Text

Enclosure 2 - Atkins-NS-TR-SHN-15-06, Revision 1, Criticality Safety Evaluation for the Shine Target Solution Preparation System.
	ML15236A142
Person / Time
Site:	SHINE Medical Technologies
Issue date:	08/07/2015
From:	; SHINE Medical Technologies
To:	; Office of Nuclear Reactor Regulation
References
	Atkins-NS-TR-SHN-15-06, Rev. 1
	Download: ML15236A142 (52)
	v • d • e

ENCLOSURE 2 SHINE MEDICAL TECHNOLOGIES, INC.

SHINE MEDICAL TECHNOLOGIES, INC. APPLICATION FOR CONSTRUCTION PERMIT SUBMITTAL OF ATKINS-NS-TR-SHN-15-06, REVISION 1 ATKINS-NS-TR-SHN-15-06, REVISION 1 CRITICALITY SAFETY EVALUATION FOR THE SHINE TARGET SOLUTION PREPARATION SYSTEM (PUBLIC VERSION) 51 pages follow

SHINE Medical Atkins-NS-TR-SHN-15-06 Approvals .................................................................................................................................. 2 Revision History ........................................................................................................................ 3 EXECUTIVE

SUMMARY

................................................................................................................ 6

1. INTRODUCTION....................................................................................................................... 7

2. PROCESS DESCRIPTION ....................................................................................................... 7 2.1. Normal Case Operating Conditions ................................................................................. 7 2.1.1. TSPS Dissolution Process Description .......................................................................... 7 2.1.2. TSPS Dissolution Operations Procedure ....................................................................... 9 2.2. Equipment Description ................................................................................................... 12 2.2.1. Uranium Oxide Storage Racks .................................................................................... 13 2.2.2. Uranium Oxide Cans ................................................................................................... 13 2.2.3. Uranium Oxide Can Transfer Carts.............................................................................. 13 2.2.4. Glovebox ..................................................................................................................... 14 2.2.5. Dissolution Tank .......................................................................................................... 15 2.2.6. Target Solution Transfer system .................................................................................. 16

3. NUCLEAR CRITICALITY HAZARD IDENTIFICATION .......................................................... 17 3.1. Hazard Identification Method .......................................................................................... 17 3.2. Hazard Identification Results ......................................................................................... 17

4. DOUBLE CONTINENCY ANALYSIS ...................................................................................... 23 4.1. Powder spills and accumulates in / around the TSPS area .......................................... 23 4.1.1. Discussion ................................................................................................................... 23 4.1.2. Subcritical by Design Determination ............................................................................ 24 4.1.3. Summary of identified Safety Controls ......................................................................... 25 4.2. Uranium oxide powder spills and accumulates inside the glovebox .......................... 26 4.2.1. Discussion ................................................................................................................... 26 4.2.2. Accident Analysis ........................................................................................................ 27 4.2.3. Criticality Barriers for uranium oxide powder spills and accumulates in the TSPS Glovebox ..................................................................................................................... 28 4.2.4. Summary of identified Safety Controls ......................................................................... 29 4.3. Dissolution tank has loss of geometry control (leak) ................................................... 29 4.3.1. Discussion ................................................................................................................... 29 4.3.2. Subcritical by Design Determination ............................................................................ 30 4.3.3. Summary of identified Safety Controls ......................................................................... 30 4.4. Piping / processing equipment has loss of geometry control ..................................... 31 4.4.1. Discussion ................................................................................................................... 31 4.4.2. Subcritical by Design Determination ............................................................................ 31 4.4.3. Summary of identified Safety Controls ......................................................................... 31 4.5. Material is brought too close to other material ............................................................. 32 4.5.1. Discussion ................................................................................................................... 32 4.5.2. Subcritical by Design Determination ............................................................................ 33 4.5.3. Summary of identified Safety Controls ......................................................................... 34 4.6. Equipment failure / damage occurs ............................................................................... 35 4.6.1. Discussion ................................................................................................................... 35 Private and confidential Criticality Safety Evaluation for the SHINE Target Solution Preparation System l Rev. 1 l August 2015 4

SHINE Medical Atkins-NS-TR-SHN-15-06 4.6.2. Subcritical by Design Determination ............................................................................ 35 4.6.3. Summary of identified Safety Controls ......................................................................... 38 4.7. Neutron absorbers in the system are damaged or missing ......................................... 38 4.7.1. Discussion ................................................................................................................... 38 4.7.2. Subcritical by Design Determination ............................................................................ 39 4.7.3. Summary of identified Safety Controls ......................................................................... 40 4.8. Oxide powder placed in unfavorable geometry containers.......................................... 40 4.8.1. Discussion ................................................................................................................... 40 4.8.2. Accident Analysis ........................................................................................................ 40 4.8.3. Criticality Barriers for uranium oxide powder placed in unfavorable geometry containers .................................................................................................................... 41 4.8.4. Summary of identified Safety Controls ......................................................................... 42 4.9. Uranium Metal is introduced into the TSPS................................................................... 42 4.9.1. Discussion ................................................................................................................... 42 4.9.2. Accident Analysis ........................................................................................................ 43 4.9.3. Criticality Barriers for the Introduction of Metal to the TSPS Dissolution Tanks ............ 43 4.9.4. Summary of identified Safety Controls ......................................................................... 44

5. NUCLEAR CRITICALITY PARAMETER DISCUSSION ......................................................... 45

6. Criticality Safety Controls..................................................................................................... 46 6.1. Passive Engineered Features ......................................................................................... 47 6.2. Active Engineered features ............................................................................................ 50 6.3. Administrative Controls .................................................................................................. 50

7. General requirements ........................................................................................................... 52

8. Bounding Assumptions ........................................................................................................ 52

9. Conclusion ............................................................................................................................ 53

10. References............................................................................................................................. 53 Private and confidential Criticality Safety Evaluation for the SHINE Target Solution Preparation System l Rev. 1 l August 2015 5

SHINE Medical Atkins-NS-TR-SHN-15-06 EXECUTIVE

SUMMARY

This report documents the Nuclear Criticality Safety Evaluation (NCSE) for the uranium oxide to Target Solution dissolution portion of the Target Solution Preparation System (TSPS). The Criticality Process Hazards Analysis (PHA) for the uranium oxide to Target Solution dissolution portion of the Target Solution Preparation System (TSPS) used a What-if analysis which represents a typical analysis tool for these particular types of operations.

The What-if analysis identified several potential accident scenarios across 12 criticality safety parameters. Nuclear criticality safety must be demonstrated by ensuring that all normal and credible abnormal conditions within the Radioisotope Production Facility (RPF) remain subcritical. This NCSE provides the technical basis for criticality safety for the uranium oxide to target solution dissolution portion of the TSPS.

Private and confidential Criticality Safety Evaluation for the SHINE Target Solution Preparation System l Rev. 1 l August 2015 6

SHINE Medical Atkins-NS-TR-SHN-15-06

1. INTRODUCTION The medical isotope production facility by SHINE Medical Technologies, Inc. creates 99Mo via fission of uranium-235 (235U) and uranium-238 (238U) in a subcritical aqueous solution. The facility exists in two parts, an Irradiation Facility (IF) where the 99Mo is produced and a Radioisotope Production Facility (RPF) where the 99Mo is extracted from the uranium-aqueous solution. Nuclear criticality safety must be demonstrated by ensuring that all normal and credible abnormal conditions within the RPF remain subcritical.

This report documents the Nuclear Criticality Safety Evaluation (NCSE) for the Uranium Oxide to Target Solution dissolution portion of the Target Solution Preparation System (TSPS). The SHINE facility has been designed to incorporate criticality safety directly into equipment design and layout.

Most of the criticality safety controls in the facility are based on geometry features that are very robust and under strict compliance with the configuration management program (Reference 1). For the uranium oxide to target solution dissolution portion of the TSPS, this NCSE demonstrates the sub-criticality of operations under all normal and credible abnormal conditions.

Events that can credibly cause a criticality are defined and the criticality safety controls necessary and sufficient to ensure that an accidental criticality accident does not occur are specified. This analysis provides the technical justification and requirements as stated in NUREG-1520 (Reference

2) to demonstrate compliance with the Double Contingency Principle for operation to prevent these credible events.

2. PROCESS DESCRIPTION1 2.1. Normal Case Operating Conditions The purpose of the SHINE TSPS is to store, process, and prepare a uranyl sulfate target solution (TS) for processing in the Target Solution Vessel (TSV). This safety evaluation focuses on the portions of the TSPS process from removal of uranium oxide from the storage racks through to the filtration of prepared target solution in route to the target solution hold tank.

2.1.1. TSPS Dissolution Process Description During normal operations, uranium oxide is dissolved in sulfuric acid in the Target Solution Preparation System in preparation for irradiation in one of eight TSVs by neutrons created by a deuteron ion beam accelerated into a target chamber filled with tritium gas.

1 The information presented in this section is for descriptive purposes only and should not be misconstrued as limits or controls. Minor inconsistencies and modifications to these systems that do not adversely impact criticality safety will be addressed in later revisions of this analysis.

Private and confidential Criticality Safety Evaluation for the SHINE Target Solution Preparation System l Rev. 1 l August 2015 7

[Proprietary Information - Withheld from Public Disclosure Under 10 CFR 2.390(a)(4)]

Security-Related Information - Withheld Under 10 CFR 2.390 SHINE Medical Atkins-NS-TR-SHN-15-06 The following primary operations are performed in the TSPS target solution preparation process analyzed in this criticality safety evaluation:

manual transfer of uranium oxide cans from the uranium oxide storage racks to the transfer cart

manual transfer / movement of the transfer cart to the glovebox

manual transfer of the uranium oxide cans one at a time to the glovebox

measurement and transfer of uranium oxide powder to the dissolution tank

dissolution, sampling, dilution and measurement

transfer to the TSPS hold tank(s)

The process ends when the newly prepared target solution exits the filter in the transfer system en route to the target solution hold tank.

Target solution (uranyl sulfate) is prepared in the target solution preparation tank (1-TSPS-01T) by dissolving uranium oxide in approximately 0.8 M sulfuric acid H2SO4 to make a 0.1M H2SO4 Target Solution containing uranyl sulfate with the tank maintained at approximately 158°F (70°C) and agitated until the uranium oxide is fully dissolved. The range of uranyl sulfate concentration is

[ Proprietary Information ] [ Security-Related Information ], and the desired concentration is prepared with an accuracy better than 1 percent. The pH of the target solution is between

[ Proprietary Information ]. The volume range of the target solution is

[ Proprietary Information ] [ Security-Related Information ] per TSV batch. The liquid outlet is designed to filter out any undissolved uranium or other particulates from the uranyl sulfate preparation tank. The Target Solution is transferred to a Target Solution Holding Tank. The general process flow of the TSPS is shown in Figure 2.1. (Reference 3)

Private and confidential Criticality Safety Evaluation for the SHINE Target Solution Preparation System l Rev. 1 l August 2015 8

SHINE Medical Atkins-NS-TR-SHN-15-06 Figure 2.1 TSPS General Process Flow 2.1.2. TSPS Dissolution Operations Procedure The following steps are performed in the preparation of fresh TS from the uranium oxide in the uranium oxide storage vault (Reference 3):

Prerequisites:

Two people shall be available and present at all times to perform TS prep operation

Uranyl sulfate preparation glovebox shall have negative pressure relative to room

Uranyl sulfate preparation glovebox shall be empty of containers and uranium oxide (including pass-through)

Process Vessel Vent System (PVVS) shall be operational Private and confidential Criticality Safety Evaluation for the SHINE Target Solution Preparation System l Rev. 1 l August 2015 9

[Proprietary Information - Withheld from Public Disclosure Under 10 CFR 2.390(a)(4)]

Security-Related Information - Withheld Under 10 CFR 2.390 SHINE Medical Atkins-NS-TR-SHN-15-06

1. Fill target solution (uranyl sulfate) preparation tank to the proper level of 0.8 M sulfuric acid to dissolve the planned quantity of uranium oxide [ Proprietary Information ] [ Security-Related Information ] by OPENING sulfuric acid supply valve

2. CLOSE sulfuric acid supply valve once Target solution (uranyl sulfate) prep tank is filled to proper level with 0.8M sulfuric acid

3. Turn ON uranyl sulfate prep tank recirculation loop and verify flow

4. Use in-recirculation-loop or in-tank pH meter to verify acid pH/concentration

5. Verify Target solution (uranyl sulfate) prep tank heater is ON

6. Remove uranium oxide from storage racks:

Assumptions for this step include:

A maximum of [ Security-Related Information ] cans per cart

The kg/can is as defined in the PSAR

The can is volume controlled

Can size is less than [ Proprietary Information ] [ Security-Related Information ]

a. Find cell door for (next) planned uranium oxide storage can

b. OPEN door to uranium oxide storage rack

c. Verify uranium oxide storage can label with procedure / controlling document

d. Radiation Protection (RP) to check for contamination as required

e. Remove uranium oxide storage can(s) from rack and place on transit cart

f. CLOSE door to uranium oxide storage rack

g. Repeat steps 6(a) through 6(f) as necessary (up to [ Security-Related Information ] cans)

7. Move uranium oxide transit cart with uranium oxide cans to the uranyl sulfate preparation glovebox area

8. OPEN the glovebox pass-through

9. Place one uranium oxide storage can inside glovebox pass-through (The door and pass through are assumed to be sized to allow only one can into or out of the pass through at a time)

10. CLOSE glovebox pass-through outer door

11. Begin using glovebox (i.e. put hands in gloves)

a. OPEN inside pass-through door

b. Bring uranium oxide can into glovebox

c. CLOSE inside pass-through door

d. OPEN can lid

e. Remove and measure (mass) uranium oxide powder to dissolve from can in measuring tray

f. Empty measuring tray into tank through chute in bottom of glovebox

g. CLOSE can lid

h. OPEN inside pass-through door

i. Place can inside glovebox pass-through

j. CLOSE inside pass-through door

12. OPEN outer glovebox pass-through door Private and confidential Criticality Safety Evaluation for the SHINE Target Solution Preparation System l Rev. 1 l August 2015 10

SHINE Medical Atkins-NS-TR-SHN-15-06

13. RP performs check of contamination on external surfaces of can

14. RP decontaminates external surfaces of can if contamination is found

15. Mark remaining contents on can, mark if empty

16. LOAD can on uranium oxide transit cart

17. CLOSE outer glovebox pass-through door

18. REPEAT steps 8 through 17 until all planned uranium oxide is loaded into tank

19. MOVE uranium oxide transit cart back to uranium oxide storage rack

20. Place uranium oxide cans back in storage rack:

a. OPEN door to empty uranium oxide storage rack cell

b. LOAD used uranium oxide storage can inside uranium oxide storage rack cell

c. CLOSE uranium oxide storage rack cell door

d. Mark / flag storage rack cell door with identification numbers

e. Repeat steps 20(a) through 20(d) until all uranium oxide cans have been placed back in the uranium oxide storage rack

21. Allow for uranium oxide powder to sufficiently dissolve in uranyl sulfate prep tank

a. Wait a proceduralized amount of time for dissolution

22. Dilute Target Solution (uranyl sulfate) solution with a measured amount of DI water from DI supply line

23. Verify that uranium concentration and acidity of target solution in uranyl sulfate prep tank meet specification

a. Take sample from sampling valve on bottom of tank (TBD)

b. Verify sample appearance indicates no particulate

c. Use in-tank or in-recirculation-loop instruments to measure temperature and pH

24. Adjust parameters from step 23 as necessary

25. Turn OFF target solution prep tank heater

26. Verify the target solution hold tank is empty and ready to receive target solution

27. Realign pump valving to transfer solution to target solution hold tank

a. Open discharge valve to target solution hold tank

b. Close recirculation valve

28. Monitor progress of solution pumping for backups or high dP across uranyl sulfate filter

29. Verify uranyl sulfate prep tank is EMPTY

30. Turn OFF uranyl sulfate pump

31. CLOSE uranyl sulfate discharge valve

32. OPEN uranyl sulfate recirculation valve During normal operations, moderation materials are limited administratively from the TSPS area and in the gloveboxes. Additionally, the designed volume control of the uranium oxide cans, the designed geometry controls for the uranium oxide storage racks and transfer cart, the geometry and volume controls for the gloveboxes, and the dissolution tanks volume, geometry, and neutron poison controls ensure normal case operations and expected upset conditions remain acceptably subcritical.

Private and confidential Criticality Safety Evaluation for the SHINE Target Solution Preparation System l Rev. 1 l August 2015 11

[Proprietary Information - Withheld from Public Disclosure Under 10 CFR 2.390(a)(4)]

Security-Related Information - Withheld Under 10 CFR 2.390 SHINE Medical Atkins-NS-TR-SHN-15-06 2.2. Equipment Description An overview of the equipment used and relied on for ensuring criticality safety in the TSPS process is as follows (References 1 and 3):

The equipment for the uranium oxide removal, transfer, dissolution and transfer to TSPS hold tank will be in the TSPS Room. The general arrangement of the TSPS room is shown in Figure 2.2.

Priopretary Information Security-Related Information Figure 2.2 TSPS Room General Arrangement The general process involves:

1. Removal of material from the uranium oxide storage racks (1) to a cart (not shown).

2. Movement of the cart from the uranium oxide storage racks (1) to the glovebox pass through (2).

3. Transfer of material from the cart into the glovebox (3).

4. Measurement of the material in the glovebox.

5. Transfer of material from the glovebox (3) via a chute to the dissolver tank (4) TSPS-01T (A/B).

6. Transfer from the dissolver tank (4) to the TSPS hold tank TSPS-03T (A/H) (not shown).

Within the TSPS room, berms surround the dissolver tanks in order to contain any potential spills or leaks in a critically safe geometry and drain to the critically safe sump catch tank in the Radioactive Drain System. The drain system is capable of holding the contents of the entire target solution preparation vessel volume. Also, the berms provide safe spacing and prevent interaction of the fissile solution inside the tank with other fissile material.

Additionally, the TSPS equipment and piping are located in an open floor area that is free of accumulation points (i.e. holes, channels, cutouts, pits, etc.) exceeding [ Proprietary Information ]

[ Security-Related Information ] in volume (References 1 and 3).

Private and confidential Criticality Safety Evaluation for the SHINE Target Solution Preparation System l Rev. 1 l August 2015 12

[Proprietary Information - Withheld from Public Disclosure Under 10 CFR 2.390(a)(4)]

Security-Related Information - Withheld Under 10 CFR 2.390 SHINE Medical Atkins-NS-TR-SHN-15-06 2.2.1. Uranium Oxide Storage Racks Priopretary Information Security-Related Information Figure 2.3 Uranium Oxide Storage Racks The physical width and depth of the storage racks is designed such that uranium oxide cans stored in the racks are critically safe by geometry. Each storage cell location holds one uranium oxide storage can. (Reference 3) 2.2.2. Uranium Oxide Cans The uranium oxide cans are designed to be critically safe for storage of uranium oxide by volume control. Can features include (References 1 and 3):

Cans are critically safe by volume ([ Proprietary Information ] [ Security-Related Information ]).

Uranium oxide cans are designed with a unique size and shape when compared to U metal storage cans to prevent placement of the U metal cans in the incorrect storage rack or transfer cart.

Cans are of a robust design to prevent loss of uranium oxide powder when dropped from a height equivalent to the top of the storage racks.

2.2.3. Uranium Oxide Can Transfer Carts

Carts are designed to prevent loss of cans during seismic activity.

Carts are designed to accept only uranium oxide cans and reject U metal cans.

Carts have storage locations with a latching mechanism to prevent cans from falling out of locations.

Carts are designed to limit the number of cans on the cart to the critically safe number of [ Security-Related Information ] based on the spacing design.

Carts are designed with bumpers on the side of the cart to limit the effect of impact on room equipment and also prevent fissile material from interacting with other equipment containing fissile material. (Reference 3)

Private and confidential Criticality Safety Evaluation for the SHINE Target Solution Preparation System l Rev. 1 l August 2015 13

[Proprietary Information - Withheld from Public Disclosure Under 10 CFR 2.390(a)(4)]

Security-Related Information - Withheld Under 10 CFR 2.390 SHINE Medical Atkins-NS-TR-SHN-15-06 2.2.4. Glovebox The general layout of the glovebox is shown in Figures 2.4 and 2.5. Glovebox features consist of (Reference 3):

Glovebox pass through design allows only one can in at a time.

Glovebox weight trays are critically safe by volume ([ Proprietary Information ]

[ Security-Related Information ] or less).

Geometry of glovebox work platform (open grating) prevents accumulation of uranium oxide.

Glovebox design excludes moderator.

Sloped glovebox floor to ensure powder falls into the dissolution tank and does not accumulate in the glovebox.

Sealed transfer tube / chute prevents spillage to room floor or into dissolution tank voids.

The physical design of the gloveboxes minimizes the use of moderators.

Figure 2.4 Glovebox Private and confidential Criticality Safety Evaluation for the SHINE Target Solution Preparation System l Rev. 1 l August 2015 14

[Proprietary Information - Withheld from Public Disclosure Under 10 CFR 2.390(a)(4)]

Security-Related Information - Withheld Under 10 CFR 2.390 SHINE Medical Atkins-NS-TR-SHN-15-06 Figure 2.5 Glovebox Side View The mass of uranium oxide used to prepare target solution is measured in the target solution preparation glovebox and transferred to target solution preparation tank (1-TSPS-01T) by emptying the required number of uranium oxide storage cans into the tank. Operators adjust the amount of sulfuric acid to be added based on the amount of uranium oxide loaded into the target solution preparation tank (1-TSPS-01T).

2.2.5. Dissolution Tank The Uranyl sulfate preparation tank (dissolution tank) (TSPS-01T (A/B)) is shown in Figures 2.6 and 2.7. The dissolution tank connects to the glovebox via a sealed transfer tube or chute. General features of the dissolution tank are:

There are a total of two of the TSPS-01T annular tanks in the facility.

The tanks are designed to prevent a loss of solution during seismic activity. The tanks are designed and fabricated according to ASME BPVC Section VIII Div 1. (Reference 3)

The volume of each tank is the critically safe volume limit of [ Proprietary Information ]

[ Security-Related Information ]. (References 3 and 4)

The tanks are designed to be critically safe by geometry and are a maximum of

[ Proprietary Information ] [ Security-Related Information ] tall. Wall thickness is less than [ Proprietary Information ] [ Security-Related Information ] and outer diameter is at least [ Proprietary Information ] [ Security-Related Information ], with a maximum liquid thickness of [ Proprietary Information ] [ Security-Related Information ]. (References 3 and 4)

The tanks are surrounded by a berm to direct fluids to the critically safe sump catch tank, provide safe spacing and prevent interaction of the fissile solution inside the tank with other fissile material. (Reference 3)

The tanks are designed with an annulus containing fissile material with a

[ Proprietary Information ] [ Security-Related Information ] neutron absorber plate consisting of PPC-B present on the outside and inside diameters of the tank. The outer gap is [ Proprietary Information ] [ Security-Related Information ] or less and the inner gap does not exceed [ Proprietary Information ] [ Security-Related Information ].

(References 4, 5, and 6)

Tank is equipped with a recirculation system. (Reference 3)

Private and confidential Criticality Safety Evaluation for the SHINE Target Solution Preparation System l Rev. 1 l August 2015 15

[Proprietary Information - Withheld from Public Disclosure Under 10 CFR 2.390(a)(4)]

Security-Related Information - Withheld Under 10 CFR 2.390 SHINE Medical Atkins-NS-TR-SHN-15-06

The tank holds approximately 0.8 M sulfuric acid at approximately 158°F (70°C) during the dissolution process. (Reference 1)

The pH of the target solution is between [ Proprietary Information ]. (Reference 1)

The target solution density is [ Proprietary Information ], mass is

[ Proprietary Information ], and volume is [ Proprietary Information ]. (Reference 1)

The tank operates at atmospheric pressure, is vented and overflows to a critically safe sump system. (Reference 3)

Proprietary Information Security-Related Information Figure 2.6 Dissolution Tank Top View (Analytical Model)

Figure 2.7 Uranyl Sulfate Preparation Tank (Dissolution Tank) Side and top Views 2.2.6. Target Solution Transfer system The transfer system is shown in Figure 2.1. Components of the transfer system include (Reference 3):

TSPS-01T (A/B) including critically safe by geometry heater and recirculation piping.

Critically safe by geometry tank vent system.

Critically safe by geometry discharge piping, valves, and filters.

Critically safe by volume Uranyl Sulfate Pump (1-TSPS-01P-A/B).

Private and confidential Criticality Safety Evaluation for the SHINE Target Solution Preparation System l Rev. 1 l August 2015 16

SHINE Medical Atkins-NS-TR-SHN-15-06

3. NUCLEAR CRITICALITY HAZARD IDENTIFICATION 3.1. Hazard Identification Method A Process Hazards Analysis (PHA) was performed on the dissolution process (Reference 3). The type of analysis used was a What-if analysis, which represents a best practice analysis tool for these particular types of operations.

The analysis focused on 12 criticality safety parameters to determine what process upsets could potentially lead to an accidental nuclear criticality. For those parameters not controlled in this system, the basis for not controlling them was discussed and documented.

The 12 criticality safety parameters are:

Concentration

Density

Enrichment

Geometry

Heterogeneity

Interaction

Mass

Moderation

Neutron Absorbers

Reflection

Volume

Material Form The process steps were grouped together as follows:

Uranium Oxide Removal from Storage Rack

Cart Transit

Glovebox Entry

Uranium Oxide Powder Transfer to the Dissolution Tank (TSPS-01T A/B)

Dissolution, Sampling, Dilution and Adjustment

Transfer of Target Solution to the TSPS Hold Tank (TSPS-03T A/H)

A team of SHINE and Atkins Nuclear Solutions personnel was assembled to participate in the What-if analysis. The team represented the following areas: Nuclear Criticality Safety, Operations, Process Engineering, Safety Analysis, and Equipment Design Engineering. The credible accident scenarios identified in the What-if analysis are analyzed in this NCSE.

3.2. Hazard Identification Results The What-If analysis items (or accident event sequences) identified in the Haz Op are listed in Table 3.1 and for those event sequences that are considered credible, an analysis of compliance with the Double Contingency Principle is performed in Section 4. Events with similar consequences and safeguards are combined into single criticality accident event sequences discussed in detail in Section 4.

Private and confidential Criticality Safety Evaluation for the SHINE Target Solution Preparation System l Rev. 1 l August 2015 17

SHINE Medical Atkins-NS-TR-SHN-15-06 Table 3.1 What-if Analysis for TSPS Uranium Oxide Dissolution What if Causes Consequences Accident Sequence Concentration The TSPS solution is abnormally None. None. The supporting criticality Event sequence does not require concentrated. safety calculations consider optimal further analysis.

credible concentration conditions.

Density Density of the solution increases Equipment malfunction or None. Temperature of all cases is Event sequence does not require (temperature). Procedure non-compliance. assumed to be 20°C. Higher further analysis.

temperatures will result in lower reactivity due to the increase in neutron absorption due to Doppler broadening of the resonance region within 238U.

Enrichment Uranium oxide powder isotopic Supplier error. Exceed the established criticality N/A. This contingency is addressed, enrichment is high. safety limits for 235U potentially and controls established to preclude resulting in a criticality accident. this event sequence, in the SHINE Receiving NCSE (Reference 7).

Geometry Powder spills and accumulates a. Uranium oxide can is dropped Potential to accumulate too much Section 4.1, where a criticality in/around the TSPS area. during removal from the storage uranium oxide powder in an unsafe accident is evaluated to be racks or dropped during transfer geometry, which could potentially subcritical by design due to there to the glovebox, result in a criticality accident. being no conceivable cause for the

b. Cart spills can, event sequence, to the extent

c. Breach of equipment, required for a criticality accident to

d. Seismic event. be possible.

Private and confidential Criticality Safety Evaluation for the SHINE Target Solution Preparation System l Rev. 1 l August 2015 18

SHINE Medical Atkins-NS-TR-SHN-15-06 Uranium oxide powder spills and Equipment malfunction or Potential to accumulate too much Section 4.2, where a criticality accumulates inside the glovebox. Procedure non-compliance. uranium oxide powder in an unsafe accident is evaluated to be geometry, which could potentially credible and Double Contingency result in a criticality accident. Principle Protection, established on prevention of loss of safe volume control, is identified.

Dissolution tank has loss of Equipment malfunction, Procedure Potential to accumulate too much Section 4.3, where a criticality geometry control. non-compliance, or Seismic event. solution in an unsafe geometry, accident is evaluated to be which could potentially result in a subcritical by design due to there criticality accident. being no conceivable cause for the event sequence, to the extent required for a criticality accident to be possible.

Piping / processing equipment has Equipment malfunction, Procedure Potential to accumulate too much Section 4.4, where a criticality loss of geometry control. non-compliance, or Seismic event. solution in an unsafe geometry, accident is evaluated to be which could potentially result in a subcritical by design due to there criticality accident. being no conceivable cause for the event sequence, to the extent required for a criticality accident to be possible.

Heterogeneity Heterogeneous particles form in the Equipment malfunction. Heterogeneous effects of the Event sequence does not require solution. solution (e.g. precipitation, further analysis.

nucleation, etc.) are not considered in this NCSE. The evaluation of the process for which these tanks are used will determine if heterogeneous solution effects are present and the analysis will be updated accordingly during final design.

Private and confidential Criticality Safety Evaluation for the SHINE Target Solution Preparation System l Rev. 1 l August 2015 19

SHINE Medical Atkins-NS-TR-SHN-15-06 Interaction Material is brought too close to a. Physical interaction with other Potential to accumulate too many Section 4.5, where a criticality other material. equipment, cans in an unsafe configuration, accident is evaluated to be

b. More than two cans in pass which could potentially result in a subcritical by design due to there through, criticality accident. being no conceivable cause for the

c. Seismic event. event sequence, to the extent required for a criticality accident to be possible.

Mass Equipment failure / damage occurs. a. Physical interaction with other Potential to accumulate too much Section 4.6, where a criticality equipment, fissile material in an unsafe accident is evaluated to be

b. Equipment expansion, geometry, which could potentially subcritical by design due to the

c. Substantial fire, or result in a criticality accident. favorable geometry (i.e. sizing) and

d. Seismic event. volume of the TSPS equipment, which are highly reliable passive engineered design features that have no credible failure mode.

Moderation Water or flooding occurs in the Any significant fluid leak or ingress None. The supporting criticality Event sequence does not require TSPS room. into the TSPS area (e.g. due to a safety calculations assume optimal further analysis.

significant water pipe breach in the credible moisture contents.

vicinity, sprinkler activation or fire-fighting activities).

Water or moderator is introduced a. Fire or damage to the glovebox, None. The supporting criticality Event sequence does not require into the glovebox. b. Moderator introduced via safety calculations assume optimal further analysis (See Section 4.2).

condensation on walls (glovebox credible moisture contents.

ventilation failure)

Private and confidential Criticality Safety Evaluation for the SHINE Target Solution Preparation System l Rev. 1 l August 2015 20

SHINE Medical Atkins-NS-TR-SHN-15-06 Neutron Absorption / Poison Neutron absorbers in the system Equipment malfunction, Procedure Potential to accumulate too much Section 4.7, where a criticality are damaged or missing. non-compliance, fire, or Seismic solution in an unpoisoned system, accident is evaluated to be event. which could potentially result in a subcritical by design due to there criticality accident. being no conceivable cause for the event sequence, to the extent required for a criticality accident to be possible.

Reflection There are more onerous reflection Any. None. The supporting criticality Event sequence does not require conditions than normal. safety calculations consider further analysis.

bounding credible reflection conditions.

Volume The volume of uranium oxide Any. Potential to exceed the maximum Section 4.8, where a criticality powder or solution in unfavorable safe volume for optimized fissile accident is evaluated to be geometry equipment exceeds the material, which could lead to a credible and Double Contingency maximum safe value. criticality accident. Principle Protection, established on prevention of loss of safe geometry control, is identified.

Material Form Improper material is stored in a. Placement of metal cans on cart, Potential to accumulate too much Section 4.9, where a criticality uranium oxide cans. b. Buildup of metal in the glovebox / metal in an unsafe configuration, accident is evaluated to be not flowing into the chute. which could potentially result in a credible and Double Contingency criticality accident. Principle Protection, established on prevention of loss of safe material form control, is identified.

Private and confidential Criticality Safety Evaluation for the SHINE Target Solution Preparation System l Rev. 1 l August 2015 21

SHINE Medical Atkins-NS-TR-SHN-15-06 Incorrect material or improper Procedure non-compliance. Heterogeneous effects of the Event sequence does not require amount of material is introduced solution (e.g. precipitation, further analysis.

during dissolution / chemical nucleation, etc.) are not considered adjustment. in this NCSE. The evaluation of the process for which these tanks are used will determine if heterogeneous solution effects are present and the analysis will be updated accordingly during final design. The supporting criticality safety calculations assume optimal credible moisture content.

Private and confidential Criticality Safety Evaluation for the SHINE Target Solution Preparation System l Rev. 1 l August 2015 22

SHINE Medical Atkins-NS-TR-SHN-15-06

4. DOUBLE CONTINENCY ANALYSIS The postulated events listed in Table 3.1 can be classified into one of three categories:

1. Subcritical by Design

processes that are subcritical due to passive engineered attributes whose dimensions fall within established single parameter limits or that can be shown via approved explicit calculations to meet the 95/95 keff acceptance criterion of 0.9391 (Reference 8) when bounding process conditions are considered and for which there are no credible failure mechanisms (e.g., corrosion, bulging, leakage) that could disrupt the credited design attributes are classified as subcritical by design. The attributes that are credited in the subcritical by design determination shall be specified as passive engineered controls. Note that failure of configuration control is not considered to be an accident sequence.

the only potential means to effect a change that might result in a failure to function would be to implement a design change. Where there is no credible accident sequence leading to criticality, the Double Contingency Principle (DCP) is met by definition.

2. No Criticality Safety Consequence

the accident sequence may be credible but the result, if the sequence is unmitigated, will not be an accidental criticality.

3. Credible

the event sequence requires Double Contingency Principle protection demonstration, and justification that the safeguards identified, collectively ensure that realization of a criticality accident is highly unlikely.

The What-If analysis items (or accident event sequences) identified in Table 3.1 as requiring further evaluation are addressed in this section. For those event sequences that are considered credible, an evaluation of strict compliance with the Double Contingency Principle is performed per Nuclear Criticality Safety in Operations with Fissionable Material Outside Reactors, ANSI/ANS-8.1-2014 (Reference 9) (see NUREG-1520 (Reference 2) for additional information).

Compliance with DCP is achieved provided the process designs incorporate sufficient factors of safety to require at least two unlikely independent and concurrent changes in process conditions before a criticality accident is possible.

In addition to demonstration of compliance with the DCP, additional safeguards (i.e. defense-in-depth practices), or enabling events (i.e. conditions which must exist for the fault sequence to result in a criticality), are identified for each credible accident event sequence. These additional features demonstrate further fault tolerance, ensuring that the risks of a criticality accident are sufficiently low.

4.1. Powder spills and accumulates in / around the TSPS area 4.1.1. Discussion The majority of the TSPS equipment components provide either safe geometry or safe volume containers for homogeneous UO2-water mixtures at optimum concentration (refer to Section 4.6 for details of the safety-related equipment).

Private and confidential Criticality Safety Evaluation for the SHINE Target Solution Preparation System l Rev. 1 l August 2015 23

[Proprietary Information - Withheld from Public Disclosure Under 10 CFR 2.390(a)(4)]

Security-Related Information - Withheld Under 10 CFR 2.390 SHINE Medical Atkins-NS-TR-SHN-15-06 In the event that any or all of the safety-related TSPS equipment release their uranium oxide powder contents, a more reactive configuration than normal could be realized, due to the potential for the accumulation of a large volume of uranium oxide powder in an uncontrolled geometry (i.e. spilled onto the operations floor).

Uranium oxide powder cans are manually loaded with uranium oxide powder and sealed prior to entry into the TSPS area. These cans are manually loaded onto a transfer cart that can hold up to

[ Security-Related Information ] cans each. The transfer cart is designed to prevent loss of cans during seismic activity. Cans are manually removed from the transfer cart and stored in the seismically qualified uranium oxide Storage Racks. There are [ Security-Related Information ] racks located adjacent to each other along the wall. Each storage rack contains

[ Security-Related Information ] storage locations in a [ Security-Related Information ] array, allowing a total of [ Security-Related Information ] cans in the TSPS area. Cans are also manually removed from the storage racks for introduction into the gloveboxes, which are connected to the TSPS annular tanks via a sealed transfer tube / chute that prevents spillage to room floor or into any dissolution tank voids.

In the event that uranium oxide powder spills from cans and accumulated in the TSPS area then, in practice, the spilled uranium oxide powder accumulation would have a very low keff, on account of:

The absence of freely available large quantities of liquid moderator (e.g. water), and

The tendency for the uranium oxide powder spills to spread out, given its form and the unbounding nature of the facility floor area.

However, a significant spillage of uranium oxide powder could potentially occur in the event of the loss of confinement of the TSPS equipment (e.g. seismic event), or in the event of loss of integrity of a uranium oxide powder can (e.g. fracture).

4.1.2. Subcritical by Design Determination From the preceding discussion, it is seen that a uranium oxide powder spillage in the TSPS area could potential result in an unsafe condition. However, consider the following:

Carts are of a robust design to prevent loss of cans during seismic activity,

Carts are designed to accept only uranium oxide cans and reject U metal cans,

Carts have storage locations with a latching mechanism to prevent cans from falling out of locations,

Carts are designed to limit the number of cans on the cart to the critically safe number of [ Security-Related Information ] based on the spacing design.

Sealed transfer tube / chute prevents spillage to room floor or into dissolution tank voids from gloveboxes,

Cans are designed with a safe geometry volume of [ Proprietary Information ]

[ Security-Related Information ] or less,

Cans are of a robust design to prevent loss of uranium oxide powder when dropped from a height equivalent to the top of the storage racks

There is an absence of any accumulation points in the TSPS area, and

The equipment only holds a single can per rack location, per glovebox, and per cart location thereby limiting the accumulation of any spillage.

Based on the above, any spilled uranium oxide powder onto the operations floor would consist of a small quantity of uranium oxide powder, resulting in only a small accumulation of uranium oxide powder.

In any case, the supporting criticality safety calculations (Reference 10) evaluate that under process upset conditions, including flooding of the area (where bounding credible moderation Private and confidential Criticality Safety Evaluation for the SHINE Target Solution Preparation System l Rev. 1 l August 2015 24

[Proprietary Information - Withheld from Public Disclosure Under 10 CFR 2.390(a)(4)]

Security-Related Information - Withheld Under 10 CFR 2.390 SHINE Medical Atkins-NS-TR-SHN-15-06 conditions could be achieved); the maximum safe volume of uranium oxide is 7.82 liters (2.07 gallons) and the safe mass is 3.59 kg of uranium. These limits were derived assuming bounding values of other parameters as follows:

Temperature of all cases is assumed to be 20°C. Higher temperatures will result in lower reactivity due to the increase in neutron absorption due to Doppler broadening of the resonance region within 238U.

Uranium is assumed to be enriched to 21 wt% 235U.

For determination of subcritical mass and subcritical volume, a simple sphere model was used. The uranium layer is followed by 12 inches of close-fitting water reflection.

Uranium oxide was modeled as UO2. This molecule has the least number of oxygen atoms per uranium atoms which will result in the highest reactivity when compared other oxide compounds (i.e. UO3, U3O8, etc.).

For each parameter, a search was performed to find the optimum uranium concentration or density that yields the lowest value. For each uranium concentration, the value at the upper safety limit (USL) was determined. These values were then compared over the optimum concentration or density range to find the minimum value.

Additionally, Reference 9 lists the subcritical limit with uranium oxide powder 1.5% water is 32.3 kg 235U or 37.2 kg UO2 (at 100% 235U) which is significantly more uranium oxide powder than would be available to spill in the TSPS room. However, if there were a spill of uranium oxide powder piled on the TSPS floor, the introduction of moisture would cause any accumulation pile to flatten out (spread across the floor), resulting in a further subcritical configuration. Given the large, unbounded nature of the operations area and the absence of accumulation points therein, a criticality accident due to spillage of uranium oxide powder on the floor is determined to be subcritical by design.

Consequently, compliance with the Double Contingency Principle is met by definition.

4.1.3. Summary of identified Safety Controls In respect of the above subcritical by design determination, the following explicit criticality safety controls (CSCs) are relied on to support the criticality safety barriers identified above (and thus are relied on to preclude a criticality accident in the TSPS area as a result of multiple can failures), which assures that the volume of uranium oxide powder, assumed to be contained in a single uranium oxide powder can, is critically safe. Additional defense-in-depth practices are also listed as enhanced safety measures utilized by SHINE in order to further increase facility safety.

Passive Engineered CSC: Each uranium oxide powder can used in the TSPS shall have a volume of [ Proprietary Information ] [ Security-Related Information ] or less.

Passive Engineered CSC: Uranium oxide powder cans are of a robust design to prevent loss of uranium oxide powder when dropped from a height equivalent to the top of the storage racks.

Passive Engineered CSC: Transfer carts are designed to prevent loss of cans during a seismic activity.

Passive Engineered CSC: Transfer carts are designed with storage locations each containing a latching mechanism to prevent cans from falling out of locations during transport.

Passive Engineered CSC: Transfer Carts are designed to limit the number of cans on the cart to the safe number of [ Security-Related Information ] based on the spacing design.

Private and confidential Criticality Safety Evaluation for the SHINE Target Solution Preparation System l Rev. 1 l August 2015 25

[Proprietary Information - Withheld from Public Disclosure Under 10 CFR 2.390(a)(4)]

Security-Related Information - Withheld Under 10 CFR 2.390 SHINE Medical Atkins-NS-TR-SHN-15-06 Passive Engineered CSC: The gloveboxes are connected to the TSPS annular tanks via a sealed transfer tube / chute that prevents spills to room floor or into any dissolution tank voids.

Passive Engineered CSC: The TSPS equipment and piping are located in an open floor area that is free of accumulation points (i.e. holes, channels, cutouts, pits, etc.) exceeding

[ Proprietary Information ] [ Security-Related Information ] in volume.

Administrative CSC: All uranium oxide cans that contain uranium oxide powder shall be placed in approved storage locations in the storage rack or transfer cart or in the glovebox.

Administrative CSC: Oxide shall ONLY be contained in oxide cans unless inside process equipment.

Defense-in-depth Practice: In the event that water is observed to be present in any area, the source of the water should be identified and eliminated. Any uranium oxide powder cans in the immediate vicinity of the water infiltrated area should be removed to a dry area.

4.2. Uranium oxide powder spills and accumulates inside the glovebox 4.2.1. Discussion TSPS gloveboxes have a single pass-through that allows the entry of a single uranium oxide powder can at a time which is manually loaded into the glovebox where it is opened and the contents are dumped into a weight tray.

Glovebox pass through design allows only one oxide can in at a time.

Geometry of glovebox work platform prevents accumulation of uranium oxide powder.

Glovebox weight tray geometry limits the accumulation of uranium oxide powder.

The physical design of the gloveboxes minimizes the use of moderators.

Sloped glovebox floor to ensure uranium oxide powder falls into the dissolution tank and does not accumulate in the glovebox.

Sealed transfer tube / chute prevents spillage to room floor or into dissolution tank voids.

The mass of uranium oxide used to prepare target solution is measured in the glovebox weight tray and then transferred to the adjacent target solution preparation tank (1-TSPS-01T) by emptying the required number of uranium oxide storage cans into the tank one at a time. Operators adjust the amount of sulfuric acid to be added based on the amount of uranium oxide loaded into the target solution preparation tank (1-TSPS-01T).

In the event that uranium oxide powder is removed from multiple cans into the weight tray and accumulated (e.g. operations fail to transfer a weight tray full of uranium oxide powder into the target solution preparation tank prior to introducing a second can of uranium oxide powder into the glovebox), in practice, the uranium oxide powder accumulation would have a very low keff, on account of:

The absence of freely available large quantities of liquid moderator (e.g. water),

The bounding maximum 1.5 wt% moisture content of uranium oxide powder,

The tendency for the powder to spread out and potentially over the edge of the weight tray for multiple cans, given its form and the unbounding nature of the small weight tray, and Private and confidential Criticality Safety Evaluation for the SHINE Target Solution Preparation System l Rev. 1 l August 2015 26

Security-Related Information - Withheld Under 10 CFR 2.390 SHINE Medical Atkins-NS-TR-SHN-15-06

Reference 9 lists the subcritical limit with uranium oxide powder 1.5% water is 32.3 kg 235U or 37.2 kg oxide (at 100% 235U) which is significantly more uranium oxide powder than would be available to accumulate in a glovebox (Reference 1 states one oxide storage can contains up to [ Security-Related Information ] of uranium oxide).

However, if a significant accumulation of uranium oxide powder were to occur, and were subsequently moderated, forming a favorable (i.e. optimum or near-optimum) ratio of uranium to water, then an unsafe accumulation of uranium oxide powder could occur, potentially resulting in a criticality accident.

4.2.2. Accident Analysis From the proceeding discussion, it is seen that a criticality accident could potentially occur in the event of overloading, and subsequent moderation, of uranium oxide powder inside the TSPS glovebox.

Reference 9 lists the subcritical limit with uranium oxide powder 1.5% water is 32.3 kg 235U or 37.2 kg oxide (at 100% 235U). The supporting criticality safety calculations (Reference 10) evaluate that under process upset conditions, including flooding of the area (where optimal credible moderation conditions could be achieved); the maximum safe volume of uranium oxide is 7.82 liters (2.07 gallons) and the safe mass is 3.59 kg of uranium at 21% 235U. These limits were derived assuming bounding values of other parameters as follows:

Temperature of all cases is assumed to be 20°C. Higher temperatures will result in lower reactivity due to the increase in neutron absorption due to Doppler broadening of the resonance region within 238U.

For determination of subcritical mass and subcritical volume, a simple sphere model was used. The uranium layer is followed by 12 inches of close-fitting water reflection.

Uranium oxide was modeled as UO2. This molecule has the least number of oxygen atoms per uranium atoms which will result in the highest reactivity when compared other oxide compounds (i.e. UO3, U3O8, etc.).

For each parameter, a search was performed to find the optimum uranium concentration or density that yields the lowest value. For each uranium concentration, the value at the USL was determined. These values were then compared over the optimum concentration or density range to find the minimum value.

Based on the results of the supporting calculations (Reference 10), a criticality accident could potentially occur in a TSPS glovebox in the event multiple cans of uranium oxide powder are introduced into the glovebox and allowed to accumulate in the weight tray, and subsequently moderated. On this basis, compliance with the Double Contingency Principle must be demonstrated (Reference 9).

The glovebox weight tray is an open top tray allowing the potential for mounding of uranium oxide powder. The glovebox pass through design allows only one can in at a time. Therefore the entire contents of a can would have to be emptied, removed, and additional cans introduced into the glovebox to have a sufficient mass of uranium oxide powder to be a criticality safety concern.

Additionally, the weight tray is the only location within the glovebox where uranium oxide powder can accumulate as the glovebox work platform is grated metal and the glovebox floor is sloped to ensure uranium oxide powder falls into the dissolution tank. The glovebox design also minimizes the use of moderators.

For the above analysis, two criticality safety barriers are evident upon which Double Contingency Protection compliance can be demonstrated. These criticality safety barriers relate to ensuring the safe geometry and moderation control of uranium oxide powder, as follows:

Private and confidential Criticality Safety Evaluation for the SHINE Target Solution Preparation System l Rev. 1 l August 2015 27

SHINE Medical Atkins-NS-TR-SHN-15-06

Primary barrier against an accidental criticality: Glovebox design does not allow the accumulation of significant oxide powder and a loaded glovebox weight tray is emptied prior to introduction of a new can of uranium oxide powder.

Secondary barrier against an accidental criticality: Glovebox design minimized the use of moderators and Operations minimize the use of moderators in the glovebox.

The primary criticality safety barrier is important in that it ensures that any uranium oxide powder accumulation in the glovebox weight tray remains in a safe geometry configuration as uranium oxide powder height cannot exceed the tops of the weight tray.

The secondary criticality safety barrier is important in that is ensures that if the primary criticality safety barrier is failed (i.e. mounded pile in the weight tray), the introduction of moisture would cause any accumulation pile to flatten out and overflow the edges of the weight tray, resulting in a further subcritical configuration. Additionally, the physical design of the weight tray and glovebox preclude the potential for realization of this condition. Specifically, there are no moderation sources in the glovebox, the geometry is limited in the weight tray, and the glovebox floor is sloped to the tank, all minimizing the potential for water retention.

Furthermore, operators are trained to be aware of the presence of water in unapproved locations of the TSPS and are required take appropriate mitigative action upon observance of any significant water. This supplementary action is designated as defense-in-depth practice. It provides further fault tolerance ensuring that the risk of a criticality accident from the postulated process upset is sufficiently low.

The potential for either of the above safety barriers to be in a failed state is considered unlikely based on the nature of operations, operational experience and on the safety margin inherent in each abovementioned safety barrier.

In summary, Double Contingency Protection is established against an accidental criticality caused by uranium oxide powder accumulations in the TSPS gloveboxes. It is unlikely for operators to accumulate uranium oxide powder in an unsafe geometry within a weight tray with uranium oxide powder from multiple uranium oxide powder cans prior to transferring the uranium oxide powder to the tank and it is unlikely for operators to introduce moderation into the glovebox that would result in an unsafe moderation condition.

4.2.3. Criticality Barriers for uranium oxide powder spills and accumulates in the TSPS Glovebox The following process upsets must occur before a criticality accident, due to an accumulation of uranium oxide powder inside a glovebox could occur:

There is a design error allowing the glovebox weight tray to hold significantly more than a safe geometry configuration of uranium oxide powder (Primary barrier: Passive Engineered Control),

There is a significant release of water (or other liquid moderator) into the TSPS glovebox where the accumulation occurs and the uranium oxide powder retains moderator (Secondary barrier: Administrative Control),

The glovebox weight tray is significantly over-loaded beyond the safe dry mass limit of 1.5% water with 32.3 kg 235U or 37.2 kg oxide (at 100% 235U) (Enabling Event), and

Operators fail to notice that the accumulation is contacted with water or fail to take remedial action upon such observation (Defense-in-depth Practice).

Private and confidential Criticality Safety Evaluation for the SHINE Target Solution Preparation System l Rev. 1 l August 2015 28

[Proprietary Information - Withheld from Public Disclosure Under 10 CFR 2.390(a)(4)]

Security-Related Information - Withheld Under 10 CFR 2.390 SHINE Medical Atkins-NS-TR-SHN-15-06 4.2.4. Summary of identified Safety Controls The explicit criticality safety controls (CSCs) relied on to support the criticality safety barriers identified above (and thus relied on to preclude a criticality accident in the TSPS as a result of uranium oxide powder spills), are listed below. Additional defense-in-depth practices are also listed as enhanced safety measures utilized by SHINE in order to further increase facility safety.

Passive Engineered CSC: Each weight tray used in the TSPS glovebox shall have a safe geometry height for accumulation prevention.

Passive Engineered CSC: Each uranium oxide powder can used in the TSPS shall have a volume of [ Proprietary Information ] [ Security-Related Information ] or less.

Passive Engineered CSC: Glovebox pass through design allows only one oxide can in at a time and rejects U metal cans.

Passive Engineered CSC: Geometry of glovebox work platform prevents accumulation of uranium oxide powder.

Passive Engineered CSC: Sloped glovebox floor to ensure uranium oxide powder falls into the dissolution tank and does not accumulate in the glovebox.

Passive Engineered CSC: The physical design of the gloveboxes minimizes the use of moderators.

Passive Engineered CSC: The gloveboxes are connected to the TSPS annular tanks via a sealed transfer tube / chute that prevents spills to room floor or into any dissolution tank voids.

Administrative CSC: Loaded glovebox weight tray is emptied prior to introduction of a new can of uranium oxide powder.

Administrative CSC: Operations prevent the use of moderators inside the glovebox.

Defense-in-depth Practice: In the event that water is observed to be present in any area, the source of the water should be identified and eliminated. Any uranium oxide powder cans in the immediate vicinity of the water infiltrated area should be removed to a dry area.

4.3. Dissolution tank has loss of geometry control (leak) 4.3.1. Discussion In the event that the TSPS dissolution tanks release their process contents, a more reactive configuration than normal could be realized, due to the potential for the accumulation of a large volume of process material in an uncontrolled geometry (i.e. spilled onto the operations floor).

The TSPS Annular dissolution tanks consist of the following specifications:

Annular tanks are designed to prevent a loss of solution during seismic activity,

Annular tanks are surrounded by a berm to provide safe spacing, direct solution to the critically safe sump catch tank, and prevent interaction of the fissile solution inside the tank with other fissile material,

The height of the berms that surround the dissolver tanks are below the critically safe slab height for uranium sulfate solution at 21% enrichment (weight percent U-235),

The annular tank height is a maximum of [ Proprietary Information ]

[ Security-Related Information ] tall, Private and confidential Criticality Safety Evaluation for the SHINE Target Solution Preparation System l Rev. 1 l August 2015 29

[Proprietary Information - Withheld from Public Disclosure Under 10 CFR 2.390(a)(4)]

Security-Related Information - Withheld Under 10 CFR 2.390 SHINE Medical Atkins-NS-TR-SHN-15-06

The minimum outer diameter of the annular tank is [ Proprietary Information ]

[ Security-Related Information ], and

The tanks have a maximum fissile material thickness of [ Proprietary Information ]

[ Security-Related Information ] and a tank wall thickness of no greater than

[ Proprietary Information ] [ Security-Related Information ].

4.3.2. Subcritical by Design Determination From the preceding discussion, it is seen that spillage of TSPS process material from a dissolution tank could potentially result in an unsafe condition. However, consider the following:

The provision of a critically safe geometry sump system situated in the TSPS process material area,

Annular tanks are surrounded by a berm to provide safe spacing, direct solution to the critically safe sump catch tank, and prevent interaction of the fissile solution inside the tank with other fissile material,

The berms that surround the dissolver tanks are below the critically safe slab height for uranium sulfate solution at 21% enrichment (weight percent U-235),

The drain system is capable of holding the contents of the entire target solution preparation vessel volume,

The tendency for the solution to spread out across the floor of the TSPS, given its form and the unbounding nature of the area, and

The absence of any accumulation points in the vicinity of the TSPS process material equipment.

Based on the above, any spilled TSPS process material from a dissolution tank onto the operations floor would expand across the surface of the floor inside the berm and drain to the critically safe geometry sump and then to the critically safe sump catch tank in the Radioactive Drain System. The drain system is capable of holding the contents of the entire target solution preparation vessel volume. If the spilled material were not able to drain (e.g. clogged pipe), the material would simply overflow the critically safe slab height berm and continue to expand across the surface of the operations floor. Given the provision of a critically safe geometry sump system, the critically safe slab height berm, the large, unbounded nature of the process area, and the absence of accumulation points within the TSPS area, a criticality accident due to spillage of process material in the TSPS area from the dissolution tanks is determined to be subcritical by design. Consequently, compliance with the Double Contingency Principle is met by definition.

4.3.3. Summary of identified Safety Controls In respect of the above subcritical by design determination, the following passive engineered CSCs are identified. The combination of these controls assures that any accumulation of TSPS process material from a dissolution tank remains critically safe. Commensurate with the above determination, failures of these robust CSCs are considered highly unlikely.

Passive Engineered CSC: The sump maintains critically safe geometry for leakage and directs liquid to the critically safe sump catch tank.

Passive Engineered CSC: Annular tanks are surrounded by a berm to provide safe spacing, direct solution to the critically safe sump catch tank, and prevent interaction of the fissile solution inside the tank with other fissile material.

Passive Engineered CSC: The TSPS equipment and piping are located in an open floor area that is free of accumulation points (i.e. holes, channels, cutouts, pits, etc.) exceeding

[ Proprietary Information ] [ Security-Related Information ] in volume.

Passive Engineered CSC: Annular tanks are designed to prevent a loss of solution during seismic activity.

Private and confidential Criticality Safety Evaluation for the SHINE Target Solution Preparation System l Rev. 1 l August 2015 30

[Proprietary Information - Withheld from Public Disclosure Under 10 CFR 2.390(a)(4)]

Security-Related Information - Withheld Under 10 CFR 2.390 SHINE Medical Atkins-NS-TR-SHN-15-06 Although failures of the above CSCs (to perform the above safety function) are considered highly unlikely, further fault tolerance can be achieved by responding to leaks when they occur. This good house-keeping defense-in-depth practice ensures that the risk of a criticality accident due to the spillage of TSPS process material is sufficiently low.

Defense-in-depth Practice: In the event of discovery of spillage or leakage of TSPS material, the cause of the process spillage should be identified and terminated as soon as is reasonably achievable. The spilled process material should be recovered into analyzed safe geometry containers / sump.

4.4. Piping / processing equipment has loss of geometry control 4.4.1. Discussion The majority of the TSPS equipment components provide either safe geometry or safe volume for homogeneous UO2-water mixtures at optimum concentration (refer to Section 4.6 for details of the safety related equipment).

A significant spill of TSPS process material could potentially occur in the event of loss of confinement of the process equipment (e.g. fracture) or backflow were to occur from a blockage in the system.

In the event that any or all of the safety related TSPS equipment release their process contents, a more reactive configuration than normal could be realized, due to the potential for the accumulation of a large volume of process material in an uncontrolled geometry (i.e. spilled onto the operations floor). However, in practice, the solution would have a very low keff, on account of:

The tendency for the solution to spread out across the floor of the TSPS, given its form and the unbounding nature of the area, and

The absence of any accumulation points in the vicinity of the TSPS process material equipment.

4.4.2. Subcritical by Design Determination From the preceding discussion, it is seen that spillage of TSPS process material could potentially result in an unsafe condition. However, consider the following:

The TSPS equipment and piping are located in an open floor area that is free of accumulation points (i.e. holes, channels, cutouts, pits, etc.) exceeding

[ Proprietary Information ] [ Security-Related Information ] in volume, and

The inherent small capacities of the TSPS process material system components (with maximum individual capacities of approximately [ Proprietary Information ]

[ Security-Related Information ] or less to comply with the safe volume limit of minimum safety volume limit of 7.82 liters uranium oxide) (i.e. filters, pumps, etc.).

Based on the above, any spilled TSPS process material onto the operations floor would expand across the surface of the floor, resulting in only a thin layer of process material. The maximum safe volume for an optimally concentrated homogeneous mixture of UO2 and water and of Uranyl Sulfate is 7.82 liters and 9.14 liters, respectively (Reference 10). Given the large, unbounded nature of the process area and the absence of accumulation points therein, a criticality accident due to spillage of process material in the TSPS area is determined to be subcritical by design. Consequently, compliance with the Double Contingency Principle is met by definition.

4.4.3. Summary of identified Safety Controls In respect of the above subcritical by design determination, the following passive engineered CSCs are identified, which assure that any leakage of TSPS process material is critically safe.

Private and confidential Criticality Safety Evaluation for the SHINE Target Solution Preparation System l Rev. 1 l August 2015 31

[Proprietary Information - Withheld from Public Disclosure Under 10 CFR 2.390(a)(4)]

Security-Related Information - Withheld Under 10 CFR 2.390 SHINE Medical Atkins-NS-TR-SHN-15-06 Commensurate with the above determination, failures of these robust CSCs are considered highly unlikely.

Passive Engineered CSC: The TSPS equipment and piping are located in an open floor area that is free of accumulation points (i.e. holes, channels, cutouts, pits, etc.) exceeding

[ Proprietary Information ] [ Security-Related Information ] in volume.

Passive Engineered CSC: Filters and uranyl sulfate pumps are designed with a critically safe volume.

Although failures of the above CSCs (to perform the above safety function) are considered highly unlikely, further fault tolerance can be achieved by responding to leaks when they occur. This good house-keeping defense-in-depth practice ensures that the risk of a criticality accident due to the spillage of TSPS process material is sufficiently low.

Defense-in-depth Practice: In the event of discovery of spillage or leakage of TSPS material, the cause of the process spillage should be identified and terminated as soon as is reasonably achievable. The spilled process material should be recovered into analyzed safe geometry containers / sump.

4.5. Material is brought too close to other material 4.5.1. Discussion The following primary operations are performed in the TSPS target solution preparation phase analyzed in this criticality safety evaluation:

manual transfer of uranium oxide cans from the uranium oxide storage racks to the transfer cart,

manual transfer / movement of the transfer cart to the glovebox,

manual transfer of the uranium oxide cans one at a time to the glovebox,

measurement and transfer of uranium oxide powder to the dissolution tank,

dissolution, sampling, dilution and measurement, and

transfer to the TSPS hold tank.

Each of the components used in the above mentioned manual operations provides either safe geometry or safe volume for TSPS uranium oxide powder or solution. The physical width and depth of the storage racks are designed such that uranium oxide cans stored in the racks are safe by geometry. Each storage cell location holds one uranium oxide storage can.

The uranium oxide cans are designed to be safe for storage of uranium oxide by volume control

([ Proprietary Information ] [ Security-Related Information ]) and are designed with a unique size and shape when compared to U metal storage cans to prevent placement of the U metal cans in the incorrect storage rack or transfer cart.

Carts are designed to accept only uranium oxide cans and reject U metal cans and have

[ Security-Related Information ] storage locations with a latching mechanism to prevent cans from falling out of locations. Additionally, to limit interaction, carts are designed with bumpers on the side of the cart to limit the effect of impact on room equipment and also provide critically safe spacing to prevent fissile material from interacting with other equipment containing fissile material.

Glovebox features include a pass through design which allows only one can in at a time and has a sloped glovebox floor to ensure uranium oxide powder falls into the dissolution tank and does not accumulate in the glovebox. The dissolution tank has a robust design and is surrounded by a Private and confidential Criticality Safety Evaluation for the SHINE Target Solution Preparation System l Rev. 1 l August 2015 32

[Proprietary Information - Withheld from Public Disclosure Under 10 CFR 2.390(a)(4)]

Security-Related Information - Withheld Under 10 CFR 2.390 SHINE Medical Atkins-NS-TR-SHN-15-06 berm to provide safe spacing and prevent interaction of the fissile solution inside the tank with other fissile material in the area.

In the event that multiple uranium oxide powder cans are stored together or a uranium oxide powder can is stored in an unauthorized location (e.g. operations fail to use the storage rack or transfer cart),

in practice, the uranium oxide powder accumulation would have a very low keff, on account of:

Uranium oxide powder cans are manually loaded with uranium oxide powder and sealed prior to entry into the TSPS area,

The absence of freely available large quantities of liquid moderator (e.g. water), and

The absence of freely available thick reflection.

However, if multiple uranium oxide powder cans were stored improperly (e.g. physical interaction with other equipment, more than two cans stacked together, or seismic event), and were subsequently reflected, then the above mentioned large criticality safety margin would be reduced.

4.5.2. Subcritical by Design Determination From the preceding discussion, it is seen that an unsafe geometrical configuration of uranium oxide powder cans the TSPS area could potentially result in an unsafe condition. However, consider the following:

Carts are designed to prevent loss of cans during seismic activity,

Carts have storage locations with a latching mechanism to prevent cans from falling out of locations,

Carts are designed to limit the number of cans on the cart to the safe number of

[ Security-Related Information ] based on the spacing design.

Carts are designed to accept only uranium oxide cans and reject U metal cans,

Carts are designed with bumpers on the side of the cart to limit the effect of impact on room equipment and also provide critically safe spacing to prevent fissile material from interacting with other equipment containing fissile material,

Annular tanks are surrounded by a berm to provide safe spacing, direct solution to the critically safe sump catch tank, and prevent interaction of the fissile solution inside the tank with other fissile material.

Cans are designed with a safe geometry volume of [ Proprietary Information ]

[ Security-Related Information ] or less,

Cans are of a robust design to prevent loss of uranium oxide powder when dropped from a height equivalent to the top of the storage racks,

There is an absence of any accumulation points in the TSPS area, and

The equipment only holds a single can per rack location, per glovebox, and per cart location limiting the interaction of cans.

In any case, the supporting criticality safety calculations (Reference 10) evaluate that under process upset conditions, including flooding of the area (where optimal credible reflection conditions could be achieved); the maximum safe mass of uranium oxide with 1.5% water content is 37.2 kg oxide or at optimal moderation is 3.59 kg of uranium. These limits were derived assuming bounding values of other parameters as follows:

Temperature of all cases is assumed to be 20°C. Higher temperatures will result in lower reactivity due to the increase in neutron absorption due to Doppler broadening of the resonance region within 238U.

Uranium is assumed to be enriched to 21 wt% 235U.

For determination of subcritical mass and subcritical volume, a simple sphere model was used. The uranium layer is followed by 12 inches of close-fitting water reflection.

Private and confidential Criticality Safety Evaluation for the SHINE Target Solution Preparation System l Rev. 1 l August 2015 33

[Proprietary Information - Withheld from Public Disclosure Under 10 CFR 2.390(a)(4)]

Security-Related Information - Withheld Under 10 CFR 2.390 SHINE Medical Atkins-NS-TR-SHN-15-06

Uranium oxide was modeled as UO2. This molecule has the least number of oxygen atoms per uranium atoms which will result in the highest reactivity when compared other oxide compounds (i.e. UO3, U3O8, etc.).

Because of the manual nature of operations, the limited volume of each sealed oxide can, and the limited interactions due to the geometry designed into the system, as well as the limited number of cans handled together, to have fissile material interactions of consequence within the TSPS area is determined to be subcritical by design. Thus even if uranium oxide powder cans were stored improperly, significant reflection of the material would also be required. The flooding / full reflection condition is determined to be subcritical by design. Consequently, compliance with the Double Contingency Principle is met by definition.

4.5.3. Summary of identified Safety Controls In respect of the above subcritical by design determination, the following explicit criticality safety controls (CSCs) are relied on to support the criticality safety barriers identified above and are thus relied on to preclude a criticality accident in the TSPS area as a result of multiple can interactions (material brought too close to other material), which assures that the storage of uranium oxide powder cans, is critically safe. Additional defense-in-depth practices are also listed as enhanced safety measures utilized by SHINE in order to further increase facility safety.

Passive Engineered CSC: Uranium oxide cans are designed with a unique size and shape when compared to U metal storage cans to prevent placement of the U metal cans in the incorrect storage rack, transfer cart or glovebox pass through.

Passive Engineered CSC: Each uranium oxide powder can used in the TSPS shall have a volume of [ Proprietary Information ] [ Security-Related Information ] or less.

Passive Engineered CSC: Transfer carts are designed to prevent loss of cans during a seismic activity.

Passive Engineered CSC: Transfer carts are designed with storage locations each containing a latching mechanism to prevent cans from falling out of locations during transport.

Passive Engineered CSC: Transfer Carts are designed to limit the number of cans on the cart to the safe number of [ Security-Related Information ] based on the spacing design.

Passive Engineered CSC: Transfer carts are designed with bumpers on the side of the cart to limit the effect of impact on room equipment and also provide critically safe spacing to prevent fissile material from interacting with other equipment containing fissile material.

Passive Engineered CSC: Annular tanks are surrounded by a berm to provide safe spacing, direct solution to the critically safe sump catch tank, and prevent interaction of the fissile solution inside the tank with other fissile material.

Passive Engineered CSC: The TSPS equipment and piping are located in an open floor area that is free of accumulation points (i.e. holes, channels, cutouts, pits, etc.) exceeding

[ Proprietary Information ] [ Security-Related Information ] in volume.

Administrative CSC: All uranium oxide cans that contain uranium oxide powder shall be placed in approved storage locations in the storage rack or transfer cart or in the glovebox.

Private and confidential Criticality Safety Evaluation for the SHINE Target Solution Preparation System l Rev. 1 l August 2015 34

[Proprietary Information - Withheld from Public Disclosure Under 10 CFR 2.390(a)(4)]

Security-Related Information - Withheld Under 10 CFR 2.390 SHINE Medical Atkins-NS-TR-SHN-15-06 Defense-in-depth Practice: In the event that water is observed to be present in any area, the source of the water should be identified and eliminated. Any uranium oxide powder cans in the immediate vicinity of the water infiltrated area should be removed to a dry area.

4.6. Equipment failure / damage occurs 4.6.1. Discussion The equipment for the uranium oxide removal, transfer, dissolution and transfer to TSPS hold tank are in the TSPS Room. The general arrangement of the TSPS room is shown in Figure 2.2. The TSPS equipment and components consist of the following capable of containing fissile material, as loose uranium oxide powder, in oxide cans, or as a solution:

There are [ Security-Related Information ] uranium oxide powder storage racks. The physical width and depth of the storage racks is designed such that uranium oxide cans stored in the racks are safe by geometry. Each storage cell location holds one uranium oxide storage can,

Oxide can transfer carts designed with bumpers on the side of the cart to limit the effect of impact on room equipment and provide critically safe spacing to prevent fissile material from interacting with other equipment containing fissile material,

Two gloveboxes, each with a single pass through design that allows only one can at a time,

Two uranyl sulfate preparation tanks (dissolution tank) (TSPS-01T (A/B)) with a volume of [ Proprietary Information ] [ Security-Related Information ] each, each designed with an annulus containing fissile material and a neutron absorber panel on both the inside and outside surfaces, equipped with a recirculation system and are surrounded by a berm to prevent interaction of the fissile solution inside the tank with other fissile material,

TSPS-01T (A/B) safe geometry heater and recirculation piping,

Tank safe geometry vent system,

Safe geometry discharge piping, valves, and filters, and

Safe geometry Uranyl Sulfate Pump (1-TSPS-01P-A/B).

Each of the abovementioned components provides either critically safe geometry or critically safe volume for homogeneous UO2-water mixtures at optimum concentration or Uranyl Sulfate at optimum concentration.

In the event that any or all of the above equipment are damaged, the geometry or spacing of the various components could be altered, giving rise to a more reactive configuration than would otherwise exist under normal conditions.

4.6.2. Subcritical by Design Determination From the preceding discussion, it is seen that physical damage of equipment in the TSPS equipment and systems could potentially result in a change to the configuration and / or dimensions of equipment, potentially leading to a more reactive configuration than would otherwise exist under normal conditions.

Physical damage of equipment that results in a change to their normal geometry, dimensions or configuration could potentially occur in the event of:

physical interaction with other equipment,

equipment expansion,

a substantial fire, or

a seismic event.

Private and confidential Criticality Safety Evaluation for the SHINE Target Solution Preparation System l Rev. 1 l August 2015 35

[Proprietary Information - Withheld from Public Disclosure Under 10 CFR 2.390(a)(4)]

Security-Related Information - Withheld Under 10 CFR 2.390 SHINE Medical Atkins-NS-TR-SHN-15-06 The potential for each of the above initiators to result in a change to the normal geometry, dimensions or configuration of the TSPS system equipment, to the extent required for a criticality accident to be possible, are examined below.

Physical interaction with other equipment Physical interactions with other equipment in the area (e.g. impact with a transfer cart or other equipment) could potentially result in damage and a change to the geometry, dimensions or configuration of the TSPS equipment. However, any hypothesized damage condition will not result in a uniform increase in the critical dimension of the equipment. For example, the important internal cross-sectional area of the cylindrical geometry controlled components (e.g. the in line filters), could not conceivably be uniformly increased. Similarly, the depth of the glovebox weight tray or glovebox sloped flooring could not conceivably be uniformly increased. In practice, any significant damage to the geometry controlled TSPS equipment would likely result in a reduction in their internal cross-sectional area (e.g. as a result of crushing) thus resulting in a reduction in the maximum potential reactivity of the system.

With respect to the annular tanks, deformation could theoretically increase reactivity. However, the oxide can transfer carts are designed with bumpers on the sides of the cart to limit the effect of impact on room equipment and also provide critically safe spacing to prevent fissile material from interacting with other equipment containing fissile material. The annular tanks themselves are surrounded by a berm to provide safe spacing and prevent interaction of the fissile solution inside the tank with other fissile material.

It is possible (although considered very unlikely) that a significant physical impact event could result in a change in the configuration of equipment (i.e. the spacing between equipment). However, any such changes would, in practice, be offset by the effects of geometry deformation (e.g. crushing) and the inevitable displacement of the fissile material located in the equipment (e.g. the annular tanks, gloveboxes, storage racks, and transport carts).

Based on the above evaluation, a criticality accident due to change in dimensions and / or configuration of the TSPS system equipment, as a result of a physical interaction event, is determined to be subcritical by design.

Equipment expansion Internal pressure induced deformation (i.e. pressure expansion) of the TSPS equipment is determined to be subcritical by design. The largest equipment are the two uranyl sulfate preparation tanks (dissolution tank) (TSPS-01T (A/B)) with a volume of [ Proprietary Information ]

[ Security-Related Information ] each. Each tank is designed with an annulus containing fissile material and a neutron absorber panel on both the inside and outside surfaces, is equipped with a recirculation system and is vented to atmospheric pressure.

In any case, the supporting criticality safety calculations (Reference 4) evaluate that under process upset conditions, including flooding of the area (where optimal credible reflection conditions could be achieved); the maximum safe height of an annular tank of uranyl sulfate or uranium dioxide and water is [ Proprietary Information ] [ Security-Related Information ], capable of holding

[ Proprietary Information ] [ Security-Related Information ]. These limits were derived assuming bounding values of other parameters as follows:

Temperature of all cases is assumed to be 20°C. Higher temperatures will result in lower reactivity due to the increase in neutron absorption due to Doppler broadening of the resonance region within 238U.

Uranium is assumed to be enriched to 21 wt% 235U.

Uranium oxide was modeled as UO2. This molecule has the least number of oxygen atoms per uranium atoms which will result in the highest reactivity when compared other oxide compounds (i.e. UO3, U3O8, etc.).

Private and confidential Criticality Safety Evaluation for the SHINE Target Solution Preparation System l Rev. 1 l August 2015 36

[Proprietary Information - Withheld from Public Disclosure Under 10 CFR 2.390(a)(4)]

Security-Related Information - Withheld Under 10 CFR 2.390 SHINE Medical Atkins-NS-TR-SHN-15-06

Both void and water was used to fill the gaps and space outside the tanks. The outer gap is [ Proprietary Information ] [ Security-Related Information ]. The inner gap does not exceed [ Proprietary Information ] [ Security-Related Information ].

The annular tanks are open at the top via a sealed transfer tube / chute between the glovebox and annular tank that prevents spillage to room floor or into dissolution tank voids, and thus the tank is not capable of achieving high pressure conditions. The remaining small components lack the necessary physical capacity to support a high pressure environment. Thus, a criticality accident due to change in dimensions of the TSPS equipment, as a result of equipment expansion, is determined to be subcritical by design.

A substantial fire A substantial, prolonged, fire in the TSPS area could potentially cause structural damage to the equipment in the vicinity. The annular tanks have a [ Proprietary Information ]

[ Security-Related Information ] neutron absorber plate consisting of PPC-B present on the outside and inside diameters of the tank. The PPC-B poison plates are a polymer based material with flame retardants incorporated to slow flame propagation. Under the described circumstances (and assuming no mitigative firefighting response), the annular tanks (the largest and most safety significant components) would be subject to very high temperatures that would result in boiling, and thus evaporation, of their liquid content. This process would quickly concentrate the fine UO2 particles in the system, resulting in sub-optimum moderation conditions and thus naturally reducing the reactivity of the system. These effects are considered to adequately compensate for any conceivable local expansion of the geometry / volume controlled process equipment and / or flame retardant absorber plates. Additionally, the combustible loading of the TSPS area is restricted per facility procedures. A criticality accident due to change in dimensions and / or configuration of the TSPS system equipment, as a result of a substantial fire, is determined to be subcritical by design.

A seismic event A seismic event could potentially cause widespread change in the configuration of the various TSPS equipment. The transfer carts are designed to prevent loss of cans during a seismic activity.

Additionally, annular tanks are designed to prevent a loss of solution during seismic activity.

However, the effects of a seismic event are considered to be bounded by physical interaction, where both loss of configuration and geometry deformation are postulated. Physical interactions with other equipment in the area (e.g. impact with a transfer cart or other equipment) could potentially result in damage and a change to the geometry, dimensions or configuration of the TSPS equipment.

However, any hypothesized damage condition will not result in a uniform increase in the critical dimension of the equipment. For example, the important internal cross-sectional area of the cylindrical geometry controlled components (e.g. the in line filters), could not conceivably be uniformly increased. Similarly, the depth of the glovebox weight tray or glovebox sloped flooring could not conceivably be uniformly increased. In practice, any significant damage to the geometry controlled TSPS equipment would likely result in a reduction in their internal cross-sectional area (e.g. as a result of crushing) thus resulting in a reduction in the maximum potential reactivity of the system. A seismic event causing widespread change would also not result in a uniform increase in the critical dimensions of the equipment.

More likely would be the possibility (although considered very unlikely) that a significant physical impact event could result in a change in the configuration of equipment (i.e. the spacing between equipment). However, any such changes would, in practice, be offset by the effects of geometry deformation (e.g. crushing) and the inevitable displacement of the fissile material located in the equipment (e.g. the annular tanks, gloveboxes, storage racks, and transport carts).

From the above discussions, it is seen that there are no identified events related to an increase in dimensions of the significant TSPS equipment. Furthermore, any conceivable change to the configuration of equipment (i.e. the spacing between equipment), is considered to be offset by the effects of geometry deformation (e.g. crushing) and the inevitable displacement of the process materials from the large volume annular tanks. Any conceivable damage to the TSPS equipment Private and confidential Criticality Safety Evaluation for the SHINE Target Solution Preparation System l Rev. 1 l August 2015 37

[Proprietary Information - Withheld from Public Disclosure Under 10 CFR 2.390(a)(4)]

Security-Related Information - Withheld Under 10 CFR 2.390 SHINE Medical Atkins-NS-TR-SHN-15-06 is therefore considered to not present a more onerous condition than exists normally, and thus an accidental criticality is determined to be subcritical by design. Consequently, compliance with the Double Contingency Principle is met by definition.

4.6.3. Summary of identified Safety Controls In respect of the above subcritical by design determination, the following explicit criticality safety controls (CSCs) are relied on to support the criticality safety barriers identified above (and are thus relied on to preclude a criticality accident in the TSPS area as a result of equipment failures /

damage), are listed below, which assures that the safety from the failure / damage of equipment, is critically safe.

Passive Engineered CSC: Glovebox pass through design allows only one oxide can in at a time and rejects U metal cans.

Passive Engineered CSC: Transfer carts are designed with bumpers on the side of the cart to limit the effect of impact on room equipment and also provide critically safe spacing to prevent fissile material from interacting with other equipment containing fissile material.

Passive Engineered CSC: Annular tanks for uranyl sulfate dissolution are designed to be a safe geometry maximum of [ Proprietary Information ] [ Security-Related Information ] tall and critically safe volume of [ Proprietary Information ] [ Security-Related Information ]. Wall thickness is less than [ Proprietary Information ] [ Security-Related Information ] and outer diameter is at least [ Proprietary Information ] [ Security-Related Information ], with a maximum liquid thickness of [ Proprietary Information ] [ Security-Related Information ].

Passive Engineered CSC: Annular tanks are designed with a [ Proprietary Information ]

[ Security-Related Information ] neutron absorber plate consisting of corrosive-resistant PPC-B present on the outside and inside diameters of the tank. The outer gap between the tank and absorber plate is [ Proprietary Information ] [ Security-Related Information ] or less and the inner gap does not exceed [ Proprietary Information ] [ Security-Related Information ].

Passive Engineered CSC: Annular tanks are surrounded by a berm to provide safe spacing, direct solution to the critically safe sump catch tank, and prevent interaction of the fissile solution inside the tank with other fissile material.

Passive Engineered CSC: Heaters, recirculation piping, tank vent system, discharge piping, and valves are all designed critically safe geometry.

Passive Engineered CSC: Filters and uranyl sulfate pumps are designed with a critically safe volume.

4.7. Neutron absorbers in the system are damaged or missing 4.7.1. Discussion The TSPS Annular dissolution tanks include the following specifications:

A [ Proprietary Information ] [ Security-Related Information ] neutron absorber plate consisting of PPC-B is present on the outside and inside diameters of the tank,

Each plate is corrosive-resistant to prevent depletion of its absorption properties, and

The acceptable gap size between the neutron absorber and the tank wall for the outer gap is [ Proprietary Information ] [ Security-Related Information ] and the inner gap does not exceed [ Proprietary Information ] [ Security-Related Information ].

Private and confidential Criticality Safety Evaluation for the SHINE Target Solution Preparation System l Rev. 1 l August 2015 38

[Proprietary Information - Withheld from Public Disclosure Under 10 CFR 2.390(a)(4)]

Security-Related Information - Withheld Under 10 CFR 2.390 SHINE Medical Atkins-NS-TR-SHN-15-06 Each of the abovementioned specifications provides required safety features of the annular tanks for homogeneous UO2-water mixtures at optimum concentration or Uranyl Sulfate at optimum concentration.

In the event that any or all of the neutron absorber plates are damaged or missing, a more reactive configuration than would otherwise exist under normal conditions could exist.

4.7.2. Subcritical by Design Determination From the proceeding discussion, it is seen that a missing or damaged [ Proprietary Information ]

[ Security-Related Information ] neutron absorber plate consisting of PPC-B required on the outside and inside diameters of the tank could potentially result in a more reactive configuration than would otherwise exist under normal conditions (References 4, 5 and 6).

The supporting criticality safety calculations (Reference 4) demonstrates the criticality safety of the annular tanks, assuming that the TSPS tanks do not contain any greater than up to

[ Proprietary Information ] [ Security-Related Information ] of uranyl sulfate or uranium dioxide and water, with the presence of an [ Proprietary Information ] [ Security-Related Information ] neutron absorber plate consisting of PPC-B present on the outside and inside diameters of the tank. These calculations assume the solute saturation is unlimited. Realistic saturation behavior is ignored in favor of showing the peak reactivity for the various materials regardless of concentration. The tank design was modeled with void in all spaces where tank material is not present including the gap between the tank wall and neutron absorber and between the absorber and the concrete reflector.

The tank designs were also modeled with water in all these locations to determine whether void or water is more reactive.

PPC-B is a neutron shielding material manufactured by Liberty Pultrusions (References 5 and 6) and primarily used by the Nuclear Navy.

The following properties of PPC-B are assumed in the calculation of the number densities.

The boron weight percent is 5%.

The hydrogen weight percent is at least 12% based on manufacturer input.

The remaining material is carbon which has a weight percent of 83%.

The minimum density of PPC-B is 0.955 g/cc. (Reference 4)

Only 75% of the calculated number density for both 10B and 11B are conservatively assumed.

Based on the abovementioned supporting calculations, a criticality accident could potentially occur if the [ Proprietary Information ] [ Security-Related Information ] neutron absorber plates are missing or damaged. From the discussion in Section 4.6, it is seen that physical damage of equipment in the TSPS equipment and systems could potentially result in a change to the configuration and / or dimensions of equipment, potentially leading to a more reactive configuration than would otherwise exist under normal conditions. However, Section 4.6 also determines there are no identified events related to an increase in dimensions of the TSPS annular tanks. Furthermore, any conceivable change to the configuration of equipment (i.e. the spacing between equipment), is considered to be offset by the effects of geometry deformation (e.g. crushing) or with respect to the annular tanks, a berm surrounds the tanks to provide safe spacing and prevent interaction of the fissile solution inside the tank with other fissile material. Any conceivable damage to the TSPS equipment is therefore considered to not present a more onerous condition than exists normally, and thus an accidental criticality is determined to be subcritical by design. As a result, there are no identified mechanisms to cause a significant displacement of the absorber plates while maintaining the integrity of the tank simultaneously; thereby ensuring the absorber plates maintain their required geometrical relationship with the fissile solution in the tank.

In order to maintain the requirements of Reference 11, the PPC-B plates are corrosive-resistant to prevent depletion of its absorption properties. Routine verification and inspection of the poison plates ensures these requirements continue to be met for the life of SHINE. Additionally, the Nuclear Navy has a long history of use of PPC-B as a neutron shielding material for long term use. Consequently, compliance with the Double Contingency Principle is met by definition.

Private and confidential Criticality Safety Evaluation for the SHINE Target Solution Preparation System l Rev. 1 l August 2015 39

[Proprietary Information - Withheld from Public Disclosure Under 10 CFR 2.390(a)(4)]

Security-Related Information - Withheld Under 10 CFR 2.390 SHINE Medical Atkins-NS-TR-SHN-15-06 4.7.3. Summary of identified Safety Controls In respect of the above subcritical by design determination, the following passive engineered CSC is identified. Commensurate with the above determination, failure of this robust CSC is considered highly unlikely.

Passive Engineered CSC: Annular tanks are designed with a [ Proprietary Information ]

[ Security-Related Information ] neutron absorber plate consisting of corrosive-resistant PPC-B present on the outside and inside diameters of the tank. The outer gap between the tank and absorber plate is [ Proprietary Information ] [ Security-Related Information ] or less and the inner gap does not exceed [ Proprietary Information ] [ Security-Related Information ].

Administrative CSC: PPC-B plate installation is verified during construction to ensure the design, safety and operating requirements are met.

Administrative CSC: PPC-B plates are routinely verified and inspected to ensure the requirements for neutron poisoning properties is met for the life cycle of SHINE.

4.8. Oxide powder placed in unfavorable geometry containers 4.8.1. Discussion In the event of any uranium oxide powder spillage in the TSPS area, the spilled uranium oxide powder will be recovered and transferred into uranium oxide powder cans. The uranium oxide powder cans are subsequently placed onto a transfer cart or stored in the oxide storage rack. The transfer cart can accommodate a maximum of only five uranium oxide powder cans due to the design of the cart (i.e. the number of positions provided) and the design of the cans (each can volume is

[ Proprietary Information ] [ Security-Related Information ] or less).

Recovery of oxide powder using any other containers (i.e. containers other than approved oxide cans) could result in an unsafe volume of uranium oxide powder, potentially resulting in a criticality accident. Solution is not stored in any containers within the TSPS as all solution processes are inside closed piping or vessels.

4.8.2. Accident Analysis The supporting criticality safety calculations (Reference 10) evaluate that under process upset conditions, including flooding of the area (where optimal credible moderation conditions could be achieved); the maximum safe mass of uranium oxide is 3.59 kg uranium, the maximum safe volume is 7.82 liters, and the maximum safe cylinder diameter is 6.24 inches. These limits were derived assuming bounding values of other parameters as follows:

Temperature of all cases is assumed to be 20°C. Higher temperatures will result in lower reactivity due to the increase in neutron absorption due to Doppler broadening of the resonance region within 238U.

Uranium is assumed to be enriched to 21 wt% 235U.

For determination of subcritical mass and subcritical volume, a simple sphere model was used. The uranium layer is followed by 12 inches of close-fitting water reflection.

Uranium oxide was modeled as UO2. This molecule has the least number of oxygen atoms per uranium atoms which will result in the highest reactivity when compared other oxide compounds (i.e. UO3, U3O8, etc.).

Section 4.1 demonstrated that given the large, unbounded nature of the TSPS operations area, and the absence of accumulation points therein, a criticality accident due to spillage of uranium oxide powder on the floor is determined to be subcritical by design. However, a criticality accident could potentially occur due to recovery of the uranium oxide powder using unauthorized containers Private and confidential Criticality Safety Evaluation for the SHINE Target Solution Preparation System l Rev. 1 l August 2015 40

[Proprietary Information - Withheld from Public Disclosure Under 10 CFR 2.390(a)(4)]

Security-Related Information - Withheld Under 10 CFR 2.390 SHINE Medical Atkins-NS-TR-SHN-15-06 (i.e. containers other than [ Proprietary Information ] [ Security-Related Information ] cans) that were subsequently moderated, forming a favorable (i.e. optimum or near-optimum) ratio of uranium to water. Thus, a criticality accident, due to the recovery of uranium oxide powder placed into unauthorized containers, must also require the use of a large volume container, i.e. a container with a volume exceeding 7.82 liters.

Because the above described conditions necessary for a criticality accident are credible, compliance with the Double Contingency Principle must be demonstrated (Reference 9).

Two criticality safety barriers are evident upon which Double Contingency Protection compliance can be demonstrated. These criticality safety barriers relate to ensuring the safe volume of recovered uranium oxide powder, as follows:

Primary barrier against an accidental criticality: Oxide shall ONLY be contained in oxide cans unless inside process equipment.

Secondary barrier against an accidental criticality: The maximum volume of any non-installed container within the TSPS area is not permitted to exceed

[ Proprietary Information ] [ Security-Related Information ].

The primary criticality safety barrier is important in that it ensures that recovered uranium oxide powder remain significantly within the maximum safe geometry limits.

The secondary criticality safety barrier is important in that it ensures that if the primary criticality safety barrier is lost, there is an insufficient volume for accumulation of recovered uranium oxide powder to cause a criticality accident.

The potential for loss of control of either the geometry or volume parameter is considered unlikely based on the nature of operations, operational experience and on the safety margin inherent in each abovementioned safety barrier.

In addition to the above noted controls / safety barriers, an accidental criticality can only credibly occur if the uranium oxide powder becomes well moderated. In this respect, operators are trained to be aware of the presence of water in unapproved locations of the TSPS area and are required take appropriate mitigative action upon observance of any significant contacting of water with uranium oxide powder in areas where use/presence of water is not a part of the process design.

This supplementary action is designated defense-in-depth practice. It provides further fault tolerance ensuring that the risk of a criticality accident from the postulated process upset is sufficiently low.

In summary, Double Contingency Protection is established against an accidental criticality caused by recovery of uranium oxide powder using containers other than the [ Proprietary Information ]

[ Security-Related Information ] oxide cans (unfavorable geometry containers). It is seen that it is unlikely for operators to store uranium oxide powder in containers other than the oxide cans and it is unlikely for operators to introduce unauthorized containers into the TSPS area.

4.8.3. Criticality Barriers for uranium oxide powder placed in unfavorable geometry containers The following process upsets must occur before a criticality accident, due to the recovery of uranium oxide powder using containers other than [ Proprietary Information ] [ Security-Related Information ]

oxide cans, could occur:

Uranium oxide powder is recovered from a spill using a container other than a

[ Proprietary Information ] [ Security-Related Information ] oxide can and not returned to proper storage (Initiating Event and Primary barrier: Administrative Control),

The quantity of recovered uranium oxide powder present in a spill exceeds the maximum volume safe limit of 7.82 liters (Enabling Event),

Private and confidential Criticality Safety Evaluation for the SHINE Target Solution Preparation System l Rev. 1 l August 2015 41

[Proprietary Information - Withheld from Public Disclosure Under 10 CFR 2.390(a)(4)]

Security-Related Information - Withheld Under 10 CFR 2.390 SHINE Medical Atkins-NS-TR-SHN-15-06

An unauthorized container exceeding [ Proprietary Information ]

[ Security-Related Information ] volume is brought into the TSPS area (Secondary Barrier: Administrative Control),

There is a significant release of water (or other liquid moderator) into the TSPS area, where the recovered uranium oxide powder is located (Enabling Event), and

Operators fail to notice that the recovered uranium oxide powder is in contact with water or fail to take remedial action upon such observation (Defense-in-depth Practice).

4.8.4. Summary of identified Safety Controls The explicit criticality safety controls (CSCs) relied on to support the criticality safety barriers identified above (and thus relied on to preclude a criticality accident in the TSPS area as a result of exceeding the maximum safe volume for oxide) are listed below. Additional defense-in-depth practices are also listed as enhanced safety measures utilized by SHINE in order to further increase facility safety.

Passive Engineered CSC: Each uranium oxide powder can used in the TSPS shall have a volume of [ Proprietary Information ] [ Security-Related Information ] or less.

Administrative CSC: Oxide shall ONLY be contained in oxide cans unless inside process equipment.

Administrative CSC: All uranium oxide cans that contain uranium oxide powder shall be placed in approved storage locations in the storage rack or transfer cart or in the glovebox.

Administrative CSC: No unauthorized containers (e.g. exceeding 7.82 liters volume) shall be brought into the TSPS area.

Defense-in-depth Practice: In the event that water is observed to be present in any area, the source of the water should be identified and eliminated. Any uranium oxide powder cans in the immediate vicinity of the water infiltrated area should be removed to a dry area.

4.9. Uranium Metal is introduced into the TSPS 4.9.1. Discussion The majority of the TSPS equipment components provide either safe geometry or safe volume for homogeneous UO2-water mixtures at optimum concentration. The uranium oxide cans are designed to be safe for storage of uranium oxide by volume control ([ Proprietary Information ]

[ Security-Related Information ]) and are designed with a unique size and shape when compared to U metal storage cans to prevent placement of the U metal cans in the incorrect storage rack, transfer cart, or glovebox pass through. Carts are designed to accept only uranium oxide cans and reject U metal cans.

Glovebox features include a pass through design that allows only one oxide can in at a time and rejects U metal cans.

Section 4.6 demonstrates that the equipment and containers for the uranium oxide removal, transfer, dissolution and transfer to TSPS hold tank provides either safe geometry or safe volume for homogeneous UO2-water mixtures at optimum concentration or Uranyl Sulfate at optimum concentration. These safe geometry and volume limits were derived assuming homogenous mixtures with optimal moderation. Additionally, support calculations in Reference 10 also demonstrate that all components of the TSPS system, with the exception of the dissolution tanks, Private and confidential Criticality Safety Evaluation for the SHINE Target Solution Preparation System l Rev. 1 l August 2015 42

SHINE Medical Atkins-NS-TR-SHN-15-06 also provide either safe volume or safe geometry for optimal uranium metal / water mixtures with thick water reflection.

In light of the above caveat; in the event that uranium metal was introduced into the TSPS, a criticality accident could only potentially occur in the dissolution tank, on account of the increased reactivity of the solution.

4.9.2. Accident Analysis From the preceding discussion, it is seen that the presence of U metal in the TSPS dissolution tank could potentially result in a criticality accident. Because the above described conditions necessary for a criticality accident are credible, compliance with the Double Contingency Principle must be demonstrated (Reference 9).

Two criticality safety barriers are evident upon which Double Contingency Protection compliance can be demonstrated. These criticality safety barriers relate to the prevention of uranium metal entering a TSPS dissolution tank, as follows:

Primary barrier against an accidental criticality: Uranium metal shall not be stored in oxide cans. Glovebox pass through design allows only one oxide can in at a time and rejects U metal cans.

Secondary barrier against an accidental criticality: Oxide can contents are verified as uranium oxide powder prior to being sealed and transported into the TSPS area. Oxide can contents are verified as uranium oxide powder prior to being weighed and added into the TSPS tanks.

The primary criticality safety barrier is important in that it ensures the uranium metal has no means of entering a TSPS annular dissolution tank and the dissolution tanks continue to remain within the safe concentration limits and safe material form limits established in the supporting calculations in Reference 4. The TSPS room has a physical separation or barrier between the metal operations and storage area and the oxide storage and dissolution area.

The secondary criticality safety barrier is important in that it ensures that if the primary criticality safety barrier is defeated, that the dissolution tanks remain within the safe concentration limits and safe material form limits established in the supporting calculations in Reference 4, as operations verifies oxide can contents are uranium oxide powder only (e.g. uranium metal is verified not to be stored in an oxide can). Operations would observe the metal in the can prior to dumping it into the tank.

The potential for loss of control of the concentration limits and safe material form limits is considered unlikely based on the nature of operations, operational experience and on the safety margin inherent in each abovementioned safety barrier.

In summary, Double Contingency Protection is established against an accidental criticality caused by the loading of metal into an oxide can that is subsequently unloaded in a glovebox and then dumped into an annular dissolution tank. It is seen that it is unlikely for operators to store metal in oxide cans and it is unlikely for operators to introduce misloaded containers into the TSPS glovebox and dump the contents into the dissolution tanks.

4.9.3. Criticality Barriers for the Introduction of Metal to the TSPS Dissolution Tanks The following process upsets must occur before a criticality accident, due to the presence of uranium metal in the TSPS dissolution tanks, could occur:

Private and confidential Criticality Safety Evaluation for the SHINE Target Solution Preparation System l Rev. 1 l August 2015 43

SHINE Medical Atkins-NS-TR-SHN-15-06

Uranium metal must be stored in oxide cans as the glovebox pass through design allows only one oxide can in at a time and rejects U metal cans. (Primary Barrier:

Administrative Control).

Oxide can contents are not verified as uranium oxide powder prior to being sealed and transported into the TSPS area and operators fail to follow procedures in regards to weighing and dumping uranium oxide powder into the TSPS Dissolution Tanks (Secondary Barrier: Administrative Control).

4.9.4. Summary of identified Safety Controls The explicit criticality safety controls (CSCs) relied on to support the criticality safety barriers identified above (and thus relied on to preclude a criticality accident in the TSPS dissolution tank as a result of exceeding the maximum safe concentration for homogeneous uranium sulfate), are listed below.

Passive Engineered CSC: Uranium oxide cans are designed with a unique size and shape when compared to U metal storage cans to prevent placement of the U metal cans in the incorrect storage rack, transfer cart or glovebox.

Passive Engineered CSC: Glovebox pass through design allows only one oxide can in at a time and rejects U metal cans.

Administrative CSC: Uranium metal shall not be stored in oxide cans.

Administrative CSC: Oxide can contents are verified as uranium oxide powder prior to being sealed and transported into the TSPS area.

Administrative CSC: Oxide can contents are verified as uranium oxide powder prior to being weighed and added into the TSPS tanks.

Private and confidential Criticality Safety Evaluation for the SHINE Target Solution Preparation System l Rev. 1 l August 2015 44

SHINE Medical Atkins-NS-TR-SHN-15-06

5. NUCLEAR CRITICALITY PARAMETER DISCUSSION Table 5-1 discusses the extent of control of each of the various criticality safety parameters introduced in Section 3.1.

Table 5-1: Nuclear Criticality Safety Parameters Applicable Nuclear Controlled Basis Scenario ID Parameter (Y/N)

Mass Y Mass control is used to limit the amount of uranium oxide Sections 4.6.

powder that can be spilled due to the design of the oxide cans. Additionally, credit is taken for the transport cart and storage rack designs such that they are not capable of holding greater than a safe mass of oxide cans.

Enrichment N The criticality safety analysis of the TSPS area credits None.

upstream enrichment control.

Refer to the Due to the provision of the above safety controls, no SHINE Receiving enrichment controls are necessary, or implemented, in the NCSE (Ref. 7) for TSPS area. applicable event scenario.

Volume Y The TSPS dissolution tanks and TSPS equipment are Section 4.8.

credited as possessing individual internal physical capacities not exceeding safe volume limits as demonstrated in supporting calculations. Volume is therefore a controlled criticality safety parameter.

Geometry Y Geometry of equipment in the TSPS area is credited in the Sections 4.1, 4.2, criticality safety analysis. In addition, administrative controls 4.3, and 4.4.

are established to limit the stacking and placement of oxide cans and to ensure the use of only approved storage methods for oxide cans.

Concentration N The TSPS equipment is sized assuming optimal N/A concentration of UO2 in water or Uranyl Sulfate.

Concentration is therefore not a criticality controlled parameter.

Density N The supporting criticality safety calculations for the TSPS N/A equipment and containers assume optimal density of UO2 in water or uranium metal in water. Density is therefore not a criticality controlled parameter.

Moderation N The supporting criticality safety calculations for the TSPS N/A equipment and area assume optimal credible interstitial moderation conditions for uranium metal and uranium oxide.

Internal moderation of uranium oxide powder (i.e. intrinsic uranium oxide powder moisture content) is not controlled because the supporting criticality safety calculations assume optimal credible moisture contents for uranium oxide powder. Additionally, the criticality safety analysis of the TSPS area credits upstream uranium oxide moisture control.

Private and confidential Criticality Safety Evaluation for the SHINE Target Solution Preparation System l Rev. 1 l August 2015 45

SHINE Medical Atkins-NS-TR-SHN-15-06 Applicable Nuclear Controlled Basis Scenario ID Parameter (Y/N)

Due to the provision of the above safety controls, no moderation controls are necessary, or implemented, in the TSPS area.

Interaction Y Volume control is used to limit the amount of uranium oxide Section 4.5.

powder that can be stored per oxide can. Credit is taken for the transport cart design, storage rack design, and annular tank design such that they prevent the interaction of fissile material in various containers / equipment. Administrative controls are also established to limit the amount of uranium oxide powder accumulated in the glovebox.

Reflection N The supporting criticality safety calculations for the TSPS N/A area assume bounding full (i.e. 30 cm) water reflection conditions. Reflection is therefore not a criticality controlled parameter.

Neutron Y Neutron absorbing materials are credited in the criticality Section 4.7.

Absorber safety calculations for the TSPS annular dissolution tanks.

Neutron Absorber is therefore a criticality controlled parameter.

Material Form Y Material form is credited to prevent the introduction of metal Section 4.9.

uranium in the TSPS area. Administrative controls are also established to prevent the introduction of uranium metal into the TSPS gloveboxes.

Heterogeneity N Heterogeneous effects of the solution (e.g. precipitation, N/A nucleation, etc.) are not considered in this NCSE. The evaluation of the process for which these tanks are used will determine if heterogeneous solution effects are present and the analysis will be updated accordingly during final design.

6. Criticality Safety Controls This section lists the criticality safety controls identified in the accident event sequence discussions in Sections 4.1 through 4.9. The design features / controls are categorized as passive engineered, active engineered or administrative controls. Additional general requirements may be listed that are Defense-in-depth Practices or strengthen the Double Contingency Protection.

Private and confidential Criticality Safety Evaluation for the SHINE Target Solution Preparation System l Rev. 1 l August 2015 46

[Proprietary Information - Withheld from Public Disclosure Under 10 CFR 2.390(a)(4)]

Security-Related Information - Withheld Under 10 CFR 2.390 SHINE Medical Atkins-NS-TR-SHN-15-06 6.1. Passive Engineered Features The following passive engineered design features have been recognized as important to ensuring the criticality safety of the TSPS area.

1. Passive Engineered CSC: Each uranium oxide powder can used in the TSPS shall have a volume of [ Proprietary Information ] [ Security-Related Information ] or less.

Basis: This CSC ensures that the oxide cans used in the TSPS area provide favorable geometry for uranium oxide powder (Reference 10). Without this CSC, oxide powder could, potentially, achieve a critical configuration in the TSPS system.

2. Passive Engineered CSC: Uranium oxide powder cans are of a robust design to prevent loss of uranium oxide powder when dropped from a height equivalent to the top of the storage racks.

Basis: This CSC ensures that it is unlikely a sealed oxide can spills uranium oxide powder onto the operations floor. Without this CSC, it may be possible to accumulate relatively small volumes of uranium oxide powder into an unfavorable geometry.

3. Passive Engineered CSC: Uranium oxide cans are designed with a unique size and shape when compared to U metal storage cans to prevent placement of the U metal cans in the incorrect storage rack, transfer cart or glovebox pass through.

Basis: This CSC ensures that it is unlikely for metal cans to be introduced to the target solution preparation area of the TSPS room and stored improperly.

4. Passive Engineered CSC: Transfer carts are designed to prevent loss of cans during a seismic activity.

Basis: This CSC ensures that it is unlikely a sealed oxide can spills uranium oxide powder onto the operations floor. Without this CSC, it may be possible to accumulate relatively small volumes of uranium oxide powder into an unfavorable geometry.

5. Passive Engineered CSC: Transfer carts are designed with storage locations each containing a latching mechanism to prevent cans from falling out of locations during transport.

Basis: This CSC ensures that it is unlikely a sealed oxide can spills uranium oxide powder onto the operations floor. Without this CSC, it may be possible to accumulate relatively small volumes of uranium oxide powder into an unfavorable geometry.

6. Passive Engineered CSC: Transfer carts are designed to limit the number of cans on the cart to the safe number of [ Security-Related Information ] based on the spacing design.

Basis: This CSC ensures that it is unlikely for uranium oxide powder to be accumulated / collected into an unfavorable geometry.

Private and confidential Criticality Safety Evaluation for the SHINE Target Solution Preparation System l Rev. 1 l August 2015 47

SHINE Medical Atkins-NS-TR-SHN-15-06

7. Passive Engineered CSC: Transfer carts are designed with bumpers on the side of the cart to limit the effect of impact on room equipment and also provide critically safe spacing to prevent fissile material from interacting with other equipment containing fissile material.

Basis: This CSC ensures that it is unlikely for uranium oxide powder located on a transfer cart to interact with other fissile material in the TSPS area.

8. Passive Engineered CSC: Each weight tray used in the TSPS glovebox shall have a safe geometry height for accumulation prevention.

Basis: This CSC ensures that the weight trays used in the TSPS gloveboxes provide favorable geometry for uranium oxide powder (Reference 10). Without this CSC, uranium oxide powder could, potentially, achieve a critical configuration in the TSPS system.

9. Passive Engineered CSC: Glovebox pass through design allows only one can in at a time and rejects U metal cans.

Basis: This CSC ensures that it is unlikely to accumulate uranium oxide powder in the TSPS glovebox. Without this CSC, oxide powder could, potentially, achieve a critical configuration in the TSPS system. This also prevents the ability to introduce metal into the dissolution tanks.

10. Passive Engineered CSC: Geometry of glovebox work platform prevents accumulation of uranium oxide powder.

Basis: This CSC ensures that it is unlikely to accumulate uranium oxide powder in the TSPS glovebox as the work platform is grated. Without this CSC, oxide powder could, potentially, achieve a critical configuration in the TSPS system.

11. Passive Engineered CSC: Sloped glovebox floor to ensure uranium oxide powder falls into the dissolution tank and does not accumulate in the glovebox.

Basis: This CSC ensures that it is unlikely to accumulate uranium oxide powder in the TSPS glovebox. Without this CSC, oxide powder could, potentially, achieve a critical configuration in the TSPS system.

12. Passive Engineered CSC: The physical design of the gloveboxes minimizes the use of moderators.

Basis: This CSC ensures that the validity of the following assumptions relied on for safety in this NCSE: the optimal geometry and moderation conditions assumed for uranium oxide / uranium metal in the supporting criticality safety calculations.

13. Passive Engineered CSC: The gloveboxes are connected to the TSPS annular tanks via a sealed transfer tube / chute that prevents spills to room floor or into any dissolution tank voids.

Basis: This CSC ensures that it is unlikely to accumulate uranium oxide powder in any unanalyzed space. Without this CSC, oxide powder could, potentially, achieve a critical configuration in the TSPS system.

Private and confidential Criticality Safety Evaluation for the SHINE Target Solution Preparation System l Rev. 1 l August 2015 48

[Proprietary Information - Withheld from Public Disclosure Under 10 CFR 2.390(a)(4)]

Security-Related Information - Withheld Under 10 CFR 2.390 SHINE Medical Atkins-NS-TR-SHN-15-06

14. Passive Engineered CSC: Annular tanks are designed to prevent a loss of solution during seismic activity.

Basis: This CSC ensures that it is unlikely an annular tank spills uranyl sulfate /

solution onto the operations floor. Without this CSC, it may be possible to accumulate solution into an unfavorable geometry.

15. Passive Engineered CSC: Annular tanks are surrounded by a berm to provide safe spacing, direct solution to the critically safe sump catch tank, and prevent interaction of the fissile solution inside the tank with other fissile material.

Basis: This CSC ensures that it is unlikely for solution inside the annular tanks to interact with other fissile material in the TSPS area or for solution to accumulate in an unsafe geometry.

16. Passive Engineered CSC: Annular tanks for uranyl sulfate dissolution are designed to be a safe geometry maximum of [ Proprietary Information ]

[ Security-Related Information ] tall and critically safe volume of

[ Proprietary Information ] [ Security-Related Information ]. Wall thickness is less than [ Proprietary Information ] [ Security-Related Information ] and outer diameter is at least [ Proprietary Information ] [ Security-Related Information ], with a maximum liquid thickness of [ Proprietary Information ]

[ Security-Related Information ].

Basis: This CSC ensures the safe geometry of uranyl sulfate solution per Reference

4. Without this CSC, uranyl sulfate solution could potentially achieve a critical configuration in the respective equipment.

17. Passive Engineered CSC: Annular tanks are designed with a

[ Proprietary Information ] [ Security-Related Information ] neutron absorber plate consisting of corrosive-resistant PPC-B present on the outside and inside diameters of the tank. The outer gap between the tank and absorber plate is

[ Proprietary Information ] [ Security-Related Information ] or less and the inner gap does not exceed [ Proprietary Information ] [ Security-Related Information ].

Basis: This CSC ensures the safe neutron poisoning of uranyl sulfate solution with the use of boron with a minimum content of 5%, a minimum hydrogen content of 12%,

and minimum density of 0.995 g/cc for the PPC-B (Reference 4). Without this CSC, uranyl sulfate solution could potentially achieve a critical configuration in the respective equipment. Additionally, this CSC ensures that it is unlikely for the neutron poison surrounding the annular tanks to degrade integrity.

18. Passive Engineered CSC: The sump maintains critically safe geometry for leakage and directs liquid to the critically safe sump catch tank.

Basis: This CSC ensures the safe geometry of any uranyl sulfate solution spills.

Without this CSC, uranyl sulfate solution could potentially achieve a critical configuration in the respective equipment (Reference 10).

19. Passive Engineered CSC: Heaters, recirculation piping, tank vent system, discharge piping, and valves are all designed critically safe geometry.

Basis: This CSC ensures the safe geometry of any uranyl sulfate solution and / or oxide. Without this CSC, uranyl sulfate solution and / or oxide could potentially achieve a critical configuration in the respective equipment (Reference 10).

Private and confidential Criticality Safety Evaluation for the SHINE Target Solution Preparation System l Rev. 1 l August 2015 49

[Proprietary Information - Withheld from Public Disclosure Under 10 CFR 2.390(a)(4)]

Security-Related Information - Withheld Under 10 CFR 2.390 SHINE Medical Atkins-NS-TR-SHN-15-06

20. Passive Engineered CSC: Filters and uranyl sulfate pumps are designed with a critically safe volume.

Basis: This CSC ensures the safe volume of any uranyl sulfate solution within the TSPS system. Without this CSC, uranyl sulfate solution could potentially achieve a critical configuration in the respective equipment (Reference 10).

21. Passive Engineered CSC: The TSPS equipment and piping are located in an open floor area that is free of accumulation points (i.e. holes, channels, cutouts, pits, etc.) exceeding [ Proprietary Information ] [ Security-Related Information ] in volume.

Basis: This CSC ensures the safe geometry of any uranyl sulfate solution and / or oxide. Without this CSC, uranyl sulfate solution and / or oxide could potentially achieve a critical configuration in the respective equipment (Reference 10).

6.2. Active Engineered features None Applicable; no active engineered controls are necessary to ensure the criticality safety of the TSPS area.

6.3. Administrative Controls The following administrative controls are recognized as important to ensuring the criticality safety of the TSPS area.

1. Administrative CSC: Loaded glovebox weight tray is emptied prior to introduction of a new can of uranium oxide powder.

Basis: This CSC ensures that it is unlikely for the weight trays used in the TSPS gloveboxes to exceed the safe geometry limit. Without this CSC, oxide powder could, potentially, achieve a critical configuration in the TSPS system.

2. Administrative CSC: Operations prevent the use of moderators inside the glovebox.

Basis: This CSC ensures that it is unlikely for moderation to mix with the oxide powder inside a glovebox.

3. Administrative CSC: All uranium oxide cans that contain uranium oxide powder shall be placed in approved storage locations in the storage rack or transfer cart or in the glovebox.

Basis: This CSC ensures that it is unlikely for uranium oxide powder to be stored in an unfavorable geometry.

4. Administrative CSC: Oxide shall ONLY be contained in oxide cans unless inside process equipment.

Basis: This CSC ensures that it is unlikely for oxide powder to be accumulated /

collected into an unfavorable geometry. Compliance with this CSC is important to protect against an accidental criticality due to accumulation of too much uranium oxide powder in an unauthorized, unsafe geometry container.

Private and confidential Criticality Safety Evaluation for the SHINE Target Solution Preparation System l Rev. 1 l August 2015 50

SHINE Medical Atkins-NS-TR-SHN-15-06

5. Administrative CSC: No unauthorized containers (e.g. exceeding 7.82 liters volume) shall be brought into the TSPS area.

Basis: This CSC ensures the safe volume of any uranium oxide. Without this CSC, oxide could potentially achieve a critical configuration due to accumulation of too much uranium oxide powder in an unauthorized, unsafe geometry container.

6. Administrative CSC: Uranium metal shall not be stored in oxide cans.

Basis: This CSC ensures that it is unlikely for uranium metal to enter the TSPS area. Compliance with this CSC is important to protect against an accidental criticality due to the introduction of uranium metal in the TSPS annular tanks.

7. Administrative CSC: Oxide can contents are verified as uranium oxide powder prior to being sealed and transported into the TSPS area.

Basis: This CSC ensures that it is unlikely for uranium metal to enter the TSPS area.

Compliance with this CSC is important to protect against an accidental criticality due to the introduction of uranium metal in the TSPS annular tanks.

8. Administrative CSC: Oxide can contents are verified as uranium oxide powder prior to being weighed and added into the TSPS tanks.

Basis: This CSC ensures that it is unlikely for uranium metal to enter the TSPS dissolution tanks. Compliance with this CSC is important to protect against an accidental criticality due to the introduction of uranium metal in the TSPS annular tanks.

9. Administrative CSC: PPC-B plate installation is verified during construction to ensure the design, safety and operating requirements are met.

Basis: This CSC ensures that it is unlikely for the neutron poison surrounding the annular tanks to not be present to perform its intended function. Compliance with this CSC is important to protect against an accidental criticality due to the loss of poison control for the TSPS annular tanks.

10. Administrative CSC: PPC-B plates are routinely verified and inspected to ensure the requirements for neutron poisoning properties is met for the life cycle of SHINE.

Basis: This CSC ensures that it is unlikely for the neutron poison surrounding the annular tanks to degrade integrity. Compliance with this CSC is important to protect against an accidental criticality due to the loss of poison control for the TSPS annular tanks.

Private and confidential Criticality Safety Evaluation for the SHINE Target Solution Preparation System l Rev. 1 l August 2015 51

Security-Related Information - Withheld Under 10 CFR 2.390 SHINE Medical Atkins-NS-TR-SHN-15-06

7. General requirements This section lists those criticality safety practices that do not directly provide Double Contingency Protection but support those controls that do and may provide additional protection to prevent an accidental criticality.

1. Defense-in-depth Practices: In the event that water is observed to be present in any area, the source of the water should be identified and eliminated. Any uranium oxide powder cans in the immediate vicinity of the water infiltrated area should be removed to a dry area.

Basis: In order for a criticality to be possible with credible amounts of uranium, water must be present. Observation by the operators in the area will ensure that the presence of any abnormal water will be removed or the uranium oxide powder will be removed to a dry area.

2. Defense-in-depth Practices: In the event of discovery of spillage or leakage of TSPS material, the cause of the process spillage should be identified and terminated as soon as is reasonably achievable. The spilled process material should be recovered into analyzed safe geometry containers / sump.

Basis: Observation by the operators in the area will ensure that TSPS material spilling from equipment is collected or directed to the drain system and the source is identified. This ensures that recovery of material or accumulation of material in a non-favorable geometry is prevented.

8. Bounding Assumptions

1. The supporting criticality safety calculations for the design system / tank assume optimally moderated homogeneous mixtures.

2. The supporting criticality safety calculations consider bounding credible reflection conditions for the annular tanks including infinite thickness concrete 6 inches from the tank perimeter.

3. The physical width and depth of the storage racks are designed such that uranium oxide cans stored in the racks are safe by geometry. Each storage cell location holds one uranium oxide storage can.

4. Transfer Carts are designed to limit the number of cans on the cart to the safe number of

[ Security-Related Information ] based on the spacing design.

5. Annular tanks are surrounded by a berm to provide safe spacing, direct solution to the critically safe sump catch tank, and prevent interaction of the fissile solution inside the tank with other fissile material.

6. Transfer carts are designed with bumpers on the side of the cart to limit the effect of impact on room equipment and also provide critically safe spacing to prevent fissile material from interacting with other equipment containing fissile material.

7. The uranium enrichment consist of LEU metal enriched to 19.75 +/- 0.2 weight percent U-235, with a maximum of 19.95 weight percent but assumed at 21% for this evaluation. The mass balance does not account for burnup of uranium during operation. The enrichment is verified prior to acceptance by SHINE.

Private and confidential Criticality Safety Evaluation for the SHINE Target Solution Preparation System l Rev. 1 l August 2015 52

SHINE Medical Atkins-NS-TR-SHN-15-06

8. Uranium is tracked by mass, not radioactivity.

9. Fresh and recycled uranium oxide will be converted to uranyl sulfate in the same vessel.

10. The reaction from uranium oxide to uranyl sulfate has a negligible heat of reaction.

11. A bounding maximum 1.5 wt% moisture content is assumed for normal conditions for processing oxide powder.

12. The TSPS building has a physical separation or barrier between the metal operations & storage room and the oxide storage & dissolution room of the TSPS building.

13. The berms that surround the dissolver tanks in order to contain any potential spills or leaks in a critically safe geometry are below the critically safe slab height for uranium sulfate solution at 21% enrichment (weight percent U-235).

14. Heterogeneous effects of the solution (e.g. precipitation, nucleation, etc.) are not considered in this NCSE. The evaluation of the process for which these tanks are used will determine if heterogeneous solution effects are present and the analysis will be updated accordingly during final design.

9. Conclusion Criticality safety of the UO3 to target solution dissolution portion of the TSPS area is based on the provision and maintenance of passive engineered design features and adherence to administrative controls. In addition to the identification of passive engineered design features and administrative controls, several defense-in-depth practices have been identified to further reduce the likelihood of criticality events to be sufficiently low. The preceding evaluation has demonstrated that the Double Contingency Principle is satisfied for these operations with the controls and designs implemented.

These operations will remain subcritical for credible normal and abnormal events with adherence to the controls identified by the analysis.

10. References

1. SHINE Medical Technologies, Inc. Preliminary Safety Analysis Report, April 10, 2015.

2. Standard Review Plan for Licenses Applications for Fuel Cycle Facilities, NUREG-1520, Rev. 2, May 2014.

3. McDaniel, David, Criticality Process Hazards Analysis for the SHINE Target Solution Preparation System, Atkins-NS-TR-SHN-15-03, Rev. 0, May 2015.

4. Newmyer, William D., Criticality Safety Calculations for the Preliminary Design of Annular Tanks for the SHINE Medical Isotope Facility, Atkins-NS-DAC-SHN-15-02, Rev. 0, July 15, 2015.

5. Liberty Pultrusions, Liberty Pultrusions, 1575 Lebanon School Road, West Mifflin, PA 15122-3464 (http://www.libertypultrusions.com/).

6. http://www.libertypultrusions.com/images/Neutron_Shielding_Properties2.pdf.

Private and confidential Criticality Safety Evaluation for the SHINE Target Solution Preparation System l Rev. 1 l August 2015 53

SHINE Medical Atkins-NS-TR-SHN-15-06

7. SHINE Receipt NCSE (TBD).

8. Revolinski, Scott, MCNP 6.1 Validation with Continuous Energy ENDF.B-VII.1 Cross Sections for SHINE Medical Technologies, Atkins-NS-DAC-SHN-15-03, Rev. 2, July 15, 2015.

9. Nuclear Criticality Safety in Operations with Fissionable Material Outside Reactors, ANSI/ANS-8.1-2014.

10. Newmyer, William D., Single Parameter Subcritical Limits for 21 wt% 235U, Uranyl Sulfate, Uranium Oxide, and Uranium Metal, Atkins-NS-DAC-SHN-15-04, Rev. 0, July 15, 2015.

11. Use of Fixed Neutron Absorbers in Nuclear Facilities Outside Reactors, ANSI/ANS-8.21-1995; R-2001, R-2011.

Private and confidential Criticality Safety Evaluation for the SHINE Target Solution Preparation System l Rev. 1 l August 2015 54

ML15236A142

Text

SUMMARY

SUMMARY

Navigation menu

Search