Text

Enclosure 5 - Final Safety Analysis Report, Chapter 7, Instrumentation and Control Systems
	ML20255A036
Person / Time
Site:	SHINE Medical Technologies
Issue date:	08/28/2020
From:	; SHINE Medical Technologies
To:	; Office of Nuclear Reactor Regulation
Shared Package
ML20255A026	List: ML20255A027; ML20255A028; ML20255A029; ML20255A030; ML20255A031; ML20255A032; ML20255A033; ML20255A034; ML20255A035; ML20255A036; ML20255A037; ML20255A038; ML20255A039; ML20255A040; ML20255A041; ML20255A042; ML20255A043; ML20255A044; ML20255A045; ML20255A046; ML20255A047; ML20255A048;
References
	2020-SMT-0081
	Download: ML20255A036 (268)
	v • d • e

INSTRUMENTATION AND CONTROL SYSTEMS TABLE OF CONTENTS tion Title Page

SUMMARY

DESCRIPTION ................................................................................. 7.1-1 7.1.1 PROCESS INTEGRATED CONTROL SYSTEM ............................... 7.1-1 7.1.2 TARGET SOLUTION VESSEL REACTIVITY PROTECTION SYSTEM ............................................................................................. 7.1-2 7.1.3 ENGINEERED SAFETY FEATURES ACTUATION SYSTEM ........... 7.1-3 7.1.4 HIGHLY INTEGRATED PROTECTION SYSTEM DESIGN ............... 7.1-3 7.1.5 CONTROL CONSOLE AND DISPLAYS ............................................ 7.1-4 7.1.6 RADIATION MONITORING................................................................. 7.1-5 7.1.7 NEUTRON FLUX DETECTION SYSTEM .......................................... 7.1-5 DESIGN OF INSTRUMENTATION AND CONTROL SYSTEMS ......................... 7.2-1 7.2.1 SYSTEM DESCRIPTION .................................................................... 7.2-1 7.2.2 DESIGN CRITERIA ............................................................................ 7.2-1 7.2.3 DESIGN BASES ................................................................................. 7.2-2 7.2.4 OPERATION AND PERFORMANCE ................................................. 7.2-2 PROCESS INTEGRATED CONTROL SYSTEM ................................................. 7.3-1 7.3.1 SYSTEM DESCRIPTION .................................................................... 7.3-1 7.3.2 DESIGN CRITERIA .......................................................................... 7.3-32 7.3.3 DESIGN BASIS ................................................................................ 7.3-34 7.3.4 OPERATION AND PERFORMANCE ............................................... 7.3-37 7.

3.5 CONCLUSION

.................................................................................. 7.3-37 NE Medical Technologies 7-i Rev. 1

INSTRUMENTATION AND CONTROL SYSTEMS TABLE OF CONTENTS tion Title Page TARGET SOLUTION VESSEL REACTIVITY PROTECTION SYSTEM .............. 7.4-1 7.4.1 SYSTEM DESCRIPTION ................................................................... 7.4-1 7.4.2 DESIGN CRITERIA ............................................................................ 7.4-2 7.4.3 DESIGN BASIS ................................................................................ 7.4-16 7.4.4 OPERATION AND PERFORMANCE ............................................... 7.4-27 7.4.5 HIGHLY INTEGRATED PROTECTION SYSTEM DESIGN.............. 7.4-35 7.

4.6 CONCLUSION

................................................................................... 7.4.54 ENGINEERED SAFETY FEATURES ACTUATION SYSTEM ............................. 7.5-1 7.5.1 SYSTEM DESCRIPTION ................................................................... 7.5-1 7.5.2 DESIGN CRITERIA ............................................................................ 7.5-2 7.5.3 DESIGN BASIS ................................................................................ 7.5-16 7.5.4 OPERATION AND PERFORMANCE ............................................... 7.5-34 7.5.5 HIGHLY INTEGRATED PROTECTION SYSTEM (HIPS) DESIGN .. 7.4-40 7.

5.6 CONCLUSION

................................................................................... 7.4.41 CONTROL CONSOLE AND DISPLAY INSTRUMENTS ..................................... 7.6-1 7.

6.1 DESCRIPTION

................................................................................... 7.6-1 7.6.2 DESIGN CRITERIA ............................................................................ 7.6-4 7.6.3 DESIGN BASIS .................................................................................. 7.6-8 7.6.4 OPERATION AND PERFORMANCE ............................................... 7.6-10 7.

6.5 CONCLUSION

.................................................................................. 7.6-13 NE Medical Technologies 7-ii Rev. 1

INSTRUMENTATION AND CONTROL SYSTEMS TABLE OF CONTENTS tion Title Page RADIATION MONITORING SYSTEMS ............................................................... 7.7-1 7.7.1 SAFETY-RELATED PROCESS RADIATION MONITORING ............ 7.7-1 7.7.2 NONSAFETY-RELATED PROCESS RADIATION MONITORING .... 7.7-6 7.7.3 AREA RADIATION MONITORING ..................................................... 7.7-7 7.7.4 CONTINUOUS AIR MONITORING .................................................... 7.7-8 7.7.5 EFFLUENT MONITORING ............................................................... 7.7-10 7.

7.6 CONCLUSION

.................................................................................. 7.7-13 NEUTRON FLUX DETECTION SYSTEM ............................................................ 7.8-1 7.8.1 SYSTEM DESCRIPTION ................................................................... 7.8-1 7.8.2 DESIGN CRITERIA ............................................................................ 7.8-1 7.8.3 DESIGN BASES ................................................................................. 7.8-9 7.8.4 OPERATION AND PERFORMANCE ............................................... 7.8-13 7.

8.5 CONCLUSION

................................................................................... 7.8-14 REFERENCES ..................................................................................................... 7.9-1 NE Medical Technologies 7-iii Rev. 1

1 Design Radiation Environments 2 Facility Control Room Design Environmental Parameters 3 RPF and IF General Area Design Environmental Parameters 4 IU Cell Interior Design Environmental Parameters 5 TOGS Cell Interior Design Environmental Parameters 6 Primary Cooling Room Interior Design Environmental Parameters 1 TRPS Monitored Variables 1 ESFAS Monitored Variables 2 Fail Safe Component Positions on ESFAS Loss of Power 1 Safety-Related Process Radiation Monitors 2 Radiation Area Monitor Locations 3 Continuous Airborne Monitor Locations NE Medical Technologies 7-iv Rev. 0

1 Instrumentation and Control System Architecture 2 Target Solution Vessel Reactivity Protection System Architecture 3 Engineered Safety Feature Actuation System Architecture 1 Process Integrated Control System Architecture 1 TRPS Logic Diagrams 2 HIPS Platform Timing 3 TRPS and ESFAS Programmable Logic Lifecycle Process 1 ESFAS Logic Diagrams 1 Facility Control Room Layout 2 Main Control Board Sections 3 Maintenance Workstation 1 Effluent Monitor Locations NE Medical Technologies 7-v Rev. 2

onym/Abbreviation Definition ARA as low as reasonably achievable S American Nuclear Society SI American National Standards Institute V air operated valve L actuation and priority logic AI application specific action item 3 boron trifluoride ST built-in self-test AS criticality accident alarm system MS continuous air monitoring system cubic centimeter F common cause failure A critical digital asset BEM carbon delay bed effluent monitor curie communication modules NE Medical Technologies 7-vi Rev. 2

onym/Abbreviation Definition TS commercial off-the-shelf s counts per second C cyclic redundancy checks B calibration and test bus direct current M equipment interface module I electromagnetic interference FAS engineered safety features actuation system T factory acceptance test HS facility chilled water system R facility control room RS facility chemical reagent system CS facility data and communications system WS facility demineralized water system WS facility heating water system HS facility nitrogen handling system NE Medical Technologies 7-vii Rev. 2

onym/Abbreviation Definition GA field programmable gate array Z4 facility ventilation zone 4 PS highly integrated protection system S hardware requirements specification I human system interfaces AC heating, ventilation, and air conditioning PS high voltage power supply W-SM hardwired submodule WM hardwired module C instrumentation and control E integrated development environment N isolated development network EE Institute of Electrical and Electronic Engineers irradiation facility G interim staff guidance M input submodule NE Medical Technologies 7-viii Rev. 2

onym/Abbreviation Definition S impurity treatment subsystem irradiation unit P iodine and xenon purification PS light water pol system i microcurie subcritical multiplication factor molybdenum extraction and purification EPS system monitoring and indication communication

-CM module B monitoring and indication bus molybdenum isotope product packaging PS system WS maintenance workstation PS nitrogen purge system AS neutron driver assembly system DS neutron flux detection system National Institute of Standards and ST Technology NE Medical Technologies 7-ix Rev. 2

onym/Abbreviation Definition SS normal electrical power supply system M nonvolatile memory OS out of service LS primary closed loop cooling system CS process integrated control system DS programmable logic design specification programmable logic requirements RS specification DA partial trip determination actuation VS process vessel vent system quality assurance PD quality assurance program description MS radiation area monitoring system A radiologically controlled area S radioactive drain system I radio-frequency interference WI radioactive liquid waste immobilization NE Medical Technologies 7-x Rev. 2

onym/Abbreviation Definition WS radioactive liquid waste storage CS radioisotope process facility cooling system F radioisotope production facility Z1 radiological ventilation zone 1 radiological ventilation zone 1 exhaust Z1e subsystem radiological ventilation zone 1 recirculating Z1r subsystem Z2 radiological ventilation zone 2 radiological ventilation zone 2 exhaust Z2e subsystem radiological ventilation zone 2 recirculating Z2r subsystem radiological ventilation zone 2 supply Z2s subsystem Z3 radiological ventilation zone 3 receiver SS subcritical assembly support structure M scheduling and bypass modules NE Medical Technologies 7-xi Rev. 2

onym/Abbreviation Definition VM scheduling, bypass, and voting modules AS subcritical assembly system B1 safety data bus 1 B2 safety data bus 2 B3 safety data bus 3 E secure development environment M safety function module S standby generator system V solenoid operated valve M stack release monitor MS stack release monitoring system M scheduling and voting module RS system requirements specification D total integrated dose GS TSV off-gas system S tritium purification system NE Medical Technologies 7-xii Rev. 2

onym/Abbreviation Definition target solution vessel reactivity protection PS system PS target solution preparation system SS target solution storage system V target solution vessel transmitter SS uninterruptible electrical power supply system SS uranium receipt and storage system V verification & validation C/ITS vacuum/impurity treatment subsystem S vacuum transfer system NE Medical Technologies 7-xiii Rev. 2

SUMMARY

DESCRIPTION instrumentation and control (I&C) systems provide the capability to monitor and control the NE facility systems manually and automatically during normal conditions and maintain the lity in a safe condition under accident conditions.

chapter describes the design of the I&C systems, including classification, functional uirements and architecture, and demonstrates the systems capabilities to perform safety and safety-related functions. The scope of the information provided in this chapter includes tems that are safety-related as defined by SHINEs Quality Assurance Program Description nonsafety-related I&C systems that perform specific regulatory required functions.

tion 7.1 provides an introduction and overview of I&C systems, which include safety-related nonsafety-related systems. Systems and topics addressed in this chapter include:

the process integrated control system (PICS) and vendor-provided nonsafety-related control systems

the target solution vessel (TSV) reactivity protection system (TRPS)

the engineered safety feature actuation system (ESFAS)

the highly integrated protection system (HIPS) underlying TRPS and ESFAS

facility control room control consoles and displays

radiation monitoring, including

- safety-related process radiation monitors considered part of the ESFAS, TRPS, and tritium purification system (TPS)

- nonsafety-related process radiation monitors included as part of other facility processes

- the radiation area monitoring system (RAMS)

- the continuous air monitoring system (CAMS)

- the stack release monitoring system (SRMS)

the neutron flux detection system (NFDS) architectural design of I&C systems is based on providing clear interconnection interfaces of lity I&C structures, systems, and components. Each irradiation unit (IU) has an independent ty-related TRPS and NFDS. A single nonsafety-related PICS provides the nonsafety tions of the IUs and facility level nonsafety-related functions. An ESFAS is provided for ty-related functions that are common to the entire facility. The RAMS, CAMS, and SRMS vide their functions at a facility level separate from the irradiation units.

mplified block diagram of the overall I&C system architecture is provided in Figure 7.1-1.

1 PROCESS INTEGRATED CONTROL SYSTEM PICS is a nonsafety-related distributed digital control system that provides monitoring and trol of the various processes throughout the SHINE facility. The PICS includes system trols, both automated and manual, and human system interfaces (HSIs) necessary to provide operator interaction with the necessary process control mechanism. The HSIs provided in the lity control room (FCR) are described in Section 7.6.

NE Medical Technologies 7.1-1 Rev. 1

trol and monitoring of the systems and components in the radioisotope production facility F).

functions of the PICS enable the operator to perform irradiation cycles, transfer target tion to and from the IU as well as throughout the RPF, and interface with the TPS, processes e supercell, waste handling operations, and the auxiliary systems.

ddition to the PICS, certain systems contain vendor-provided nonsafety-related control tems which interface with the PICS. These systems consist of the neutron driver assembly tem (NDAS) controls, supercell controls, and various auxiliary system controls.

PICS and other vendor -provided nonsafety-related control systems are further described in tion 7.3.

2 TARGET SOLUTION VESSEL REACTIVITY PROTECTION SYSTEM purpose of the TRPS is to monitor process variables and provide automatic initiating signals esponse to off-normal conditions, providing protection against unsafe IU operation during the illing, irradiation, and post-irradiation modes of operation. Each IU has its own TRPS, figured as shown in Figure 7.1-2. The major safety function of the TRPS is to monitor ables associated with the IU and trip the neutron driver and actuate the engineered safety ures when specified setpoints, based on analytical limits, are reached or exceeded.

TRPS maintains the modes of operation of the IU and creates the necessary interlocks and missives on each safety function needed for the different modes. Modes are transitioned uentially using an operator input.

TRPS also transmits status and information signals to the nonsafety-related maintenance kstation (MWS) and to the PICS for display in the FCR, trending, and historian purposes.

TRPS uses the HIPS platform as described in Section 2.0 of NuScale Topical ort TR-1015-18653, Design of Highly Integrated Protection System Platform (NuScale, 7). HIPS is a field programmable gate array (FPGA)-based system. The TRPS incorporates fundamental I&C principles of independence, redundancy, predictability and repeatability, diversity and defense-in-depth as used by the HIPS platform. SHINE relies on the prior NRC roval of the HIPS platform described in the HIPS topical report Safety Evaluation Report R) (USNRC, 2017) to demonstrate the acceptability of the platform for use in the SHINE lity and to partially demonstrate that the design of the TRPS meets SHINE Design Criteria.

TRPS includes the following safety-related (except where noted otherwise) components:

one division of input modules, signal conditioning, and trip determination

two divisions of input modules, signal conditioning, trip determination, voting and actuation equipment

two divisions of power distribution panels

power supplies for sensors and TRPS components

two nonsafety-related MWSs (shared with the ESFAS)

manual input switches NE Medical Technologies 7.1-2 Rev. 1

TRPS is further described in Section 7.4.

3 ENGINEERED SAFETY FEATURES ACTUATION SYSTEM purpose of the ESFAS is to monitor process variables and provide automatic initiating als in response to off-normal conditions, providing protection against unsafe conditions in the n production facility. The ESFAS is a plant level control system not specific to any operating or process, configured as shown in Figure 7.1-3. The two major safety functions of the FAS are to provide:

sense and command functions necessary to maintain the facility confinement strategy and

process actuation functions as required by the safety analysis.

ESFAS also transmits status and information signals to the nonsafety-related MWS and to PICS for display in the FCR, trending, and historian purposes.

ESFAS, like the TRPS, is also built using the HIPS platform as described in Section 2.0 of cale Topical Report TR-1015-18653, Design of Highly Integrated Protection System form (NuScale, 2017). The ESFAS incorporates the fundamental I&C principles of pendence, redundancy, predictability and repeatability, and diversity and defense-in-depth sed by the HIPS platform. SHINE relies on the prior NRC approval of the HIPS platform cribed in the HIPS topical report Safety Evaluation Report (SER) (USNRC, 2017) to onstrate the acceptability of the platform for use in the SHINE facility and to partially onstrate that the design of the ESFAS meets SHINE Design Criteria.

ESFAS includes the following safety-related components (except where noted otherwise):

one division of input modules, signal conditioning, and trip determination

two divisions of input modules, signal conditioning, trip determination, voting and actuation equipment

two divisions of power distribution panels

power supplies for sensors and ESFAS components

two nonsafety-related MWSs (shared with the TRPS)

manual input switches boundary of the ESFAS extends from the terminations of the cabling at the output of the sors to the terminations of the cabling to each actuation component of the ESFAS.

ESFAS is further described in Section 7.5.

4 HIGHLY INTEGRATED PROTECTION SYSTEM DESIGN HIPS platform is a generic digital safety-related I&C platform devoted to the implementation afety-related applications in nuclear facilities. The platform is a logic-based platform that does utilize software or microprocessors for operation. It is composed of logic implemented using rete components and FPGA technology. The platform is described in detail in Section 2.0 of NE Medical Technologies 7.1-3 Rev. 1

5 CONTROL CONSOLE AND DISPLAYS operator workstations and main control board are provided as the HSI subset of components he FCR. These components are included as part of the PICS and are classified as nonsafety-ted.

two operator workstations provide operators with interactive displays to perform daily vities for the SHINE facility. The displays at the operator workstation are capable of being nged to the appropriate screen applicable to the activities that the operator is performing ng day-to-day operations of the SHINE facility. Additional equipment, located between the operator workstations and usable by either operator, is dedicated to controlling the eight AS units located in the IU cells.

main control board, located in front of the two operator workstations, includes both digital lays and limited manual interfaces.

main control board provides the operator with multiple digital displays, configured to tinuously display variables important to safety-related system status for individual IUs and the nce of the SHINE facility. The displays on the main control board are used to support manual ation of safety-related systems and to verify correct operation of the safety-related systems e event of an actuation.

main control board provides operator interfaces for:

manual actuation of the TRPS and ESFAS protective functions,

the enable nonsafety function, which allows PICS control of the actuation and priority logic (APL) output state (i.e., deenergized or energized), and

the facility operating permissive key, which is used to place the main production facility into a secure state.

supervisor workstation is located at the rear of the facility control room and acts as an nsion of the operator workstations. The supervisor workstation is equipped with equipment lay screens that allow the supervisor to monitor system status, but not control facility ponents.

ility controls are designed and located using consideration of human factors engineering ciples. SHINE uses human factors engineering principles to facilitate the safe, efficient, and ble performance of operations, maintenance, tests, inspections, and surveillance tasks, and nsure the implementation of operator interfaces, indicators, and controls are standardized oss vendors.

se systems are further described in Section 7.6.

NE Medical Technologies 7.1-4 Rev. 1

iation monitoring is used to monitor radiation levels within the SHINE facility, to provide ms for personnel within the facility and the control room, to provide actuation signals to ty-related control systems, and to monitor airborne effluent streams from the facility.

ety-related process radiation monitoring is performed by ESFAS, TRPS and TPS radiation nitors. These monitors provide input into the safety-related controls to provide input for safety ations and interlocks, and provide indication and alarm signals to the FCR.

safety-related process radiation monitors are used in select facility processes to provide us information and diagnose off-normal process conditions.

a radiation monitoring and local alarms within the general areas of the facility radiologically trolled area (RCA) are provided by the RAMS. This nonsafety-related system also provides als to the FCR to inform operators of abnormal conditions within the facility.

orne contamination monitoring within general areas of the RCA is performed by the CAMS.

CAMS units are nonsafety-related devices that provide local alarms and provide signals to FCR to inform operators of the occurrence and approximate location of abnormal conditions.

mal airborne facility effluents are directed into a single facility stack and are monitored by the k release monitor. An alternate safety-related vent path for the nitrogen purge system is nitored by the carbon delay bed effluent monitor. These nonsafety-related effluent monitors vide control room indication and alarm. The main production facility does not have a normal id effluent path from the RCA, and as such no liquid effluent monitoring system is provided.

se systems are further described in Section 7.7.

7 NEUTRON FLUX DETECTION SYSTEM NFDS is used for monitoring the reactivity and power of the subcritical assembly system in IU. The NFDS is a safety-related system with redundant channels of neutron flux detectors.

NFDS detects and provides remote indication of the neutron flux levels during TSV filling irradiation to determine the multiplication factor and power levels, respectively. The NFDS vides safety-related outputs to the TRPS used for trip determination. The NFDS also provides safety-related outputs to the PICS, which are used for monitoring of conditions within the IU.

ee sets of NFDS detectors are provided for each IU, located in the light water pool ounding the subcritical assembly support structure (SASS).

ee NFDS divisions, designated as Division A, Division B, and Division C, serve each IU. The DS divisions are powered from safety-related power feeds, and the equipment associated each NFDS division maintains electrical and physical separation with the other divisions for same IU.

NFDS is further described in Section 7.8.

NE Medical Technologies 7.1-5 Rev. 1

Chapter 7 - Instrumentation and Control Systems Summary Description Figure 7.1 Instrumentation and Control System Architecture LEGEND ACRONYMNS EXTERNAL UNIDIRECTIONAL DATA CAMS - CONTINUOUS AIR MONITORING SYSTEM ESFAS - ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INTERNAL DIAGNOSTIC AND PARAMETER DATA NFDS - NEUTRON FLUX DETECTION SYSTEM INTERNAL SAFETY DATA PICS - PROCESS INTEGRATED CONTROL SYSTEM RAMS - RADIATION AREA MONITORING SYSTEM CAMS RAMS SRMS SRMS - STACK RELEASE MONITORING SYSTEM EXTERNAL DISCRETE SIGNAL OR DATA NEUTRON FLUX DETECTION SYSTEM (NFDS)

TRPS - TARGET SOLUTION VESSEL REACTIVITY PROTECTION SYSTEM INTERNAL DISCRETE SIGNAL APL - ACTUATION AND PRIORITY LOGIC NONSAFETY CONTROL SYSTEM CTB - CALIBRATION AND TEST BUS EIM - EQUIPMENT INTERFACE MODULE SAFETY CONTROL SYSTEM HWM - HARDWIRED MODULE DIV DIVAA NEUTRON NEUTRON FLUX FLUX DIV DIVAA NEUTRON FLUX DIV DIVAA NEUTRON NEUTRON FLUX HW-SM - HARDWIRED SUBMODULE DIV ADETECTOR NEUTRON DETECTOR DIV CNEUTRON NEUTRON DETECTOR DETECTOR FLUX DIV BDETECTOR NEUTRON DETECTOR FLUX HIPS PLATFORM SAFETY FUNCTION MODULE FLUX DETECTOR FLUX DETECTOR FLUX DETECTOR NSR - NONSAFETY-RELATED HIPS PLATFORM COMMUNICATION MODULE MIB - MONITORING AND INDICATION BUS X8 X8 X8 VENDOR-PROVIDED NSR HIPS PLATFORM EQUIPMENT INTERFACE MODULE MI-CM - MONITORING AND INDICATION COMMUNICATION MODULE MWS - MAINTENANCE WORKSTATION CONTROL SYSTEMS RX - RECEIVER HIPS PLATFORM HARDWIRED MODULE DIV NFDSA NFDS NFDS DIV NFDSC NFDS NFDS DIV NFDSB NFDS NFDS SBM - SCHEDULING AND BYPASS MODULE DIV DIVAAA DIV DIV DIVAAA DIV DIV DIVAAA DIV SBVM - SCHEDULING, BYPASS AND VOTING MODULE PRE-AMP PRE-AMP PRE-AMP SDB - SAFETY DATA BUS SFM - SAFETY FUNCTION MODULE X8 X8 X8 PROCESS INTEGRATED CONTROL SYSTEM (PICS)

TX - TRANSMITTER DIV NFDSA NFDS NFDS DIV NFDSC NFDS NFDS DIV NFDSB NFDS NFDS DIV DIVAAA DIV DIV DIVAAA DIV DIV DIVAAA DIV PROCESSING PROCESSING PROCESSING X8 X8 X8 SAFETY-RELATED SAFETY-RELATED INSTRUMENTATION INSTRUMENTATION X8 RX TX TX RX TX TX SAFETY-RELATED MI-CM SFM SAFETY-RELATED SAFETY-RELATED MI-CM SFM SAFETY-RELATED INSTRUMENTATION INSTRUMENTATION INSTRUMENTATION INSTRUMENTATION MIB CTB CTB SDB1 SDB2 SDB3 MIB MIB CTB CTB SDB1 SDB2 SDB3 MIB IRRADIATION ESFAS DIV C UNIT 1 TSV REACTIVITY MWS DIV C MWS MWS ENGINEERED SAFETY MWS DIV A PROTECTION SYSTEM DIV B DIV A DIV B SDB MIB SDB MIB SDB MIB FEATURES ACTUATION SDB MIB SDB MIB SDB MIB SBM1 SBM2 SBM3 (TRPS) SBM1 SBM2 SBM3 SYSTEM (ESFAS)

X8 X8 TX RX TX TX TX TX TX TX TX RX TX TX TX TX RX TX TX TX TX TX TX TX RX TX MI-CM SFM SFM MI-CM MI-CM SFM SFM MI-CM MIB CTB CTB SDB3 SDB2 SDB1 MIB MIB SDB1 SDB2 SDB3 CTB CTB MIB MIB CTB CTB SDB3 SDB2 SDB1 MIB MIB SDB1 SDB2 SDB3 CTB CTB MIB IRRADIATION IRRADIATION ESFAS DIV A ESFAS DIV B UNIT 1 UNIT 1 DIV A DIV B SDB1 SDB2 SDB3 MIB SDB SDB MIB SDB SDB MIB SDB SDB MIB MIB SDB SDB MIB SDB SDB MIB SDB SDB MIB SDB3 SDB2 SDB1 SDB1 SDB2 SDB3 MIB SDB SDB MIB SDB SDB MIB SDB SDB MIB MIB SDB SDB MIB SDB SDB MIB SDB SDB MIB SDB3 SDB2 SDB1 HARDWIRED MODULE (HWM) HARDWIRED MODULE (HWM) HARDWIRED MODULE (HWM) HARDWIRED MODULE (HWM)

TRIP/BYPASS TRIP/BYPASS TRIP/BYPASS TRIP/BYPASS APL EIM FACILITY INPUTS MANUAL INPUTS SBVM3 SBVM2 SBVM1 SBVM1 SBVM2 SBVM3 FACILITY INPUTS MANUAL INPUTS EIM APL EIM FACILITY INPUTS MANUAL INPUTS SBVM3 SBVM2 SBVM1 SBVM1 SBVM2 SBVM3 FACILITY INPUTS MANUAL INPUTS EIM POSITION INPUTS HW-SM RX TX RX HW-SM HW-SM RX TX RX HW-SM HW-SM RX TX RX HW-SM HW-SM RX RX TX HW-SM HW-SM RX RX TX HW-SM HW-SM RX RX TX HW-SM POSITION INPUTS APL POSITION INPUTS HW-SM RX TX RX HW-SM HW-SM RX TX RX HW-SM HW-SM RX TX RX HW-SM HW-SM RX RX TX HW-SM HW-SM RX RX TX HW-SM HW-SM RX RX TX HW-SM POSITION INPUTS APL TRPS DIV A ACTUATION TRPS DIV B ACTUATION ESFAS DIV A ACTUATION ESFAS DIV B DEVICES DEVICES DEVICES ACTUATION DEVICES PRODUCTION FACILITY HUMAN SYSTEM INTERFACE FACILITY CONTROL ROOM HUMAN SYSTEM INTERFACE INDICATION DISPLAYS OPERATOR WORKSTATION SUPERVISOR WORKSTATION PICS FACILITY MANUAL PICS PICS PICS PICS PICS PICS PICS MASTER PICS ACTUATION SWITCHES OPERATING PICS PICS PICS PICS PERMISSIVE PICS SHINE Medical Technologies 7.1-6 Rev. 1

Chapter 7 - Instrumentation and Control Systems Summary Description Figure 7.1 Target Solution Vessel Reactivity Protection System Architecture TO PICS SENSOR INPUTS RX TX TX M&I COMMUNICATION SAFETY FUNCTION MODULE MODULE MIB CTB CTB SDB1 SDB2 SDB3 MIB TRPS DIV C MAINTENANCE MAINTENANCE WORKSTATION WORKSTATION TO (MWS) DIV A (MWS) DIV B TO SENSOR INPUTS SENSOR INPUTS PICS PICS SDB MIB SDB MIB SDB MIB SCHEDULE AND SCHEDULE AND SCHEDULE AND BYPASS MODULE 1 BYPASS MODULE 2 BYPASS MODULE 3 TX TX RX TX TX TX TX TX TX RX TX TX M&I COMMUNICATION SAFETY FUNCTION MODULE SAFETY FUNCTION MODULE M&I COMMUNICATION MODULE MODULE MIB CTB CTB SDB3 SDB2 SDB1 MIB MIB SDB1 SDB2 SDB3 CTB CTB MIB TRPS DIV A TRPS DIV B SDB1 SDB2 SDB3 MIB SDB SDB MIB SDB SDB MIB SDB SDB MIB MIB SDB SDB MIB SDB SDB MIB SDB SDB MIB SDB3 SDB2 SDB1 HARDWIRED MODULE (HWM) HARDWIRED MODULE (HWM)

EQUIPMENT INTERFACE TRIP/BYPASS SCHEDULE, BYPASS AND SCHEDULE, BYPASS AND SCHEDULE, BYPASS AND SCHEDULE, BYPASS AND SCHEDULE, BYPASS AND SCHEDULE, BYPASS AND TRIP/BYPASS EQUIPMENT INTERFACE MODULE FACILITY INPUTS VOTING MODULE 3 VOTING MODULE 2 VOTING MODULE 1 VOTING MODULE 1 VOTING MODULE 2 VOTING MODULE 3 FACILITY INPUTS MODULE PRIORITY MANUAL INPUTS MANUAL INPUTS PRIORITY LOGIC (APL) POSITION INPUTS HW- HW- HW- HW- HW- HW- HW- HW- HW- HW- HW- HW- POSITION INPUTS LOGIC (APL)

SM RX TX RX SM SM RX TX RX SM SM RX TX RX SM SM RX RX TX SM SM RX RX TX SM SM RX RX TX SM S

S ACTUATED S EQUIPMENT ACTUATED FROM THE S FROM FROM THE FROM TO ESFAS FROM TO ESFAS FROM TO ESFAS TO ESFAS FROM TO ESFAS FROM TO ESFAS FROM FROM EQUIPMENT ACTUATED ACTUATED CONTROL FIELD ESFAS DIV DIV A ESFAS DIV DIV A ESFAS DIV DIV A DIV B ESFAS DIV DIV B ESFAS DIV DIV B ESFAS DIV CONTROL FIELD EQUIPMENT EQUIPMENT ROOM A SBVM 3 SBVM 3 A SBVM 2 SBVM 2 A SBVM 1 SBVM 1 SBVM 1 B SBVM 1 SBVM 2 B SBVM 2 SBVM 3 B SBVM 3 ROOM POSITION POSITION INDICATION INDICATION LEGEND AND ACRONYMNS HIPS PLATFORM SAFETY FUNCTION MODULE ESFAS - ENGINEERED SAFETY FEATURES ACTUATION SYSTEM MIB - MONITORING AND INDICATION BUS PICS - PROCESS INTEGRATED CONTROL SYSTEM MI-CM - MONITORING AND INDICATION COMMUNICATION MODULE HIPS PLATFORM COMMUNICATION MODULE TRPS - TARGET SOLUTION VESSEL REACTIVITY PROTECTION SYSTEM MWS - MAINTENANCE WORKSTATION HIPS PLATFORM EQUIPMENT INTERFACE MODULE RX - RECEIVER APL - ACTUATION AND PRIORITY LOGIC SBM - SCHEDULING AND BYPASS MODULE HIPS PLATFORM HARDWIRED MODULE CTB - CALIBRATION AND TEST BUS SBVM - SCHEDULING, BYPASS AND VOTING MODULE INTERNAL DIAGNOSTIC AND PARAMETER DATA EIM - EQUIPMENT INTERFACE MODULE SDB - SAFETY DATA BUS INTERNAL SAFETY DATA HWM - HARDWIRED MODULE SFM - SAFETY FUNCTION MODULE HW-SM - HARDWIRED SUBMODULE TX - TRANSMITTER EXTERNAL DISCRETE SIGNAL OR DATA SHINE Medical Technologies 7.1-7 Rev. 1

Chapter 7 - Instrumentation and Control Systems Summary Description Figure 7.1 Engineered Safety Feature Actuation System Architecture TO PICS SENSOR INPUTS RX TX TX M&I COMMUNICATION SAFETY FUNCTION MODULE MODULE MIB CTB CTB SDB1 SDB2 SDB3 MIB ESFAS DIV C MAINTENANCE MAINTENANCE WORKSTATION WORKSTATION TO (MWS) DIV A (MWS) DIV B TO SENSOR INPUTS SENSOR INPUTS PICS PICS SDB MIB SDB MIB SDB MIB SCHEDULE AND SCHEDULE AND SCHEDULE AND BYPASS MODULE 1 BYPASS MODULE 2 BYPASS MODULE 3 TX TX RX TX TX TX TX TX TX RX TX TX M&I COMMUNICATION SAFETY FUNCTION MODULE SAFETY FUNCTION MODULE M&I COMMUNICATION MODULE MODULE MIB CTB CTB SDB3 SDB2 SDB1 MIB MIB SDB1 SDB2 SDB3 CTB CTB MIB ESFAS DIV A ESFAS DIV B SDB1 SDB2 SDB3 MIB SDB SDB MIB SDB SDB MIB SDB SDB MIB MIB SDB SDB MIB SDB SDB MIB SDB SDB MIB SDB3 SDB2 SDB1 HARDWIRED MODULE (HWM) HARDWIRED MODULE (HWM)

EQUIPMENT INTERFACE TRIP/BYPASS SCHEDULE, BYPASS AND SCHEDULE, BYPASS AND SCHEDULE, BYPASS AND SCHEDULE, BYPASS AND SCHEDULE, BYPASS AND SCHEDULE, BYPASS AND TRIP/BYPASS EQUIPMENT INTERFACE MODULE FACILITY INPUTS VOTING MODULE 3 VOTING MODULE 2 VOTING MODULE 1 VOTING MODULE 1 VOTING MODULE 2 VOTING MODULE 3 FACILITY INPUTS MODULE PRIORITY MANUAL INPUTS MANUAL INPUTS PRIORITY LOGIC (APL) POSITION INPUTS HW- HW- HW- HW- HW- HW- HW- HW- HW- HW- HW- HW- POSITION INPUTS LOGIC (APL)

SM RX TX RX SM SM RX TX RX SM SM RX TX RX SM SM RX RX TX SM SM RX RX TX SM SM RX RX TX SM S

S ACTUATED S EQUIPMENT ACTUATED S FROM FROM THE FROM TO TRPS FROM TO TRPS FROM TO TRPS TO TRPS FROM TRPS TO TRPS FROM TRPS TO TRPS FROM TRPS FROM FROM THE EQUIPMENT ACTUATED ACTUATED CONTROL FIELD TRPS DIV DIV A TRPS DIV DIV A TRPS DIV DIV A DIV B DIV B DIV B DIV B DIV B DIV B CONTROL FIELD EQUIPMENT EQUIPMENT ROOM A SBVM 3 SBVM 3 A SBVM 2 SBVM 2 A SBVM 1 SBVM 1 SBVM 1 SBVM 1 SBVM 2 SBVM 2 SBVM 3 SBVM 3 ROOM POSITION POSITION INDICATION INDICATION LEGEND AND ACRONYMNS HIPS PLATFORM SAFETY FUNCTION MODULE ESFAS - ENGINEERED SAFETY FEATURES ACTUATION SYSTEM MIB - MONITORING AND INDICATION BUS PICS - PROCESS INTEGRATED CONTROL SYSTEM MI-CM - MONITORING AND INDICATION COMMUNICATION MODULE HIPS PLATFORM COMMUNICATION MODULE TRPS - TARGET SOLUTION VESSEL REACTIVITY PROTECTION SYSTEM MWS - MAINTENANCE WORKSTATION HIPS PLATFORM EQUIPMENT INTERFACE MODULE RX - RECEIVER APL - ACTUATION AND PRIORITY LOGIC SBM - SCHEDULING AND BYPASS MODULE HIPS PLATFORM HARDWIRED MODULE CTB - CALIBRATION AND TEST BUS SBVM - SCHEDULING, BYPASS AND VOTING MODULE INTERNAL DIAGNOSTIC AND PARAMETER DATA EIM - EQUIPMENT INTERFACE MODULE SDB - SAFETY DATA BUS INTERNAL SAFETY DATA HWM - HARDWIRED MODULE SFM - SAFETY FUNCTION MODULE HW-SM - HARDWIRED SUBMODULE TX - TRANSMITTER EXTERNAL DISCRETE SIGNAL OR DATA SHINE Medical Technologies 7.1-8 Rev. 1

1 SYSTEM DESCRIPTION SHINE facility instrumentation and control systems are described in Section 7.1 and are e fully described in Chapter 7.

SHINE safety-related instrumentation and control systems are:

the target solution vessel (TSV) reactivity protection system (TRPS) (Section 7.4)

the engineered safety feature actuation system (ESFAS) (Section 7.5)

the neutron flux detection system (NFDS) (Section 7.8)

safety-related process radiation monitors associated with the TRPS, ESFAS and tritium purification system (TPS) (Section 7.7)

SHINE nonsafety-related instrumentation and control systems are:

the process integrated control system (PICS) and vendor-provided controls (Section 7.3)

facility control room (FCR) control consoles and displays (Section 7.6)

nonsafety-related radiation monitors (Section 7.7) mplified block diagram of the overall I&C system architecture is provided in Figure 7.1-1.

ailed descriptions of the above systems, including equipment and major components, control protection system development processes, and operational, support, and operator interface uirements, are provided in Sections 7.3 through 7.8.

NE uses a documented methodology for establishing and calibrating setpoints for safety-ted I&C functions. A combination of statistical and algebraic methods is used to combine rument uncertainties to determine the total instrument loop uncertainty for each setpoint. The hodology considers both random and non-random uncertainties, and considers process asurement and miscellaneous effects uncertainties, sensor uncertainties, and protection tem processing uncertainties. Instrument drift between calibrations is accounted for in the oint methodology. The methodology is used to ensure an adequate margin exists between lytical limits and instrument setpoints so that protective actions are initiated before safety ts are exceeded.

2 DESIGN CRITERIA design criteria of the I&C systems were derived from the criteria in 10 CFR 50, Appendix A, 10 CFR 70.64(a), as described in Table 3.1-3, as well as guidance provided in Chapter 7 of REG-1537, Part 1 and the Final Interim Staff Guidance (ISG) Augmenting NUREG-1537, t 1. The criteria were applied in a graded approach to each I&C system.

SHINE facility design criteria are described in Section 3.1. Table 3.1-1 and Table 3.1-2 show the facility design criteria are applied to each I&C system. System-specific design criteria provided in Sections 7.3 through 7.8. Sections 7.3 through 7.8 additionally describe how the lity design criteria and system-specific design criteria are met or implemented for each I&C tem.

NE Medical Technologies 7.2-1 Rev. 1

3 DESIGN BASES design bases requirements identified for each I&C system in Sections 7.3 through 7.8 are blished for safe facility operation and to prevent or mitigate the process hazards and ential accident sequences identified in the accident analysis described in FSAR Chapter 13.

I&C design meets established design criteria to ensure safety functions are performed sistently and completely to fulfill the safety intent.

ety functions, applicable modes of operation, permissive conditions, monitored variables and r ranges, conditions for manual control, and any other special design bases requirements cific to each of the I&C systems are described in Sections 7.3 through 7.8.

ironmental and radiological parameters applicable to I&C components located in different as of the facility are provided in Tables 7.2-1 through 7.2-6 and are referred to in Sections 7.3 ugh 7.8.

ironmental parameters inside the main production facility are maintained by the facility ting, ventilation, and air conditioning (HVAC) systems, which are described in Section 9a2.1.

4 OPERATION AND PERFORMANCE ration and performance are addressed for each instrumentation and control system in tions 7.3 through 7.8. The operation and performance analysis describes how the system ign criteria and design bases are met for performance of the system design functions. The ussions include, but are not limited to, descriptions of instrumentation and control system ons, setpoints, and how a single failure affects the ability of the system to perform the safety ctions.

NE Medical Technologies 7.2-2 Rev. 1

Table 7.2 Design Radiation Environments Location Normal Transient dioisotope production facility (RPF) 1.0E+3 Rad TID, 5 mR/hr 100 mR/hr neral area adiation facility (IF) general area 1.0E+3 Rad TID, 5 mR/hr 50 mR/hr tium purification system (TPS) 50 Rad TID, 0.25 mR/hr 5 mR/hr om, glovebox and exhaust duct adiation unit (IU) cell above the light 1.8E+8 Rad TID, 1E+3 R/hr 1E+3 R/hr ter pool cell near dump tank and flux 1.8E+10 Rad TID, 1E+5 R/hr 1E+5 R/hr tectors (in light water pool) ide the target solution vessel (TSV) 5.4E+8 Rad TID, 3E+3 R/hr 3E+3 R/hr

-gas system (TOGS) instrument box ide the TOGS cell, outside 1.2E+10 Rad TID, 7E+4 R/hr 7E+4 R/hr trument box ide the cooling room 1.8E+4 Rad TID, 100 mR/hr 100 R/hr e: (1) Total integrated dose (TID) is calculated over a 20-year timeframe.

(2) Design radiation environments lower than those listed may be defined for specific locations using additional analysis or localized shielding.

NE Medical Technologies 7.2-3 Rev. 1

Table 7.2 Facility Control Room Design Environmental Parameters Parameter Normal Transient mperature 60ºF to 80ºF 40ºF to 120ºF essure Ambient Ambient 10 percent to 80 percent 10 percent to 95 percent lative Humidity (non-condensing) (non-condensing)

NE Medical Technologies 7.2-4 Rev. 1

Table 7.2 RPF and IF General Area Design Environmental Parameters Parameter Normal Transient mperature 65ºF to 85ºF 40ºF to 120ºF essure Ambient Ambient 10 percent to 80 percent 10 percent to 95 percent lative Humidity (non-condensing) (non-condensing)

NE Medical Technologies 7.2-5 Rev. 1

Table 7.2 IU Cell Interior Design Environmental Parameters Parameter Normal Transient mperature 40ºF to 104ºF 40ºF to 120ºF ssure Ambient 14 psia to 19 psia 10 percent to 100 percent 10 percent to 100 percent ative Humidity (condensing) (condensing)

NE Medical Technologies 7.2-6 Rev. 1

Table 7.2 TOGS Cell Interior Design Environmental Parameters Parameter Normal Transient mperature 40ºF to 104ºF 40ºF to 120ºF ssure Ambient 14 psia to 19 psia 10 percent to 100 percent 10 percent to 100 percent ative Humidity (condensing) (condensing)

NE Medical Technologies 7.2-7 Rev. 1

Table 7.2 Primary Cooling Room Interior Design Environmental Parameters Parameter Normal Transient mperature 40ºF to 120ºF 40ºF to 120ºF essure Ambient Ambient 10 percent to 80 percent 10 percent to 95 percent lative Humidity (non-condensing) (non-condensing)

NE Medical Technologies 7.2-8 Rev. 1

SHINE facility is provided with nonsafety-related control systems necessary to perform mal operational activities within the facility. The process integrated control system (PICS) is a safety-related digital control system that performs various functions throughout the SHINE lity. The PICS is the primary interface for operators to perform tasks in both the irradiation lity (IF) and the radioisotope production facility (RPF). PICS functions include signal ditioning, system controls, interlocks, and monitoring of the process variables and system us.

dor-provided nonsafety-related control systems, which interface and communicate with the S, are also present within the SHINE facility and are used to monitor and control specific lity systems.

main control board and operator workstations in the facility control room are also part of the S and are described in Section 7.6.

1 SYSTEM DESCRIPTION PICS is a collection of instrumentation and control equipment located throughout the facility upport monitoring, indication, and control of various systems. A portion of the PICS supports main control board and operator workstations in the facility control room by receiving operator mands and collecting and transmitting facility information to the operators, as described in tion 7.6. An architecture of the PICS is provided in Figure 7.3-1.

following vendor-provided nonsafety-related control systems are also provided for the NE facility:

The building automation system is a digital control system capable of integrating multiple building functions, including equipment supervision and control, alarm management, energy management, and trend data collection. It provides control for the facility heating water system (FHWS), the facility chilled water system (FCHS), the process chilled water system (PCHS), the radioisotope process facility cooling system (RPCS), facility ventilation zone 4 (FVZ4) air handling, and radiological ventilation zone 1, 2, and 3 (RVZ1/2/3) air handling. The building automation system receives commands from the PICS to start and stop select control sequences and provides information to the PICS for monitoring.

The supercell contains a local control system and human system interface equipment for controlling hot cell functions including interior lighting, interior temperature and pressure, and operation of the doors, ports, and waste export system. The supercell control system provides information to PICS for monitoring only.

The radioactive liquid waste immobilization (RLWI) system contains a local control system and human system interface equipment for controlling RLWI equipment functions including lighting inside the RLWI enclosure, interior temperature and pressure, operation of the doors and other access ports, and operation of equipment used to handle solidified waste. The RLWI control system provides information to PICS for monitoring only.

The neutron driver assembly system (NDAS) control system is used to monitor and make adjustments to any of the eight neutron drivers in the eight irradiation unit (IU) cells. Two NDAS control stations are provided in the facility control room as described in Subsection 7.6.1.2, and a portable local station is provided as described in NE Medical Technologies 7.3-1 Rev. 2

use of the system and provides information to PICS for monitoring.

The standby generator system (SGS) generator, facility demineralized water system (FDWS) reverse osmosis (RO) unit, facility nitrogen handling system (FNHS) unit, FHWS boilers, and FCHS and PCHS chillers are each provided with integral controllers that interface with the PICS (for the SGS generator, FDWS RO unit, and FNHS unit) or the building automation system (for boilers and chillers).

escription of the PICS process monitoring functions, control functions, interlocks, alarms, and lays is provided for each facility system where the PICS provides these functions. If licable, the vendor-provided nonsafety-related controls are also described for each facility tem. In addition to the variables described below, PICS monitors valve or damper position dback as needed to perform control functions or implement interlocks and permissives.

1.1 Irradiation Unit Systems PICS is used to monitor parameters and perform manual and automatic actions during each he operational modes of a subcritical assembly system (SCAS):

Mode 0 - Solution Removed: No target solution in the SCAS Mode 1 - Startup: Filling the target solution vessel (TSV)

Mode 2 - Irradiation: Operating mode (neutron driver active)

Mode 3 - Post-Irradiation: TSV dump valves open Mode 4 - Transfer to the RPF: Dump tank drain valve opens to permit solution transfer systems associated with SCAS modes of operation include the SCAS itself, the NDAS, the off-gas system (TOGS), the primary closed loop cooling system (PCLS), and the neutron detection system (NFDS).

de 0 - Solution Removed ode 0, the PICS provides the capability to control equipment needed to transition an IU into de 1, including closing the TSV fill valves and dump valves and starting the TOGS blowers as ded to meet mode transition criteria. The PICS also provides monitoring and controls of the mon tritium purification system (TPS), which is integrated with the modes of operation for h IU cell.

de 1 - Startup Mode r the operator transitions the IU to Mode 1 using the operating mode input to the TSV ctivity protection system (TRPS), the PICS is used to open the TSV fill valves and operate the uum transfer system (VTS) to add target solution to the TSV from the associated target tion hold tank.

NE Medical Technologies 7.3-2 Rev. 2

calculation. The PICS also provides defense-in-depth time limits and interlocks to control the ximum volumetric step addition during the 1/M fill process to prevent challenging the TRPS Stop actuation function described in Section 7.4.

de 2 - Irradiation en the TSV fill has been completed, PICS is used to close the TSV fill valves to meet Mode 2 sition criteria. The PICS provides an interlock with the source range channel of the NFDS to vent TSV irradiation without sufficient neutron counts on the detectors and, when that missive is met, PICS is used to close the neutron driver breakers to enable the target solution e TSV to be irradiated. The PICS interfaces with the NDAS control system to start or stop the er and is used to control the introduction of tritium into the NDAS target from the TPS.

ing irradiation, PICS is used to monitor neutron flux levels, concentrations of radiolytic gases erated, NDAS performance parameters, and other parameters associated with the irradiation cess.

de 3 - Post-Irradiation neutron driver breakers are opened by the PICS, ending the irradiation period and satisfying mode transition criteria, allowing the operator to transition from Mode 2 to Mode 3. When sitioning from Mode 2 to Mode 3 during normal operations, the PICS provides the mode sition signal from the TRPS to automatically open the TSV dump valves to drain the target tion to the dump tank. While in Mode 3, the PICS is used to monitor TOGS and SCAS rational parameters while the solution is held for decay.

de 4 - Transfer to RPF r the operator transitions the IU to Mode 4, the PICS is used to open the TSV dump tank n isolation valve allowing the target solution to be vacuum lifted out of the IU cell, pumped ugh an extraction column, and drained to a target solution hold tank. The PICS is used to ct the flow path for the transfer to the desired extraction cell and to operate the VTS which omplishes the lift.

en the solution has been removed from the dump tank, the operator uses PICS to verify that

-high TSV dump tank level is inactive, meeting the Mode 4 to Mode 0 transition criteria.

1.1.1 Subcritical Assembly System SCAS maintains fissile material in a subcritical, but highly multiplying configuration during irradiation process to produce molybdenum-99 (Mo-99) and other fission products. The AS is described in Section 4a2.2.

nitoring and Alarms PICS is used to monitor and provide alarms for TSV level, TSV temperature, and TSV dspace pressure for each IU. TSV dump tank level is monitored using two level switches NE Medical Technologies 7.3-3 Rev. 2

S also provides alarms for automatic or manual actuation of the TRPS safety functions cribed in Subsection 7.4.3.1 and the TRPS Fill Stop described in Subsection 7.4.4.1.18.

trol Functions operator is able to use the PICS to manually open and close individual valves and manually t or stop individual components unless operation is prevented by interlocks, permissives, or ve sequences. Components that are capable of being actuated by TRPS are controlled by S as described in Subsection 7.3.1.3.11.

PICS provides a signal to the TRPS, when manually initiated by the operator, to sequentially sition the TRPS from one mode to the next.

en a TSV fill sequence is manually initiated, the PICS opens and closes the TSV lift tank uum valve and the TSV fill valves according to a programmed sequence to add a manually ered prescribed volume to the TSV. The PICS uses feedback from the TSV fill lift tank level ches and valve position indication to accomplish this sequence. At or above 40 percent of the ximum 95 percent fill neutron flux, the time the TSV fill valve is open is limited to less than

]PROP/ECI to prevent reliance on the TRPS Fill Stop function (Subsection 7.4.4.1.18).

TSV fill lift sequence can be manually aborted by the operator.

en a TSV drain sequence is manually initiated and the operator manually enters a solution time, the PICS provides a signal to the TRPS to transition to Mode 3, opens the TSV dump es, verifies the TSV lift tank vacuum valve is closed, and opens the TSV fill valves to drain target solution remaining in the fill lines to the TSV dump tank via the TSV. When TSV level cates the TSV is drained, the PICS closes the TSV fill valves and starts a timer for the viously entered solution hold time.

solution hold time portion of the TSV drain sequence can be manually aborted by the rator.

rlocks and Permissives PICS provides an interlock at or above 40 percent of the maximum 95 percent fill neutron to limit the fill rate of the TSV.

PICS additionally provides permissives and interlocks to:

Prevent the NDAS high voltage power supply (HVPS) from being energized if any of the TSV fill valves, TSV dump valves, TSV dump tank drain valve, or nitrogen purge system (N2PS) inerting gas isolation valves are open.

Prevent the TSV fill valves from opening in Mode 1 if the median value of the three values of TOGS mainstream flow inputs for both TOGS trains is below the allowable value.

Prevent the TSV fill valves from opening in Mode 1 if either TSV dump valve is open.

Prevent the TSV dump tank drain valve from opening until the solution hold time has elapsed.

NE Medical Technologies 7.3-4 Rev. 2

solution is not present.

Allow transition from Mode 1 to Mode 2 only when both TSV dump valves are closed, both TSV fill valves are closed, and TSV level is above an allowable level, indicating the TSV contains sufficient solution for irradiation.

Allow transition from Mode 3 to Mode 4 only when TSV level is below an allowable level indicating solution has been drained, and the TSV dump tank low-high level signal is present indicating solution is in the TSV dump tank.

Allow transition from Mode 4 to Mode 0 only when TSV level is below an allowable level indicating solution has been drained, the TSV dump tank low-high level signal is clear indicating solution has been removed from the TSV dump tank, and the TSV fill valves are closed.

cation to the operator is provided on the PICS operator workstation displays when an rlock or permissive is bypassed.

1.1.2 Target Solution Vessel Off-Gas System TOGS is used to manage radiolysis and fission product gases generated in the TSV during diation operation and present in the TSV dump tank during target solution cooldown to ntain concentrations within safe limits. The TOGS is described in Section 4a2.8.

nitoring and Alarms PICS receives input from the TRPS and provides alarms for TOGS oxygen concentration bsection 7.4.4.1.10), mainstream flow for both train A and B (Subsection 7.4.4.1.11),

denser demister outlet temperatures for both train A and B (Subsection 7.4.4.1.13), and p tank flow for train A (Subsection 7.4.4.1.12).

PICS directly monitors and provides alarms for TOGS hydrogen concentration, gas injection rate, TOGS blower outlet and sidestream pressures, instrument demister condensate high l switch and condenser demister outlet, sweep gas supply, recombiner inlet, recombiner et, zeolite bed inlet, and zeolite bed outlet temperatures.

trol Functions operator is able to use the PICS to manually open and close individual valves and manually t or stop individual components unless operation is prevented by interlocks, permissives, or ve sequences. Components that are capable of being actuated by TRPS are controlled by S as described in Subsection 7.3.1.3.11.

following functions are performed while TOGS is running (Mode 1, 2, 3, or 4):

S automatically controls mainstream flow for each TOGS train based on the median value of three mainstream flow inputs received from TRPS by adjusting the variable speed motor of associated train TOGS blower.

NE Medical Technologies 7.3-5 Rev. 2

perature of each component.

S automatically opens the TOGS oxygen inlet valve when oxygen concentration is low, ed on the median value of the three TOGS oxygen concentration inputs received from TRPS.

SV headspace pressure (Subsection 7.3.1.1.1) increases above the allowable setpoint, PICS ns the TOGS vacuum tank inlet valve. If TSV headspace pressure is too high while TOGS gen concentration is low, PICS closes the TOGS oxygen inlet valve prior to opening the GS vacuum tank inlet valve. If TSV headspace pressure is too low, PICS opens the TOGS ogen inlet valve.

S automatically controls the position of the TOGS gas inlet flow control valve to maintain a stant gas injection flowrate when either the TOGS oxygen or nitrogen inlet valve is open.

following functions are performed while TOGS is not running (Mode 0):

en manually initiated by the operator, the PICS executes a programmed sequence to cuate the TOGS vacuum tank by opening and closing the TOGS vacuum tank inlet valve, ning and closing the TOGS vacuum tank outlet valve, and opening and closing the vacuum ply valves in a specific order.

en manually initiated by the operator, the PICS executes a programmed sequence to start the GS by ensuring TOGS valves are in their required states, enabling the TOGS control loops, starting the TOGS blowers. This sequence places the TOGS in a Running state.

rlocks and Permissives S provides interlocks and permissives to:

Prevent the TOGS vacuum tank inlet valve and TOGS vacuum tank outlet valve from being open simultaneously.

Prevent the TOGS oxygen inlet valve and TOGS nitrogen inlet valve from being open simultaneously.

Prevent the TOGS vacuum tank inlet valve from being open when either the TOGS oxygen inlet valve or the TOGS nitrogen inlet valve is open.

Allow the transition from Mode 0 to Mode 1 only when TOGS is in a Running state.

Allow the transition from Mode 1 to Mode 2 only when TOGS is in a Running state.

cation to the operator is provided on the PICS operator workstation displays when an rlock or permissive is bypassed.

1.1.3 Primary Closed Loop Cooling System PCLS provides forced convection water cooling to the TSV and neutron multiplier during diation of the target solution and immediately prior to transferring target solution from the TSV he TSV dump tank. The PCLS is described in Section 5a2.2.

NE Medical Technologies 7.3-6 Rev. 2

PICS receives input from the TRPS and provides alarms for PCLS cooling water flow bsection 7.4.4.1.7) and PCLS cooling water supply temperature (Subsections 7.4.2.1.5 and 2.1.6).

PICS receives direct input and provides alarms for PCLS pressure, PCLS conductivity, LS expansion tank level, PCLS cleanup side stream flow, PCLS cooling water temperature asured separately from safety-related PCLS cooling water supply temperature), and various er system parameters.

LS instrumentation is further described in Subsections 5a2.2.3 and 5a2.5.2.

trol Functions operator is able to use the PICS to manually open and close individual valves and manually t or stop individual components unless operation is prevented by interlocks, permissives, or ve sequences. Components that are capable of being actuated by TRPS are controlled by S as described in Subsection 7.3.1.3.11.

S automatically controls the position of the RPCS outlet control valve from the PCLS heat hanger to maintain the nonsafety-related PCLS cooling water supply temperature indication in an acceptable band.

en manually initiated by the operator, the PICS executes a programmed sequence to start or the PCLS by ensuring PCLS valves are in their required states, enabling or disabling the LS temperature control loop, and allowing the operator to start or stop the PCLS pump ors. Starting at least one PCLS pump places PCLS in a Running state.

rlocks and Permissives S provides interlocks and permissives to:

Prevent the PCLS pumps from starting if the PCLS supply isolation valve or either PCLS return isolation valve is closed.

Prevent the PCLS pumps from starting if PCLS expansion tank level is low.

Prevent the PCLS pumps from starting if PCLS suction pressure is low.

Allow the transition from Mode 0 to Mode 1 only when PCLS is in a Running state.

Allow the transition from Mode 1 to Mode 2 only when PCLS is in a Running state.

cation to the operator is provided on the PICS operator workstation displays when an rlock or permissive is bypassed.

1.1.4 Light Water Pool System light water pool system (LWPS) provides neutron moderation and reflection to reduce tron leakage, radiation shielding, and decay heat removal from target solution following diation. The LWPS is described in Subsection 4a2.4.2.

NE Medical Technologies 7.3-7 Rev. 2

PICS receives input and provides alarms for LWPS pool level, LWPS pool temperature, and PS pool leak chase level for each IU.

trol Functions e

rlocks e

1.1.5 Neutron Driver Assembly System NDAS is the source of neutrons used to generate the neutron fluxes required to create dical isotopes in the TSV. The NDAS produces neutrons by colliding a deuterium (D) ion m with tritium (T) gas. The NDAS is directly controlled by a vendor-provided nonsafety-ted control system. The NDAS is described in Section 4a2.3.

nitoring and Alarms NDAS is directly monitored by a vendor-provided nonsafety-related control system. The AS control system monitors deuterium-tritium (DT) neutron yield, beam current, target ssure, leakage indications, various system voltages, currents and temperatures, and dback from vacuum pumps and other system components.

NDAS control system provides a subset of these monitored parameters and the status of the tem (System Off, Vacuum, Prepared, Standby, or Beam On) to the PICS for display on the S workstations and generation of alarms.

trol Functions NDAS control system allows the operator to manually adjust (e.g., focus or direct) the terium beam by changing voltages and currents applied to various solenoid magnets. The AS control system also allows the operator to control the ion source by adjusting microwave er, current, and voltage to manually start and stop various system auxiliaries (e.g., vacuum ps, blowers, cooling pumps), and to open and close NDAS system valves.

local NDAS control station is only used for maintenance and commissioning activities for an AS unit installed in an IU, or for an NDAS unit located in the NDAS service cell.

operator uses PICS to provide signals to manually open or close the neutron driver HVPS akers to meet TRPS mode transition criteria and allow the beam to be energized. The rator is able to use the PICS to manually open and close individual valves that are capable of g actuated by TRPS as described in Subsection 7.3.1.3.11.

NE Medical Technologies 7.3-8 Rev. 2

PICS provides permissive signals to the NDAS control system to:

Allow the use of the control room NDAS control station, specific to each NDAS unit.

Allow the control room NDAS control station to transition a specific NDAS unit to Beam On status.

Allow the use of the local NDAS control station.

moval of the PICS permissive signal for Beam On operation causes the beam to deenergize.

PICS additionally provides interlocks and permissives to:

Prevent the transition of an NDAS unit to Beam On when the NFDS source range count rate is below an allowable value.

Allow the transition from Mode 1 to Mode 2 only when the NDAS is in Standby.

Allow the transition from Mode 2 to Mode 3 only when the NDAS is not in Beam On.

Allow the transition from Mode 3 to Mode 4 only when the NDAS is not in Beam On.

Allow the transition from Mode 4 to Mode 0 only when the NDAS is not in Beam On.

cation to the operator is provided on the PICS operator workstation displays when an rlock or permissive is bypassed.

1.1.6 Neutron Flux Detection System NFDS monitors the neutron flux in the IU during TSV fill and irradiation. The NFDS is cribed in Section 7.8.

nitoring and Alarms PICS receives input from the TRPS for monitoring and provides alarms for source range tron flux (Subsection 7.4.4.1.1), wide range neutron flux (Subsection 7.4.4.1.4), and power ge neutron flux (Subsections 7.4.2.1.2 and 7.4.4.1.3), as described in Subsection 7.8.3.9.

PICS directly receives discrete signals from the NFDS for source range missing and wer range missing faults for the generation of alarms (Subsection 7.8.3.10).

trol Functions e

rlocks and Permissives e

1.2 Supercell Systems PICS provides automated and manual control of systems associated with the supercell, ch are used to transfer target solution between locations within the facility and extract and NE Medical Technologies 7.3-9 Rev. 2

1.2.1 Molybdenum Extraction and Purification System ope extraction and purification activities are performed by the molybdenum extraction and fication system (MEPS), molybdenum isotope product packaging system (MIPS), and iodine xenon purification and packaging (IXP) system. The MEPS is located in six hot cells of the ercell (extraction areas A, B, and C and purification areas A, B, and C) and is used to extract ybdenum from target solution and purify it, as described in Section 4b.3.

ee local operator PICS stations are provided at the supercell, one located near each action hot cell.

nitoring and Alarms PICS receives input from the engineered safety features actuation system (ESFAS) and vides alarms for the position of the MEPS extraction column three-way valves bsection 7.5.4.1.16) and the MEPS [ ]PROP/ECI conductivity bsection 7.5.4.1.6).

PICS directly monitors and provides alarms for molybdenum eluate hold tank level, harge pressure and status feedback from system pumps, MEPS evaporator temperature, various other system temperatures and pressures. The PICS also monitors the weight of ples obtained from various processes, but no alarms are provided.

the MEPS [ ]PROP/ECI, the PICS monitors and provides alarms for temperature,

, and pressure at various locations.

PICS also provides alarms for automatic or manual Extraction Column A/B/C Alignment uations and MEPS A/B/C [ ]PROP/ECI Isolations described in Subsection 7.5.3.1.

trol Functions en a target solution extraction sequence is manually initiated by the operator, the PICS cutes a programmed sequence to transfer solution from one manually selected TSV dump to a manually selected supercell extraction hot cell using the VTS. The PICS opens and es the associated TSV dump tank drain isolation valve and appropriate system isolation es based on feedback from associated VTS lift tank level switches and the selected TSV p tank low-high level switch to accomplish the solution transfer. The PICS also starts and s the associated extraction feed pump as part of the sequence.

ing a target solution extraction sequence, the PICS automatically controls the [

]PROP/ECI.

en initiated by the operator during a purification operation, the PICS automatically controls the perature of the MEPS evaporator by energizing and deenergizing the evaporator heater.

NE Medical Technologies 7.3-10 Rev. 2

rator is able to use the PICS local supercell control stations to manually open and close vidual valves and manually start or stop individual components unless operation is prevented nterlocks, permissives, or active sequences. Components that are capable of being actuated ESFAS are controlled by PICS as described in Subsection 7.3.1.3.11.

supercell control system is used by the operator to manually control hot cell (non-process) tions.

rlocks and Permissives PICS provides permissives and interlocks to:

Prevent initiation of a target solution extraction sequence if the associated IU from where solution is being transferred is not in Mode 4.

Prevent opening of any of the supercell reagent feed isolation valves while a target solution extraction sequence is in progress.

Prevent alignment of MEPS three-way valves in a way that could misdirect fluid and challenge the operation of system check valves.

Prevent operation of the extraction feed pump if more than one target solution discharge valve is open (i.e., valves used to direct post-extraction target solution to the IXP hot cell, or a target solution staging system [TSSS] or radioactive liquid waste storage [RLWS]

tank).

Stop or prevent from starting system pumps when discharge pressure is above an allowable limit or when the pump discharge flow path is isolated.

cation to the operator is provided on the PICS operator workstation displays when an rlock or permissive is bypassed.

1.2.2 Molybdenum Isotope Product Packaging System MIPS is located in two hot cells of the supercell (packaging areas 1 and 2) and is used to kage isotopes received from the MEPS and IXP, as described in Subsection 9b.7.1.

nitoring and Alarms S monitors the weight of the Mo-99 product from the MEPS and the weight of the Xe-133 and 1 products from the IXP system. No alarms are provided.

trol Functions supercell control system is used by the operator to manually control hot cell (non-process) tions.

rlocks and Permissives e

NE Medical Technologies 7.3-11 Rev. 2

IXP is located in a hot cell of the supercell (IXP area) and is used to extract and purify opes of iodine and xenon. The IXP is described in Subsection 4b.3.1.

nitoring and Alarms PICS receives input from the ESFAS and provides alarms for the position of the IXP three-valves (Subsection 7.5.4.1.17).

PICS directly monitors and provides alarms for IXP eluate hold tank level, [

]PROP/ECI, xenon trap temperature, and various other system temperatures and pressures. The PICS also nitors the weight of samples obtained from various processes, but no alarms are provided.

PICS also provides alarms for automatic or manual IXP Alignment Actuations described in section 7.5.3.1.

trol Functions tasks performed by the operator for the IXP are manual. The operator is able to use the S local supercell control stations to manually open and close individual valves and manually t or stop individual components unless operation is prevented by interlocks, permissives, or ve sequences. Components that are capable of being actuated by ESFAS are controlled by S as described in Subsection 7.3.1.3.11.

supercell control system is used by the operator to manually control hot cell (non-process) tions.

rlocks and Permissives PICS provides permissives and interlocks to:

Prevent opening of any of the supercell reagent feed isolation valves while an IXP target solution supply valve is open.

Prevent alignment of IXP three-way valves in a way that could misdirect fluid and challenge the operation of system check valves.

Prevent operation of the B and C extraction feed pumps if more than one target solution discharge valve is open (i.e., valves used to direct post-IXP recovery target solution to a TSSS or RLWS tank).

[

]PROP/ECI cation to the operator is provided on the PICS operator workstation displays when an rlock or permissive is bypassed.

NE Medical Technologies 7.3-12 Rev. 2

process vessel vent system (PVVS) provides ventilation of tanks and vessels located in the F that may contain radioactive solutions in order to mitigate the potential buildup of hydrogen is generated via radiolysis. A portion of the PVVS equipment is located in a hot cell of the ercell (PVVS area), with other equipment located in the main production facility mezzanine or elow grade vaults. The PVVS is described in Subsection 9b.6.1.

nitoring and Alarms PICS receives input from the ESFAS and provides alarms for PVVS flow bsection 7.5.4.1.15) and PVVS carbon delay bed exhaust carbon monoxide bsection 7.5.4.1.7).

PICS directly monitors and provides alarms for nonsafety-related PVVS supply flow to vidual tanks and vessels serviced by PVVS, PVVS reheater temperatures, PVVS condensate k level, PVVS condenser cooling water temperature, PVVS carbon guard bed train exhaust perature and differential pressure, PVVS carbon delay bed temperatures, and other system peratures, pressures, and flows.

PICS also provides alarms for automatic or manual Carbon Delay Bed Group 1/2/3 ations described in Subsection 7.5.3.1.

trol Functions operator is able to use the PICS to manually open and close individual valves and manually t or stop individual components unless operation is prevented by interlocks, permissives, or ve sequences. Components that are capable of being actuated by ESFAS are controlled by S as described in Subsection 7.3.1.3.11.

PICS provides automatic control of PVVS condensate transfer by stopping the condensate harge pump on low PVVS condensate tank level after the operator has manually selected the tination tank and initiated the transfer.

PICS provides automatic control of the PVVS makeup air supply valve by monitoring safety-related PVVS return flow (from tanks and vessels serviced by PVVS), to maintain total to the PVVS blowers constant.

PICS automatically controls temperature by energizing and deenergizing the PVVS eaters based on the PVVS reheater downstream temperature.

supercell control system is used by the operator to manually control hot cell (non-process) tions.

NE Medical Technologies 7.3-13 Rev. 2

PICS provides interlocks and permissives to:

Close the PVVS inlet valve to a carbon guard bed train if differential pressure for the associated carbon guard bed train is above an allowable limit, and open the PVVS inlet and outlet valves and start the PVVS reheater for the redundant carbon guard bed train.

Close the PVVS inlet and outlet valves for a carbon guard bed train if exhaust temperature for the associated carbon guard bed train is above an allowable limit, and open the PVVS inlet and outlet valves and start the PVVS reheater for the redundant carbon guard bed train.

Open the carbon guard bed bypass valves if both carbon guard bed train PVVS inlet valves are closed.

Isolate flow from the PVVS condensate tank on high level in the first uranium liquid waste tank.

Isolate flow from the PVVS condensate tank on high level in the liquid waste blending tanks.

Prevent from starting or stop the PVVS condensate pump when all PVVS condensate pump discharge valves are closed.

cation to the operator is provided on the PICS operator workstation displays when an rlock or permissive is bypassed.

1.2.5 Vacuum Transfer System get solution transfer activities occur throughout the main production facility in order to remove diated solution from the TSV dump tank, extract isotopes, and return target solution to an IU.

se activities are accomplished by the VTS and TSSS. The VTS consists of vacuum pumps a vacuum buffer tank located in a hot cell of the supercell (co-located with the PVVS in the VS area) and lift tanks, as described in Subsection 9b.2.5.

nitoring and Alarms PICS receives input from the ESFAS and provides alarms for the VTS vacuum header liquid ection switches (Subsection 7.5.4.1.8).

PICS directly monitors and provides alarms for vacuum system pressure, individual VTS lift level switches, VTS vacuum buffer tank level switches, target solution sample line level ches, and status feedback information from the VTS vacuum pumps.

PICS also provides alarms for automatic or manual VTS Safety Actuation described in section 7.5.3.1.

trol Functions operator is able to use the PICS to manually open and close individual valves and manually t or stop individual components unless operation is prevented by interlocks, permissives, or ve sequences. Components that are capable of being actuated by TRPS or ESFAS are trolled by PICS as described in Subsection 7.3.1.3.11.

NE Medical Technologies 7.3-14 Rev. 2

PICS automatically starts and stops the second of two VTS vacuum pumps to maintain uum system pressure within an allowable range.

supercell control system is used by the operator to manually control hot cell (non-process) tions.

rlocks and Permissives PICS provides interlocks and permissives to:

Close or prevent opening of individual VTS lift tank or target solution sample line vacuum valves when the corresponding VTS lift tank or target solution sample line high level switch signal is active.

Close or prevent opening VTS vacuum buffer tank vacuum valves, stop or prevent from starting the VTS vacuum pumps, and open the VTS vacuum buffer tank drain valve on high level in the VTS vacuum buffer tank.

Prevent the vacuum transfer sequence from starting if level in the destination tank selected is above an allowable limit.

cation to the operator is provided on the PICS operator workstation displays when an rlock or permissive is bypassed.

1.2.6 Target Solution Staging System TSSS is used in conjunction with the VTS (Subsection 7.3.1.2.5), and consists of hold tanks storage tanks located in subgrade vaults. The TSSS is described in more detail in section 4b.4.1.1.

nitoring and Alarms PICS monitors and provides alarms for two diverse methods of level indication for the vidual TSSS tanks, and temperature indication for the individual TSSS tanks. The PICS itionally provides alarms when tank level or transfer time is outside of expected parameters ng a solution transfer sequence.

trol Functions en manually initiated by the operator, the PICS executes a programmed sequence to transfer tion from one manually selected TSSS tank to another manually selected tank using the

. The PICS opens and closes the appropriate system isolation valves based on feedback VTS lift tank level switches and the selected hold or storage tank level indication to omplish the solution transfer.

n-progress solution transfer sequence can be manually aborted by the operator.

NE Medical Technologies 7.3-15 Rev. 2

uum valves and sampling isolation valves to accomplish the sampling activity.

operator is able to use the PICS to manually open and close individual valves and manually t or stop individual components unless operation is prevented by interlocks, permissives, or ve sequences.

rlocks and Permissives PICS provides interlocks to:

Prevent a vacuum transfer sequence from starting in a hold or storage tank when the temperature in the associated tank is above an allowable limit.

Stop a vacuum transfer sequence on high level in the destination tank.

cation to the operator is provided on the PICS operator workstation displays when an rlock or permissive is bypassed.

1.3 Ancillary Process Systems PICS provides automated and manual control of systems used to prepare target solution, nage radioactive waste, control tritium provided to the neutron drivers, and perform other lity process monitoring and control functions.

1.3.1 Uranium Receipt and Storage System uranium receipt and storage system (URSS) is used to receive uranium prior to conversion arget solution. The URSS is described in detail in Subsection 4b.4.2.1.

nitoring and Alarms PICS monitors and provides alarms for URSS glovebox pressures, URSS glovebox air flow, URSS glovebox temperatures.

ngle local control station is associated with the URSS and target solution preparation system PS) which is capable of displaying URSS and TSPS indications and alarms to the local rator.

trol Functions e

rlocks and Permissives e

NE Medical Technologies 7.3-16 Rev. 2

TSPS is used to prepare uranyl sulfate target solution. PICS provides monitoring and ming functions for parameters associated with the TSPS preparation and dissolution tanks, uding alarms to alert the operators of potential overflow of the TSPS dissolution tank into the S glovebox. The TSPS is described in detail in Subsection 4b.4.2.2.

nitoring and Alarms PICS receives input from the ESFAS and provides alarms for the TSPS dissolution tank l switches (Subsection 7.5.4.1.18).

PICS directly monitors and provides alarms for TSPS dissolution tank temperature and level cations, TSPS preparation tank temperature and level indications, and various additional tem temperatures and pressures.

ngle local control station is associated with the URSS and TSPS which is capable of laying these indications and alarms to the local operator.

PICS also provides alarms for automatic or manual Dissolution Tank Isolation described in section 7.5.3.1.

trol Functions PICS automatically controls the operation of the individual TSPS dissolution tank heaters ed on the associated TSPS dissolution tank temperature.

operator is able to use the PICS, either locally or remotely, to manually open and close vidual valves and manually start or stop individual components unless operation is prevented nterlocks, permissives, or active sequences. Components that are capable of being actuated ESFAS are controlled by PICS as described in Subsection 7.3.1.3.11.

rlocks and Permissives PICS provides interlocks to:

Prevent the operation of the TSPS filter pump when TSPS dissolution tank temperature is above an allowable limit.

Stop or prevent from starting system pumps when discharge pressure is above an allowable limit or when the pump discharge flow path is isolated.

cation to the operator is provided on the PICS operator workstation displays when an rlock or permissive is bypassed.

1.3.3 Radioactive Drain System ins from vaults, trenches, and other areas where uranium-bearing solutions may be present part of the radioactive drain system (RDS), described in Subsection 9b.7.2. PICS is used to vide indication of leakage and the presence of liquid in the RDS sump tanks to alert the rator of abnormal situations.

NE Medical Technologies 7.3-17 Rev. 2

PICS receives input from the ESFAS and provides alarms for the RDS liquid detection ches (Subsection 7.5.4.1.9).

PICS directly monitors and provides alarms for RDS sump tank temperature and level.

trol Functions en manually initiated by the operator, the PICS executes a programmed sequence to transfer tion from the RDS sump tanks to another manually selected tank using the VTS. The PICS ns and closes the appropriate system isolation valves based on feedback from VTS lift tank l switches and the RDS sump tank level indication to accomplish the solution transfer.

n-progress solution transfer sequence can be manually aborted by the operator.

operator is able to use the PICS to manually open and close individual valves and manually t or stop individual components unless operation is prevented by interlocks, permissives, or ve sequences.

rlocks and Permissives PICS provides interlocks to prevent a vacuum transfer sequence from starting in the RDS p tanks when the temperature in the associated tank is above an allowable limit.

cation to the operator is provided on the PICS operator workstation displays when an rlock or permissive is bypassed.

1.3.4 Radioactive Liquid Waste Storage System ioactive liquid waste is stored in the RLWS, described in Subsection 9b.7.4. The PICS is d to monitor tank levels and temperatures, control the operation of system valves, and vide functionality to support administrative controls related to the transfer of radioactive liquid te between tanks using the VTS.

nitoring and Alarms PICS monitors and provides alarms for two diverse methods of level indication for the vidual RLWS tanks, temperature indication for the individual RLWS tanks, and status dback from the mixers provided in the blending and collection tanks.

trol Functions en manually initiated by the operator, the PICS executes a programmed sequence to transfer tion from a selected RLWS tank to another manually selected tank using the VTS. The PICS ns and closes the appropriate system isolation valves based on feedback from VTS lift tank l switches and RLWS tank and destination tank level indication to accomplish the solution sfer.

n-progress solution transfer sequence can be manually aborted by the operator.

NE Medical Technologies 7.3-18 Rev. 2

uum valves and sampling isolation valves to accomplish the sampling activity.

operator is able to use the PICS to manually open and close individual valves and manually t or stop individual components unless operation is prevented by interlocks, permissives, or ve sequences.

rlocks and Permissives PICS provides interlocks and permissives to:

Prevent a vacuum transfer sequence from starting in a RLWS tank when the temperature in the associated tank is above an allowable limit.

Prevent a vacuum transfer sequence from starting if the selected destination tank indicates level above an allowable limit.

Allow tank solution transfers to the second uranium liquid waste tank or to the liquid waste blending tanks only when uranium sampling results have been entered and verified to be within allowable limits and when an operations supervisor has verified the results.

cation to the operator is provided on the PICS operator workstation displays when an rlock or permissive is bypassed.

1.3.5 Radioactive Liquid Waste Immobilization System ioactive liquid waste is immobilized in the RLWI system, described in detail in section 9b.7.3. PICS interfaces with the RLWI vendor-provided nonsafety-related control tem for monitoring purposes only.

nitoring and Alarms PICS directly monitors and provides alarms for RLWI immobilization feed tank level and perature and RLWI feed pump discharge pressure and flow rate.

RLWI control system directly monitors the status of immobilization drum filling and mixing ipment, and various other system parameters. The RLWI control system provides a subset of se monitored parameters and the status of the system to the PICS for display on the local and trol room PICS workstations for generation of alarms.

trol Functions RLWI control system is used by the local operator to manually start and stop operations to sfer drums into and out of the enclosure, and to fill and mix drums of liquid waste to be dified.

RWLI control system is also used by the operator to manually control RLWI enclosure n-process) functions.

NE Medical Technologies 7.3-19 Rev. 2

section 7.3.1.3.4.

rlocks and Permissives PICS provides an interlock to prevent the transfer of liquid waste into the RLWI enclosure ss the RLWI control system provides indication that it is in a ready status.

cation to the operator is provided on the PICS local and control room operator workstation lays when an interlock or permissive is bypassed.

1.3.6 Tritium Purification System TPS, which supplies tritium to the neutron drivers located in the IUs, is described in section 9a2.7.1. The TPS consists of three separate, identical trains. Train A serves IU s 1 and 2; Train B serves IU cells 3, 4, and 5; and Train C serves IU cells 6, 7, and 8.

nitoring and Alarms PICS receives input from the ESFAS and provides alarms for the IU cell (NDAS) target mber supply and exhaust pressures (Subsections 7.5.4.1.10 and 7.5.4.1.11), TPS exhaust to lity stack tritium (Subsection 7.5.4.1.12), and TPS confinement tritium bsection 7.5.4.1.13).

PICS directly monitors and provides alarms for:

Glovebox pressure, helium flow, and dew point;

Target gas exhaust humidity;

Nonsafety-related tritium concentration at various points in the system;

Status feedback from TPS heaters; and

Various other system pressures, temperatures, dew points, and flows.

PICS also provides alarms for automatic or manual TPS Train A/B/C Isolations and TPS cess Vent Actuations described in Subsection 7.5.3.1.

trol Functions en initiated by the operator, the PICS executes programmed sequences to start or stop a TPS

n. The PICS opens and closes TPS valves to control the flow of gas through the TPS train and ween the separation columns. The PICS starts or stops pumps to transport process gas ugh the TPS and to circulate the TPS glovebox atmosphere. Temperature and pressure trol loops, listed below, are also enabled and disabled as applicable as part of the grammed sequence.

PICS provides automatic temperature control of permeators, depleted uranium storage s, oxide and hydride beds, and other TPS components by energizing and deenergizing the ter associated with each component.

NE Medical Technologies 7.3-20 Rev. 2

ociated with each component.

PICS provides control of glovebox pressures by opening and closing valves to add helium to glovebox or remove glovebox atmosphere to the zone 1 ventilation system.

en initiated by the operator, the PICS executes programmed sequences to start or stop gas ply to an individual NDAS unit. As part of the sequence, automatic control of valve positions is bled and disabled to maintain gas supply flow to each NDAS unit individually as selected by operator, and controls gas return flow pressure within an allowable pressure band.

en initiated by the operator, the PICS executes programmed sequences to perform other odic or maintenance tasks, including the addition of tritium from a depleted uranium storage to the process by energizing or deenergizing heaters, and the evacuation of process lines.

operator is able to use the PICS, either locally or remotely, to manually open and close vidual valves and manually start or stop individual components unless operation is prevented nterlocks, permissives, or active sequences. Components that are capable of being actuated TRPS or ESFAS are controlled by PICS as described in Subsection 7.3.1.3.11.

rlocks and Permissives PICS provides an interlock to prevent the introduction of tritium to an NDAS target chamber n the associated IU is not in Mode 2.

PICS also provides interlocks to prevent the initiation of certain TPS programmed uences while conflicting sequences are in progress.

1.3.7 Stack Release Monitoring System stack release monitoring system (SRMS) consists of a stack release monitor (SRM) and a bon delay bed effluent monitor (CDBEM) to monitor gaseous effluents from the main duction facility. The SRMS is described in Subsection 7.7.5.

nitoring and Alarms PICS provides monitoring and alarms for SRM noble gas activity, pressure, flow, and mass rate, and CDBEM noble gas activity and mass flow rate.

trol Functions e

rlocks and Permissives e

NE Medical Technologies 7.3-21 Rev. 2

radiation area monitoring system (RAMS) provides radiation monitoring within the main duction facility where personnel may be present and radiation levels could become ificant, as described in Subsection 7.7.3.

nitoring and Alarms PICS provides monitoring and alarms for the radiation level associated with each RAMS

. The PICS additionally provides alarms for communication errors and loss of power for each MS unit.

trol Functions e

rlocks and Permissives e

1.3.9 Continuous Air Monitoring System continuous air monitoring system (CAMS) provides airborne radiation monitoring within the n production facility, either alpha and beta activities for airborne particulates or beta activities airborne tritium, as described in Subsection 7.7.4.

nitoring and Alarms PICS provides monitoring and alarms for the contamination level associated with each MS unit. The PICS additionally provides alarms for communication errors and loss of power each CAMS unit.

trol Functions e

rlocks and Permissives e

1.3.10 Quality Control and Analytical Testing Laboratory main production facility contains two laboratories to provide analytical testing support as cribed in Subsection 9b.5.4.

nitoring and Alarms PICS monitors and provides alarms for fume hood air flow rates.

NE Medical Technologies 7.3-22 Rev. 2

e rlocks and Permissives e

1.3.11 Target Solution Vessel Reactivity Protection System and Engineered Safety Features Actuation System TRPS and ESFAS are the safety-related control systems for the main production facility, as cribed in Sections 7.4 and 7.5, respectively.

ety-related radiation monitors are also within the scope of the TRPS and ESFAS, as cribed in Subsection 7.7.1. These components are used to monitor radiation in the ological ventilation (RV) system and are discussed in Subsection 7.3.1.4.5 nitoring and Alarms PICS receives input from the TRPS and ESAFS and provides alarms related to the status functionality of the safety-related control systems (e.g., communication errors, faulted dules, failed power supplies).

trol Functions PICS provides signals to the TRPS and ESFAS to provide normal control of components are capable of being actuated by TRPS or ESFAS. Control signals from the PICS are only epted by the TRPS and ESFAS when the associated enable nonsafety switch located on the n control board is in the enable position. Details of the control signals provided by PICS are cribed in Subsections 7.4.3.4 and 7.5.3.3.

rlocks and Permissives e

1.4 Other Facility Systems PICS provides the automated control and operator interface to manually control aspects of facility auxiliary and electrical systems.

1.4.1 Normal Electrical Power Supply System normal electrical power supply system (NPSS) is the normal electrical power supply for the NE facility, as described in Subsection 8a2.1.3. The NPSS provides normal power to the S, and the PICS provides monitoring, control, and alarms for the NPSS as described in this tion.

PICS remains operational through the use of local PICS power supplies upon a loss of site power for a minimum of 10 minutes (Subsection 7.3.3.6).

NE Medical Technologies 7.3-23 Rev. 2

PICS provides monitoring and alarms for voltage, current, frequency, and power for each n electrical service branch for the SHINE facility. The PICS additionally provides status cation (closed, open, or trip) and alarms for main service breakers, switchgear breakers, and reakers, as well as safety-related equipment breakers (i.e., NDAS HVPS breakers, VTS uum pump breakers, MEPS extraction pump breakers, and RVZ1 exhaust subsystem Z1e] exhaust, RVZ2 exhaust subsystem [RVZ2e] exhaust, and RVZ2 supply subsystem Z2s] supply fan breakers), and alarms for main service breaker undervoltage, overvoltage, se reversal, loss of phase, out of frequency, or loss of utility power.

trol Functions PICS provides the operator the ability to manually open or close the main service breakers, reakers, switchgear breakers, and the NDAS HVPS breakers.

PICS automatically disconnects the on-site electric power systems from the utility by ning the affected main service breaker on undervoltage, overvoltage, phase reversal, or loss hase.

rlocks and Permissives PICS provides interlocks to prevent a main service breaker and the tie breaker for that same vice from being closed simultaneously, to prevent paralleling two AC power sources.

1.4.2 Uninterruptible Electrical Power Supply System uninterruptible electrical power supply system (UPSS) provides safety-related power for the n production facility, as described in Subsection 8a2.2.3.

nitoring and Alarms PICS receives input from the ESFAS and provides alarms for UPSS loss of external power bsection 7.5.4.1.19).

PICS directly monitors and provides alarms for battery room and UPS equipment room peratures, battery room hydrogen concentration, battery charge level, battery charger ent, inverter bypass status, inverter current, and various other system parameters for both sions of the UPSS. The PICS also provides alarms for fault conditions of UPSS components

., battery fault, battery charger fault, UPS fault, DC bus ground) and unexpected system nments (e.g., battery charger breakers open, bypass transformer breakers open, inverter ass breaker closed, load breakers open).

trol Functions e

rlocks and Permissives e

NE Medical Technologies 7.3-24 Rev. 2

SGS provides nonsafety-related backup power for the SHINE facility, as described in section 8a2.2.6. The SGS generator includes a vendor-provided nonsafety-related controller.

nitoring and Alarms PICS provides monitoring and alarms for SGS voltage, current, and power. The internal dor-provided SGS generator controller additionally monitors for generator status and faults, uding oil pressure, water temperature, engine temperature, fuel pressure, coolant level, rcrank or overspeed conditions, and other generator parameters. The SGS controller vides a subset of these monitored parameters to the PICS for display and alarming.

trol Functions PICS provides the operator the ability to manually start or stop the generator by providing a al to the SGS automatic transfer switch(es), and to manually transfer loads between the erator and the off-site utility by opening and closing breakers.

SGS generator controller automatically starts the generator in response to a loss of off-site er event. PICS automatically sequences the loads onto the generator.

rlocks and Permissives generator automatic transfer switch design prevents paralleling the generator with either vice entrance.

1.4.4 Nitrogen Purge System N2PS provides a backup supply of sweep gas to each IU and to all tanks normally ventilated he PVVS during a loss of normal power or loss of normal sweep gas flow. The off-gas ulting from the nitrogen purge is treated by passive PVVS equipment prior to being harged to the stack. The N2PS is described in Subsections 6b.2.3 and 9b.6.2.

nitoring and Alarms PICS monitors and provides alarms for N2PS storage tube pressures, N2PS flows, and gen concentration in the N2PS structure general area.

PICS also provides alarms for automatic or manual IU Cell Nitrogen Purge and RPF ogen Purge described in Subsection 7.5.3.1.

trol Functions operator is able to use the PICS to manually open and close individual valves that are able of being actuated by TRPS or ESFAS, as described in Subsection 7.3.1.3.11.

rlocks and Permissives e

NE Medical Technologies 7.3-25 Rev. 2

RV systems are constant volume systems that include supply air, recirculating, and exhaust systems required to condition the air and provide the confinement and isolation needed to gate design basis accidents, as described in Section 9a2.1. The main production facility uses e ventilation zones and five subsystems in the radiologically controlled area (RCA) to ntain the temperature and humidity of the RCA and to maintain a pressure gradient from as of least potential for contamination to areas with the most potential for contamination:

RVZ1

RVZ1 recirculating subsystem (RVZ1r)

RVZ1e

RVZ2

RVZ2e

RVZ2s

RVZ2 recirculating subsystem (RVZ2r)

RVZ3 RV systems interface with the vendor-provided building automation system.

nitoring and Alarms PICS receives input from the ESFAS and provides alarms for RVZ1 and RVZ2 RCA exhaust ation (Subsection 7.5.4.1.1), RVZ1 supercell radiation in all 10 supercell areas bsection 7.5.4.1.2 through Subsection 7.5.4.1.5), and RVZ1e IU cell radiation for each IU bsection 7.4.4.1.5).

building automation system continuously monitors hot water supply and return peratures, chilled water supply and return temperatures, unit mixed air temperature, and harge air temperature for the RVZ2s air handling units. The building automation system also nitors system flow rates and various other system parameters. The building automation tem provides a subset of the monitored variables to PICS for display and alarming.

PICS directly monitors and provides alarms for:

RVZ1r IU cell and TOGS cell flows, temperatures, differential pressures, and status feedback from blowers,

RVZ1e filter bank differential pressures and status feedback from blowers,

RVZ2e filter bank differential pressures and status feedback from blowers,

RVZ2r area temperatures, and status feedback from blowers and fans, and

RVZ3 differential pressures.

PICS also provides alarms for automatic or manual Supercell Isolation and RCA Isolation cribed in Subsection 7.5.3.1.

trol Functions en manually initiated by the operator, the building automation system provides automatic trol of RVZ2s air handling units, RVZ1e and RVZ2e exhaust fans, make-up air supply, and position of dampers to maintain the air pressure cascade from areas with the least potential NE Medical Technologies 7.3-26 Rev. 2

ition of hot water heating and chilled water-cooling control valves.

en manually initiated by the operator, the PICS executes a programmed sequence to start or the RVZ1r subsystem for a selected IU by verifying dampers are in the correct position and bling or disabling RVZ1r automatic temperature control. The PICS maintains temperature in an allowable band by controlling the position of RPCS cooling water valves for the RVZ1r handling units.

en manually initiated by the operator, the PICS executes a programmed sequence to start or the RVZ1e subsystem by verifying dampers are in the correct position and enabling or bling RVZ1e automatic pressure control. The PICS maintains pressure within an allowable d by controlling the operation of the variable speed RVZ1e blowers.

en manually initiated by the operator, the PICS executes a programmed sequence to start or the RVZ2r subsystem by verifying dampers are in the correct position and enabling or bling RVZ2r automatic temperature control. The PICS maintains temperatures within an wable band by controlling the position of RPCS cooling water valves for the RVZ2r air dling units starting and stopping the RVZ2r RPCS pumps.

operator is able to use the PICS to provide limited start and stop commands to building omation system control sequences. The operator may also use the PICS to manually open close individual valves and dampers and manually start or stop individual components ctly controlled by the PICS unless operation is prevented by interlocks, permissives, or active uences. Components that are capable of being actuated by TRPS or ESFAS are controlled PICS as described in Subsection 7.3.1.3.11.

rlocks and Permissives PICS provides interlocks and permissives to prevent operation of fans or blowers where the ociated discharge damper is closed.

1.4.6 Facility Ventilation System facility ventilation system (FVZ4) is a variable air volume system that provides heating, tilation, and cooling to the non-RCAs of the main production facility, as described in tion 9a2.1. FVZ4 interfaces with the vendor-provided building automation system.

nitoring and Alarms building automation system continuously monitors hot water supply and return peratures, chilled water supply and return temperatures, unit mixed air temperature, and harge air temperature for the RVZ2s air handling units. The building automation system also nitors system flow rates and various other system parameters. The building automation tem provides a subset of the monitored variables to PICS for display and alarming.

NE Medical Technologies 7.3-27 Rev. 2

en manually initiated by the operator, the building automation system provides automatic trol of FVZ4 air handling units, exhaust fans, make-up air supply, and the position of pers. The building automation system controls supply air temperature and humidity by dulating the position of hot water heating and chilled water-cooling control valves, or when door conditions allow for free cooling, by adjusting the percentage of outside air supplied as ke-up.

operator is able to use the PICS to provide limited start and stop commands to building omation system control sequences.

rlocks and Permissives e

1.4.7 Facility Chilled Water System FCHS includes air cooled chillers and distribution pumps and provides chilled water to the n production facility RVZ2s and FVZ4 supply air handling units. The FCHS is described in section 9a2.1.3. FCHS interfaces with the vendor-provided building automation system.

nitoring and Alarms building automation system continuously monitors and provides alarms leaving chilled water peratures of chillers, return chilled water temperature, chiller flow rates, system pressure, and trol valve positions. The building automation system provides a subset of the monitored ables to PICS for display and alarming in the facility control room.

trol Functions en manually initiated by the operator, the building automation system provides automatic trol of the FCHS temperature. Each FCHS chiller is provided with an integral controller that trols onboard operations (e.g., capacity control and safeties) and requires a signal from ding automation system to engage or disable the chiller. If temperature requirements are not

, the building automation system enables or disables redundant chillers as necessary to ntain FCHS temperature.

building automation system provides automatic control to enable and disable primary pumps equired to maintain loop flow rates between minimum and maximum chiller flow rates while ntaining real-time response to air handling unit load changes.

rlocks and Permissives e

1.4.8 Facility Heating Water System FHWS includes boilers and distribution pumps and provides heating water to the main duction facility RVZ2s and FVZ4 supply air handling units and to various terminal hot water NE Medical Technologies 7.3-28 Rev. 2

nitoring and Alarms building automation system continuously monitors and provides alarms for leaving hot water peratures of boilers, return hot water temperature, hot water flow rates, and control valve itions. The building automation system provides a subset of the monitored variables to PICS display and alarming in the facility control room.

trol Functions en manually initiated by the operator, the building automation system provides automatic trol of the FHWS temperature. Each FHWS boiler is provided with an integral controller that trols onboard operations (e.g., capacity control and safeties) and requires a signal from ding automation system to engage or disable the boiler. If temperature requirements are not

, the building automation system enables or disables redundant boilers as necessary to ntain FHWS temperature.

building automation system provides automatic control to enable and disable primary pumps equired to maintain loop flow rates between minimum and maximum boiler flow rates while ntaining real-time response to connected load changes.

rlocks and Permissives e

1.4.9 Radioisotope Process Facility Cooling Water System RPCS includes a heat exchanger cooled by the PCHS and primary RPCS distribution ps, and provides cooling to various main production facility loads as described in tion 5a2.3. RPCS interfaces with the vendor-provided building automation system.

nitoring and Alarms building automation system continuously monitors and provides alarms for leaving chilled er temperature from the RPCS heat exchanger, return chilled water temperature, system flow s, system pressure, and control valve positions. The building automation system provides a set of the monitored variables to PICS for display and alarming in the facility control room.

trol Functions en manually initiated by the operator, the building automation system maintains RPCS heat hanger flow within an allowable band by enabling and disabling the primary RPCS distribution ps and controlling the position of RPCS valves.

operator is able to use the PICS to provide limited start and stop commands to building omation system control sequences.

NE Medical Technologies 7.3-29 Rev. 2

e 1.4.10 Process Chilled Water System PCHS includes air cooled chillers and distribution pumps and provides chilled water to the CS heat exchanger. The PCHS is described in Section 5a2.4. PCHS interfaces with the dor-provided building automation system.

nitoring and Alarms building automation system continuously monitors and provides alarms for leaving chilled er temperatures of chillers, return chilled water temperature, chiller flow rates, system ssure, and control valve positions. The building automation system provides a subset of the nitored variables to PICS for display and alarming in the facility control room.

trol Functions en manually initiated by the operator, the building automation system provides automatic trol of the PCHS temperature. Each PCHS chiller is provided with an integral controller that trols all onboard operations (e.g., capacity control and safeties) and requires a signal from ding automation system to engage or disable the chiller. If temperature requirements are not

, the building automation system enables or disables redundant chillers as necessary to ntain PCHS temperature.

building automation system provides automatic control to enable and disable primary pumps equired to maintain loop flow rates between minimum and maximum chiller flow rates while ntaining real-time response to changes in RPCS heat exchanger load.

rlocks and Permissives e

1.4.11 Facility Nitrogen Handling System FNHS provides gaseous and liquid nitrogen to various systems in the main production lity, as described in Subsection 9b.7.8. The FNHS unit contains an integral vendor-provided troller.

nitoring and Alarms PICS provides monitoring and alarms for main production facility general area oxygen centration and nitrogen pressure in nitrogen receivers for end users.

FNHS unit contains an integral controller that monitors system status (e.g., vaporizer status tank level) and provides a subset of monitored parameters to the PICS for display and ming.

NE Medical Technologies 7.3-30 Rev. 2

operator is able to use the PICS to provide limited start and stop commands to the FNHS gral controller and to manually open and close individual valves.

rlocks and Permissives e

1.4.12 Facility Chemical Reagent System portion of the facility chemical reagent system (FCRS) that interfaces with the PICS provides eous oxygen to the TOGS, as described in Subsection 9b.7.10 nitoring and Alarms PICS provides monitoring and alarms for pressure in oxygen receivers for end users.

trol Functions e

rlocks and Permissives e

1.4.13 Facility Demineralized Water System FDWS provides demineralized water to various systems in the main production facility as cribed in Section 5a2.6. The FDWS RO unit contains an integral vendor-provided controller.

nitoring and Alarms FDWS RO unit contains an integral controller that monitors system status (e.g., storage tank l) and provides a subset of monitored parameters to the PICS for display and alarming.

trol Functions operator is able to use the PICS to provide limited start and stop commands to the RO unit gral controller and to manually open and close individual valves.

rlocks and Permissives e

1.4.14 Seismic Monitoring System PICS contains a seismic monitoring system, which includes instrumentation, control inets, and a dedicated computer for monitoring seismic activity in the safety-related portion of facility. The seismic monitoring system provides event recording time histories for seismic NE Medical Technologies 7.3-31 Rev. 2

puter or via the operator workstation in the facility control room.

nitoring and Alarms PICS provides monitoring and alarms for the acceleration status of the seismic monitors ted in the main production facility.

trol Functions e

rlocks and Permissives e

2 DESIGN CRITERIA SHINE facility design criteria applicable to the PICS are stated in Table 3.1-2. The facility ign criteria applicable to the PICS, and the PICS system design criteria, are addressed in this tion. Discussion of other vendor-provided nonsafety-related control systems is also provided, re applicable.

2.1 SHINE Facility Design Criteria NE facility design criterion 13 applies to the PICS.

SHINE Design Criterion 13 - Instrumentation is provided to monitor variables and systems over their anticipated ranges for normal operation, for anticipated transients, and for postulated accidents as appropriate to ensure adequate safety, including those variables and systems that can affect the fission process, the integrity of the primary system boundary, the primary confinement and its associated systems, and the process confinement boundary and its associated systems. Appropriate controls are provided to maintain these variables and systems within prescribed operating ranges.

PICS interfaces with the safety-related TRPS, ESFAS, NFDS, and safety-related radiation nitors to provide nonsafety-related system status and measured process variable values for wing, recording, and trending. The TRPS, ESFAS, NFDS, and safety-related radiation nitors and applicable operating ranges are described in Sections 7.4, 7.5, 7.7, and 7.8. The S is designed to operate in a normal environment and during normal radiological conditions bsection 7.3.3.3).

2.2 PICS System Design Criteria 2.2.1 Access Control PICS Criterion 1 - The PICS design shall incorporate design or administrative controls to prevent/limit unauthorized physical and electronic access to critical digital assets (CDAs) during the operational phase, including the transition from development to operations. CDAs NE Medical Technologies 7.3-32 Rev. 2

PICS and other vendor-provided nonsafety-related control systems do not allow remote ess and include the capability to disable unneeded networks, communication ports, and ovable media drives or provide engineered barriers (Subsection 7.3.3.5). Physical access to SHINE facility is controlled in accordance with the physical security plan. Physical access to control room and access to the equipment within is controlled as described in section 7.6.3.4.

2.2.2 Software Requirements Development PICS Criterion 2 - A structured process, which is commensurate with the risk associated with its failure or malfunction and the potential for the failures challenging safety systems, shall be used in developing software for the PICS.

PICS is developed under a structured process commensurate with the risk associated with ailure or malfunction, as described in Subsection 7.3.3.4. The development of other vendor vided nonsafety-related control systems is also described in Subsection 7.3.3.4.

PICS Criterion 3 - The PICS software development lifecycle process requirements shall be described and documented in appropriate plans which shall address verification and validation (V&V) and configuration control activities.

PICS is developed in accordance with the PICS validation master plan, which addresses V and configuration control activities, as described in Subsection 7.3.3.4. The development of er vendor-provided nonsafety-related control systems is also described in Subsection 7.3.3.4.

PICS Criterion 4 - The configuration control process shall assure that the required PICS hardware and software are installed in the appropriate system configuration and ensure that the correct version of the software/firmware is installed in the correct hardware components.

PICS validation master plan assures that the required PICS hardware and software are alled in the appropriate system configuration and ensures that the correct version of the dware/firmware is installed in the correct hardware components as described in section 7.3.3.4. Configuration control of other vendor-provided nonsafety-related control tems is also described in Subsection 7.3.3.4.

2.2.3 Fail Safe PICS Criterion 5 - The PICS shall assume a defined safe state with loss of electrical power to the PICS.

mponents controlled by the PICS assume a defined safe state on loss of electrical power bsection 7.3.3.6).

2.2.4 Effects of Control System Operation/Failures PICS Criterion 6 - The PICS shall be designed so that it cannot fail or operate in a mode that could prevent the TRPS or ESFAS from performing its designated functions.

NE Medical Technologies 7.3-33 Rev. 2

sections 7.4.3.4 and 7.5.3.3. Other vendor-provided nonsafety-related control systems do provide input to the TRPS or ESFAS.

2.2.5 Operational Bypass PICS Criterion 7 - Bypasses of PICS interlocks, including provisions for testing, shall be under the direct control of a control room operator and shall be indicated on control room displays.

assing of interlocks is performed from the PICS workstations under the direct control of the trol room operator. Bypassing an interlock generates a notification that is visible on the PICS kstation displays (Subsection 7.3.4.2). Interlocks applicable to each system served by the S are described in Subsection 7.3.1.

2.2.6 Surveillance PICS Criterion 8 - Subsystems of and equipment in the PICS shall be designed to allow testing, calibration, and inspection to ensure functionality.

ting, calibration and inspection of PICS equipment are allowable to ensure functionality as cribed in Subsection 7.3.4.2.

PICS Criterion 9 - Testing, calibration, and inspections of the PICS shall be sufficient to confirm that surveillance test and self-test features address failure detection, self-test capabilities, and actions taken upon failure detection.

ting, calibration, and inspection of PICS equipment are described in Subsection 7.3.4.2.

3 DESIGN BASIS 3.1 Design Basis Functions PICS is designed to allow the operator to perform irradiation cycles, transfer target solution nd from the IU as well as through the main production facility, and interface with the TPS, ercell, waste handling, and auxiliary systems, as described in Subsection 7.3.1.

PICS contains no safety-related controls and has no safety-related functions; however, the ty-related TRPS, ESFAS, NFDS, and safety-related radiation monitors provide nonsafety-ted system status and measured process variable values to the PICS for viewing, recording, trending. The PICS is also used to transmit discrete hardwired signals to the TRPS and FAS for deliberate operator action to return the TRPS or ESFAS to a normal operating state.

3.2 Modes of Operation modes of operation for the functions of the PICS that interface with individual IUs correspond he mode of that IU (see Subsection 7.3.1). Portions of the PICS that monitor or control mon or facility-wide systems are not mode-dependent.

NE Medical Technologies 7.3-34 Rev. 2

PICS control cabinets are located in the non-RCAs of the main production facility and PICS ponents are in various plant areas with varying environmental conditions. The PICS is igned for the normal environmental and radiological conditions provided in Tables 7.2-1 ugh 7.2-6.

3.4 Software Development PICS is developed under a structured process commensurate with the risk associated with ailure or malfunction and the potential for challenging safety systems. The process for elopment of the PICS includes the definition of functional requirements, a documented elopment and implementation process, and a plan for verification of software outputs.

PICS software development lifecycle process requirements, including V&V and configuration trol requirements to ensure that hardware and software are installed in the appropriate tem configuration and ensure that the correct version of the software/firmware is installed in correct hardware components, are described in the PICS validation master plan. The PICS dation master plan additionally includes provisions for operational qualification testing to fy the operation and functionality of various aspects of the PICS, including operator graphics uracy and functionality, security, interface communications, interlock functionality, and control c operation and failure monitoring and handling.

dor-provided nonsafety-related control systems are developed under structured processes mensurate with the risk associated with their failure or malfunction and the potential for llenging safety systems.

process for development of the NDAS control system includes the definition of functional uirements, a documented development and implementation process, and a plan of fication of software outputs. The NDAS control system software development lifecycle cess requirements, including V&V and configuration control requirements to ensure that dware and software are installed in the appropriate system configuration and ensure that the ect version of the software/firmware is installed in the correct hardware components, are cribed in the NDAS vendor software quality assurance plan.

h the PICS and NDAS control systems are subject to acceptance by SHINE as part of factory eptance testing, site acceptance testing, and system turnover processes.

er vendor-provided nonsafety-related control systems, which include the building automation tem, the supercell control system, and the RLWI control system, are independently developed he vendor, and accepted by SHINE as part of factory acceptance testing, site acceptance ing, and system turnover.

3.5 Access Control and Cyber Security PICS and other vendor-provided nonsafety-related control systems do not use the secure elopment and operating environment implemented for the safety-related control systems cribed in Subsection 7.4.5, but rather incorporate features commensurate with the risk and gnitude of the harm that would result from unauthorized and inappropriate access, use, losure, disruption, or destruction of this nonsafety-related control system.

NE Medical Technologies 7.3-35 Rev. 2

kstations, main control board, PICS display cabinet, and other PICS controllers and cabinets a location with less physical security.

PICS and other vendor-provided nonsafety-related control systems include the capability to ble, through software or physical disconnection, unneeded networks, communication ports, removable media drives, or provide engineered barriers.

PICS and other vendor-provided nonsafety-related control systems do not use any wireless rface capabilities for control functions.

PICS provides information to the facility data and communications system (FDCS) networks equipment via a one-way data diode, such that no inputs can be provided to the PICS from site sources.

dor-provided nonsafety-related control systems communicate with the PICS via ethernet or er industry standard digital communication protocols.

urity requirements imposed on the PICS during the development phase are commensurate the risk and magnitude of the harm that would result from unauthorized and inappropriate ess, use, disclosure, disruption, or destruction. Security requirements for the PICS elopment include limiting access to the software to those individuals involved in the PICS elopment project.

urity requirements imposed on the vendor-provided nonsafety-related control systems during development phase are commensurate with the risk and magnitude of the harm that would ult from unauthorized and inappropriate access, use, disclosure, disruption, or destruction.

urity requirements for the NDAS control system include limiting access to the software to e individuals employed by the NDAS vendor and other individuals involved in the NDAS trol system development project.

special security requirements are imposed on the vendors for other nonsafety-related control tems, which include the building automation system, the supercell control system, and the WI control system, as these systems are not considered part of the control console and lay instruments.

3.6 Loss of Power PICS design includes local battery supplies sufficient to allow the PICS to continue to rate for at least 10 minutes after a loss of external power. The 10-minute design supports ting and loading the defense-in-depth SGS within five minutes following a loss of off-site er event (Section 8a2.2).

mponents controlled by the PICS assume a defined safe state on loss of electrical power.

NE Medical Technologies 7.3-36 Rev. 2

4.1 System Operation PICS is designed to operate under normal facility conditions and anticipated transients to ure adequate safety for the facility.

4.2 Testing and Maintenance S initial hardware testing is performed in accordance with the PICS validation master plan.

dware testing is to be performed on the control cabinets, the localized I/O cabinets and the I panels, the operator workstations, and the main control board.

design of the PICS allows operators to remove main control board or operator workstation lays from service without impacting the operation of the remaining portions of the PICS.

PICS is designed to allow testing, calibration, and inspection to ensure functionality, and udes features for failure detection and self-test capabilities.

S controllers and I/O panels are located in general areas of the SHINE facility and are essible for inspection.

PICS has in-service self-testing capabilities such that the system will alarm if individual ts or an entire rack or cabinet lose communications or faults.

h PICS analog I/O module has status indicators that display module status. The PICS analog modules allow for calibration on a channel-by-channel or module-wide basis.

safety-related interlocks are provided in the PICS as described in Subsection 7.3.1.

assing of interlocks is performed from the PICS workstations under the direct control of the trol room operator. Bypassing an interlock generates an alarm that is visible on the PICS kstation displays.

4.3 Technical Specifications and Surveillance PICS contains no safety-related controls and has no safety-related functions; however, the S monitors parameters and provides control room alarms.

tain material in this section provides information that is used in the technical specifications.

includes limiting conditions for operation, setpoints, design features, and means for omplishing surveillances. In addition, significant material is also applicable to, and may be renced by, the bases that are described in the technical specifications.

5 CONCLUSION PICS is designed to allow the operator to perform facility activities in a safe and efficient nner. The PICS contains no safety-related controls and has no safety-related functions; ever, the PICS interfaces with the safety-related TRPS, ESFAS, NFDS, and safety-related ation monitors to provide nonsafety-related system status and measured process variable es for viewing, recording, and trending. Other vendor-provided nonsafety-related control NE Medical Technologies 7.3-37 Rev. 2

PICS and other vendor-provided nonsafety-related control systems do not use the highly grated protection system (HIPS) design, but instead are developed under structured cesses commensurate with the risk associated with each systems failure or malfunction.

NE Medical Technologies 7.3-38 Rev. 2

Chapter 7 - Instrumentation and Control Systems Process Integrated Control System Figure 7.3 Process Integrated Control System Architecture Control Room PLC Cabinet Supercell and Ancillary Target Solution IU Cell PLC Utilities PLC Equipment PLC Transfer PLC IU Cell #8 IU Cell #7 IU Cell #6 IU Cell #5 Facility Facility IU Cell #4 IU Cell #3 IU Cell #2 IU Cell #1 Overview Overview Overview Overview Process Process Overview Overview Overview Overview FNHS Controls Server Cabinet NDAS Workstation Operator Workstation FDWS Controls Supervisor Workstation Rack-Mounted Switch NDAS Workstation Operator Workstation Seismic Monitoring Building NDAS Supercell Control RLWI Control Automation Control System System System System Key Cabinet Cabinet Cabinet Cabinet Cabinet ESFAS - engineered safety features actuation system Workstation TSSS TSSS / RLWS RPCS / NPSS IU Cell 7-8 IU Cell 1-4 FDWS - facility demineralized water system RLWI Area FNHS - facility nitrogen handling system HC - hot cell IU - irradiation unit Cabinet Cabinet Cabinet Cabinet Cabinet IXP - Iodine and xenon purification and packaging TSSS TSSS / RLWS UPSS/ESFAS/TRPS IU Cell 5-6 IU Cell 5-8 MEPS - molybdenum extraction and purification system Workstation MIPS - molybdenum isotope product packaging system Supercell A Area N2PS - nitrogen purge system Cabinet NDAS - neutron driver assembly system Cabinet Cabinet Cabinet Cabinet MEPS/IXP/MIPS/ NPSS - normal electrical power supply system PVVS N2PS IU Cell 3-4 RCA VTS/HC PLC - programmable logic controller PVVS - process vessel vent system Workstation RCA - radiologically controlled area Supercell B Area Cabinet Cabinet Cabinet Cabinet RDS - radioactive drain system RDS LABS/TSPS/URSS SGS IU Cell 1-2 RLWI - radioactive liquid waste immobilization system RLWS - radioactive liquid waste storage system RPCS - radioisotope process facility cooling system SGS - standby generator system Workstation Cabinet Cabinet Cabinet Supercell C Area TPS - tritium purification system TPS TPS TPS TRPS - target solution vessel reactivity protection system TS - target solution TSPS - target solution preparation system TSSS - target solution staging system Workstation Workstation Workstation Workstation UPSS - uninterruptible electrical power supply system TPS Area TPS Area TPS Area TS Prep Area URSS - uranium receipt and storage system VTS - vacuum transfer system SHINE Medical Technologies 7.3-39 Rev. 2

1 SYSTEM DESCRIPTION target solution vessel (TSV) reactivity protection system (TRPS) is a safety-related rumentation and control (I&C) system consisting of eight independent instances, or systems, each dedicated to one of the eight irradiation units (IU) in the SHINE irradiation lity.

TRPS performs various design basis safety functions as required by the SHINE safety lysis described in Chapter 13 for accelerator-based irradiation processes taking place within h IU cell. While operating, the TRPS performs various detection, logic processing, control, actuation functions associated with the SHINE irradiation process. The TRPS includes t/output capabilities necessary to interface with various indications and control components ted within the facility control room. The TRPS also provides nonsafety-related system status measured process variable values to the process integrated control system (PICS) for wing, recording, and trending.

TRPS monitors variables important to the safety functions of the irradiation process during h operating mode of the IU to perform one or more of the following safety functions:

IU Cell Safety Actuation

IU Cell Nitrogen Purge

IU Cell Tritium Purification System (TPS) Actuation

Driver Dropout TRPS also performs the nonsafety defense-in-depth Fill Stop function.

TRPS monitors the IU cell from filling of the TSV through irradiation of the target solution, ping of the target solution, and transfer of the target solution to the radioisotope production lity (RPF). All advances to the modes of operation throughout the irradiation process are nually initiated by the operator and the TRPS implements the required mode-specific system rlocks and bypasses; however, the TRPS does not automatically determine the mode of ration. If at any point during the irradiation process a monitored variable indicating unsafe ditions exceeds its setpoint, the TRPS automatically places the IU into a safe state. The PS logic diagrams are shown in Figure 7.4-1.

TRPS uses redundant and independent sensors through three divisions to complete the cal decisions necessary to initiate the required protective trips and actuations. When a TRPS t channel exceeds a predetermined limit, the trip determinations from each division of the PS are sent to voting logic where a two-out-of-three coincident logic vote is performed to ate a trip or actuation. The general architecture of the TRPS is shown in Figure 7.1-2.

TRPS is designed using the highly integrated protection system (HIPS) platform, which is cribed in Subsection 7.4.5. TRPS equipment is separated into three divisions (A, B, and C).

TRPS redundantly receives safety-related inputs from field instrumentation (input devices) to er two divisions (A and B) or all three divisions, dependent on the input variable. The input als are provided to the TRPS safety function modules (SFMs) or, in the case of the TSV fill e position indication, to a hardwired module (HWM). More than one input device provides a al to each SFM. The inputs are allocated to the different SFMs (or HWM) within a division as NE Medical Technologies 7.4-1 Rev. 2

ociated trip/bypass switch located below the SFM, as described in Subsection 7.4.4.3.

cing an SFM in trip or bypass causes all channels associated with that SFM to be placed in or bypass, respectively.

TRPS bypass logic is implemented in all three divisions using scheduling, bypass, and ng modules (SBVMs), for divisions A and B, or scheduling and bypass modules (SBMs), for sion C. The TRPS voting and actuation logic is implemented in only divisions A and B. For sions A and B, the three SBVMs, in each division, generate actuation signals when the SFMs ny two of the three divisions determine that an actuation is required. Both TRPS divisions A B evaluate the input signals from the SFMs in each of three redundant SBVMs. Each SBVM pares the inputs received from the SFMs and generates an appropriate actuation signal if uired by two or more of the three divisions.

output of the three redundant SBVMs in divisions A and B is communicated via three pendent safety data buses to the associated equipment interface modules (EIMs). There are independent EIMs for each actuation component, associated with each division A and B of PS. The EIMs compare inputs from the three SBVMs and initiate an actuation if two out of e signals agree on the need to actuate. Both EIMs associated with a component are required e deenergized for the actuation component(s) to fail to their actuated (deenergized) states.

2 DESIGN CRITERIA SHINE facility design criteria applicable to the TRPS are stated in Table 3.1-1. The facility ign criteria applicable to the TRPS, and the TRPS system design criteria, are addressed in section.

2.1 SHINE Facility Design Criteria NE facility design criteria 13 through 19, 38, and 39 apply to the TRPS.

2.1.1 Instrumentation and Controls SHINE Design Criterion 13 - Instrumentation is provided to monitor variables and systems over their anticipated ranges for normal operation, for anticipated transients, and for postulated accidents as appropriate to ensure adequate safety, including those variables and systems that can affect the fission process, the integrity of the primary system boundary, the primary confinement and its associated systems, and the process confinement boundary and its associated systems. Appropriate controls are provided to maintain these variables and systems within prescribed operating range.

TRPS monitored variables for performance of design basis functions are presented in le 7.4-1 and include the instrument range for covering normal and accident conditions, the uracy for each variable, and the analytical limit. Operation of the TRPS in response to the lyzed events is presented in Subsection 7.4.4.1.

NE Medical Technologies 7.4-2 Rev. 2

SHINE Design Criterion 14 - The protection systems are designed to: (1) initiate, automatically, the operation of appropriate systems to ensure that specified acceptable target solution design limits are not exceeded as a result of anticipated transients; and (2) sense accident conditions and to initiate the operation of safety-related systems and components.

ration of the TRPS in response to the analyzed events is presented in Subsection 7.4.4.1.

section describes the automatic system response to actuation setpoints in monitored ables.

2.1.3 Protection System Reliability and Testability SHINE Design Criterion 15 - The protection systems are designed for high functional reliability and inservice testability commensurate with the safety functions to be performed.

Redundancy and independence designed into the protection systems are sufficient to ensure that: (1) no single failure results in loss of the protection function, and (2) removal from service of any component or channel does not result in loss of the required minimum redundancy unless the acceptable reliability of operation of the protection system can be otherwise demonstrated. The protection systems are designed to permit periodic testing, including a capability to test channels independently to determine failures and losses of redundancy that may have occurred.

h functional reliability is addressed in SHINE Design Criterion 19. The HIPS design rporates predictability and repeatability principles to ensure an extremely high probability of omplishing safety functions (Subsection 7.4.5.2.3).

TRPS contains capabilities for inservice testing for those functions that cannot be tested e the IU is out of service (Subsection 7.4.4.4).

TRPS design utilizes functional independence. Structures, systems, and components that prise a division are physically separated to retain the capability of performing the required ty functions during a design basis accident (Subsection 7.4.5.2.1).

TRPS consists of three divisions of input processing and trip determination and two divisions ctuation logic arranged such that no single failure can prevent a safety actuation when uired, and no single failure in a single measurement channel can generate an unnecessary ty actuation (Subsection 7.4.3.4). A single failure analysis of the TRPS was performed in ordance with Institute of Electrical and Electronics Engineers (IEEE) Standard 379-2000 E, 2000).

maintenance bypass function allows an individual safety function module to be removed service for required testing without loss of redundancy (Subsection 7.4.4.3). Self-test ures are provided for components that do not have setpoints or tunable parameters. The rete logic of the actuation and priority logic (APL) of the EIM does not have self-test capability is instead functionally tested (SSubsection 7.4.4.4). Calibration, testing, and diagnostics are ressed in Section 8.0 of Topical Report TR-1015-18653, Design of the Highly Integrated tection System Platform (NuScale, 2017).

NE Medical Technologies 7.4-3 Rev. 2

SHINE Design Criterion 16 - The protection systems are designed to ensure that the effects of natural phenomena, and of normal operating, maintenance, testing, and postulated accident conditions on redundant channels, do not result in loss of the protection function or are demonstrated to be acceptable on some other defined basis. Design techniques, such as functional diversity or diversity in component design and principles of operation, are used to the extent practical to prevent loss of the protection function.

TRPS is designed as Seismic Class 1 and is protected from the effects of earthquakes, adoes, and floods (Subsection 7.4.3.6). The TRPS structures, systems, and components that prise a division are physically separated to retain the capability of performing the required ty functions during a design basis accident. Division independence is maintained throughout, nding from the sensor to the devices actuating the protective function (Subsection 7.4.5.2.1).

architecture provides two diverse methods for an actuation of the safety functions at the sion level, automatic (Subsections 7.4.3.1 and 7.4.4.1) and manual (Subsection 7.4.3.7), and programmable gate arrays (FPGAs) in each division are of a different physical architecture revent common cause failure (CCF) (Subsection 7.4.5.2.4).

2.1.5 Protection System Failure Modes SHINE Design Criterion 17 - The protection systems are designed to fail into a safe state if conditions such as disconnection of the system, loss of energy (e.g., electric power, instrument air), or postulated adverse environments are experienced.

trolled components associated with safety actuations are designed to go to their safe state n deenergized (Subsection 7.4.3.8.) The TRPS equipment is qualified for radiological and ironmental hazards present during normal operation and postulated accidents bsection 7.4.3.5).

2.1.6 Separation of Protection and Control Systems SHINE Design Criterion 18 - The protection system is separated from control systems to the extent that failure of any single control system component or channel, or failure or removal from service of any single protection system component or channel that is common to the control and protection systems, leaves intact a system satisfying all reliability, redundancy, and independence requirements of the protection system. Interconnection of the protection and control systems is limited to assure that safety is not significantly impaired.

safety-related inputs into the TRPS are designed and controlled so they do not prevent the PS from performing its safety functions (Subsection 7.4.3.4).

2.1.7 Protection Against Anticipated Transients SHINE Design Criterion 19 - The protection systems are designed to ensure an extremely high probability of accomplishing their safety functions in the event of anticipated transients.

TRPS design utilizes functional independence; structures, systems, and components that prise a division are physically separated to retain the capability of performing the required ty functions during a design basis accident (Subsection 7.4.5.2.1). The TRPS includes NE Medical Technologies 7.4-4 Rev. 2

ty functions at the division level, automatic (Subsections 7.4.3.1 and 7.4.4.1) and manual bsection 7.4.3.7), and FPGAs in each division are of a different physical architecture to vent CCF (Subsection 7.4.5.2.4).

2.1.8 Monitoring Radioactivity Releases SHINE Design Criterion 38 - Means are provided for monitoring the primary confinement boundary, hot cell, and glovebox atmospheres to detect potential leakage of gaseous or other airborne radioactive material. Potential effluent discharge paths and the plant environs are monitored for radioactivity that may be released from normal operations, including anticipated transients, and from postulated accidents.

TRPS monitors for potential radioactivity releases from the primary confinement boundary.

cific monitored variables are addressed in Subsection 7.4.4.1. Additional radioactivity ase monitoring is provided by the engineered safety features actuation system (ESFAS) ction 7.5) and by nonsafety-related radiation monitoring systems (Section 7.7).

2.1.9 Hydrogen Mitigation SHINE Design Criterion 39 - Systems to control the buildup of hydrogen that is released into the primary system boundary and tanks or other volumes that contain fission products and produce significant quantities of hydrogen are provided to ensure that the integrity of the system and confinement boundaries is maintained.

TRPS monitors variables and provides actuations to prevent and mitigate hydrogen agration in the primary system boundary or TSV dump tank (Subsection 7.4.4.1).

2.2 TRPS System Design Criteria 2.2.1 Access Control TRPS Criterion 1 - The TRPS shall require a key or combination authentication input at the control console to prevent unauthorized use of the TRPS.

TRPS utilizes a HIPS design which is described in Subsection 7.4.5. Unauthorized use of TRPS is prevented by required use of a physical key as described in Subsection 7.4.5.3.3.

TRPS Criterion 2 - Developmental phases for TRPS software shall address the potential cyber security vulnerabilities (physical and electronic) to prevent unauthorized physical and electronic access.

TRPS development design uses a defensive system architecture described in section 7.4.5.3.2 that prevents unauthorized physical and electronic access.

TRPS Criterion 3 - The TRPS design shall incorporate design or administrative controls to prevent/limit unauthorized physical and electronic access to critical digital assets (CDAs) during the operational phase, including the transition from development to operations. CDAs NE Medical Technologies 7.4-5 Rev. 2

ess control features prevent unauthorized physical and electronic access to CDAs during the rational phase and during transition from development to operations. Access control, cyber urity, and the secure development operating environment are described in section 7.4.5.3. Subsection 7.4.5.3 describes prevention of unauthorized access during the elopment and operational phases. Post-development installation and testing is performed controlled by the safety-related control system vendor as described in Subsections 7.4.5.4 7.4.5.4.2.6.

2.2.2 Software Requirements Development TRPS Criterion 4 - The functional characteristics of the TRPS software requirements specifications shall be properly and precisely described for each software requirement.

system design requirements are specified in the system requirements specification (SyRS) ch is generated in accordance with the vendor SyRS development procedure bsection 7.4.5.4.2.1). A system design description is generated to define the system design ails. Software requirements development is addressed in Subsection 7.4.5.4.

TRPS Criterion 5 - Development of TRPS software shall follow a formally defined lifecycle process and address potential security vulnerabilities in each phase of the lifecycle.

programmable logic lifecycle process is described in Subsection 7.4.5.4.2. The lifecycle cess includes a Project Security Plan as stated in Subsection 7.4.5.4.2.1. The development cess addresses security vulnerabilities (physical and electronic) in the developmental phases he software and addresses controls to prevent unauthorized physical and electronic access.

grammable logic lifecycle activities are performed within a secure development environment E) using an isolated development network (IDN) (Subsections 7.4.5.3.1 and 7.4.5.4.2.2).

TRPS Criterion 6 - TRPS development lifecycle phase-specific security requirements shall be commensurate with the risk and magnitude of the harm that would result from unauthorized and inappropriate access, use, disclosure, disruption, or destruction of the TRPS.

grammable logic lifecycle activities necessitate use of a SDE using an IDN from the uirements Phase forward (Subsection 7.4.5.4.2.2). Software requirements development, uding lifecycle phase-specific security requirements, is addressed in TRPS Criterion 5.

TRPS Criterion 7 - TRPS software development lifecycle process requirements shall be described and documented in appropriate plans which shall address safety analysis, verification and validation (V&V), and configuration control activities.

ign basis requirements are specified in the SyRS and system design description bsection 7.4.5.4.2.1). The lifecycle process includes development of a V&V Plan and figuration Management Plan to control V&V and configuration management activities bsection 7.4.5.4.2.1).

NE Medical Technologies 7.4-6 Rev. 2

individuals or groups with appropriate technical competence in an organization separate from the development and program management organizations. Successful completion of V&V tasks for each software lifecycle activity group shall be documented.

NE has delegated V&V activities related to the safety-related control system development, uding V&V documentation, to the vendor. The vendor Project V&V Plan for the system elopment was tailored and adapted for FPGA technology from the guidance in IEEE ndard 1012-2004 (IEEE, 2004a). The V&V activities are performed using an internal V&V m from within the design organization (Subsection 7.4.5.4.5).

TRPS Criterion 9 - The TRPS software lifecycle configuration control program shall trace software development from software requirement specification to implementation and address any impacts on TRPS safety, control console, or display instruments.

programmable logic lifecycle process addresses design interfaces, which includes ressing any impacts on the safety system, control console, or display instruments during the ycle process, as stated in Subsection 7.4.5.4.2.

TRPS Criterion 10 - The TRPS configuration control program shall assure that the required TRPS hardware and software are installed in the appropriate system configuration and ensure that the correct version of the software/firmware is installed in the correct hardware components.

section 7.4.5.4.6.3 addresses compliance with TRPS Criterion 10 and ensures the correct sion of software/firmware is installed in the correct hardware components. The development se configuration management process is described in Subsection 7.4.5.4.6.1 and states that ponents of the system (hardware) and programmable logic and its development process a (software) are controlled by the Project Configuration Management Plan. Post-installation se configuration management is addressed in Subsection 7.4.5.4.6.2.

TRPS Criterion 11 - Validation testing shall test all portions of TRPS programmable logic necessary to accomplish its safety functions and shall exercise those portions whose operation or failure could impair safety functions during testing.

lementation phase V&V activities, described in Subsection 7.4.5.4.5.5, verify the design uracy to accomplish safety functions and include functional verification and timing verification vities. Test phase V&V (Subsection 7.4.5.4.5.6) includes system functional, interface, and ormance testing.

TRPS Criterion 12 - The TRPS software development lifecycle shall include a software risk management program which addresses vulnerabilities throughout the software lifecycle.

vendor utilizes a Project Risk Management Plan for development of the TRPS, as described ubsection 7.4.5.4.8. Risk identification activities occur throughout the project lifecycle.

ntified risks are documented in a project risk register and actions are developed to address tified risks or vulnerabilities.

NE Medical Technologies 7.4-7 Rev. 2

program.

developmental process for creating the safety-related TRPS has been delegated to SHINE's ty-related control system vendor (Subsection 7.4.5.3.1), including any modifications to the tem logic after initial development (Subsection 7.4.5.4). SHINE is responsible for providing rsight of the vendor, verifying deliverables are developed in accordance with approved quality procurement documents, and maintaining the vendor as an approved supplier on the SHINE roved supplier list (Subsection 7.4.5.4.1).

2.2.3 General Instrumentation and Control Requirements TRPS Criterion 14 - The TRPS safety function shall perform and remain functional during normal operation and during and following a design basis event.

TRPS equipment is installed in the seismically qualified portion of the main production facility re it is protected from earthquakes, tornadoes, and floods. The TRPS equipment is Seismic egory I, designed in accordance with Section 8 of IEEE Standard 344-2013 (IEEE, 2013) bsection 7.4.3.6). The TRPS control and logic equipment is located in a mild operating ironment inside the facility control room, protected from radiological and environmental ards during normal operation, maintenance, testing, and postulated accidents, and cables sensors outside the facility control room are designed for their respective environments bsection 7.4.3.5).

TRPS Criterion 15 - Manual controls of TRPS actuation components shall be implemented downstream of the digital I&C portions of the safety system.

TRPS logic diagrams (Figure 7.4-1) display where the manual actuation is brought into the

c. Manual controls and nonsafety control system inputs come individually into the APL and downstream of the programmable logic portion of the TRPS architecture shown in ure 7.1-2 (Subsection 7.4.5.2.4).

2.2.4 Single Failure TRPS Criterion 16 - The TRPS shall be designed to perform its protective functions after experiencing a single random active failure in nonsafety control systems or in the TRPS, and such failure shall not prevent the TRPS and credited passive redundant control components from performing its intended functions or prevent safe shutdown of an IU cell.

TRPS consists of three divisions of input processing and trip determination and two divisions ctuation logic arranged such that no single failure within the TRPS results in the loss of the ective function, and no single failure in a single measurement channel can generate an ecessary safety actuation. Redundancy is addressed in Subsection 7.4.5.2.2. Nonsafety-ted inputs into the TRPS are designed and controlled so they do not prevent the TRPS from orming its safety functions. Single failure is additionally addressed in Subsection 7.4.3.4.

TRPS Criterion 17 - The TRPS shall be designed such that no single failure can cause the failure of more than one redundant component.

NE Medical Technologies 7.4-8 Rev. 2

re of a field input, signal conditioning circuit, or trip determination and still maintain the ability rovide needed number of valid inputs to the voting circuitry. A single failure of the voting logic he actuation logic is also acceptable within the configuration as the redundant division of ng logic and actuation logic is capable of performing the safety function. Functional pendence is addressed in Subsection 7.4.5.2.1 and redundancy is addressed in section 7.4.5.2.2.

2.2.5 Independence TRPS Criterion 18 - Interconnections among TRPS safety divisions shall not adversely affect the functions of the TRPS.

ety-related inputs to the TRPS which originate within a specific division of the TRPS are input and processed in, only the same division prior to being provided to any other division of the tem for voting purposes (Subsection 7.4.5.2.1).

TRPS Criterion 19 - A logical or software malfunction of any interfacing non-safety systems shall not affect the functions of the TRPS.

APL (which is constructed of discrete components and part of the EIM) is designed to vide priority to safety-related signals over nonsafety-related signals. Division A and Division B rity logic of the TRPS prioritizes the following TRPS inputs, with the first input listed having highest priority and each successive input in the list having a lower priority than the previous:

Automatic Safety Actuation, Manual Actuation, and 2) PICS nonsafety control signals bsection 7.4.3.12). When the enable nonsafety control is not active, the nonsafety-related trol signals are ignored. If the enable nonsafety control is active, and no automatic safety ation or manual actuation command is present, the nonsafety control signal can control the ponent (Subsection 7.4.3.3).

TRPS Criterion 20 - The TRPS shall be designed with physical, electrical, and communications independence of the TRPS both between the TRPS channels and between the TRPS and nonsafety-related systems to ensure that the safety functions required during and following any design basis event can be accomplished.

TRPS structures, systems, and components that comprise a division are physically arated to retain the capability of performing the required safety functions during a design is accident (Subsection 7.4.5.2.1) and nonsafety-related TRPS inputs and outputs are routed on-divisional cable raceways and are segregated from safety-related inputs and outputs bsection 7.4.3.9). Wiring for redundant divisions uses physical separation and isolation to vide independence for circuits (Subsection 7.4.5.2.1) in accordance with IEEE ndard 384-2008 (IEEE, 2008). HIPS communication paths are designed such that a single re does not cause all safety functions of a division to be inoperable (Subsection 7.4.5.2).

TRPS Criterion 21 - Physical separation and electrical isolation shall be used to maintain the independence of TRPS circuits and equipment among redundant safety divisions or with nonsafety systems so that the safety functions required during and following any design basis event can be accomplished.

NE Medical Technologies 7.4-9 Rev. 2

is accident (Subsection 7.4.5.2.1) and nonsafety-related TRPS inputs and outputs are routed on-divisional cable raceways and are segregated from safety-related inputs and outputs bsection 7.4.3.9). Wiring for redundant divisions uses physical separation and isolation to vide independence for circuits (Subsection 7.4.5.2.1) in accordance with IEEE ndard 384-2008 (IEEE, 2008).

TRPS Criterion 22 - The TRPS shall be designed such that no communication - within a single safety channel, between safety channels, and between safety and nonsafety systems - adversely affects the performance of required safety functions.

S communication paths are designed with simplicity such that a single failure does not cause afety functions of a division to be inoperable. The design uses triple redundant munication paths. A single failure does not cause all safety functions of that division to be erable (Subsection 7.4.5.2). Communication ports that are for communication outside of a S chassis implement the one-way communication with hardware (Subsection 7.4.5.3.2).

TRPS Criterion 23 - TRPS data communications protocols shall meet the performance requirements of all supported systems.

PS data communications protocol is detailed in Section 7.5.1 of Topical ort TR-1015-18653 (NuScale, 2017). The protocol is used on the safety buses as a simple ster-slave communication protocol and employs a cyclic redundancy checksum feature to ure the integrity of the communicated information between modules. Data communications is ussed in Subsection 7.4.5.2.5.

TRPS Criterion 24 - The timing of TRPS data communications shall be deterministic.

maximum response time of the TRPS components from when an input signal exceeds a determined setpoint to the time that the TRPS deenergizes the EIM output switching for ated components is conservatively set to a maximum of 500 milliseconds bsection 7.4.5.2.3).

TRPS Criterion 25 - TRPS communications protocols shall conform to validated protocol specifications by formally generated test procedures and test data vectors and verify that the implementations themselves were constructed using a formal design process that ensures consistency between the product and the validated specification.

PS communication protocols are verified as conforming to the validated protocol cifications by the Project V&V Plan (Subsection 7.4.5.4.5.

TRPS Criterion 26 - The TRPS shall be designed such that no unexpected performance deficits exist that could adversely affect the TRPS architecture.

communications independence, the TRPS platform is designed such that each safety sion functions independently of other safety divisions. With the exception of interdivisional ng, communication within a division does not rely on communication outside the respective sion to perform the safety function. Safety-related inputs to the TRPS which originate within a NE Medical Technologies 7.4-10 Rev. 2

2.2.6 Prioritization of Functions TRPS Criterion 27 - TRPS devices that receive signals from safety and nonsafety sources shall prioritize the signal from the safety system.

rity is provided to automatic and manual safety-related actuation signals over nonsafety-ted signals as described in Subsection 7.4.3.12.

2.2.7 Fail Safe TRPS Criterion 28 - The TRPS shall be designed to assume a safe state on loss of electrical power.

trolled components associated with safety actuations are designed to go to their safe state n deenergized (Subsection 7.4.3.8).

2.2.8 Setpoints TRPS Criterion 29 - Setpoints for an actuation of the TRPS shall be based on a documented analysis methodology that identifies assumptions and accounts for uncertainties, such as environmental allowances and measurement computational errors associated with each element of the instrument channel. The setpoint analysis parameters and assumptions shall be consistent with the safety analysis, system design basis, technical specifications and facility design, and expected maintenance practices.

points in the TRPS are based on a documented methodology that identifies each of the umptions and accounts for the uncertainties in each instrument channel. The setpoint hodology is further described in Subsections 7.2.1 and 7.4.3.11.

TRPS Criterion 30 - Adequate margin shall exist between setpoints and safety limits so that the TRPS initiates protective actions before safety limits are exceeded.

points in the TRPS are based on a documented methodology that ensures adequate margin ts between setpoints and analytical limits or safety limits. The setpoint methodology is further cribed in Subsections 7.2.1 and 7.4.3.11.

TRPS Criterion 31 - Where it is necessary to provide multiple setpoints for adequate protection based on particular modes of operation or sets of operating conditions, the TRPS shall provide positive means of ensuring that the more restrictive setpoint is used when required.

tiple setpoints are used for safety actuations based on neutron flux dependent on the IU rating conditions. Operational bypasses are used as described in Subsection 7.4.4.2 to ure the more restrictive setpoint is used when required.

NE Medical Technologies 7.4-11 Rev. 2

the protective function.

points in the TRPS are based on a documented methodology that identifies each of the umptions and accounts for the uncertainties in each instrument channel. The setpoint hodology is further described in Subsections 7.2.1 and 7.4.3.11. Setpoint analysis ameters typically consider instrument precision, sensitivity, accuracy, loop uncertainties, and putational errors.

2.2.9 Operational Bypass, Permissives, and Interlocks TRPS Criterion 33 - Permissive conditions for each TRPS operating or maintenance bypass capability shall be documented.

PS operating permissives are used to control the modes of operation of the IU cells. The de transition functions are described in Subsection 7.4.3.2. Operational use of the missives and conditions to be satisfied and operational bypasses is addressed in section 7.4.4.2. A maintenance bypass function is available and is described in section 7.4.4.3.

TRPS Criterion 34 - TRPS interlocks shall ensure that operator actions cannot defeat an automatic safety function during any operating condition where that safety function may be required.

rator action is required to transition the TRPS between normal operating modes as cribed in Subsection 7.4.3.2. Operational bypasses are initiated or removed dependent on TRPS mode of operation as described in Subsection 7.4.4.2. Interlocks are provided by PS to prevent the operator from transitioning to the next operating mode unless certain ditions are met, as described in Subsection 7.4.3.2, to ensure that operator actions cannot eat an automatic safety function during any operating condition where that safety function y be required.

TRPS Criterion 35 - TRPS provisions shall exist to prevent activation of an operating bypass unless applicable permissive conditions exist.

PS implements logic associated with each mode of operation to prevent an operator from vating a bypass through changing the IU cell mode out of sequential order. Each mode of ration is achieved through manual input from the operator when permissive conditions for the t mode in the sequence have been met (Subsection 7.4.4.2).

TRPS Criterion 36 - Bypass capability shall not be provided for the mechanisms to manually initiate TRPS safety.

nual safety actuations are shown in the logic diagrams (Figure 7.4-1). There are no conditions allow manually initiated TRPS safety functions to be bypassed.

TRPS Criterion 37 - If provisions for maintenance or operating bypasses are provided, the TRPS design shall retain the capability to accomplish its safety function while a bypass is in effect.

NE Medical Technologies 7.4-12 Rev. 2

ration prevents an operator from activating a bypass through changing the IU cell mode out equential order (Subsection 7.4.4.2). Use of the maintenance bypass either preserves the le failure criterion where three channels are provided or is performed in accordance with nical specification requirements (Subsection 7.4.4.3).

TRPS Criterion 38 - Whenever permissive conditions for bypassing a train or channel in the TRPS are not met, a feature in the TRPS shall physically prevent or facilitate administrative controls to prevent the unauthorized use of bypasses.

rator action is required to transition the TRPS between normal operating modes as cribed in Subsection 7.4.3.2. Operational bypasses are initiated or removed dependent on TRPS mode of operation as described in Subsection 7.4.4.2. Interlocks are provided by PS to prevent the operator from transitioning to the next operating mode unless certain ditions are met, as described in Subsection 7.4.3.2.

TRPS Criterion 39 - All TRPS operating bypasses, either manually or automatically initiated, shall be automatically removed when the facility moves to an operating regime where the protective action would be required if an accident occurred.

rational bypasses are automatically initiated or removed dependent on the TRPS mode of ration, as described in Subsection 7.4.4.2, when the associated IU is moved from one mode peration to another, to ensure the automatic protective functions are available when required.

TRPS Criterion 40 - If operating conditions change so that an active operating bypass is no longer permissible, the TRPS shall automatically accomplish one of the following actions:

Remove the appropriate active operating bypass(es).

Restore conditions so that permissive conditions once again exist.

Initiate the appropriate safety function(s).

rator action is required to transition the TRPS between normal operating modes as cribed in Subsection 7.4.3.2. Operational bypasses are initiated or removed dependent on TRPS mode of operation as described in Subsection 7.4.4.2. Interlocks are provided by PS to prevent the operator from transitioning to the next operating mode unless certain ditions are met, as described in Subsection 7.4.3.2.

TRPS Criterion 41 - Portions of TRPS execute features with a degree of redundancy of one shall be designed so that when a portion is placed in maintenance bypass (i.e., reducing temporarily its degree of redundancy to zero), the remaining portions provide acceptable reliability.

ere three channels are provided, taking an SFM out of service preserves the single failure rion for variables associated with that SFM. In cases where only two channels are provided, ng a channel out of service will actuate the associated safety function. For testing purposes, ing a channel in maintenance bypass will be allowed by technical specifications for up to hours to perform required testing. Two hours is considered acceptable due to the continued rability of the redundant channel(s) and the low likelihood that an accident would occur in e two hours (Subsection 7.4.4.3).

NE Medical Technologies 7.4-13 Rev. 2

en a mode of operation changes, the bypasses from the previous mode are automatically oved as they are no longer appropriate. The status of each bypass is provided to the operator ugh the monitoring and indication bus to the PICS, including any channel placed in ntenance bypass (Subsection 7.4.4.3), which allows the operator to confirm that a function been bypassed or returned to service (Subsection 7.4.4.2). The PICS is described in tion 7.3 and operator displays and human factors considerations are addressed in tion 7.6.

2.2.10 Completion of Protective Actions TRPS Criterion 43 - The TRPS design shall ensure that once initiated, the safety actions will continue until the protective function is completed.

ure 7.4-1 shows how the TRPS latches in a protective action and maintains the state of a ective action until operator input is initiated to reset the output of the TRPS. Completion of ective actions is described in Subsection 7.4.3.3.

TRPS Criterion 44 - Only deliberate operator action shall be permitted to reset the TRPS or its components following manual or automatic actuation.

y deliberate operator action can be taken to reset the TRPS following a protective action.

ure 7.4-1 shows how the TRPS latches in a protective action and maintains the state of a ective action until operator input is initiated to reset the output of the TRPS. Completion of ective actions is described in Subsection 7.4.3.3.

TRPS Criterion 45 - Mechanisms for deliberate operator intervention in the TRPS status or its functions shall not be capable of preventing the initiation of TRPS.

afety-related enable nonsafety switch (when enabled) allows a facility operator to control the put state of the TRPS with a hardwired binary control signal from the nonsafety-related trols. If the enable nonsafety switch is active, and no automatic safety actuation or manual ty actuation signals are present, the operator is capable of energizing or deenergizing any outputs using the nonsafety-related hardwired control signals (Subsection 7.4.3.3).

itionally, safety-related signals are prioritized over nonsafety-related signals bsection 7.4.3.12).

2.2.11 Equipment Qualification TRPS Criterion 46 - The effects of electromagnetic interference/radio-frequency interference (EMI/RFI) and power surges (such as high-energy faults and lightning) on the TRPS, including FPGA-based digital portions, shall be adequately addressed.

PS rack mounted equipment is installed in a mild operating environment and is designed to et the environmental conditions described in Subsection 7.4.3.5. Rack mounted TRPS ipment is tested to appropriate standards to show that the effects of EMI/RFI and power ges are adequately addressed. Appropriate grounding of the TRPS is performed in ordance with Section 5.2.1 of IEEE Standard 1050-2004 (IEEE, 2004b).

NE Medical Technologies 7.4-14 Rev. 2

TRPS Criterion 47 - Equipment in the TRPS (from the input circuitry to output actuation circuitry) shall be designed to allow testing, calibration, and inspection to ensure operability. If testing is required or can be performed as an option during operation, the TRPS shall retain the capability to accomplish its safety function while under test.

TRPS design supports testing, maintenance, and calibration, as described in section 7.4.4.3 and 7.4.4.4. Testing performed during operation is controlled in accordance the technical specifications to ensure that at least one division of the TRPS is capable of orming its safety functions when required.

TRPS Criterion 48 - Testing, calibration, and inspections of the TRPS shall be sufficient to show that, once performed, they confirm that surveillance test and self-test features address failure detection, self-test features, and actions taken upon failure detection.

TRPS design supports testing, maintenance, and calibration, as described in section 7.4.4.3 and 7.4.4.4. End-to-end testing of the entire TRPS platform can be performed ugh overlap testing. All TRPS components have self-testing capabilities, except the discrete of EIM which is functionally tested.

TRPS Criterion 49 - The design of the TRPS and the justification for test intervals shall be consistent with the surveillance testing intervals as part of the facility technical specifications.

TRPS design supports testing, maintenance, and calibration, as described in sections 7.4.4.3 and 7.4.4.4. Testing intervals are established in the technical specifications bsection 7.4.4.5).

2.2.13 Classification and Identification TRPS Criterion 50 - TRPS equipment shall be distinctly identified to indicate its safety classification and to associate equipment according to divisional or channel assignments.

h TRPS cable and component is uniquely identified in accordance with the SHINE ponent numbering guidelines. The unique identification number indicates the applicable tem and division (Subsection 7.4.3.10).

2.2.14 Human Factors TRPS Criterion 51 - Human factors shall be considered at the initial stages and throughout the TRPS design process to ensure that the functions allocated in whole or in part to the operator(s) can be successfully accomplished to meet TRPS design goals.

man factors is a design consideration for development of the TRPS. Changes to the design ughout the lifecycle process include human factors considerations (Subsection 7.4.5.4.2).

man factors design is described in Subsection 7.4.3.7.

TRPS Criterion 52 - The TRPS shall include readily available means for manual initiation of each protective function at the system level.

NE Medical Technologies 7.4-15 Rev. 2

upport of manual initiation is described in Subsection 7.4.3.7.

TRPS Criterion 53 - The TRPS shall be designed to provide the information necessary to support annunciation of the channel initiating a protective action to the operator and requiring manual operator reset when all conditions to resume operation are met and satisfied.

support the use of manual safety actuations, the TRPS associated with each IU includes ated outputs for each safety-related instrument channel to provide monitoring and indication rmation to the PICS (Subsection 7.4.3.7). See also TRPS Criterion 44 regarding manual rator reset in Subsection 7.4.2.2.10.

2.2.15 Quality TRPS Criterion 54 - The quality of the components and modules in the TRPS shall be commensurate with the importance of the safety function to be performed.

safety-related TRPS is designed, fabricated, erected, and tested by SHINEs safety-related trol system vendor in accordance with the vendors Project Quality Assurance Plan bsection 7.4.5.4). SHINE is responsible for oversight of the vendor and maintaining the dor as an approved supplier on the SHINE approved supplier list (Subsection 7.4.5.4.1).

TRPS Criterion 55 - Controls over the design, fabrication, installation, and modification of the TRPS shall conform to the guidance of ANSI/ANS 15.8-1995, Quality Assurance Program Requirements for Research Reactors (ANSI/ANS, 1995), as endorsed by Regulatory Guide 2.5, Quality Assurance Program Requirements for Research and Test Reactors (USNRC, 2010).

TRPS design conforms to the guidance of ANSI/ANS 15.8-1995 (ANSI/ANS, 1995) as orsed by Regulatory Guide 2.5 (USNRC, 2010) (Subsection 7.4.3.13).

3 DESIGN BASIS TRPS monitors variables important to the safety functions of the irradiation process during h operating mode of the IU and performs one or more of the following safety actuations upon ching specified analytical values:

IU Cell Safety Actuation

IU Cell Nitrogen Purge

IU Cell TPS Actuation

Driver Dropout TRPS also contains pre-established interlocks and permissives to control transition between perating modes to ensure safe operation of the main production facility.

section 7.4.4 addresses the specific variables that provide input into the TRPS, the rument range for covering normal and accident conditions, the accuracy for each variable, the lytical limit, and response time.

NE Medical Technologies 7.4-16 Rev. 2

3.1 Safety Functions TRPS consists of eight subsystems, one for each of the eight IUs. The safety functions cribed in this subsection are applicable to each TRPS subsystem independently.

3.1.1 IU Cell Safety Actuation IU Cell Safety Actuation is initiated in response to process variables indicating abnormal ditions. An IU Cell Safety Actuation shuts down the irradiation process and isolates the ary system boundary and primary confinement boundary.

IU Cell Safety Actuation is relied upon as a safety-related control in accordance with the NE safety analysis described in Chapter 13 for insertion of excess reactivity events bsection 13a2.1.2, Scenarios 1, 2, 3, 4, 5, 6, 10, and 11), reduction in cooling events bsection 13a2.1.3, Scenarios 1 and 2), mishandling or malfunction of target solution events bsection 13a2.1.4, Scenario 4), external events (Subsection 13a2.1.6, Scenarios 2 and 5),

e undamped power oscillations (Subsection 13a2.1.8), detonation and deflagration in the ary system boundary (Subsection 13a2.1.9, Scenarios 1 and 2), system interaction events bsection 13a2.1.11, Scenarios 1 and 2), and facility specific - neutron driver assembly tem (NDAS) events (Subsection 13a2.1.12, Scenario 3).

U Cell Safety Actuation causes a transition of the TRPS to Mode 3 operation, isolation of the ary system boundary, and isolation of the primary confinement boundary via transition of h of the following components to their deenergized state.

Mode 3 Transition Components

TSV dump valves

NDAS high voltage power supply (HVPS) breakers Primary System Boundary Components

TSV fill isolation valves

TSV dump tank drain isolation valve

TSV off-gas system (TOGS) gas supply isolation valves

TOGS vacuum tank isolation valves

Vacuum transfer system (VTS) lower lift tank target solution valves*

Primary Confinement Boundary Components

Primary closed loop cooling system (PCLS) supply isolation valve

PCLS return isolation valves

Radiological ventilation zone 1 exhaust (RVZ1e) subsystem IU cell isolation valves

Radiological ventilation zone 1 recirculation (RVZ1r) subsystem radioisotope process facility cooling system (RPCS) supply isolation valve

RVZ1r RPCS return isolation valve

TPS target chamber supply isolation valves

TPS deuterium supply isolation valves

TPS target chamber exhaust isolation valves

TPS neutron driver evacuation isolation valves NE Medical Technologies 7.4-17 Rev. 2

NDAS vacuum pump cooling supply isolation valve

NDAS vacuum pump cooling return isolation valve Cells 1 and 8 only have a single valve to the extraction lower lift tanks. The VTS lower lift target solution valves are redundant to the TSV dump tank drain isolation valve for an Cell Safety Actuation.

TRPS initiates an IU Cell Safety Actuation based on the following variables:

High source range neutron flux

High time-averaged neutron flux*

High wide range neutron flux

High RVZ1e IU cell radiation

Low TOGS oxygen concentration

Low TOGS mainstream flow (Train A)

Low TOGS mainstream flow (Train B)

Low TOGS dump tank flow

High TOGS condenser demister outlet temperature (Train A)

High TOGS condenser demister outlet temperature (Train B)

Low PCLS flow (180 second delay)

High PCLS temperature (180 second delay)

Low PCLS temperature

Low-high TSV dump tank level signal

High-high TSV dump tank level signal

TSV fill isolation valves not fully closed

IU Cell Nitrogen Purge

Facility master operating permissive gh time averaged neutron flux is calculated from power range neutron flux over a 45 second ng average.

section 7.4.4 provides additional details for each condition that results in an IU Cell Safety uation.

3.1.2 IU Cell Nitrogen Purge IU Cell Nitrogen Purge is initiated when monitored variables indicate a loss of hydrogen ombination capability in the IU. An IU Cell Nitrogen Purge results in purging the primary tem boundary for the affected IU with nitrogen.

IU Cell Nitrogen Purge is relied upon as a safety-related control in accordance with the NE safety analysis described in Chapter 13 for insertion of excess reactivity events bsection 13a2.1.2, Scenario 5), and detonation and deflagration in the primary system ndary (Subsection 13a2.1.9, Scenario 1).

IU Cell Nitrogen Purge consists of an automatically or manually initiated transition of each of following components associated with the affected IU to their deenergized state and provides NE Medical Technologies 7.4-18 Rev. 2

N2PS inerting gas isolation valves

TOGS nitrogen vent isolation valves

TOGS RPCS supply isolation valves

TOGS RPCS return isolation valve TRPS initiates an IU Cell Nitrogen Purge based on the following variables:

Low-high TSV dump tank level

High-high TSV dump tank level

Low TOGS oxygen concentration

Low TOGS mainstream flow (Train A)

Low TOGS mainstream flow (Train B)

Low TOGS dump tank flow

High TOGS condenser demister outlet temperature (Train A)

High TOGS condenser demister outlet temperature (Train B)

ESFAS loss of external power 3.1.3 IU Cell TPS Actuation IU Cell TPS Actuation is initiated when monitored variables indicate a release of tritium in a glovebox. An IU Cell TPS Actuation results in isolating the TPS lines into and out of the ell, isolating the RVZ1 exhaust out of the IU cell, and deenergizing the neutron driver.

IU Cell TPS Actuation consists of an automatically or manually initiated transition of each of following components to their deenergized state and initiating a Driver Dropout (see section 7.4.3.1.4):

TPS target chamber supply isolation valves

TPS deuterium supply isolation valves

TPS target chamber exhaust isolation valves

TPS neutron driver evacuation isolation valves

RVZ1e IU cell isolation valves TRPS initiates an IU Cell TPS Actuation based on the following variables:

ESFAS IU Cell TPS Actuation

ESFAS TPS Process Vent Actuation 3.1.4 Driver Dropout river Dropout responds to monitored variables that indicate a loss of neutron driver output or ss of cooling to allow the subcritical assembly system (SCAS) to recover from NDAS or PCLS sients. A Driver Dropout functions differently depending on whether it was initiated based on of neutron driver output or loss of cooling.

NE Medical Technologies 7.4-19 Rev. 2

narios 1 and 2). The TRPS initiates a Driver Dropout based on:

Low power range neutron flux

Low PCLS flow

High PCLS temperature

IU Cell TPS Actuation TRPS initiates a loss of neutron driver Driver Dropout on low power range neutron flux by ning the NDAS HVPS breakers with a timed delay. Driver Dropout on low power range tron flux is bypassed until the power range neutron flux has reached the power range driver pout permissive. After the bypass of Driver Dropout on low power range neutron flux has n removed, it remains removed until a mode transition or both HVPS breakers are open. The PS implements a timed delay of [ ]PROP/ECI from the time the low power range tron flux signal is initiated, indicating that the neutron flux has exceeded its lower limits, to n the TRPS output to the HVPS breakers is deenergized. If fewer than two-out-of-three low er range neutron flux actuation signals are present before the timer has expired, then the low er range neutron flux timer resets. This delay allows the neutron driver to be restarted or to art automatically within analyzed conditions.

TRPS initiates a loss of cooling Driver Dropout on low PCLS cooling water flow or high PCLS ling water supply temperature to open the NDAS HVPS breakers without a timed delay. This ts down the neutron driver to prevent overheating of the target solution, while allowing the et solution to remain within the TSV. The breakers are then interlocked open until the PCLS and temperature are in the allowable range. If PCLS flow and temperature are not in the wable range within 180 seconds, an IU Cell Safety Actuation is initiated, as described in section 7.4.3.1.1.

3.2 Mode Transition design of the TRPS includes use of permissives and interlocks to control transition between perating modes to ensure safe operation of the main production facility. IU operating modes described in Subsection 7.3.1.1.

h mode transition in the TRPS is initiated manually through the PICS; however, transition to de 3 can occur automatically by an IU Cell Safety Actuation or by use of the control key to ctivate the facility master operating permissive. Before an operator is able to manually sition to a different mode, the transition criteria conditions must be met. Figure 7.4-1 shows a e diagram of the mode transitions.

de 0 to Mode 1 Transition Criteria TRPS permissives prevent transitioning from Mode 0 to Mode 1 until the TSV dump valves TSV fill isolation valves have been confirmed to be closed and TOGS mainstream flow is at bove the low flow limit. Normal control of actuation component positions when going from de 0 to Mode 1 is manual and independent from TRPS mode transition.

NE Medical Technologies 7.4-20 Rev. 2

nsition from Mode 0 to Mode 3 is initiated automatically by TRPS or manually by an operator manual actuation or the facility master operating permissive. Initiation of this transition erates an IU Cell Safety Actuation.

de 1 to Mode 2 Transition Criteria TRPS permissives prevent transitioning from Mode 1 to Mode 2 until the TSV fill isolation es indicate fully closed. Normal control of actuation component positions when going from de 1 to Mode 2 is manual and independent from TRPS mode transition.

de 1 to Mode 3 Transition Criteria nsition from Mode 1 to Mode 3 is initiated automatically by TRPS or manually by an operator manual actuation or the facility master operating permissive. Initiation of this transition erates IU Cell Safety Actuation.

de 2 to Mode 3 Transition Criteria TRPS permissives prevent transitioning from Mode 2 to Mode 3 until the NDAS HVPS akers have been confirmed opened. Normal control of the HVPS breakers from closed to n is manual and independent from TRPS mode transition. Normal transition of the dump es to the open position is automated by PICS upon receipt of a mode transition signal from PS to PICS signifying that the TRPS has entered Mode 3.

nsition from Mode 2 to Mode 3 may also be initiated automatically by TRPS or manually by an rator via manual actuation or the facility master operating permissive. Initiation of this sition generates an IU Cell Safety Actuation.

de 3 to Mode 4 Transition Criteria nsition of the TRPS from Mode 3 to Mode 4 is prevented if an automated IU Cell Safety uation is present. Normal control of actuation components is manual and independent from PS mode transition.

de 3 to Secure State Transition Criteria nsition from Mode 3 to the secure state is initiated manually by an operator via disengaging facility master operating permissive. While operating in the secure state, transition to another de of operation is not allowed.

de 4 to Mode 0 Transition Criteria TRPS permissives prevent the transition from Mode 4 to Mode 0 until the TSV dump tank l is below the low-high dump tank level setpoint. There is no requirement for normal control of actuation components to transition from Mode 4 to Mode 0.

NE Medical Technologies 7.4-21 Rev. 2

nsition from Mode 4 to Mode 3 is initiated automatically by TRPS or manually by an operator manual actuation or the facility master operating permissive. Initiation of this transition erates an IU Cell Safety Actuation.

ure State to Mode 3 Transition Criteria nsition from the secure state to Mode 3 is initiated manually by an operator via engaging the lity master operating permissive. Initiation of this transition permits a transition to another de of operation.

3.3 Completion of Protective Actions TRPS is designed so that once initiated, protective actions will continue to completion. Only berate operator action can be taken to reset the TRPS following a protective action.

ure 7.4-1 shows how the TRPS latches in a protective action and maintains the state of a ective action until operator input is initiated to reset the output of the TRPS to normal rating conditions.

output of the TRPS is designed so that actuation through automatic or manual means of a ty function can only deenergize the output. If there is no signal present from the automatic ty actuation or manual safety actuation, then the output of the EIM remains in its current

e. A safety-related enable nonsafety switch allows a facility operator, after the switch has n brought to enable, to control the output state of the TRPS with a hardwired binary control al from the nonsafety-related controls. The enable nonsafety switch is classified as part of safety system and is used to prevent spurious nonsafety-related control signals from ersely affecting safety-related components. If the enable nonsafety switch is active, and no omatic safety actuation or manual safety actuation signals are present, the operator is able of energizing or deenergizing any EIM outputs using the nonsafety-related hardwired trol signals. If the enable nonsafety switch is not active, the nonsafety-related hardwired trol signals are ignored.

3.4 Single Failure TRPS consists of three divisions of input processing and trip determination and two divisions ctuation logic (see Figure 7.1-2), arranged such that no single failure within the TRPS results e loss of the protective function, and no single failure in a single measurement channel can erate an unnecessary safety actuation.

safety-related inputs into the TRPS are designed and controlled so they do not prevent the PS from performing its safety functions. The only nonsafety inputs into the TRPS are those the PICS for control, the discrete mode input, and monitoring and indication only variables.

nonsafety control signals from the PICS are implemented through a hardwired parallel rface that requires the PICS to send a binary address associated to the output state of the along with a mirrored complement address. The mirrored complement address prevents any le incorrectly presented bit from addressing the wrong EIM output state. To prevent the PICS inadvertently presenting a valid address, the TRPS contains a safety-related enable safety switch that controls when the hardwired parallel interface within the APL is active, thus NE Medical Technologies 7.4-22 Rev. 2

ted control signal is ignored. If the enable nonsafety is active, and no automatic or manual ty actuation command is present, the nonsafety-related control signal can control the TRPS put. The HWM provides isolation for the nonsafety-related signal path.

discrete mode input has a unique input for each of Division A and Division B. The HWM vides isolation of the signal path into the TRPS. As a discrete input, the three failure modes are addressed are stuck high, stuck low, or oscillating. Because the TRPS only clocks in a mode on the rising edge of the mode input, an input stuck low or high would maintain the PS in the same mode and continue monitoring the variables important to the safe operation of mode. If the mode input began oscillating continuously between a logic high and low, the PS would only allow the mode to change if permissive conditions for the current mode are

. If the permissive conditions place the IU into a state that within the transitioned mode are ide of the predetermined operating limits, then the TRPS would initiate an IU Cell Safety uation and transition to and maintain Mode 3, ignoring any further input from the discrete de input.

ations exist in the design where TRPS only actuates a Division A component and there is no esponding Division B component, or, there is a passive check valve credited as a redundant ponent. These situations are considered acceptable since the safety function includes a arate, redundant, and passive component (i.e., check valve) which does not need to be nitored or manipulated by the TRPS.

h input variable to the TRPS for monitoring and indication only is processed on independent t submodules that are unique to that input. If the variable is not used for a safety function

, no trip determination is performed with the variable or the variable is used only for actuated ponent position indication), then the variable is not connected to the safety data buses and is placed onto the monitoring and indication bus. The monitoring and indication bus is used by monitoring and indication communication module (MI-CM) without interacting with any of the ty data paths.

TRPS provides separate communication paths to the PICS display systems from each of the e TRPS divisions. TRPS divisions A and B are powered from a separate division of the terruptible electrical power supply system (UPSS); TRPS division C receives auctioneered er from both UPSS divisions A and B.

3.5 Operating Conditions TRPS control and logic functions are located inside of the facility control room, where the ironment is mild and not exposed to the irradiation process, and is not subjected to rational cycling. However, cables providing signals to and from the TRPS are routed through radiologically controlled area (RCA) and into the IUs, where those cables are exposed to sher environments. Many of the sensors providing information to the TRPS are connected to primary system boundary, so the cable routing to these sensors is exposed to the operating ironment of the irradiation process.

ing normal operation, the TRPS equipment will operate in the applicable normal radiation ironments identified in Table 7.2-1 for up to 20 years, replaced at a frequency sufficient such the radiation qualification of the affected components is not exceeded.

NE Medical Technologies 7.4-23 Rev. 2

conditioning (HVAC) systems are relied upon to maintain the temperature and humidity ameters in these areas. The facility HVAC systems are described in Section 9a2.1.

3.6 Seismic, Tornado, Flood TRPS equipment is installed in the seismically qualified portion of the main production facility re it is protected from earthquakes, tornadoes, and floods. The TRPS equipment is Seismic egory I, designed in accordance with Section 8 of IEEE Standard 344-2013 (IEEE, 2013).

3.7 Human Factors TRPS provides the following manual actuation capabilities via individual manual push ons for each TRPS subsystem:

IU Cell Safety Actuation

IU Cell Nitrogen Purge

Driver Dropout h TRPS Divisions A and B respond to the activation of a push button. A manual IU Cell TPS uation on all eight TRPS subsystems is initiated via the manual TPS Isolation push button ted on the ESFAS main control board panel (see Subsection 7.5.3.6).

support the use of manual safety actuations, the TRPS subsystem associated with each IU includes isolated outputs for each safety-related instrument channel to provide monitoring indication information to the PICS. To facilitate operator indication of mode control status, PS actuation function status, manual initiation, and reset of protective actions, the TRPS, at division level, includes isolated input/output for the following:

Indication of TRPS variable values

Indication of TRPS parameter values

Indication of TRPS logic status

Indication of TRPS equipment status

Indication of TRPS actuation device status

Indication of TRPS mode rator display criteria and design are addressed in Section 7.6.

3.8 Loss of External Power TRPS is powered from the UPSS, which provides a reliable source of power to maintain the PS functional during normal operation and during and following a design basis event. The SS is designed to provide power to the TRPS for two hours after a loss of off-site power. The SS is described in Section 8a2.2.

trolled components associated with safety actuations are designed to go to their safe state n deenergized. On a loss of power to the TRPS, the TRPS deenergizes actuation ponents to the positions defined below:

NE Medical Technologies 7.4-24 Rev. 2

NDAS HVPS breakers - Open Primary System Boundary Components

TSV fill isolation valves - Closed

TSV dump tank drain isolation valve - Closed

TOGS gas supply isolation valves - Closed

TOGS vacuum tank isolation valves - Closed

VTS lower lift tank target solution valves - Closed Primary Confinement Components

PCLS supply isolation valve - Closed

PCLS return isolation valves - Closed

RVZ1e IU cell isolation valves - Closed

RVZ1r RPCS supply isolation valve - Closed

RVZ1r RPCS return isolation valve - Closed

TPS target chamber supply isolation valves - Closed

TPS deuterium supply isolation valves - Closed

TPS target chamber exhaust isolation valves - Closed

TPS neutron driver evacuation isolation valves - Closed

TOGS RPCS supply isolation valves - Closed

TOGS RPCS return isolation valve - Closed

NDAS target/ion source cooling supply isolation valve - Closed

NDAS target/ion source cooling return isolation valve - Closed

NDAS vacuum pump cooling supply isolation valve - Closed

NDAS vacuum pump cooling return isolation valve - Closed Nitrogen Purge Components

N2PS inerting gas isolation valves - Open

TOGS nitrogen vent isolation valves - Open 3.9 Fire Protection TRPS design utilizes physical separation to minimize the effects from fire or explosion.

ety-related equipment for different divisions is located in separate fire areas when practical.

eptions include components for all three divisions located in the facility control room, in an vidual irradiation unit (IU) or in TOGS cells, and in other locations where end devices are alled.

sical separation is used to achieve separation of redundant sensors. Wiring for redundant sions uses physical separation and isolation to provide independence for circuits. Separation iring is achieved using separate wireways and cable trays for each of Division A, Division B, Division C. Division A and C cables are routed along the south side of the RPF to go to the lity control room and Division B cables are routed on the north side of the RPF. Where sible, conduit is routed subgrade to provide additional separation. Instrument transmitters are ted in separate areas: A and C instrumentation is located primarily on the east side of the n production facility G-line wall, while Division B is along the west side of the wall.

NE Medical Technologies 7.4-25 Rev. 2

Class C fire extinguishers for fire suppression are utilized in the facility control room to nguish fires originating within a cabinet, console, or connecting cables. Wet sprinklers are not d in the facility control room to avoid potentially impairing the ability of the TRPS to perform its ty functions.

combustible and heat resistant materials are used whenever practical in the TRPS design, icularly in locations such as confinement boundaries and the facility control room. Use of erials that release toxic or corrosive gases under combustion is minimized.

safety-related TRPS inputs and outputs are routed in non-divisional cable raceways and are regated from safety-related inputs and outputs. Spatial separation between cable and eway groups is in accordance with Section 5.1.1.2, Table 1 of Section 5.1.3.3, and Table 2 of tion 5.1.4 of IEEE 384-2008 (IEEE, 2008).

3.10 Classification and Identification h TRPS cable and component is uniquely identified in accordance with the SHINE ponent numbering guidelines. The equipment identification includes, but is not limited to, tem designation (code), equipment train, and division.

3.11 Setpoints servative setpoints for the TRPS monitored variables are established based in documented lysis methodology (Subsection 7.2.1). Setpoint analysis parameters typically consider rument precision, sensitivity, accuracy, loop uncertainties, and computational errors.

quate margin is required between the setpoints and the associated safety limits to ensure the ective action is initiated prior to the safety limit being exceeded. The setpoint values are ved from approved system design technical reports, design calculations, uncertainty ulations, and technical specifications.

3.12 Prioritization of Functions APL (which is constructed of discrete components and part of the EIM) is designed to vide priority to safety-related signals over nonsafety-related signals. Division A and Division B rity logic of the TRPS prioritizes the following TRPS inputs, with the first input listed having highest priority and each successive input in the list having a lower priority than the previous:

1) Automatic Safety Actuation, Manual Safety Actuation

2) PICS nonsafety control signals manual actuation signals input from the operators in the facility control room is brought ctly into the discrete APL The manual actuation input into the priority logic does not have the ity to be bypassed and will always have equal priority to the automated actuation signal over other signals that are present.

NE Medical Technologies 7.4-26 Rev. 2

following codes and standards are applied to the TRPS design:

1) Section 8 of IEEE Standard 344-2013, IEEE Standard for Seismic Qualification of Equipment for Nuclear Power Generating Stations (IEEE, 2013); invoked as guidance to meet TRPS Criterion 14.

2) IEEE Standard 379-2000, IEEE Standard Application of Single-Failure Criterion to Nuclear Power Generating Station Safety Systems (IEEE, 2000); invoked as guidance to meet SHINE Design Criterion 15.

3) IEEE Standard 384-2008, IEEE Standard Criteria for Independence of Class 1E Equipment and Circuits (IEEE, 2008); invoked as guidance for separation of safety-related and nonsafety-related cables and raceways to meet TRPS Criteria 20 and 21, and as described in Subsection 8a2.1.3 and Subsection 8a2.1.5.

4) IEEE Standard 1012-2004, IEEE Standard for Software Verification and Validation (IEEE 2004a); invoked as guidance to meet TRPS Design Criterion 8.

5) Section 5.2.1 of IEEE Standard 1050-2004, IEEE Guide for Instrumentation and Control Equipment Grounding in Generating Stations (IEEE, 2004b); invoked as guidance to meet TRPS Criterion 46 and to support electromagnetic compatibility qualification for digital I&C equipment.

6) The guidance of ANSI/ANS 15.8-1995, Quality Assurance Program Requirements for Research Reactors (R2013) (ANSI/ANS, 1995), as endorsed by Regulatory Guide 2.5, Quality Assurance Program Requirements for Research and Test Reactors (USNRC, 2010), is applied as part of the SHINE Quality Assurance Program for complying with the programmatic requirements of 10 CFR 50.34(b)(6)(ii).

4 OPERATION AND PERFORMANCE section 7.4.4 discusses the operation of the TRPS.

TRPS design basis functions utilize redundant logic to ensure safe and reliable operation to prevent a single failure from defeating the intended function. Additional information related he effects of single failure, reliability, redundancy, and independence can be found in section 7.4.2 and Subsection 7.4.5.

4.1 Monitored Variables and Response le 7.4-1 identifies specific variables that provide input into the TRPS and includes the rument range for covering normal and accident conditions, the accuracy for each variable, the lytical limit, and response time. A discussion of each variable (signal input) and the system ponse is provided in this section.

4.1.1 High Source Range Neutron Flux high source range neutron flux signal protects against an insertion of excess reactivity during filling process (Subsection 13a2.1.2, Scenarios 5, 6, and 11). The signal is generated by PS when a source range neutron flux input exceeds the high level setpoint. The TRPS asses safety actuations based on the high source range neutron flux signal when filling vities cannot be in progress (i.e., Modes 2, 3, and 4), because the fill isolation valves are ed. The signal is transmitted as an analog input to the TRPS from the neutron flux detection NE Medical Technologies 7.4-27 Rev. 2

Cell Safety Actuation is initiated.

4.1.2 Low Power Range Neutron Flux low power range neutron flux signal protects against loss of the neutron beam followed by a art of the neutron beam outside of analyzed conditions (Subsection 13a2.1.2, Scenario 4).

signal is generated by TRPS when a power range neutron flux input exceeds the low level oint. The low power range neutron flux is only used during the irradiation process (Mode 2) is bypassed in the other modes of operation. Safety actuations based on the low power ge neutron flux are bypassed until the power range neutron flux has reached the power range er dropout permissive. Once power range neutron flux levels have risen above the high oint, then the bypass on the low power range neutron flux is removed. The power range tron flux is measured as an analog input to the TRPS from the NFDS through three pendent and redundant channels, one for each division of TRPS. When two-out-of-three or e low power range neutron flux signals are active, a timer is started that must run to pletion for a Driver Dropout to be initiated. If, while the timer is running, less than two-out-of-e low power range neutron flux actuation signals are active, the timer is reset and the TRPS tinues operating under normal conditions.

4.1.3 High Time-Averaged Neutron Flux high time-averaged neutron flux signal protects against exceeding analyzed TSV power ls during Modes 1 and 2 (Subsection 13a2.1.2, Scenarios 1, 3, 5, and 10; section 13a2.1.6, Scenarios 2 and 5; and Subsection 13a2.1.8). The high time-averaged tron flux signal is generated by the TRPS, which averages the power range neutron flux input r a set time period, and compares the averaged power to the high level setpoint. The power ge neutron flux is measured as an analog input to the TRPS from the NFDS through three pendent and redundant channels, one for each division of TRPS. When two-out-of-three or e high time-averaged neutron flux signals are active, an IU Cell Safety Actuation is initiated.

4.1.4 High Wide Range Neutron Flux high wide power range neutron flux signal protects against exceeding solution power density ts during Modes 1 and 2 (Subsection 13a2.1.2, Scenario 4; and Subsection 13a2.1.8). The al is generated by TRPS when a wide range neutron flux input exceeds the high level oint. The wide range neutron flux is measured as an analog input to the TRPS from the DS through three independent and redundant channels, one for each division of TRPS. When

-out-of-three or more high wide range neutron flux actuation signals are active, an IU Cell ety Actuation is initiated.

4.1.5 High PCLS Temperature high PCLS temperature signal protects against a loss of cooling that could cause target tion heat-up (Subsection 13a2.1.2, Scenarios 2, 3, and 11; Subsection 13a2.1.3, narios 1 and 2; Subsection 13a2.1.6, Scenario 2; and Subsection 13a2.1.11, Scenario 2).

signal is generated by TRPS when a PCLS temperature input exceeds the high level oint. The PCLS temperature is measured on three different channels, one for each TRPS sion. Safety actuations based on high PCLS temperature are not bypassed when target NE Medical Technologies 7.4-28 Rev. 2

must run to completion before initiating an IU Cell Safety Actuation. If, while the timer is ning, less than two-out-of-three high PCLS temperature signals are active, the timer is reset the TRPS continues operating under normal conditions. The timer is based on the eptability of a complete loss of cooling for up to three minutes prior to transferring target tion to the TSV dump tank.

4.1.6 Low PCLS Temperature low PCLS temperature signal protects against an overcooling of the target solution that ld cause an excess reactivity insertion (Subsection 13a2.1.2.2, Scenarios 2 and 3; and section 13a2.1.11.2, Scenario 2). The signal is generated by TRPS when a PCLS perature input exceeds the low level setpoint. The PCLS temperature is measured on three rent channels, one for each TRPS division. Safety actuations based on PCLS temperature not bypassed during filling and irradiation of the TSV (Mode 1 and Mode 2) and are bypassed ll other modes. When two-out-of-three or more PCLS temperature inputs drop below the wable limit, an IU Cell Safety Actuation is initiated.

4.1.7 Low PCLS Flow low PCLS flow signal protects against a loss of cooling that could cause target solution bulk ing (Subsection 13a2.1.3.2, Scenarios 1 and 2; Subsection 13a2.1.6.2, Scenario 2; and section 13a2.1.11.2, Scenario 1). The signal is generated by TRPS when a PCLS flow input eeds the low level setpoint. The PCLS flow is measured with an analog interface on three rent channels, one for each TRPS division. Safety actuation based on PCLS flow is not assed during filling and irradiation of the TSV (Mode 1 and Mode 2) and is bypassed in all er modes. When two-out-of-three or more PCLS flow inputs drop below the allowable limit, a r is started that must run to completion before initiating an IU Cell Safety Actuation. If, while timer is running, less than two-out-of-three low PCLS flow signals are active, the timer is et and the TRPS continues operating under normal conditions. The timer is based on the eptability of a complete loss of cooling for up to three minutes prior to transferring target tion to the TSV dump tank.

4.1.8 Low-High TSV Dump Tank Level low-high TSV dump tank level signal protects against a leak of liquid into the TSV dump k, preventing the ability to transfer the entire batch of target solution from the TSV into the dump tank (Subsection 13a2.1.2.2, Scenario 5). The low-high TSV dump tank level signal results in a nitrogen purge of the IU for an anticipatory loss of TSV dump tank headspace r target solution has been transferred to the TSV dump tank (Subsection 13a2.1.9.2, nario 1). The low-high TSV dump tank level signal is received by the TRPS as a discrete t from level switches associated with three different channels, one for each TRPS division.

low-high TSV dump tank level switches are physically separate from the high-high level ches described in Subsection 7.4.4.1.9. Safety actuations based on the low-high TSV dump signal are bypassed during post irradiation when target solution is expected to be in the TSV p tank (Mode 3 and Mode 4). The low-high TSV dump tank signal is used as a permissive dition to transition operational modes from transferring of the target solution to the RPF de 4) to operating with no target solution in the IU (Mode 0). When two-out-of-three or more NE Medical Technologies 7.4-29 Rev. 2

4.1.9 High-High TSV Dump Tank Level high-high TSV dump tank level signal protects against an overfill of the TSV dump tank ater than the volume of target solution expected to be transferred from the TSV),

promising the ability of the TOGS to remove hydrogen from the TSV dump tank headspace bsection 13a2.1.9.2, Scenario 1). The high-high TSV dump tank level signal is received by TRPS as a discrete input from level switches on three different channels, one for each TRPS sion. The high-high TSV dump tank level switches are physically separate from the low-high l switches described in Subsection 7.4.4.1.8. When two-out-of-three or more high-high TSV p tank signals are active, an IU Cell Safety Actuation and an IU Cell Nitrogen Purge are ated.

4.1.10 Low TOGS Oxygen Concentration low TOGS oxygen concentration signal protects against a deflagration in the primary system ndary caused by the inability to recombine hydrogen with oxygen (Subsection 13a2.1.9.2, nario 1). The signal is generated by TRPS when a TOGS oxygen concentration input eeds the low level setpoint. The TOGS oxygen signal is measured with an analog interface hree different channels, one for each division of TRPS. When two-out-of-three or more TOGS gen concentration inputs drop below the allowable limit, an IU Cell Safety Actuation and an Cell Nitrogen Purge are initiated.

4.1.11 Low TOGS Mainstream Flow low TOGS mainstream flow signal protects against a deflagration in the primary system ndary caused by the inability to sweep accumulated hydrogen through the TOGS hydrogen ombiners (Subsection 13a2.1.9.2, Scenario 1; and Subsection 13a2.1.11.2, Scenario 1). The al is generated by TRPS when a TOGS mainstream flow input exceeds the low level oint. TOGS mainstream flow is measured independently for both TOGS Train A and TOGS n B. The TOGS mainstream flow is measured with an analog interface on three different nnels, one for each division of TRPS. Safety actuations based on the low TOGS mainstream are bypassed when no target solution is present in the IU. When two-out-of-three or more GS mainstream flow inputs drop below the allowable limit, an IU Cell Safety Actuation and an Cell Nitrogen Purge are initiated.

4.1.12 Low TOGS Dump Tank Flow low TOGS dump tank flow signal protects against a deflagration in the TSV dump tank sed by an inability to remove accumulated hydrogen from that tank (Subsection 13a2.1.9.2, nario 1; and Subsection 13a2.1.11.2, Scenario 1). The signal is generated by TRPS when a GS dump tank flow input exceeds the low level setpoint. TOGS dump tank flow is only asured for TOGS Train A, which is the only TOGS train that provides sweep gas flow to the dump tank. The TOGS dump tank flow is measured with an analog interface on three rent channels, one for each division of TRPS. Safety actuations based on the low TOGS p tank flow are bypassed when no target solution is present in the IU. When two-out-of-three ore TOGS dump tank flow inputs drop below the allowable limit, an IU Cell Safety Actuation an IU Cell Nitrogen Purge are initiated.

NE Medical Technologies 7.4-30 Rev. 2

high TOGS condenser demister outlet temperature signal protects against adverse effects TOGS instrumentation and zeolite beds, causing them to fail to perform their safety functions bsection 13a2.1.9.2, Scenario 1). The signal is generated by TRPS when a TOGS condenser ister outlet temperature input exceeds the high level setpoint. TOGS condenser demister et temperature is measured independently for both TOGS Train A and TOGS Train B. The GS condenser demister outlet temperature signal is measured with a temperature interface hree different channels, one for each TRPS division. When two-out-of-three or more TOGS denser demister outlet temperature inputs exceed the allowable limit, an IU Cell Safety uation and an IU Cell Nitrogen Purge are initiated.

4.1.14 ESFAS Loss of External Power ESFAS loss of external power signal is an anticipatory protection against the impending loss OGS blowers and recombiners after the runtime of that equipment on the UPSS has been eeded (Subsection 13a2.1.9.2, Scenario 1). The signal is generated by ESFAS and provided ach of the eight TRPS subsystems when ESFAS senses a loss of external (i.e., normal) er being provided to the UPSS as described in Subsection 7.5.4.1.19. TRPS does not eive the loss of external power signal from ESFAS until three minutes after the external power

. The ESFAS loss of external power signal is measured with a discrete input signal on two rent channels, one for each Division A and Division B of TRPS. When an ESFAS loss of rnal power signal is active, the division receiving the discrete signal initiates an IU Cell ogen Purge.

4.1.15 High RVZ1e IU Cell Radiation high RVZ1e radiation signal protects against a breach in the primary system boundary bsection 13a2.1.4.2, Scenario 4; and Subsection 13a2.1.9.2, Scenario 2). The signal is erated by TRPS when an RVZ1e IU cell radiation input exceeds the high level setpoint. The Z1 radiation is measured with an analog interface on three different channels, one for each sion of TRPS. When two-out-of-three or more RVZ1 radiation channels exceed the allowable t, an IU Cell Safety Actuation is initiated.

4.1.16 TSV Fill Isolation Valve Fully Closed SV fill isolation valve fully closed signal protects against the inadvertent addition of target tion to the TSV (Subsection 13a2.1.2.2, Scenario 6). The TSV fill isolation valve fully closed ition indication is received by the TRPS as a discrete input from redundant position indicating t switches on two different channels for each valve. When one-out-of-two or more TSV fill ation valve fully closed signals are no longer active for either of the TSV fill isolation valves, U Cell Safety Actuation is initiated. IU Cell Safety Actuation on TSV fill isolation valves fully ed is only active when the IU cell is undergoing irradiation (Mode 2).

4.1.17 ESFAS IU Cell TPS Actuation ESFAS IU Cell TPS Actuation protects against release of tritium events in the TPS bsection 13a2.1.6.2, Scenario 3; and Subsection 13a2.1.12.2, Scenario 1). The actuation al is generated by ESFAS and provided to only the affected TRPS subsystems when the FAS initiates a TPS Train A/B/C Isolation as described in Subsections 7.5.3.1.18, 7.5.3.1.19, NE Medical Technologies 7.4-31 Rev. 2

Actuation is active, the division receiving the discrete signal initiates an IU Cell TPS uation.

4.1.18 Fill Stop nonsafety-related Fill Stop function aids in controlling the rate of fill of the TSV, as described ubsection 13a2.1.2.2, Scenario 6. If Fill Stop parameters are not met, then the Fill Stop nergizes the TSV fill isolation valves blocking the fill path into the TSV.

ing Mode 1, after NFDS source range neutron flux has reached or exceeded 40 percent of maximum 95 percent fill flux, if the TSV fill isolation valve fully closed position indication omes inactive, then a [ ]PROP/ECI timer is initiated. If the TSV fill isolation valve fully ed position indication is not active before the end of the [ ]PROP/ECI duration, then TRPS initiates a Fill Stop. If the TSV fill isolation valve fully closed position indication is active r to the end of the [ ]PROP/ECI duration, then the [ ]PROP/ECI timer resets.

ing Mode 1, after NFDS source range neutron flux has reached or exceeded 40 percent of maximum 95 percent fill flux, if the TSV fill isolation valve fully closed position indication omes active, a 5-minute timer is initiated. If the TSV fill isolation valve fully closed position cation becomes inactive prior to the duration of the 5-minute timer ending, then the TRPS ates a Fill Stop.

Fill Stop parameters ensure that target solution can only be added to the TSV for a ximum of [ ]PROP/ECI and that a 5-minute delay occurs between fill steps.

4.2 Operational Bypass, Permissiives, and Interlocks missive conditions, bypasses, and interlocks are created in each mode of operation specific hat mode to allow the operator to progress the TRPS to the next mode of operation. The PS implements logic associated with each mode of operation to prevent an operator from vating a bypass through changing the IU cell mode out of sequential order. Each mode of ration is achieved through manual input from the operator when permissive conditions for the t mode in the sequence have been met. See the TRPS mode state diagram in the TRPS logic rams (Figure 7.4-1) for the transitional sequence of the TRPS. Below are the required ditions that must be satisfied before a transition to the following mode in the sequence can be ated.

The TRPS shall only transition from Mode 0 to Mode 1 if all TSV dump valve position indications and all TSV fill isolation valve indications indicate valves are fully closed and the TOGS mainstream flow is above the minimum flow rate.

The TRPS shall only transition from Mode 1 to Mode 2 if the TSV fill isolation valve position indications indicate both valves are fully closed.

The TRPS shall only transition from Mode 2 to Mode 3 if all HVPS breaker position indications indicate the breakers are open.

The TRPS shall only transition from Mode 3 to Mode 4 if an IU Cell Safety Actuation is not present.

The TRPS shall only transition from Mode 4 to Mode 0 if the TSV dump tank level is below the low-high TSV dump tank level.

NE Medical Technologies 7.4-32 Rev. 2

Cell TPS Actuation, or Driver Dropout. The lists below identify each variable that is bypassed ng the different modes of operation.

ety actuations based on the following instrumentation channels are bypassed in Mode 0:

Low power range neutron flux

Low PCLS temperature

High PCLS temperature

Low PCLS flow

Low TOGS mainstream flow (Train A) (Train B)

Low TOGS dump tank flow

High TOGS condenser demister outlet temperature (Train A) (Train B)

ESFAS loss of external power ety actuations based on the following instrumentation channels are bypassed in Mode 1:

Low power range neutron flux

TSV fill isolation valve not fully closed

Low PCLS flow

High PCLS temperature ety actuations and interlocks based on the following instrumentation channels are bypassed ode 2:

High source range neutron flux TRPS bypasses Driver Dropout on the low power range neutron flux signal until the power ge neutron flux is above the driver dropout permissive setpoint. The bypass is reapplied if e has been a change in mode of operation or if both HVPS breaker position indications cate in Mode 2 that they are open.

en the low power range neutron flux signal becomes active, a timer is started to create a

]PROP/ECI delay before a Driver Dropout is initiated. If fewer than two-out-of-three low er range neutron flux actuation signals are present before the timer has expired, then the low er range neutron flux timer resets.

PCLS flow and high PCLS temperature do not initiate an IU Cell Safety Actuation until after me delay of 180 seconds from the start of the low PCLS flow or high PCLS temperature al. If fewer than two-out-of-three low PCLS flow or high PCLS temperature signals are sent before the timer has expired, then the 180 second timer resets.

ety actuations and interlocks based on the following instrumentation channels are bypassed ode 3:

High source range neutron flux

Low power range neutron flux

High PCLS temperature

Low PCLS temperature NE Medical Technologies 7.4-33 Rev. 2

TSV fill isolation valve fully closed TRPS includes the ability for the operator to transition the system from Mode 3 operation to cure state of operation. While in the secure state, an interlock is maintained preventing the PS from transitioning to the next sequential mode. The control key, via use of a facility master rating permissive, is used to place the TRPS into and out of the secure state.

ety actuations and interlocks based on the following instrumentation channels are bypassed ode 4:

High source range neutron flux

Low power range neutron flux

High PCLS temperature

Low PCLS temperature

Low PCLS flow

Low-high TSV dump tank level signal

TSV fill isolation valve fully closed en a mode of operation changes, the bypasses from the previous mode are automatically oved as they are no longer appropriate. The status of each bypass is provided to the operator ugh the monitoring and indication bus to the PICS, including any channel placed in ntenance bypass (Subsection 7.4.4.3), which allows the operator to confirm that a function been bypassed or returned to service.

4.3 Maintenance Bypass h SFM can be placed in maintenance bypass or in a trip state by use of the OOS switch ted on the front of the SFM and an associated trip/bypass switch located below the SFM.

ails of the physical configuration and operation of the OOS and trip/bypass switches are vided in Sections 2.5.1 and 2.5.2 of Topical Report TR-1015-18653 (NuScale, 2017). Any PS channels placed in maintenance bypass for maintenance or testing, or removed from ntenance bypass, will be displayed to the operators in the facility control room through the nitoring and indication bus to the PICS.

ndividual SFM within a TRPS division is allowed to be placed in maintenance bypass for up wo hours while the associated input channel(s) is required to be operable, in accordance with technical specifications, for the purpose of performing required technical specification veillance testing. A time limit of two hours is acceptable based on the small amount of time the nnel could be in bypass, the continual attendance by operations or maintenance personnel ng the test, the continued operability of the redundant channel(s), and the low likelihood that accident would occur during the two hour time period.

SFM may also be placed in trip by use of the OOS and trip/bypass switches, as described in tions 2.5.1 and 2.5.2 of Topical Report TR-1015-18653 (NuScale, 2017). Placing an SFM in preserves the single failure criterion for variables associated with that SFM where three nnels are provided. In cases where only two channels are provided, placing a channel in trip ves to actuate the associated safety function. Inoperable channels are required to be placed NE Medical Technologies 7.4-34 Rev. 2

4.4 Testing Capability ting of the TRPS consists of the inservice self-testing capabilities of the HIPS platform and odic surveillance testing.

-to-end testing of the entire HIPS platform is performed through overlap testing. Individual

-tests in the various components of the TRPS ensure that the entire component is functioning ectly. Self-test features are provided for components that do not have setpoints or tunable ameters. All TRPS components, except the discrete APL of the EIM, have self-testing abilities that ensure the information passed on to the following step in the signal path is ect.

discrete logic of the APL of the EIM does not have self-test capability but is instead tionally tested. This functional testing consists of periodic simulated automatic and manual ations to verify the functionality of the APL and the manual actuation pushbuttons.

ting of input devices consists of channel checks, channel tests, and channel calibrations.

nnel checks are performed while the channel is in service. Channel tests and channel brations may be performed while the IU is in a mode where the channel is required to be rable (i.e., inservice) by placing the associated SFM in maintenance bypass bsection 7.4.4.3). Channel tests and channel calibrations may also be performed when the nnel is not required to be operable.

4.5 Technical Specifications and Surveillance iting Conditions for Operation and Surveillance Requirements are established for TRPS logic, ng, and actuation divisions and instrumentation monitored by TRPS as input to safety ations.

5 HIGHLY INTEGRATED PROTECTION SYSTEM DESIGN 5.1 HIPS Design Summary IPS platform is used to achieve the desired architecture for system control. The HIPS form is a generic digital safety-related instrumentation and control platform devoted to the lementation of safety-related applications in nuclear facilities. The platform is a logic-based form that does not utilize software or microprocessors for operation. It is composed of logic is implemented using discrete components and FPGA technology. The platform is described etail in Section 2.0 of Topical Report TR-1015-18653 (NuScale, 2017). The HIPS platform is zed for the design of the TRPS and ESFAS (Section 7.5).

TRPS HIPS design is shown in Figure 7.1-2.

NE Medical Technologies 7.4-35 Rev. 2

5.2.1 Independence HIPS design incorporates the independence principles outlined in Section 4.0 of Topical ort TR-1015-18653 (NuScale, 2017).

built-in self-test (BIST) feature in the FPGA logic is separate and independent of the FPGA ty function logic; thus, the programming of the FPGA safety function logic is not made more plex by the inclusion of the diagnostic and self-test FPGA logic.

TRPS and ESFAS structures, systems, and components that comprise a division are sically separated to retain the capability of performing the required safety functions during a ign basis accident. Division independence is maintained throughout both systems, extending the sensor to the devices actuating the protective function. Physical separation is used to ieve separation of redundant sensors. Wiring for redundant divisions uses physical aration and isolation to provide independence for circuits. Separation of wiring is achieved g separate wireways and cable trays for each of Division A, Division B, and Division C.

sion A and C are located on the opposite side of the facility control room from where sion B is located.

communications independence, the TRPS platform is designed such that each safety sion functions independently of other safety divisions. With the exception of interdivisional ng, communication within a division does not rely on communication outside the respective sion to perform the safety function. Safety-related inputs to the TRPS which originate within a cific division of the TRPS are input to, and processed in, only the same division prior to being vided to any other division of the system for voting purposes.

vidual TRPS units are supplied for each of the eight irradiation units.

5.2.2 Redundancy HIPS design incorporates the redundancy principles outlined in Section 5 of Topical ort TR-1015-18653 (NuScale, 2017). The use of the redundancy design principles meets ions of the criteria for redundancy in SHINE Design Criterion 15.

SFM is designed with three redundant signal paths and begins the communication paths for o-out-of-three comparison. This internal redundancy provides for easy fault detection, giving er reliability from spurious actuation without increasing the complexity of the design.

undancy within the safety I&C system platform architecture is achieved by employing two or e divisions of sensors, detectors, and trip determination, and two divisions of trip and ation circuitry. Three divisions of sensors, detectors, and trip determination are selected for tions where spurious actuation may significantly impact overall main production facility ration or for operational convenience; two divisions are used for other functions. Using tiple divisions of sensors and detectors and trip and actuation determination is one of the chanisms employed to satisfy single-failure criteria and improve system availability.

ncidence voting on functions with three divisions of trip determination is implemented so that ngle failure of an input process signal will not prevent a trip or actuation from occurring when NE Medical Technologies 7.4-36 Rev. 2

required.

ure 7.1-2 shows typical signal data flow paths in the HIPS platform.

5.2.3 Predictability and Repeatability HIPS design incorporates the predictability and repeatability principles outlined in Section 7 opical Report TR-1015-18653 (NuScale, 2017). The use of the predictability and repeatability ign principles meets portions of the criteria for ensuring an extremely high probability of omplishing safety functions as required by SHINE Design Criterion 19.

information in this section satisfies Application-Specific Action Items (ASAI) numbers 19, 56, 59 from Topical Report TR-1015-18653 (NuScale, 2017).

h SBVM of the two actuation divisions receives inputs from the trip determination portions of SFMs through isolated receive-only serial data paths. The trip determinations are combined e voting logic so that two or more trip inputs from the trip determination modules produce an ation output demand signal, which is sent to dedicated APL circuits to actuate the ropriate equipment associated with that division. Manual trip and actuation capability also vides a direct trip or actuation of equipment, as well as input to the automatic portion of the tem, to ensure the sequence is maintained.

meet a response time performance requirement of 500 milliseconds, a HIPS platform-based tem must acquire the input signal that represents the start of a response time performance uirement, perform logic processing associated with the response time performance uirement, and generate an output signal that represents the end of a response time ormance requirement. These HIPS platform response time components exclude: (1) the ier plant process delays through the sensor input to the platform, and (2) the latter delays ugh a final actuating device to affect the plant process (Figure 7.4-2). The required response s credited in the safety analysis for systems using the HIPS design (TRPS, ESFAS) cover process delays through the sensor input to the platform and the delays through the final ating device.

5.2.4 Diversity APL portions within an EIM support the implementation of different actuation methods.

ing the capability for hardwired signals into each EIM supports the capability for additional diverse actuation means from automated actuation. As an example, a division of APL circuits y receive inputs automatically from the programmable logic portion of the TRPS, inputs from nual controls in the facility control room, and input signals from a nonsafety control system.

h the manual controls and nonsafety control system inputs come individually into the APL and downstream of the programmable logic portion of the TRPS architecture as shown in ure 7.1-2.

APL is implemented using discrete components and is not vulnerable to a software CCF.

NE Medical Technologies 7.4-37 Rev. 2

ions of the criteria for diversity in SHINE Design Criterion 16.

information in this section satisfies the application-specific information requirements for AI numbers 62, 63, 64, and 65 from Topical Report TR-1015-18653 (NuScale, 2017).

rder to ensure performance in the presence of a digital CCF, the different divisions of the tem (TRPS, ESFAS) use different FPGA architectures (static random access memory, flash, ne-time programmable).

play of information is available to the operator(s) at various locations in the facility control

m. Information from the safety-related control systems is processed through the system PS or ESFAS) and is transmitted to PICS for display on the static display screens of the main trol board or at the operator workstation. Other information at the operator workstations or the n control board is aggregated from instruments throughout the facility and displayed to the rator. Section 7.6 provides further detail on the SHINE display systems.

5.2.5 Simplicity plicity attributes have been considered and incorporated into the design of the I&C system hitecture. The I&C system architecture is consistent with proven safety system designs used nuclear production facilities.

HIPS technology utilized is based on only four core modules. The use of FPGA technology ws for modules to perform a broader range of unique functions yet utilize the same core ponents. Increased flexibility with core components provides simplified maintainability. The ntity of spare parts can be reduced to blank modules that are programmed and configured as ded.

ctions within the FPGA of each module are implemented with finite state machines in order to ieve deterministic behavior. The HIPS platform does not rely on complex system/platform trollers. Dedicating SFMs to a function or group of functions based on its input provides rent function segmentation creating simpler and separate SFMs that can be more easily ed. This segmentation also helps limit module failures to a subset of safety functions.

physical layer of a communication module (CM) used for intradivisional communication is a tidrop topology; however, the flexibility afforded by FPGAs allows implementation of a simple al point-to-point communication protocol. Autonomous modules allow for simpler component ing, implementation, and integration.

of fundamentally different FPGA architectures provides a simple and verifiable approach to ipment and design diversity. By simply implementing safety functions on an SFM based on its ts, safety functions have been segmented to provide functional diversity. The discrete and grammable logic circuits on an EIM provide a clear distinction between those portions that are are not vulnerable to a software CCF. These diversity attributes simplify the system design ot having to install a separate diverse actuation system to address software CCF concerns.

lementation of triple redundant communication within a division of a HIPS platform increases number of components (e.g., additional CMs) but provides simpler maintenance and NE Medical Technologies 7.4-38 Rev. 2

s not cause all safety functions of that division to be inoperable.

ctions within the FPGA of each module are implemented with finite state machines in order to ieve deterministic behavior. Deterministic behavior allows implementation of a simple munication protocol using a predefined message structure with fixed time intervals. This ple periodic communication scheme is used throughout the architecture. Communication ween SFMs and CMs is implemented through a simple and well-established RS-485 physical

r. The configurable transmit-only or receive-only ports on a CM use a point-to-point physical

r. Communication between modules is done asynchronously which simplifies implementation voiding complex syncing techniques.

5.3 Access Control and Cyber Security secure development operating environment, cyber security requirements, and access trol are discussed in this section.

5.3.1 Secure Development Operating Environment developmental process for creating safety-related applications (TRPS and ESFAS) has n delegated to SHINE's safety-related control system vendor. The process addresses the ential cyber security vulnerabilities (physical and electronic) in the developmental phases of software and the controls to prevent unauthorized physical and electronic access. The ure development controls are applied from developing the requirements of the software, igning the software, integrating the hardware and software, and testing the system. The elopment controls include physical access controls at the development facility, personnel ess controls that limit access to the system design information to authorized individuals, and use of an IDN.

HIPS platform contains design features that reduce the susceptibility to inadvertent access oth hardware and software and undesirable behavior from connected systems. These form features support the establishment and use of a secure operational environment and ective measures to maintain it.

cific requirements are defined to provide and maintain a secure operational environment ng the defined modes of operation. A requirements traceability matrix is used throughout the elopment process. Bi-directional traceability is independently verified to ensure that uirements are implemented (forward tracing) and that no unwanted or unnecessary code has n introduced (backward tracing).

5.3.2 Cyber Security Design Features efensive system architecture is utilized as shown in Figure 7.1-1.

defensive system architecture has the following characteristics:

Communication outside of the system while in service is through one-way isolated communication ports over point-to point cables.

NE Medical Technologies 7.4-39 Rev. 2

Communication from a maintenance workstation (MWS) to a HIPS chassis is only allowed when the affected module is placed out of service by activating the OOS switch using a temporary cable that is attached from the MWS to a HIPS chassis.

No capability for remote access to the safety system is included with the HIPS platform design.

5.3.3 Access Control itional access control features include:

Required use of a physical key at the main control board to prevent unauthorized use.

Rack mounted equipment is installed within cabinets that can be locked so access can be administratively controlled.

FPGAs on any of the HIPS modules cannot be modified (for static random-access memory type) or replaced (for one-time programmable or flash types) while installed in the HIPS chassis.

Capability to modify modules installed in the HIPS chassis is limited to setpoints and tunable parameters that may require periodic modification.

h division has a nonsafety-related MWS for the purpose of online monitoring and offline ntenance and calibration. The HIPS platform MWS supports online monitoring through

-way isolated communication ports. The MWS is used to update setpoints and tunable ameters in the HIPS chassis when the safety function is out of service. Physical and logical trols are put in place to prevent modifications to a safety channel when it is being relied upon erform a safety function. A temporary cable and OOS switch are required to be activated ore any changes can be made to an SFM. When the safety function is removed from service, er in bypass or trip, an indication is provided by the HIPS platform that can be used to drive alarm in the facility control room to inform the operator. Adjustments to parameters are ormed in accordance with technical specifications, including any that establish the minimum ber of redundant safety channels that must remain operable for the applicable operating de and conditions.

5.4 Software Requirements Development ety-related systems are designed and implemented using a programmable logic-based I&C form that is based on fundamental safety-related I&C design principles of independence, undancy, predictability and repeatability, and diversity, and was developed specifically to vide a simple and reliable solution for safety-related applications. These design principles contribute to simplicity in both the functionality of the system and in its implementation.

systems are implemented on a logic-based platform that does not utilize traditional software icroprocessors for operation. It is composed of logic implemented using discrete ponents and FPGA technology. The platform design was developed to support meeting the elines and the requirements of NRC Regulatory Guides and IEEE standards applicable to ty-related applications.

HIPS platform has been reviewed and approved by the NRC for use in safety-related lications for commercial nuclear power plants (NuScale, 2017).

NE Medical Technologies 7.4-40 Rev. 2

elopment activities are complete are also delegated to the vendor.

systems are developed using the vendor's Project Management Plan, which describes a ned and systematic approach to design, implement, test, and deliver the safety-related tems (TRPS, ESFAS). The approach defines the technical and managerial processes essary to develop high-quality products that satisfy the specified requirements.

systems are developed in accordance with the vendor's Project Quality Assurance Plan ch defines the techniques, procedures, and methodologies used to develop and implement systems.

5.4.1 Key Responsibilities NE is responsible for providing oversight of the vendor, verifying deliverables are developed ccordance with approved quality and procurement documents, and maintaining the vendor as approved supplier on the SHINE approved supplier list.

vendor is responsible for developing and delivering the safety-related control systems in ordance with the processes identified in this section.

key responsibilities for the system development activities are identified in the vendor's ject Management Plan and project implementing procedures.

5.4.2 Programmable Logic Lifecycle Process programmable logic lifecycle process is shown in Figure 7.4-3 and provides an overview of programmable logic development process from planning through installation. The grammable logic lifecycle process is implemented through the vendor system design control cedure. The procedure defines the minimum system design control tasks from the planning se through the shipment phase.

ign interfaces are established during the design development process, and during the design ew and approval process. Design interfaces are controlled in accordance with the Project nagement Plan. The design interfaces include addressing any impacts on the safety system, trol console, or display instruments during the lifecycle process.

5.4.2.1 Planning Phase NE procurement and technical documents (e.g., specifications, drawings, input/output abase) are inputs to the planning phase. These documents are reviewed by the vendor to tify design input documents containing system requirements. The design input documents formally received from SHINE and controlled by version and date. Design output documents data required by SHINE are identified and scheduled for development.

yRS that defines the system design requirements detail is generated. The SyRS is generated ccordance with the vendor SyRS development procedure. A system design description is erated to define the system design details.

NE Medical Technologies 7.4-41 Rev. 2

Project Configuration Management Plan

Project V&V Plan

Project Equipment Qualification Plan

Project Test Plan

Project Security Plan

Project Integration Plan nning phase documents are verified and processed in accordance with the vendor design ument and data control procedures.

5.4.2.2 Requirements Phase ardware requirements specification (HRS) is generated by the vendor to define the system dware requirements detail. The HRS is generated in accordance with the vendor HRS elopment procedure.

ogrammable logic requirements specification (PLRS) is generated to translate the conformed ign specification into project-specific programmable logic requirements. The PLRS is erated in accordance with the vendor PLRS development procedure.

PLRS is reviewed in accordance with the vendor verification process procedure.

grammable logic lifecycle activities from this point forward are performed within an SDE using DN. Exceptions for the use of an SDE and IDN may be specified by management in ordance with contract requirements and/or regulatory requirements, as defined in the vendor E and IDN Security Plan.

PLRS defines what the programmable logic should do, but not how the programmable logic ets the requirements. The complete description of the functions to be performed by the grammable logic is included in the PLRS.

en the programmable logic requirements are expressed by a requirement specification del, the model elements are categorized as either:

Model elements that represent programmable logic requirements including derived requirements, or

Model elements that do not represent programmable logic requirements.

requirement specification model is developed to define the programmable logic functionality ccordance with the vendor model-based development procedure and reviewed in accordance the vendor verification process procedure.

5.4.2.3 Design Phase input documents to the design phase are the SyRS, HRS, and PLRS.

NE Medical Technologies 7.4-42 Rev. 2

cification development procedure.

rogrammable logic design specification (PLDS) is generated to translate the PLRS into:

A description of the functional requirements

A description of the system or component architecture

A description of the control logic, data structures, input/output formats, interface descriptions, and algorithms PLDS is generated in accordance with the vendor PLDS development procedure and ewed in accordance with the vendor verification process procedure.

he case when a PLDS is expressed by a design specification model, model elements that do represent programmable logic requirements or architecture and are not input to a subsequent elopment activity may be included in a model (for example, comment elements). These ments will not be implemented in the executable code and therefore need to be clearly tified. Model elements are categorized as described in the vendor model-based development cedure as either:

Model elements that represent programmable logic design, including derived requirements or architecture, or

Model elements that do not represent programmable logic design or architecture.

ign specification models are developed in accordance with the vendor model-based elopment procedure and are traceable, verifiable, and consistent.

ependent design review is performed to verify that the design meets the system requirements ccordance with the vendor verification process procedure. Design tests are performed to date that the design meets the system requirements in accordance with the vendor test trol procedure.

5.4.2.4 Implementation Phase input documents to the implementation phase are the completed tasks and approved uments from the development phase. Although implementation phase activities may proceed, outputs from the implementation phase are not approved until the development phase uments are approved.

HIPS platform hardware and programmable logic components are integrated into the project ng this phase to provide the target hardware and incorporate the HIPS platform grammable logic that has been previously designed, developed, tested, qualified, and lemented.

implementation phase ends at the completion of the programmable logic design, elopment, and verification. Exit to the test phase occurs when the completed programmable c is ready for validation on target hardware.

NE Medical Technologies 7.4-43 Rev. 2

dor conditional release procedure prior to beginning test phase activities.

roved documents ready for V&V are placed into configuration management prior to lementation phase exit.

5.4.2.5 Test Phase test phase is the validation phase. Outputs from this phase, which are requirements of the ect but may not serve as inputs to the shipment phase, are completed prior to test phase exit.

ification that test phase tasks are complete and output documents are approved serves as control point to transition the project from the test phase to the shipment phase. The test se V&V summary report documents the test phase exit. Proceeding beyond the control point ore control point exit criteria are met adds risk to the successful completion of the project. If trol point exit criteria are not met, a conditional release may be issued in accordance with the dor conditional release procedure prior to the shipment phase.

roved documents are placed into configuration management prior to test phase exit.

5.4.2.6 Shipment Phase and Installation shipment phase prepares the system for shipment and ships the system to SHINE. Output uments from this phase are completed prior to shipment phase exit.

shipment phase V&V summary report is completed. The final V&V report documents the pleted project V&V activities.

pment phase documents are verified to be complete and approved prior to transitioning the ect from the shipment phase.

roved documents are placed into configuration management prior to shipment phase exit.

tems are installed and site acceptance tests are performed in accordance with written plans instructions prepared and controlled under the installer's quality assurance program. SHINE sponsible for providing oversight of the installer and maintaining the installer as an approved plier on the SHINE approved supplier list.

5.4.3 Programmable Logic Regression Analysis al release of a PLRS or PLDS does not require regression analysis. Subsequent releases of S or PLDS require regression analysis to determine the required independent V&V activities erform. Regression analysis is performed if changes are made to previously tested grammable logic to determine the impact to all parts of the system. This regression analysis urs prior to the execution of tests. Any tests based on the identified changes and impact lysis to detect any possible errors due to the recent changes are rerun. When the grammable logic requirements are expressed by a requirement specification model or grammable logic design is expressed by a design specification model, the regression analysis erformed in accordance with vendor model-based development procedure.

NE Medical Technologies 7.4-44 Rev. 2

ystem requirements traceability matrix is developed by the vendor during each of the project ses. These traceability matrices are used for the traceability analysis tasks in each respective se. The system requirements traceability matrices are developed in accordance with the dor traceability matrix development procedure.

en using model-based development, identification of requirements in accordance with the hod defined in the vendor traceability matrix development procedure and vendor modeling dards document is used for bi-directional traceability between model elements and uirements external to the model.

5.4.5 Verification and Validation NE has delegated V&V activities related to the safety-related control system development to vendor. The vendor Project V&V Plan is designed to detect and report errors that may have n introduced during the system development process. The programmable logic verification cess verifies that:

System requirements allocated to programmable logic have been developed into programmable logic requirements that satisfy those system requirements.

Programmable logic requirements have been developed into logic architecture and design that satisfy the programmable logic requirements.

Logic architecture and design have been developed into code that satisfies the logic architecture and design.

Developed code satisfies the requirements and provides confidence that there is no unintended functionality.

Developed code is robust such that it can respond properly to abnormal inputs and conditions.

Methods used to perform this verification are technically correct and complete for the specified programmable logic integrity level.

E Standard 1012-2004 (IEEE, 2004a), Section 4, provides guidance on selection of criticality ls for software based on its intended use and application. The software and hardware eloped for the safety-related systems are classified as Software Integrity Level 2. The vendor ject V&V Plan for the system development was tailored and adapted for FPGA technology the guidance in IEEE Standard 1012-2004 (IEEE, 2004a). The V&V activities are mensurate with the expectations for a Software Integrity Level 2 classification. Successful pletion of V&V activities is documented.

V&V activities are performed using an internal V&V team from within the design anization. It is recommended, but not required, that the personnel performing the V&V vities are not the same personnel involved directly in the design. This organization structure selected taking into consideration the Software Integrity Level 2 classification of the project pe and the size of the vendor organization.

the lifecycle phases described in IEEE Standard 1012-2004 (IEEE, 2004a), the lifecycle ses applicable to the vendor work scope are the management and development phases. The V development phase activities follow the system development lifecycle as described in section 7.4.5.4.2.

NE Medical Technologies 7.4-45 Rev. 2

mensurate with those applied to the original design per the vendor system design control cedure.

V personnel review each design output at the end of its lifecycle phase, prior to approving the verable. Revision control is performed in accordance with the Project Configuration nagement Plan.

a and document reviews are performed in accordance with the vendor verification process cedure and testing activities are performed in accordance with the vendor test control cedure.

system requirements traceability matrices are used to generate comprehensive validation procedure(s) that ensure that each requirement is adequately tested and meets the system uirements. Test procedure(s) are generated by V&V personnel.

5.4.5.1 Management Phase V&V V&V effort performs the following V&V tasks for management of V&V:

Project V&V Plan Generation

Baseline Change Assessment

Management Review of V&V

Management and Technical Review Support

Interface with Organizational and Supporting Processes 5.4.5.2 Planning Phase V&V ification of the programmable logic planning process is conducted to ensure that the project s and procedures comply with the requirements and guidelines of the development dards and regulatory requirements, and that means are provided to execute the plans.

objectives of the planning phase verification are to:

Determine that the V&V methods enable the objectives of the development standards and regulatory guidelines.

Verify that the development processes can be applied consistently.

Verify that each development process produces evidence that its outputs can be traced to their activity and inputs, showing the degree of independence of the activity, the environment, and the methods used.

5.4.5.3 Requirements Phase V&V requirements phase reviews and analysis activities detect and report requirements errors may have been introduced during the requirements process. These reviews and analysis vities confirm that the programmable logic requirements satisfy the following objectives:

Compliance with system requirements

Accuracy and consistency NE Medical Technologies 7.4-46 Rev. 2

Conformance to applicable standards and procedures

Traceability 5.4.5.4 Design Phase V&V design phase review and analysis activities detect and report design errors that may have n introduced during the programmable logic design process. These reviews and analysis vities confirm that the programmable logic design satisfies the following objectives:

Compliance with programmable logic requirements

Accuracy and consistency

Compatibility with the target hardware

Testability

Conformance to applicable standards and procedures

Traceability ification of the design can be divided into two types: functional verification and timing fication. Functional verification only considers whether the logic functions of the design meet requirements and can be done by simulation or formal proof. Timing verification considers ther the design meets the timing constraints and can be performed using dynamic timing ulation or static timing analysis.

te-box testing techniques are used for analyzing application programmable logic during fication activities.

5.4.5.5 Implementation Phase V&V implementation phase review and analysis activities detect and report errors that may have n introduced during the coding process. Primary concerns include correctness of the code respect to programmable logic requirements, design, and conformance to coding standards.

se reviews and analysis are confined to the code and confirm that the code satisfies these ctives:

Compliance with programmable logic design

Compliance with the programmable logic architecture

Testability

Conformance to standards

Traceability

Accuracy and consistency ification of the design can be divided into two types: functional verification and timing fication. Functional verification only considers whether the logic functions of the design meet requirements and can be done by simulation or formal proof. Timing verification considers ther the design meets the timing constraints and can be performed using dynamic timing ulation or static timing analysis.

te-box testing techniques are used for analyzing application programmable logic during fication activities.

NE Medical Technologies 7.4-47 Rev. 2

purpose of the test phase V&V is to uncover errors that may have been introduced during development processes. Testing objectives include the development and execution of test es and procedures to verify the following:

Code complies with the PLRS

Code complies with the PLDS

Code is robust

Code complies with the target hardware ck-box testing techniques are used to execute functional checks on the system components ng system testing.

5.4.6 Configuration Management 5.4.6.1 Development Phase Configuration Management figuration management of the development of safety-related control systems has been gated to the vendor and is applied to data and documentation used to produce, verify, test, show compliance with the programmable logic used in the system. The programmable logic figuration management process is described in this subsection.

figuration identification is the first activity of configuration management. Configuration tification identifies items to be controlled, establishes identification schemes for the items their versions, and establishes the tools and methods to be used in acquiring and managing trolled items. Configuration identification provides a starting point for other configuration nagement activities. Configuration identification provides the ability to:

Identify the components of the system throughout the development process, and

Trace between the programmable logic and its development process data.

h configuration item is uniquely identified. The identification method includes a naming vention with version numbers or letters. The configuration identification facilitates storage, eval, tracking, reproduction, and distribution of configuration items. The following figuration items are identified and are placed under configuration management:

Design input documents

Design output documents

SyRS

System design specifications

System hardware design specifications

System hardware components

Programmable logic requirements documents

Programmable logic requirements models

Programmable logic design models

Programmable logic hardware description language code

V&V data and documents

Programmable logic development environment NE Medical Technologies 7.4-48 Rev. 2

Third-party vendor supplied documents

Third-party vendor supplied software vendor Configuration Management Plan specifies a numbering scheme for project data and uments.

integrated development environment (IDE) tool is used to store and manage configuration

s. Configuration items such as data, requirements, models, code files, reports, and tests are ed and placed under source control in the IDE tool. The IDE tool is used to perform the wing configuration management activities:

Review changes in modified files

Run impact analysis

Run project integrity checks

Commit modified files into source control

Discard modifications made to committed files

Retrieve configuration items from source control

Revert to a previous version of a file

View and report configuration item source control information figuration baselines are established at various points in the project. A baseline is the grammable logic and its data at a point in time. The baseline serves as a basis for further elopment. Once a baseline is established, changes can only be made through the change trol process described in the Configuration Management Plan.

elines are established after each development phase, at the completion of the formal review he V&V team. The following baselines are established:

Requirements Baseline

Design Baseline

Implementation Baseline

Test Baseline elining is performed by committing phase configuration items into source control and listing configuration item in the master configuration list, as specified in the vendor system design trol procedure. The project file contains and manages programmable logic configuration s in one project folder structure allowing committing of all project phase configuration items g one project file in the IDE tool.

aselined configuration item is traceable to the baselined configuration item from which it was eloped.

aselined configuration item is traceable to either the output it identifies or to the process with ch it is associated. The traceability of baselined configuration items is recorded in the system uirements traceability matrix.

proposed change to a baselined configuration item is subject to the change control and ew requirements in the Configuration Management Plan. The change in status is flagged in NE Medical Technologies 7.4-49 Rev. 2

e the configuration item is baselined, only authorized personnel can change the configuration

. Changes to baselined configuration items are planned, documented, approved, and ked in accordance with a change control process.

IDE tool records each change to baselined configuration items, including who made the nge, and can discard changes that have been implemented or revert to any previous baseline r the changed configuration item has been baselined.

archival and retrieval process involves the storage of data so that it can be accessed by horized personnel. Project documents and records are retained and filed in the system gration document package and are stored in dual remote storage locations to preclude loss sed by natural disasters. The archival and retrieval process ensures:

Accuracy and completeness

Protection from unauthorized change

Quality of storage media and protection from disaster

Accuracy of retrieval and duplication grammable logic code load controls include approved load procedures, load verification, and marking verification.

programmable logic development environment includes the tools, methods, procedures, gramming languages, and hardware used to develop, verify, control, and produce the grammable logic. The tools identification data, including version numbers, are listed in the ster Configuration List.

code generation tools version is automatically included in the code files. The tool version d to develop the programmable logic is verified as the version on the master configuration list.

nges to the development environment are subject to change control.

figuration reviews are required for configuration items prior to shipment. The configuration its include both document configuration items and programmable logic components.

figuration status accounting involves recording and reporting information that is needed to ctively manage the programmable logic configuration items development, verification, and dation processes. Reports are generated to inform managers, developers, and SHINE about project status. Configuration status accounting reports provide consistent, reliable, and timely us information that enhances communication, avoids duplication, and prevents repeat takes. The configuration status accounting reports provide the following information:

Status of data items including configuration identification

Status of change requests and test anomaly reports

Status of released data and files

List of baselined contents and differences from previous baseline NE Medical Technologies 7.4-50 Rev. 2

master configuration list identifies hardware part numbers and the programmable logic code ociated with the hardware. Before loading the code onto the hardware, the identification of the grammable logic code and the hardware is performed to ensure compatibility.

commercial off-the-shelf (COTS) vendor supplied documents or software are edited by the ty-related control system vendor project team. The document versions and software versions recorded upon receipt in the master configuration list and should not change. Therefore, her configuration change procedures nor baselining apply to COTS documents or software.

urchase order issued by the safety-related control system vendor to a third-party vendor for a TS program or technical calculations typically contains:

a description of the major components of the software design, as they relate to the software requirements,

a technical description of the software with respect to the theoretical basis, mathematical model, control flow, data flow, control logic, and data structure,

a description of the allowable or prescribed ranges for inputs and outputs, and

the design described in a manner that can be translated into code.

purchase order requires the vendor to provide a software design description and evidence of V.

third-party vendor software and documentation are verified for sufficiency such that a person is technically qualified in the subject is able to understand the third-party vendor deliverables verify the adequacy of the results without recourse to the originator.

5.4.6.2 Post-Installation Phase Configuration Management figuration management of any post-installation changes or modifications required to the ty-related control systems has been delegated to the vendor. Processes equivalent to those d for initial development, described in Subsection 7.4.5.4.6.1, are followed. SHINE maintains rsight of the vendor, authorization of changes, control of the scope of changes, and luation of the change against the requirements of the SHINE facility license.

5.4.6.3 Configuration Management Compliance sions of software/firmware and documentation of specified hardware components are naged by the configuration management process to ensure the correct version of ware/firmware is installed in the correct hardware components.

5.4.7 Independent Testing elopment, review, and release of V&V generated test documents and execution of tests are ormed by the vendor in accordance with the system Test Plan and V&V Plan. V&V personnel responsible for hardware and software test setup. The test schedule is developed to ensure ect deliverables satisfy the system technical and regulatory requirements. The test tasks ude the following:

NE Medical Technologies 7.4-51 Rev. 2

FAT procedures development

System requirements traceability matrix update

Test equipment setup

Pre-FAT test procedures execution

Report pre-FAT results and update FAT documents

FAT procedures execution

Report FAT results

Test phase V&V summary report development test documentation includes the following:

Project test plan

Test procedures

Test scripts and test input stimulus files

Test reports

Test anomaly reports

Test phase summary report ting is performed to ensure satisfactory hardware has been developed in accordance with the S. Measurement and test equipment calibration is performed before a testing activity and eable to National Institute of Standards and Technology (NIST) standards. Measures are n to establish that tools, gauges, instruments, and other measuring and testing devices used ctivities affecting quality are properly controlled, calibrated, and adjusted at specified periods aintain accuracy within acceptable limits. Testing activities include both pre-FAT and FAT.

pre-FAT ensures that the FAT procedures are developed properly and the protection tems components conform to the SyRS in an operating integrated system environment. The FAT informally executes the FAT procedures to determine their suitability, correctness, pleteness, and efficiency of the test procedures.

FAT validates that the system hardware conforms to the system requirements as defined in SyRS and as documented in the system requirements traceability matrix.

FAT is performed on each protection system and includes integration tests and system tests.

nsists of a documented series of inspections, power-on tests, and calibration verification s to confirm that the system hardware conforms to the approved requirements and design uments and is in overall proper working order. It also verifies that the test configuration is ect and the required test equipment is properly calibrated.

FAT integration test cases and procedures perform the following:

Test programmable logic interfaces and basic programmable logic operations, and

Test interface characteristics defined in the requirements specifications and design description such as protocols, sequences, and timing.

NE Medical Technologies 7.4-52 Rev. 2

Test system functions as defined in the SyRS

Test voting functions

Test trip or protective outputs

Test system operation in all modes as defined in the SyRS mal and robustness test cases are prepared in the test procedures to demonstrate that ign outputs conform to requirements.

acceptance criteria for each testable requirement are specified in the applicable test case.

acceptance criteria are specified by either qualitative (pass/fail) or quantitative (numerical) eptance criteria. When an acceptance criterion is numerical, the minimum and maximum es are specified.

testable attribute that does not meet the stated acceptance criteria is documented on a Test maly Report. This includes both programmable logic anomalies and hardware deficiencies.

Test Anomaly Report identifies the resolution of the stated problem and describes any sting requirements.

results of the FAT are summarized in the FAT summary report and are incorporated into a arate test phase summary report, which is generated at the end of the test phase. The FAT mary report also incorporates other reports including test anomaly reports (used to ument deficiencies found during testing) and change requests as attachments.

FAT summary report documents the review of the test results with the following criteria:

1. Complete: Test cases and steps have been executed.

2. Acceptable: Results are within the expected results.

3. Anomalies resolved: Test anomaly reports have been resolved.

4. Changes implemented and tested: Change requests submitted during testing have been performed in accordance with the Configuration Management Plan and are implemented and tested.

re is no process risk associated with either the system test plan or implementation of the ted FAT. The FAT is conducted using simulated inputs, using either measurement and test ipment generated signals or computer-based test systems. The outputs are not connected to plant process equipment, but are connected to displays, measurement and test equipment, omputer-based indication and data collection equipment. No equipment is operated outside esign parameters; therefore, there is no expectation of equipment failure. The only risks ociated with the system test plan are schedule compliance and satisfaction of test eptance criteria.

5.4.8 Project Risk Management vendor Project Management Plan describes the risk management activities for the project.

risk management approach consists of five activities:

1. Risk identification

2. Risk analysis NE Medical Technologies 7.4-53 Rev. 2

5. Risk tracking and control k identification activities occur throughout the project lifecycle. Identified risks are umented in a safety-related control system vendor project risk register, which includes a cription of the risk, areas of concern, likelihood, mitigating actions, and possible sequences. The project risk register may also describe the impacts to stakeholders, umptions, constraints, relationship to other project risks, possible alternatives, as well as acts to the project budget, schedule, or deliverables.

h identified risk is analyzed to determine the type and the extent of the impacts should the situation or event occur. The analysis considers several relevant factors and includes any umptions made, constraints, and sensitivity of the risk item.

k mitigation planning involves developing plans for mitigation and/or contingency actions for a cific risk. The risk mitigation plans address topics such as:

Identification of mitigation and contingency actions for funding, schedule, staff, or resources

Identification of actions to be taken to reduce the likelihood or consequences of impact on the project

Determination of the planned response based on a cost/benefit analysis

Assignment of responsibility for each mitigation and contingency action k tracking, monitoring, and control assess how the project risk profile is changing throughout project lifecycle, as well the effectiveness of any mitigation/contingency plans that have been cuted. When changes to the risk occur, the process to identify, analyze, and plan is repeated.

sting risk mitigation plans are modified to change the approach if the desired effect is not g achieved.

5.5 HIPS Performance Analysis S system performance is addressed in Subsection 7.4.4.

gnostic and maintenance features provided by the HIPS platform features include the use of T, cyclic redundancy checks (CRC), periodic surveillance testing, and other tests in each type odule, as appropriate, to verify normal operation. Attributes of the system incorporate the nostic and maintenance principles outlined in Section 8.0 of Topical Report TR-1015-18653 Scale, 2017).

6 CONCLUSION safety-related TRPS is designed to specific and measurable criteria to ensure quality and quacy in the system design, implementation, and maintenance.

ign basis functions ensure safe operation of the facility and prevent or mitigate sequences of design basis events.

NE Medical Technologies 7.4-54 Rev. 2

developed under quality management to provide a simple yet reliable solution for the safety-ted TRPS functions.

NE Medical Technologies 7.4-55 Rev. 2

Table 7.4 TRPS Monitored Variables (Sheet 1 of 2)

Instrument Variable Analytical Limit Logic Range Accuracy Response Time 2.52 times the nominal Source range neutron flux flux at 95 percent volume 2/3 1 to 1.0E+05 cps 2 percent 450 milliseconds of the critical fill height Wide range neutron flux 240 percent 2/3 2.5E-8 to 250 percent 2 percent 450 milliseconds Power range neutron flux [ ]PROP/ECI 2/3 w power range limit, driver droput 40 percent 2/3 0 to 125 percent 1 percent 1 second rmissive, and high time-averaged limit) 104 percent 2/3 RVZ1e IU cell radiation 60x background radiation 2/3 10-7 to 10-1 µCi/cc 20 percent 15 seconds TOGS oxygen concentration 10 percent 2/3 0 to 25 percent 1 percent 120 seconds TOGS mainstream flow [ ]PROP/ECI 2/3 [ ]PROP/ECI 3 percent 0.5 seconds TOGS dump tank flow [ ]PROP/ECI 2/3 [ ]PROP/ECI 3 percent 0.5 seconds OGS condenser demister outlet 25°C 2/3 0 to 100°C 0.65 percent 10 seconds temperature Discrete w-high TSV dump tank level signal Active 2/3 Active/inactive 1.5 seconds input signal Discrete h-high TSV dump tank level signal Active 2/3 Active/inactive 1.5 seconds input signal PCLS flow [ ]PROP/ECI 2/3 [ ]PROP/ECI 1 percent 1 second 15°C 2/3 PCLS temperature -1 to 121°C 1 percent 10 seconds 25°C 2/3 NE Medical Technologies 7.4-56 Rev. 2

Instrument Variable Analytical Limit Logic Range Accuracy Response Time Discrete SV fill isolation valves fully closed Inactive full close 1/2 Active/inactive 0.5 seconds input signal Discrete ESFAS loss of external power Inactive 1/1 Active/inactive 0.5 seconds input signal NE Medical Technologies 7.4-57 Rev. 2

Chapter 7 - Instrumentation and Control Systems Target Solution Vessel Reactivity Protection System Figure 7.4-1 TRPS Logic Diagrams (Sheet 1 of 14)

Trip Determination and Bypasses SHINE Medical Technologies 7.4-58 Rev. 2

Chapter 7 - Instrumentation and Control Systems Target Solution Vessel Reactivity Protection System Figure 7.4-1 TRPS Logic Diagrams (Sheet 2 of 14)

Trip Determination and Bypasses SHINE Medical Technologies 7.4-59 Rev. 2

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)

Chapter 7 - Instrumentation and Control Systems Target Solution Vessel Reactivity Protection System Figure 7.4-1 TRPS Logic Diagrams (Sheet 3 of 14)

SHINE Medical Technologies 7.4-60 Rev. 2

Chapter 7 - Instrumentation and Control Systems Target Solution Vessel Reactivity Protection System Figure 7.4-1 TRPS Logic Diagrams (Sheet 4 of 14)

Trip Determination and Bypasses SHINE Medical Technologies 7.4-61 Rev. 2

Chapter 7 - Instrumentation and Control Systems Target Solution Vessel Reactivity Protection System Figure 7.4-1 TRPS Logic Diagrams (Sheet 5 of 14)

Trip Determination and Bypasses SHINE Medical Technologies 7.4-62 Rev. 2

Chapter 7 - Instrumentation and Control Systems Target Solution Vessel Reactivity Protection System Figure 7.4-1 TRPS Logic Diagrams (Sheet 6 of 14)

Trip Determination and Bypasses SHINE Medical Technologies 7.4-63 Rev. 2

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)

Chapter 7 - Instrumentation and Control Systems Target Solution Vessel Reactivity Protection System Figure 7.4-1 TRPS Logic Diagrams (Sheet 7 of 14)

SHINE Medical Technologies 7.4-64 Rev. 2

Chapter 7 - Instrumentation and Control Systems Target Solution Vessel Reactivity Protection System Figure 7.4-1 TRPS Logic Diagrams (Sheet 8 of 14)

Mode State Machine SHINE Medical Technologies 7.4-65 Rev. 2

Chapter 7 - Instrumentation and Control Systems Target Solution Vessel Reactivity Protection System Figure 7.4-1 TRPS Logic Diagrams (Sheet 9 of 14)

Safety Function SHINE Medical Technologies 7.4-66 Rev. 2

Chapter 7 - Instrumentation and Control Systems Target Solution Vessel Reactivity Protection System Figure 7.4-1 TRPS Logic Diagrams (Sheet 10 of 14)

Safety Function SHINE Medical Technologies 7.4-67 Rev. 2

Target Solution Vessel Chapter 7 - Instrumentation and Control Systems Reactivity Protection System Figure 7.4-1 TRPS Logic Diagrams (Sheet 11 of 14)

Nonsafety Interface Decode SHINE Medical Technologies 7.4-68 Rev. 2

Target Solution Vessel Chapter 7 - Instrumentation and Control Systems Reactivity Protection System Figure 7.4-1 TRPS Logic Diagrams (Sheet 12 of 14)

Priority Logic SHINE Medical Technologies 7.4-69 Rev. 2

Target Solution Vessel Chapter 7 - Instrumentation and Control Systems Reactivity Protection System Figure 7.4-1 TRPS Logic Diagrams (Sheet 13 of 14)

Priority Logic SHINE Medical Technologies 7.4-70 Rev. 2

Target Solution Vessel Chapter 7 - Instrumentation and Control Systems Reactivity Protection System Figure 7.4-1 TRPS Logic Diagrams (Sheet 14 of 14)

Legend SHINE Medical Technologies 7.4-71 Rev. 2

NE Medical Technologies 7.4-72 Rev. 2 NE Medical Technologies 7.4-73 Rev. 2 1 SYSTEM DESCRIPTION engineered safety features actuation system (ESFAS) is a single, safety-related rumentation and control (I&C) system that provides monitoring and actuation functions ughout the SHINE main production facility.

ESFAS performs various detection, logic processing, control, and actuation functions dited by the SHINE safety analysis described in Chapter 13 as required to prevent the urrence or mitigate the consequences of design basis events within the main production lity. The ESFAS provides sense, command, and execute functions necessary to maintain the lity confinement strategy and provides process actuation functions required to shut down cesses and maintain processes in a safe condition. The ESFAS also provides nonsafety-ted system status and measured process variable values to the facility process integrated trol system (PICS) for viewing, recording, and trending.

ESFAS monitors variables important to the safety functions for confinement of radiation and m within the irradiation facility (IF) and the radioisotope production facility (RPF) and for cality safety to perform the following functions:

Radiologically Controlled Area (RCA) Isolation

Supercell Isolation

Carbon Delay Bed Isolation

Vacuum Transfer System (VTS) Safety Actuation

Tritium Purification System (TPS) Train Isolation

TPS Process Vent Actuation

Irradiation Unit (IU) Cell Nitrogen Purge

RPF Nitrogen Purge

Molybdenum Extraction and Purification System (MEPS) [ ]PROP/ECI Isolation

Extraction Column Alignment Actuation

Iodine and Xenon Purification and Packaging (IXP) Alignment Actuation

Dissolution Tank Isolation ESFAS monitors the IF and the RPF continually throughout the operation of processes in the main production facility, via the use of radiation monitoring and other instrumentation.

rlocks and bypass logic necessary for operation are implemented within the ESFAS. If at any t a monitored variable exceeds its predetermined limits, the ESFAS automatically initiates associated safety function. ESFAS logic diagrams are provided in Figure 7.5-1 and the eral architecture of the ESFAS is provided in Figure 7.1-3.

ESFAS is built using the highly integrated protection system (HIPS) platform as described in section 7.4.5. ESFAS equipment is separated into three divisions (A, B, and C). The ESFAS undantly receives safety-related inputs from field instrumentation (input devices) to either two sions (A and B) or all three divisions, dependent on the input variable. The input signals are vided to the ESFAS safety function modules (SFMs). More than one input device provides a al to each SFM. The inputs are allocated to the different SFMs within a division as described e technical specifications. Each SFM can be placed in maintenance bypass or in a trip state se of the out-of-service (OOS) switch located on the front of the SFM and an associated bypass switch located below the SFM, as described in Subsection 7.5.4.4. Placing an SFM in NE Medical Technologies 7.5-1 Rev. 3

ESFAS bypass logic is implemented in all three divisions using scheduling, bypass, and ng modules (SBVMs) for divisions A and B, or scheduling and bypass modules (SBMs) for sion C. The ESFAS voting and actuation logic is implemented in only divisions A and B. For sions A and B, the three SBVMs, in each division, generate actuation signals when the SFMs ny two of three (or one of two) divisions determine that an actuation is required. Both ESFAS sions A and B evaluate the input signals from the SFMs in each of three redundant SBVMs.

h SBVM compares the inputs received from the SFMs and generates an appropriate ation signal if required by two or more of the three (or one or more of the two) divisions.

output of the three redundant SBVMs in divisions A and B is communicated via three pendent safety data buses to the associated equipment interface modules (EIMs). There are independent EIMs for each actuation component, associated with each division A and B of FAS. The EIMs compare inputs from the three SBVMs and initiate an actuation if two out of e signals agree on the need to actuate. Both EIMs associated with a component are required e deenergized for the actuation component(s) to fail to their actuated (deenergized) states, the exception of the process vessel vent system (PVVS) carbon delay bed three-way and et isolation valves (Subsections 7.5.3.1.14, 7.5.3.1.15, and 7.5.3.1.16). These valves are rgized to actuate.

2 DESIGN CRITERIA SHINE facility design criteria applicable to the ESFAS are stated in Table 3.1-1. The facility ign criteria applicable to the ESFAS, and the ESFAS system design criteria, are addressed in section.

ESFAS utilizes a HIPS design. The HIPS design is applicable to both the target solution sel (TSV) reactivity protection system (TRPS) and the ESFAS. The HIPS design is described ubsection 7.4.5.

2.1 SHINE Facility Design Criteria NE facility Design Criteria 13 through 19 and 37 through 39 apply to the ESFAS.

2.1.1 Instrumentation and Controls SHINE Design Criterion 13 - Instrumentation is provided to monitor variables and systems over their anticipated ranges for normal operation, for anticipated transients, and for postulated accidents as appropriate to ensure adequate safety, including those variables and systems that can affect the fission process, the integrity of the primary system boundary, the primary confinement and its associated systems, and the process confinement boundary and its associated systems. Appropriate controls are provided to maintain these variables and systems within prescribed operating ranges.

ESFAS monitored variables for performance of design basis functions are presented in le 7.5-1 and include the instrument range for covering normal and accident conditions, the uracy for each variable, and the analytical limit. Operation of the ESFAS in response to the lyzed events is presented in Subsection 7.5.4.1.

NE Medical Technologies 7.5-2 Rev. 3

SHINE Design Criterion 14 - The protection systems are designed to: (1) initiate, automatically, the operation of appropriate systems to ensure that specified acceptable target solution design limits are not exceeded as a result of anticipated transients; and (2) sense accident conditions and to initiate the operation of safety-related systems and components.

ration of the ESFAS in response to the analyzed events is presented in Subsection 7.5.4.1.

section describes the automatic system response to actuation setpoints in monitored ables.

2.1.3 Protection System Reliability and Testability SHINE Design Criterion 15 - The protection systems are designed for high functional reliability and inservice testability commensurate with the safety functions to be performed.

Redundancy and independence designed into the protection systems are sufficient to ensure that: (1) no single failure results in loss of the protection function, and (2) removal from service of any component or channel does not result in loss of the required minimum redundancy unless the acceptable reliability of operation of the protection system can be otherwise demonstrated. The protection systems are designed to permit periodic testing, including a capability to test channels independently to determine failures and losses of redundancy that may have occurred.

h functional reliability is addressed in SHINE Design Criterion 19 (Subsection 7.5.2.1.7). The S design incorporates predictability and repeatability principles to ensure an extremely high bability of accomplishing safety functions (Subsection 7.4.5.2.3).

ESFAS contains capabilities for inservice testing for those functions that cannot be tested e the associated equipment is out of service (Subsection 7.5.4.5).

ESFAS design utilizes functional independence; structures, systems, and components that prise a division are physically separated to retain the capability of performing the required ty functions during a design basis accident (Subsection 7.4.5.2.1).

ESFAS consists of two or three divisions of input processing and trip determination pendent on the monitored variable) and two divisions of actuation logic arranged such that no le failure can prevent a safety actuation when required (Subsection 7.5.3.3). A single failure lysis of the ESFAS was performed in accordance with IEEE Standard 379-2000 (IEEE-2000).

maintenance bypass function allows an individual safety function module to be removed service for required testing (Subsection 7.5.4.4). Self-test features are provided for ponents that do not have setpoints or tunable parameters. The discrete logic of the actuation priority logic (APL) of the EIM does not have self-test capability but is instead functionally ed (Subsection 7.5.4.5). Calibration, testing, and diagnostics is addressed in Section 8.0 of ical Report TR-1015-18653 (NuScale, 2017).

2.1.4 Protection System Independence SHINE Design Criterion 16 - The protection systems are designed to ensure that the effects of natural phenomena, and of normal operating, maintenance, testing, and postulated NE Medical Technologies 7.5-3 Rev. 3

functional diversity or diversity in component design and principles of operation, are used to the extent practical to prevent loss of the protection function.

ESFAS control and logic functions operate inside of the facility control room where the ironment is mild, not exposed to the irradiation process, and is protected from earthquakes, adoes, and floods (Subsections 7.5.3.4 and 7.5.3.5). The ESFAS structures, systems, and ponents that comprise a division are physically separated to retain the capability of orming the required safety functions during a design basis accident. Division independence aintained throughout, extending from the sensor to the devices actuating the protective tion (Subsection 7.4.5.2.1). The architecture provides two diverse methods for an actuation he safety functions at the division level, automatic and manual, and field programmable gate ys (FPGAs) in each division are of a different physical architecture to prevent common cause re (Subsections 7.4.5.2.4 and 7.5.3.6).

2.1.5 Protection System Failure Modes SHINE Design Criterion 17 - The protection systems are designed to fail into a safe state if conditions such as disconnection of the system, loss of energy (e.g., electric power, instrument air), or postulated adverse environments are experienced.

trolled components associated with safety actuations are designed to go to their safe state n deenergized (Table 7.5-2). The ESFAS equipment is qualified for radiological and ironmental hazards present during normal operation and postulated accidents bsection 7.5.3.4).

2.1.6 Separation of Protection and Control Systems SHINE Design Criterion 18 - The protection system is separated from control systems to the extent that failure of any single control system component or channel, or failure or removal from service of any single protection system component or channel that is common to the control and protection systems, leaves intact a system satisfying all reliability, redundancy, and independence requirements of the protection system. Interconnection of the protection and control systems is limited to assure that safety is not significantly impaired.

safety-related inputs to the ESFAS from the PICS are designed and controlled so they do not vent the ESFAS from performing its safety functions (Subsection 7.5.3.2).

2.1.7 Protection Against Anticipated Transients SHINE Design Criterion 19 - The protection systems are designed to ensure an extremely high probability of accomplishing their safety functions in the event of anticipated transients.

ESFAS design utilizes functional independence; structures, systems, and components that prise a division are physically separated to retain the capability of performing the required ty functions during a design basis accident (Subsection 7.4.5.2.1). The ESFAS includes undancy such that no single failure can prevent a safety actuation when required bsection 7.5.3.3). The architecture provides two diverse methods for an actuation of the ty functions at the division level, automatic and manual, and FPGAs in each division are of a NE Medical Technologies 7.5-4 Rev. 3

2.1.8 Criticality Control in the Radioisotope Production Facility SHINE Design Criterion 37 - Criticality in the radioisotope production facility is prevented by physical systems or processes and the use of administrative controls. Use of geometrically safe configurations is preferred. Control of criticality adheres to the double contingency principle. A criticality accident alarm system to detect and alert facility personnel of an inadvertent criticality is provided.

ESFAS provides two safety functions as required by the SHINE criticality safety program cribed in Section 6b.3. The VTS Safety Actuation safety function stops the transfer of target tion or other radioactive solutions upon indication of potential upset conditions bsection 7.5.3.1.17). Actuation on a VTS vacuum header liquid detection switch signal ects against an overflow of the vacuum lift tanks and potential criticality event bsection 7.5.4.1.8). The Dissolution Tank Isolation safety function protects against a criticality nt due to excess fissile material in a non-favorable geometry system (Subsection 7.5.4.1.18) prevents overflow of the dissolution tank into the uranium handling glovebox or ventilation tem.

2.1.9 Monitoring Radioactivity Releases SHINE Design Criterion 38 - Means are provided for monitoring the primary confinement boundary, hot cell, and glovebox atmospheres to detect potential leakage of gaseous or other airborne radioactive material. Potential effluent discharge paths and the plant environs are monitored for radioactivity that may be released from normal operations, including anticipated transients, and from postulated accidents.

ESFAS monitors for potential radioactivity releases from various areas of the SHINE main duction facility. The ESFAS monitors radiation in the radiological ventilation zone 1 (RVZ1) or ological ventilation zone 2 (RVZ2) facility exhaust (Subsection 7.5.3.1.24), radiation from the et of each cell of the supercell (Subsections 7.5.3.1.1 through 7.5.3.1.10), and tritium from tritium purification system glovebox (SSubsections 7.5.3.1.18, 7.5.3.1.19, and 7.5.3.1.20).

itional radioactivity release monitoring is provided by the TRPS (Section 7.4) and by safety-related radiation monitoring systems (Section 7.7).

2.1.10 Hydrogen Mitigation SHINE Design Criterion 39 - Systems to control the buildup of hydrogen that is released into the primary system boundary and tanks or other volumes that contain fission products and produce significant quantities of hydrogen are provided to ensure that the integrity of the system and confinement boundaries is maintained.

ESFAS monitors variables and provides actuations to prevent and mitigate hydrogen agration in various areas in the SHINE main production facility. The TRPS IU cell nitrogen ge signal protects against a loss of hydrogen mitigation capabilities in the IUs bsection 7.5.4.1.14). The low PVVS flow signal protects against a loss of hydrogen mitigation abilities in the RPF (Subsection 7.5.4.1.15). The uninterruptible electrical power supply NE Medical Technologies 7.5-5 Rev. 3

2.2 ESFAS System Design Criteria 2.2.1 Access Control ESFAS Criterion 1 - The ESFAS shall require a key or combination authentication input at the control console to prevent unauthorized use of the ESFAS.

ESFAS utilizes a HIPS design which is described in Subsection 7.4.5. Unauthorized use of ESFAS is prevented by required use of a physical key as described in the HIPS design bsection 7.4.5.3.3).

ESFAS Criterion 2 - Developmental phases for ESFAS software shall address the potential cyber security vulnerabilities (physical and electronic) to prevent unauthorized physical and electronic access.

ESFAS development design uses a defensive system architecture described in section 7.4.5.3.2 that prevents unauthorized physical and electronic access.

ESFAS Criterion 3 - The ESFAS design shall incorporate design or administrative controls to prevent/limit unauthorized physical and electronic access to critical digital assets (CDAs) during the operational phase, including the transition from development to operations. CDAs are defined as digital systems and devices that are used to perform or support, among other things, physical security and access control, safety-related functions, and reactivity control.

ess control features prevent unauthorized physical and electronic access to CDAs during the rational phase and during transition from development to operations. Access control, cyber urity, and the secure development operating environment are described in section 7.4.4.1.3. Subsection 7.4.4.1.3 also describes prevention of unauthorized access ng the development and operational phases. Post-development installation and testing is ormed and controlled by the safety-related control system vendor as described in sections 7.4.4.1.4 and 7.4.5.4.2.6.

2.2.2 Software Requirements Development ESFAS Criterion 4 - The functional characteristics of the ESFAS software requirements specifications shall be properly and precisely described for each software requirement.

system design requirements are specified in the system requirements specification which is erated in accordance with the vendor system requirements specification development cedure (Subsection 7.4.5.4.2.1). A system design description is generated to define the tem design details. Software requirements development is addressed in Subsection 7.4.4.1.4.

ESFAS Criterion 5 - Development of ESFAS software shall follow a formally defined lifecycle process and address potential security vulnerabilities in each phase of the lifecycle.

programmable logic lifecycle process is described in Subsection 7.4.5.4.2. The lifecycle cess includes a Project Security Plan as stated in Subsection 7.4.5.4.2.1. The development NE Medical Technologies 7.5-6 Rev. 3

grammable logic lifecycle activities are performed within a secure development environment g an isolated development network (Subsections 7.4.5.3.1 and 7.4.5.4.2.2).

ESFAS Criterion 6 - ESFAS development lifecycle phase-specific security requirements shall be commensurate with the risk and magnitude of the harm that would result from unauthorized and inappropriate access, use, disclosure, disruption, or destruction of the ESFAS.

grammable logic lifecycle activities necessitate use of a secure development environment g an isolated development network from the Requirements Phase forward bsection 7.4.5.4.2.2). Software requirements development, including lifecycle phase-specific urity requirements, is addressed in ESFAS Criterion 5.

ESFAS Criterion 7 - ESFAS software development lifecycle process requirements shall be described and documented in appropriate plans which shall address safety analysis, verification and validation (V&V), and configuration control activities.

ign basis requirements are specified in the system requirements specification and system ign description (Subsection 7.4.5.4.2.1). The lifecycle process includes development of a V Plan and Configuration Management Plan to control V&V and configuration management vities (Subsection 7.4.5.4.2.1).

ESFAS Criterion 8 - Tasks for validating and verifying the ESFAS software development activities shall be carried out in their entirety. Independent V&V tasks shall be performed by individuals or groups with appropriate technical competence in an organization separate from the development and program management organizations. Successful completion of V&V tasks for each software lifecycle activity group shall be documented.

NE has delegated V&V activities related to the safety-related control system development, uding V&V documentation, to the vendor. The vendor Project V&V Plan for the system elopment was tailored and adapted for FPGA technology from the guidance in IEEE ndard 1012-2004 (IEEE, 2004a). The V&V activities are performed using an internal V&V m from within the design organization, as defined in IEEE Standard 1012-2004 (IEEE, 4a), Annex C.4.4, and is independent of the design team (Subsection 7.4.5.4.5).

ESFAS Criterion 9 - The ESFAS software lifecycle configuration control program shall trace software development from software requirement specification to implementation and address any impacts on ESFAS safety, control console, or display instruments.

programmable logic lifecycle process addresses design interfaces, which includes ressing any impacts on the safety system, control console, or display instruments during the ycle process, as stated in Subsection 7.4.5.4.2.

ESFAS Criterion 10 - The ESFAS configuration control program shall assure that the required ESFAS hardware and software are installed in the appropriate system configuration and ensure that the correct version of the software/firmware is installed in the correct hardware components.

NE Medical Technologies 7.5-7 Rev. 3

se configuration management process is described in Subsection 7.4.5.4.6.1 and states that ponents of the system (hardware) and programmable logic and its development process a (software) are controlled by the Project Configuration Management Plan. Post-installation se configuration management is addressed in Subsection 7.4.5.4.6.2.

ESFAS Criterion 11 - Qualification testing shall test all portions of ESFAS programmable logic necessary to accomplish its safety functions, and shall exercise those portions whose operation or failure could impair safety functions during testing.

lementation phase V&V activities (Subsection 7.4.5.4.5.5) verify the design accuracy to omplish safety functions and include functional verification and timing verification activities.

t phase V&V (Subsection 7.4.5.4.5.6) includes system functional, interface, and performance ing.

ESFAS Criterion 12 - The ESFAS software development lifecycle shall include a software risk management program which addresses vulnerabilities throughout the software lifecycle.

vendor utilizes a Project Risk Management Plan for development of the ESFAS, as cribed in Subsection 7.4.5.4.8. Risk identification activities occur throughout the project ycle. Identified risks are documented in a project risk register and actions are developed to ress identified risks or vulnerabilities.

ESFAS Criterion 13 - ESFAS equipment not designed under a SHINE approved quality assurance (QA) program shall be qualified under the SHINE commercial-grade dedication program.

developmental process for creating the safety-related ESFAS has been delegated to NE's safety-related control system vendor (Subsection 7.4.5.3.1), including any modifications he system logic after initial development (Subsection 7.4.4.1.4). SHINE is responsible for viding oversight of the vendor, verifying deliverables are developed in accordance with roved quality and procurement documents, and maintaining the vendor as an approved plier on the SHINE approved supplier list (Subsection 7.4.5.4.1).

2.2.3 General Instrumentation and Control Requirements ESFAS Criterion 14 - The ESFAS safety functions shall perform and remain functional during normal operation and during and following a design basis event.

ESFAS equipment is installed in the seismically qualified portion of the main production lity where it is protected from earthquakes, tornadoes, and floods. The ESFAS equipment is smic Category I, designed in accordance with Section 8 of IEEE Standard 344-2013 E, 2013) (Subsections 7.5.3.4 and 7.5.3.5). The ESFAS control and logic equipment is ted in a mild operating environment inside the facility control room, protected from ological and environmental hazards during normal operation, maintenance, testing, and tulated accidents, and cables and sensors outside the facility control room are designed for r respective environments (Subsection 7.5.3.4).

NE Medical Technologies 7.5-8 Rev. 3

ESFAS logic diagrams (Figure 7.5-1) display where the manual actuation is brought into the

c. Manual controls and nonsafety control system inputs come individually into the APL and downstream of the programmable logic portion of the ESFAS architecture shown in ure 7.1-3 (Subsection 7.4.5.2.4).

2.2.4 Single Failure ESFAS Criterion 16 - The ESFAS shall be designed to perform its protective functions after experiencing a single random active failure in nonsafety control systems or in the ESFAS, and such failure shall not prevent the ESFAS and credited redundant passive control components from performing the intended functions or prevent safe shutdown of an IU cell.

ESFAS consists of three divisions of input processing and trip determination and two sions of actuation logic arranged such that no single failure within the ESFAS results in the of the protective function. Redundancy is addressed in Subsection 7.4.5.2.2. Nonsafety-ted inputs into the ESFAS are designed and controlled so they do not prevent the ESFAS performing its safety functions. Single failure is additionally addressed in section 7.5.3.3.

ESFAS Criterion 17 - The ESFAS shall be designed such that no single failure can cause the failure of more than one redundant component.

ESFAS is comprised of three divisions of signal conditioning and trip determination, and two sions of voting and actuation. This configuration allows for the architecture to handle a single re of a field input, signal conditioning circuit, or trip determination and still maintain the ability rovide the needed number of valid inputs to the voting circuitry. A single failure of the voting c or the actuation logic is also acceptable within the configuration as the redundant division of ng logic and actuation logic is capable of performing the safety function. Functional pendence is addressed in Subsection 7.4.5.2.1 and redundancy is addressed in section 7.4.5.2.2.

ESFAS Criterion 18 - The ESFAS shall be designed so that no single failure within the instrumentation or power sources concurrent with failures as a result of a design basis event should prevent operators from being presented the information necessary to determine the safety status of the facility following the design basis event.

ESFAS provides separate communication paths to the PICS display systems from each of three ESFAS divisions. ESFAS divisions A and B are powered from a separate division of the SS; ESFAS division C receives auctioneered power from both UPSS divisions A and B. This undancy in communication paths and power sources ensures no single failure concurrent with esign basis event prevents operators from being presented necessary information bsection 7.5.3.3). Loss of external power to the PICS is described in Subsection 7.3.3.6.

2.2.5 Independence ESFAS Criterion 19 - Interconnections among ESFAS safety divisions shall not adversely affect the functions of the ESFAS.

NE Medical Technologies 7.5-9 Rev. 3

system for voting purposes (Subsection 7.4.5.2.1).

ESFAS Criterion 20 - A logical or software malfunction of any interfacing nonsafety systems shall not affect the functions of the ESFAS.

APL, which is constructed of discrete components and part of the equipment interface dule, is designed to provide priority to safety-related signals over nonsafety-related signals.

sion A and division B priority logic of the ESFAS prioritizes the following ESFAS inputs, with first input listed having the highest priority and each successive input in the list having a lower rity than the previous: (1) Automatic Safety Actuation, Manual Actuation, and (2) PICS safety control signals (Subsection 7.5.3.11). When the enable nonsafety control is not active, nonsafety-related control signals are ignored. If the enable nonsafety control is active, and no omatic safety actuation or manual actuation command is present, the nonsafety control signal control the component (Subsection 7.5.3.2).

ESFAS Criterion 21 - The ESFAS shall be designed with physical, electrical, and communications independence of the ESFAS both between the ESFAS channels and between the ESFAS and nonsafety-related systems to ensure that the safety functions required during and following any design basis event can be accomplished.

ESFAS structures, systems, and components that comprise a division are physically arated to retain the capability of performing the required safety functions during a design is accident (Subsection 7.4.5.2.1) and nonsafety-related ESFAS inputs and outputs are ed in non-divisional cable raceways and are segregated from safety-related inputs and puts (Subsection 7.5.3.8). Wiring for redundant divisions uses physical separation and ation to provide independence for circuits (Subsection 7.4.5.2.1) in accordance with IEEE ndard 384-2008 (IEEE, 2008). HIPS communication paths are designed such that a single re does not cause all safety functions of a division to be inoperable (Subsection 7.4.4.1.2).

ESFAS Criterion 22 - Physical separation and electrical isolation shall be used to maintain the independence of ESFAS circuits and equipment among redundant safety divisions or with nonsafety systems so that the safety functions required during and following any design basis event can be accomplished.

ESFAS structures, systems, and components that comprise a division are physically arated to retain the capability of performing the required safety functions during a design is accident (Subsection 7.4.5.2.1) and nonsafety-related ESFAS inputs and outputs are ed in non-divisional cable raceways and are segregated from safety-related inputs and puts (Subsection 7.5.3.8). Wiring for redundant divisions uses physical separation and ation to provide independence for circuits (Subsection 7.4.5.2.1) in accordance with IEEE ndard 384-2008 (IEEE, 2008).

ESFAS Criterion 23 - The ESFAS shall be designed such that no communication - within a single safety channel, between safety channels, and between safety and nonsafety systems - adversely affects the performance of required safety functions.

S communication paths are designed with simplicity such that a single failure does not cause afety functions of a division to be inoperable. The design uses triple redundant NE Medical Technologies 7.5-10 Rev. 3

S chassis implement the one-way communication with hardware (Subsection 7.4.5.3.2).

ESFAS Criterion 24 - ESFAS data communications protocols shall meet the performance requirements of all supported systems.

FAS data communications protocol is detailed in Section 7.5.1 of Topical ort TR-1015-18653 (NuScale, 2017). The protocol is used on the safety buses as a simple ster-slave communication protocol and employs a cyclic redundancy checksum feature to ure the integrity of the communicated information between modules. Data communications is ussed in Subsection 7.4.5.2.5.

ESFAS Criterion 25 - The timing of ESFAS data communications shall be deterministic.

maximum response time of the ESFAS components from when an input signal exceeds a determined setpoint to the time that the ESFAS deenergizes the equipment interface module put switching for actuated components is conservatively set to a maximum of milliseconds (Subsection 7.4.5.2.3).

ESFAS Criterion 26 - ESFAS communications protocols shall conform to validated protocol specifications by formally generated test procedures and test data vectors and verify that the implementations themselves were constructed using a formal design process that ensures consistency between the product and the validated specification.

FAS communication protocols are verified as conforming to the validated protocol cifications by the Project V&V Plan (Subsection 7.4.5.4.5).

ESFAS Criterion 27 - The ESFAS shall be designed such that no unexpected performance deficits exist that could adversely affect the ESFAS architecture.

communications independence, the ESFAS platform is designed such that each safety sion functions independently of other safety divisions. With the exception of interdivisional ng, communication within a division does not rely on communication outside the respective sion to perform the safety function. Safety-related inputs to the ESFAS which originate within ecific division of the ESFAS are input to, and processed in, only the same division prior to g provided to any other division of the system for voting purposes (Subsection 7.4.5.2.1).

2.2.6 Prioritization of Functions ESFAS Criterion 28 - ESFAS devices that receive signals from safety and nonsafety sources shall prioritize the signal from the safety system.

rity is provided to automatic and manual safety-related actuation signals over nonsafety-ted signals as described in Subsection 7.5.3.11.

2.2.7 Fail-Safe ESFAS Criterion 29 - The ESFAS shall be designed to assume a safe state on loss of electrical power.

NE Medical Technologies 7.5-11 Rev. 3

2.2.8 Setpoints ESFAS Criterion 30 - Setpoints for an actuation of the ESFAS shall be based on a documented analysis methodology that identifies assumptions and accounts for uncertainties, such as environmental allowances and measurement computational errors associated with each element of the instrument channel. The setpoint analysis parameters and assumptions shall be consistent with the safety analysis, system design basis, technical specifications, facility design, and expected maintenance practices.

points in the ESFAS are based on a documented methodology that identifies each of the umptions and accounts for the uncertainties in each instrument channel. The setpoint hodology is further described in Subsections 7.2.1 and 7.5.3.10.

ESFAS Criterion 31 - Adequate margin shall exist between setpoints and safety limits so that the ESFAS initiates protective actions before safety limits are exceeded.

points in the ESFAS are based on a documented methodology that ensures adequate margin ts between setpoints and analytical limits or safety limits. The setpoint methodology is further cribed in Subsections 7.2.1 and 7.5.3.10.

ESFAS Criterion 32 - Where it is necessary to provide multiple setpoints for adequate protection based on particular modes of operation or sets of operating conditions, the ESFAS shall provide positive means of ensuring that the more restrictive setpoint is used when required.

re are no safety functions in the ESFAS that use multiple setpoints.

ESFAS Criterion 33 - The sensitivity of each ESFAS sensor channel shall be commensurate with the precision and accuracy to which knowledge of the variable measured is required for the protective function.

points in the ESFAS are based on a documented methodology that identifies each of the umptions and accounts for the uncertainties in each instrument channel. The setpoint hodology is further described in Subsections 7.2.1 and 7.5.3.10. Setpoint analysis ameters typically consider instrument precision, sensitivity, accuracy, loop uncertainties, and putational errors.

2.2.9 Operational Bypass, Permissives and Interlocks ESFAS Criterion 34 - Permissive conditions for each ESFAS operating or maintenance bypass capability shall be documented.

re are no operational bypasses in the ESFAS design (Subsection 7.5.4.2). The ESFAS rporates the Facility Master Operating Permissive key switch in the system design to select ration in the normal, unsecured mode or operationally secured (Subsection 7.5.4.3).

NE Medical Technologies 7.5-12 Rev. 3

required.

ESFAS has no operational bypasses included in the design, and therefore no interlocks are uired to prevent operator actions from defeating an automatic safety function bsection 7.5.4.2).

ESFAS Criterion 36 - ESFAS provisions shall exist to prevent activation of an operating bypass unless applicable permissive conditions exist.

re are no operational bypasses in the ESFAS design (Subsection 7.5.4.2). PICS inputs may bypassed with the enable nonsafety switch, as described in Subsection 7.5.3.2.

ESFAS Criterion 37 - Bypass capability shall not be provided for the mechanisms to manually initiate ESFAS safety functions.

nual safety actuations are shown in the logic diagrams (Figure 7.5-1). There are no conditions allow manually initiated ESFAS safety functions to be bypassed.

ESFAS Criterion 38 - If provisions for maintenance or operating bypasses are provided, the ESFAS design shall retain the capability to accomplish its safety function while a bypass is in effect.

re are no operational bypasses in the ESFAS design (Subsection 7.5.4.2). Use of the ntenance bypass either preserves the single failure criterion where three channels are vided or is performed in accordance with technical specification requirements bsection 7.5.4.4).

ESFAS Criterion 39 - Whenever permissive conditions for bypassing a train or channel in the ESFAS are not met, a feature in the ESFAS shall physically prevent or facilitate administrative controls to prevent the unauthorized use of bypasses.

re are no operational bypasses in the ESFAS design (Subsection 7.5.4.2). A maintenance ass is provided and utilized for maintenance and testing purposes (Subsection 7.5.4.4).

ESFAS Criterion 40 - All ESFAS operating bypasses, either manually or automatically initiated, shall be automatically removed when the facility moves to an operating regime where the protective action would be required if an accident occurred.

re are no operational bypasses in the ESFAS design (Subsection 7.5.4.2).

ESFAS Criterion 41 - If operating conditions change so that an active operating bypass is no longer permissible, the ESFAS shall automatically accomplish one of the following actions:

Remove the appropriate active operating bypass(es)

Restore conditions so that permissive conditions once again exist

Initiate the appropriate safety function(s) re are no operational bypasses in the ESFAS design (Subsection 7.5.4.2).

NE Medical Technologies 7.5-13 Rev. 3

reducing temporarily its degree of redundancy to zero), the remaining portions provide acceptable reliability to perform the ESFAS action if required.

ere three channels are provided, taking a SFM out of service preserves the single failure rion for variables associated with that SFM. In cases where only two channels are provided, ng a channel out of service will actuate the associated safety function. For testing purposes, ing a channel in maintenance bypass will be allowed by technical specifications for up to two rs to perform required testing. Two hours is considered acceptable due to the continued rability of the redundant channel(s) and the low likelihood that an accident would occur in se two hours (Subsection 7.5.4.4).

ESFAS Criterion 43 - Provisions shall exist to allow the operations staff to confirm that a bypassed ESFAS safety function has been properly returned to service.

re are no operational bypasses in the ESFAS design (Subsection 7.5.4.2). Any ESFAS nnels placed in maintenance bypass for maintenance or testing, or removed from ntenance bypass, will be displayed to the operators in the facility control room through the nitoring and indication bus to the PICS (Subsection 7.5.4.4). The PICS is described in tion 7.3 and operator displays and human factors considerations are addressed in tion 7.6.

2.2.10 Completion of Protective Actions ESFAS Criterion 44 - The ESFAS design shall ensure that once initiated the safety actions will continue until the protective function is completed.

ure 7.5-1 shows how the ESFAS latches in a protective action and maintains the state of a ective action until operator input is initiated to reset the output of the ESFAS. Completion of ective actions is described in Subsection 7.5.3.2.

ESFAS Criterion 45 - Only deliberate operator action shall be permitted to reset the ESFAS or its components following manual or automatic actuation.

y deliberate operator action can be taken to reset the ESFAS following a protective action.

ure 7.5-1 shows how the ESFAS latches in a protective action and maintains the state of a ective action until operator input is initiated to reset the output of the ESFAS. Completion of ective actions is described in Subsection 7.5.3.2.

ESFAS Criterion 46 - Mechanisms for deliberate operator intervention in the ESFAS status or its functions shall not be capable of preventing the initiation of ESFAS actions.

afety-related enable nonsafety switch (when enabled) allows a facility operator to control the put state of the ESFAS with a hardwired binary control signal from the nonsafety-related trols. If the enable nonsafety switch is active, and no automatic safety actuation or manual ty actuation signals are present, the operator is capable of energizing or deenergizing any outputs using the nonsafety-related hardwired control signals (Subsection 7.5.3.2).

itionally, safety-related signals are prioritized over nonsafety-related signals bsection 7.5.3.11).

NE Medical Technologies 7.5-14 Rev. 3

ESFAS Criterion 47 - The effects of electromagnetic interference/radio-frequency interference (EMI/RFI) and power surges, such as high-energy faults and lightning, on the ESFAS, including field programmable gate array (FPGA)-based digital portions, shall be adequately addressed.

FAS rack mounted equipment is installed in a mild operating environment and is designed to et the environmental conditions described in Subsection 7.5.3.4. Rack mounted ESFAS ipment is tested to appropriate standards to show that the effects of EMI/RFI and power ges are adequately addressed. Appropriate grounding of the ESFAS is performed in ordance with Section 5.2.1 of IEEE Standard 1050-2004 (IEEE, 2004b).

2.2.12 Surveillance ESFAS Criterion 48 - Equipment in the ESFAS (from the input circuitry to output actuation circuitry) shall be designed to allow testing, calibration, and inspection to ensure operability. If testing is required or can be performed as an option during operation, the ESFAS shall retain the capability to accomplish its safety function while under test.

ESFAS design supports testing, maintenance, and calibration to ensure operability as cribed in Subsections 7.5.4.4 and 7.5.4.5. Testing performed during operation is controlled in ordance with the technical specifications to ensure that at least one division of the ESFAS is able of performing its safety functions when required.

ESFAS Criterion 49 - Testing, calibration, and inspections of the ESFAS shall be sufficient to show that once performed, they confirm that surveillance test and self-test features address failure detection, self-test features, and actions taken upon failure detection.

ESFAS design supports testing, maintenance, and calibration, as described in sections 7.5.4.4 and 7.5.4.5. End-to-end testing of the entire ESFAS platform can be ormed through overlap testing. ESFAS components have self-testing capabilities, except the rete APL of the EIM which is functionally tested.

ESFAS Criterion 50 - The design of the ESFAS and the justification for test intervals shall be consistent with the surveillance testing intervals as part of the facility technical specifications.

ESFAS design supports testing, maintenance, and calibration, as described in sections 7.5.4.4 and 7.5.4.5. Testing intervals are established in the technical specifications bsection 7.5.4.6).

2.2.13 Classification and Identification ESFAS Criterion 51 - ESFAS equipment shall be distinctly identified to indicate its safety classification and to associate equipment according to divisional or channel assignments.

h ESFAS cable and component is uniquely identified in accordance with SHINE component bering guidelines. The unique identification number indicates the applicable system and sion (Subsection 7.5.3.9).

NE Medical Technologies 7.5-15 Rev. 3

ESFAS Criterion 52 - Human factors shall be considered at the initial stages and throughout the ESFAS design process to ensure that the functions allocated in whole or in part to the operator(s) can be successfully accomplished to meet ESFAS design goals.

man factors is a design consideration for development of the ESFAS. Changes to the design ughout the lifecycle process include human factors considerations (Subsection 7.4.5.4.2).

man factors design is described in Subsection 7.5.3.6.

ESFAS Criterion 53 - The ESFAS shall include readily available means for manual initiation of each protective function at the system level.

ESFAS provides manual safety actuation capability as shown in the logic diagrams.

ure 7.5-1 displays where the manual actuation is brought into the logic. Human factors design upport of manual initiation is described in Subsection 7.5.3.6.

ESFAS Criterion 54 - The ESFAS shall be designed to provide the information necessary to support annunciation of the channel initiating a protective action to the operator and requiring manual operator reset when all conditions to resume operation are met and satisfied.

support the use of manual safety actuations, the ESFAS includes isolated outputs for each ty-related instrument channel to provide monitoring and indication information to the PICS bsection 7.5.3.6). See also ESFAS Criterion 45 regarding manual operator reset in section 7.5.2.2.10.

2.2.15 Quality ESFAS Criterion 55 - The quality of the components and modules in the ESFAS shall be commensurate with the importance of the safety function to be performed.

safety-related ESFAS is designed, fabricated, erected, and tested by SHINEs safety-related trol system vendor in accordance with the vendors Project Quality Assurance Plan bsection 7.4.4.1.4). SHINE is responsible for oversight of the vendor and maintaining the dor as an approved supplier on the SHINE approved supplier list (Subsection 7.4.5.4.1).

ESFAS Criterion 56 - Controls over the design, fabrication, installation, and modification of the ESFAS shall conform to the guidance of ANSI/ANS 15.8-1995, Quality Assurance Program Requirements for Research Reactors (ANSI/ANS, 1995), as endorsed by Regulatory Guide 2.5, Quality Assurance Program Requirements for Research and Test Reactors (USNRC, 2010).

ESFAS design conforms to the guidance of ANSI/ANS 15.8-1995 (ANSI/ANS, 1995) as orsed by Regulatory Guide 2.5 (USNRC, 2010) (Subsection 7.5.3.12).

3 DESIGN BASIS ESFAS monitors process variables and provides automatic initiating signals in response to normal conditions, providing protection against unsafe conditions in the main production lity.

NE Medical Technologies 7.5-16 Rev. 3

lytical limit, and response time. The conditions or operating modes applicable to each able monitored by the ESFAS are described in the technical specifications.

3.1 Safety Functions ESFAS is a plant level control system not specific to any operating unit or process, figured as shown in Figure 7.1-3 The facility operating conditions applicable to each omatic ESFAS safety function listed in this subsection are specified in the technical cifications.

3.1.1 Supercell Area 1 (PVVS Area) Isolation ercell Area 1 (PVVS Area) Isolation is relied upon as a safety-related control for radioactivity ase scenarios similar to those described in Chapter 13 for RPF critical equipment malfunction nts (Subsection 13b.1.2.3), and to provide for a consistent confinement strategy for all ten s of the supercell.

upercell Area 1 (PVVS Area) Isolation initiates the following safety functions:

Deenergize RVZ2 supercell area 1 (PVVS area) inlet isolation dampers

Deenergize RVZ1 supercell area 1 (PVVS area) outlet isolation dampers

VTS Safety Actuation which returns the VTS to atmospheric pressure ESFAS initiates a Supercell Area 1 (PVVS Area) Isolation based on the following variable or ty actuation:

High RVZ1 supercell area 1 (PVVS area) radiation

RCA Isolation 3.1.2 Supercell Area 2 (Extraction Area A) Isolation ercell Area 2 (Extraction Area A) Isolation is relied upon as a safety-related control in ordance with the SHINE safety analysis described in Chapter 13 for RPF critical equipment function events (Subsection 13b.1.2.3, Scenarios 1, 2, 3, and 13).

upercell Area 2 (Extraction Area A) Isolation initiates the following safety functions:

Deenergize RVZ2 supercell area 2 (extraction area A) inlet isolation dampers

Deenergize RVZ1 supercell area 2 (extraction area A) outlet isolation dampers

MEPS A [ ]PROP/ECI Isolation

VTS Safety Actuation ESFAS initiates a Supercell Area 2 (Extraction Area A) Isolation based on the following able or safety actuation:

High RVZ1 supercell area 2 (extraction area A) radiation

RCA Isolation NE Medical Technologies 7.5-17 Rev. 3

ercell Area 3 (Purification Area A) Isolation is relied upon as a safety-related control for oactivity release scenarios similar to those described in Chapter 13 for RPF critical ipment malfunction events (Subsection 13b.1.2.3), and to provide for a consistent finement strategy for all ten cells of the supercell.

upercell Area 3 (Purification Area A) Isolation initiates the following safety functions:

Deenergize RVZ2 supercell area 3 (purification area A) inlet isolation dampers

Deenergize RVZ1 supercell area 3 (purification area A) outlet isolation dampers ESFAS initiates a Supercell Area 3 (Purification Area A) Isolation based on the following able or safety actuation:

High RVZ1 supercell area 3 (purification area A) radiation

RCA Isolation 3.1.4 Supercell Area 4 (Packaging Area 1) Isolation ercell Area 4 (Packaging Area 1) Isolation is relied upon as a safety-related control for oactivity release scenarios similar to those described in Chapter 13 for RPF critical ipment malfunction events (Subsection 13b.1.2.3), and to provide for a consistent finement strategy for all ten cells of the supercell.

upercell Area 4 (Packaging Area 1) Isolation initiates the following safety functions:

Deenergize RVZ2 supercell area 4 (packaging area 1) inlet isolation dampers

Deenergize RVZ1 supercell area 4 (packaging area 1) outlet isolation dampers ESFAS initiates a Supercell Area 4 (Packaging Area 1) Isolation based on the following able or safety actuation:

High RVZ1 supercell area 4 (packaging area 1) radiation

RCA Isolation 3.1.5 Supercell Area 5 (Purification Area B) Isolation ercell Area 5 (Purification Area B) Isolation is relied upon as a safety-related control for oactivity release scenarios similar to those described in Chapter 13 for RPF critical ipment malfunction events (Subsection 13b.1.2.3), and to provide for a consistent finement strategy for all ten cells of the supercell.

upercell Area 5 (Purification Area B) Isolation initiates the following safety functions:

Deenergize RVZ2 supercell area 5 (purification area B) inlet isolation dampers

Deenergize RVZ1 supercell area 5 (purification area B) outlet isolation dampers NE Medical Technologies 7.5-18 Rev. 3

High RVZ1 supercell area 5 (purification area B) radiation

RCA Isolation 3.1.6 Supercell Area 6 (Extraction Area B) Isolation ercell Area 6 (Extraction Area B) Isolation is relied upon as a safety-related control in ordance with the SHINE safety analysis described in Chapter 13 for RPF critical equipment function events (Subsection 13b.1.2.3, Scenarios 1, 2, 3, and 13).

upercell Area 6 (Extraction Area B) Isolation initiates the following safety functions:

Deenergize RVZ2 supercell area 6 (extraction area B) inlet isolation dampers

Deenergize RVZ1 supercell area 6 (extraction area B) outlet isolation dampers

MEPS B [ ]PROP/ECI Isolation

VTS Safety Actuation ESFAS initiates a Supercell Area 6 (Extraction Area B) Isolation based on the following able or safety actuation:

High RVZ1 supercell area 6 (extraction area B) radiation

RCA Isolation

Supercell Area 10 (IXP area) Isolation 3.1.7 Supercell Area 7 (Extraction Area C) Isolation ercell Area 7 (Extraction Area C) Isolation is relied upon as a safety-related control in ordance with the SHINE safety analysis described in Chapter 13 for RPF critical equipment function events (Subsection 13b.1.2.3, Scenarios 1, 2, 3, and 13).

upercell Area 7 (Extraction Area C) Isolation initiates the following safety functions:

Deenergize RVZ2 supercell area 7 (purification area C) inlet isolation dampers

Deenergize RVZ1 supercell area 7 (purification area C) outlet isolation dampers

MEPS C [ ]PROP/ECI Isolation

VTS Safety Actuation ESFAS initiates a Supercell Area 7 (Extraction Area C) Isolation based on the following able or safety actuation:

High RVZ1 supercell area 7 (extraction Area C) radiation

RCA Isolation

Supercell Area 10 (IXP area) Isolation 3.1.8 Supercell Area 8 (Purification Area C) Isolation ercell Area 8 (Purification Area C) Isolation is relied upon as a safety-related control for oactivity release scenarios similar to those described in Chapter 13 for RPF critical NE Medical Technologies 7.5-19 Rev. 3

upercell Area 8 (Purification Area C) Isolation initiates the following safety functions:

Deenergize RVZ2 supercell area 8 (purification area C) inlet isolation dampers

Deenergize RVZ1 supercell area 8 (purification area C) outlet isolation dampers ESFAS initiates a Supercell Area 8 (Purification Area C) Isolation based on the following able or safety actuation:

High RVZ1 supercell area 8 (purification area C) radiation

RCA Isolation 3.1.9 Supercell Area 9 (Packaging Area 2) Isolation ercell Area 9 (Packaging Area 2) Isolation is relied upon as a safety-related control for oactivity release scenarios similar to those described in Chapter 13 for RPF critical ipment malfunction events (Subsection 13b.1.2.3), and to provide for a consistent finement strategy for all ten cells of the supercell.

upercell Area 9 (Packaging Area 2) Isolation initiates the following safety functions:

Deenergize RVZ2 supercell area 9 (packaging area 2) inlet isolation dampers

Deenergize RVZ1 supercell area 9 (packaging area 2) outlet isolation dampers ESFAS initiates a Supercell Area 9 (Packaging Area 2) Isolation based on the following able or safety actuation:

High RVZ1 supercell area 9 (packaging area 2) radiation

RCA Isolation 3.1.10 Supercell Area 10 (IXP Area) Isolation ercell Area 10 (IXP Area) Isolation is relied upon as a safety-related control in accordance the SHINE safety analysis described in Chapter 13 for RPF critical equipment malfunction nts (Subsection 13b.1.2.3, Scenarios 4, 5, 6, and 7).

upercell Area 10 (IXP Area) Isolation initiates the following safety functions:

Deenergize RVZ2 supercell area 10 (IXP area) inlet isolation dampers

Deenergize RVZ1 supercell area 10 (IXP area) outlet isolation dampers

Supercell Area 6 (extraction area B) Isolation

Supercell Area 7 (extraction area C) Isolation ESFAS initiates a Supercell Area 10 (IXP Area) Isolation based on the following variable or ty actuation:

High RVZ1 supercell area 10 (IXP area) radiation

RCA Isolation NE Medical Technologies 7.5-20 Rev. 3

PS A [ ]PROP/ECI Isolation is relied upon as a safety-related control in accordance the SHINE safety analysis described in Chapter 13 for RPF critical equipment malfunction nts (Subsection 13b.1.2.3, Scenario 14).

EPS A [ ]PROP/ECI Isolation initiates the following safety functions:

Deenergize MEPS [ ]PROP/ECI A inlet isolation valves

Deenergize MEPS [ ]PROP/ECI A discharge isolation valves

Deenergize MEPS A extraction feed pump breakers ESFAS initiates a MEPS A [ ]PROP/ECI Isolation based on the following variable afety actuation:

High MEPS [ ]PROP/ECI conductivity extraction area A

Radioactive drain system (RDS) liquid detection switch signal

Supercell Area 2 Isolation 3.1.12 MEPS B [ ]PROP/ECI Isolation PS B [ ]PROP/ECI Isolation is relied upon as a safety-related control in accordance the SHINE safety analysis described in Chapter 13 for RPF critical equipment malfunction nts (Subsection 13b.1.2.3, Scenario 14).

EPS B [ ]PROP/ECI Isolation initiates the following safety functions:

Deenergize MEPS [ ]PROP/ECI B inlet isolation valves

Deenergize MEPS [ ]PROP/ECI B discharge isolation valves

Deenergize MEPS B extraction feed pump breakers ESFAS initiates a MEPS B [ ]PROP/ECI Isolation based on the following variable afety actuation:

High MEPS [ ]PROP/ECI conductivity extraction area B

RDS liquid detection switch signal

Supercell Area 6 Isolation 3.1.13 MEPS C [ ]PROP/ECI Isolation PS C [ ]PROP/ECI Isolation is relied upon as a safety-related control in accordance the SHINE safety analysis described in Chapter 13 for RPF critical equipment malfunction nts (Subsection 13b.1.2.3, Scenario 14).

EPS C [ ]PROP/ECI Isolation initiates the following safety functions:

Deenergize MEPS [ ]PROP/ECI C inlet isolation valves

Deenergize MEPS [ ]PROP/ECI C discharge isolation valves

Deenergize MEPS C extraction feed pump breakers NE Medical Technologies 7.5-21 Rev. 3

High MEPS [ ]PROP/ECI conductivity extraction area C

RDS liquid detection switch signal

Supercell Area 7 Isolation 3.1.14 Carbon Delay Bed Group 1 Isolation bon Delay Bed Group 1 Isolation is relied upon as a safety-related control in accordance with SHINE safety analysis described in Chapter 13 for RPF fire events (Subsection 13b.1.2.5, nario 1).

arbon Delay Bed Group 1 Isolation initiates the following safety functions:

Energize PVVS carbon delay bed group 1 three-way valves

Energize PVVS carbon delay bed group 1 outlet isolation valves ESFAS initiates a Carbon Delay Bed Group 1 Isolation based on the following variables:

High carbon delay bed group 1 exhaust carbon monoxide 3.1.15 Carbon Delay Bed Group 2 Isolation bon Delay Bed Group 2 Isolation is relied upon as a safety-related control in accordance with SHINE safety analysis described in Chapter 13 for RPF fire events (Subsection 13b.1.2.5, nario 1).

arbon Delay Bed Group 2 Isolation initiates the following safety functions:

Energize PVVS carbon delay bed group 2 three-way valves

Energize PVVS carbon delay bed group 2 outlet isolation valves ESFAS initiates a Carbon Delay Bed Group 2 Isolation based on the following variables:

High carbon delay bed group 2 exhaust carbon monoxide 3.1.16 Carbon Delay Bed Group 3 Isolation bon Delay Bed Group 3 Isolation is relied upon as a safety-related control in accordance with SHINE safety analysis described in Chapter 13 for RPF fire events (Subsection 13b.1.2.5, nario 1).

arbon Delay Bed Group 3 Isolation initiates the following safety functions:

Energize PVVS carbon delay bed group 3 three-way valves

Energize PVVS carbon delay bed group 3 outlet isolation valves NE Medical Technologies 7.5-22 Rev. 3

High carbon delay bed group 3 exhaust carbon monoxide 3.1.17 VTS Safety Actuation Safety Actuation is relied upon as a safety-related control in accordance with the SHINE ty analysis described in Chapter 13 for RPF critical equipment malfunction events bsection 13b.1.2.3, Scenarios 8, 10, 11, 12, and 16), and for criticality safety requirements bsection 6b.3.2.5).

TS Safety Actuation Isolation initiates the following safety functions:

Deenergize VTS vacuum transfer pump 1 breakers

Deenergize VTS vacuum transfer pump 2 breakers

Deenergize VTS vacuum break valves

Deenergize MEPS A extraction column wash supply valve

Deenergize MEPS A extraction column eluent valve

Deenergize MEPS A [ ]PROP/ECI wash supply valve

Deenergize MEPS A [ ]PROP/ECI eluent valve

Deenergize MEPS B extraction column wash supply valve

Deenergize MEPS B extraction column eluent valve

Deenergize MEPS B [ ]PROP/ECI wash supply valve

Deenergize MEPS B [ ]PROP/ECI eluent valve

Deenergize MEPS C extraction column wash supply valve

Deenergize MEPS C extraction column eluent valve

Deenergize MEPS C [ ]PROP/ECI wash supply valve

Deenergize MEPS C [ ]PROP/ECI eluent valve

Deenergize IXP recovery column wash supply valve

Deenergize IXP recovery column eluent valve

Deenergize IXP [ ]PROP/ECI wash supply valve

Deenergize IXP [ ]PROP/ECI eluent valve

Deenergize IXP FNHS supply valve

Deenergize IXP liquid nitrogen supply valve ESFAS initiates a VTS Safety Actuation based on the following variables or safety ations:

VTS vacuum header liquid detection switch signal

RDS liquid detection switch signal

Supercell Area 1 Isolation

Supercell Area 2 Isolation

Supercell Area 6 Isolation

Supercell Area 7 Isolation

RCA Isolation

Facility master operating permissive NE Medical Technologies 7.5-23 Rev. 3

Train A Isolation is relied upon as a safety-related control in accordance with the SHINE ty analysis described in Chapter 13 for external events (Subsection 13a2.1.6, Scenario 3),

for facility specific tritium purification system events (Subsection 13a2.1.12, TPS nario 1).

PS Train A Isolation initiates the following safety functions:

Deenergize TPS train A glovebox pressure control exhaust isolation valve

Deenergize vacuum/impurity treatment subsystem (VAC/ITS) train A process vent ITS isolation valves (TPS train A ITS isolation valves)

Deenergize TPS train A helium air operated valve (AOV) supply isolation valve

Deenergize TPS train A helium solenoid operated valve (SOV) supply isolation valve

Deenergize RVZ2 TPS room supply isolation dampers

Deenergize RVZ2 TPS room exhaust isolation dampers

Deenergize VAC/ITS train A process vent vacuum isolation valves (TPS train A vacuum isolation valves)

Deenergize IU Cell 1 TPS Actuation

Deenergize IU Cell 2 TPS Actuation ESFAS initiates a TPS Train A Isolation based on the following variables or safety actuation:

High TPS IU cell 1 target chamber supply pressure

High TPS IU cell 2 target chamber supply pressure

High TPS IU cell 1 target chamber exhaust pressure

High TPS IU cell 2 target chamber exhaust pressure

High TPS confinement A tritium

RCA Isolation

Facility master operating permissive 3.1.19 TPS Train B Isolation Train B Isolation is relied upon as a safety-related control in accordance with the SHINE ty analysis described in Chapter 13 for external events (Subsection 13a2.1.6, Scenario 3),

for facility specific tritium purification system events (Subsection 13a2.1.12, TPS nario 1).

PS Train B Isolation initiates the following safety functions:

Deenergize TPS train B glovebox pressure control exhaust isolation valve

Deenergize VAC/ITS train B process vent ITS isolation valves (TPS train B ITS isolation valves)

Deenergize TPS train B helium AOV supply isolation valve

Deenergize TPS train B helium SOV supply isolation valve

Deenergize RVZ2 TPS room supply isolation dampers

Deenergize RVZ2 TPS room exhaust isolation dampers

Deenergize VAC/ITS train B process vent vacuum isolation valves (TPS train B vacuum isolation valves)

TRPS IU Cell 3 TPS Actuation NE Medical Technologies 7.5-24 Rev. 3

ESFAS initiates a TPS Train B Isolation based on the following variables or safety actuation:

High TPS IU cell 3 target chamber supply pressure

High TPS IU cell 4 target chamber supply pressure

High TPS IU cell 5 target chamber supply pressure

High TPS IU cell 3 target chamber exhaust pressure

High TPS IU cell 4 target chamber exhaust pressure

High TPS IU cell 5 target chamber exhaust pressure

High TPS confinement B tritium

RCA Isolation

Facility master operating permissive 3.1.20 TPS Train C Isolation Train C Isolation is relied upon as a safety-related control in accordance with the SHINE ty analysis described in Chapter 13 for external events (Subsection 13a2.1.6, Scenario 3),

for facility specific tritium purification system events (Subsection 13a2.1.12, TPS nario 1).

PS Train C Isolation initiates the following safety functions:

Deenergize TPS train C glovebox pressure control exhaust isolation valve

Deenergize VAC/ITS train C process vent ITS isolation valves (TPS train C ITS isolation valves)

Deenergize TPS train C helium AOV supply isolation valve

Deenergize TPS train C helium SOV supply isolation valve

Deenergize RVZ2 TPS room supply isolation dampers

Deenergize RVZ2 TPS room exhaust isolation dampers

Deenergize VAC/ITS train C process vent vacuum isolation valves (TPS train C vacuum isolation valves)

TRPS IU Cell 6 TPS Actuation

TRPS IU Cell 7 TPS Actuation

TRPS IU Cell 8 TPS Actuation ESFAS initiates a TPS Train C Isolation based on the following variables or safety actuation:

High TPS IU cell 6 target chamber supply pressure

High TPS IU cell 7 target chamber supply pressure

High TPS IU cell 8 target chamber supply pressure

High TPS IU cell 6 target chamber exhaust pressure

High TPS IU cell 7 target chamber exhaust pressure

High TPS IU cell 8 target chamber exhaust pressure

High TPS confinement C tritium

RCA Isolation

Facility master operating permissive NE Medical Technologies 7.5-25 Rev. 3

Process Vent Actuation is relied upon as a safety-related control in accordance with the NE safety analysis described in Chapter 13 for facility specific tritium purification system nts (Subsection 13a2.1.12, TPS Scenario 3 and TPS Scenario 4).

PS Process Vent Actuation initiates the following safety functions:

Deenergize TPS train A vacuum isolation valves

Deenergize TPS train A ITS isolation valves

Deenergize TPS train B vacuum isolation valves

Deenergize TPS train B ITS isolation valves

Deenergize TPS train C vacuum isolation valves

Deenergize TPS train C ITS isolation valves

TRPS IU Cell 1 TPS Actuation

TRPS IU Cell 2 TPS Actuation

TRPS IU Cell 3 TPS Actuation

TRPS IU Cell 4 TPS Actuation

TRPS IU Cell 5 TPS Actuation

TRPS IU Cell 6 TPS Actuation

TRPS IU Cell 7 TPS Actuation

TRPS IU Cell 8 TPS Actuation ESFAS initiates a TPS Process Vent Actuation based on the following variables or safety ation:

High TPS exhaust to facility stack tritium

RCA Isolation

Facility master operating permissive 3.1.22 IU Cell Nitrogen Purge Cell Nitrogen Purge transitions the nitrogen purge system (N2PS) IU cell header valves to r deenergized state.

ESFAS also provides an ESFAS loss of external power actuation signal to the TRPS system associated with each IU cell upon receipt of a UPSS loss of external power signal to ate an IU Cell Nitrogen Purge within the TRPS (Subsection 7.4.3.1.2).

IU Cell Nitrogen Purge is relied upon as a safety-related control in accordance with the NE safety analysis described in Chapter 13 for insertion of excess reactivity events bsection 13a2.1.12, Scenario 5), and detonation and deflagration in the primary system ndary (Subsection 13a2.1.9, Scenario 1).

ESFAS initiates an IU Cell Nitrogen Purge based on the following variables:

UPSS loss of external power

TRPS IU Cell 1 Nitrogen Purge signal

TRPS IU Cell 2 Nitrogen Purge signal

TRPS IU Cell 3 Nitrogen Purge signal NE Medical Technologies 7.5-26 Rev. 3

TRPS IU Cell 6 Nitrogen Purge signal

TRPS IU Cell 7 Nitrogen Purge signal

TRPS IU Cell 8 Nitrogen Purge signal 3.1.23 RPF Nitrogen Purge RPF Nitrogen Purge is relied upon as a safety-related control in accordance with the SHINE ty analysis described in Chapter 13 for external events (Subsection 13a2.1.6, Scenario 7).

F Nitrogen Purge initiates the following safety functions:

Deenergize PVVS blower bypass valves

Deenergize radioactive liquid waste immobilization (RLWI) PVVS isolation valve

Deenergize PVVS carbon guard bed bypass valves

Deenergize N2PS RPF header valves

Deenergize N2PS PVVS north header valves

Deenergize N2PS PVVS south header valves ESFAS initiates an RPF Nitrogen Purge based on the following variable:

Low PVVS flow 3.1.24 RCA Isolation RCA Isolation is relied upon as a safety-related control in accordance with the SHINE safety lysis described in Chapter 13 for RPF critical equipment malfunction events bsection 13b.1.2.3, Scenarios 8, 10, 11, 12, and 16).

A Isolation initiates the following safety functions:

Deenergize RVZ1 RCA exhaust isolation dampers

Deenergize RVZ2 RCA exhaust isolation dampers

Deenergize RVZ2 RCA supply isolation dampers

Deenergize RVZ2 TPS room supply isolation dampers

Deenergize RVZ2 TPS room exhaust isolation dampers

Deenergize RVZ3 transfer isolation dampers shipping/receiving IF

Deenergize RVZ3 transfer isolation dampers shipping/receiving RPF

Deenergize RVZ3 transfer isolation dampers main RCA ingress/egress

Deenergize RVZ3 transfer isolation dampers RPF emergency exit

Deenergize RVZ3 transfer isolation dampers IF emergency exit

Deenergize RVZ3 transfer isolation dampers mezzanine emergency exit

Deenergize RVZ1 exhaust train 1 blower breakers

Deenergize RVZ1 exhaust train 2 blower breakers

Deenergize RVZ2 exhaust train 1 blower breakers

Deenergize RVZ2 exhaust train 2 blower breakers

Deenergize RVZ2 supply train 1 blower breakers

Deenergize RVZ2 supply train 2 blower breakers NE Medical Technologies 7.5-27 Rev. 3

Supercell Area 3 Isolation

Supercell Area 4 Isolation

Supercell Area 5 Isolation

Supercell Area 6 Isolation

Supercell Area 7 Isolation

Supercell Area 8 Isolation

Supercell Area 9 Isolation

Supercell Area 10 Isolation

VTS Safety Actuation

TPS Train A Isolation

TPS Train B Isolation

TPS Train C Isolation

TPS Process Vent Actuation ESFAS initiates an RCA Isolation based on the following variables:

High RVZ1 RCA exhaust radiation

High RVZ2 RCA exhaust radiation 3.1.25 Extraction Column A Alignment Actuation action Column A Alignment Actuation is relied upon as a safety-related control in accordance the SHINE safety analysis described in Chapter 13 for RPF critical equipment malfunction nts (Subsection 13b.1.2.3, Scenario 15).

Extraction Column A Alignment Actuation initiates the following safety functions:

Deenergize MEPS area A extraction column upper three-way valve

Deenergize MEPS area A extraction column lower three-way valve

Deenergize MEPS A extraction column eluent valve ESFAS initiates the Extraction Column A Alignment Actuation based on both of the following ts being active:

MEPS area A extraction column upper three-way valve supplying position indication

MEPS area A extraction column lower three-way valve supplying position indication 3.1.26 Extraction Column B Alignment Actuation action Column B Alignment Actuation is relied upon as a safety-related control in accordance the SHINE safety analysis described in Chapter 13 for RPF critical equipment malfunction nts (Subsection 13b.1.2.3, Scenario 15).

Extraction Column B Alignment Actuation initiates the following safety functions:

Deenergize MEPS area B extraction column upper three-way valve

Deenergize MEPS area B extraction column lower three-way valve

Deenergize MEPS B extraction column eluent valve NE Medical Technologies 7.5-28 Rev. 3

MEPS area B extraction column upper three-way valve supplying position indication

MEPS area B extraction column lower three-way valve supplying position indication 3.1.27 Extraction Column C Alignment Actuation action Column C Alignment Actuation is relied upon as a safety-related control in accordance the SHINE safety analysis described in Chapter 13 for RPF critical equipment malfunction nts (Subsection 13b.1.2.3, Scenario 15).

Extraction Column C Alignment Actuation initiates the following safety functions:

Deenergize MEPS area C extraction column upper three-way valve

Deenergize MEPS area C extraction column lower three-way valve

Deenergize MEPS area C extraction column eluent valve ESFAS initiates the Extraction Column C Alignment Actuation based on both of the following ts being active:

MEPS area C extraction column upper three-way valve supplying position indication

MEPS area C extraction column lower three-way valve supplying position indication 3.1.28 IXP Alignment Actuation IXP Alignment Actuation is relied upon as a safety-related control for column misalignment narios similar to those described in Chapter 13 for RPF critical equipment malfunction events bsection 13b.1.2.3, Scenario 15).

IXP Alignment Actuation initiates the following safety functions:

Deenergize IXP upper three-way valve

Deenergize IXP lower three-way valve

Deenergize IXP recovery column eluent valve ESFAS initiates the IXP Alignment Actuation based on both of the following inputs being ve:

IXP upper three-way valve supplying position indication

IXP lower three-way valve supplying position indication 3.1.29 Dissolution Tank Isolation solution Tank Isolation is relied upon as a safety-related control for preventing criticality nts (Subsection 6b.3.2.4).

NE Medical Technologies 7.5-29 Rev. 3

Deenergize target solution preparation system (TSPS) radioisotope process facility cooling system (RPCS) supply cooling valves

Deenergize TSPS RPCS return cooling valve

Deenergize TSPS air inlet isolation valve

Deenergize TSPS RVZ1 exhaust isolation valve ESFAS initiates the Dissolution Tank Isolation based on the following inputs being active:

High TSPS dissolution tank 1 level switch signal

High TSPS dissolution tank 2 level switch signal 3.2 Completion of Protective Actions ESFAS is designed so that once initiated, protective actions will continue to completion. Only berate operator action can be taken to reset the ESFAS following a protective action.

ure 7.5-1 shows how the ESFAS latches in a protective action and maintains the state of a ective action until operator input is initiated to reset the output of the ESFAS to normal rating conditions.

output of the ESFAS is designed so that actuation through automatic or manual means of a ty function can only change when a new position is requested. If there is no signal present the automatic safety actuation or manual actuation, then the output of the EIM remains in its ent state. A safety-related enable nonsafety switch allows an operator, after the switch has n brought to enable, to control the output state of the ESFAS with a hardwired binary control al from the nonsafety-related controls. The enable nonsafety switch is classified as part of safety system and is used to prevent spurious nonsafety-related control signals from ersely affecting safety-related components. If the enable nonsafety switch is active, and no omatic safety actuation or manual actuation signals are present, the operator is capable of rgizing or deenergizing any EIM outputs using the nonsafety-related hardwired control als. If the enable nonsafety switch is not active, the nonsafety-related hardwired control als are ignored.

3.3 Single Failure ESFAS consists of three divisions of input processing and trip determination and two sions of actuation logic (see Figure 7.1-2) arranged so that no single failure within the ESFAS ults in the loss of the protective function.

safety-related inputs into the ESFAS are designed and controlled so they do not prevent the FAS from performing its safety functions. The only nonsafety inputs into the ESFAS are those the PICS for controls and monitoring/indication only variables. The nonsafety control signals the PICS are implemented through a hardwired parallel interface that requires the PICS to d a binary address associated to the output state of the EIM along with a mirrored plement address. The mirrored complement address prevents any single incorrectly sented bit from addressing the wrong EIM output state. To prevent the PICS from vertently presenting a valid address, the ESFAS contains a safety-related enable nonsafety ch that controls when the hardwired parallel interface within the APL is active, thus controlling NE Medical Technologies 7.5-30 Rev. 3

trol signal is ignored. If the enable nonsafety is active, and no automatic or manual actuation mand is present, the nonsafety-related control signal can control the ESFAS output. The dwired module provides isolation for the nonsafety-related signal path.

ations exist in the design where the ESFAS only actuates a Division A component and there o corresponding Division B component, or there is a passive check valve credited as a undant component. These situations are considered acceptable since the safety function udes a separate, redundant and passive component (i.e., check valve) which does not need e monitored or manipulated by the ESFAS.

h input variable to the ESFAS for monitoring and indication only is processed on independent t submodules that are unique to that input. If the variable is not used for a safety function

, no trip determination is performed with the variable or the variable is used only for actuated ponent position indication), then the variable is not connected to the safety data buses and is placed onto the monitoring and indication bus. The monitoring and indication bus is used by monitoring and indication communication module (MI-CM) without interacting with any of the ty data paths.

ESFAS provides separate communication paths to the PICS display systems from each of three ESFAS divisions. ESFAS divisions A and B are powered from a separate division of the SS; ESFAS division C receives auctioneered power from both UPSS divisions A and B.

3.4 Operating Conditions ESFAS control and logic functions operate inside of the facility control room where the ironment is mild and not exposed to the irradiation process, and is not subject to operational ing. However, the cables for the ESFAS are routed through the radiologically controlled area he process areas. The routed cables have the potential to be exposed to more harsh ditions than the mild environment of the facility control room. The sensors are located inside process confinement boundary; therefore, the terminations of the cables routed to the sors are exposed to the high radiation environment.

ing normal operation, the ESFAS equipment will operate in the applicable normal radiation ironments identified in Table 7.2-1 for up to 20 years, replaced at a frequency sufficient such the radiation qualification of the affected components is not exceeded.

environmental conditions for ESFAS components are outlined in Table 7.2-1 through le 7.2-3. The facility heating, ventilation and air conditioning (HVAC) systems are relied upon aintain the temperature and humidity parameters in these areas. The facility HVAC systems described in Section 9a2.1.

3.5 Seismic, Tornado, Flood ESFAS equipment is installed in the seismically qualified portion of the main production lity where it is protected from earthquakes, tornadoes, and floods. The ESFAS equipment is smic Category I, designed in accordance with Section 8 of IEEE Standard 344-2013 E, 2013) (Subsection 7.5.3.12).

NE Medical Technologies 7.5-31 Rev. 3

ESFAS provides manual actuation capabilities for the safety functions identified in section 7.5.3.1, except for the IU Cell Nitrogen Purge signal which originates in the TRPS, the following manual push buttons located on the main control board:

RCA Isolation

Supercell Isolation (performs Supercell Areas 1 through 10 Isolations and MEPS A/B/C

[ ]PROP/ECI Isolations)

VTS Actuation

TPS Isolation (performs TPS Train A/B/C Isolation and TPS Process Vent Isolation)

Carbon Delay Bed Group 1 Isolation

Carbon Delay Bed Group 2 Isolation

Carbon Delay Bed Group 3 Isolation

Extraction Column A Alignment Actuation

Extraction Column B Alignment Actuation

Extraction Column C Alignment Actuation

IXP Alignment Actuation

RPF Nitrogen Purge

Dissolution Tank Isolation support the use of manual actuations, the ESFAS includes isolated outputs for each safety-ted instrument channel to provide monitoring and indication information to the PICS. To litate operator indication of ESFAS actuation function status, manual initiation and reset of ective actions, the ESFAS, at the division level, includes isolated input/output for the wing:

Indication of ESFAS variable values

Indication of ESFAS parameter values

Indication of ESFAS logic status

Indication of ESFAS equipment status

Indication of ESFAS actuation device status rator display criteria and design are addressed in Section 7.6.

3.7 Loss of External Power ESFAS is powered from the UPSS, which provides a reliable source of power to maintain ESFAS functional during normal operation and during and following a design basis event.

UPSS is designed to provide power to the ESFAS controls for six hours after a loss of off-power. The UPSS is described in Section 8a2.2.

trolled components associated with safety actuations are designed to go to their safe state n deenergized. On a loss of power to the ESFAS, the ESFAS deenergizes actuation ponents to the positions defined in Table 7.5-2.

FAS response to a loss of external power signal is discussed in Subsection 7.5.4.1.19.

NE Medical Technologies 7.5-32 Rev. 3

ESFAS design utilizes physical separation to minimize the effects from fire or explosion.

ety-related ESFAS equipment in different divisions is located in separate fire areas when ctical. Exceptions include components for all three divisions located in the facility control room in other locations where end devices are installed.

sical separation is used to achieve separation of redundant sensors. Wiring for redundant sions uses physical separation and isolation to provide independence for circuits. Separation iring is achieved using separate wireways and cable trays for each of Division A, Division B, Division C. Division A and C cables are routed along the south side of the RPF to the facility trol room and Division B cables are routed on the north side of the RPF. Where possible, duit is routed subgrade to provide additional separation. Instrument transmitters are located eparate areas: A and C instrumentation is located primarily on the east side of the G-line wall, e Division B is located along the west side of the wall.

sion A and C ESFAS cabinets are separated by a minimum of four feet and are located on opposite side of the facility control room from where Division B cabinets are located. Portable ss A and Class C fire extinguishers are located in the control room to extinguish fires inating within a cabinet, console, or connecting cables. Wet sprinklers are not used in the lity control room to avoid potentially impairing the ability of the ESFAS to perform its safety tions.

combustible and heat resistant materials are used whenever practical in the ESFAS design, icularly in locations such as confinement boundaries and the facility control room. Use of erials that release toxic or corrosive gases under combustion is minimized.

safety-related ESFAS inputs and outputs are routed in non-divisional cable raceways and segregated from safety-related inputs and outputs. Spatial separation between cable and eway groups is in accordance with Section 5.1.1.2, Table 1 of Section 5.1.3.3, and Table 2 of tion 5.1.4 of IEEE Standard 384-2008 (IEEE, 2008) (Subsection 7.5.3.12).

3.9 Classification and Identification h ESFAS cable and component is uniquely identified in accordance with the SHINE ponent numbering guideline. The unique identification number includes, but is not limited to, tem designation (code), equipment train, and division.

3.10 Setpoints servative setpoints for the ESFAS monitored variables are established based on umented analysis methodology (Subsection 7.2.1). Setpoint analysis parameters typically sider instrument precision, sensitivity, accuracy, loop uncertainties, and computational errors.

quate margin is required between the setpoints and the associated safety limits to ensure the ective action is initiated prior to the safety limit being exceeded. The setpoint values are ved from approved system design technical reports, design calculations, uncertainty ulations, and technical specifications.

NE Medical Technologies 7.5-33 Rev. 3

APL (which is constructed of discrete components and part of the equipment interface dule) is designed to provide priority to safety-related signals over nonsafety-related signals.

sion A and Division B priority logic of the ESFAS prioritizes the following ESFAS inputs, with first input listed having the highest priority and each successive input in the list having a lower rity than the previous:

(1) Automatic Safety Actuation, Manual Safety Actuation (2) PICS nonsafety control signals manual actuation inputs from the operators in the facility control room are connected directly he discrete APL. The manual actuation input into the priority logic does not have the ability to bypassed and will always have equal priority to the automated actuation signals over any er signals that are present.

3.12 Design Codes and Standards following codes and standards are applied to the ESFAS design.

1) Section 8 of IEEE Standard 344-2013, IEEE Standard for Seismic Qualification of Equipment for Nuclear Power Generating Stations (IEEE, 2013); invoked as guidance to meet ESFAS Criterion 14.

2) IEEE Standard 379-2000, IEEE Standard Application of Single-Failure Criterion to Nuclear Power Generating Station Safety Systems (IEEE, 2000); invoked as guidance to meet SHINE Design Criterion 15.

3) IEEE Standard 384-2008, IEEE Standard Criteria for Independence of Class 1E Equipment and Circuits (IEEE, 2008); invoked as guidance for separation of safety-related and nonsafety-related cables and raceways to meet ESFAS Design Criteria 21 and 22, and as described in Subsection 8a2.1.3 and Subsection 8a2.1.5.

4) Section 5.2.1 of IEEE Standard 1050-2004, IEEE Guide for Instrumentation and Control Equipment Grounding in Generating Stations (IEEE, 2004b); invoked as guidance to meet ESFAS Design Criterion 47 and to support electromagnetic compatibility qualification for digital I&C equipment.

5) The guidance of ANSI/ANS 15.8-1995, Quality Assurance Program Requirements for Research Reactors (R2013) (ANSI/ANS, 1995), as endorsed by Regulatory Guide 2.5, Quality Assurance Program Requirements for Research and Test Reactors (USNRC, 2010), is applied as part of the SHINE Quality Assurance Program for complying with the programmatic requirements of 10 CFR 50.34(b)(6)(ii).

6) IEEE Standard 1012-2004, IEEE Standard for Software Verification and Validation (IEEE 2004a); invoked as guidance to meet ESFAS Design Criterion 8.

4 OPERATION AND PERFORMANCE section 7.5.4 discusses the operation of the ESFAS.

ESFAS design basis functions utilize redundant logic to ensure safe and reliable operation to prevent a single failure from defeating the intended function. Additional information related he effects of single failure, reliability, redundancy, and independence can be found in section 7.5.2.

NE Medical Technologies 7.5-34 Rev. 3

le 7.5-1 identifies specific variables that provide input into the ESFAS and includes the rument range for covering normal and accident conditions, the accuracy for each variable, the lytical limit, and response time. A discussion of each variable (signal input) and the system ponse is provided in this section.

4.1.1 High RVZ1/2 RCA Exhaust Radiation high RVZ1/2 RCA exhaust radiation signal protects against confinement leakage or idents that could potentially result in excess radiation doses to the workers or to the public bsection 13b.1.2.3, Scenarios 8, 10, 11, 12, and 16). The signal is generated by ESFAS n an RVZ1/2 RCA exhaust radiation input exceeds the high level setpoint. The RZV1/2 RCA aust radiation is measured by an analog interface on three different channels in RVZ1 and e different channels in RVZ2, one channel of each type for each division of ESFAS. When

-out-of-three or more high RVZ1 or two-out-of-three or more high RVZ2 RCA exhaust ation channels are active, then an RCA Isolation is initiated.

4.1.2 High RVZ1 Supercell Radiation (PVVS Cell) high RVZ1 supercell radiation signal protects against hot cell equipment leakage or an ident that could potentially result in excess radiation doses to the workers or to the public. The al is used to indicate potential radioactivity releases in the PVVS cell similar to those cribed in Chapter 13 for RPF critical equipment malfunction events (Subsection 13b.1.2.3).

signal is generated by ESFAS when a PVVS cell radiation input exceeds the high level oint. The RVZ1 supercell radiation is measured by an analog interface on three different nnels, one for each division of ESFAS. When two-out-of-three or more high RVZ1 supercell ation channels are active, then a Supercell Isolation for that area and VTS Safety Actuation initiated.

4.1.3 High RVZ1 Supercell Radiation (MEPS Extraction Cells) high RVZ1 supercell radiation signal protects against hot cell equipment leakage or an ident that could potentially result in excess radiation doses to the workers or to the public bsection 13b.1.2.3, Scenarios 1, 2, 3, and 13). The signal is generated by ESFAS when a PS extraction cell radiation input exceeds the high level setpoint. The RVZ1 supercell ation is measured by an analog interface on two different channels, one for each Division A Division B of ESFAS. When one-out-of-two or more high RVZ1 supercell radiation channels active, then a Supercell Isolation for that area, MEPS [

]PROP/ECI Isolation, and VTS Safety Actuation are initiated.

4.1.4 High RVZ1 Supercell Radiation (IXP Extraction Cell) high RVZ1 supercell radiation signal protects against hot cell equipment leakage or an ident that could potentially result in excess radiation doses to the workers or to the public bsection 13b.1.2.3, Scenarios 4, 5, 6, and 7). The signal is generated by ESFAS when an IXP action cell radiation input exceeds the high level setpoint. The RVZ1 supercell radiation is asured by an analog interface on two different channels, one for each Division A and sion B of ESFAS. When one-out-of-two or more high RVZ1 supercell radiation channels are ve, then a Supercell Isolation for that area and VTS Safety Actuation are initiated.

NE Medical Technologies 7.5-35 Rev. 3

high RVZ1 supercell radiation signal protects against hot cell equipment leakage or an ident that could potentially result in excess radiation doses to the workers or to the public The al is used to indicate potential radioactivity releases in the purification or packaging cells ilar to those described in Chapter 13 for RPF critical equipment malfunction events bsection 13b.1.2.3). The signal is generated by ESFAS when a purification or packaging cell ation input exceeds the high level setpoint. The RVZ1 supercell radiation is measured by an log interface on two different channels, one for each Division A and Division B of ESFAS.

en one-out-of-two or more high RVZ1 supercell radiation channels are active, then a ercell Isolation for that area is initiated.

4.1.6 High MEPS [ ]PROP/ECI Conductivity high MEPS [ ]PROP/ECI conductivity signal protects against leakage of high ation solutions into the [ ]PROP/ECI, which is partially located outside the ercell shielding and could potentially result in an excess dose to the workers bsection 13b.1.2.3, Scenario 14). The signal is generated by ESFAS when a MEPS

]PROP/ECI conductivity input exceeds the high level setpoint. The MEPS

]PROP/ECI conductivity is measured by an analog interface on two different channels, for each Division A and Division B of ESFAS. MEPS [ ]PROP/ECI conductivity is asured in three locations (MEPS A, B, and C). When one-out-of-two or more high MEPS

]PROP/ECI conductivity channels are active in a given [ ]PROP/ECI (A, B, or then a MEPS [ ]PROP/ECI Isolation is initiated for that [ ]PROP/ECI.

4.1.7 High PVVS Carbon Delay Bed Exhaust Carbon Monoxide high PVVS carbon delay bed exhaust carbon monoxide signal protects against a fire in the VS delay bed (Subsection 13b.1.2.5, Scenario 1). The signal is generated by ESFAS for the ociated carbon delay bed group (Group 1, 2, or 3) when a carbon delay bed exhaust carbon noxide input exceeds the high level setpoint. The PVVS carbon delay bed exhaust carbon noxide is measured with an analog interface on two different channels, one for each sion A and Division B of ESFAS. When one-out-of-two or more high PVVS carbon delay bed aust carbon monoxide channels are active, then a Carbon Delay Bed Isolation for the cted group is initiated.

4.1.8 VTS Vacuum Header Liquid Detection Switch VTS vacuum header liquid detection switch signal protects against an overflow of the uum lift tanks to prevent a potential criticality event as described in Subsection 6b.3.2.5. The vacuum header liquid detection switch signal is received by the ESFAS as a discrete input a liquid detection switch on two different channels, one for each Division A and Division B of FAS. When one-out-of-two or more (Division A and Division B) VTS vacuum header liquid ection switch signals are active, then a VTS Safety Actuation is initiated.

4.1.9 RDS Liquid Detection Switch RDS liquid detection switch signal detects leakage or overflow from other tanks and piping bsection 13b.1.2.3, Scenarios 8, 10, 11, 12, and 16). The RDS liquid detection switch signal NE Medical Technologies 7.5-36 Rev. 3

id detection switch signal channels are active, then a VTS Safety Actuation is initiated.

4.1.10 High TPS IU Cell 1/2/3/4/5/6/7/8 Target Chamber Exhaust Pressure high TPS IU Cell 1/2/3/4/5/6/7/8 target chamber exhaust pressure signal protects against a ak in the tritium exhaust lines in the IU cell (Subsection 13a2.1.6.2, Scenario 3 and section 13a2.1.12.2, TPS Scenario 3). The signal is generated by ESFAS when a target mber exhaust pressure input exceeds the high level setpoint. The TPS IU Cell 1/2/3/4/5/6/7/8 et chamber exhaust pressure is measured with an analog interface on two different channels, for each Division A and Division B of ESFAS. When one-out-of-two or more TPS IU 1/2/3/4/5/6/7/8 target chamber exhaust pressure inputs exceed the allowable limit, the ropriate TPS Train A/B/C Isolation is initiated.

4.1.11 High TPS IU Cell 1/2/3/4/5/6/7/8 Target Chamber Supply Pressure high TPS IU Cell 1/2/3/4/5/6/7/8 target chamber supply pressure signal protects against a ak in the tritium supply lines in the IU cell (Subsection 13a2.1.6.2, Scenario 3 and section 13a2.1.12.2, TPS Scenario 3). The signal is generated by ESFAS when a target mber supply pressure input exceeds the high level setpoint. The TPS IU Cell 1/2/3/4/5/6/7/8 et chamber supply pressure is measured with an analog interface on two different channels, for each Division A and Division B of ESFAS. When one-out-of-two or more TPS IU 1/2/3/4/5/6/7/8 target chamber supply pressure inputs exceed the allowable limit, the ropriate TPS Train A/B/C Isolation is initiated.

4.1.12 High TPS Exhaust to Facility Stack Tritium high TPS exhaust to facility stack tritium signal protects against a release of tritium from the glovebox pressure control exhaust and VAC/ITS process vent exhaust into the facility tilation systems (Subsection 13a2.1.12.2, TPS Scenario 3 and TPS Scenario 4). The signal is erated by ESFAS when a TPS exhaust to facility stack tritium input exceeds the high level oint. The TPS exhaust to facility stack tritium is measured with an analog interface on three rent channels, one for each division of ESFAS. When two-out-of-three or more high TPS aust to facility stack tritium channels are active, then a TPS Process Vent Actuation is ated.

4.1.13 High TPS Confinement Tritium high TPS confinement tritium signal protects against a release of tritium from TPS ipment into the TPS glovebox (Subsection 13a2.1.12.2, TPS Scenario 1). The signal is erated by ESFAS when a TPS confinement tritium input exceeds the high level setpoint.

re is an independent and separate tritium measurement for each of the three TPS trains. The confinement tritium concentration is measured with an analog interface on two different nnels, one for each Division A and Division B of ESFAS. When one-out-of-two or more high confinement tritium channels are active, then a TPS Train A Isolation, TPS Train B Isolation, PS Train C Isolation is initiated for the respective TPS train.

NE Medical Technologies 7.5-37 Rev. 3

TRPS IU cell nitrogen purge signal protects against a loss of hydrogen mitigation capabilities e irradiation units (Subsection 13a2.1.2.2, Scenario 5 and Subsection 13a2.1.9.2, nario 1). The signal is generated by an affected TRPS subsystem and provided to the FAS when the TRPS initiates an IU Cell Nitrogen Purge, as described in Subsection 7.4.3.1.2.

TRPS IU cell nitrogen purge signal is transmitted as a discrete input from the TRPS on two rent channels, one for each Division A and Division B of ESFAS. When a TRPS IU cell ogen purge signal is active, then an ESFAS IU Cell Nitrogen Purge is initiated.

4.1.15 Low PVVS Flow PVVS flow signal protects against loss of hydrogen mitigation capabilities in the RPF bsection 13a2.1.6.2, Scenario 7). The signal is generated by ESFAS when a PVVS flow input eeds the low level setpoint. The PVVS flow is measured with an analog interface on three rent channels, one for each division of ESFAS. When two-out-of-three or more low PVVS channels are active, then an RPF Nitrogen Purge is initiated.

4.1.16 MEPS Extraction Column Three-Way Valves Misaligned MEPS extraction column three-way valves misalignment signal protects against a alignment of the extraction column upper and lower three-way valves, degrading one of the iers preventing misdirection of chemical reagents or target solution (Subsection 13b.1.2.3, nario 15). The MEPS extraction column upper and lower three-way valve position indication ceived by the ESFAS as a discrete input from redundant position indicating limit switches on different channels, one for each Division A and Division B of ESFAS, for each three-way

e. When two-out-of-two MEPS extraction column upper and lower three-way valve position cations indicate they are energized, then an Extraction Column Alignment Actuation for that a is initiated.

4.1.17 IXP Three-Way Valves Misaligned IXP three-way valves misalignment signal protects against a misalignment of the upper and er three-way valves, degrading one of the barriers preventing misdirection of chemical gents or target solution. The signal is used to detect scenarios similar to a MEPS extraction mn three-way valve misalignment as described in Subsection 13b.1.2.3, Scenario 15.The three-way valve position indication is received by the ESFAS as a discrete input from undant position indicating limit switches on two different channels, one for each Division A Division B of ESFAS, for each three-way valve. When two-out-of-two IXP three-way valve ition indications indicate they are energized, then an IXP Alignment Actuation is initiated.

4.1.18 TSPS Dissolution Tank Level Switch TSPS dissolution tank level switch signal protects against a criticality event due to excess le material in a non-favorable geometry system (Subsection 6b.3.2.4). The TSPS dissolution level switch signal is received by the ESFAS as a discrete input from level switches on two rent channels, one for each Division A and Division B of ESFAS. When one-out-of-two or e TSPS dissolution tank level switch signals are active for either dissolution tank, a solution Tank Isolation is initiated.

NE Medical Technologies 7.5-38 Rev. 3

UPSS loss of external power signal protects against an anticipatory loss of hydrogen gation in the IU cell (i.e., loss of TSV off-gas system [TOGS] blowers and recombiners after UPSS runtime of that equipment has been exceeded), as described in section 13a2.1.9.2, Scenario 1. The UPSS loss of external power signal is received by the FAS as a discrete input signal on two different channels, one for each Division A and sion B of ESFAS. When one-out-of-two or more UPSS loss of external power signals are ve, a timer is started that must run to completion before initiating an IU Cell Nitrogen Purge.

le the timer is running, if fewer than one-out-of-two UPSS loss of external power signals are ve, the timer is reset and the ESFAS continues operating under normal conditions. The timer et at three minutes to provide margin to the loss of TOGS equipment after five minutes of ime on the UPSS. The ESFAS initiated IU Cell Nitrogen Purge signal is provided to each of eight TRPS as an ESFAS loss of external power signal as described in section 7.4.4.1.14.

4.2 Operational Bypass, Permissives, and Interlocks ESFAS has no operational bypasses included in the design, and therefore no interlocks are uired to prevent operator actions from defeating an automatic safety function.

r an ESFAS actuation, the ESFAS system must receive feedback signals from each acted actuated device that each device has indeed reached its fail-safe position. Only then the operator, through deliberate action with the manual enable nonsafety switch, be allowed nable the PICS to reset the components.

4.3 Facility Master Operating Permissive ESFAS incorporates the Facility Master Operating Permissive key switch in the system ign. The key switch has two positions, Operating and Secure (Subsection 7.6.1.1). When the ility Master Operating Permissive key switch is active (operating), the ESFAS operates in the mal, nonsecure mode.

4.4 Maintenance Bypass h SFM can be placed in maintenance bypass or in a trip state by use of the OOS switch ted on the front of the SFM and an associated trip/bypass switch located below the SFM.

ails of the physical configuration and operation of the OOS and trip/bypass switches are vided in Sections 2.5.1 and 2.5.2 of Topical Report TR-1015-18653 (NuScale, 2017). Any FAS channels placed in maintenance bypass for maintenance or testing, or removed from ntenance bypass, will be displayed to the operators in the facility control room through the nitoring and indication bus to the PICS.

ndividual SFM within an ESFAS division is allowed to be placed in maintenance bypass for o two hours while the associated input channel(s) is required to be operable, in accordance the technical specifications, for the purpose of performing required technical specification veillance testing. A time limit of two hours is acceptable based on the small amount of time the nnel could be in bypass, the continual attendance by operations or maintenance personnel ng the test, the continued operability of the redundant channel(s), and the low likelihood that accident would occur during the two-hour time period.

NE Medical Technologies 7.5-39 Rev. 3

preserves the single failure criterion for variables associated with that SFM where three nnels are provided. In cases where only two channels are provided, placing a channel in trip ves to actuate the associated safety function. Inoperable channels are required to be placed ip, or other actions are required to be taken to mitigate the condition, in accordance with the nical specifications.

4.5 Testing Capability ting of the ESFAS consists of the inservice self-testing capabilities of the HIPS platform and odic surveillance testing.

-to-end testing of the entire HIPS platform can be performed through overlap testing.

vidual self-tests in the various components of the ESFAS ensure that the entire component is tioning correctly. Self-test features are provided for components that do not have setpoints or able parameters. ESFAS components, except the discrete APL of the EIM, have self-testing abilities that ensure the information passed on to the following step in the signal path is ect.

discrete logic of the APL of the EIM does not have self-test capability but is instead tionally tested. This functional testing consists of periodic simulated automatic and manual ations to verify the functionality of the APL and the manual actuation pushbuttons.

ting of input devices consists of channel checks, channel tests, and channel calibrations.

nnel checks are performed while the channel is in service. Channel tests and channel brations may be performed while the associated equipment is in a condition where the nnel is required to be operable (i.e., inservice), by placing the associated SFM in ntenance bypass (Subsection 7.5.4.4). Channel tests and channel calibrations may also be ormed when the channel is not required to be operable.

4.6 Technical Specifications and Surveillance iting Conditions for Operation and Surveillance Requirements are established for ESFAS c, voting, and actuation divisions and instrumentation monitored by ESFAS as input to safety ations.

5 HIGHLY INTEGRATED PROTECTION SYSTEM (HIPS) DESIGN ESFAS utilizes a HIPS platform to achieve the desired architecture for ESFAS system trol. The HIPS platform used to support both the TRPS and the ESFAS is described in section 7.4.5. The HIPS design described in Subsection 7.4.5 addresses HIPS design butes, access control and cyber security, software development requirements, and HIPS ormance analysis.

ESFAS HIPS architecture is shown in Figure 7.1-3.

NE Medical Technologies 7.5-40 Rev. 3

safety-related ESFAS is designed to specific and measurable criteria to ensure quality and quacy in the system design, implementation, and maintenance.

ign basis functions ensure safe operation of the facility and prevent or mitigate the sequences of design basis events.

HIPS platform used in the ESFAS design is based on fundamental instrumentation and trol principles of independence, redundancy, predictability and repeatability, and diversity and developed under quality management to provide a simple yet reliable solution for the safety-ted ESFAS functions.

NE Medical Technologies 7.5-41 Rev. 3

Table 7.5 ESFAS Monitored Variables (Sheet 1 of 6)

Variable Analytical Limit Logic Range Accuracy Response Time RVZ1 RCA exhaust radiation 60x background radiation 2/3 10-7 to 10-1 µCi/cc 20 percent 15 seconds RVZ2 RCA exhaust radiation 60x background radiation 2/3 10-7 to 10-1 µCi/cc 20 percent 15 seconds Supercell area 1 60x background radiation 2/3 10-7 to 10-1 µCi/cc 20 percent 15 seconds (PVVS area) radiation Supercell area 2 60x background radiation 1/2 10-7 to 10-1 µCi/cc 20 percent 15 seconds (extraction area A) radiation Supercell area 3 60x background radiation 1/2 10-7 to 10-1 µCi/cc 20 percent 15 seconds (purification area A) radiation Supercell area 4 60x background radiation 1/2 10-7 to 10-1 µCi/cc 20 percent 15 seconds (packaging area 1) radiation Supercell area 5 60x background radiation 1/2 10-7 to 10-1 µCi/cc 20 percent 15 seconds (purification area B) radiation Supercell area 6 60x background radiation 1/2 10-7 to 10-1 µCi/cc 20 percent 15 seconds (extraction area B) radiation Supercell area 7 60x background radiation 1/2 10-7 to 10-1 µCi/cc 20 percent 15 seconds (extraction area C) radiation Supercell area 8 60x background radiation 1/2 10-7 to 10-1 µCi/cc 20 percent 15 seconds (purification area C) radiation Supercell area 9 60x background radiation 1/2 10-7 to 10-1 µCi/cc 20 percent 15 seconds (packaging area 2) radiation Supercell area 10 60x background radiation 1/2 10-7 to 10-1 µCi/cc 20 percent 15 seconds (IXP area) radiation NE Medical Technologies 7.5-42 Rev. 3

Variable Analytical Limit Logic Range Accuracy Response Time MEPS [ ]PROP/ECI 0.2 to 500 500 micromho/cm 1/2 3 percent 5 seconds conductivity extraction area A micromho/cm MEPS [ ]PROP/ECI 0.2 to 500 500 micromho/cm 1/2 3 percent 5 seconds conductivity extraction area B micromho/cm MEPS [ ]PROP/ECI 0.2 to 500 500 micromho/cm 1/2 3 percent 5 seconds conductivity extraction area C micromho/cm Carbon delay bed group 1 50 ppm 1/2 1 to 100 ppm 10 percent 15 seconds exhaust carbon monoxide Carbon delay bed group 2 50 ppm 1/2 1 to 100 ppm 10 percent 15 seconds exhaust carbon monoxide Carbon delay bed group 3 50 ppm 1/2 1 to 100 ppm 10 percent 15 seconds exhaust carbon monoxide VTS vacuum header Discrete Active 1/2 Active/Inactive 5.5 seconds liquid detection switch signal input signal RDS liquid detection Discrete Active 1/2 Active/Inactive 5.5 seconds switch signal input signal TPS exhaust to 1 Ci/m3 2/3 1 to 2,000,000 µCi/m3 10 percent 5 seconds facility stack tritium TPS IU cell 1 target chamber 8 psia 1/2 0 to 19.5 psia 1 percent 10 seconds exhaust pressure TPS IU cell 2 target chamber 8 psia 1/2 0 to 19.5 psia 1 percent 10 seconds exhaust pressure TPS IU cell 3 target chamber 8 psia 1/2 0 to 19.5 psia 1 percent 10 seconds exhaust pressure NE Medical Technologies 7.5-43 Rev. 3

Variable Analytical Limit Logic Range Accuracy Response Time TPS IU cell 4 target chamber 8 psia 1/2 0 to 19.5 psia 1 percent 10 seconds exhaust pressure TPS IU cell 5 target chamber 8 psia 1/2 0 to 19.5 psia 1 percent 10 seconds exhaust pressure TPS IU cell 6 target chamber 8 psia 1/2 0 to 19.5 psia 1 percent 10 seconds exhaust pressure TPS IU cell 7 target chamber 8 psia 1/2 0 to 19.5 psia 1 percent 10 seconds exhaust pressure TPS IU cell 8 target chamber 8 psia 1/2 0 to 19.5 psia 1 percent 10 seconds exhaust pressure S IU cell 1 target chamber supply 8 psia 1/2 0 to 19.5 psia 1 percent 10 seconds pressure S IU cell 2 target chamber supply 8 psia 1/2 0 to 19.5 psia 1 percent 10 seconds pressure S IU cell 3 target chamber supply 8 psia 1/2 0 to 19.5 psia 1 percent 10 seconds pressure S IU cell 4 target chamber supply 8 psia 1/2 0 to 19.5 psia 1 percent 10 seconds pressure S IU cell 5 target chamber supply 8 psia 1/2 0 to 19.5 psia 1 percent 10 seconds pressure S IU cell 6 target chamber supply 8 psia 1/2 0 to 19.5 psia 1 percent 10 seconds pressure NE Medical Technologies 7.5-44 Rev. 3

Variable Analytical Limit Logic Range Accuracy Response Time S IU cell 7 target chamber supply 8 psia 1/2 0 to 19.5 psia 1 percent 10 seconds pressure S IU cell 8 target chamber supply 8 psia 1/2 0 to 19.5 psia 1 percent 10 seconds pressure TPS confinement A tritium 1000 Ci/m3 1/2 0.001 to 50,000 Ci/m3 10 percent 5 seconds TPS confinement B tritium 1000 Ci/m3 1/2 0.001 to 50,000 Ci/m3 10 percent 5 seconds TPS confinement C tritium 1000 Ci/m3 1/2 0.001 to 50,000 Ci/m3 10 percent 5 seconds PVVS flow 5.0 scfm 2/3 1-20 scfm 3 percent 0.5 seconds TSPS dissolution tank 1 Discrete Active 1/2 Active/Inactive 1 second level switch signal input signal TSPS dissolution tank 2 Discrete Active 1/2 Active/Inactive 1 second level switch signal input signal TRPS IU cell 1 Discrete Active 1/1 Active/Inactive 500 ms nitrogen purge signal input signal TRPS IU cell 2 Discrete Active 1/1 Active/Inactive 500 ms nitrogen purge signal input signal TRPS IU cell 3 Discrete Active 1/1 Active/Inactive 500 ms nitrogen purge signal input signal TRPS IU cell 4 Discrete Active 1/1 Active/Inactive 500 ms nitrogen purge signal input signal TRPS IU cell 5 Discrete Active 1/1 Active/Inactive 500 ms nitrogen purge signal input signal TRPS IU cell 6 Discrete Active 1/1 Active/Inactive 500 ms nitrogen purge signal input signal NE Medical Technologies 7.5-45 Rev. 3

Variable Analytical Limit Logic Range Accuracy Response Time TRPS IU cell 7 Discrete Active 1/1 Active/Inactive 500 ms nitrogen purge signal input signal TRPS IU cell 8 Discrete Active 1/1 Active/Inactive 500 ms nitrogen purge signal input signal MEPS area A lower Discrete three-way valve supplying Active 1/2 & 1/2 Active/Inactive 1 second input signal position indication(a)

MEPS area A upper Discrete three-way valve supplying Active 1/2 & 1/2 Active/Inactive 1 second input signal position indication(a)

MEPS area B lower Discrete three-way valve supplying Active 1/2 & 1/2 Active/Inactive 1 second input signal position indication(a)

MEPS area B upper Discrete three-way valve supplying Active 1/2 & 1/2 Active/Inactive 1 second input signal position indication(a)

MEPS area C lower Discrete three-way valve supplying Active 1/2 & 1/2 Active/Inactive 1 second input signal position indication(a)

MEPS area C upper Discrete three-way valve supplying Active 1/2 & 1/2 Active/Inactive 1 second input signal position indication(a)

NE Medical Technologies 7.5-46 Rev. 3

Variable Analytical Limit Logic Range Accuracy Response Time IXP lower three-way valve Discrete Active 1/2 & 1/2 Active/Inactive 1 second supplying position indication(a) input signal IXP upper three-way valve Discrete Active 1/2 & 1/2 Active/Inactive 1 second supplying position indication(a) input signal Discrete UPSS loss of external power Active 1/2 Active/Inactive 1 second input signal A safety actuation is initiated when both the lower and upper three-way valve supplying position indications show one-out-of-two of the redundant indications are active.

NE Medical Technologies 7.5-47 Rev. 3

Table 7.5 Fail Safe Component Positions on ESFAS Loss of Power (Sheet 1 of 2)

FAIL-SAFE POSITION: CLOSED Z1 RCA exhaust isolation dampers RVZ1 supercell area 9 (packaging area 2) outlet isolation dampers Z2 RCA exhaust isolation dampers RVZ2 supercell area 10 (IXP area) inlet isolation dampers Z2 RCA supply isolation dampers RVZ1 supercell area 10 (IXP area) outlet isolation dampers Z3 transfer isolation dampers shipping/receiving IF RVZ2 TPS room supply isolation dampers Z3 transfer isolation dampers shipping/receiving RPF RVZ2 TP S room exhaust isolation dampers Z3 transfer isolation dampers main RCA ingress/egress RLWI PVVS isolation valve Z3 transfer isolation dampers RPF emergency exit MEPS [ ]PROP/ECI A inlet isolation valve Z3 transfer isolation dampers IF emergency exit MEPS [ ]PROP/ECI B inlet isolation valve Z3 transfer isolation dampers mezzanine emergency exit MEPS [ ]PROP/ECI C inlet isolation valve PS air inlet isolative valve MEPS [ ]PROP/ECI A discharge isolation valve PS RVZ1 exhaust valve MEPS [ ]PROP/ECI B discharge isolation valve Z2 supercell area 1 (PVVS area) inlet isolation dampers MEPS [ ]PROP/ECI C discharge isolation valve Z1 supercell area 1 (PVVS area) outlet isolation dampers MEPS A extraction column wash supply valve Z2 supercell area 2 (extraction area A) inlet isolation dampers MEPS A extraction column eluent valve Z1 supercell area 2 (extraction area A) outlet isolation dampers MEPS A [ ]PROP/ECI wash supply valve Z2 supercell area 3 (purification area A) inlet isolation dampers MEPS A [ ]PROP/ECI eluent valve Z1 supercell area 3 (purification area A) outlet isolation dampers MEPS B extraction column wash supply valve Z2 supercell area 4 (packaging area 1) inlet isolation dampers MEPS B extraction column eluent valve Z1 supercell area 4 (packaging area 1) outlet isolation dampers MEPS B [ ]PROP/ECI wash supply valve Z2 supercell area 5 (purification area B) inlet isolation dampers MEPS B [ ]PROP/ECI eluent valve Z1 supercell area 5 (purification area B) outlet isolation dampers MEPS C extraction column wash supply valve Z2 supercell area 6 (extraction area B) inlet isolation dampers MEPS C extraction column eluent valve Z1 supercell area 6 (extraction area B) outlet isolation dampers MEPS C [ ]PROP/ECI wash supply valve Z2 supercell area 7 (extraction area C) inlet isolation dampers MEPS C [ ]PROP/ECI eluent valve Z1 supercell area 7 (extraction area C) outlet isolation dampers IXP recovery column wash supply valve Z2 supercell area 8 (purification area C) inlet isolation dampers IXP recovery column eluent valve Z1 supercell area 8 (purification area C) outlet isolation dampers IXP [ ]PROP/ECI wash supply valve Z2 supercell area 9 (packaging area 2) inlet isolation dampers IXP [ ]PROP/ECI eluent valve NE Medical Technologies 7.5-48 Rev. 3

FNHS supply valve TPS train B vacuum isolation valves liquid nitrogen supply valve TPS train C glovebox pressure control exhaust isolation valve S train A glovebox pressure control exhaust isolation valve TPS train C ITS isolation valves S train A ITS isolation valves TPS train C helium AOV supply valve S train A helium AOV supply valve TPS train C helium SOV supply valve S train A helium SOV supply valve TPS train C vacuum isolation valves S train A vacuum isolation valves N2PS PVVS north header valves S train B glovebox pressure control exhaust isolation valve N2PS PVVS south header valves S train B ITS isolation valves TSPS RPCS supply cooling valves S train B helium AOV supply valve TSPS RPCS return cooling valve S train B helium SOV supply valve FAIL-SAFE POSITION: OPEN Z1 exhaust train 1 blower breakers PVVS blower bypass valves Z1 exhaust train 2 blower breakers PVVS carbon guard bed bypass valves Z2 exhaust train 1 blower breakers PVVS carbon delay bed group 1 outlet isolation valves Z2 exhaust train 2 blower breakers PVVS carbon delay bed group 2 outlet isolation valves Z2 supply train 1 blower breakers PVVS carbon delay bed group 3 outlet isolation valves Z2 supply train 2 blower breakers MEPS A extraction feed pump breakers S vacuum transfer pump 1 breakers MEPS B extraction feed pump breakers S vacuum transfer pump 2 breakers MEPS C extraction feed pump breakers S vacuum break valves N2PS IU cell header valves N2PS RPF header valves FAIL-SAFE POSITION: SUPPLYING VS carbon delay bed group 1 three-way valves VS carbon delay bed group 2 three-way valves VS carbon delay bed group 3 three-way valves FAIL-SAFE POSITION: DISCHARGING PS area A lower three-way valve MEPS area C lower three-way isolation valve PS area A upper three-way valve MEPS area C upper three-way isolation valve PS area B lower three-way valve IXP upper three-way valve PS area B upper three-way valve IXP lower three-way valve NE Medical Technologies 7.5-49 Rev. 3

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)

Chapter 7 - Instrumentation and Control Systems Engineered Safety Features Actuation System Figure 7.5 ESFAS Logic Diagrams (Sheet 1 of 27)

SHINE Medical Technologies 7.5-50 Rev. 3

Chapter 7 - Instrumentation and Control Systems Engineered Safety Features Actuation System Figure 7.5 ESFAS Logic Diagrams (Sheet 2 of 27)

Trip Determination SHINE Medical Technologies 7.5-51 Rev. 3

Chapter 7 - Instrumentation and Control Systems Engineered Safety Features Actuation System Figure 7.5 ESFAS Logic Diagrams (Sheet 3 of 27)

Trip Determination SHINE Medical Technologies 7.5-52 Rev. 3

Chapter 7 - Instrumentation and Control Systems Engineered Safety Features Actuation System Figure 7.5 ESFAS Logic Diagrams (Sheet 4 of 27)

Trip Determination SHINE Medical Technologies 7.5-53 Rev. 3

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)

Chapter 7 - Instrumentation and Control Systems Engineered Safety Features Actuation System Figure 7.5 ESFAS Logic Diagrams (Sheet 5 of 27)

SHINE Medical Technologies 7.5-54 Rev. 3

Chapter 7 - Instrumentation and Control Systems Engineered Safety Features Actuation System Figure 7.5 ESFAS Logic Diagrams (Sheet 6 of 27)

Trip Determination SHINE Medical Technologies 7.5-55 Rev. 3

Chapter 7 - Instrumentation and Control Systems Engineered Safety Features Actuation System Figure 7.5 ESFAS Logic Diagrams (Sheet 7 of 27)

Trip Determination SHINE Medical Technologies 7.5-56 Rev. 3

Chapter 7 - Instrumentation and Control Systems Engineered Safety Features Actuation System Figure 7.5 ESFAS Logic Diagrams (Sheet 8 of 27)

Trip Determination SHINE Medical Technologies 7.5-57 Rev. 3

Chapter 7 - Instrumentation and Control Systems Engineered Safety Features Actuation System Figure 7.5 ESFAS Logic Diagrams (Sheet 9 of 27)

Trip Determination SHINE Medical Technologies 7.5-58 Rev. 3

Chapter 7 - Instrumentation and Control Systems Engineered Safety Features Actuation System Figure 7.5 ESFAS Logic Diagrams (Sheet 10 of 27)

Trip Determination SHINE Medical Technologies 7.5-59 Rev. 3

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)

Chapter 7 - Instrumentation and Control Systems Engineered Safety Features Actuation System Figure 7.5 ESFAS Logic Diagrams (Sheet 11 of 27)

SHINE Medical Technologies 7.5-60 Rev. 3

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)

Engineered Safety Features Chapter 7 - Instrumentation and Control Systems Actuation System Figure 7.5 ESFAS Logic Diagrams (Sheet 12 of 27)

SHINE Medical Technologies 7.5-61 Rev. 3

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)

Chapter 7 - Instrumentation and Control Systems Engineered Safety Features Actuation System Figure 7.5 ESFAS Logic Diagrams (Sheet 13 of 27)

SHINE Medical Technologies 7.5-62 Rev. 3

Chapter 7 - Instrumentation and Control Systems Engineered Safety Features Actuation System Figure 7.5 ESFAS Logic Diagrams (Sheet 14 of 27)

Safety Actuation SHINE Medical Technologies 7.5-63 Rev. 3

Chapter 7 - Instrumentation and Control Systems Engineered Safety Features Actuation System Figure 7.5 ESFAS Logic Diagrams (Sheet 15 of 27)

Safety Actuation SHINE Medical Technologies 7.5-64 Rev. 3

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)

Chapter 7 - Instrumentation and Control Systems Engineered Safety Features Actuation System Figure 7.5 ESFAS Logic Diagrams (Sheet 16 of 27)

SHINE Medical Technologies 7.5-65 Rev. 3

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)

Engineered Safety Features Chapter 7 - Instrumentation and Control Systems Actuation System Figure 7.5 ESFAS Logic Diagrams (Sheet 17 of 27)

SHINE Medical Technologies 7.5-66 Rev. 3

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)

Engineered Safety Features Chapter 7 - Instrumentation and Control Systems Actuation System Figure 7.5 ESFAS Logic Diagrams (Sheet 18 of 27)

SHINE Medical Technologies 7.5-67 Rev. 3

Chapter 7 - Instrumentation and Control Systems Engineered Safety Features Actuation System Figure 7.5 ESFAS Logic Diagrams (Sheet 19 of 27)

Safety Actuation SHINE Medical Technologies 7.5-68 Rev. 3

Engineered Safety Features Chapter 7 - Instrumentation and Control Systems Actuation System Figure 7.5 ESFAS Logic Diagrams (Sheet 20 of 27)

Safety Actuation SHINE Medical Technologies 7.5-69 Rev. 3

Engineered Safety Features Chapter 7 - Instrumentation and Control Systems Actuation System Figure 7.5 ESFAS Logic Diagrams (Sheet 21 of 27)

Nonsafety Interface Decode SHINE Medical Technologies 7.5-70 Rev. 3

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)

Engineered Safety Features Chapter 7 - Instrumentation and Control Systems Actuation System Figure 7.5 ESFAS Logic Diagrams (Sheet 22 of 27)

SHINE Medical Technologies 7.5-71 Rev. 3

Engineered Safety Features Chapter 7 - Instrumentation and Control Systems Actuation System Figure 7.5 ESFAS Logic Diagrams (Sheet 23 of 27)

Priority Logic SHINE Medical Technologies 7.5-72 Rev. 3

Engineered Safety Features Chapter 7 - Instrumentation and Control Systems Actuation System Figure 7.5 ESFAS Logic Diagrams (Sheet 24 of 27)

Priority Logic SHINE Medical Technologies 7.5-73 Rev. 3

Engineered Safety Features Chapter 7 - Instrumentation and Control Systems Actuation System Figure 7.5 ESFAS Logic Diagrams (Sheet 25 of 27)

Priority Logic SHINE Medical Technologies 7.5-74 Rev. 3

Engineered Safety Features Chapter 7 - Instrumentation and Control Systems Actuation System Figure 7.5 ESFAS Logic Diagrams (Sheet 26 of 27)

Priority Logic SHINE Medical Technologies 7.5-75 Rev. 3

Engineered Safety Features Chapter 7 - Instrumentation and Control Systems Actuation System Figure 7.5 ESFAS Logic Diagrams (Sheet 27 of 27)

Legend SHINE Medical Technologies 7.5-76 Rev. 3

SHINE facility control room contains the necessary workstations, displays, and control inets needed for the operation of the main production facility. The facility control room is ted in the non-radiologically controlled area of the main production facility.

hin the facility control room, there is a main control board, two process integrated control tem (PICS) operator workstations, two neutron driver assembly system (NDAS) workstations, a supervisor workstation. The operator workstations consist of display screens and human rface equipment, and the main control board consists of a console, static display screens, manual actuation interfaces. The supervisor workstation is similar to the PICS operator kstations, but is typically used for monitoring purposes only, and is not normally assigned any trol functions. The main control board, PICS operator and supervisor workstations, and ociated control equipment are considered part of the PICS. The PICS provides nonsafety-ted system status and measured process variable values for viewing, recording, and trending e facility control room (Subsection 7.3.3.1). The main control board, PICS and NDAS rator workstations, and supervisor workstation are not credited with performing safety tions and only assist operators in performance of normal operations or diverse actuations to safety systems.

SHINE facility additionally contains local control stations with limited functionality used for orming specific local tasks.

1 DESCRIPTION 1.1 Main Control Board main control board is located on the east wall of the facility control room between the two ances to the room, as shown in Figure 7.6-1. The main control board is approximately 25 feet e and contains eight sections each containing one column of displays dedicated to a single diation unit (IU), and a ninth section containing two columns of displays dedicated to other cesses within the facility. The ninth section, for the facility generally, is located between the th and fifth IU sections.

static display screens, which show the variables important to the safety functions of the IUs other facility processes, are located on the upper half of the main control board, aligned in e rows of displays. The configuration of the main control board, including the location of the ic display screens, is shown in Figure 7.6-2. The static display screens are used by the rator to verify the status of the main production facility. The current mode of operation for h IU is displayed on a static display screen associated with that IU.

nual actuation interfaces (i.e., physical push buttons and switches), which provide diverse ans to actuate automated safety functions, are located in the space directly below the static lay screens at each main control board section, as shown in Figure 7.6-2. In the same area he manual actuation interfaces, there is an enable nonsafety switch (labeled E/D for able/Disable) for each IU section and for the facility process section, which allows operators nable the PICS ability to manipulate equipment that can also be actuated by the target tion vessel (TSV) reactivity protection system (TRPS) or the engineered safety features ation system (ESFAS). Manual actuations are not required to ensure adequate safety of the lity, as described in Chapter 13.

NE Medical Technologies 7.6-1 Rev. 1

1.2 Operator Workstation re are four desks that make up the main operator workstations, centrally located within the lity control room, aligned end-to-end in front of the main control board. The two outermost ks are designated as PICS workstations and the two inner desks are NDAS control stations.

h workstation contains multiple display screens. Configuration of the operator workstations is wn in Figure 7.6-1.

er PICS workstation can display any of the available PICS display screens for monitoring poses. PICS controls are designed such that they can only be manipulated by a single station ny given time to prevent two operators from inputting conflicting commands. While control of h IU or process is normally assigned to a particular workstation, control can also be sferred between workstations for operational flexibility. Control of a process or IU may also ransferred to the supervisor workstation if necessary (e.g., to perform maintenance on an rator workstation, or to accommodate additional workload). A limited set of control functions be transferred to local control stations as described in Subsection 7.6.1.6. Only one kstation (operator, supervisor, or local) is allowed to input control commands to a particular ponent at any time.

of the screens at the PICS workstation is used to display the alarms present in the facility.

screen is designated as monitoring only so that, when an alarm is present, the screen omatically changes the content displayed to the current alarms that are present without rrupting a control process. The remaining screens can be used for control or monitoring as operator tasks demand.

des of operation for the IUs are advanced by the operator at the PICS operator workstation ugh the use of the equipment control screens. Even though the operator has the ability to ance the mode of operation at the workstation, maintaining the current mode of operation is e in the safety-related control systems. If permissive conditions are not met to achieve the t mode of operation, the operator will not be able to move on to the following mode of ration until permissive conditions have been achieved.

two NDAS control stations allow operators to monitor and make adjustments to any of the t neutron drivers in the eight IU cells. The NDAS control stations are only allowed to provide trol signals to the NDAS when a permissive provided by the PICS is satisfied. The NDAS trol stations are used to interface with the vendor provided NDAS control system described in section 4a2.3.4.

1.3 Supervisor Workstation supervisor workstation is located on an elevated platform on the west side of the facility trol room facing the operator workstations and the main control board. The supervisor kstation is similar to the PICS operator workstations, and may be used to control a process or but is normally used for monitoring facility status only. The supervisor station does not have NDAS control capabilities.

NE Medical Technologies 7.6-2 Rev. 1

TRPS/ESFAS maintenance workstations receive diagnostic and indication information from TRPS and the ESFAS. Any module failure or warning is shown at the maintenance kstation and a log of each failure or warning is maintained at the maintenance workstation for

. The maintenance workstation is also used to update setpoints within the safety function dule in the chassis. This update is done through a temporary connection to the monitoring and cation communication module of the associated division, as described in Subsection 7.4.5.

TRPS/ESFAS maintenance workstations are provided in the facility control room.

ntenance workstations are integrated into two of the TRPS cabinets, for use by both TRPS ESFAS. The Division A maintenance workstation is located in a Division A TRPS cabinet, the Division B maintenance workstation is located in a Division B TRPS cabinet. The sion A maintenance workstation can also be used for performing maintenance on Division C inets. The typical arrangement of the maintenance workstation in a TRPS cabinet is shown in ure 7.6-3.

1.5 Other Control Room Interface Equipment SHINE facility control room also contains the following equipment used for monitoring or rfacing with facility systems:

iticality accident alarm system (CAAS) panel is located along the east wall of the control m, north of the main control board. The CAAS panel contains a logical unit for processing ms and is used to monitor the status of the CAAS. The CAAS is described in section 6b.3.3.

e control panel is located along the west wall of the control room, north of the supervisor ion. The fire control panel is used to monitor for facility fire alarms provided by the facility fire ection system. The facility fire protection system is described in Subsection 9a2.3.7.

1.6 Local Control Stations SHINE main production facility contains eight local PICS control stations:

Target solution preparation

Radioactive liquid waste immobilization

Supercell A

Supercell B

Supercell C

Tritium purification system (TPS) Train A

TPS Train B

TPS Train C pecific, limited set of control functions associated with each local control station can be sferred from the control room to the specified local control station with authorization of a trol room supervisor. The local control stations can also be used for monitoring only for PICS lays not associated with the function of the local control station. The local control stations h contain display and human system interface capabilities.

NE Medical Technologies 7.6-3 Rev. 1

SHINE facility additionally contains local control stations for vendor provided nonsafety-ted control systems. The vendor provided nonsafety-related control systems are further cribed in Subsection 7.3.2.

building automation system contains two control stations, one located in the resource ding and the other located in the main production facility mezzanine. The control stations are d for periodic adjustments and maintenance on systems served by the building automation tem and is not used for normal operation.

supercell contains an operator interface for the supercell control system used for controlling cell functions.

radioactive liquid waste immobilization (RLWI) system contains an operator interface for the WI control system for controlling RLWI equipment functions.

ortable NDAS local control station is provided for controlling one NDAS unit at a time during ntenance and commissioning. The station performs the same functions as the control room AS control station, but is not normally connected to an NDAS unit, and is not used for normal ration. The NDAS local control station is also used for controlling an NDAS unit located in the AS service cell.

2 DESIGN CRITERIA re are no SHINE facility design criteria that are uniquely applicable to the control console and lay instruments (other than criteria 1-8 identified in Section 3.1, Tables 3.1-1 and 3.1-2, ch are generically applicable to the facility as a whole). The system design criteria applicable he control console and display instruments are addressed in this section.

2.1 SHINE Facility Design Criteria re are no SHINE facility design criteria that are uniquely applicable to the control console and lay instruments.

2.2 System Design Criteria 2.2.1 Access Control PICS Criterion 10 - The operator workstation and main control board design shall incorporate design or administrative controls to prevent or limit unauthorized physical and electronic access to critical digital assets (CDAs) during the operational phase, including the transition from development to operations. CDAs are defined as digital systems and devices that are used to perform or support, among other things, physical security and access control, safety-related functions, and reactivity control.

sical access to the control room and access to the equipment within is controlled as cribed in Subsection 7.6.3.4. The PICS does not allow remote access and includes the NE Medical Technologies 7.6-4 Rev. 1

2.2.2 Software Requirements Development PICS Criterion 11 - A structured process, which is commensurate with the risk associated with its failure or malfunction and the potential for the failures challenging safety systems, shall be used in developing software for the operator workstations and the main control board.

development of software for the PICS, which includes the PICS operator workstations and main control board, follows a structured process as described in Subsection 7.3.3.4. The elopment of software for the NDAS workstation follows the structured process described in section 7.3.3.4.

PICS Criterion 12 - The operator workstation and main control board development lifecycle phase-specific security requirements shall be commensurate with the risk and magnitude of the harm that would result from unauthorized and inappropriate access, use, disclosure, disruption, or destruction of the operator workstation and main control board and display instruments.

security requirements imposed on the PICS, which includes the PICS operator workstations the main control board, are described in Subsection 7.3.3.5. Security requirements imposed ng the development of NDAS controls are also described in Subsection 7.3.3.5.

PICS Criterion 13 - The operator workstation and main control board software development lifecycle process requirements shall be described and documented in appropriate plans which shall address verification and validation (V&V) and configuration control activities.

PICS software, including the operator workstation and main control board software, is eloped in accordance with the PICS validation master plan, which addresses V&V and figuration control activities, as described in Subsection 7.3.3.4.

PICS Criterion 14 - The operator workstation and main control board configuration control program shall assure that the required hardware and software are installed in the appropriate system configuration and ensure that the correct version of the software/firmware is installed in the correct hardware components.

PICS validation master plan assures that the required PICS hardware and software are alled in the appropriate system configuration and ensures that the correct version of the dware/firmware is installed in the correct hardware components as described in section 7.3.3.4. Configuration control of the NDAS control system is also described in section 7.3.3.4.

2.2.3 General I&C Requirements PICS Criterion 15 - The main control board shall be functional, accessible within the time constraints of operator responses, and available during operating conditions to confirm safety system status.

NE Medical Technologies 7.6-5 Rev. 1

PICS Criterion 16 - Loss of power, power surges, power interruption, and any other credible event to the operator workstations shall not result in spurious actuation or stoppage of any system displaying variables important to the safe operation of the safety systems.

s of power, power surges, or power interruption to the operator workstations does not result change of position of any controlled components nor does it result in the loss of displaying uired parameters from TRPS (Table 7.4-1) or ESFAS (Table 7.5-1) on the main control board.

PICS Criterion 17 - Displays of variables important to the safe operation of the SHINE facility that the operator shall monitor to keep variables within a limiting value, and those that can affect reactivity of the target solution vessel, shall be readily accessible and understandable to the operator.

ameters required to be displayed per TRPS (Table 7.4-1) and ESFAS (Table 7.5-1) are layed on the main control board and are accessible from the operator and supervisor kstations. Display and control functions are further described in Subsection 7.6.3.1.

2.2.4 Independence PICS Criterion 18 - Operator workstations and the main control board, where associated with both safety and nonsafety functions, shall not impede execution of the safety function.

PICS outputs to TRPS and ESFAS will not impede on the ability of the safety systems to cute their safety functions due to the prioritization of safety signals in the TRPS and ESFAS bsections 7.4.3.12 and 7.5.3.11) and the use of the enable nonsafety switch bsections 7.4.3.3 and 7.5.3.2).

PICS Criterion 19 - The operator workstations and main control board data that is transmitted to remote displays shall be protected by one-way communication through the use of hardware devices to a processor that is protected by a firewall.

PICS communication to displays external to the PICS is controlled through one-way data es such that no communication outside of the PICS can have an impact on the operation of PICS (Subsection 7.6.4.5) 2.2.5 Fail Safe PICS Criterion 20 - The operator workstations and main control board shall be designed to assume a safe state on loss of electrical power or exposure to adverse environments.

s of power to the operator workstations or main control board does not result in a change of ition for any controlled components. The control room is not an adverse environment and is ntained at an acceptable temperature for continued equipment operation for at least two rs following a loss of ventilation (Subsection 7.6.3.2).

NE Medical Technologies 7.6-6 Rev. 1

of normal electrical power.

al batteries are provided for PICS servers, the operator workstations, and the main control rd such that the PICS continues to operate for at least 10 minutes after a loss of external er. The standby generator system (SGS) provides backup power to the PICS if normal power terrupted (Subsection 7.6.3.5).

2.2.6 Surveillance PICS Criterion 22 - The operator workstations and main control board shall be readily testable.

operator workstations and main control board are part of the PICS. In-service self-testing abilities of the PICS are described in Subsection 7.6.4.5.

2.2.7 Human Factors PICS Criterion 23 - Human factors shall be considered at the initial stages and throughout the operator workstation and main control board design process to ensure that the outputs and display devices showing irradiation unit and process facility status are readily observable by the operator while the operator is positioned at the controls and manual actuation switches.

design of the facility control room, display screens, and operator interfaces incorporates an factors engineering principles (Subsection 7.1.5). Displays that an operator may use to orm a task are placed such that they are visible from the operator workstation, with the lays most frequently used being placed closest to the operator. The supervisor workstation is ed and arranged so that the supervisor has a visual of both operator workstations, the lays that the operators are working from, and the main control board (Subsection 7.6.3.3).

2.2.8 Annunciators PICS Criterion 24 - Alarms and annunciators shall clearly show the status of the operating systems, interlocks, engineered safety feature initiations, confinement status, and radiation fields and concentration.

m indication is provided on both the operator workstations and the main control board as cribed in Subsection 7.6.4.2. The types of alarms provided, including the status of operating tems, interlocks, engineered safety feature initiations, confinement status, and radiation fields concentration, are described in Subsection 7.3.2.

PICS Criterion 25 - Hardware and software failures shall be assessed in reliability analyses of the annunciators used to support normal and emergency operations.

annunciators are integral to the PICS and are not designed as a separate system.

rational qualification testing of the PICS is performed as described in Subsection 7.3.3.4.

dware testing of the PICS is performed as described in Subsection 7.3.4.2.

NE Medical Technologies 7.6-7 Rev. 1

PICS Criterion 26 - Controls over the design, fabrication, installation, and modification of the operator workstations and main control board shall conform to commercial quality standards following accepted engineering and industrial practices..

PICS operator workstations and main control board are part of the PICS and are designed, icated, and installed in accordance with the PICS validation master plan, which includes visions for operational qualification testing as described in Subsection 7.3.3.4. The NDAS trol stations are designed, fabricated, and installed in accordance with vendor procedures roved by SHINE. During facility operation, modifications to either the PICS or NDAS controls controlled in accordance with SHINE work control processes.

3 DESIGN BASIS 3.1 Display and Control Functions h IU-specific set of static display screens on the main control board indicates variables ortant for verifying proper operation of safety systems following automatic actuation of the PS. The facility process set of static display screens indicates variables important for verifying per operation of safety systems used in other facility systems following automatic actuation of ESFAS. Each set of static display screens on the main control board is used to support an rator in performing manual actuation of a safety function. Manual actuations are performed the main control board, where the static display screens are visible from the manual ation push buttons.

PICS operator workstations have multiple equipment control display screens available to port normal control functions and provide indication of alarms. The PICS display screens e the capability of providing at least 30 minutes of data trending from instrumentation ables obtained from the ESFAS, TRPS, and those variables associated with identifying a ach of the primary system boundary or determining and assessing the magnitude of oactive material release to assist operators actions. Operator interaction with the equipment trol display screens is through a keyboard and mouse interface.

supervisor workstation provides displays so that the supervisor can select and monitor the ropriate screen applicable to the current tasks being performed by the operator. Control of ct processes or IUs may be transferred to the supervisor workstation at the discretion of the trol room supervisor.

NDAS control stations display variables associated with the neutron drivers located in each The NDAS interface is used by operators to monitor and make adjustments to the neutron ers in the eight IU cells. Each NDAS control station has the ability to monitor and control any he eight neutron drivers, but the NDAS control station is only allowed to provide control als to an NDAS unit when a permissive provided by the PICS is satisfied. The NDAS control ion permissive is enabled or disabled using the PICS operator (or supervisor) workstation.

ectively enabling this control permissive is used to prevent both NDAS control stations from viding conflicting commands to a single NDAS unit.

NE Medical Technologies 7.6-8 Rev. 1

operator workstations and the main control board are designed to operate in the normal ironmental conditions of the facility control room, presented in Table 7.2-2. The main control rd equipment is designed to operate in the transient environmental conditions listed in le 7.2-2 for a minimum of two hours after initiation of a protective action resulting from a ign basis event.

he event of a loss of ventilation to the facility control room, the environment within the facility trol room is calculated to remain below 120ºF after two hours. This result is based on the wing assumptions:

Initial facility control room temperature: 75ºF

Outdoor air temperature: 102.6ºF

Facility control room occupancy: 10

Facility control room equipment load: 29 kW resultant temperature is within the temperature indicated in Table 7.2-2 for at least two rs, which is sufficient time to ensure that safety-related equipment is able to perform its safety ction if required. Therefore, no safety-related ventilation or cooling systems are required to ure the safety-related I&C systems located in the control room can continue to perform their ty function as required.

3.3 Human Factors design of the facility control room, display screens, and operator interfaces incorporates an factors engineering principles. The layout of screens presenting the same set of rmation at multiple locations is identical for each (i.e., PICS operator workstation, supervisor kstation, local control station, or main control board). The displays and controls are generally uped by system to aid the operator in the recognition and operation of the controls.

supervisor workstation is placed and arranged so that the supervisor has a visual of both rator workstations, the displays that the operators are working from, and the main control rd. Operator workstations are oriented such that the main control board static display screens directly in front of the operator workstation.

manual actuation push buttons are located directly below the static display screens so that operator can be directly monitoring the variables important to the safe operation of the facility n the manual actuation is performed. The use of selector switch and push buttons in the e product line ensures consistency in look and function. These push buttons also include a itive position indication and a protective guard to prevent inadvertent actuation.

3.4 Access Control ess is administratively controlled to both the facility control room and the facility control tems. The facility control room is located within the main production facility, and personnel ess to the control room and the main production facility is controlled in accordance with lity procedures. The PICS does not allow remote access and does not use any wireless rface capabilities for control functions, as described in Subsection 7.3.3.5. Access control for ty-related control systems is described in Subsection 7.4.4.1.3.

NE Medical Technologies 7.6-9 Rev. 1

horized via PICS permissions by a control room supervisor to prevent unauthorized use.

usage of portable storage devices or other personal electronic equipment is controlled by lity procedures.

3.5 Loss of External Power al batteries are provided for PICS servers, the operator workstations, and the main control rd such that the PICS continues to operate for at least 10 minutes after a loss of external er. The SGS provides backup power to the PICS if normal power is interrupted.

4 OPERATION AND PERFORMANCE 4.1 Displays plays of information related to the operation of the main production facility are available to the rator on the workstations and the main control board. The displays at each of the operator kstations, supervisor workstation, and main control board are digital displays. Displays are gramed such that the range of the displayed information includes the expected range of ation of the monitored variable.

h of the variables listed in Table 7.4-1 and Table 7.5-1 is continuously displayed on the static lays of the main control board. The position indication of actuation components identified in tions 7.4 and 7.5 is also available on the static display screens.

iables available to the PICS, including the variables from Table 7.4-1 and Table 7.5-1, are ilable for display on the various PICS displays at the operator workstations and supervisor kstation.

play of interlock and bypass status is available on each of the PICS displays of the equipment trol display screens for the equipment or instrument channel that has been bypassed.

assed channels for the safety systems are also visible on the maintenance workstation.

uded in displayed variables at the PICS operator workstation displays, the following variables ociated with a breach of the primary system boundary are uniquely identified:

TSV level

TSV dump tank level o included in displayed variables at the PICS operator workstation displays, the following ables used in determining and assessing the magnitude of radioactive material release are vided for display at the operator workstations:

Stack release monitor emissions

Carbon delay bed effluent monitor emissions

Radiological ventilation zone 1 (RVZ1) radiologically control area (RCA) exhaust radiation detectors emissions

Radiological ventilation zone 2 (RVZ2) RCA exhaust radiation detectors emissions NE Medical Technologies 7.6-10 Rev. 1

nitoring information is available on demand at the operator workstations.

play values on each PICS display screen are automatically updated as more current data omes available. Each PICS display screen presented on the operator workstation has a title eader and unique identification to distinguish each display page.

maintenance workstation provides diagnostic information received from the ESFAS and PS on system status to be used as a test interface.

ited function local displays, including radiation monitoring information, are also provided in irradiation facility (IF) and radioisotope production facility (RPF) at select locations bsection 7.6.1.6).

4.2 Alarms ms are integrated into the PICS display systems. The operator workstations provide detailed al alarms to the operator to represent unfavorable status of the facility systems. Indications at operator workstation are provided as visual feedback as well as visual features to indicate systems are operating properly. Indication of alarms present is also provided for each IU and he facility process systems at the main control board. Alarms are provided to inform the rator of off-normal operating system status, interlocks, engineered safety feature initiations, finement status, and radiation fields and concentration. Alarms for facility systems are further cribed in Subsection 7.3.2.

4.3 Controls nual controls are provided on both of the PICS operator workstations, via input to the PICS, on the main control board.

nual controls for the safety-related TRPS and ESAFS protective functions are located at the n control board. Nonsafety manual push buttons that provide a diverse actuation to the omatically generated safety actuations are located directly below the static display screens for associated IU or for the facility process section. A safety-related enable nonsafety switch is ted in each main control board section next to the manual push buttons to allow the operator ontrol actuation components or to reset the safety-related control systems using the PICS wing the actuation of a protective function. The enable nonsafety switch is a three-position rn-to-center switch with states for Enable, Disable, and the return-to-center operating as-is

e. To provide the operators the ability to place the facility into the Facility Secure state, a le manual key switch is located at the facility process section of the main control board below static display screens. The switch has two positions of operation, Secured and Operating.

nual actuation inputs from the main control board are connected downstream of the safety-ted control system programmable logic functions as described in Subsection 7.4.5.2.4.

trols for normal operation are provided at the operator workstations. Multiple equipment trol displays are set up at each operator workstation for operators to select the PICS (or AS) display screen that coincides with the task that the operator is currently performing.

rface with the equipment control displays is through a keyboard and mouse provided for each NE Medical Technologies 7.6-11 Rev. 1

rator workstation is normally assigned a specific set of IUs or processes for which the PICS lays provide control functions. The supervisor workstation is not normally assigned control tions, and the local PICS control stations are only assigned limited control functions when roved by a control room supervisor. For PICS display screens where the station has not been igned a control function, the PICS displays provide monitoring capabilities only. Limiting trol capabilities for each IU or facility system or process to a single workstation at a given time vent two operators from entering conflicting commands to a single component or process. On ilure of one PICS operator workstation, control functions assigned to that station can be sferred to the remaining PICS operator workstation or the supervisor workstation.

NDAS control stations can each provide control of any of the eight neutron drivers, but each AS control station can only provide control commands to one neutron driver at any given time.

4.4 Information Retrieval variables monitored by each of the safety systems, radiation monitoring systems, and the S are recorded into a data historian. The PICS obtains the information that is to be recorded provides that information to the facility data and communication system (FDCS) where the a historian is located. The data historian provides the ability to retrieve post-event data ing. Through the use of the information provided to the FDCS, off-site monitoring is provided.

rmation from the FDCS historian is able to be retrieved by operations personnel in the facility trol room on demand.

4.5 Reliability al batteries are provided for PICS servers, the operator workstations, and the main control rd to ensure the PICS continues to operate for at least 10 minutes after a loss of external er event and the SGS provides backup power to the PICS if normal power is interrupted bsection 7.6.3.5).

play screens in the facility control room are industrial flat panel displays to ensure compliance electromagnetic compatibility requirements in an industrial setting.

nsmission of information between systems is through unidirectional data transfers. Each of safety system communications to the nonsafety PICS system is through one-way data munications from the safety systems to the nonsafety system. There are no unidirectional munications that allow the nonsafety system to communicate back to the safety systems venting the ability to propagate a failure from the nonsafety control system displays to the ty control systems. The PICS communication to the FDCS is through a one-way data diode h that no communication from outside of the PICS (other than the inputs from the safety-ted control systems) can have an impact on the operation of the PICS. Communications of indication and diagnostic information of the TRPS and ESFAS to the maintenance kstation are through a unidirectional point-to-point communication bus so that the ntenance workstation does not have an effect on the TRPS or ESFAS.

ilure in the display systems results in distinct display changes, which directly indicate that icted plant conditions are invalid.

NE Medical Technologies 7.6-12 Rev. 1

ions of the PICS displays.

PICS has in-service self-testing capabilities such that the system will alarm if individual ts or an entire rack or cabinet loses communications or faults.

4.6 Technical Specifications and Surveillance tain material in this section provides information that is used in the technical specifications.

includes limiting conditions for operation, setpoints, design features, and means for omplishing surveillances. In addition, significant material is also applicable to, and may be renced in, the bases that are described in the technical specifications.

5 CONCLUSION SHINE facility control room is located in the non-radiologically controlled area of the main duction facility and contains the necessary workstations, displays, and control cabinets ded for the operation of the main production facility. The main control board, PICS operator supervisor workstations, and associated control cabinets are considered part of the PICS.

part of the PICS, the main control board, operator workstations, and supervisor workstation not credited with performing safety functions and only assist operators in performance of mal operations or diverse actuations to the safety systems. The PICS interfaces with the ty-related TRPS, ESFAS, NFDS, and safety-related radiation monitors to provide nonsafety-ted system status and measured process variable values for viewing, recording, and ding.

trol interfaces are also provided both in the control room and locally in the SHINE facility for er vendor provided nonsafety-related control systems that interface with the PICS.

control console and display instruments are designed for functionality and high reliability.

control console and display instruments are designed for the normal environment and for cified time intervals following a design basis event or loss of ventilation. No safety-related tilation or cooling systems are required for the facility control room.

NE Medical Technologies 7.6-13 Rev. 1

NE Medical Technologies 7.6-14 Rev. 1 Main Control Board Main Control Board IU Section Facility Status Section Static Display Static Display Static Display Screen Screen Screen Static Display Static Display Static Display Screen Screen Screen Static Display Static Display Static Display Screen Screen Screen E D O S E D NE Medical Technologies 7.6-15 Rev. 1

MI CM TRPS SFMs SVMs EIMs IU Cell 1 MWS MI CM TRPS SFMs SVMs EIMs IU Cell 2 NE Medical Technologies 7.6-16 Rev. 1

section describes systems and components that perform radiation monitoring functions in the SHINE facility. Radiation monitoring systems and components include:

safety-related process radiation monitors included as part of the engineered safety features actuation system (ESFAS), target solution vessel (TSV) reactivity protection system (TRPS), and tritium purification system (TPS);

nonsafety-related process radiation monitors included as part of other facility processes;

area radiation monitoring consisting of the radiation area monitoring system (RAMS);

continuous air monitoring consisting of the continuous air monitoring system (CAMS);

and

effluent monitoring consisting of the stack release monitoring system (SRMS).

objective of the radiation monitoring systems is to:

provide facility control room personnel with a continuous record and indication of radiation levels at selected locations within processes and within the facility;

provide local radiation information and alarms for personnel within the facility;

provide input to safety-related control systems to actuate safety systems; and

provide the ability to monitor radioactive releases to the environment.

agram showing how the facility radiation monitoring systems relate to the overall facility rumentation and control (I&C) architecture is provided as Figure 7.1-1.

1 SAFETY-RELATED PROCESS RADIATION MONITORING 1.1 System Description ety-related process radiation monitors provide input to the safety-related ESFAS or TRPS trol systems. These components monitor for either fission products (via beta detection) or

m. Beta detection radiation monitors are part of the ESFAS or TRPS. The type of safety-ted process radiation monitor (fission product or tritium) is selected based on the location and tity of the radioactive material present. The ESFAS and TRPS process radiation monitors a detection) are intended to detect abnormal situations within the facility ventilation systems provide actuation signals to the ESFAS controls. Safety-related tritium monitors are part of TPS. The TPS monitors are installed within various portions of the TPS to detect potential m releases, provide actuation signals to the ESFAS controls, and provide interlock inputs to TRPS controls. Information from safety-related process radiation monitors is displayed in the lity control room on the operator workstations (via the process integrated control system S]).

st of safety-related process radiation monitors is provided in Table 7.7-1.

ic diagrams depicting how the safety-related process radiation monitors provide inputs to PS and ESFAS are provided in Figure 7.4-1 and Figure 7.5-1, respectively.

NE Medical Technologies 7.7-1 Rev. 2

SHINE facility design criteria applicable to the safety-related process radiation monitors are ressed in this section. SHINE facility design criteria 13 and 38 apply to the safety related ation monitors.

1.2.1 Instrumentation and Controls SHINE Design Criterion 13 - Instrumentation is provided to monitor variables and systems over their anticipated ranges for normal operation, for anticipated transients, and for postulated accidents as appropriate to ensure adequate safety, including those variables and systems that can affect the fission process, the integrity of the primary system boundary, the primary confinement and its associated systems, and the process confinement boundary and its associated systems. Appropriate controls are provided to maintain these variables and systems within prescribed operating ranges.

ety-related radiation monitoring channels produce a full-scale reading when subject to ation fields higher than the full-scale reading; however, they are expected to remain on-scale ng accident conditions. The safety-related process radiation monitors that provide actuation als are designed to function in the range necessary to detect accident conditions and provide ty-related inputs to the ESFAS and TRPS control systems (Subsection 7.7.1.3.1). Setpoints selected based on analytical limits and calculated to account for known uncertainties in ordance with the setpoint determination methodology and the monitors are periodically ctionally tested and maintained (Subsection 7.7.1.4.3).

1.2.2 Monitoring Radioactivity Releases SHINE Design Criterion 38 - Means are provided for monitoring the primary confinement boundary, hot cell, and glovebox atmospheres to detect potential leakage of gaseous or other airborne radioactive material. Potential effluent discharge paths and the plant environs are monitored for radioactivity that may be released from normal operations, including anticipated transients, and from postulated accidents.

safety-related process radiation monitors provide radiation monitoring for the primary finement boundary, hot cell, and glovebox atmospheres and monitor effluent release paths bsection 7.7.1.4.1). The monitors are designed to operate during normal conditions, cipated transients and design basis accidents (Subsection 7.7.1.4).

1.3 Design Bases 1.3.1 Design Bases Functions safety functions of the process radiation monitors are: (1) to detect radioactivity in excess of mal levels and provide an actuation signal to the ESFAS or TRPS controls, or (2) to provide t to TRPS for interlocking the operation of the neutron driver. Additional discussion of TRPS ESFAS functions, interlocks, and bypasses is provided in Section 7.4 and Section 7.5, pectively.

h location that requires process radiation monitoring as determined by the safety analysis is ipped with safety-related process radiation monitors. The specified minimum number of NE Medical Technologies 7.7-2 Rev. 2

cess radiation monitors are selected for compatibility with the normal and postulated accident ironmental and radiological conditions.

st of safety-related process radiation monitors, specifying the monitored location, number of sing channels provided, and operability requirements, is provided in Table 7.7-1.

variables to be monitored and their ranges, accuracies, setpoints, and response times of ty-related process radiation monitors are provided in Table 7.4-1 and Table 7.5-1. Instrument uracies are appropriate for the associated setpoints. Signal processing time for the ESFAS TRPS is provided in Subsection 7.4.5.2.3.

ety-related radiation monitoring channels produce a full-scale reading when subject to ation fields higher than the full-scale reading, however, they are expected to remain on-scale ng accident conditions. The safety-related process radiation monitors that provide actuation als are designed to function in the range necessary to detect accident conditions and provide ty-related inputs to the ESFAS and TRPS control systems. For defense-in-depth, the ologically controlled area (RCA) exhaust, general area direct radiation levels, and general a airborne particulates are monitored by stack release, radiation area, and continuous area nitors, respectively.

1.3.2 Operating Conditions ing normal operation, the process radiation monitors are designed to operate in the normal ironmental conditions (temperature, pressure, relative humidity) identified in Tables 7.2-2 ugh 7.2-5 for an expected 20-year lifetime of the equipment.

monitors are designed to operate in the transient conditions identified in Tables 7.2-1 ugh 7.2-5 until the associated protective function has continued to completion.

1.3.3 Single Failure east two process radiation monitors are provided for each protection function input parameter, h providing input to the associated division of the safety-related control system. Redundancy onitors ensures that a failure of one monitor will not prevent the control system from orming its safety function.

Channel A process radiation monitors receive power from Division A of the uninterruptible er supply system (UPSS), and Channel B monitors receive power from UPSS Division B.

nnel C monitors, when provided, receive auctioneered power from both UPSS Division A B.

refore, no single failure of a detector, control division, or power division will prevent the ty-related control system from performing its safety function.

NE Medical Technologies 7.7-3 Rev. 2

ety-related process radiation monitors provide analog communication to the ESFAS and PS controls. Channel communication independence is maintained by implementing separate dwired connections to the separate ESFAS or TRPS controls divisions.

iation monitoring data provided to nonsafety control systems is through one-way isolated puts.

ety-related process radiation monitors from separate divisions are physically separated from h other and independently powered from the associated UPSS division.

1.3.5 Redundancy h location that requires engineered safety features to actuate in response to radiation levels, etermined by the safety analysis, is provided with at least two independent safety-related cess radiation monitors, designated as Channels A and B. For locations where spurious ation of a process radiation monitor could significantly impact overall facility operation, a third sing division (Division C) is provided.

1.3.6 Human Factors, Display and Recording ection and display of process radiation monitor variables are designed with consideration of an factors engineering principles.

Section 7.6 for additional discussion of information presented to facility operators and orded for future use.

1.3.7 Fire Protection ety-related monitors in different channels are located in separate fire areas when practical.

sical separation is used to achieve separation of redundant sensors. Wiring for redundant nnels uses physical separation and isolation to provide independence for circuits. Separation iring is achieved using separate wireways and cable trays for each channel. Spatial aration between cable and raceway groups is in accordance with IEEE 384-2008 (IEEE, 8), Section 5.1.1.2, Section 5.1.3.3 Table 1, and Section 5.1.4 Table 2.

le, wire, and electrical connectors utilized to connect radiation monitoring components to the FAS or TRPS have certifications that demonstrate the ability to inhibit the propagation of e in the event of a fire. The certifications use recognized industry standards or guidance.

combustible and heat resistant materials are used where practical in the design.

1.3.8 Natural Phenomena Hazards and Dynamic Effects process radiation monitors are installed in the seismically qualified portion of the main duction facility where they are protected from earthquakes, tornadoes, and floods bsections 7.4.3.6 and 7.5.3.5). The process radiation monitors are Seismic Category I, igned in accordance with Section 8 of IEEE Standard 344-2013 (IEEE, 2013)

NE Medical Technologies 7.7-4 Rev. 2

1.3.9 Quality safety-related process radiation monitors are designed, procured, fabricated, erected, and ed in accordance with the SHINE Quality Program Description (QAPD). Quality records licable to the design , procurement, fabrication, erection, and testing are maintained.

following codes and standards are applied to the design of the safety-related process ation monitors:

IEEE 344-2013, Recommended Practice for Seismic Qualification of Class 1E Equipment for Nuclear Power Generating Stations (IEEE, 2013), Section 8.

IEEE 384-2008, IEEE Standard Criteria for Independence of Class1E Equipment and Circuits (IEEE, 2008); invoked for separation of safety-related and nonsafety-related cables and raceways, as described in Subsection 8a2.1.3 and Subsection 8a2.1.5.

1.4 Operation and Performance safety-related process radiation monitors are designed to operate under normal conditions, ng anticipated transients, and during design basis accidents such that they will perform their ty function.

1.4.1 Functionality PS process radiation monitors monitor the ventilation line from the primary closed loop cooling tem (PCLS) expansion tanks (i.e., radiological ventilation zone 1 exhaust subsystem [RVZ1e]

diation unit [IU] cell radiation monitors). These monitors provide an actuation signal when ation levels exceed pre-determined limits, indicative of a release of target solution or fission ducts within the PCLS or the primary confinement atmosphere (with which the tank municates). The actuation results in an IU Cell Safety Actuation for that unit.

FAS process monitors associated with the supercell monitor the ventilation exhaust from each cell and provide an actuation signal when radiation levels exceed pre-determined limits, cative of a release of target solution or fission products within that hot cell. The actuation ults in isolation of the affected hot cell.

FAS process monitors associated with the radiological ventilation zone 1 (RVZ1) and ological ventilation zone 2 (RVZ2) exhaust are designed to provide an actuation signal when ation levels in the RCA ventilation exhaust systems exceed pre-determined limits, indicative failure of a confinement boundary within the facility. The actuation results in isolation of Z1, RVZ2, and radiological ventilation zone 3 (RVZ3) ventilation.

TPS process monitors associated with tritium confinement are designed to provide an ation signal when tritium concentrations within the TPS gloveboxes exceed predetermined s, indicative of a failure of TPS process equipment and release of tritium into the TPS ebox. The actuation results in isolation of the tritium confinement and ventilation associated the TPS room.

NE Medical Technologies 7.7-5 Rev. 2

eed predetermined limits, indicative of a release of tritium out of the TPS. The actuation ults in isolation of the TPS process vent exhaust lines and ventilation associated with the TPS m.

itional discussion of safety-related process radiation monitor functionality is provided in tions 7.4 and 7.5.

1.4.2 Reliability, Adequacy, and Timeliness safety-related process radiation monitors are provided for each location requiring nitoring. For locations where spurious actuation of the process radiation monitor could ificantly impact overall facility operation, a third sensing channel (Channel C) is provided for

-out-of-three voting capability.

rument ranges and response times are provided in Tables 7.4-1 and 7.5-1.

1.4.3 Setpoints, Calibration and Surveillance points for safety-related process radiation monitors are selected based on analytical limits calculated to account for known uncertainties in accordance with the setpoint determination hodology described in Subsection 7.2.1.

nitors are periodically functionally tested and maintained in accordance with the SHINE nical specifications to verify operability.

rument background count rate is observed to ensure proper functioning of the monitors.

ety-related process radiation monitors located in a low background area are equipped with a ck source to be able to verify proper operation.

ety-related process radiation monitors are calibrated using commercial radionuclide dards that have been standardized using a measurement system traceable to the National itute of Standards and Technology (NIST).

1.4.4 Technical Specifications tain material in this section provides information that is used in the technical specifications.

includes limiting conditions for operation, setpoints, design features, and means for omplishing surveillances. In addition, significant material is also applicable to, and may be renced by, the bases that are described in the technical specifications.

2 NONSAFETY-RELATED PROCESS RADIATION MONITORING safety-related process radiation monitoring is provided as part of various systems to provide rmation to the operator on the status and effectiveness of processes. They may be used to nose process upsets but are not relied upon to prevent or mitigate accidents. Nonsafety-ted process radiation monitoring is not used to control personnel or environmental ological exposures.

NE Medical Technologies 7.7-6 Rev. 2

3.1 System Description a radiation monitoring within the facility is provided by the RAMS. Area radiation monitors are ted in areas where personnel may be present and where radiation levels could become ificant. The monitors provide local and remote indication of radiation levels and provide local ms to notify personnel of potentially hazardous conditions. The RAMS provides a nonsafety-ted defense-in-depth as low as reasonably achievable (ALARA) function of alerting personnel he need to evacuate an area if required. Personnel entering radiation areas are provided with sonal electronic dosimetry, which serves as the primary means of alerting individuals of the d to evacuate those areas if conditions warrant. Additional discussion of radiation protection ctices is provided in Chapter 11.

h RAMS unit consists of a dose rate meter/controller, Geiger Mueller or silicon detector, local ation level display, audible horn, and an alarm beacon. RAMS unit locations are provided in le 7.7-2.

RAMS also provides remote indication of the radiological status of the facility to control room sonnel. RAMS information is provided on the operator workstations (via the PICS).

MS units are powered from the normal power supply system and provided backup power from standby generator system (SGS). Electrical power systems are discussed further in pter 8.

3.2 Design Criteria SHINE facility design criteria applicable to the RAMS are stated in Chapter 3, Table 3.1-2.

SHINE facility design criteria applicable to the RAMS are addressed in this section.

3.2.1 Applicable Design Criteria SHINE Design Criterion 13 - Instrumentation is provided to monitor variables and systems over their anticipated ranges for normal operation, for anticipated transients, and for postulated accidents as appropriate to ensure adequate safety, including those variables and systems that can affect the fission process, the integrity of the primary system boundary, the primary confinement and its associated systems, and the process confinement boundary and its associated systems. Appropriate controls are provided to maintain these variables and systems within prescribed operating ranges.

RAMS monitors gamma radiation levels as described in Subsection 7.7.3.3.1, which cover a ge from low normal background (below the definition of a radiation area) to 100 times the nition of a high radiation area (100 mrem/hour), in order to monitor radiation during normal rations, anticipated transients, and postulated accidents.

SHINE Design Criterion 38 - Means are provided for monitoring the primary confinement boundary, hot cell, and glovebox atmospheres to detect potential leakage of gaseous or other airborne radioactive material. Potential effluent discharge paths and the plant environs are monitored for radioactivity that may be released from normal operations, including anticipated transients, and from postulated accidents.

NE Medical Technologies 7.7-7 Rev. 2

3.3 Design Bases 3.3.1 Design Bases Functions RAMS functions continuously to alert facility personnel entering or working in low radiation as of increasing or abnormally high radiation levels which, if unnoticed, could possibly result advertent overexposures. The RAMS also serves to inform the control room operator of the urrence and approximate location of an abnormal radiation increase in low-radiation areas.

h RAMS unit is designed to detect direct radiation from 0.1 mrem/hr up to 10 rem/hr. RAMS s have an accuracy of at least 25 percent of the measured value.

3.3.2 Operating Conditions MS units are designed to operate in the normal environmental conditions presented in les 7.2-1 and 7.2-3.

3.4 Operation and Performance RAMS area radiation monitors are designed to operate under normal facility conditions and etect radiation that may be indicative of anticipated transients or design basis accidents.

RAMS includes the area radiation monitoring units located in the main production facility A.

m setpoints are set conservatively as required to notify workers to potential hazards or ificant changes to radiological conditions in the area.

nitors are periodically calibrated using calibration sources that are traceable to factory tests verified initial calibration and accuracy. The units are calibrated at least annually and as ommended by the instrument manufacturer. Monitors are periodically functionally tested using alled check sources, which simulate a radiation level in the area.

3.4.1 Technical Specifications re are no technical specifications applicable to the RAMS.

4 CONTINUOUS AIR MONITORING 4.1 System Description tinuous airborne contamination monitoring within the facility is provided by the CAMS. Each MS unit samples air and provides real time alpha and beta activities or tritium activity to alert sonnel when airborne contamination is above preset limits. CAMS units are located in areas re personnel may be present and where contamination levels could become significant. Each MS unit provides local and remote indication of airborne radiation levels and alarm abilities. The CAMS provides a nonsafety-related defense-in-depth ALARA function of NE Medical Technologies 7.7-8 Rev. 2

ticulate continuous air monitors are alpha-beta air monitors, which are self-contained units ipped with a vacuum pump, particulate filter, and a silicon-based detector. Real time tritium monitors are self-contained units equipped with a vacuum pump and dual ionization mbers. CAMS unit locations are provided in Table 7.7-3.

MS units are powered from the normal power supply system and provided backup power from SGS. Electrical power systems are discussed further in Chapter 8.

4.2 Design Criteria SHINE facility design criteria applicable to the CAMS are stated in Chapter 3, Table 3.1-2.

SHINE facility design criteria applicable to the CAMS are addressed in this section.

4.2.1 Applicable Design Criteria SHINE Design Criterion 13 - Instrumentation is provided to monitor variables and systems over their anticipated ranges for normal operation, for anticipated transients, and for postulated accidents as appropriate to ensure adequate safety, including those variables and systems that can affect the fission process, the integrity of the primary system boundary, the primary confinement and its associated systems, and the process confinement boundary and its associated systems. Appropriate controls are provided to maintain these variables and systems within prescribed operating ranges.

CAMS units monitor alpha and beta airborne activity concentration and tritium airborne vity concentration as described in Subsection 7.7.4.3.1. For alpha and beta airborne activity centration detection, the design range is 10 percent DAC up to 1,000,000 DAC. For tritium orne activity concentration detection, the design range is 5 percent DAC up to 50,000 DAC.

SHINE Design Criterion 38 - Means are provided for monitoring the primary confinement boundary, hot cell, and glovebox atmospheres to detect potential leakage of gaseous or other airborne radioactive material. Potential effluent discharge paths and the plant environs are monitored for radioactivity that may be released from normal operations, including anticipated transients, and from postulated accidents.

CAMS monitors the facility environment where personnel are normally present and where tamination levels could become significant. The CAMS provides real time sampling for alpha, a, and tritium. The CAMS is provided with backup power from the SGS (Subsection 7.7.4.1).

monitor locations are shown in Table 7.7-3.

4.3 Design Bases 4.3.1 Design Bases Functions CAMS functions continuously to immediately alert facility personnel entering or working in radiation areas of increasing or abnormally high airborne contamination levels which, if oticed, could possibly result in inadvertent overexposures. The CAMS also serves to inform NE Medical Technologies 7.7-9 Rev. 2

h particulate CAMS unit has a minimum sensitivity of 1E-12 Ci/cc alpha and 1E-10 Ci/cc a, with a span of at least six decades of monitoring capability. Each tritium CAMS unit has a imum sensitivity of 1 Ci/m3, with a span of at least four decades of monitoring capability.

4.3.2 Operating Conditions MS units are designed to operate in the normal environmental conditions presented in le 7.2-3.

4.4 Operation and Performance CAMS airborne contamination monitors are designed to operate under normal facility ditions and to detect radiation that may be indicative of anticipated transients or design basis idents.

CAMS includes the continuous airborne contamination monitoring units located in the main duction facility RCA.

m setpoints are set conservatively as required to notify workers to potential hazards or ificant changes to radiological conditions in the area. Monitors are periodically calibrated g calibration sources that are traceable to factory tests that verified initial calibration and uracy. The calibration of instrumentation is at least annually and as recommended by the rument manufacturer. Operation and response tests of instruments are performed consistent the manufacturers recommendations and are conducted at a frequency consistent with stry practices.

4.4.1 Technical Specifications re are no technical specifications applicable to the CAMS.

5 EFFLUENT MONITORING 5.1 System Description uent monitoring for the facility is provided by the SRMS. The SRMS is composed of two nitoring units: the main facility stack release monitor (SRM), and the carbon delay bed effluent nitor (CDBEM).

SRM is used to demonstrate that gaseous effluents from the main production facility are in regulatory limits and do not have an accident mitigation or personnel protection function.

SRM performs its function by drawing a representative air sample from the stack and viding a means to measure the air sample for noble gases (continuous measurement) and turing particulates, iodine, and tritium for collective measurement.

CDBEM monitors for noble gases at the exhaust of the process vessel vent system (PVVS) bon delay beds to provide information about the health of the PVVS carbon delay beds and to vide the ability to monitor the safety-related exhaust point effluent release pathway when it is NE Medical Technologies 7.7-10 Rev. 2

normal heating, ventilation, and air conditioning [HVAC] systems and the PVVS are not rating) and do not have an accident mitigation or personnel protection function. Two iculate and iodine filters (redundant configuration) are provided for in-line capturing and ective measurement when the safety-related exhaust point is in use.

locations of the SRM and CDBEM within the facility ventilation systems are shown in ure 7.7-1.

5.2 Design Criteria SHINE facility design criteria are described in Section 3.1. The SHINE facility design criteria licable to the SRMS are provided in Table 3.1-2.

5.2.1 Applicable Design Criteria SHINE Design Criterion 13 - Instrumentation is provided to monitor variables and systems over their anticipated ranges for normal operation, for anticipated transients, and for postulated accidents as appropriate to ensure adequate safety, including those variables and systems that can affect the fission process, the integrity of the primary system boundary, the primary confinement and its associated systems, and the process confinement boundary and its associated systems. Appropriate controls are provided to maintain these variables and systems within prescribed operating ranges.

SRMS continuously monitors noble gases that are present in facility effluent streams and ws for the collection and analysis of particulate, iodine, and tritium (Subsection 7.7.5.3.1).

SRMS units are designed to operate under normal facility conditions and to detect radiation may be indicative of anticipated transients or design basis accidents (Subsection 7.7.5.4).

SRM and CDBEM instrument ranges are provided in Subsection 7.7.5.3.1.

SHINE Design Criterion 38 - Means are provided for monitoring the primary confinement boundary, hot cell, and glovebox atmospheres to detect potential leakage of gaseous or other airborne radioactive material. Potential effluent discharge paths and the plant environs are monitored for radioactivity that may be released from normal operations, including anticipated transients, and from postulated accidents.

SRMS continuously monitors noble gases that are present in facility effluent streams and ws for the collection and analysis of particulate, iodine, and tritium (Subsection 7.7.5.3.1).

SRMS units are designed to operate under normal facility conditions and to detect radiation may be indicative of anticipated transients or design basis accidents (Subsection 7.7.5.4).

5.3 Design Bases 5.3.1 Design Basis Functions SRMS functions to continuously monitor noble gases that are present in facility effluent ams and to allow for the collection and analysis of particulate, iodine, and tritium.

NE Medical Technologies 7.7-11 Rev. 2

uirements for ANSI N13.1-1999 (ANSI, 1999).

SRM noble gas radiation monitor has a range of 1.0E-06 Ci/cc to 1.0E-01 Ci/cc, with a imum sensitivity of 3.1E-07 Ci/cc (xenon-133 equivalent). The SRM tritium monitor has a imum sensitivity of 1.0E-10 Ci/cc.

CDBEM noble gas radiation monitor has a range of 1.0E-06 Ci/cc to 1.0E+01 Ci/cc.

both the SRM and CDBEM, filter medium collection efficiency is 99 percent for 0.3 micron or er particles. Halogen isotopes are collected on a filter having a collection efficiency of percent or better for iodine.

5.3.2 Operating Conditions MS units are designed to operate in the normal environmental conditions presented in le 7.2-3 and the radioisotope production facility (RPF) general area radiological environment sented in Table 7.2-1.

5.3.3 Quality following standard is applied to the design of the facility effluent monitors:

ANSI N13.1-1999, Sampling and Monitoring Release of Airborne Radioactive Substances from the Stacks and Ducts of Nuclear Facilities (ANSI, 1999) 5.4 Operation and Performance SRMS units are designed to operate under normal facility conditions and to detect radiation may be indicative of anticipated transients or design basis accidents.

SRM is used to monitor the main facility stack, which is the normal release path for gaseous ents from the PVVS and RCA ventilation systems. The SRM includes a mass flow controller egulate sample flow rate in the isokinetic region relative to stack flow. A vacuum pump is used raw sampled air through particulate and iodine filter cartridges, which are removed and lyzed periodically. The sampled air is then drawn into a sample chamber, which houses a a detector used to measure the noble gas radionuclides. The ratemeter for the beta radiation nitor indicates and displays the radiation level inside the sampler from the sampled air. From sampler, the air is drawn through the flow controller assembly, pump, and exhausted into the rn line. Downstream of the particulate and iodine filter, a connection for the tritium detection tem is provided. The tritium monitor has its own pump and flow control. The tritium detector is ssive sampler collecting system (i.e., bubble system) to continuously collect and concentrate mental tritium and tritiated water in small vials. The contents of the vials are assayed using a tillation counter at regular intervals.

CDBEM monitors noble gases at the exhaust of the PVVS carbon delay beds using a pling system. Redundant particulate and iodine filters are installed in-line with the effluent am, upstream of the safety-related exhaust point, which operates at a much lower flow rate proximately 16 standard cubic feet per minute) than the main facility stack. The safety-related NE Medical Technologies 7.7-12 Rev. 2

ude a tritium monitor. See Section 9b.6 for additional discussion on the PVVS and nitrogen ge operations.

initial channel calibration for the SRM and CDBEM noble gas detectors is performed using dards traceable to NIST.

5.4.1 Technical Specifications tain material in this section provides information that is used in the technical specifications.

includes limiting conditions for operation, setpoints, design features, and means for omplishing surveillances. In addition, significant material is also applicable to, and may be renced by, the bases that are described in the technical specifications.

6 CONCLUSION iation monitoring within the SHINE facility is performed by multiple radiation monitoring cesses. The radiation monitoring supports facility control room operations, provides rmation and alarms for personnel within the facility, provides input to safety-related control ems to actuate safety systems, and provides the ability to monitor radioactive releases to the ironment.

radiation monitoring systems and equipment are designed to applicable SHINE facility ign criteria and applicable quality standards to support reliable operation in performing the ation monitoring functions.

NE Medical Technologies 7.7-13 Rev. 2

Table 7.7 Safety-Related Process Radiation Monitors (Sheet 1 of 4)

Total Minimum Monitored Monitored Unit Available Required Operability it Material Location Location Function Channels Channels Requirements Detect elevated Whenever PVVS, radiation levels Supercell VTS, or N2PS is Fission Supercell from process exhaust 3 2 operating and hot cell products exterior vessel ventilation isolation dampers are ventilation cell not closed (input to ESFAS)

Whenever target Detect elevated solution or Supercell radiation levels radioisotope products Fission Supercell exhaust from extraction 2 2 are present in the hot products exterior ventilation cell A (input to cell and hot cell ESFAS) isolation dampers are not closed Detect elevated Supercell radiation levels Fission Supercell exhaust from purification 2 2 products exterior ventilation cell A (input to ESFAS)

Whenever Detect elevated radioisotope products Supercell radiation levels Fission Supercell are present in the hot exhaust from packaging 2 2 products exterior cell and hot cell ventilation cell 1 (input to isolation dampers are ESFAS) not closed Detect elevated Supercell radiation levels Fission Supercell exhaust from purification 2 2 products exterior ventilation cell B (input to ESFAS)

Whenever target Detect elevated solution or Supercell radiation levels radioisotope products Fission Supercell exhaust from extraction 2 2 are present in the hot products exterior ventilation cell B (input to cell and hot cell ESFAS) isolation dampers are not closed Whenever target Detect elevated solution or Supercell radiation levels radioisotope products Fission Supercell exhaust from extraction 2 2 are present in the hot products exterior ventilation cell C (input to cell and hot cell ESFAS) isolation dampers are not closed NE Medical Technologies 7.7-14 Rev. 2

Total Minimum Monitored Monitored Unit Available Required Operability it Material Location Location Function Channels Channels Requirements Detect elevated Supercell radiation levels Fission Supercell exhaust from purification 2 2 products exterior ventilation cell C (input to ESFAS)

Detect elevated Whenever Supercell radiation levels radioisotope products Fission Supercell exhaust from packaging 2 2 are present in the hot products exterior ventilation cell 2 (input to cell and hot cell ESFAS) isolation dampers are not closed Detect elevated radiation levels Supercell Fission Supercell from iodine and 0 exhaust 2 2 products exterior xenon ventilation purification cell (input to ESFAS)

Detect elevated Mezzanine radiation levels Fission RVZ1 (RPF 1 from RVZ1 RCA 3 2 products exhaust general exhaust (input to Whenever facility area)

ESFAS) operations are not secured or RVZ Detect elevated isolation dampers are Mezzanine radiation levels not closed Fission RVZ2 (RPF 2 from RVZ2 RCA 3 2 products exhaust general exhaust (input to area)

ESFAS)

Detect elevated tritium TPS concentration in Whenever tritium is confinement tritium present in the TPS 3 Tritium TPS room 2 2 A purification confinement in atmosphere system gaseous form confinement (input to ESFAS)

Detect elevated tritium TPS concentration in Whenever tritium is confinement tritium present in the TPS 4 Tritium TPS room 2 2 B purification confinement in atmosphere system gaseous form confinement (input to ESFAS)

NE Medical Technologies 7.7-15 Rev. 2

Total Minimum Monitored Monitored Unit Available Required Operability it Material Location Location Function Channels Channels Requirements Detect elevated tritium TPS concentration in Whenever tritium is confinement tritium present in the TPS 5 Tritium TPS room 2 2 C purification confinement in atmosphere system gaseous form confinement (input to ESFAS)

Detect elevated Whenever tritium is tritium present in the TPS concentration in exhaust to RVZ1e in tritium 6 Tritium TPS exhaust TPS room 3 2 gaseous form and purification TPS confinement system exhaust isolation devices are to RVZ1e (input not closed to ESFAS)

IU 1 primary Detect elevated closed loop radiation levels cooling from IU 1 PCLS Fission Cooling Modes 1 7 system expansion tank 3 2 products room through 4 (PCLS) exhaust (input to expansion TRPS) tank exhaust Detect elevated radiation levels IU 2 PCLS Fission Cooling from IU 2 PCLS Modes 1 8 expansion 3 2 products room expansion tank through 4 tank exhaust exhaust (input to TRPS)

Detect elevated radiation levels IU 3 PCLS Fission Cooling from IU 3 PCLS Modes 1 9 expansion 3 2 products room expansion tank through 4 tank exhaust exhaust (input to TRPS)

Detect elevated radiation levels IU 4 PCLS Fission Cooling from IU 4 PCLS Modes 1 0 expansion 3 2 products room expansion tank through 4 tank exhaust exhaust (input to TRPS)

Detect elevated radiation levels IU 5 PCLS Fission Cooling from IU 5 PCLS Modes 1 1 expansion 3 2 products room expansion tank through 4 tank exhaust exhaust (input to TRPS)

NE Medical Technologies 7.7-16 Rev. 2

Total Minimum Monitored Monitored Unit Available Required Operability it Material Location Location Function Channels Channels Requirements Detect elevated radiation levels IU 6 PCLS Fission Cooling from IU 6 PCLS Modes 1 2 expansion 3 2 products room expansion tank through 4 tank exhaust exhaust (input to TRPS)

Detect elevated radiation levels IU 7 PCLS Fission Cooling from IU 7 PCLS Modes 1 3 expansion 3 2 products room expansion tank through 4 tank exhaust exhaust (input to TRPS)

Detect elevated radiation levels IU 8 PCLS Fission Cooling from IU 8 PCLS Modes 1 4 expansion 3 2 products room expansion tank through 4 tank exhaust exhaust (input to TRPS)

NE Medical Technologies 7.7-17 Rev. 2

Table 7.7 Radiation Area Monitor Locations Unit Function Location ea Monitor 1 Alert supercell operators of high radiation Near supercell, ground levels floor ea Monitor 2 Alert personnel of high radiation levels from North end of RPF tank tank vaults near the north-west RPF vaults, ground floor emergency exit ea Monitor 3 Alert personnel of high radiation levels from South end of RPF tank tank vaults near the main RPF exit vaults, ground floor ea Monitor 4 Alert waste cell operators of high radiation Near waste enclosure, levels ground floor ea Monitor 5 Alert personnel of high radiation levels from North end of main IF north off-gas or cooling rooms near the corridor, ground floor north-east IF emergency exit ea Monitor 6 Alert personnel of high radiation levels from South end of main IF south off-gas, cooling rooms, and NDAS corridor, ground floor service cell near the IF overhead doors ea Monitor 7 Alert personnel of high radiation levels from North end of IU vaults, top north IU cells of vault elevation ea Monitor 8 Alert personnel of high radiation levels from South end of IU vaults, top south IU cells of vault elevation ea Monitor 9 Alert personnel of high radiation levels from TPS room roof elevation the NDAS service cell ea Monitor 10 Alert personnel of high radiation levels from Safety-related area, facility filter banks mezzanine NE Medical Technologies 7.7-18 Rev. 2

Table 7.7 Continuous Airborne Monitor Locations Unit Function Location borne Alert supercell operators of high contamination Near supercell, ground floor nitor 1 levels borne Alert personnel of high contamination levels North end of RPF tank vaults, nitor 2 from tank vaults near the north-west RPF ground floor emergency exit borne Alert personnel of high contamination levels South end of RPF tank vaults, nitor 3 from tank vaults near the main RPF exit ground floor borne Alert waste cell operators of high contamination Near waste enclosure, ground nitor 4 levels floor borne Alert personnel of high contamination levels North end of main IF corridor, nitor 5 from north off-gas or cooling rooms near the ground floor north-east IF emergency exit borne Alert personnel of high contamination levels South end of main IF corridor, nitor 6 from south off-gas or cooling rooms near the IF ground floor overhead doors borne Alert personnel of high contamination levels Safety-related area nitor 7 from filter banks mezzanine, facility mezzanine borne Alert laboratory personnel of high contamination North laboratory, ground floor nitor 8 levels borne Alert laboratory personnel of high contamination South laboratory, ground floor nitor 9 levels borne Alert personnel of high contamination levels Target solution preparation nitor 10 from target solution preparation activities room, ground floor borne Alert personnel of high contamination levels Uranium storage room, ground nitor 11 from target solution preparation activities floor tium Alert personnel of high tritium levels from the TPS room, ground floor nitor 12 TPS glovebox tium Alert personnel of high tritium levels in the main Main IF corridor, ground floor nitor 13 IF corridor NE Medical Technologies 7.7-19 Rev. 2

NE Medical Technologies 7.7-20 Rev. 2 1 SYSTEM DESCRIPTION neutron flux detection system (NFDS) performs the task of monitoring and indicating the tron flux to determine the multiplication factor and power level during filling of the target tion vessel (TSV) and irradiating the target solution. The signal from the detectors is smitted to the pre-amplifiers where the signal is amplified and filtering for noise reduction is ormed. The output of the pre-amplifier is transmitted to cabinets in the facility control room re the signal processing units are located. The signal processing units perform measurement he neutron flux signal from the pre-amplifier, signal processing, indication and interfacing with er systems. The NFDS interfaces with the TSV reactivity protection system (TRPS) for safety-ted interfaces and monitoring and indication, and interfaces with the process integrated trol system (PICS) for nonsafety-related functions.

NFDS monitors variables important to the safety functions of the irradiation unit (IU) to vide input to the TRPS to perform its safety functions.

NFDS provides continuous indication of the neutron flux during operation, from filling ugh maximum power during irradiation. To cover the entire range of neutron flux levels, there three different ranges provided from the NFDS: source range, wide range, and power range.

rce range covers the low levels expected while the TSV is being filled while power range ers the higher flux levels anticipated while the neutron driver is on and irradiating. To cover gap between the source and power ranges, the wide range monitors the flux levels between source and power range with a minimum two decade overlap with the high end of the source ge and the low end of the power range.

NFDS is a three-division system with three detectors positioned around the subcritical embly support structure (SASS) at approximately 120-degree intervals to the TSV. Each sion of the NFDS consists of a watertight detector located in the light water pool, a pre-plifier mounted in the radioisotope production facility (RPF), and a signal processing unit de the facility control room. The three watertight detectors located in a light water pool are ported using brackets attached to the outer shell of the SASS. These brackets serve to locate flux detectors in a fixed location relative to the TSV, ensuring flux profiles are measured sistently such that the sensitivity in the source range reliably indicates the neutron flux levels ugh the entire range of filling with the target solution.

2 DESIGN CRITERIA SHINE facility design criteria applicable to the NFDS are as stated in Chapter 3, Table 3.1-1.

facility design criteria applicable to the NFDS, and the NFDS system design criteria, are ressed in this section.

2.1 SHINE Facility Design Criteria NE facility design criteria 13 through 19 apply to the NFDS.

NE Medical Technologies 7.8-1 Rev. 2

SHINE Design Criterion 13 - Instrumentation is provided to monitor variables and systems over their anticipated ranges for normal operation, for anticipated transients, and for postulated accidents as appropriate to ensure adequate safety, including those variables and systems that can affect the fission process, the integrity of the primary system boundary, the primary confinement and its associated systems, and the process confinement boundary and its associated systems. Appropriate controls are provided to maintain these variables and systems within prescribed operating ranges.

NFDS provides continuous indication of the neutron flux during operation, from filling ugh maximum power during irradiation (Subsection 7.8.1). The neutron flux detector oints bound normal operations and accident conditions and provide margin to analytical ts (Subsection 7.8.4.3). Setpoints are established based on a documented methodology and ounts for uncertainties in each instrument channel (Subsection 7.8.2.2.5). The NFDS ports maintenance and testing to ensure operability as required by the technical cifications (Subsection 7.8.3.10).

2.1.2 Protection System Functions SHINE Design Criterion 14 - The protection systems are designed to:

1) initiate, automatically, the operation of appropriate systems to ensure that specified acceptable target solution design limits are not exceeded as a result of anticipated transients; and

2) sense accident conditions and to initiate the operation of safety-related systems and components.

tron flux detector setpoints bound normal operations and accident conditions and provide gin to analytical limits (Subsection 7.8.4.3). Upon reaching the neutron flux signal setpoints ble 7.4-1), automatic safety actuations are initiated by the TRPS, as described in section 7.4.4.1.

2.1.3 Protection System Reliability and Testability SHINE Design Criterion 15 - The protection systems are designed for high functional reliability and inservice testability commensurate with the safety functions to be performed.

Redundancy and independence designed into the protection systems are sufficient to ensure that:

1) no single failure results in loss of the protection function, and

2) removal from service of any component or channel does not result in loss of the required minimum redundancy unless the acceptable reliability of operation of the protection system can be otherwise demonstrated.

The protection systems are designed to permit periodic testing, including a capability to test channels independently to determine failures and losses of redundancy that may have occurred.

NE Medical Technologies 7.8-2 Rev. 2

DS such that a failure of an interfacing nonsafety system will not impact the NFDS bsection 7.8.3.3 and Figure 7.4-1). The NFDS supports maintenance and testing to ensure rability as required by the technical specifications. The NFDS is designed to allow operators emove portions of the NFDS from service when not required for operation without impacting DS components specific to other IU cells (Subsection 7.8.3.10). The independent NFDS sions interface with TRPS, which has been analyzed for single failure in accordance with E Standard 379-2000 (IEEE, 2000) for all inputs, including NFDS.

2.1.4 Protection System Independence SHINE Design Criterion 16 - The protection systems are designed to ensure that the effects of natural phenomena, and of normal operating, maintenance, testing, and postulated accident conditions on redundant channels do not result in loss of the protection function or are demonstrated to be acceptable on some other defined basis. Design techniques, such as functional diversity or diversity in component design and principles of operation, are used to the extent practical to prevent loss of the protection function.

NFDS is qualified for operation during and after a seismic design basis event using the ance in IEEE Standard 344-2013 (IEEE, 2013) (Subsection 7.8.3.8). The NFDS components located in the RPF, the IF, and facility control room and are protected from seismic events, ado wind, tornado missile and external flooding (Subsection 7.8.3.8). Hurricanes, tsunamis, seiches are not credible events at the SHINE facility (Subsection 2.4.5.1, 2.4.2.7, and 5.2). Physical and electrical independence (Subsection 7.8.3.4), redundancy bsection 7.8.3.3), equipment qualification (Subsection 7.8.3.7) and quality in design bsection 7.8.3.11) are applied in the NFDS design to prevent loss of the protective function.

2.1.5 Protection System Failure Modes SHINE Design Criterion 17 - The protection systems are designed to fail into a safe state if conditions such as disconnection of the system, loss of energy (e.g., electric power, instrument air), or postulated adverse environments are experienced.

NFDS is designed so that a failure due to loss of power to the NFDS or a removal of an DS channel presents to TRPS as zero current on the analog outputs to allow TRPS to treat condition as a positive trip determination . The interaction between NFDS and TRPS is wn in Figure 7.4-1 (Subsection 7.8.3.5).

2.1.6 Separation of Protection and Control Systems SHINE Design Criterion 18 - The protection system is separated from control systems to the extent that failure of any single control system component or channel, or failure or removal from service of any single protection system component or channel that is common to the control and protection systems leaves intact a system satisfying all reliability, redundancy, and independence requirements of the protection system. Interconnection of the protection and control systems is limited to assure that safety is not significantly impaired.

NFDS is comprised of three redundant divisions of detectors, preamplifiers, and processing uits for single failure protection (Subsection 7.8.3.3). Communications from the NFDS to the NE Medical Technologies 7.8-3 Rev. 2

tions of the NFDS (Subsection 7.8.3.2).

2.1.7 Protection Against Anticipated Transients SHINE Design Criterion 19 - The protection systems are designed to ensure an extremely high probability of accomplishing their safety functions in the event of anticipated transients.

NFDS is comprised of three redundant divisions of detectors, preamplifiers, and processing uits for single failure protection (Subsection 7.8.3.3). The three divisions of the NFDS are sically and electrically independent of each other (Subsection 7.8.3.4) and the NFDS ipment is qualified for normal and transient conditions (Subsections 7.8.3.6 and 7.8.3.7).

2.2 NFDS System Design Criteria 2.2.1 General Instrumentation and Control NFDS Criterion 1 - The range of operation of detector channels for the NFDS shall be sufficient to cover the expected range of variation of monitored neutron flux during normal and transient operation.

neutron flux detector setpoints bound normal operations and accident conditions and vide margin to analytical limits (Subsection 7.8.4.3).

NFDS Criterion 2 - The NFDS shall give continuous indication of the neutron flux from subcritical source multiplication level through licensed maximum power range. The continuous indication shall ensure at least two decades of overlap in indication is maintained while observation is transferred from one channel to another.

NFDS provides continuous indication of the neutron flux from zero counts per second to at t 250 percent power with two decades of overlap (Subsection 7.8.3.1).

NFDS Criterion 3 - The NFDS power range channels shall provide reliable TSV power level while the source range channel provides count rate information from detectors that directly monitor the neutron flux.

NFDS power range provides a signal proportional to TSV power level from 0 to 125 percent he licensed power limit. The source range provides a current signal proportional to count rate all expected startup count rates (Subsection 7.8.3.1).

NFDS Criterion 4 - The NFDS log power range channel (i.e., wide range channel) and a linear flux monitoring channel (i.e., power range channel) shall accurately sense neutrons during irradiation, even in the presence of intense high gamma radiation.

h NFDS division includes a fission chamber detector and a Boron Trifluoride (BF3) detector

. These detector types are primarily sensitive to thermal neutrons with excellent gamma ction.

NE Medical Technologies 7.8-4 Rev. 2

NFDS is comprised of three redundant divisions of detectors, preamplifiers, and processing uits for single failure protection (Subsection 7.8.3.3). The wide range neutron flux monitors cent power up to 250 percent of the licensed power limit (Subsection 7.8.3.1.3). The power ge neutron flux signal has a range of 0 percent to 125 percent of the licensed power limit bsection 7.8.3.1.2).

NFDS Criterion 6 - The location and sensitivity of at least one NFDS detector in the source range channel, along with the location and emission rate of the subcritical multiplication source, shall be designed to ensure that changes in reactivity will be reliably indicated even with the TSV shut down.

positioning of the NFDS source range detectors, and the location, and emission rate of the critical multiplication source, is designed so that all three channels are on scale throughout

g. This includes while the TSV is empty of solution. NFDS source range signal increases with easing target solution volume, and in this way, increasing reactivity will always produce an ease in count rate.

NFDS Criterion 7 - The NFDS shall have at least one detector in the power range channel to provide reliable readings to a predetermined power level above the licensed maximum power level.

wide range neutron flux monitors percent power up to 250 percent of the licensed power limit bsection 7.8.3.1.3). The power range neutron flux signal has a range of 0 percent to percent of the licensed power limit (Subsection 7.8.3.1.2).

NFDS Criterion 8 - The NFDS shall be separated from the PICS to the extent that any removal of a component or channel common to both the NFDS and the PICS preserves the reliability, redundancy, and independence of the NFDS.

mmunications from the NFDS to the TRPS and PICS are continuous through isolated outputs only allow the data to be transmitted out of the system so that no failure from an interfacing tem can affect the functions of the NFDS (Subsection 7.8.3.2).

NFDS Criterion 9 - The NFDS detectors shall be qualified for continuous submerged operation within the light water pool. The NFDS detector housings shall be watertight and supported by a sleeve structure, mounted to the SASS, at specific locations surrounding the SASS.

NFDS detectors are housed in a watertight assembly qualified for submergence to a depth p to 16 feet (Subsection 7.8.3.7). The detector housings are supported using brackets ched to the outer shell of the SASS (Subsection 7.8.1). The detectors are installed roximately 120 degrees equidistant around the SASS in relation to the target solution vessel bsection 7.8.3.4).

NFDS Criterion 10 - The timing of NFDS communications shall be deterministic.

timing of NFDS communications is deterministic.

NE Medical Technologies 7.8-5 Rev. 2

NFDS Criterion 11 - The NFDS shall be designed to perform its protective functions after experiencing a single random active failure in nonsafety control systems or in the NFDS, and such failure shall not prevent the NFDS from performing its intended functions or prevent safe shutdown of an IU cell.

NFDS is comprised of three redundant divisions of detectors, preamplifiers, and processing uits for single failure protection. Interfacing systems with the NFDS are downstream of the DS such that a failure of an interfacing nonsafety system will not impact the NFDS bsection 7.8.3.3 and Figure 7.4-1). Communications from the NFDS to the TRPS and PICS continuous through isolated outputs that only allow the data to be transmitted out of the tem so that no failure from an interfacing system can affect the functions of the NFDS bsection 7.8.3.2).

NFDS Criterion 12 - The NFDS shall be designed such that no single failure can cause the failure of more than one redundant component.

NFDS is comprised of three redundant divisions of detectors, preamplifiers, and processing uits for single failure protection (Subsection 7.8.3.3). The three divisions of the NFDS are sically and electrically independent of each other (Subsection 7.8.3.4).

2.2.3 Independence NFDS Criterion 13 - Physical separation and electrical isolation shall be used to maintain the independence of NFDS circuits and equipment among redundant safety divisions or with nonsafety systems so that the safety functions required during and following any maximum hypothetical accident or postulated accident can be accomplished.

three divisions of the NFDS are physically and electrically independent of each other bsection 7.8.3.4). The NFDS detector cables are routed back to the control room in physically arated cable trays and raceways (Subsection 7.8.3.4) in accordance with IEEE Standard

-2008 (IEEE, 2008) (Subsection 7.8.3.11). Interfacing systems with the NFDS are nstream of the NFDS such that a failure of an interfacing nonsafety system will not impact NFDS (Subsection 7.8.3.3).

NFDS Criterion 14 - The NFDS shall be designed such that no communication-within a single safety channel, between safety channels, and between safety and nonsafety systems-adversely affects the performance of required safety functions.

three divisions of the NFDS are physically and electrically independent of each other bsection 7.8.3.4). Interfacing systems with the NFDS are downstream of the NFDS such that ilure of an interfacing nonsafety system will not impact the NFDS (Subsection 7.8.3.3).

mmunications from the NFDS to the TRPS and PICS are continuous through isolated outputs.

output isolation devices only allow for the data to be transmitted out of the system so that no re from an interfacing system can affect the functions of the NFDS (Subsection 7.8.3.2).

NE Medical Technologies 7.8-6 Rev. 2

NFDS Criterion 15 - The NFDS and associated components shall be designed to assume a safe state on loss of electrical power.

NFDS is supplied power from the uninterruptible power supply system (UPSS). The UPSS ery backup supplies power to the NFDS for a minimum of 10 minutes following a loss of off-power. The NFDS is designed so that a failure due to loss of power to the NFDS or a removal n NFDS channel interacts the same with the TRPS as if there was a positive trip ermination output to the TRPS. The interaction between NFDS and TRPS is shown in ure 7.4-1 (Subsection 7.8.3.5).

NFDS Criterion 16 - The NFDS shall not be designed to fail or operate in a mode that could prevent the TRPS from performing its intended safety function. The design of the NFDS shall consider:

1) The effect of NFDS on accidents

2) The effects of NFDS failures

3) The effects of NFDS failures caused by accidents.

The failure analyses shall cover hardware and software failures associated with the NFDS.

NFDS utilizes a fault-tolerant, triple redundant architecture. This design identifies and pensates for failed system elements. Because of the triple redundant architecture of the DS platform, failure mechanisms that affect a single function have no effect on plant ration.

2.2.5 Setpoints NFDS Criterion 17 - Neutron flux setpoints for an actuation of the NFDS shall be based on a documented analysis methodology that identifies assumptions and accounts for uncertainties, such as environmental allowances and measurement computational errors associated with each element of the instrument channel. The setpoint analysis parameters and assumptions shall be consistent with the safety analysis, system design basis, technical specifications, facility design, and expected maintenance practices.

points in the NFDS are based on a documented methodology that identifies each of the umptions and accounts for the uncertainties in each instrument channel. The setpoint hodology is further described in Subsection 7.2.1.

NFDS Criterion 18 - Adequate margin shall exist between setpoints and safety limits so that the TRPS initiates protective actions before safety limits are exceeded.

points applicable to the NFDS are based on a documented methodology that identifies each he assumptions and accounts for the uncertainties in each instrument channel. The setpoint hodology is further described in Subsection 7.2.1.

NE Medical Technologies 7.8-7 Rev. 2

the protective function.

source range neutron flux measurement supports filling of the IU cell prior to irradiation of target solution. The power range neutron flux measurement supports operations when the tron driver is operating and irradiating the target solution, and the wide range neutron flux asurement overlaps the source range and power range and is usable during both source and er range levels. The instrument ranges and accuracies support the design functions for each ge and are provided in Subsection 7.8.3.1 and Table 7.4-1.

2.2.6 Equipment Qualification NFDS Criterion 20 - The effects of electromagnetic interference/radio-frequency interference (EMI/RFI) and power surges on the NFDS shall be adequately addressed.

k mounted NFDS equipment is tested to appropriate standards to show that the effects of I/RFI and power surges are adequately addressed (Subsection 7.8.3.7). The codes and dards applicable to the NFDS design are stated in Subsection 7.8.3.11.

2.2.7 Surveillance NFDS Criterion 21 - The NFDS shall provide the capability for calibration, inspection, and testing to validate the desired functionality of the NFDS.

NFDS supports testing and calibration to ensure operability as required by the technical cifications. The NFDS is designed to allow operators to remove portions of the NFDS from vice when not required for operation without impacting NFDS components specific to other IU s (Subsection 7.8.3.10).

NFDS Criterion 22 - Equipment in the NFDS (from the input circuitry to output actuation circuitry) shall be designed to allow testing, calibration, and inspection to ensure operability. If testing is required or can be performed as an option during operation, the NFDS shall retain the capability to accomplish its safety function while under test.

NFDS design supports testing and calibration to ensure operability as required by the nical specifications. The NFDS is designed to allow operators to remove portions of the DS from service when not required for operation without impacting NFDS components cific to other IU cells (Subsection 7.8.3.10).

NFDS Criterion 23 - Testing, calibration, and inspections of the NFDS shall be sufficient to confirm that surveillance test and self-test features address failure detection, self-test capabilities, and actions taken upon failure detection.

an all analog system, the only form of fault detection normally available is the source range sing and power range missing discrete signals provided to the PICS (Subsection 7.8.3.10).

NE Medical Technologies 7.8-8 Rev. 2

iting Conditions for Operation and Surveillance Requirements are established for the NFDS e technical specifications (Subsection 7.8.4.3). The NFDS design supports testing and bration to ensure operability as required by the technical specifications (Subsection 7.8.3.10).

2.2.8 Classification and Identification NFDS Criterion 25 - NFDS equipment shall be distinctively identified to indicate its safety classification and to associate equipment according to divisional or channel assignments.

h division of the NFDS is uniquely labeled and identified in accordance with SHINE tification and classification procedures.

2.2.9 Human Factors NFDS Criterion 26 - The NFDS shall be designed to provide the information necessary to support annunciation of the channel initiating a protective action to the operator.

DS input to TRPS safety functions are communicated to the PICS to alert the operators. The system architecture is shown in Figure 7.1-1.

2.2.10 Quality NFDS Criterion 27 - Controls over the design, fabrication, installation, and modification of the NFDS shall conform to the guidance of ANSI/ANS 15.8-1995 (ANSI/ANS, 1995), as endorsed by Regulatory Guide 2.5 (USNRC, 2010).

SI/ANS 15.8-1995 (ANSI/ANS, 1995) is applied to the NFDS by the SHINE Quality Assurance gram (Subsection 7.8.3.11). The SHINE Quality Assurance Program controls activities ted to the system design, fabrication, installation, and modification.

NFDS Criterion 28 - The quality of the components and modules in the NFDS shall be commensurate with the importance of the safety function to be performed.

ustry codes and standards are applied to the design of the NFDS to ensure quality in the ign of this safety-related system (Subsection 7.8.3.11). The NFDS is also designed for the mal and transient operating environments, as described in Subsections 7.8.3.6 and 7.8.3.7.

3 DESIGN BASES 3.1 Design Bases Functions NFDS measures the neutron flux in the TSV over three separate ranges: source range, er range, and wide range.

NE Medical Technologies 7.8-9 Rev. 2

source range measures low flux levels common to what would be expected during the filling he IU cell prior to irradiation of the target solution.

NFDS provides TRPS a count rate signal for TRPS to perform a trip determination upon ching the source range setpoint. The TRPS initiates an IU Cell Safety Actuation when two-of-three or more high source range neutron flux signals from NFDS are above their setpoint bsection 7.4.4).

NFDS transmits the following source range analog signal to the TRPS:

NFDS source range analytical limit for the high source range trip determination is:

Increasing at 2.52 times the nominal flux at 95 percent volume of the critical fill height source range neutron flux signal has an accuracy of less than or equal to 2 percent of the full ar scale.

3.1.2 Power Range power range measures high flux levels in the ranges that are expected when the neutron er is operating and irradiating the target solution.

NFDS transmits the following power range analog signal to the TRPS:

NFDS power range power range neutron flux signal is input to the safety-related trip determination by the TRPS.

TRPS initiates a Driver Dropout on low power range neutron flux, as described in section 7.4.4 and initiates an IU Cell Safety Actuation on high (power range) time-averaged tron flux, as described in Subsection 7.4.4.

power range neutron flux signal has a range of 0 percent to 125 percent of the licensed er limit and has an accuracy of less than or equal to 1 percent of the full linear scale.

3.1.3 Wide Range wide range neutron flux connects the gap between the source range and the power range overlap and is usable during both source and power range levels. The wide range neutron monitors percent power up to 250 percent of the licensed power limit.

NFDS transmits the following wide range analog signals to the TRPS:

NFDS wide range NE Medical Technologies 7.8-10 Rev. 2

cribed in Subsection 7.4.4.

wide range neutron flux signal has an accuracy of less than or equal to 1 percent of the full rithmic scale.

3.2 Simplicity NFDS is an analog system with no digital communications for simplicity. Communications the NFDS to the TRPS and PICS are continuous through isolated outputs. The output ation devices only allow for the data to be transmitted out of the system so that no failure from nterfacing system can affect the functions of the NFDS.

3.3 Single Failure NFDS is comprised of three redundant divisions of detectors, preamplifiers, and processing uits. A single failure of any one of the divisions will not affect the functionality of the other two undant divisions ensuring the required safety functions perform as designed during a design is event. Interfacing systems with the NFDS are downstream of the NFDS such that a failure n interfacing nonsafety system will not impact the NFDS.

3.4 Independence three divisions of the NFDS are physically and electrically independent of each other.

ectors are installed approximately 120 degrees equidistant around the SASS in relation to the et solution vessel. The detector cables are routed back to the control room in physically arated cable trays and raceways.

h division of the NFDS is capable of monitoring the neutron flux levels in the detector, reading amplifying the levels in the preamplifier, and processing the measurement readings within h division independently without aid of another NFDS division or external safety or nonsafety tem.

3.5 Loss of External Power NFDS is supplied power from the UPSS upon a loss of off-site power. The UPSS battery kup supplies power to the NFDS for a minimum of 10 minutes following a loss of off-site er.

NFDS is designed so that a failure due to loss of power to the NFDS or a removal of an DS channel interacts the same with the TRPS as if there was a positive trip determination in PS. The interaction between NFDS and TRPS is shown in Figure 7.4-1.

3.6 Operating Conditions NFDS control and logic functions are located inside the facility control room where the ironment is mild and not exposed to the irradiation process. The preamplifiers are located in RPF where operating conditions are a mild operating environment. The detectors are located NE Medical Technologies 7.8-11 Rev. 2

normal and transient environmental conditions present in areas where NFDS is located are vided in Table 7.2-2 through Table 7.2-4. The main production facility heating, ventilation, and conditioning (HVAC) systems are relied upon to maintain the temperature and humidity ameters in these areas. The main production facility HVAC systems are described in tion 9a2.1.

ing normal operation, the NFDS equipment will operate in the applicable normal radiation ironments identified in Table 7.2-1 for up to 20 years, and will be replaced at a frequency icient such that the radiation qualification of the affected components is not exceeded.

3.7 Equipment Qualification NFDS detectors are housed in a watertight assembly qualified for submergence to a depth o 16 feet.

DS rack mounted equipment is installed in a mild operating environment and is designed to et the normal and transient environmental conditions described in Subsection 7.8.3.6. Rack unted NFDS equipment is tested to appropriate standards to show that the effects of EMI/RFI power surges are adequately addressed. Appropriate grounding of the NFDS is performed in ordance with Section 5.2.1 of IEEE Standard 1050-2004 (IEEE, 2004b).

3.8 Natural Phenomena NFDS is qualified for operation during and after a seismic design basis event. The NFDS is lified using the guidance in IEEE Standard 344-2013 (IEEE, 2013) (Subsection 7.8.3.11).

NFDS components are located in the RPF, the IF, and facility control room. The facility trol room is located in a non-radiologically controlled seismic area. The RPF, IF, and the non-ologically controlled seismic area are classified as Seismic Class I structures (Section 3.4) provide protection from tornado and tornado missiles (Subsection 3.2.2.3). The main duction facility is protected from an external flood (Subsection 3.3.1.1.1).

3.9 Human Factors NFDS provides the following signals to the TRPS to transmit to the PICS for display to the rator:

Source range neutron flux

Wide range neutron flux

Power range neutron flux rator display criteria and design are addressed in Section 7.6.

NE Medical Technologies 7.8-12 Rev. 2

NFDS supports testing and calibration to ensure operability as required by the technical cifications. The NFDS is designed to allow operators to remove portions of the NFDS from vice when not required for operation without impacting NFDS components specific to other IU

s. As an all analog system, the only form of fault detection normally available is the source ge missing and power range missing discrete signals provided to the PICS.

3.11 Codes and Standards following codes and standards are applied to the NFDS design:

1) Section 8 of IEEE Standard 344-2013, IEEE Standard for Seismic Qualification of Equipment for Nuclear Power Generating Stations (IEEE, 2013); invoked as guidance to meet SHINE Design Criterion 16.

2) IEEE Standard 379-2000, IEEE Standard Application of the Single-Failure Criterion to Nuclear Power Generating Station Safety Systems (IEEE, 2000); invoked to meet SHINE Design Criterion 15, Protection system reliability and testability.

3) IEEE Standard 384-2008, IEEE Standard Criteria for Independence of Class 1E Equipment and Circuits (IEEE, 2008); invoked for separation of safety-related and nonsafety-related cables and raceways, as described in Subsection 8a2.1.3 and Subsection 8a2.1.5.

4) Section 5.2.1 of IEEE Standard 1050-2004, IEEE Guide for Instrumentation and Control Equipment Grounding in Generating Stations (IEEE, 2004b); invoked as guidance to support electromagnetic compatibility qualification for digital I&C equipment.

5) The guidance of ANSI/ANS 15.8-1995, Quality Assurance Program Requirements for Research Reactors (R2013) (ANSI/ANS, 1995), as endorsed by Regulatory Guide 2.5, Quality Assurance Program Requirements for Research and Test Reactors (USNRC, 2010), is applied as part of the SHINE Quality Assurance Program for complying with the programmatic requirements of 10 CFR 50.34(b)(6)(ii).

4 OPERATION AND PERFORMANCE NFDS supports safe and reliable operation of the SHINE facility and prevents a single failure defeating the intended NFDS functions.

4.1 Monitored Variables NFDS measures the flux over three separate ranges, source range, wide range, and power ge.

source range measures low flux levels common to what would be expected during the filling e prior to irradiation of the target solution.

power range measures high flux levels in the ranges that are expected when the neutron er is operating and irradiating the target solution.

wide range connects the gap between the source range and the power range with overlap is usable during both source and power range levels.

NE Medical Technologies 7.8-13 Rev. 2

es up to 1.0E+05 counts per second (cps). The inverse of the count rate can also be used to mate the critical fill level using the 1/M methodology.

he power range, the neutron flux is measured in terms of the design power levels of the TSV.

range of measurement of the power range is indicated as 0 percent to 125 percent.

wide range measurement monitors the power level in a logarithmic scale over 10 decades 2.5E-08 percent up to 250 percent covering the irradiation cycle both during deuterium-terium reactions and deuterium-tritium reactions.

4.2 Logic Processing Functions NFDS provides the following analog signals to the TRPS:

NFDS source range

NFDS wide range

NFDS power range NFDS also provides a source range missing and power range missing signal to the PICS use as an alarm to the operator in alerting that the NFDS is not operating properly.

TRPS transmits the analog signals as nonsafety-related signals to the PICS to display for rator use when monitoring conditions in the IU cells.

4.3 Technical Specifications and Surveillance iting Conditions for Operation and Surveillance Requirements are established for the NFDS e technical specifications. The neutron flux detector setpoints bound normal operations and ident conditions and provide margin to analytical limits.

5 CONCLUSION NFDS monitors neutron flux levels inside the target solution vessel to support safe operation he SHINE facility. The system design includes a high source range neutron flux trip ermination and neutron flux variables that are input to the TRPS for safety actuations. The DS also transmits signals to TRPS (Section 7.4) that are transmitted by TRPS as nonsafety-ted neutron flux values to the PICS for display to the operators.

system design incorporates independence and redundancy to ensure no single failure vents the NFDS from fulfilling its intended safety functions.

NE Medical Technologies 7.8-14 Rev. 2

SI, 1999. Sampling and Monitoring Releases of Airborne Radioactive Substances from the cks and Ducts of Nuclear Facilities, ANSI N13.1-1999, American National Standards Institute, 9.

SI/ANS, 1995. Quality Assurance Program Requirements for Research Reactors, SI/ANS 15.8-1995 (R2013), American National Standards Institute/American Nuclear Society, 5.

E, 2000. IEEE Standard Application of Single-Failure Criterion to Nuclear Power Generating tion Safety Systems, IEEE 379-2000, Institute of Electrical and Electronics Engineers, 2000.

E, 2004a. IEEE Standard for Software Verification and Validation, IEEE 1012-2004, Institute lectrical and Electronics Engineers, 2004.

E, 2004b. IEEE Guide for Instrumentation and Control Equipment Grounding in Generating tions, IEEE 1050-2004, Institute of Electrical and Electronics Engineers, 2004.

E, 2008. IEEE Standard Criteria for Independence of Class 1E Equipment and Circuits, E 384-2008, Institute of Electrical and Electronics Engineers, 2008.

E, 2013. IEEE Standard for Seismic Qualification of Equipment for Nuclear Power Generating tions, IEEE 344-2013, Institute of Electrical and Electronics Engineers, 2013.

Scale, 2017. NuScale Power, LLC Submittal of the Approved Version of NuScale Topical ort TR-1015-18653, Design of the Highly Integrated Protection System Platform, Revision 2 C No. RQ6005), NuScale Power, LLC, September 13, 2017 (ML17256A892).

NRC, 2010. Quality Assurance Program Requirements for Research and Test Reactors, ulatory Guide 2.5, Revision 1, U.S. Nuclear Regulatory Commission, June 2010.

NRC, 2017. Safety Evaluation by the Office of New Reactors, Licensing Topical Report

) 1015-18653-P (Revision 2), Design of the Highly Integrated Protection System Platform, cale Power, LLC, U.S. Nuclear Regulatory Commission, May 2017.

NE Medical Technologies 7.9-1 Rev. 1

ML20255A036

Contents

Text

SUMMARY

3.5 CONCLUSION

4.6 CONCLUSION

5.6 CONCLUSION

6.1 DESCRIPTION

6.5 CONCLUSION

7.6 CONCLUSION

8.5 CONCLUSION

SUMMARY

Navigation menu

ML20255A036

Text

SUMMARY

3.5 CONCLUSION

4.6 CONCLUSION

5.6 CONCLUSION

6.1 DESCRIPTION

6.5 CONCLUSION

7.6 CONCLUSION

8.5 CONCLUSION

SUMMARY

Navigation menu

Search