ML15131A481

Enclosure 2 - Shine Medical Technologies, Inc., Response to Request for Additional Information (Public Version)

ML15131A481
Person / Time
Site:	SHINE Medical Technologies
Issue date:	05/01/2015
From:	SHINE Medical Technologies
To:	Office of Nuclear Reactor Regulation
Shared Package
ML15131A464	List: ML15131A462 ML15131A479 ML15131A481
References
SMT-2015-014
Download: ML15131A481 (28)

Text

SHINE MEDICAL TECHNOLOGIES, INC.

SHINE MEDICAL TECHNOLOGIES, INC. APPLICATION FOR CONSTRUCTION PERMIT RESPONSE TO REQUEST FOR ADDITIONAL INFORMATION PUBLIC VERSION The NRC staff determined that additional information was required (Reference 1) to enable the continued review of the SHINE Medical Technologies, Inc. (SHINE) application for a construction permit to construct a medical isotope facility (References 2 and 3). SHINE provided responses to a portion of the NRC staffs request via Reference (4). The following information is provided by SHINE in response to the remaining NRC staffs requests.

CHAPTER 3 - DESIGN OF STRUCTURES, SYSTEMS, AND COMPONENTS Section 3.5 - Systems and Components RAI 3.5-7 As required by 10 CFR 50.34(a)(4), the information in the PSAR shall contain [a] preliminary analysis and evaluation of the design and performance of structures, systems, and components of the facility with the objective of assessing the risk to public health and safety resulting from operation of the facility, and the adequacy of structures, systems, and components provided for the prevention of accidents and the mitigation of the consequences of accidents.

In response to RAI 3.5-4 SHINE stated, in part, that the Control Room is part of a safety-related, Seismic Category I structure, but that the other SSCs are not defined as safety-related based on SHINEs definition of safety-related structures, systems, and components.

While SHINEs response to RAI 3.5-4 also states that safety-related systems are automatic and would put the facility in a safe condition without operator intervention, there is no discussion on how control room operators or other facility personnel will determine the facility is in a safe condition or how personnel will maintain the facility in a safe condition.

Under the conditions of a postulated design basis earthquake and a loss of offsite power, conditions could exist which would inhibit facility personnel from determining that the facility is in a safe condition and maintaining the facility in a safe condition using necessary safety-related equipment:

• SHINE PSAR Tables 2.3-2 and 2.3-3 show that the outdoor temperature can vary between 37°F and 104°F. While Control Room ventilation is supplied via Facility Ventilation Zone 4 (FVZ4), which is nonsafety-related, the Control Room has no heating, ventilation, and air conditioning (HVAC) system, which could impact Control Room habitability and equipment operability.

• The SHINE facility does not include emergency lighting, which could impact the ability of facility personnel to assess the facility status and to staff the Control Room.

Page 1 of 28

• Since the Stack Release Monitoring System is not defined as safety-related, its unavailability could impact the ability of facility personnel to determine that there are no releases going up the stack.

• Since the Health Physics Monitors are not defined as safety-related, their unavailability could impact the ability of facility personnel to assess levels of contamination during egress from the facility.

• Since the Facility Data and Communication System is not defined as safety-related, its unavailability could impact the ability of control room personnel to determine the facility status and communicate with other facility personnel and offsite agencies.

• In the event of an earthquake, there is the possibility for both onsite and offsite toxic releases and smoke from fire. Since the Facility Breathing Air System is not defined as safety-related, its unavailability could impact the ability of facility personnel to determine the facility status.

Additional information is needed on the design of the SHINE control room and other SSCs for NRC staff to determine the adequacy of the design for the prevention of accidents and the mitigation of the consequences of accidents.

Taking into account the conditions described above, provide additional information describing how the design of the SHINE control room and other SSCs will allow control room operators or other facility personnel to determine the facility is in a safe condition or how personnel will maintain the facility in a safe condition in the event of a postulated design basis earthquake with a loss of off-site power.

SHINE Response The SHINE facility is designed to be maintained in a safe configuration through the use of safety-related equipment during normal operations and as required to prevent or mitigate the consequences of abnormal operational transients or design basis accidents.

The Control Room Operators and other SHINE personnel will be able to determine the facility is in a safe condition and maintain it in a safe condition through several means, as described below.

The SHINE Facility Control Room is a robust, highly protected structure within the production facility building. The hardened structure that contains the Control Room is protected against credible severe external events, including seismic events, tornadoes, and airplane crashes.

The Control Room and the safety-related equipment required to monitor the facility to determine its status and maintain it in a safe condition will be at a temperature sufficient to allow habitability and equipment operability following a loss of off-site power (LOOP) or a design basis earthquake. The means to accomplish this will be determined during detailed design, and may consist of:

• A passive safety-related heat removal system;

• A safety-related chilled water system to cool equipment; Page 2 of 28

• A safety-related ventilation sub-system to service the control room and related equipment to provide heating or cooling;

• An analysis that demonstrates the time required to reach an unacceptable temperature is longer than the time necessary to obtain and install portable heating or cooling equipment; or

• A combination of the above options.

During detailed design, SHINE will demonstrate that the Control Room will be within reasonable temperatures following a LOOP. Reasonable temperatures are those that will ensure safety-related equipment operability and will ensure that the Control Room Operators can monitor plant conditions following a LOOP. The reasonable temperature range will be determined during detailed design. SHINE will describe the method chosen to ensure the Control Room remains within a reasonable temperature range, and define the reasonable temperature range, in the Final Safety Analysis Report (FSAR). An IMR has been initiated to track the inclusion of this information in the FSAR.

The Control Room will have access to information on the status of safety-related plant systems through the display and interface panels for the Target Solution Vessel (TSV) Reactivity Protection System (TRPS) and Radiological Integrated Control System (RICS), the Engineered Safety Features Actuation System (ESFAS) operator panel, the radiation monitor displays from the Radiation Area Monitoring System (RAMS), the displays and alarms for the Criticality Accident Alarm System (CAAS), and the neutron fluxes measured by the Neutron Flux Detection System (NFDS) and relayed to the TRPS. These systems are safety-related and powered by the Uninterruptable Power Supply System (UPSS). These systems provide sufficient information to allow personnel in the Control Room to determine that the plant is in a safe condition and maintained in a safe condition.

The Control Room will have adequate lighting following a seismic event or LOOP. As described below, emergency lighting is provided for the facility. SHINE has added the Emergency Lighting System (ELTG) to the systems list provided in Table 3.1-1 of the PSAR. A mark-up of the PSAR changes is provided in Attachment 1. The non-public (proprietary) version of the PSAR, incorporating the changes provided in Attachment 1, is provided in Enclosure 3. The public (non-proprietary) version of the PSAR, incorporating the changes provided in , is provided in Enclosure 4.

Control Room emergency lighting will have an 8-hour battery backup power. Emergency lighting with 8-hour battery backup power will also be installed in the Radiologically Controlled Area (RCA), which in addition to assisting with safe egress as described in Subsection 9a2.3.4.4.1.4 of the PSAR, will also provide adequate lighting in the area should surveys, inspections, or other activities be needed. As described in Subsection 8a2.1.4 of the PSAR, emergency lights are powered (i.e., charged) by the standby diesel generator (SDG), in addition to the Normal Electrical Power Supply System (NPSS). If the duration of the power outage is greater than the runtime of the batteries and the SDG is unable to provide an alternate source of power, then personnel will use handheld lights for monitoring activities following a seismic event or LOOP. SHINE expects this to be an unlikely event over the life of the facility.

Handheld lights will be inventoried and surveilled to ensure they are available when required.

In addition to the monitoring of the plant conditions through the Control Room instrumentation described above, SHINE personnel will also be able to assess releases through the facility stack. The primary means of monitoring the facility stack will be with the Stack Release Monitoring (SRM) system. This system will provide monitoring of noble gases, aerosols, iodine, and tritium effluents. Although nonsafety-related, SHINE will add the SRM system to the loads Page 3 of 28

Security-Related Information - Withheld Under 10 CFR 2.390 powered by the UPSS, and therefore the SRM system will likely be available after a LOOP. The nominal connected load and the nominal demand load for the SRM system will be determined during detailed design. SHINE will update the UPSS load list provided in Table 8a2.2-1 of the PSAR in the FSAR to include the SRM system. An IMR has been initiated to track the inclusion of this information in the FSAR.

As described in Section 7.2.3 of the SHINE Preliminary Emergency Plan (Reference 5), if the SRM system becomes unavailable due to a design basis earthquake,

[ Security-Related Information ].

As described in Section 7.4.5 of the SHINE Preliminary Emergency Plan, in the event of a design basis earthquake or LOOP resulting in the loss of Health Physics Monitors,

[ Security-Related Information ]. This equipment will be inventoried and surveilled to ensure it is available when required.

The Control Room Operators and other SHINE personnel will be able to communicate with each other and off-site agencies during a seismic event or LOOP. SHINE has multiple independent communication subsystems available that use different technologies to ensure at least one method is available for on-site and off-site communication. As described in Section 8.5.1 of the SHINE Preliminary Emergency Plan, [ Security-Related Information ].

As described in Section 13b.3 of the PSAR, SHINE has evaluated potential chemical hazards from on-site chemicals associated with licensed materials and included appropriate safety controls to prevent or mitigate the consequences to an acceptable level. Off-site chemical hazards have been evaluated in Subsection 2.2.3 of the PSAR and in the SHINE Response to RAI 2.2-3 (Reference 6).

Fire areas in the irradiation facility (IF) and radioisotope production facility (RPF) are separated by three-hour rated fire barriers to prevent the spread of a fire throughout the facility. While one fire zone may become uninhabitable, the majority of the facility will not be affected.

SHINE also has a diesel-driven fire pump, which is expected to be available following a LOOP.

The SHINE fire protection systems and programs are described in Section 9a2.3 of the PSAR.

As described above, the design of the Control Room and other structures, systems, and components (SSCs) will ensure that SHINE personnel can assess the safe condition of the facility and ensure that it is maintained in a safe shutdown condition following a design basis earthquake or LOOP.

Page 4 of 28

CHAPTER 6 - ENGINEERED SAFETY FEATURES Section 6b.3 - Nuclear Criticality Control (Applies to RAIs 6b.3-23 through 30)

As required by 10 CFR 50.34(a)(4), an applicant needs to submit [a] preliminary analysis and evaluation of the design and performance of structures, systems, and components of the facility with the objective of assessing the risk to public health and safety resulting from operation of the facility, and the adequacy of structures, systems, and components provided for the prevention of accidents and the mitigation of the consequences of accidents.

As stated in the ISG Augmenting NUREG-1537, Chapter 13, the NRC staff has determined that the use of integrated safety analysis (ISA) methodologies as described in 10 CFR Part 70, Domestic Licensing of Special Nuclear Material, and NUREG-1520, Standard Review Plan for the Review of a License Application for a Fuel Cycle Facility, Revision 1, May 2010, application of the radiological and chemical consequence and likelihood criteria contained in the performance requirements of 10 CFR Section 70.61, designation of IROFS, and establishment of management measures are acceptable ways of demonstrating adequate safety for the medical isotopes production facility.

Applicants may propose alternate accident analysis methodologies, alternate radiological and chemical consequence and likelihood criteria, alternate safety features, and alternate methods of assuring the availability and reliability of the safety features.

As used in this ISG, the term performance requirements, when referencing 10 CFR Part 70, Subpart H, is not intended to mean that the performance requirements of Subpart H are required for a radioisotope production facility license, only that their use as accident consequence and likelihood criteria may be found acceptable by NRC staff.

RAI 6b.3-23 The ISG Augmenting NUREG-1537, Part 2, Section 6b.3, Nuclear Criticality Safety for the Processing Facility, states, in part that [c]riticality process safety controls should be provided for criticality safety, and a description of their safety function should be described. The applicant should use enough safety controls to demonstrate that, under normal and abnormal credible conditions, all nuclear processes remain subcritical and that NCS [nuclear criticality safety]

limits on controlled parameters will be established to ensure that all nuclear processes are subcritical, including an adequate margin of subcriticality for safety.

For example, the applicant could commit to base the safety limits on validated calculation methods. These methods should be industry-accepted and peer-reviewed. Also, the applicant should commit to ensuring that methods used to develop NCS limits will be validated to confirm that they are used within acceptable ranges and that the applicant used both appropriate assumptions and acceptable computer codes.

In response to RAI 6b.3-1b, SHINE submitted a general validation report and a project-specific validation report, which provided the methods and assumptions used to determine that nuclear criticality safety criteria are met at the SHINE facility. Staff reviewed these reports and has determined that additional information is needed to determine that the methods used to validate NCS safety criteria are acceptable and that SHINE used both appropriate assumptions and acceptable computer codes.

Page 5 of 28

a. The general validation report appears to be an off-the-shelf report, dated 2007. As described in ANSI/ANS-8.24, Validation of Neutron Transport Methods for Nuclear Criticality Safety Calculations, verification and validation should be performed using the same operating systems, software, and hardware that will be used for performing evaluations and placing systems under configuration control.

Provide additional information describing how the general validation report uses appropriate methods to validate NCS safety criteria, including information on the operating systems, software, and hardware used to perform evaluations and place systems under configuration control.

b. As described in NUREG-6698, Guide for Validation of Nuclear Criticality Safety Calculational Methodology, prior to the initiation of validation activities, the operating conditions and parameters for which the validation is to apply must first be identified.

For both the general and project-specific validation reports, describe the area of applicability with respect to the actual operations and describe the applicability of the benchmark experiments to these operations.

c. As described in NUREG-6698, the statistical results from the bias trends are used to establish safety limits. Both the general and project-specific validation reports are missing an evaluation of trends in the bias data, which may impact potential bias estimates.

For both the general and project-specific validation reports, provide an evaluation of the trends in the bias data, describing potential impacts on the bias impacts.

d. The validation of two different libraries for different materials, introduces the possibility of human error in selecting a library for the evaluation (i.e., picking the wrong library).

Provide the methods SHINE uses to guard against the selection of the incorrect library for validation.

e. The project-specific validation report utilizes only a limited number of experiments to evaluate the bias and estimate uncertainty. For example, only four experiments were listed for the most applicable enrichment. Additionally, modeled results were compared with calculated results, as opposed to only with experimental data.

Explain why only a limited number of experiments are sufficient to evaluate bias and estimate uncertainty. Additionally, explain why modeled results were compared with calculated results, as opposed to only with experimental data.

SHINE Response

a. SHINE is developing a consolidated facility-specific validation report which uses appropriate methods to validate nuclear criticality safety (NCS) safety criteria, including information on the operating system, software, and hardware used to perform verification and validation.

The same operating system, software, and hardware will be used to perform evaluations and place systems under configuration control.

SHINE will provide the facility-specific validation report to the NRC by June 12, 2015.

Page 6 of 28

b. SHINE is developing a consolidated facility-specific validation report which will include information in that report regarding the area of applicability with respect to the actual operations and describe the applicability of the benchmark experiments to these operations.

SHINE will provide the facility-specific validation report to the NRC by June 12, 2015.

c. SHINE is developing a consolidated facility-specific validation report which will include an evaluation of the trends in the bias data. The facility-specific validation report will also describe potential impacts of the trends on the bias estimates.

SHINE will provide the facility-specific validation report to the NRC by June 12, 2015.

d. SHINE is developing a consolidated facility-specific validation report. This report will be generated using a NCS computer cluster that uses only one cross section library for the benchmark calculations and the SHINE facility NCS calculations will use only that cross section library. These details will be included in the facility-specific validation report.

SHINE will provide the facility-specific validation report to the NRC by June 12, 2015.

e. SHINE is developing a consolidated facility-specific validation report. This report will include approximately 40 benchmarks across a range of enrichments which are anticipated to be from 5 to 30 percent. This number of experiments will be sufficient to evaluate bias and estimate uncertainty. The consolidated facility specific report will only compare the modeled results to experimental data.

SHINE will provide the facility-specific validation report to the NRC by June 12, 2015.

RAI 6b.3-24 The ISG Augmenting NUREG-1537, Part 2, Section 6b.3, states, in part, that [e]ach process that has accident sequences leading to criticality should have sufficient controls in place to ensure double-contingency protection. This may be provided by either (1) control of two independent process parameters, or (2) control of a single process parameter, such that at least two independent failures would have to occur before criticality is possible. The first method is preferable because of the inherent difficulty in preventing common-mode failure when controlling only one parameter. Additional discussions of the double-contingency principle are available on pages 5-7 and 5-A-8 of NUREG-1527.

In response to RAI 6b.3-10, SHINE states that tank 1-TSPS-01T meets double contingency by geometry and the configuration management program. NRC staff does not view the configuration management program as an independent control. As described in 10 CFR 70.4, configuration management is not normally considered a management measure because it assures the availability of the geometry control.

Provide additional information describing how tank 1-TSPS-01T meets the double contingency principle.

SHINE Response The uranyl sulfate preparation tank (1-TSPS-01T) is a favorable geometry tank that is of robust and corrosion-resistant design and is designed to be criticality-safe for the optimum uranium concentration, including consideration of heterogeneous effects. It is credible, but unlikely, that Page 7 of 28

a leak could develop in this tank. Any leakage is directed to the criticality-safe sump serving this tank and then directed to the criticality-safe sump catch tank (1-RDS-01T), which will maintain the leakage in a favorable geometry for the optimum uranium concentration, including consideration of heterogeneous effects. The drains are non-valved and there is no mechanism for material to accumulate in an unfavorable geometry in the sump or drain tank. The Radioactive Drain System (RDS) also contains leak detection and alarm capability to surveil and alert the operators to take action, which makes any leakage coming from 1-TSPS-01T detectable and self-revealing.

The double contingency principle is met for this potential change in process conditions because 1-TSPS-01T is a favorable geometry tank and any solution leakage from the tank would enter a favorable geometry sump. This leakage would be surveilled via leak detection and alarm and would be self-revealing. SHINE will update Subsection 6b.3.1 of the PSAR in the FSAR to provide clarification on how the design for the favorable geometry tanks adheres to the double contingency principle, as described above. An Issues Management Report (IMR) has been initiated to track the inclusion of this information in the FSAR.

In addition, SHINE will be providing a nuclear criticality safety evaluation (NCSE) as part of the SHINE Response to RAI 6b.3-30, which will provide a discussion of how 1-TSPS-01T meets the double contingency principle.

RAI 6b.3-25 NUREG 1520, Section 3.4.3.2, Integrated Safety Analysis Summary and Documentation, states that an event defined as not credible must be convincing despite the absence of designated [controls]. Typically, this can be achieved only for external events known to be extremely unlikely.

In response to RAI 6b.3-3, SHINE provides the basis for considering a criticality sequence to be not credible. In this explanation, SHINE essentially quotes the three independent acceptable sets of qualities that could define an event as not credible from Section 3.4.3.2 of NUREG-1520.

In the response to RAI 13b.1-1, SHINE established, in Table 13b.1-1-2, Likelihood Index Limit Guidelines, an event frequency associated with highly unlikely and unlikely that is consistent with the values found in NUREG-1520.

While SHINE provides three independent sets of qualities that could define an event as not credible, SHINEs criteria does not take into account an absence of designated controls.

Without a reliance on controls, consistent with the guidance in NUREG-1520, criticality, in certain situations, would be credible, but highly unlikely, due to the establishment of controls consistent with the methods proposed. Therefore, additional information is required for NRC staff to determine the adequacy of SHINEs use of the term not credible in its PSAR with respect to criticality safety.

Revise the definition of not credible to not include reliance on controls consistent with the guidance in NUREG-1520 and event frequency limits provided in Table 13b.1-1-2 or provide information why this is not necessary.

Page 8 of 28

SHINE Response The SHINE Response to RAI 6b.3-3 (Reference 7) provided a definition of not credible.

However, the definition of not credible needs to be revised to explicitly exclude reliance on controls, consistent with the guidance provided in NUREG-1520 (Reference 8). The not credible nature of an event with respect to criticality safety at the SHINE facility does not depend on any facility feature that could credibly fail to function or be rendered ineffective as a result of a change to the system.

SHINE has revised the definition of not credible as applied to criticality safety as follows:

Any one of the following three independent acceptable sets of qualities could define an event as not credible:

1. An external event for which the frequency of occurrence can conservatively be estimated as less than once in a million years.

2. A process deviation that consists of a sequence of many unlikely events or errors for which there is no reason or motive. In determining that there is no reason for such errors, a wide range of possible motives, short of intent to cause harm, must be considered.

3. A convincing argument exists that, given physical laws, process deviations are not possible, or are extremely unlikely. The validity of the argument is not dependent on any feature of the design or materials controlled by the Technical Specifications or safety-related SSCs or activities.

The demonstration of "not credible" with respect to criticality safety must be convincing despite the absence of designated safety-related SSCs and activities and Technical Specifications.

Typically, this can be achieved only for external events known to be extremely unlikely.

Subsection 13b.2.5 of the PSAR provides a description of the safety controls, administrative controls, and safety-related SSCs that maintain subcriticality and prevent an inadvertent criticality under normal and abnormal conditions in the RPF. The accident scenarios listed in Subsection 13b.2.5 that could cause an unintended criticality are highly unlikely due to the safety controls listed in Table 13b.2.5-1 of the PSAR. Additionally, double-contingency protection will ensure that unintended criticality is highly unlikely.

Where applicable to nuclear criticality safety, SHINE has revised the PSAR to replace the words not credible with appropriate wording, consistent with the above noted design philosophy. A mark-up of the PSAR changes is provided in Attachment 1. The non-public (proprietary) version of the PSAR, incorporating the changes provided in Attachment 1, is provided in Enclosure 3.

The public (non-proprietary) version of the PSAR, incorporating the changes provided in , is provided in Enclosure 4.

RAI 6b.3-26 The ISG Augmenting NUREG-1537, Part 2, Section 6b.3, states, in part, that the reviewer should determine whether the margin of subcriticality for safety is sufficient to provide reasonable assurance of subcriticality.

Page 9 of 28

In response to RAI 6b.3-4, SHINE states it intends to utilize a subcritical margin of 0.05 with additional considerations for uncertainty in the validation and modeling. In addition, SHINE states in multiple places in the PSAR that processes will be maintained to a keff 0.95 (assuming a subcritical margin of 0.05).

The NRC staffs review of SHINEs response to RAI 6b.3-1, which requested the applicants validation report and NCS reference manual, found that there was insufficient benchmarking of the code against experiments utilizing the materials and enrichments expected in SHINEs processes. For this reason, the proposed subcritical margin of 0.05 is not sufficient to adequately address the uncertainty associated with the neutron interactions of these process materials. The subcritical margin of 0.05, which SHINE quoted from NUREG-1520, was intended for facilities with enrichment less than five percent utilizing well established processes and for which there is significant experience and data. In contrast, the SHINE facility will be a first-of-a-kind facility using materials not normally utilized and of an enrichment up to 20 percent.

Provide additional information describing how SHINE will sufficiently benchmark against experiments utilizing the materials and enrichments expected to be used in SHINE facility processes for its proposed margin of subcriticality, or propose a new margin of subcriticality that appropriately takes into account materials and enrichment.

SHINE Response SHINE is developing a consolidated facility-specific validation report which will describe how SHINE has sufficiently benchmarked against experiments utilizing the materials and enrichments expected to be used in SHINE facility processes for the proposed margin of subcriticality, or additional information will be provided proposing a new margin of subcriticality that appropriately takes into account materials and enrichment.

SHINE will provide the facility-specific validation report to the NRC by June 12, 2015.

RAI 6b.3-27 The ISG Augmenting NUREG-1537, Part 2, Section 6b.3, Nuclear Criticality Safety for the Processing Facility, states that the reviewer should determine if, when they are relevant, the applicant considers heterogeneous effects. Heterogeneous effects are particularly relevant for low-enriched uranium processes, where, all other parameters being equal, heterogeneous systems are more reactive than homogeneous systems.

SHINE PSAR, Section 6b.3, Nuclear Criticality Control, states that [h]eterogeneous effects are not considered applicable because the uranium enrichment is less than 20 percent.

In the response to RAI 6b.3-6, SHINE elaborated on its treatment of heterogeneous effects by quoting LA-12808, Nuclear Criticality Safety Guide, stating that heterogeneous effects can be ignored for uranium with an enrichment above six percent uranium-235.

As shown in figures 22 through 25 of LA-10860-MS, Critical Dimensions of Systems Containing U-235, Pu-239, and U-233, heterogeneity does affect some parameters at greater than six percent enrichment in U-235.

Page 10 of 28

Provide additional information acknowledging that heterogeneity effects will be considered when establishing NCS controls and limits, where such are credible and relevant.

SHINE Response SHINE will consider heterogeneity effects when establishing NCS controls and limits, where such are credible and relevant.

RAI 6b.3-28 The ISG Augmenting NUREG-1537, Part 2, Section 6b.3, Nuclear Criticality Safety for the Processing Facility, states that the reviewer should determine whether the applicants use of moderator as a controlled parameter is acceptable.

In the response to RAI 6b.3-8, SHINE states that preliminary criticality scoping safety assessments include optimum moderation conditions. The preliminary design does not contain systems that require moderation as the sole controlled criticality safety parameter and there are no plans to have moderation controlled areas. While moderation may not be a sole controlled safety parameter, it is unclear whether SHINE will be reliant on moderation controls in any capacity. NRC staff needs additional information to determine whether SHINE considers moderation to be a controlled parameter.

Verify whether the SHINE facility will be reliant on moderation controls in any capacity as opposed to a sole control. If moderation controls will be used, provide information describing these controls.

SHINE Response There could be cases where SHINE may use moderation in conjunction with other controlled criticality safety parameters to ensure criticality safety. The specific controls used to control moderation will depend on the situation being evaluated and will be described in the NCSEs.

If SHINE uses moderation as a controlled parameter, the following acceptance criteria from NUREG-1520 (Reference 8) for moderation control will be met:

• SHINE will follow ANSI/ANS-8.22-1997 (R2011) (Reference 9).

• When process variables can affect the moderation, the accident analysis shows the process variables to be controlled by either safety-related SSCs or licensing basis administrative items.

• Moderation is measured by using instrumentation subject to facility administrative controls.

• The design of physical structures prevents the ingress of moderators.

• When moderation needs to be sampled, dual independent sampling methods are used.

• Firefighting procedures for use in a moderation-controlled area evaluate the use of moderator material.

• After evaluation of all credible sources of moderation for the potential for intrusion into a moderation-controlled area, the ingress of moderation is prevented or controlled.

SHINE will update Subsection 6b.3.1 of the PSAR in the FSAR to include a description of the use of moderation as a controlled parameter, as described above. An IMR has been initiated to track the inclusion of this information in the FSAR.

Page 11 of 28

RAI 6b.3-29 The ISG Augmenting NUREG-1537, Part 2, Section 6b.3, Nuclear Criticality Safety for the Processing Facility, states that the reviewer should determine whether the applicants use of enrichment as a controlled parameter is acceptable.

In response to RAI 6b.3-18 SHINE states that criticality scoping safety assessments have been performed using a uranium enrichment value of 21 percent to conservatively address uranium enrichment. NRC staff needs additional information to determine whether SHINE considers enrichment to be a controlled parameter.

Verify whether enrichment will be a controlled parameter controlled by independent verification, upon receipt of materials, to assure no out-of-spec materials are utilized.

SHINE Response SHINE considers enrichment to be a controlled parameter. In order to ensure no out-of-spec materials are utilized, SHINE will independently verify uranium enrichment upon receipt. Once a shipment of uranium material is independently verified to assure enrichment is within specifications, then enrichment is no longer a controlled parameter for this material.

SHINE will perform an analysis regarding the receipt of uranium with incorrect enrichment and will consider criticality events in the accident analysis associated with receiving the incorrect enrichment. These actions will be performed during detailed design and the analysis results will be included in the FSAR. An IMR has been initiated to track the inclusion of this information in the FSAR.

SHINE will update Subsection 6b.3.1 of the PSAR in the FSAR to include a description of the use of enrichment as a controlled parameter, as described above. An IMR has been initiated to track the inclusion of this information in the FSAR.

RAI 6b.3-30 The ISG Augmenting NUREG-1537, Part 2, Section 6b.3, states, in part, that [c]riticality process safety controls should be provided for criticality safety, and a description of their safety function should be described. The applicant should use enough safety controls to demonstrate that, under normal and abnormal credible conditions, all nuclear processes remain subcritical.

While SHINE states in response to RAIs 6b.3-1 and 6b.3-22, that the NCS reference manual and formal NCSEs have yet to be generated, the NRC staff need additional information to determine that enough safety controls have been considered to demonstrate that, under normal and abnormal credible conditions, all nuclear processes remain subcritical.

Provide additional information discussing the methodologies and assumptions that will be used to develop SHINEs NCS reference manual and provide a representative sample of nuclear criticality safety evaluations to demonstrate the methods used to demonstrate that under normal and abnormal credible conditions, all nuclear processes remain subcritical.

Page 12 of 28

SHINE Response SHINE will provide the following information to the NRC by June 10, 2015, to show the methods used to demonstrate that under normal and abnormal credible conditions, all nuclear processes remain subcritical:

1. The NCS reference manual;

2. Two nuclear criticality safety calculations titled, Single Parameter Subcritical Limits for 21 wt% 235U Uranyl Sulfate, Uranium Oxide, and Uranium Metal and Criticality Safety Calculations for the Preliminary Design of Annular Tanks for the SHINE Medical Isotope Facility; and

3. An NCSE covering criticality safety in the uranyl sulfate preparation tank (1-TSPS-01T).

This NCSE will be representative of the NCSEs which SHINE will perform during final design.

Page 13 of 28

CHAPTER 13 - ACCIDENT ANALYSIS Section 13a2.2 - Accident Analysis and Determination of Consequences (Applies to RAIs 13a2.2-5 through 7)

The ISG Augmenting NUREG-1537, Part 2, Section 13a2, Aqueous Homogeneous Reactor Accident Analyses, states that the applicant should include a systematic analysis and discussion of credible accidents for determining the limiting event in each category and that the mathematical models and analytical methods employed, including assumptions, approximations, validation, and uncertainties, should be clearly stated.

RAI 13a2.2-5 While SHINEs response to RAI 13a2.2-1 states that the basis for the internal dose conversion factors (DCFs) is International Commission on Radiological Protection Publication 30, Limits for Intakes of Radionuclides by Workers, (ICRP 30) additional information is needed on this basis, as applied to offsite DCFs for members of the public, for the NRC staff to determine the adequacy of SHINEs radiological dose consequence analysis as part of its accident analysis.

Provide information supporting the acceptability of ICRP 30, which provides DCFs for adult workers, as the basis for calculating offsite doses to members of the public, including children.

SHINE Response SHINE will provide a response to RAI 13a2.2-5 by June 12, 2015.

Section 13b.1 - Radioisotope Production Facility Accident Analysis Methodology RAI 13b.1-3 As required by 10 CFR 50.34(a)(4), the preliminary safety analysis report should include [a]

preliminary analysis and evaluation of the design and performance of structures, systems, and components of the facility with the objective of assessing the risk to public health and safety resulting from operation of the facility, and the adequacy of structures, systems, and components provided for the prevention of accidents and the mitigation of the consequences of accidents.

The ISG Augmenting NUREG-1537, Part 2, Section 13b.1.2, Accident Initiating Events, states that [i]nformation in the [safety analysis report] should allow the reviewer to follow the sequence of events in the accident scenario from initiation to a stabilized condition. The reviewer should confirm the following:

• The credible accidents were categorized, and the most limiting accident in each group was chosen for detailed analyses.

• The process was assumed to be operating normally under applicable technical specifications before the initiating event. However, the process may be in the most limiting technical specification condition at the initiation of the event.

Page 14 of 28

• Instruments, controls, and automatic protective systems were assumed to be operating normally or to be operable before the initiating event. Maximum acceptable non-conservative instrument error may be assumed to exist at accident initiation.

• The single malfunction that initiates the event was identified.

• Credit was taken during the scenario for normally operating process systems. Protective actions were initiated by either the operating staff, control systems, or ESFs.

• The sequence of events and the components and systems damaged during the accident scenario were clearly discussed.

• Validated mathematical models and analytical methods that were employed, including assumptions, approximations, and uncertainties, were clearly stated.

• The radiation source terms were presented or referenced.

• The potential radiation consequences to the facility staff and the public were presented and compared with acceptance criteria.

While Tables 13b.1-2-1 and 13b.1-1-4 provided in response to RAIs 13b.1-1 and 13b.1-2 provided potential accident sequences at the SHINE facility, additional information is needed for the NRC staff to evaluate SHINEs methodology for determining the sequence of events in an accident scenario from initiation to a stabilized condition.

Provide detailed accident sequence descriptions for at least four of the sequences listed in Table 13b.1-1-4, from the initiating events through the sequences mitigated consequences. The descriptions should include the most limiting examples from a chemical accident, radiological accident, fire accident, and criticality accident, and should discuss the following:

a) The hazards involved in the accident, including source terms and initiating events. The initiating events should consider potential operator errors as well as external events and equipment failures; b) An explanation of the methodology for selecting the numerical value of the likelihood of the initiating event; c) An analysis of the unmitigated consequences, including the classification of unmitigated consequences as radiological or chemical, as well as less-than-intermediate, intermediate, or high; d) A description of the accident progression, and the function(s) of IROFS, as applicable, in the accident sequence mitigation; e) An explanation of methodology for selecting the numerical value for the availability and reliability of the IROFS, as applicable, and the resulting mitigated likelihood; and f) An explanation of how the mitigated consequences were estimated.

Page 15 of 28

SHINE Response The accident analysis was developed by the Integrated Safety Analysis (ISA) Team.

The following are ISA Team members and their experience involved in the performance of various aspects required for completion of the accident analysis. Collectively, they are qualified in the areas of chemical safety, criticality safety, fire safety, and radiological safety, and multiple members are qualified, trained ISA team leaders, as required. The composition of the ISA team meets the requirements of NUREG-1520 (Reference 8) and 10 CFR 70.62(c)(2).

• Atkins Nuclear Solutions US (Atkins) individual acting as the ISA team lead with 34 years of technical and management experience at a fuel fabrication facility, including licensing, ISA development, and other regulatory activities.

• Atkins individual with 23 years of experience in the field of nuclear engineering, including specific experience with nuclear criticality safety and nuclear core design. The individual performed diverse criticality safety work for a variety of different facilities.

• Atkins individual with 30 years of experience in commercial nuclear power, including new plant construction, safety analysis, and Technical Specification development. The individual has a M.S. degree in Nuclear Engineering.

• Atkins individual with 30 years of experience in nuclear science and engineering including reactor safety, nuclear process safety, nuclear waste management, fire, fire hazards, fire risk, nuclear explosives, source terms, Hazards and Operability Studies (HAZOPS),

chemistry, and Process Hazards Analysis. The individual has an M.S. degree in Chemistry.

• Atkins individual with 30 years of experience in hazard/accident analysis, phenomenological modeling, safety analysis, report development, teaching, and integration of safety into design. The individual has a Ph.D. in Nuclear Engineering.

• Atkins individual with 30 years of experience in generating risk-related analyses for nuclear facilities and nuclear reactors, including significant experience in probabilistic risk assessment (PRA). The individual has a Ph.D. in Physics.

• SHINE individual with eight years of experience in commercial nuclear power, in engineering and operations. The individual has a B.S. degree in Chemical Engineering.

• SHINE individual with 30 years of experience in commercial nuclear power in operations, engineering and licensing. The individual has an M.S. degree in Nuclear Engineering.

• Merrick & Company individual with experience in the design, procurement, licensing, construction, commissioning, maintenance, and modifications of Department of Energy (DOE) nuclear facilities, systems, and commercial nuclear power generating stations. The individual also has experience in HAZOPS, and the development of procedures for system acceptance testing, operations, and maintenance.

The SHINE Response to RAI 13b.1-1 and RAI 13b.1-2, including Tables 13b.1-1-2, 13b.1-1-4, and 13b.1-2-1, are referenced within this response. The SHINE Response to RAI 13b.1-1 and RAI 13b.1-2 were provided via Reference (10).

A. Radiological a) The most limiting radiological accident is the Maximum Hypothetical Accident (MHA) in the RPF, which is the release of the maximum radioisotope inventory of the five Noble Gas Storage Tanks inside the noble gas storage cell. The source term for this event is described in Subsection 13b.2.1.6 and Table 13b.2.1-1 of the PSAR. This event is considered the most limiting radiological accident because it has the most limiting mitigated consequences of the radiological accidents evaluated for the SHINE facility.

Page 16 of 28

This limiting radiological accident is represented by the Mishandling or Malfunction of Equipment (Off-gas/NGRS) Initiating Event Scenario 2, as found in Table 13b.1-1-4, which states:

Release of noble gases from hold up tank due to mechanical failures (e.g., leaks, vessel failures)

The initiating event for this accident is a failure of the hold-up tanks from mechanical failures. This initiating event and the initiating events for the chemical, fire, and criticality accidents discussed in Sections B through D, below, are included in the accident analysis and presented in Table 13b.1-1-4, which considered potential operator errors as well as external events and equipment failures during the development of the accident analysis.

b) The numerical values for the likelihoods of the initiating events were determined in the Preliminary Hazards Analysis (PHA), using the methodology described in the SHINE Response to RAI 13b.1-1, in accordance with frequency definitions taken from Table A-6 of NUREG-1520, and provided in Table 13b.1-1-2. This methodology also applies to the chemical, fire, and criticality accidents discussed in Sections B through D, below.

This radiological accident scenario was determined in the PHA to have an unmitigated likelihood category of 3 (Not Unlikely), which is defined as more than 10-4 per event, per year in Table A-6 of NUREG-1520. Consistent with the risk matrix found in Table A-3 of NUREG-1520, likelihood category 3 was selected in the accident analysis to be conservative. As there was no specific failure modes and effects analysis (FMEA) or probabilistic risk assessment (PRA) performed for the SHINE facility, likelihood category 3 was chosen for this accident and the other limiting accidents discussed in this response, and events were then mitigated based on design features and controls.

c) The unmitigated event was determined to be an Intermediate Consequence (IC) event for the off-site public and a High Consequence (HC) event for workers. These consequences are classified as radiological. An IC event for the off-site public is a radiological dose greater than or equal to 5 rem total effective dose equivalent (TEDE).

For workers, an HC event is a radiological dose greater than or equal to 100 rem TEDE.

These unmitigated dose consequences are estimated based on the mitigated consequences calculated for the MHA provided in Subsection 13b.2.1.7 of the PSAR, by the elimination of safety features such as building confinement, dampers, and filters or actions such as worker evacuation.

d) Administrative controls described in the accident progressions in this response and in the SHINE Response to RAI 13b.1-1 and RAI 13b.1-2 (e.g., Conduct of Operations and Fire Protection Program) are generic in nature. The specific human actions credited to prevent or mitigate accidents will be identified during detailed design and provided with the FSAR. An IMR has been initiated to track the inclusion of this information in the FSAR. This clarification also applies to the administrative controls for the chemical, fire, and criticality accidents discussed in Sections B through D below.

Page 17 of 28

The radiological accident progression is described below.

Initiating Event

• Mechanical failures occur affecting all five noble gas tanks simultaneously, with the potential to release the contents instantly to the noble gas storage cell.

Preventors

• Process tanks and piping provide confinement, and a breach is not expected due to the robust design of safety-related equipment (Process Tanks and Piping, Integrity - Preventor, P3).

• Facility personnel use a disciplined and formal method for safely performing safety-related activities, contributing to the prevention of accidents (e.g., caused by human error, improper maintenance, improper operation) (Conduct of Operations Program - Preventor, P1).

Mitigators

• In the event of a release, redundant safety-related bubble-tight isolation dampers isolate the intake and exhaust ventilation penetrations for the noble gas storage cell on high radiation indication (Zone 1 Ventilation - Mitigator, P2).

• Operators are notified locally and in the Control Room of an incursion of excess radiation levels in the noble gas storage cell via the safety-related RAMS. Operators ensure processes in the IF and RPF are in a stable condition (Radiation Area Monitoring System - Mitigator, P2).

• High radiation levels detected in the RPF cause isolation of the safety-related RCA Ventilation Zone 2 (RVZ2), further preventing the release of radioactive materials offsite (RVZ2 - described in Subsection 13b.2.1.3 of the PSAR, but not specifically credited for this event in the accident analysis).

e) An explanation of general methodology for selecting the numerical value for the availability and reliability of the controls is available in the SHINE Response to RAI 13b.1-1. For this specific scenario, the numerical values were assigned as listed below, in accordance with Table A-10 of NUREG-1520. The resulting mitigated likelihood for this accident and the limiting chemical, fire, and criticality scenarios described in Sections B through D below, is determined by the number and type of preventor controls applied to each accident scenario. To calculate the mitigated likelihoods, it is assumed that the base rate for all unmitigated accident scenarios is 1 per year or 100, which is equivalent to a frequency index of zero. The preventor controls (and the base rate of 0) are summed to determine the mitigated likelihood. The mitigated likelihood has a maximum value of -6, as higher values are considered unrealistic.

• The following administrative control is assigned a value of P1, which is equivalent to 10-1 per year:

o Conduct of Operations Program (Preventor)

Page 18 of 28

[Proprietary Information - Withheld from Public Disclosure Under 10 CFR 2.390(a)(4)]

• The following active engineered controls are assigned a value of P2, which is equivalent to 10-2 per year:

o Zone 1 Ventilation o Radiation Area Monitoring System

• The following passive engineered controls are assigned a value of P3, which is equivalent to 10-3 per year:

o Process Tanks and Piping (Preventor)

The preventor-type controls in the above list are the Process Tanks and Piping and the Conduct of Operations Program. The sum of these controls results in a mitigated likelihood of -4. Table 13b.1-1-4 lists a mitigated likelihood for this scenario of -6; however, this number is based on SHINE inadvertently double-counting preventive controls for robust process tanks. An IMR has been initiated correct the mitigated likelihood in the accident analysis.

f) The mitigated radiological dose consequences of the MHA were calculated using the methodology provided in Subsection 13b.2.1.5 of the PSAR.

The results of the radiological dose calculation are provided in Subsection 13b.2.1.7 of the PSAR. The MHA results in a worker dose of 3.59 rem and an off-site dose at the site boundary of 0.0820 rem. These doses meet the levels defined for a Less than Intermediate Consequence (LT IC) event for both a worker (below 25 rem TEDE) and for the off-site public (below 5 rem TEDE), and meet the regulatory requirements of 10 CFR 20.1201 (Occupational dose limits for adults) and 10 CFR 20.1301 (Dose limits for individual members of the public). In the accident analysis, the mitigated consequences were conservatively estimated as IC for both workers and the off-site public in accordance with Table A-5 of NUREG-1520.

B. Chemical a) The most limiting chemical accident is one that involves a release of

[ Proprietary Information ] associated with licensed materials. This release is conservatively represented by the release of the site storage inventory of

[ Proprietary Information ] (4,104 lbs), with a solid material airborne fraction of 0.001, as shown in Table 13b.3-2 of the PSAR. The chemical source term for this event is therefore 4.104 lbs of [ Proprietary Information ]. This limiting chemical accident results in the highest exposure of the maximally exposed individual (located at the site boundary), expressed as a fraction of the PAC-1 limit, and the highest worker exposure concentration, expressed as a fraction of the PAC-2 limit.

The accident and associated calculation assumes a release of the storage inventory of

[ Proprietary Information ] and is conservative, since only a portion of the storage inventory will be used with licensed material at any one time. [ Proprietary Information ]

is used with licensed materials when it is added to the uranyl nitrate conversion tank (1-UNCS-01T-A/B), which is located inside a shielded cell. This accident is represented by the Hazardous Chemicals Initiating Event Scenario 1, as found in Table 13b.1-1-4, which states:

Failure of tanks and/or vessels with significant quantities of hazardous toxic chemicals inside vaults or cells (includes associated valves, piping, and overflow lines) due to operational mechanical failures, human errors, or natural phenomena events (e.g., leaks, rupture)

Page 19 of 28

[Proprietary Information - Withheld from Public Disclosure Under 10 CFR 2.390(a)(4)]

The initiating event for the chemical accident is a failure of the uranyl nitrate conversion tank, regardless of the cause of that the failure, which may include operator errors, external events or equipment failures.

Other accident scenarios involving chemicals were identified in the PHA and consolidated and summarized in the accident analysis. These additional scenarios include hydrogen deflagrations and detonations, non-hydrogen deflagrations, detonations and explosions, and exothermic chemical reactions. During the review of this RAI, SHINE determined that a potential scenario involving the exothermic decomposition of ion exchange resin in contact with nitric acid should have been evaluated in the PHA and accident analysis and was not. SHINE only evaluated a generic scenario involving exothermic reactions between chemicals, Hazardous Chemicals Initiating Event Scenario 5, as found in Table 13b.1-1-4. Based on the fact that the chemical involved (nitric acid), in a quantity of 721 lbs (as shown in Table 13b.3-2 of the PSAR), is relatively less hazardous than a dispersal of 4.104 lbs of

[ Proprietary Information ] described above, the limiting chemical accident described in this response is bounding and conservative relative to the potential chemical accident consequences. However, SHINE will evaluate an exothermic decomposition of ion exchange resin in contact with nitric acid scenario in the accident analysis during final design. An IMR has been initiated to track the inclusion of this information in the accident analysis.

b) This chemical accident scenario was determined in the PHA to have an unmitigated likelihood category of 3 (Not Unlikely), which is defined as more than 10-4 per event, per year in Table A-6 of NUREG-1520.

c) The unmitigated event was determined to be a High Consequence (HC) event for both workers and the off-site public. These consequences are classified as chemical. Based on 10 CFR 70.61, the definitions of an HC event are a chemical dose greater than AEGL-3 or ERPG-3 for a worker and greater than AEGL-2 or ERPG-2 for the off-site public. The unmitigated consequences are based on a conservative scenario involving a large spill of bulk chemicals outdoors (i.e. on the loading dock). However, other than the licensed materials themselves, chemicals arriving at the loading dock are not produced from, mixed with, or have the ability to affect licensed materials, and are instead normal industrial chemicals. This conservative estimate of the unmitigated consequences was made due to an unavailability of detailed design information at the time of the accident analysis was being developed.

However, the potential dispersion of applicable chemicals associated with licensed materials has since been calculated, and the results are presented in Table 13b.3-2 of the PSAR. The unmitigated consequences for both workers and the public are Less than Intermediate Consequence (LT IC), defined as an event that does not exceed AEGL-2 or ERPG-2 for workers and does not exceed AEGL-1 or ERPG-1 for the offsite public. The accident analysis is therefore conservative.

Page 20 of 28

[Proprietary Information - Withheld from Public Disclosure Under 10 CFR 2.390(a)(4)]

d) As indicated in Table 13b.1-1-4 for the Hazardous Chemicals Initiating Event Scenario 1, the controls for this event when the consequences involve licensed material are provided in the Loss of Confinement or Mishandling or Malfunction of Target Solution or Confinement Initiating Event Scenarios. These controls are found in Table 13b.1-2-1. The scenario containing the applicable controls for this chemical accident is Loss of Confinement Initiating Event Scenario 15, which states:

Rotating equipment malfunctions, resulting in rupture of solution tank and release of uranium solution The controls for the chemical accident are therefore the same controls provided for the Loss of Confinement Initiating Event Scenario 15 from Table 13b.1-2-1.

The chemical accident progression is described below.

Initiating Event

• [ Proprietary Information ] is used with licensed materials when it is added to the uranyl nitrate conversion tank, which is located inside a shielded cell. The uranyl nitrate conversion tank is mixed by a pump-around recycle and is vented to the Process Vessel Vent System (PVVS). A mechanical failure or human error could lead to a failure of the tank or associated equipment, with a potential to release hazardous chemicals.

Preventor

• A breach of process tanks or piping is not expected due to the robust design of safety-related equipment containing licensed material (Process Tanks and Piping, Integrity - Preventor, P2).

Mitigators

• In the event of a spill, the chemicals and licensed material would be confined to the shielded cell, due to the robust safety-related design (Hot Cell Integrity -

Mitigator, P3).

• Confinement of material is further provided by safety-related RCA Ventilation Zone 1 (RVZ1) (Zone 1 Ventilation - Mitigator, P2 and Dampers (RPF) -

Mitigator, P2), which acts to provide bubble-tight isolation upon receipt of a control signal (i.e. high radiation associated with the spill), loss of power, or manual actuation. Bubble-tight damper isolation is expected due to the use of

[ Proprietary Information ] with irradiated target solution in this process, where a chemical spill also involves a spill of target solution.

• Safety-related radiation monitoring alarms will alert personnel in the area of a spill involving radioactive material, allowing them to evacuate within 10 minutes (Radiation Area Monitoring System - Mitigator, P2).

• Safety-related leak detection instrumentation and alarms will alert personnel and allow them to take corrective action to limit the release (Moisture-Leak Detection/Instrumentation and Alarm - Mitigator, P2).

Page 21 of 28

[Proprietary Information - Withheld from Public Disclosure Under 10 CFR 2.390(a)(4)]

e) For this specific scenario, the numerical values were assigned as listed below, in accordance with Table A-10 of NUREG-1520.

• The following active engineered controls are assigned a value of P2, which is equivalent to 10-2 per year:

o Zone 1 Ventilation o Dampers (RPF) o Radiation Area Monitoring System o Moisture-Leak Detection/Instrumentation and Alarm

• The following passive engineered control is assigned a value of P3, which is equivalent to 10-3 per year:

o Hot Cell Integrity

• The following passive engineered control was conservatively assigned a value of P2 for this scenario. The accident analysis team judgment at the time of development was to set the value as a P2 for conservativism.

o Process Tanks and Piping, Integrity (Preventor)

This chemical accident scenario does not have a documented mitigated likelihood in Table 13b.1-1-4, since the controls for this scenario are taken from a Loss of Confinement scenario. However, the only preventor-type control in the above list is Process Tanks and Piping, Integrity which has a value of P2, resulting in a mitigated likelihood of -2. The most limiting mitigated likelihood in the Loss of Confinement Initiating Scenarios provided in Table 13b.1-1-4 is also -2. Therefore, -2 is the mitigated likelihood value for this scenario.

f) The calculated consequences of a release of [ Proprietary Information ] provided in Table 13b.3-2 of the PSAR are conservative, since they assume the site storage inventory is released, and for this chemical, no credit is taken for the mitigative effects of confinement (i.e., dampers, ventilation, tank vaults or hot cells), or for instrumentation and alarms (i.e., leak detection and radiation area monitoring) that would allow personnel to evacuate or take corrective action to minimize the solid powder material release duration of 60 minutes assumed in the calculation. These unmitigated consequences are categorized as LT IC, as described in Part c above. Therefore, after the application of mitigative measures, the consequences are still LT IC.

C. Fire a) The most limiting fire accident is one that causes damage to the most limiting tank inside of a supercell, as described in Subsections 13b.2.6.3 and 13b.2.6.6 of the PSAR. The radiological source term for this event is provided in Table 13b.2.6-1 of the PSAR. This accident is represented by the Fire Initiating Event Scenario 2B, as found in Table 13b.1-1-4, which states:

Maintenance and other non-operations fires initiated in RPF (may initiate inside or outside hot cells but propagates to both areas)

The initiating event for this accident is a human error, but may also be caused by other initiating events, as described in Subsection 13b.2.6.2 of the PSAR.

b) This fire accident scenario was determined in the PHA to have a likelihood category of 3 (Not Unlikely) which is defined as more than 10-4 per event, per year in Table A-6 of NUREG-1520.

Page 22 of 28

c) The unmitigated event was determined to be a High Consequence (HC) event for both workers and the off-site public. These consequences are classified as radiological.

An HC event for the off-site public is a radiological dose greater than or equal to 25 rem TEDE. For workers, an HC event is a radiological dose greater than or equal to 100 rem TEDE.

The unmitigated fire scenarios in the accident analysis assume that a fire causes damage to multiple portions of the facility, resulting in a large release in excess of the MHA described in Subsection 13b.2.1.6 of the PSAR. The unmitigated consequences are therefore estimated based on the unmitigated consequences of the radiological MHA discussed above. Although the unmitigated consequences of this accident are estimated to be more severe than the unmitigated consequences of the MHA, after mitigation, which includes fire barriers to limit the spread of the fire to one fire area (i.e., the supercell), the consequences are less than those of the MHA.

d) The fire accident progression is described below.

Initiating Event

• A fire is initiated in the RPF as a result of maintenance.

Preventors

• The fire will be identified quickly by the required fire watch personnel per the fire protection program, which is included as a Technical Specification Administrative Control (Fire Watch During Maintenance Operations - Preventor, P1).

• Combustible loading limits (Combustible Loading Limits - Preventor, P1) in the RPF (part of the fire protection program) will minimize the spread of the fire.

• The fire protection program (Fire Protection Program - Preventor, P1) also ensures that the installed fire detection and suppression systems meet National Fire Protection Association (NFPA) standards and will therefore operate as expected.

Mitigators

• The fire detection and suppression systems (not safety-related and therefore not credited in the accident analysis) actuate to notify personnel and mitigate the spread of the fire.

• The tanks and vessels in the facility containing licensed material are safety-related and of a robust design such that they are not expected to fail (Robust Tanks and Vessels (RPF) - Mitigator, P3).

• The safety-related three-hour fire-rated barriers (Fire Rating for RPF Areas -

Mitigator, P3) separating fire areas will prevent the spread of the fire to adjacent fire areas.

• Safety-related dampers in the ventilation system (Ventilation System, Passive Function - Mitigator, P3) close to prevent the spread into or out of hot cells or vaults.

• If the fire does result in a radiological release, safety-related radiation monitors (Radiation Area Monitoring System - Mitigator, P2) alarm to notify personnel in the local area and the Control Room.

• Facility personnel are trained to evacuate an area in the case of an alarm, and operations personnel are trained to ensure processes are in a safe condition (Conduct of Operations Program - Mitigator, P1).

Page 23 of 28

[Proprietary Information - Withheld from Public Disclosure Under 10 CFR 2.390(a)(4)]

e) For this specific scenario, the numerical values were assigned as listed below, in accordance with Table A-10 of NUREG-1520.

• The following administrative controls are assigned a value of P1, which is equivalent to 10-1 per year:

o Conduct of Operations Program o Combustible Loading Limits (Preventor) o Fire Watch During Maintenance Operations (Preventor) o Fire Protection Program (Preventor)

• The following active engineered controls are assigned a value of P2, which is equivalent to 10-2 per year:

o Radiation Area Monitoring System

• The following passive engineered controls are assigned a value of P3, which is equivalent to 10-3 per year:

o Robust Tanks and Vessels (RPF) o Fire Rating for RPF Areas o Ventilation System (Passive Function)

The mitigated likelihood is -3, which is the sum of the preventive controls for this scenario (Combustible Loading Limits, Fire Watch During Maintenance Operations, and Fire Protection Program).

f) The mitigated radiological dose consequences of the limiting fire were calculated and are provided in Subsection 13b.2.6.7 of the PSAR. The limiting fire results in a worker dose of 0.578 rem and an off-site dose at the site boundary of 8.77E-04 rem. These doses meet the levels defined for a Less than Intermediate Consequence (LT IC) event for both a worker (below 25 rem TEDE) and for the off-site public (below 5 rem TEDE),

and meet the regulatory requirements of 10 CFR 20.1201 (Occupational dose limits for adults) and 10 CFR 20.1301 (Dose limits for individual members of the public). The mitigated consequences were therefore estimated to be LT IC for both workers and the off-site public in the accident analysis.

D. Criticality a) The most limiting criticality event is the accumulation of un-irradiated solution outside of a radiation shielded area caused by a spill or other physical upset condition. This event was considered highly unlikely, and a detailed analysis of the source term and radiological consequences were not included in the PSAR, as described in the SHINE Response to RAI 13b.1-1. The criticality source term was calculated by SHINE, consisting of neutron and photon source magnitude and energy spectra. Several representative fissile materials were considered and evaluated to determine the maximum sources of neutrons and photons. [ Proprietary Information ] Source terms associated with fission product generation rates associated with a hypothetical criticality were not calculated.

Page 24 of 28

This criticality accident is represented by the Criticality Initiating Event Scenario 5, as found in Table 13b.1-1-4, which states:

Loss of uranium solution from TSV or processing equipment (e.g., vessel fails),

resulting in the accumulation of target solution in an unfavorable geometry, causing an inadvertent criticality The initiating event for this accident is a failure of processing equipment leading to a spill, regardless of the cause of the equipment failure.

b) This criticality accident scenario was determined in the PHA to have an unmitigated likelihood category of 3 (Not Unlikely) which is defined as more than 10-4 per event, per year in Table A-6 of NUREG-1520.

c) The unmitigated event was determined to be a High Consequence (HC) event for both workers and the off-site public. These consequences are classified as radiological.

An HC event for the off-site public is a radiological dose greater than or equal to 25 rem TEDE. For workers, an HC event is a radiological dose greater than or equal to 100 rem TEDE.

All criticality accident scenarios for SHINE are evaluated as highly unlikely. Although highly unlikely, the potential radiological dose to workers from an inadvertent nuclear criticality was evaluated by SHINE to be an HC event due to the proximity of workers to a postulated unshielded criticality accident. Based on the consequences to workers, and the uncalculated effects from the potential release of fission products, the unmitigated (i.e., unshielded) dose consequences to the off-site public were conservatively estimated to be HC. The accident analysis and Table 13b.1-1-4 list an unmitigated consequence to the public of IC, which is based only on the prompt effects of a criticality. An IMR has been initiated correct the unmitigated consequences to the off-site public in the accident analysis.

d) The criticality accident progression is described below.

Initiating Event

• Uranium solution is spilled from processing equipment, with a potential to cause an inadvertent criticality.

Preventors

• Criticality inside of the safety-related process equipment is highly unlikely due to the criticality-safe by geometry design (Geometrically Safe Configuration for Process Tanks, Pipes, and Other Process Equipment - Preventor, P3) and application of the double contingency principle to prevent criticality.

• Failure of process vessels is not expected due to the robust design of safety-related equipment containing licensed material (present, but not specifically credited in the accident analysis).

• In the event of a spill, the solution will be directed to a safety-related criticality-safe sump catch tank (Safe Geometry Sumps and Berms - Preventor, P3) located at the lowest point of the facility.

Page 25 of 28

• A criticality is prevented in the case of a tank overflow scenario by a safety-related safe geometry overflow system (Safe Geometry Overflow System - Preventor, P3).

• Safety-related leak detection instrumentation (Moisture-Leak Detection/Instrumentation and Alarm (Rad) - Preventor, P2) and alarms will alert operators to the spill and allow them to take corrective action prior to a criticality.

Mitigators

• In the highly unlikely event of an inadvertent criticality, the facility is equipped with a safety-related CAAS (Criticality Accident Alarm System - Mitigator, P2) to provide local and Control Room alarms and allow for personnel evacuation.

• RVZ1 and RVZ2 isolate safety-related dampers on receipt of high radiation alarms to prevent the spread of contamination (Zone 1 Ventilation - Mitigator, P2 and Zone 2 Ventilation - Mitigator, P2).

• The location of the facility and the distance from the RCA to the site boundary mitigates the potential doses to the off-site public (Facility Siting - Mitigator, P4).

The location of the site is described in the PSAR.

• The internal safety-related shielding of the facility further limits the effects of an accident on the offsite public and workers in other areas of the facility (Facility Shielding - Mitigator, P4).

e) For this specific scenario, the numerical values were assigned as listed below, in accordance with Table A-10 of NUREG-1520.

• The following active engineered controls are assigned a value of P2, which is equivalent to 10-2 per year:

o Criticality Accident Alarm System o Moisture-Leak Detection/Instrumentation and Alarm (Preventor) o Zone 1 Ventilation o Zone 2 Ventilation

• The following passive engineered controls are assigned a value of P3, which is equivalent to 10-3 per year:

o Safe Geometry Sumps and Berms (Preventor) o Safe Geometry Overflow System (Preventor) o Geometrically Safe Configuration for Process Tanks, Pipes, and Other Process Equipment (Preventor)

• The following robust passive engineered controls are assigned a value of P4, which is equivalent to 10-4 per year:

o Facility Shielding o Facility Siting The mitigated likelihood is -6, which based on having at least two preventive controls in place for any criticality scenario, consisting of two or more of the following: Geometrically Safe Configuration for Process Tanks, Pipes, and Other Process Equipment; Safe Geometry Sumps and Berms; Safe Geometry Overflow System; and Moisture-Leak Detection/Instrumentation and Alarm (Rad).

Page 26 of 28

f) The mitigated consequences for this scenario are an estimated Less than Intermediate Consequence (LT IC) event for the off-site public. This estimation is based on the controls in place, including Facility Shielding and Facility Siting (i.e., distance to the facility) to mitigate prompt doses, and ventilation isolation to mitigate fission product releases.

The mitigated consequences for this scenario are an estimated HC event for workers due to the proximity of workers to a postulated unshielded criticality accident. An IMR has been initiated to clarify the reporting of an LT IC mitigated consequence for workers for Criticality Initiating Event Scenario 5, found in Table 13b.1-1-4, since this consequence estimate only applies to criticalities within shielded areas.

Page 27 of 28

References (1) NRC letter to SHINE Medical Technologies, Inc., dated March 25, 2015, SHINE Medical Technologies, Inc. - Request for Additional Information Regarding Application for Construction Permit (TAC Nos. MF2305, MF2307, and MF2308) (ML15055A116)

(2) SHINE Medical Technologies, Inc. letter to NRC, dated March 26, 2013, Part One of the SHINE Medical Technologies, Inc. Application for Construction Permit (ML130880226)

(3) SHINE Medical Technologies, Inc. letter to NRC, dated May 31, 2013, Part Two of the SHINE Medical Technologies, Inc. Application for Construction Permit (ML13172A324)

(4) SHINE Medical Technologies, Inc. letter to NRC, dated April 10, 2015, SHINE Medical Technologies, Inc. Application for Construction Permit, Response to Request for Additional Information (5) SHINE Medical Technologies, Inc. letter to NRC, dated September 25, 2013, Submittal of the SHINE Medical Technologies, Inc. Preliminary Emergency Plan (ML13269A378)

(6) SHINE Medical Technologies, Inc. letter to NRC, dated February 6, 2015, SHINE Medical Technologies, Inc. Application for Construction Permit, Response to Request for Additional Information (ML15043A404)

(7) SHINE Medical Technologies, Inc. letter to NRC, dated October 15, 2014, SHINE Medical Technologies, Inc. Application for Construction Permit, Response to Request for Additional Information (ML14296A190)

(8) U.S. Nuclear Regulatory Commission, Standard Review Plan for the Review of a License Application for a Fuel Cycle Facility, NUREG-1520, Revision 1, May 2010 (ML101390110)

(9) American National Standards Institute/American Nuclear Society, Nuclear Criticality Safety Based on Limiting and Controlling Moderators, ANSI/ANS-8.22-1997 (R2011),

La Grange Park, IL (10) SHINE Medical Technologies, Inc. letter to NRC, dated December 3, 2014, SHINE Medical Technologies, Inc. Application for Construction Permit, Response to Request for Additional Information (ML14356A528)

(11) U.S. Nuclear Regulatory Commission, Nuclear Fuel Cycle Facility Accident Analysis Handbook, NUREG/CR-6410, March 1998 (ML072000468)

Page 28 of 28