional Target Solution Injection During Fill/Startup and Irradiation Operations:

  • Target solution uranium enrichment limit and tolerance (potential Technical Specification parameter).
  • Target solution uranium concentration limit and tolerance (potential Technical Specification parameter).
  • Neutron driver high voltage power supply interlocked with TSV startup mode to prevent operation by TRPS (SR).
  • Manual TSV trip capability incorporated into operator control panel (SR).
  • Incorporated operator manual TSV trips in operating procedures as appropriate (DID).
  • TSV dump tank designed with criticality-safe geometry (keff < 0.95) (SR).
  • TSV dump tank at a lower elevation than the TSV (SR).
  • TSV fill valves, fill pipe sizing, and fill pump design (SR).
  • TRPS trip on source range high neutron flux (SR).
  • Two redundant TSV dump tank valves (SR).
  • Administrative controls include an approved, procedural startup process using the 1/M methodology (DID).
  • Administrative controls incorporated in operating procedures for TSV volume hold points to calculate location within 1/M curve acceptable band (DID).
  • Procedural control of startup - Conduct of Operations (Technical Specification Administrative Control)

SHINE Medical Technologies 13a2-47 Rev. 1

[Proprietary Information - Withhold from public disclosure under 10 CFR 2.390(a)(4)]

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis During the fill/startup operation, the TRPS trip signal automatically closes TSV fill valves and opens the TSV dump valves transferring the target solution from the TSV to the criticality-safe TSV dump tanks terminating the event. Only one of these events needs to occur to prevent criticality. The target solution is passively cooled for decay heat removal.

Following fill/startup operation, the TSV fill valves and the fill pump are locked out and de-energized to prevent inadvertent fissile solution transfer to the TSV prior to and during irradiation operation.

During irradiation operations, the TRPS trip signal automatically de-energizes the neutron driver and opens the TSV dump tank valves.

Besides the TRPS, other principle SR design features to prevent or mitigate the consequences of an excess reactivity insertion event include:

  • Robust design of the TSV.
  • Robust design and reliability of the TOGS.
  • Robust design of the dump tank, piping, and valves.

Finally, the instrumentation and monitoring equipment provides the means for the operators to monitor the TSV and assess the condition of the facility both inside and outside the IU cell area.

This includes radiation monitoring and alarms to notify facility personnel of elevated radiation levels for the protection of facility workers, and effluent monitoring to assess impact to the public.

Hydrogen control is also required in order to maintain the hydrogen concentration in the TOGS and TSV headspace below the lower flammability limit. SR Systems include the following:

  • TRPS - TSV Reactivity Protection System.
  • CAMS - Continuous Air Monitoring System.
  • RAMS - Radiation Air Monitoring System.
  • SCADA/HMI - Supervisory Control and Data Acquisition/Human Machine Interface.
  • NGRS - Noble Gas Removal System.

13a2.2.3 REDUCTION IN COOLING The TRPS trips on loss of cooling. The temperature increase prior to TRPS trip results in a negative reactivity insertion within the TSV. The decay heat from the target solution is estimated to be approximately [ Proprietary Information ]. The volume of water in the light water pool is sufficient to act as a passive heat sink for the TSV dump tanks and the decay heat from the uranyl sulfate solution and sensible heat from the other TSV components. Therefore, cooling system operation is not required to remove decay heat from the target solution. Thus, there is no significant increased risk to workers or the public.

Safety Controls The essential safety-related systems that are required to function during a loss of cooling are:

  • TRPS loss of cooling trip (loss of PCLS flow and/or PCLS high temperature) (SR).
  • Light water pool (SR).

SHINE Medical Technologies 13a2-48 Rev. 1

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis Airborne and respirable source terms are used to calculate the TEDE. The factors used to calculate the airborne and respirable source terms are the product of the MAR, the damage ratio (DR), the release fraction from IU cell, the airborne release fraction (ARF), and the respirable fraction (RF). The values used in this analysis for these factors are listed in Table 13a2.2.1-2.

13a2.2.4.6 Radiological Consequence Analysis The radiological dose consequences for this DBA are calculated using the methods described in Subsection 13a2.2.1 and the values in Table 13a2.2.1-2.

The resulting TEDE for workers is 1.50 rem. The TEDE to a member of the public for this event is 2.19E-03 rem at the site boundary and 3.06E-04 rem for the nearest resident. Therefore, the resulting on-site and off-site doses are below the regulatory limits specified in 10 CFR 20.1301, and 10 CFR 20.1201.

13a2.2.4.7 Safety Controls The following engineering controls have been designed to prevent or mitigate the effects of the target solution spill in IU cell.

  • TSV dump tank piping integrity (SR).
  • The structural integrity, biological shielding, and low leakage construction (including penetrations) of the IU cells (SR).
  • RVZ1 isolation bubble-tight dampers, exhaust filters, and ductwork (SR).
  • RAMs high radiation signal (SR).
  • Light water coolant activity monitoring program (TS Administrative Control).
  • TSV overflow line (SR).

Instrumentation and monitoring equipment provides the means for the operators to monitor and assess the condition of the facility in the irradiation operations area. This includes radiation monitoring and alarms to notify facility personnel of elevated radiation levels for the protection of facility workers, and effluent monitoring to assess impact to the public. A 120 VAC UPSS is designed to provide power in the case of LOOP for monitoring of conditions in the IF.

13a2.2.5 LOSS OF OFF-SITE POWER Following a LOOP, the neutron driver is de-energized, however, hydrogen generation continues to occur in the target solution due to radiolysis from the decay of fission products. The UPSS is designed to power the TOGS loads needed to continue to remove hydrogen generated by radiolysis. The effects of loss of cooling due to a LOOP are discussed in Subsection 13a2.2.3.

Thus, there is no significant increased risk to workers or the public.

Safety Controls The following safety-related controls have been designed to prevent or mitigate the effects of a LOOP:

  • TOGS blower (SR).

SHINE Medical Technologies 13a2-51 Rev. 1

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis

  • PVVS blower (IROFS) (SR).
  • Robust design and reliability of TOGS (SR).
  • Process and radiation monitoring equipment needed to monitor the condition of the facility (TRPS, TPCS, CAMS, RAMS, CAAS, SCADA/HMI) (DID) (SR).
  • UPSS and associated 120 VAC buses (SR).

13a2.2.6 EXTERNAL EVENTS The facility is designed to withstand credible external events as described in 13a2.1.6. Thus, there are no consequences to the workers or the public from external events.

Safety Controls The essential systems that are required to function during an external event are:

  • Seismic Category I SSCs (SR).

13a2.2.7 MISHANDLING OR MALFUNCTION OF EQUIPMENT AFFECTING THE PSB This subsection contains the follow-on evaluation for the event identified in Subsection 13a2.1.7.

The conclusion of that subsection was that the release of the off-gas purge volume from one of the eight TOGS to the TOGS shielded cell requires further evaluation.

13a2.2.7.1 Initiating Event In this scenario, a malfunction or human error occurs that releases the off-gas purge volume from one of the eight TOGS to one of the TOGS shielded cells.

13a2.2.7.2 Sequence of Events This scenario is the complete release of the off-gas purge volume into the TOGS shielded cell.

The sequence of events for the postulated scenario is as follows:

a. A release of off-gas purge volume occurs from the TSV directly to the TOGS shielded cell as a result of TOGS pipe rupture.
b. Twenty-five percent of the TOGS activity enters the TOGS shielded cell prior to evacuation of the facility.
c. A high radiation signal activates the bubble-tight isolation dampers after approximately one percent of the total activity is released to the RVZ1.
d. The airborne activity is filtered prior to being released to the environment through the RVZ1 system until the bubble-tight dampers are closed.
e. Ten percent of the airborne activity is released into the RCA through penetrations in the TOGS shielded cell.
f. Radiation alarms are available locally or in the control room to notify facility personnel of any radiation leakage.

SHINE Medical Technologies 13a2-52 Rev. 1

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis The resulting TEDE for workers is 1.87 rem. The TEDE to a member of the public for this event is 1.59E-02 rem at the site boundary and 2.23E-03 rem for the nearest resident. Therefore, the resulting on-site and off-site doses are below the regulatory limits specified in 10 CFR 20.1301, and 10 CFR 20.1201.

13a2.2.7.7 Safety Controls The following engineering safety-related SSCs have been designed to prevent or mitigate the effects of the off-gas purge volume release into the TOGS shielded cell:

  • Robust design and reliability of TOGS (SR).
  • The structural integrity, biological shielding, and leak tight construction (including penetrations) of the TOGS shielded cells (SR).
  • RVZ1 isolation bubble-tight dampers, exhaust filters, and ductwork (SR).
  • RAMs high radiation signal (SR).

Instrumentation and monitoring equipment provides the means for the operators to monitor and assess the condition of the facility in the IF. This includes radiation monitoring and alarms to notify facility personnel of elevated radiation levels for the protection of facility workers, and effluent monitoring to assess impact to the public. A 120 VAC UPSS is designed to provide power in the case of LOOP for monitoring of conditions in the IF.

SHINE Medical Technologies 13a2-54 Rev. 1

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis 13a2.2.8 LARGE UNDAMPED POWER OSCILLATION As described in Subsection 13a2.1.8, operating at a subcritical condition with a low power density and negative temperature and void reactivity coefficients provides TSV stability and self-limiting power oscillations. A TRPS setpoint is designed to activate on high neutron flux level should a large undamped power oscillation occur. Thus, there are no consequences to workers or the public.

Safety Controls The essential features required to function during a large undamped power oscillation are:

  • Target solution properties.

- Negative temperature coefficient (Technical Specifications parameter).

- Negative void coefficient (Technical Specifications parameter).

  • Thermal power limit of the TSV (Technical Specifications parameter).
  • TRPS high neutron flux trip (SR).

13a2.2.9 DETONATION AND DEFLAGRATION IN PRIMARY SYSTEM BOUNDARY As discussed in Subsection 13a2.1.9, hydrogen and oxygen are released by radiolysis from the target solution both during and after irradiation, and high concentrations of hydrogen may result in detonation or deflagration. The TOGS provides ventilation of the headspace above the TSV to maintain hydrogen concentrations below the LFL. A failure of the TOGS to perform this design function may result in conditions that could lead to a hydrogen deflagration/detonation.

The pressure transient caused by a hydrogen deflagration/detonation in the PSB is contained by the construction of the TSV, TOGS, dump tank, and associated piping that constitutes the PSB.

The integrity of the PSB is maintained. The potential damage is limited plastic deformation of components of the PSB or internal to the PSB. The fission product inventory and associated fission gases are contained within the PSB, thereby resulting in no consequences to the workers or the public.

Safety Controls The following safety-related SSCs have been designed to prevent damage to the PSB in the event of hydrogen detonation or deflagration:

  • The integrity of the PSB which has been designed to withstand credible hydrogen detonation or deflagration events (SR).
  • TRPS trip on high hydrogen concentrations in the PSB (SR).

SHINE Medical Technologies 13a2-56 Rev. 1

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis 13a2.2.10 UNINTENDED EXOTHERMIC CHEMICAL REACTIONS OTHER THAN DETONATION As discussed in Subsection 13a2.1.10, because there is no potential for an unintended exothermic chemical reaction within the IF, there are no consequences to address. The potential for a hydrogen detonation is addressed in Subsection 13a2.1.9. Thus, there are no consequences to the workers or the public.

Safety Controls Because there is no potential for an unintended exothermic chemical reaction within the IF, there are no required safety controls to prevent or mitigate the event.

The following control prevents or mitigates the effects of an unintended exothermic chemical reaction other than detonation:

  • Control of chemical inventory in the IF (DID).

13a2.2.11 PRIMARY SYSTEM BOUNDARY SYSTEM INTERACTION EVENTS As discussed in Subsection 13a2.1.11, no releases are expected to occur as a result of PSB interaction events. Thus, there are no consequences to workers or the public.

Safety Controls The following features safety-related SSCs and Technical Specifications prevent or mitigate the effects of PSB interaction events:

  • TSV dump tank valves (SR).
  • UPSS (SR).
  • Emergency exit lighting (DID).
  • TOGS blower (SR).
  • TOGS recombiner beds (SR).
  • PVVS blower (SR).
  • Light water pool (SR).
  • IU cell integrity (SR and fire rated).
  • TOGS cell integrity (SR and fire rated).
  • IF wall (SR and fire rated).
  • NGRS backflow protection (SR).
  • Target solution uranium enrichment (Technical Specifications).
  • Target solution uranium concentration (Technical Specifications).

13a2.2.12 FACILITY-SPECIFIC EVENTS 13a2.2.12.1 Inadvertent Exposure to Neutrons from the Neutron Driver IU cell biological shielding and neutron driver/access door interlock prevent inadvertent exposure to neutrons (see Subsection 13a2.1.12.1). Thus, there are no consequences to workers or the public.

SHINE Medical Technologies 13a2-57 Rev. 1

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis Safety Controls The following features safety-related SSCs and Technical Specification administrative controls prevent an inadvertent exposure to neutrons from the accelerator:

  • IU cell walls and shield plug, biological shield (SR).
  • Light water pool (SR).
  • Neutron driver personnel access door interlock (SR).
  • Lockout/tagout procedures (DID).
  • Administrative controls on crane operation (DID).
  • Neutron driver cutoff switches and audible/visible warning signals (DID).
  • Use of accelerator audible/visual warnings (TS Administrative Control).
  • Accelerator key switch to prevent the activation of the accelerator while personnel are present (SR).
  • Accelerator local kill switch (SR).
  • Accelerator manual shut-off switch (SR).

13a2.2.12.2 Irradiation Facility Fire Event Analysis of the IF fire contained in Subsection 13a2.1.12.2 identified four initiating events:

  • A malfunction of equipment that results in the ignition of a fire.
  • Loss of combustible and ignition control.
  • The spread of a fire from outside of the IF.

The effects of the fires resulting from these IEs are considered to be contained within the IF, with no impact other than fire damage internal to the IF. Fires within the cells of the IF are contained within their respective cells. The FFPS detects fires within the IF and initiates isolation of the fire area. Combustible loading within the IF areas containing radiological materials is limited to reduce the consequences of a fire. Detonation and deflagration within the PSB are addressed in Subsection 13a2.2.9.

Safety Controls The following engineering safety-related SSCs and Technical Specification administrative controls have been designed to prevent or mitigate the effects of fire within the IF:

  • TPS robust design (SR).
  • TPS pressure confinement boundary (DID) (SR).
  • Limited combustible loading within the IU cells, the TOGS shielded cells, and the TPS room (DID) (TS Administrative Control).
  • Limited tritium inventory based on TPS fixed glovebox volume (SR) (TS Administrative Control).
  • Inerted atmosphere of the TPS gloveboxes (DID).
  • FFPS detection of fires within the IF and initiation of isolation functions (DID).
  • IF boundary (FA-2) and components (e.g., doors, penetration seals, dampers)

(Fire-rated).

  • Deuterium source vessel integrity program (TS Administrative Control).

SHINE Medical Technologies 13a2-58 Rev. 1

[Security-Related Information - Withhold Under 10 CFR 2.390]

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis Therefore, there is no need to further analyze consequences of fires within the IF.

13a2.2.12.3 Tritium Purification System (TPS) Design Basis Accident This section contains the follow-on evaluation for the loss of TPS integrity (e.g., a break of the TPS piping that releases the entire tritium inventory of the neutron drivers [ Security-Related Information ].

13a2.2.12.3.1 Initiating Event In this scenario, a malfunction or external event occurs that releases the tritium from eight neutron drivers.

13a2.2.12.3.2 Sequence of Events The sequence of events for the postulated scenario is as follows:

a) A release of the tritium in the neutron driver system directly to the irradiation unit cell.

b) A high radiation signal (e.g., loss of vacuum in TPS piping) or other actuation signal activates the bubble-tight isolation dampers after approximately one percent of the material is released to the RVZ1, and actuates isolation of tritium supply and return piping.

c) The airborne activity is filtered prior to being released to the environment through the RVZ1 system until the bubble-tight dampers are closed.

d) Ten percent of the airborne activity is released into the RCA through penetrations in the IU cell.

ed) Alarms are available locally or in the control room to notify facility personnel of radiation leakage due to loss of TPS integrity.

fe) Facility personnel evacuate the immediate area upon actuation of the radiation area monitor alarms.

13a2.2.12.3.3 Damage to Equipment The postulated scenario is initiated from damage or degradation to the tritium piping on the neutron drivers. The effects of the piping damage are contained within the IU cell.

13a2.2.12.3.4 Quantitative Evaluation of Accident Evolution The airborne release fraction for tritium in the TPS is 1.0. Once the tritium has been released to the IU cell it becomes mixed with the atmosphere inside the cell.

The RVZ1 exhaust is equipped with HEPA and charcoal filters with assumed efficiencies of 99 percent for particulates and 95 percent for halogens, respectively, although not credited for any tritium removal. The isolation dampers are of a fail-safe design, and close on high radiation or other actuation signal within the IU shielded cell or on a loss of power. The total release to RVZ1 through the bubble-tight isolation dampers during the accident is assumed to be no more than one (1) percent of the airborne activity in the IU cell based on design characteristics of the dampers and the response of the actuating system.

SHINE Medical Technologies 13a2-59 Rev. 1

[Security-Related Information - Withhold Under 10 CFR 2.390]

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis Each IU cell is constructed of reinforced concrete walls and ceiling thick enough to contain the released material, provide shielding, and isolate the effects of the rupture or leakage from the other areas of the IF. Due to the decay mode and energy of tritium, the released tritium that stays within the IU cell does not affect workers outside the IU cell. The total release to the RCA through the IU cell penetrations during the accident is assumed to be no more than 10 percent of the inventory available for release. While the confinement features of the IU cell would significantly reduce dose to workers, no reduction due to confinement features was assumed in this analysis.

13a2.2.12.3.5 Radiation Source Term Analysis The source term for this scenario is the tritium inventory of the eight neutron drivers,

[ Security-Related Information ] grams.

13a2.2.12.3.6 Radiological Consequence Analysis The only postulated credible release from the TPS is a break in the tritium piping on the neutron driver. Dose consequence analysis has been performed for a [ Security-Related Information ] g release of tritium. The resulting TEDE for workers is 2.54 rem. The TEDE to a member of the public for this event is 0.06 5.6E-04 rem at the site boundary. The resulting off-site doses are within the 0.1 rem TEDE regulatory limit specified in 10 CFR 20.1301, and on-site doses are within the 5 rem TEDE regulatory limit specified in 10 CFR 20.1201.

13a2.2.12.3.7 Safety Controls Safety-related SSCs and Technical Specification administrative controls to prevent or mitigate a TPS malfunction include:

  • Robust TPS construction and confinement provided by the glovebox and double-wall pipe (SR).
  • TPS confinement system (relief valves or rupture discs, monitoring instrumentation, isolation valves) (SR).
  • Fire detection and suppression (DID).
  • Engineered transport enclosures or containers (SR) (TS Administrative Control).
  • RVZ1, isolation bubble-tight dampers (SR).
  • RAMs, high radiation signal (SR).
  • Administrative controls for TPS system and confinement sampling, inspection, testing and operating procedures (TS Administrative Control).

SHINE Medical Technologies 13a2-60 Rev. 1

Chapter 13 - Accident Analysis Summary and Conclusions 13a3

SUMMARY

AND CONCLUSIONS This section presents the summary and conclusions for the accident analysis for the IF.

The following accident categories were addressed for the irradiation facility:

  • Maximum hypothetical accident (MHA).
  • Excess reactivity insertion.
  • Reduction in cooling events.
  • Mishandling or malfunction of target solution.
  • Loss of off-site power.
  • External events.
  • Mishandling or malfunction of equipment affecting the PSB.
  • Large undamped power oscillations.
  • Detonation or deflagration in the PSB.
  • Unintended exothermic chemical reactions other than detonation.
  • PSB system interaction events.
  • Facility-specific events.

For the consequences of the bounding accident scenarios evaluated for each category, see Table 13a3-1. The consequences of the evaluated bounding accident scenarios are below the limits in 10 CFR 20.

The safety controls for the IF are provided in Table 13a3-2.

SHINE Medical Technologies 13a3-1 Rev. 1

Chapter 13 - Accident Analysis Summary and Conclusions Table 13a3-1 Potential Consequences of Postulated Accidents in the Irradiation Facility Dose Consequences (rem TEDE)

General Public Accident Category (Limit = 0.1 rem) Worker (Bounding Scenario) Site Boundary Nearest Resident (Limit = 5.0 rem)

Postulated Maximum Hypothetical Accident 1.65E-02 2.30E-03 3.06E+00 (Target solution release into the IU cell)

Excess Reactivity Insertion (No consequences)

Reduction in Cooling (No consequences)

Mishandling or Malfunction of Target Solution 2.19E-03 3.06E-04 1.50 (Dump tank leak into an IU cell)

Loss of Off-Site Power (LOOP) (No consequences)

External Events (No consequences)

Mishandling or Malfunction of Equipment Affecting the PSB 1.59E-02 2.23E-03 1.87 Large Undamped Power Oscillations (No consequences)

Detonation and Deflagration in PSB (No consequences)

Unintended Exothermic Chemical Reactions other than (No consequences)

Detonation Primary System Boundary System Interaction Events (No consequences)

Facility-Specific Events (1) Inadvertent Exposure to Neutrons from the Neutron Driver (No consequences)

(2) Irradiation Facility Fire Event (3) Tritium Purification System DBA 5.6E-024 8.0E-035 2.4 SHINE Medical Technologies 13a3-2 Rev. 1

Chapter 13 - Accident Analysis Summary and Conclusions Table 13a3-2 Irradiation Operations Safety Controls and Accident Applicability (Sheet 1 of 3)

Accident Scenario MHA(a) Reactivity(b) Cooling(c) Target(d) LOOP(e) External(f) Equipment(g) Power(h) Detonation (i) Chemical (j) Neutrons (l)

PSB(k) Fire(m) TPS(n)

Classification TRPS Trip on High Hydrogen Safety-Related N/A X X Concentration High Range Safety-Related N/A X X High Flux Trip Source Range Safety-Related N/A X X High Flux Trip TOGS Recombiner Safety-Related N/A X Beds PVVS Blower Safety-Related N/A X X IF Wall Safety-Related N/A X Boundary TRPS Trip on Low PCLS Safety-Related N/A X Temperature NGRS Backflow Safety-Related N/A X Protection Technical Uranium Specification N/A X X Enrichment Parameter Technical Uranium Specification N/A X X Concentration Parameter PCLS Loss of Safety-Related N/A X Flow Trip PCLS High Temperature Safety-Related N/A X Trip TOGS Blower Safety-Related N/A X X NDAS Interlock with TSV Safety-Related N/A X Startup Mode Manual Trip Safety-Related N/A X SHINE Medical Technologies 13a3-3 Rev. 1

Chapter 13 - Accident Analysis Summary and Conclusions Table 13a3-2 Irradiation Operations Safety Controls and Accident Applicability (Sheet 2 of 3)

Accident Scenario Reactivity(b) Cooling(c) Target(d) LOOP(e) External(f) Equipment (g) Power(h) Detonation (i) Chemical (j) Neutrons (l)

MHA(a) PSB(k) Fire(m) TPS(n)

Classification Criticality-Safe Safety-Related N/A X Dump Tank Dump Tank Safety-Related N/A X Elevation Fill System Safety-Related N/A X Design TSV Dump Safety-Related N/A X X Tank Valves TPS Robust Safety-Related N/A X X Design TSV Robust Safety-Related N/A X X Design TOGS Robust Design/ Safety-Related N/A X X X X Reliability Robust Design of Dump Tank, Safety-Related N/A X X X Piping, and Valves TPS Tritium Safety-Related N/A X Inventory Light Water Safety-Related N/A X X X Pool IU Cell Integrity Safety-Related N/A X X X RVZ1 Bubble-tight Dampers, Safety-Related N/A X X X Exhaust Filters, and Ductwork RAMS High Radiation Safety-Related N/A X X X Signal ESFAS Safety-Related N/A X X UPSS Safety-Related N/A X X SHINE Medical Technologies 13a3-4 Rev. 1

Chapter 13 - Accident Analysis Summary and Conclusions Table 13a3-2 Irradiation Operations Safety Controls and Accident Applicability (Sheet 3 of 3)

Accident Scenario Reactivity(b) Cooling(c) Target(d) LOOP(e) External(f) Equipment (g) Power(h) Detonation (i) Chemical (j) Neutrons (l)

MHA(a) PSB(k) Fire(m) TPS(n)

Classification Seismic Category 1 Safety-Related N/A X SSCs Technical TSV Thermal Specification N/A X Power Limit Parameter Technical Target Solution Specification N/A X Properties Parameter NDAS Door Safety-Related N/A X Interlock TOGS Shielded Cell Safety-Related N/A X X Integrity TPS Confinement Safety-Related N/A X System Tritium Transport Safety-Related N/A X Containers (a) Maximum Hypothetical Accident (Subsections 13a2.1.1 and 13a2.2.1)

(b) Insertion of Excess Reactivity/ Inadvertent Criticality (Subsections 13a2.1.2 and 13a2.2.2)

(c) Reduction of Cooling (Subsections 13a2.1.3 and 13a2.2.3)

(d) Mishandling or Malfunction of Target Solution (Subsections 13a2.1.4 and 13a2.2.4)

(e) Loss of Off-Site Power (Subsections 13a2.1.5 and 13a2.2.5)

(f) External Events (Subsections 13a2.1.6 and 13a2.2.6)

(g) Mishandling or Malfunction of Equipment Affecting the PSB (Subsections 13a2.1.7 and 13a2.2.7)

(h) Large Undamped Power Oscillations (Subsections 13a2.1.8 and 13a2.2.8)

(i) Detonation and Deflagration in Primary System Boundary (Subsections 13a2.1.9 and 13a2.2.9)

(j) Unintended Exothermic Chemical Reaction Other Than Detonation (Subsections 13a2.1.10 and 13a2.2.10)

(k) Primary System Boundary System Interaction Events (Subsections 13a2.1.11 and 13a2.2.11)

(l) Inadvertent Exposure to Neutrons from the Neutron Driver (Subsections 13a2.1.12.1 and 13a2.2.12.1)

(m) Irradiation Facility Fires (Subsections 13a2.1.12.2 and 13a2.2.12.2)

(n) Tritium Purification System Design Basis Accident (Subsections 13a2.1.12.3 and 13a2.2.12.3)

SHINE Medical Technologies 13a3-5 Rev. 1

Radioisotope Production Facility Accident Chapter 13 - Accident Analysis Analysis Methodology 13b.1.2 ACCIDENT INITIATING EVENTS The purpose of this section is to identify the postulated IEs and credible accidents that form the design basis for the RPF. The DBAs identified in Section 13b.2.1 range from anticipated events, such as a malfunction of equipment, to a postulated MHA that exceeds the radiological consequences of any accident considered to be credible. The MHA is intended to establish bounding consequences and need not be credible.

The bases for the identification of DBAs and their IEs and associated accident scenarios were:

  • HAZOPS and PHA within the ISA Summary in accordance with NUREG-1520.
  • Experience of the hazard analysis team.
  • Current preliminary design for the processes and facility.

The DBAs that have been identified for potential significant radiological consequences in the RPF include the following:

  • MHA
  • External Events
  • Critical Equipment Malfunction
  • Inadvertent Criticality in RPF
  • Chemical Accidents These DBAs encompass LOOP and operator errors. Qualitative evaluations were performed on the above DBAs to further identify the bounding or limiting accidents and scenarios that could result in the highest potential consequences. These evaluations are based on review of identification of causes, the initial conditions, and assumptions for each accident.

SHINE Medical Technologies 13b-3 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences 13b.2.3 EXTERNAL EVENTS The following potential external events have been identified as DBAs for the SHINE facility:

  • Seismic event affecting the IF and RPF (see Section 3.4).
  • Tornado or high-winds affecting the IF and RPF (see Section 3.2).
  • Small aircraft crash into the IF or RPF (see Subsection 3.4.5).

Plant SSCs, including their foundations and supports, that are designed to remain functional in the event of a design basis earthquake (DBEQ) are designated as Seismic Category I, as indicated in Table 3.5-1. SSCs designated SR or IROFS are classified as Seismic Category I.

SSCs whose failure as a result of a DBEQ could impact an SSC designated as SR or IROFS are classified as Seismic Category I. SSCs that must maintain structural integrity post-DBEQ, but are not required to remain functional are Seismic Category II.

Seismic Category I SSCs are analyzed under the loading conditions of the DBEQ and consider margins of safety appropriate for that earthquake. The margin of safety provided for safety class SSCs for the DBEQ are sufficient to ensure that their design functions are not jeopardized. For further details of seismic design criteria refer to Section 3.4.

The SHINE production facility building is designed to survive credible wind and tornado loads, including missiles, as described in Section 3.2 and Subsection 3.4.2.6. It is also designed to withstand credible aircraft impacts as discussed in Subsection 3.4.5.

The facility is designed to withstand credible external events as described in 13a2.1.6. Thus, there are no consequences to the workers or the public from external events.

Safety Controls The essential systems that are required to function during an external event are the Seismic Category I SSCs (SR).

SHINE Medical Technologies 13b-13 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences Some of these materials are stored for specific minimum periods of time to allow for decay of short-lived isotopes, either in one of the hot cells or in the waste storage area.

  • The RVZ1, RVZ2, and RVZ3 systems are normally operated in an automatic mode to maintain a negative pressure in the RPF with respect to the environment outside of the SHINE facility. Automatic isolation of the system occurs on either a loss of off-site power or on indication of a high radiation condition.
  • Noble gases are received from the TOGS and stored in a bank of five noble gas storage tanks that are filled on a staggered basis. The noble gas storage tanks have enough capacity to store the generated noble gases for at least 40 days.
  • NGRS noble gas storage tanks and associated equipment are located within a shielded cell with isolation and confinement capability.

The eight IUs are in operation for at least as long as required to fill the five noble gas storage tanks. The NGRS contains the TOGS contents for at least 40 days before they are discharged to RVZ1 and then, ultimately, to the stack.

13b.2.4.2 Identification of Causes Most processes covered by this evaluation are performed manually by RPF technicians. The manual nature of these operations makes human error a likely initiator for an event. Another potential cause is failure of the laboratory glassware used in the purification portion of the supercells. The glassware is replaced after every batch, but may possess a manufacturing flaw or sustain undetected damage during handling.

There are several process steps involved in the extraction of the molybdenum product and recycling of the target solution, which are performed in the RPF. A critical equipment malfunction due to human error or other failure in the RPF systems could result in a local liquid spill or release of stored fission product gases. For liquid spills, a vapor release would also be expected, especially for process streams with elevated temperatures. Processes in the RPF were reviewed for the potential of an error or failure that results in a radiological event. The following is a summary of that review:

Spills Inside of a Hot Cell Liquid or vapor releases from process equipment or piping inside a supercell, UREX hot cell, thermal denitration hot cell, or one of the waste treatment hot cells would be contained by the physical design of these enclosures, and their drainage and ventilation systems. These releases could be caused by equipment failures and human errors such as valve or pump leaks/misalignments, contactor failures in UREX, column failures in MEPS, and corrosion.

Workers would be shielded from any direct gamma radiation by the hot cell biological shielding design. A spill of target solution in any of these cells would be directed to a drain or sump with a geometry that is criticality-safe. The area ventilation system would be shut down and isolated by bubble-tight dampers upon detection of excessive radiation to prevent release outside of the facility.

Radiological consequences to workers, the public, or the environment could result from a spill in one of the hot cells through the release of airborne radioactive material into the ventilation system (prior to the bubble-tight dampers isolating the cell) or penetrations into other portions of the RCA. Radiological spills within the hot cells are mitigated by facility and hot cell controls SHINE Medical Technologies 13b-16 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences 13b.2.4.8 Safety Controls There are several safety controls that prevent or provide mitigation for the consequences of an inadvertent release from the NGRS and the other identified critical equipment malfunction scenarios. The following facility systems and components are identified as safety controls:

  • Radiation area monitoring system (RAMS) (SR)
  • Production facility biological shield (PFBS) system (including noble gas storage cell, hot cells, tank vaults, and pipe trenches) (SR)
  • Noble gas removal system (NGRS) (SR)
  • RVZ1 (including bubble-tight dampers for the noble gas storage cell and hot cells) and RVZ2 (SR)
  • Radiological integrated control system (RICS) (SR)
  • MEPS column pressure monitor (SR)
  • Moisture-Leak Detection/Instrumentation and Alarm for tank overflow into PVVS (SR)
  • Procurement and use of waste containers program (TS Administrative Control)
  • Reverse flow indication and alarm for MEPS hot cell (SR)
  • Criticality Safe Geometry Overflow- Part of Radioactive Drain System (SR)
  • Raffinate hold tank level detection (SR)
  • Piping and tank integrity (SR)

The RAMS are designed to alert both the control room operators and the facility staff in the RCA of abnormal radiation levels within the facility. The sensitivity of these radiation monitors will be set such that they will not alarm spuriously due to normal process variations but will be sensitive enough to alarm upon detection of upset conditions. The radiation monitoring components are relied upon to reduce the off-site dose consequences and to alert the facility staff. The RAMS is classified as a safety-related system.

The PFBS also mitigates the consequences of the postulated scenarios by providing a robust and passive barrier for retention of radioactive materials and providing shielding for facility workers. The PFBS is classified as an IROFS a safety-related system.

The NGRS collects TOGS purge gases in storage tanks to allow for decay of noble gases released from the target solution during the irradiation cycle. The radiation level in the decayed gases is verified to be within acceptable criteria prior to release. The NGRS is classified as an IROFS a safety-related system.

RVZ1 and RVZ2 provide confinement capabilities and filtration of halogens and particulates that may be released during postulated normal, abnormal, and accident conditions. The bubble-tight dampers isolate cells and ventilation zones when corresponding high radiation levels are detected. The bubble-tight isolation dampers reduce the off-site dose consequences for the postulated scenario. RVZ1 and RVZ2 are classified as safety-related and IROFS systems, respectively.

RICS monitors IROFS parameters within the RPF and initiates the isolation functions necessary to achieve confinement, including closure of the bubble-tight dampers. The RICS is relied upon to reduce the off-site dose consequences and to alert the facility staff. RICS is classified as an IROFS a safety-related system.

SHINE Medical Technologies 13b-21 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences The MEPS column pressure monitor detects pressure increases from the positive displacement pump transferring solution from the TSV dump tank to prevent a spill.

The moisture-leak detection/instrumentation and alarm detects process tank overflows into the vent system which could allow a release pathway for fission products in a system designed for handling tank vapors.

The procurement and use of waste containers program ensures confinement for radioactive waste in the event of mishandling or other accidents.

Hydrogen monitors in the NGRS alert the operator to excessive hydrogen concentrations in this system so actions can be taken to prevent a hydrogen deflagration or detonation, preventing an inadvertent release from NGRS.

The reverse flow indication and alarm for the MEPS hot cell alerts the operator to unanticipated transfer of target solution into the MEPS, resulting in a spill inside the hot cell. The alarm will allow the operator to secure the transfer and mitigate the spill.

The criticality-safe geometry overflow equipment (part of radioactive drain system) directs tank contents to the criticality-safe sump in the case of an inadvertent tank overflow to prevent excess liquid into inappropriate areas or systems like PVVS.

Raffinate hold tank level instrumentation prevents or mitigates a raffinate spill by alerting the operator of an overflow from the raffinate hold tank, preventing the transfer of fissile material to an unsafe geometry tank downstream.

A tank or piping failure is an initiating event to cause a release, but is unlikely due to the robust nature of tanks and piping containing radioactive materials.

SHINE Medical Technologies 13b-22 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences 13b.2.5 INADVERTENT NUCLEAR CRITICALITY IN THE RADIOISOTOPE PRODUCTION FACILITY An accidental criticality is highly unlikely because the SHINE facility has been designed with passive engineering design features to prevent criticality, including the use of neutron absorbers, such as borated plastic. Additionally administrative controls and IROFS SR SSCs provide control on enrichments and target solution uranium concentration to further prevent inadvertent criticality.

Therefore this subsection identifies areas within the RPF where an inadvertent criticality is possible, and discusses controls that are used to reduce the likelihood of an inadvertent criticality, and discusses the potential consequences of a highly unlikely inadvertent criticality event. This section only considers processes in the RPF that involve SNM.

13b.2.5.1 Initial Conditions and Assumptions Processing, handling, and storage of SNM take place in many areas of the RPF. A brief description of each area is provided along with the general criticality-safety control strategy.

  • Process 1 - Receipt of Uranium Metal and Dissolution in Nitric Acid.

Uranium metal is received into the plant and stored in criticality-safe storage containers in racks. Uranium metal is handled in criticality-safe storage containers and transferred to a criticality-safe vessel, where it is dissolved in nitric acid to produce uranyl nitrate. The uranyl nitrate is further processed through the criticality-safe thermal denitrator to yield uranium oxide. The uranium oxide is transferred to a criticality-safe container and stored in criticality-safe storage racks. Criticality control in this area is provided by passive engineering design features and administrative controls that are defined in the criticality-safety program (see Section 6b.3).

  • Process 2 - Dissolving Uranium Oxide in Sulfuric Acid.

Containers of uranium oxide are transferred into a criticality-safe dissolution vessel (which includes neutron absorbers) and subsequently dissolved in sulfuric acid to create uranyl sulfate. Criticality control in this area is provided by passive engineering design features (including neutron absorbers) and administrative controls.

  • Process 3 - Transfer of Solution to the Target Solution Vessel within the IF.

Solution is transferred to the TSV for subsequent irradiation through criticality-safe transfer piping. Upon transfer into the IF, the solution has left the RPF and is no longer covered by this discussion.

  • Process 4 - Transfer of Irradiated Solution Back to the RPF (Mo-99).

The solution is transferred back to the RPF via criticality-safe piping and enters a number of different processing areas. These processing areas involve criticality-safe geometry (including neutron absorbers) for processing and storage, and are within radiation shielded areas of the facility. Criticality control in these areas is provided by passive engineering design features and administrative controls.

SHINE Medical Technologies 13b-24 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences

  • Process 5 - Processing of Irradiated Solution via UREX Process.

After repeated cycles in the TSV, the irradiated solution is treated in a process known as UREX. There are two outputs from this process: clean uranyl nitrate solution and raffinate (fission and activation products including trace amounts of plutonium removed from the irradiated solution). The equipment used in the UREX process is shown to be geometrically-safe with respect to criticality-safety and is contained in radiation shielded areas of the facility. Criticality control in this area is provided by passive engineering design features and administrative controls.

The main concern for criticality-safety in this process is the transfer of the raffinate to large-capacity vessels that are not geometrically-safe with respect to criticality. Prior to transfer from the post-UREX criticality-safe geometry vessels to vessels that do not have criticality-safe geometry in the waste processing storage area, the raffinate is sampled to ensure that the uranium concentration is below the discharge limit. If an unacceptable concentration of uranium is measured, the transfer between the tanks does not occur.

Criticality control in this area is provided by passive engineering design features and administrative controls.

  • Process 6 - Conversion of Uranyl Nitrate to Uranium Oxide.

The final step in the process is the conversion of uranyl nitrate back to uranium oxide.

This conversion process occurs in criticality-safe geometry vessels. In the final step, the uranium oxide material is transferred into a criticality-safe geometry container and stored in a criticality-safe storage rack. The uranium oxide containers are then used as feed material in the creation of uranyl sulfate (Process 2 above). Criticality control in this area is provided by passive engineering design features and administrative controls.

13b.2.5.2 Identification of Causes Credible scenarios that could lead to an accidental criticality within the RPF have been identified and engineered controls and design features have been included in the facility design to prevent such an event. Furthermore, the IROFS SR SSCs necessary to demonstrate that each credible scenario is highly unlikely have been identified.

There are three four distinct types of criticality scenarios postulated:

  • Scenario 1 - Accumulation of metal or oxide fissile material outside of a radiation shielded area of the facility, resulting in an inadvertent criticality.
  • Scenario 2 - Accumulation of irradiated solution within a radiation shielded area of the facility, resulting in an inadvertent criticality.
  • Scenario 3 - Accumulation of un-irradiated solution outside of a radiation shielded area of the facility, resulting in an inadvertent criticality.
  • Scenario 4 - Accumulation of metal or oxide fissile material within a radiation shielded area of the facility, resulting in an inadvertent criticality.

Each of the above scenarios are developed further to show how these scenarios may evolve to cause an inadvertent criticality accident.

SHINE Medical Technologies 13b-25 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences

  • Scenario 1 - The accumulation of metal or oxide material within the RPF outside of a radiation shielded area caused by a spill or other physical upset condition. Since the metal and oxide powder do not contain radioactive fission products, either can be safely handled without any significant radiation shielding material. Containers of uranium metal and oxide powder are handled routinely when transferred from storage racks to processing equipment and multiple containers could be spilled or accumulate into a configuration such that a critical geometry is achieved given the proper moderation conditions. This scenario would require multiple administrative control failures as well as the introduction of uncontrolled moderating material into the area.
  • Scenario 2 - The accumulation of irradiated solution within a radiation shielded area caused by a spill or other physical upset. The processing and transfer of irradiated fissile material is accomplished within criticality-safe geometry vessels. In the unlikely event of a leak or spill, material is collected in a criticality-safe geometry sump and transferred to another criticality-safe geometry storage vessel. Should these systems fail to divert spilled material to the proper storage vessel, an accumulation of fissile solution in an unsafe geometry could occur. This scenario would require the failure of multiple passive engineered design features as well as the failure of administrative controls.
  • Scenario 3 - The accumulation of un-irradiated solution outside of a radiation shielded area caused by a spill or other physical upset. The processing and transfer of un-irradiated fissile material is accomplished within criticality-safe geometry vessels. In the unlikely event of a leak or spill, material is collected in a criticality-safe geometry sump and transferred to another criticality-safe geometry storage vessel. Should these systems fail to divert spilled material to the proper storage vessel, an accumulation of fissile solution in an unsafe geometry could occur. This scenario would require the failure of multiple passive engineered design features as well as the failure of administrative controls.
  • Scenario 4 - The accumulation of metal or oxide material within the RPF within a radiation shielded area could be caused by the incomplete dissolution of solid material in a process tank, and carry-over of this material further into the process system. This scenario would require the failure of multiple passive engineered design features as well as the failure of administrative controls.

Specific examples of events associated with the scenarios listed above are:

  • Transfer of target solution between the RPF and IF.

Leaks in the piping resulting in target solution collecting in the sump and/or trenches that could lead to a criticality unsafe accumulation of fissile material. Changes in piping design or valve alignment that may result in misdirection to a tank that is not designed to be criticality-safe. Both scenarios may lead to an inadvertent criticality.

Leaks in the piping or extraction process resulting in target solution collecting in the sump, trenches and/or drains that could lead to a criticality-unsafe accumulation of fissile material. Changes in piping design or valve alignment that may result in misdirection to a SHINE Medical Technologies 13b-26 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences tank that is not designed to be criticality-safe. Both scenarios may lead to an inadvertent criticality. Cell waste and shipping containers will have criticality-safe containers.

  • Target solution clean-up via UREX process, uranium storage, and transfer.

Leaks in the piping or UREX process resulting in target solution collecting in the sump, trenches and/or drains that could lead to criticality-unsafe accumulation of fissile material.

Changes to spacing of uranium oxide containers in the uranium container storage racks that may result in a criticality-unsafe condition. Not following procedures and use of container transfer carts when transferring uranium oxide containers to the target solution preparation area. These scenarios may lead to an inadvertent criticality.

  • Fission product waste stream.

Improper monitoring of the raffinate for unacceptable amounts of uranium prior to transfer of the raffinate to criticality unsafe vessels in the waste processing storage area. Failure to hold transfer of raffinate until the unacceptable amount of uranium is removed.

Transfer of waste with an unacceptable amount of uranium to criticality unsafe geometry vessels in the waste storage area may result in an inadvertent criticality.

Improper residence time or acid concentration in the uranium metal dissolution tank (1-TSPS-02T) or the uranyl sulfate preparation tank (1-TSPS-01T) could lead to carry-over of this material further into the process system. This scenario is prevented by the presence of filters downstream of these tanks. A differential pressure monitor is also installed at each filter to alert personnel of a build-up of uranium metal particles or other fissile particles on the filter.

13b.2.5.3 Sequence of Events An inadvertent criticality in the RPF is not credible as it is prevented by the facility design using multiple passive safety-related engineered design features SSCs and administrative controls in the RPF. The SHINE definition for Safety-related SSCs, described in PSAR Section 3.5.1.1.1, assures that required SSCs remain functional during normal conditions and during and following design basis events such that the potential for an inadvertent criticality accident is not credible.

Therefore, a radiological consequence analysis for a criticality accident was not performed.

Failure of these SSCs may lead to an inadvertent criticality event, resulting in a dose to personnel in the vicinity of the criticality event.

13b.2.5.4 Damage to Equipment An inadvertent criticality releases energy in the form of radiation. No equipment involved in the detection of an inadvertent criticality would be damaged; therefore, the event would be detected as required and evacuation alarms would be sounded. No other equipment damage is expected from an inadvertent criticality event in the RPF.

SHINE Medical Technologies 13b-27 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences 13b.2.5.5 Quantitative Evaluation of Accident Evolution There is the possibility that an inadvertent criticality event could occur within either a shielded area of the facility or an un-shielded area of the facility. It could also occur with different fissile material forms: metal, powder, or solution.

The dose from an unshielded criticality event has previously been shown to result in a potentially fatal dose to the worker and no significant consequence to the public (LANL, 2000). It is worthwhile to quantify the potential dose received by a worker who is near an inadvertent criticality event that occurs within a shielded area of the facility. Therefore, the dose consequence due to a worker standing beside or on top of a shielded concrete vault is determined.

The first step in quantifying the potential radiation dose due to an inadvertent criticality within a shielded concrete vault is to define the fissile material involved as well as the potential critical geometry. The most basic critical geometry is a sphere. This allows a criticality to occur with the smallest amount of fissile material.

The next step is to define the fissile material of interest. As described earlier the facility handles, processes, and stores uranium metal, uranium oxide powder, and uranium solution throughout the facility. The specific materials of interest in the facility include: uranium metal, uranium oxide powder, uranyl sulfate, and uranyl nitrate. Fissile material is assumed to be enriched to 21 weight percent U-235. The actual enrichment used is less than 20 weight percent U-235. However, to be conservative, 21 weight percent U-235 is used in the analysis.

Various reflector conditions affect the critical radius of the critical sphere of fissile material. The thickness of the reflector affects the amount of radiation that escapes the critical sphere.

Therefore, three different thicknesses of water reflection are considered: zero water thickness (bare sphere), 1 inch water reflection, and 12 inch water reflection.

A critical radius search was performed for each of the four fissile materials and each of the reflector conditions. The calculations were performed using the 3-D transport Monte Carlo code, MCNP5 v1.4. MCNP is a general-purpose Monte Carlo N-Particle transport code that can be used for neutron, photon, electron, or coupled neutron/photon/electron transport. MCNP was developed by the Los Alamos National Laboratory, Transport Methods Group, to solve a wide variety of transport problems.

Using this critical radius dimension, an additional calculation was performed using MCNP for each combination to determine the percentage of neutrons and photons that escape the critical sphere, the energy spectra of the leaking radiation, and the average number of neutrons produced per fission event. These values are used in the next subsection to determine the radiation source term for both neutrons and photons that are used to determine the final dose outside a shielded concrete vault within the facility.

13b.2.5.6 Radiation Source Term Analysis The previous subsection has determined the fraction of neutrons and photons emitted from a critical sphere of various fissile materials and reflector conditions. Also, the average number of neutrons produced for each fission event was determined. The next step is to determine how SHINE Medical Technologies 13b-28 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences many fission events are expected during the inadvertent criticality event so that the maximum source strength of photons and neutrons produced by the criticality event can be determined.

The duration of a criticality event and the amount of energy released depend in a complex manner on the quantities, physical and chemical form, and concentrations of the fissile material and on the size, configuration, moderation, reflection, and neutron absorption characteristics of the system. The energy generated by the criticality event is directly related to the fission rate.

Worldwide, 20 of the 22 reported criticality accidents occurred in solutions (LANL, 2000).

Although a solid-phase material inadvertent criticality event cannot be ruled out, its likelihood is judged to be well below that for aqueous or solution criticalities. Therefore, the number of fissions produced during an inadvertent criticality event are based on solution criticality excursions.

In general, solution criticality events are characterized by an initial spike followed by a plateau region characterized by a series of smaller spikes of decreasing magnitude. The maximum spike yield that has been observed from a solution criticality event is 2 x 1017 fissions (LANL, 2000).

Each spike typically has a duration on the order of a few seconds. During that time, the fission rate is variable. The spike yield is the total number of fissions that occur during the spike (i.e., the time integral of the fission rate over the spike). The time between spikes is variable and is a complex function of the system.

Twenty-two separate accidental criticalities that occurred in fissile material process operations have been documented (LANL, 2000). Spike yields vary from 3 x 1015 to 2 x 1017 fissions, while total yields vary from 1 x 1015 to 4 x 1019 fissions. It should be noted that the few accidents with estimated total yields greater than 1 x 1018 fissions were events that continued over a long duration of time. Most commonly the system behavior during these excursions was oscillatory, and the total yield corresponded to a number of individual events. It should also be noted there is no criticality accident information for low enriched uranium systems. Accident data are relative to high enriched uranium or plutonium systems.

Although total fissions released during the event will be based on solution criticality events, there are estimates from solid phase systems. Estimates of peak fission rate and total number of fissions for an accidental nuclear criticality in a moderated, reflected solid system may be derived from data from accidents and from experiments with light- and heavy-water-moderated reactors.

Criticality accident data are reported in NRC (1998a), for uranium and plutonium elements of various shapes with water or graphite moderation. Reactor excursion data are also reported in NRC (1998a) for uranium-aluminum and UO2 stainless steel clad fuels. The total number of fissions for the relevant accidental criticalities ranges from 1 x 1015 to 1 x l017fissions while the total number of fissions for reactor excursions is bounded by 5 x 1018 fissions for the reported power levels (NRC, 1998a). Criticality events in moderated, reflected solid systems were characterized by an initial burst with little or no plateau period.

Fission yield has also been estimated for critical experiments (NRC, 1998b). The 24 CRAC experiments covered a limited range of parameters with HEU solutions of volumes from 19 to 134 L, tank diameters of 80 cm (31.52 in.) and 30 cm (11.82 in.), reactivity insertion rates of 0.014 to 0.786 $/s, and densities of 30.6 to 320 grams of U/L. The resulting first pulse fission yields ranged from 3.1 x 1016 to 1.8 x 10 17 fissions.

SHINE Medical Technologies 13b-29 Rev. 1

[Security-Related Information - Withhold Under 10 CFR 2.390]

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences A fission yield cannot be selected for modeling purposes with 100 percent certainty that it will not be exceeded. There are simply too many variables and the problem is so highly situation-dependent that it is impossible to account for all scenarios. With regards to determining the magnitude of the fission yield, NRC (1998a), states:

Thus, the nature and magnitude of possible accidents are assessed individually and conservative analyses are used to evaluate the adequacy of NCS protection systems.

Therefore, it is up to the analyst to choose a fission yield large enough to bound, within reason, an accident that may occur at a site of interest. Based on the previous discussion and the fission yields available from criticality accidents and experiments involving high enriched uranium or plutonium, a total fission yield of 1 x 1018 fissions is chosen to determine the consequences of a criticality event within the shielded concrete vault in the RPF.

Using the total number of fissions produced during the inadvertent criticality event (1 x 1018), the total number of source neutrons and photons escaping the critical sphere can be determined.

The largest neutron source strength was determined to be 9.77 x 1017 resulting from a critical sphere of water-moderated uranium oxide with a moderator to fissile material ratio (H/X) of 200 with no water reflection. The largest photon source strength was determined to be 3.98 x 1018 resulting from a critical sphere of water-moderated uranium metal with an H/X ratio of 700 with 1 inch of water reflection.

13b.2.5.7 Radiological Consequence Analysis With the source magnitude defined for both neutrons and photons escaping the critical sphere, the calculation of the dose outside of a shielded concrete vault within the facility can be determined.

A typical concrete vault was modeled as a room with internal dimensions of 6 feet by 6 feet by 6 feet with walls [ Security-Related Information ]. The room was assumed to be filled with dry air at 1 atm and 32°F.

The surface dose was determined at two locations outside the concrete vault. One location is at the outside surface of the vertical concrete wall. Another location is the outside surface of the vault ceiling.

The dose was determined by calculating three contributors: direct neutron dose, direct photon dose, and indirect photon dose (those photons created by neutron interactions with material causing photons). It is assumed that the ventilation system for the concrete vault handles any fission product gases; therefore, the dose due to fission product gases was not determined.

Total dose calculated at the outer surface of the vertical wall due to an inadvertent criticality inside a concrete vault was 4.60 rem. Total dose calculated at the outer surface of the ceiling due to an inadvertent criticality inside a concrete vault was 4.33 rem. Neither of these values exceed the total worker dose annual limit of 5 rem. Therefore, an inadvertent criticality event inside a shielded concrete vault within the facility is not an event of significant concern.

SHINE Medical Technologies 13b-30 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences 13b.2.5.8 (Will be renumbered to 13b.2.5.4 after deletions accepted) Safety Controls As stated before, the credible accident scenarios that could cause an inadvertent criticality are highly unlikely. This is accomplished by specifying safety controls (IROFS) that reduce the likelihood of such scenarios. A list of safety controls is provided in Table 13b.2.5-1.

SHINE Medical Technologies 13b-31 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences Table 13b.2.5-1 Safety-Related SSCs and Technical Specification Administrative Controls (IROFS) to Prevent and Mitigate Criticality Accidents (Sheet 1 of 2)

Functional (c) (a) (b)

Control Function Qualification Requirement Metal or Oxide Criticality Outside Shielded Cells Criticality-safe P PEC Safe geometry containers and/or volume Fixed spacing P PEC Safe geometry racks /spacing Handling P AC Separate fissile controls material containers; operator training Solution Criticality Outside Shielded Cells Criticality-safe P PEC Safe geometry vessels /spacing Criticality-safe P PEC Safe geometry sumps and/or volume Sump level P AEC Detect high sensors level in sump Sump pumps P PEC Safe geometry and/or volume; AEC Pumps solution from sump upon high level detection Criticality-safe P PEC Safe geometry containers and/or volume Handling P AC Separate fissile controls material containers; operator training Solution Criticality Inside Shielded Cells Criticality-safe P PEC Safe geometry vessels /spacing Criticality-safe P PEC Safe geometry sumps and/or volume Sump level P AEC Detect high sensors level in sump SHINE Medical Technologies 13b-32 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences Table 13b.2.5-1 Safety-Related SSCs and Technical Specification Administrative Controls (IROFS) to Prevent and Mitigate Criticality Accidents (Sheet 2 of 2)

Functional (c) (a) (b)

Control Function Qualification Requirement Sump pumps P PEC Safe geometry and/or volume; AEC Pumps solution from sump upon high level detection Concrete vault M PEC Radiation walls shielding Solution P AC Detect Sampling unacceptable uranium concentration prior to transfer to unsafe geometry Metal or Oxide Criticality Inside Shielded Cells Filters P AC Prevent solid material carry-over Differential P AC Detect solid Pressure material Monitors build-up on filters Solvent Control P AC Ensure Program dissolution is complete prior to transferring solution a) Function: P=Preventive; M=Mitigative b) Qualification: PEC=Passive Engineered Control; AEC=Active Engineered Control; AC=Technical Specification Administrative Control c) SSCs listed are safety-related SHINE Medical Technologies 13b-33 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences 13b.2.6 RADIOISOTOPE PRODUCTION FACILITY FIRE This subsection analyzes the credible accident conditions that could result in a release of radioactive material or hazardous chemicals produced from licensed materials into or outside of the controlled areas of the RPF. This subsection includes development and analysis of fire scenarios that are postulated in the RPF.

The RPF is located in the RCA outside of the IF. The RPF contains processes associated with extraction and purification of the Mo-99 product from irradiated target solution, preparation and recycling of the target solution, and the waste processing. Individual chemical processes are located in hot cells and glove boxes which are connected via piping located in pipe trenches throughout the RPF. Process storage tanks are located in concrete vaults, below grade in the RPF. Batch tanks, supporting various process operations are located within the process hot cell and glove box enclosures.

The equipment and processes in the RPF present a potential for fire. Ignition and fuel sources in this area are primarily small in nature with the greatest hazards located within process enclosures.

The potential exists for the accumulation of hydrogen in a noble gas storage tank because of a failure of the TOGS to recombine the hydrogen produced in the TSV. The deflagration or detonation of the hydrogen in the noble gas storage tank is assumed to cause activity of one noble gas storage tank to be released into the noble gas storage cell. The airborne activity is released to the environment through RVZ1, exposing the public until the bubble tight dampers are isolated after ten percent of the activity is released. In addition to the public exposure, ten percent of the activity is assumed to leak into the RCA through penetrations in the noble gas storage cell, which exposes workers until they exit the RCA. This scenario is the same as the inadvertent release of the contents of the noble gas storage tank into the noble gas storage cell due to a malfunction or mishandling of equipment evaluated in Subsection 13b.2.4. Therefore, this subsection discusses a fire inside a process enclosure such as a hot cell, glove box, or tank vault.

13b.2.6.1 Initial Conditions and Assumptions An RPF fire has been identified as a potential accident-initiating event (IE) by the Final ISG Augmenting NUREG 1537 and the ISA Summary performed for the SHINE facility. Production facility fire-initiating events have the potential to cause damage to IROFS and ESFs SR SSCs located within the RPF. Fires that may damage IROFS or ESFs SR SSCs are evaluated in this section to determine their potential to cause a radioactive release to the environment.

Initial conditions considered for these fires include:

  • Normal RPF operations supporting chemical processing of irradiated target solution within process enclosures,
  • Maintenance activities involving system overhaul or system modification within process enclosures,
  • Normal operations within the RPF, outside of the process enclosures,
  • Maintenance activities performed outside of process enclosures.

Fires postulated in the RPF may result from:

SHINE Medical Technologies 13b-33 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences

  • Equipment malfunction (e.g. electrical equipment or pump fire),
  • Loss of ignition or combustible material control,
  • Fire propagation from areas exterior to the RPF when fire area barriers are breached/open.
  • Exothermic chemical reactions that may lead to a fire.

The following assumptions apply to the fires considered in this section:

  • Small quantities of lubricating or insulating oil are contained in in-situ equipment (less than one gallon [3.8 L]),
  • Tank enclosure and pipe trench shield/access plugs are normally closed; however, they may be removed to support maintenance activities during system outages.
  • Power and control cables for redundant trains of IROFS and/or ESFs SR SSCs are adequately separated to prevent direct fire damage and spread between trains.
  • Procedural controls are in place to administratively limit the admission of transient combustible materials within the RPF to a maximum of 2 lbs/ft2.
  • Electrical cabling exhibits limited combustibility and is self-extinguishing outside the presence of an ignition source.
  • The RCA ventilation system is supplied with fire detection which is interlocked to the RCA ventilation system and isolation dampers to provide isolation when alarmed.
  • Administrative Controls are in place to limit the possibility of unintended incompatible chemicals coming into contact with each other leading to an exothermic chemical reaction.

13b.2.6.2 Identification of Causes Fires occurring in the RPF may be categorized as either a fire in the general area or a fire located inside of a process or system enclosure such as hot cells, glove boxes, tank vaults, and laboratories. The general area outside of these enclosures is open and provides a large volume for deposition of products of combustion. Fires originating inside process or system enclosures may generate a hot-gas-layer (HGL) that is capable of damaging IROFS SSCs or ESFsSR SSCs outside of the immediate area of the fire; this is not likely to occur for fires located in the general area of the RPF.

An additional category involves fires originating outside of the RPF that propagate into the RPF where fire area barriers have been breached for maintenance or similar activities. Administrative control of fire barrier impairments ensures that an additional level of preventative fire protection controls and fire watch personnel are in place to prevent fire spread across compromised barriers. Controls include greater restriction on hot work and constraint of transient combustible storage in the immediate vicinity of any breach. These controls ensure that an IE involving fire spread from outside the RPF is bounded by a fire in the general area of the RPF.

IEs that could generate a fire involve various fire initiators. The capability of these to damage redundant trains of IROFS SSCs and/or ESFsSR SSCs is dependent on their location and potential for fire growth/spread into other combustible materials. Events that could precipitate fire and lead to a fire-related accident are as follows:

  • Electrical Equipment Failure - This event involves an electrical system failure in equipment such as an electrical distribution cabinet, junction box, motor control center, SHINE Medical Technologies 13b-34 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences switchgear, or control cabinet. This IE may be caused by an error during maintenance resulting in a faulted circuit, failure of a fuse or circuit breaker during an overcurrent event, or faulting of a cable due to damaged jacketing.

  • Electric Motor - This event involves failure of a ventilation, hoist, or pump motor. A fire involving an electrical motor involves electrical failure of the motor windings due to a locked rotor condition or bearing failure that ignites collocated secondary combustibles.
  • Pump - This event involves failure of a pump lubrication system such as spillage and ignition of lubricant. This IE involves damage to the pump oilers such that lubricant is spilled to a pump skid. This IE may be caused by breakage of a pump oiler due to operations or maintenance activities in the vicinity of the pump and ignition of pre-heated lubricating oil.
  • Transient Combustible - This event involves a human error that results in ignition of transient combustibles. he transient combustible provides the fuel source for the fire event, coupled with a sufficiently energetic IE such as improperly controlled hot work which results in development of a damaging fire.
  • Exothermic Chemical Reactions - This event involves a human error or other failure that results in mixing chemicals within a hot cell enclosure that when in the presence of each other could lead to an exothermic reaction increasing temperature of the mixture that could increase the severity of a fire or result in a fire or explosion.

13b.2.6.3 Sequence of Events The RPF was reviewed and the design basis fire occurs inside a process enclosure such as a hot cell, glove box, or tank vault. A fire in these locations has the potential to entrain or release radiological materials as a direct result of the fire or damage to important equipment. Fires with the greatest potential for radiological release would involve either the Mo extraction feed tank or the Mo eluate hold tank located in each supercell. These tanks are used for hold up of the target solution prior to being routed to or from the extraction column. These tanks have similar radionuclide inventories. Fire damage that leads to spurious opening of a drain valve or damage to seals could precipitate a release of this material into the supercell. Such a fire may be caused by any of the previously identified IEs. The Mo extraction feed tank is the design basis fire in the RPF.

The potential for a radiological release involving the design basis fire associated with the Mo extraction feed tank is mitigated by several IROFS SR SSCs. The mechanical piping, valves and tank are not directly susceptible to fire damage, thus direct fire damage to these components would not likely lead to a release. Severe fire damage to flange or valve seals could precipitate leaks from the mechanical piping, valves and tank; however, the likelihood of such damage is very low because the low combustible loading of the supercells would prevent development of a severe fire. If a leak were precipitated by a fire it would likely release only small amounts of Mo-99 eluate, thus any radiological release would be bounded by a release of the entire tank.

Also, the chemicals present within this process enclosure cell does not lead to an exothermic reaction causing a fire. Finally the supercell construction and its fire detection and suppression system would limit the effects of any fire occurring within. The supercell is constructed of thick concrete barriers, viewing windows, and access openings. These features are designed to provide radiation shielding however their robust design provides significant fire separation from the general area of the RPF. The hot cell fire detection and suppression system would detect any fire within and close isolation dampers located in the exhaust filter housing, which would limit radiological release through the exhaust stack. The hot cell fire detection and suppression SHINE Medical Technologies 13b-35 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences ensures that fires occurring inside a process enclosure, tank vault, pipe way, or glove box are contained by the construction of the enclosure.

b. Cabling in the RPF is qualified to IEEE 1202 which ensures limited combustibility and limits the potential for fire ignition, growth, and spread. Fire involving this cable does not spread beyond the initiating flame. This design ensures that fires involving electrical cable and fire spread to exposed cables is severely limited.
c. As defined in the fire hazards analysis (FHA), mechanical, electrical and ventilation penetrations into process enclosures are sealed in a manner that the seals provide fire separation equivalent to that provided by the separation barrier.
d. Redundant trains of IROFS SSCs and ESFs SR SSCs are separated by fire barriers.
e. Combustible loading inside RPF and process enclosures, tank vaults, pipe trenches, or glove boxes is maintained at an average of less than 2 pounds per square foot.
f. Automatic or manual fire suppression is provided for vaults and hot cells.
g. Ventilation system isolation is provided by bubble-tight dampers. These dampers are interlocked to process enclosure fire detection systems to ensure system shut down and isolation for detected fires. This design ensures the ability to prevent passage of potentially contaminated products of combustion to the environment. The airborne activity is filtered and released to the environment through the HVAC system prior to isolation of the bubble-tight dampers allowing ten percent of the airborne activity to exit the facility.

The HEPA filter is assumed to have an efficiency of 99 percent for particulates and the charcoal filter is assumed to have an efficiency of 95 percent for halogens.

h. Administrative Controls are in place to prevent unintended chemicals from coming into contact with each other that may lead to an exothermic chemical reaction.
i. Ten percent of the released activity exposes workers in the RCA until they evacuate.

Personnel evacuation from the RCA occurs within 10 minutes.

13b.2.6.6 Radiation Source Term Analysis Tanks 1-MEPS-04T and 1-MEPS-02T were evaluated as potential source terms for this event. It was determined that the worst case fire scenario involves a fire affecting Tank 1-MEPS-02T.

The material at risk from Tank 1-MEPS-02T for isotopes contributing more than one percent of dose is given in Table 13b.2.6-1. Ten percent of the airborne material is assumed to be released through RVZ1 prior to isolation by the bubble-tight dampers. Ten percent of airborne activity is also assumed to be released to the RCA through penetrations in the supercell prior to evacuation of the facility.

13b.2.6.7 Radiological Consequence Analysis The maximum expected dose to a member of the public is 8.77E-04 rem (site boundary) and 1.23E-04 rem (nearest resident) and the maximum expected worker dose is 0.578 rem.

SHINE Medical Technologies 13b-37 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences 13b.2.6.8 Safety Controls Safety controls are credited to mitigate the effects of a design basis fire in the RPF. The following safety controls are identified as IROFS SSCs, ESFs, or defense-in-depth items SR SSCs or Technical Specification administrative controls. As appropriate these items are included in the facility technical specifications pursuant to 10 CFR 50.36.

  • Installed combustible loading in the RPF and process enclosures is low (DID) (TS Administrative Control).
  • Supercells, hot cells, tank enclosures, process enclosures are robustly constructed of non-combustible materials which provide fire resistance and radiological shielding (IROFS) (SR).
  • Interior finish provided in supercells, hot cells, tank enclosures, process enclosures is noncombustible or limited combustible materials (DID).
  • Administrative control of the admission and storage of transient combustible materials and potentially exothermic-reacting chemicals and the performance of hot work is maintained in the RPF (DID) (TS Administrative Control).
  • Use of and storage of flammable and combustible liquids and gases is in accordance with the facility fire protection program (DID) (TS Administrative Control).
  • Penetrations and components installed through fire area boundaries, hot cells, supercells and process enclosure barriers provide separation commensurate with the barrier protection (DID) (SR).
  • Automatic fire detection systems are installed and maintained in hot and supercells (IROFS).
  • Automatic fire suppression systems have the capability to be manually actuated (DID).
  • The hot cell fire detection and suppression system fire detection subsystem is interlocked to the cell ventilation system to provide ventilation isolation when fire is detected (IROFS).
  • Manual fire suppression capability is provided in the RPF through installation of appropriate fire extinguishers and fire hose reels (DID).
  • Firefighting capability is provided by trained firefighting personnel (DID).

The above safety controls provide assurance that radiological releases and consequences to workers and the public are maintained within 10 CFR 20 limits.

SHINE Medical Technologies 13b-38 Rev. 1

[Proprietary Information - Withhold from public disclosure under 10 CFR 2.390(a)(4)]

Chapter 13 - Accident Analysis Analyses of Accidents with Hazardous Chemicals Produced from Licensed Material 13b.3 ANALYSES OF ACCIDENTS WITH HAZARDOUS CHEMICALS PRODUCED FROM LICENSED MATERIAL The Final ISG Augmenting NUREG-1537 and the ISA Summary and the corresponding HAZOPS/PHA identified IEs and scenarios that involve chemical hazards that have the potential for significant consequences to workers, the public, or the environment. Only those hazards associated with chemicals produced from licensed material or that could affect the safety of licensed material will be evaluated for safety controls in this section.

The SHINE facility uses a variety of solid and liquid process chemicals, some of which are toxic chemicals. The chemicals are in relatively small (<1000 lbs) quantities. They include acids, bases, oxidizers, and flammables. Only a limited number of chemicals exceed 1000 lb quantities (e.g., nitric acid, sulfuric acid, and [ Proprietary Information ]).

These hazardous (including toxic) chemicals are used to support a wide variety of operations such as: (1) target solution preparation, (2) radioisotope production, extraction and purification, (3) target solution cleanup and thermal denitration, and (4) waste operations. Most of these operations are conducted in cells that have an inventory well below 100 lb. The bulk of the chemicals associated with licensed materials are stored in storage rooms outside the RCA, and in tank vaults inside the RCA.

This section focuses on identifying and evaluating the potential for chemical accidents involving significant quantities of toxic chemicals hazardous chemicals that are produced from licensed material that could lead to exceeding the Emergency Response Planning Guideline (ERPG) or equivalent levels (Temporary Emergency Exposure Limits [TEEL] or Acute Exposure Guideline Levels [AEGL]) as stated in the SHINE definition of safety-related. It also focuses on identifying chemical process controls that could prevent or mitigate such accidents and thus ensure that workers and the public are protected from such hazards. Based on the potential for exceeding ERPG levels, some of those controls are identified as IROFS and/or ESFs safety-related.

There are other process chemicals that could become fire and/or deflagration/explosion hazards (e.g., n-dodecane, deuterium, tritium), and as such are treated as potential initiators for those postulated accident categories. Only those that could result in the release of toxic chemicals hazardous chemicals that are produced from licensed material are explicitly evaluated in this section. Other process chemicals are considered to be industrial hazards that could lead to asphyxiation, burns, and other commonly accepted industrial consequences. These later type of hazards are not considered in this section, and are assumed to be controlled by industrial safety and hygiene programs.

There are no external chemical safety issues related to plant conditions that affect or may affect the safety of licensed materials and thus do not increase radiation risk to workers, the public, or the environment.

13b.3.1 CHEMICAL ACCIDENTS DESCRIPTION This section identifies the chemical hazards, potential IEs, and accidents that could result in unacceptable consequences to workers and/or the public (e.g., exceed ERPG levels), along with initial conditions and assumptions related to chemical hazards. Postulated accidents are described with respect to the potential interaction of process chemicals with licensed materials, SHINE Medical Technologies 13b-40 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Hazardous Chemicals Produced from Licensed Material confinement vessels, facility SSCs, and facility workers. A brief description of the accident progression is presented with respect to the controls that is designed to prevent or mitigate such chemical accidents. Mitigation of the consequences of chemical accidents will be reflected in the emergency plan, which is provided in the FSAR. A detailed description of these controls is presented in Subsection 13b.3.3.

13b.3.1.1 Initial Conditions and Assumptions The initial conditions and assumptions associated with chemical hazards produced from licensed material or that could affect the safety of licensed material are as follows:

a. Table 13b.3-1 identifies the bounding inventories (lbs) for each predominant process chemical along with their location and process use. The chemicals on this list are only those with ERPG, TEEL, AEGL limits/levels and quantities of more than a few pounds.
b. It is conservatively assumed that all postulated IEs impact the entire inventory in a single location (e.g., storage area, or tank or vessel in a vault or cell).
c. Significant quantities of toxic chemicals (with the potential to exceed ERPG limits at the site boundary) are delivered via DOT-approved containers. The evaluation of chemical hazards near (outside) the facility is provided in Subsection 2.2.3.
d. Tanks or vessels containing liquid chemicals are located within berms capable of holding the entire tank or vessel volumes.
c. Bulk storage outside the RCA is in a dedicated chemical storage area defined as a fire area while Storage in the RCA is exclusively in tank vaults or cells. Uranyl sulfate storage and preparation is in a dedicated fire area.
d. Spills of chemicals within the facility are assumed to take place in a 100 ft2 berm area.

This is a conservative assumption, given that most floor areas where chemicals are stored or present are <100 ft2, with the exception of the UREX hot cell, and waste evaporation cell; however, even for these areas, it is assumed that the berm area is 100 ft2. In the UREX cell the chemicals (e.g., nitric acid, acetohydroxamic acid) are in solution with the irradiated solution, so the hazards are predominantly due to fission products and fissile material, not the chemicals themselves. As a result of the fission product hazards, controls that mitigate radiological releases from this cell also mitigate chemical releases.

A pool evaporation model is used to determine the amount of liquid chemicals that are released.

13b.3.1.2 Identification of Initiating Events and Causes As indicated in the ISA Summary, There are several potential IEs or causes that could lead to toxic chemical releases of hazardous chemicals produced from licensed material, which if left uncontrolled, could potentially challenge the ERPG limits. These IEs and associated causes include:

a. Failure of tanks and/or vessels (including associated valves, piping, and overflow lines) with significant quantities of toxic chemicals inside vaults or cells is assumed to be due to operational mechanical failures, or human errors, or natural phenomena, none that could result in releases of hazardous materials chemicals produced from licensed materials.
b. Failure of tanks and/or vessels with significant quantities of toxic chemicals outside vaults or cells is assumed to be due to operational mechanical failures, or human errors.

SHINE Medical Technologies 13b-41 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Hazardous Chemicals Produced from Licensed Material

b. Failure of tanks and/or vessels with significant quantities of toxic chemicals inside vaults or cells (includes associated valves, piping, and overflow lines) due to fires.
c. Failure of tanks and/or vessels with quantities of toxic chemicals outside vaults or cells is assumed to be due to fires.
d. Exothermic reactions between chemicals leading to damage to tanks or vessels containing significant quantities of toxic materials.
e. Mishap during handling of chemicals leads to breach or spill of chemicals from tanks or vessels.
f. Mishap during handling of chemicals leads to spill of chemicals outside tanks or vessels.
h. Mishap (e.g., spill) during delivery of toxic chemicals outside the facility.
g. Excessive time of process solution in the evaporator creates increased concentrations and temperatures that promote formation of unstable compounds (e.g., reactions between nitric acid, Tri-Butyl Phosphate (TBP), and related decomposition products) that accumulate over time, resulting in an explosion and release of chemicals produced from licensed materials.
h. Degradation products not removed from Strip Solution, lead to solutions transferred for processing in the UN Evaporator and Thermal Denitrator causing a sudden reaction of unstable species giving rise to a chemical explosion in the UN Evaporator or Thermal Denitrator and a release of chemicals produced from licensed materials.

No significant quantities of toxic chemicals (i.e., below Reportable Quantities) hazardous chemicals produced from licensed materials are stored outside the facility.

13b.3.1.3 Sequence of Events The sequence of events following an initiated event that could potentially lead to a release of a toxic chemical depends on the cause of the IE and where it takes place. For scenarios that take place inside vaults or cells, the following sequence of events is likely to occur (as indicated previously, it is conservatively assumed that postulated IEs impact the entire inventory in a single location, e.g., storage area, or tanks or vessels in a vault or cell):

  • The vessel or tank could, depending on the magnitude of the IE, survive or fail.
  • For liquid chemicals, any loss of confinement or containment from a tank or vessel results in a spill into the berm, cell, or vault around the tank or vessel. No significant quantities of dry or powder forms of toxic chemicals are present in the vaults or cells as indicated in Table 13b.3-1.
  • Methods are employed for detection of liquid spills.
  • The vault or cells provide a secondary barrier to protect workers. The RCA ventilation system exhausts releases from the facility.

For scenarios that take place in the chemical storage area(s) outside cells or vaults, the following sequence of events is expected to occur:

a. As with releases within vaults and cells, the tanks or vessels could, depending on the magnitude of the IE, survive or fail.
b. For liquid chemicals, any loss of confinement or containment from a tank or vessel results in a spill into the berm around the tank or vessel. Any failure of a container with dry hazardous chemicals results in a release into the storage area; however the amount of airborne hazardous material is considered to be significantly less than if it were a liquid (due to the difference in the release fractions or rates between these material forms).

SHINE Medical Technologies 13b-42 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Hazardous Chemicals Produced from Licensed Material

c. Methods are employed for detection of liquid spills.
d. The chemical storage rooms or equivalent areas provide barriers to any potential release, with the support of its associated ventilation system (RVZ2 for uranyl sulfate preparation/storage rooms, and facility ventilation Zone 4 [FVZ4] for the chemical storage rooms outside the RCA).

The impacts of these hazardous chemicals are expected to be confined within the vaults or cells, or storage areas. The facility ventilation systems dilute the concentration of such toxic chemicals within these locations, and reduces potential releases by filtering any particulate hazardous chemicals (as long as they are compatible with the filtration media in the ventilation system), and ensure that release under normal operating conditions is released through the facility stack, thus further diluting or reducing the potential concentrations of hazardous toxic chemicals at the site boundary or to the nearest population.

13b.3.1.4 Quantitative Evaluation of Accident Evolution As discussed in Subsection 13b.3.1.2 several potential IEs were postulated that could lead to a release of hazardous chemicals produced from licensed materials. Depending on the IE, there are several facility design and operational controls that protect the tanks, vessels, or containers with hazardous chemicals.

For fire IEs, the low combustible loading, limited availability of ignition sources, and fire detection and suppression in cells and storage areas, along with the berms around the tanks or vessels (preventing flame impingement) and the fire resistant construction of the tanks and vessels themselves make the potential for a chemical release unlikely (between 1E-4 and 1E-5/yr -

according to the NUREG/CR-1520 likelihood categorization).

For natural phenomena IEs (e.g., seismic events), tanks and vessels within the RCA with significant quantities of hazardous toxic materials with the potential for exceeding ERPG levels are seismically anchored and designed not to fail during such events.

Human error IEs that could result in a release of significant amount of hazard chemicals are very limited. Most of these human errors are likely to result in relatively low quantities of chemicals spilled or released due to mishandling activities, filling or transfer operations, with the exception of those taking place outside the facility (e.g., during delivery operations). The limited access of personnel inside vaults and cells make this type of IEs unlikely (<1E-4/yr).

For scenarios caused by exothermic reactions between chemicals, the segregation and/or isolation of chemical storage based on the potential for exothermic reactions along with the integrity of the tanks and vessels themselves makes this type of IE unlikely to occur (between 1E-4 and 1E-5/yr).

See Subsection 2.2.3 for an analysis of chemical hazards near the facility.

SHINE Medical Technologies 13b-43 Rev. 1

[Proprietary Information - Withhold from public disclosure under 10 CFR 2.390(a)(4)]

Chapter 13 - Accident Analysis Analyses of Accidents with Hazardous Chemicals Produced from Licensed Material 13b.3.2 CHEMICAL ACCIDENT CONSEQUENCES The following analysis has been performed for hazardous toxic chemicals within the facility, and not just those produced from licensed materials, since the listed chemicals may or may not be produced from or associated with licensed materials depending on which point in the process or system is being considered. This analysis is therefore bounding for all hazardous chemicals produced from licensed materials. Safety-related or administrative controls have been developed only for those systems or processes where the hazardous chemical is produced from or otherwise associated with licensed materials.

The initial conditions and assumptions, identification of initiating events and causes, sequence of events, and the quantitative evaluation of accident evaluation are preserved in Subsection 13b.3.1. This subsection discusses the consequences of the scenarios described in Subsection 13b.3.1.

In the event of release of hazardous toxic chemicals within the facility, there is a potential for exposure to workers and to the public. Instead of trying to bound the potential releases and associated Chemical Dose (CD - or concentration) for the single most toxic chemical produced from licensed materials based on screening methodologies like the Vapor Hazard Ratio (DOE, 1999), the toxic chemicals with the highest inventories in Table 13b.3-1 and with the highest toxicity (lowest ERPG values) have been evaluated using widely accepted methodologies and/or computer codes, such as ALOHA or EPIcode. Both codes have been verified and validated (V&V) and are commonly used for safety analysis purposes by government agencies such as the Department of Energy (DOE).

A determination has been made as to whether the CD for such chemicals could exceed the ERPG limits for the various frequency categories (as defined in the consequence versus frequency category matrix provided by NUREG/CR-1520). Where ERPG limits are exceeded, IROFS SR controls are identified to prevent or mitigate the consequences from postulated scenarios when they relate to releases of hazardous chemicals produced from licensed materials.

13b.3.2.1 Damage to Equipment The release of toxic chemicals is not expected to result in damage to IROFS SR SSCs, with the exception of the damaged caused by the IE to tanks and vessels themselves. Tanks and vessels are compatible with the chemicals that they contain.

13b.3.2.2 Chemical Source Term Analysis As indicated in Table 13b.3-1, bounding inventories (or material-at-risk [MAR]) for the chemicals of concern have been provided. From this list of chemicals identified in Table 13b.3-1, 11 chemicals were identified for further analysis based on their toxicity, potential dispersibility, and inventory. The selected hazardous chemicals are: nitric and sulfuric acid, calcium hydroxide, caustic soda, [ Proprietary Information ], ammonium hydroxide, [ Proprietary Information ],

n-dodecane, potassium permanganate, tributyl phosphate, and uranium nitrate.

Of concern in a postulated accident is what fraction of the hazardous chemical inventory is impacted by the scenario (damage ratio [DR]), what fraction of the inventory becomes airborne (airborne release fraction [ARF]), and in some cases the respirable fraction (RF), and is readily SHINE Medical Technologies 13b-44 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Hazardous Chemicals Produced from Licensed Material transported outside of the facility (leakpath factor [LPF]). The five-factor formula is being used to determine the source term of dispersible/respirable material that is released to the environment; namely:

Source term = MAR x DR x ARF x RF x LPF (Equation 13b.3-1)

Source terms are evaluated using models and/or computer codes that conform to NUREG/CR-6410s methodologies. Conservatively, it is assumed that IEs impact the entire inventory in the bounding location; that is, a DR of 1.0 is assumed for postulated accidents.

Releases of liquid toxic chemicals are modeled to limit evaporation since none of the tanks or vessels containing toxic chemicals are pressurized. In all cases, the evaporation of the entire inventory takes several hours.

ARFs/RFs for solid or powder chemicals have been selected to bound those in NUREG/CR-6410, namely an ARF/RF of 1E-03/1.0 from a spill of powders. Notice that some chemicals are delivered in solid or powder form (e.g., caustic soda) but are prepared or used in liquid form; however, for conservatism, these were modeled as powders, since the source term is higher than when modeled as being released from an evaporating pool. An LPF of 1.0 has been assumed conservatively at this time for all chemicals except for nitric acid and n-dodecane. For nitric acid and n-dodecane, only those inventories associated with licensed materials have been analyzed for release. These inventories exist inside tank vault or hot cells. As such, an LPF of 0.1 has been assumed for these two release scenarios (see Table 13b.3-1). This LPF corresponds to the most conservative LPF used for the bubble-tight isolation dampers.

13b.3.2.3 Chemical Concentrations and Comparison to Acceptable Limits Consequence or chemical dose modeling are evaluated using dispersion models and/or computer codes that conform to NUREG/CR-6410 methodologies.

Typical computer codes to model chemical releases and determine the chemical dose (or concentration) are the ALOHA and EPIcode; as indicated previously both computer codes are widely used for supporting accident analysis and emergency response evaluations. Both codes have been used and accepted by DOE. V&V for both codes has been performed for modeling chemical hazards for the SHINE facility. Because ALOHA only can readily model only about half of these chemicals, the EPIcode was selected to perform chemical dose calculations in this section, and ALOHA was used to benchmark some of the EPIcode runs.

In running EPIcode, no credit is taken for depletion or plateout of chemicals within the facility or during transport to the site boundary or nearest population location. Dispersion calculations performed are done assuming stable meteorological conditions (i.e., stability F) and 3.3 ft/s (1 m/s) wind speed. These meteorological conditions are typically seen about 15 percent of the time at the site. Ambient temperature was assumed to be 75°F (24°C). A deposition velocity of 3.3 ft/s (1 m/s), a receptor height of 5 ft. (1.5 m) was used to simulate the height of an individual, concentrations are plume centerline values. Releases were conservatively modeled as ground non-buoyant.

Chemical doses or concentrations were determined for the 11 chemicals for a postulated collocated worker within the site boundary (328 ft. [100 m]) at the site boundary and at the nearest residence (1319 817 ft. and 2585 ft. [402 249 m and 788 m], respectively).

SHINE Medical Technologies 13b-45 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Hazardous Chemicals Produced from Licensed Material summarizes the results of the source term and concentration calculations for the 11 chemicals.

The acceptance limits were those identified in NUREG/CR-6410 and correspond to Protective Action Criteria (PAC) values corresponding to AEGLs, ERPGs, or TEELs values for such chemicals.

The chemical dose or concentration for the nearest residence is below the PAC 1, 2 and 3 levels (equivalent to ERPG 2 and 3 ERPG-1, 2 and 3). For the workers postulated to be located within the boundary 328 ft. (100 m) downwind, the concentrations are below the PAC values.

SHINE Medical Technologies 13b-46 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Hazardous Chemicals Produced from Licensed Materials 13b.3.3 CHEMICAL PROCESS CONTROLS The safety controls preventing or mitigating the consequences of a toxic hazardous chemical release produced from licensed materials are:

  • Berms and cell and vault configuration (IROFS and ESF).
  • Separation of chemical storage based on the potential for exothermic reaction (IROFS).
  • Chemical inventory control (IROFS).
  • Fire detection system (DID).
  • Room, Cell, and vault physical barriers (DID) (SR).
  • Thermal Denitrator Vent (SR).
  • Uranyl Nitrate Evaporator Vessel Vent (SR).
  • Solvent Control Program (TS Administrative Control).

SHINE Medical Technologies 13b-47 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Hazardous Chemicals Produced from Licensed Material Table 13b.3-1 Bounding Inventory (lbs) of Significant Process Chemicals (Sheet 2 of 4)

Bounding Chemical Location Inventory (Lbs) Notes n-Dodecane N/A 1596 Facility total Caustics Room 1033 Storage inventory Tank Vault 259 Tank Vault 304 Bounding inventory for n-Dodecane associated with licensed materials. Spills pure n-Dodecane from a tank into a hot cell Hydrochloric Acid Acids Room 3 Hydrogen Peroxide Caustics Room 3 Molybdenum Trioxide Hot Lab 0.66 Nitric Acid N/A 17556 Facility total Acids Room 6229 Storage inventory; assumes stored as received in 1000L IBC at 15.9 M HNO3.

Max inventory of 2 containers Uranyl Sulfate Prep 113 Tank Vault 23 Tank Vault 363 UREX hot cell 7 Consists of the scrub and strip solutions Tank Vault 721 Bounding inventory for nitric acid associated with licensed materials. Spills 12 M nitric acid from a tank into a hot cell.

Tank Vault 4 TDN area 0.03 30L holdup volume Liquid waste storage tank 9648 Assumes both A&B tanks are full.

vaults SHINE Medical Technologies 13b-49 Rev. 1

[Proprietary Information - Withhold from public disclosure under 10 CFR 2.390(a)(4)]

Chapter 13 - Accident Analysis Analyses of Accidents with Hazardous Chemicals Produced from Licensed Material Table 13b.3-2 SHINE Toxic Chemical Source Terms and Concentrations Nearest Hazardous Source Worker MOI MEI Residence Chemical/Release MAR Term(a) Concentration Concentration Concentration Mechanism (lb) ARF/RF (lb) PAC-1 PAC-2 PAC-3 (100 m) (402 249 m) (788 m)

Nitric Acid, 12 M, associated with licensed 6,229 6,229 1.0 0.53 ppm 24 ppm 92 ppm 1 5 0.49 ppm 3.0 0.090 ppm 0.4 0.012 ppm materials 721 721 (Evaporating Liquid)

Sulfuric Acid 0.20 8.7mg/m 160 7,770 1.0 7,770 2.4E-06 ppm 4.7E-07 mg/m3 6.3E-08 mg/m3 (Evaporating Liquid) mg/m3 mg/m3 Calcium Hydroxide 240 1,500 3,182 0.001 3.182 15 mg/m3 0.86 mg/m3 0.16 mg/m3 0.020 mg/m3 (Dispersed Solid) mg/m3 mg/m3 Caustic Soda 0.5 50 (Dispersed as both a 1,488 0.001 1.488 3 5 mg/m3 0.40 mg/m3 0.073 mg/m3 0.010 mg/m3 mg/m mg/m3 powder and liquid)

[ Proprietary Information ] [ Proprietary [ Proprietary [ Proprietary 4,104 0.001 4.104 1.1 mg/m3 0.20 mg/m3 0.026 mg/m3 (Dispersed Solid) Information ] Information ] Information ]

Ammonium Hydroxide 2300 59 0.001 0.059 61 ppm 330 ppm 0.011 ppm 2.0E-03 ppm 2.6E-04 ppm (Evaporating Liquid) ppm

[ Proprietary Information ] [ Proprietary [ Proprietary [ Proprietary 606 0.001 0.606 0.16 mg/m3 0.03 mg/m3 3.9E-03 mg/m3 (Dispersed Solid) Information ] Information ] Information ]

Dodecane associated 1,033 1,033 0.0028 0.031 0.023 0.0023 with licensed materials 1.0 7.9 ppm 4.4E-034ppm 5.9E-045 ppm 304 304 ppm ppm ppm (Evaporating Liquid)

Potassium Permanganate 8.6 14 78 66 0.001 0.001 0.018 mg/m3 3.3E-03 mg/m3 4.2E-04 mg/m3 (Dispersed Solid) mg/m3 mg/m3 mg/m3 Tributyl Phosphate 0.6 3.5 125 333 0.001 0.333 0.0082 ppm 1.5E-03 ppm 2.0E-04 ppm (Evaporating Liquid) mg/m3 mg/m3 mg/m3 Uranyl Nitrate 0.99 5.5 33 480 0.001 0.480 0.024 mg/m3 0.024 mg/m3 3.1E-03 mg/m3 (Dispersed as a powder) mg/m3 mg/m3 mg/m3 a) With the potential for exceeding ERPG-2 limits at site boundary SHINE Medical Technologies 13b-52 Rev. 1

Chapter 14 - Technical Specifications Administrative Controls 14a2.6 ADMINISTRATIVE CONTROLS Administrative controls will be provided in the technical specifications.

Examples of the proposed subjects of administrative controls are provided below:

Procedures Written procedures shall be established, implemented, and maintained covering activities described in the following Programs.

Programs

  • Criticality-safety
  • ALARA (includes use of accelerator and hot cell audible and visual warnings)
  • Procurement and use of transport and waste containers
  • Fire protection (includes installed and transient combustible loading, performance of hot work, deuterium source vessel integrity, fire watch requirements, use and storage of flammable and combustible liquids and gasses)
  • Solvent control (includes control of process residence times, solvent quality control, and solvent solution sampling and analysis)
  • Tritium control (includes inventory control and sampling)
  • Light water coolant activity monitoring
  • Chemical control SHINE Medical Technologies 14a2-7 Rev. 1

Chapter 14 - Technical Specifications Introduction Table 14a2-1 SHINE Facility Proposed Parameters for Technical Specifications (Sheet 1 of 10)

Chapter/

Section/

Subsection Reference per ANSI/ANS-1 5.1-2007 Section Name SLs and LSSS Basis 2 SLs and LSSS 2.1 SLs

  • TSV power 13a2.1.8/13a2.2.8 Large undamped power oscillations
  • Uranium concentration 13a2.1.2/13a2.2.2 Insertion of excess reactivity
  • Uranium enrichment 13a2.1.11/13a2.2.11 PSB System interaction events
  • Quantities of radioactive materials 13b.2.4 Critical equipment malfunction 13b.2.5 Inadvertent nuclear criticality in the radioisotope
  • Quantities of hazardous production facility chemicals 13b.2.6 Radioisotope production facility fire 2.2 Limiting Safety
  • TSV LSSS 13a2.1.2/13a2.2.2 Excess reactivity System a. TSV cover gas hydrogen 13a2.1.8/13a2.2.8 Large undamped power oscillations Settings concentration high 13a2.1.9/13a2.2.9 Detonation and deflagration in primary system boundary
b. TSV neutron flux high, source range
c. TSV neutron flux high, high range SHINE Medical Technologies 14a2-8 Rev. 1

Chapter 14 - Technical Specifications Introduction Table 14a2-1 SHINE Facility Proposed Parameters for Technical Specifications (Sheet 6 of 10)

Chapter/

Section/

Subsection Reference per ANSI/ANS-1 5.1-2007 Section Name LCO or Condition Basis 3.7 Radiation

  • Noble gas storage tank activity 13b.2.4 Critical equipment malfunction Monitoring
  • Target solution transfer decay time Systems and
  • Radiation monitoring systems 13a2.1.4/13a2.2.4 Mishandling or malfunction of target solution Effluents a. Channels and interlocks with 13a2.1.7/13a2.2.7 Mishandling or malfunction of equipment ventilation systems affecting the PSB
b. Monitoring equipment operable 13a2.1.12.3/13a2.2.12.3 TPS design basis accident 3.8 Experiments N/A N/A 3.9 Facility
  • Hot cell fire detection and suppres- 13b.2.6 Radioisotope production facility fire Specific LCOs sion system (detection only)
a. Detection system operable
b. Ventilation system interlock operable
  • Criticality-safe sumps 13b.2.5 Inadvertent nuclear criticality in the radioisotope
a. Sump pump operable production facility
b. Sump level detectors operable
  • Radiological Integrated Control Sys- 13b.2.4 Critical Equipment Malfunction tem (RICS)

SHINE Medical Technologies 14a2-13 Rev. 1

Chapter 14 - Technical Specifications Introduction 14b TECHNICAL SPECIFICATIONS OF PROCESSES OUTSIDE THE IRRADIATION FACILITY This section encompasses the technical specifications for the processes involving special nuclear material (SNM), radioisotopes, and chemicals outside the IF produced from licensed materials.

In accordance with the requirements of 10 CFR 50.34 (a)(5), this section identifies the variables and conditions that will likely be the subjects of technical specifications for the SHINE facility.

These may change with the operating license application. These variables and conditions are based on the preliminary design of the SHINE facility. The technical specifications will be submitted with the operating license application.

These proposed technical specifications have been formulated on the premise that this material presents a sound framework upon which a final, complete set of specifications can be developed with the operating license application.

14b.1 INTRODUCTION The format and content of the Technical Specifications will be written with the guidance provided in ANSI/ANS 15.1 (ANSI/ANS 2007), NUREG-1537, and the Final ISG Augmenting NUREG-1537. The technical specifications for the facility outside the IF will comply with the regulations in 10 CFR 50.36 pertaining to a fuel reprocessing facility, as required by the Final ISG Augmenting NUREG-1537.

SHINE Medical Technologies 14b-1 Rev. 1

Chapter 14 - Technical Specifications Safety Limits and Limiting Safety System Settings 14b.2 SAFETY LIMITS AND LIMITING SAFETY SYSTEM SETTINGS 14b.2.1 SAFETY LIMITS FOR PROCESSING IRRADIATED SPECIAL NUCLEAR MATERIAL OUTSIDE OF THE REACTOR For irradiated SNM outside of the TSV, SLs are derived for criticality accident prevention based on the Nuclear Criticality Safety Program, and also from an Integrated Safety Analysis (ISA).

Limits are specified, using the double-contingency principle, to avoid a criticality accident. Limits are set with a conservative margin.

For irradiated SNM outside of the TSV, appropriate limits are imposed pursuant to 10 CFR 50.36(c)(1) to ensure that fission products will be controlled to prevent excessive releases from the containment components, systems, or structures, particularly those structures, systems, and components containing large inventories of byproduct material.

14b.2.2 SAFETY LIMITS FOR PROCESSING UNIRRADIATED SPECIAL NUCLEAR MATERIAL OUTSIDE OF THE IRRADIATION FACILITY Limits are specified, using the double-contingency principle, to avoid a criticality accident. Limits are set with a conservative margin.

14b.2.3 SAFETY LIMITS FOR RADIOCHEMICAL PROCESSING Safety limits for radiochemical processing are developed to maintain operations within limits pursuant to 10 CFR 50.36 to protect the staff and the public. The amount of radiation is limited so as not to exceed the shielding and confinement capabilities of the systems and components in which the materials are processed or stored.

14b.2.4 SAFETY LIMITS FOR CHEMICAL PROCESSING Safety limits for chemical processing with hazardous chemicals that are conducted coincident to operations with SNM or radioactive material are developed in accordance with 10 CFR 50.36.

These SLs could take the form of item relied on for safety (IROFS) designated in an ISA and defined in 10 CFR 70.4 and described in 10 CFR 70.61(e).

14b.2.5 LIMITING SAFETY SYSTEM SETTINGS For each process variable or parameter for which a SL is specified, and for which monitoring instruments are used, a protective operating limit is set to avoid exceeding the SL. This LSSS is calculated to provide a conservative margin below the SL and to account for overall measurement uncertainty, operating characteristics of control systems, and accuracy of control instrumentation. LSSSs will be established, as much as possible, to ensure adequate safety margins for each of the processes described above.

Refer to Table 14a2-1 for the SLs and LSSSs associated with the processes outside the irradiation facility.

SHINE Medical Technologies 14b-2 Rev. 1

Chapter 14 - Technical Specifications Administrative Controls 14b.6 ADMINISTRATIVE CONTROLS Chemical storage segregation and control of chemical inventories is identified as an IROFS in Chapter 13b.3. A chemical control program will be developed to control chemical segregation and chemical inventories.

Fissile material handling is identified as an IROFS in Chapter 13b.2.5. A nuclear criticality safety program will be developed.

See Section 14a2.6 for examples of Administrative Controls that will be in use at the SHINE Facility.

The remaining administrative controls will be provided in the technical specifications.

SHINE Medical Technologies 14b-6 Rev. 1

Retrieved from "https://kanterella.com/w/index.php?title=ML14357A364&oldid=2450408"