Text

Enclosure 7 - Technical Specifications
	ML20255A048
Person / Time
Site:	SHINE Medical Technologies
Issue date:	08/28/2020
From:	; SHINE Medical Technologies
To:	; Office of Nuclear Reactor Regulation
Shared Package
ML20255A026	List: ML20255A027; ML20255A028; ML20255A029; ML20255A030; ML20255A031; ML20255A032; ML20255A033; ML20255A034; ML20255A035; ML20255A036; ML20255A037; ML20255A038; ML20255A039; ML20255A040; ML20255A041; ML20255A042; ML20255A043; ML20255A044; ML20255A045; ML20255A046; ML20255A047; ML20255A048;
References
	2020-SMT-0081
	Download: ML20255A048 (138)
	v • d • e

ENCLOSURE 7 SHINE MEDICAL TECHNOLOGIES, LLC SHINE MEDICAL TECHNOLOGIES, LLC OPERATING LICENSE APPLICATION RESPONSE TO REQUEST FOR ADDITIONAL INFORMATION AND SUPPLEMENT NO. 3 TECHNICAL SPECIFICATIONS PUBLIC VERSION 137 pages follow

Appendix A to Facility License No.

Technical Specifications and Bases Revision No. 3 SHINE Medical Technologies, LLC Medical Isotope Production Facility Docket No. 50-608

Table of Contents 1.0 Introduction ..................................................................................................................1.0-1 1.1 Scope ....................................................................................................................... 1.0-1 1.2 Format ...................................................................................................................... 1.0-1 1.3 Definitions ................................................................................................................. 1.0-1 2.0 Safety Limits and Limiting Safety System Settings ...................................................... 1.3-1 2.1 Safety Limits ............................................................................................................. 2.1-1 2.2 Limiting Safety System Settings (LSSS) .................................................................. 2.2-1 3.0 Limiting Conditions for Operation and Surveillance Requirements .............................. 3.1-1 3.1 Irradiation Unit Parameters ....................................................................................... 3.1-2 3.2 Instrumentation and Control Safety Systems ........................................................... 3.2-1 3.3 Coolant Systems ...................................................................................................... 3.3-1 3.4 Confinement ............................................................................................................. 3.4-1 3.5 Ventilation Systems .................................................................................................. 3.5-1 3.6 Emergency Power .................................................................................................... 3.6-1 3.7 Radiation Monitoring Systems and Effluents ............................................................ 3.7-1 3.8 Facility-Specific ......................................................................................................... 3.8-1 4.0 Design Features ........................................................................................................... 4.0-1 4.1 Site and Facility Description ..................................................................................... 4.0-1 4.2 Coolant Systems ...................................................................................................... 4.0-2 4.3 Subcritical Assembly System and Target Solution ................................................... 4.0-2 4.4 Fissionable Material Storage .................................................................................... 4.0-3 5.0 Administrative Controls ................................................................................................ 5.0-1 5.1 Organization ............................................................................................................. 5.0-1 5.2 Review and Audit ...................................................................................................... 5.0-4 5.3 Radiation Safety ....................................................................................................... 5.0-6 5.4 Procedures ............................................................................................................... 5.0-6 5.5 Programs .................................................................................................................. 5.0-8 5.6 Experiments Review and Approval ......................................................................... 5.0-12 5.7 Required Actions .................................................................................................... 5.0-12 5.8 Reports ................................................................................................................... 5.0-13 5.9 Records .................................................................................................................. 5.0-15 Page i Revision 3

List of Tables Table 1.3 IU Modes of Operation .................................................................................. 1.0-2 Table 2.2 Limiting Safety System Settings .................................................................... 2.2-1 Table 3.1.1 TOGS Actions ................................................................................................ 3.1-2 Table 3.1.2 TSV Headspace Pressure Actions ................................................................ 3.1-3 Table 3.1.3 TSV Volume Actions ...................................................................................... 3.1-4 Table 3.1.4 Target Solution Temperature Actions ............................................................ 3.1-4 Table 3.1.5 TSV Dump Valve Actions .............................................................................. 3.1-5 Table 3.1.6 Power Density Limit Actions .......................................................................... 3.1-6 Table 3.1.7 Transient Average Power Density Actions..................................................... 3.1-8 Table 3.1.8 Required Minimum Hold Time ....................................................................... 3.1-8 Table 3.2.1 TRPS Logic and Actuation Actions ................................................................ 3.2-1 Table 3.2.2 ESFAS Logic and Actuation Actions .............................................................. 3.2-3 Table 3.2.3 TRPS Input Channel Actions ......................................................................... 3.2-5 Table 3.2.3-a TRPS Instrumentation ................................................................................... 3.2-6 Table 3.2.4 ESFAS Process Instrumentation Actions....................................................... 3.2-8 Table 3.2.4-a ESFAS Process Instrumentation ................................................................. 3.2-10 Table B-3.2.3 TRPS Input Variable Allocation .................................................................. B 3.2-6 Table B-3.2.4 ESFAS Input Variable Allocation.............................................................. B 3.2-14 Table 3.3.1 Light Water Pool Level Actions ...................................................................... 3.3-1 Table 3.4.1 Confinement Boundary and Isolation Actions ................................................ 3.4-1 Table 3.4.1-a Isolation Valves .............................................................................................. 3.4-2 Table 3.4.2 Confinement Check Valve Actions ................................................................ 3.4-3 Table 3.4.2-a Confinement Check Valves ........................................................................... 3.4-3 Table 3.4.3 TPS Glovebox Confinement Boundary Valve Actions ................................... 3.4-4 Table 3.4.3-a TPS Glovebox Confinement Valves .............................................................. 3.4-4 Table 3.4.4 Supercell Confinement Damper Actions ........................................................ 3.4-5 Table 3.4.4-a Supercell Confinement Dampers ................................................................... 3.4-6 Table 3.5.1 PVVS Actions ................................................................................................ 3.5-1 Table 3.5.1-a PVVS Tank Flowrates .................................................................................... 3.5-2 Table 3.6.1 UPSS Actions ................................................................................................ 3.6-1 Table 3.6.2 Safety-Related Breakers Actions ................................................................... 3.6-2 Table 3.6.2-a Safety-Related Breakers ................................................................................ 3.6-2 Table 3.7.1 Safety-Related Radiation Monitor Actions ..................................................... 3.7-1 Table 3.7.1-a Safety-Related Radiation Monitoring Instruments ......................................... 3.7-2 Page ii Revision 3

Table 3.7.2 Gaseous Effluents Actions ............................................................................. 3.7-4 Table B-3.7.1 Safety-Related Radiation Monitoring Input Allocation ............................... B 3.7-1 Table 3.8.1 Nitrogen Purge System Actions ..................................................................... 3.8-1 Table 3.8.4 Waste Tank Uranium Concentration Actions ................................................. 3.8-4 Table 3.8.6 Target Chamber Pressure Actions ................................................................ 3.8-5 Table 3.8.7 TPS Glovebox Atmosphere Actions .............................................................. 3.8-6 Table 3.8.8 TPS SEC Actions ........................................................................................... 3.8-7 Table 3.8.9 RCA Isolation Damper Actions ...................................................................... 3.8-7 Table 3.8.9-a RCA Isolation Dampers ................................................................................. 3.8-8 Table 3.8.10 Safety Related Valves Actions ....................................................................... 3.8-9 Table 3.8.10-a Automatically-Actuated Safety-Related Valves ........................................... 3.8-11 Table 3.8.11 Safety-related Check Valve Actions ............................................................ 3.8-13 Table 3.8.11-a Safety-Related Check Valves...................................................................... 3.8-14 Table 5.5.4 Controls ........................................................................................................ 5.0-9 List of Figures Figure 2.1.1 PSB Low Temperature Portion Safety Limit .................................................. 2.1-1 Figure 3.1.6 Target Solution Average Power Density vs Temperature .............................. 3.1-7 Figure 3.8.3 Target Solution Catalyst Concentration vs pH ............................................... 3.8-3 Figure 5.1.1 SHINE Operational Organization Chart ......................................................... 5.0-2 Page iii Revision 3

1.0 Introduction 1.1 Scope This document constitutes the technical specifications for the SHINE Medical Isotope Production Facility, as required by 10 CFR 50.36, and supersedes all prior technical specifications. This document includes the bases to support the selection and significance of the specifications. The technical specifications employ the applicable features of the guidance provided in NUREG-1537, Part 1, Appendix 14.1, as modified by the Final Interim Staff Guidance (ISG) Augmenting NUREG-1537, and the updated national standard endorsed therein: ANSI/ANS 15.1-2007, The Development of Technical Specifications for Research Reactors.

1.2 Format The format of this document follows the guidance provided in NUREG-1537 and ANSI/ANS 15.1-2007, with the exception that limiting conditions for operation (LCOs) and surveillance requirements (SRs) are combined into a single section (i.e., Section 3.0) to achieve better clarity and improved human performance.

1.3 Definitions Channel Calibration: A Channel Calibration is an adjustment of the channel such that its output corresponds with acceptable accuracy to known values of the parameter that the channel measures. Calibration shall encompass the entire channel, including equipment actuation, alarm, or trip and shall include a Channel Test.

Channel Check: A Channel Check is a qualitative verification of acceptable performance by observation of channel behavior or verification of the absence of Channel Check alarms from systems performing an equivalent automatic verification. This verification, where possible, shall include comparison of the channel with other independent channels or systems measuring the same variable.

Channel Test: A Channel Test is the introduction of a signal into the channel for verification that it is Operable.

Confinement: Confinement is an enclosure that is designed to limit the release of effluents between the enclosure and its external environment by use of a sealed low-leakage barrier, and through controlled or defined pathways.

Division: The designation applied to a given system or set of components that enables the establishment and maintenance of physical, electrical, and functional independence from other redundant sets of components.

Facility Secured (Secured): The SHINE Facility is Secured when the following conditions are met:

1. Each Irradiation Unit is in a Safe Shutdown condition.

2. No work is in progress involving special nuclear material, and unirradiated special nuclear material is in a safe storage location.

3. Target solution hydrogen generation rates are below those requiring preventive controls.

Page 1.0-1 Revision 3

Irradiation Unit (IU): An IU is an accelerator-driven subcritical Operating assembly used for the irradiation of an aqueous uranyl sulfate target solution, resulting in the production of molybdenum-99 (Mo-99) and other fission products.

IU Mode: The IU is designed to remain in the subcritical operating region in all Operating Modes. There are five Modes (0-4) of operation for an IU. Each Mode has defined interlocks and permissives in the safety-related and/or nonsafety-related control systems, the target solution vessel (TSV) reactivity protection system (TRPS) and the process integration control system (PICS), respectively. IU Modes of operation are defined in Table 1.3.

Table 1.3 IU Modes of Operation Neutron Driver Mode Title TSV Fill Valves TSV Dump Valves Status 0 Solution Removed Not Operating Open/Closed Open/Closed 1 Startup Not Operating Open/Closed Closed 2 Irradiation Operation Allowed Closed Closed Shutdown/

3 Not Operating Open/Closed Open Post-Irradiation 4 Transfer to RPF Not Operating Open/Closed Open License: The written authorization, by the responsible authority, for an individual or organization to carry out the duties and responsibilities associated with a personnel position, material, or facility requiring licensing.

Licensed Operator: An individual who is Licensed to manipulate the controls of an IU.

Operable: Operable means a component or system is capable of performing its intended function.

Operating: Operating means a component or system is performing its intended function.

Primary System Boundary (PSB): The PSB means the TSV, TSV dump tank, TSV off-gas system (TOGS), and associated components that enclose target solution and fission product gases during the irradiation process.

Protective Action: Protective Action is the initiation of a signal or the operation of equipment within the safety system in response to a parameter or condition of the facility having reached a specified limit.

Page 1.0-2 Revision 3

Safe Shutdown: An IU is in a Safe Shutdown condition if the following performance criteria are achieved and maintained:

A. Target solution is not present:

No target solution is present in the IU AND TSV fill valves are closed.

OR B. Target solution is present:

Target solution is drained from the TSV AND Hydrogen is controlled:

Nitrogen purge system (N2PS) is Operable OR Target solution hydrogen generation rates are below those requiring preventive controls.

Safety Systems: Safety Systems, or safety-related control systems, are those systems, including their associated input channels, that are designed to initiate automatic protection or to provide information for initiation of manual Protective Action.

Senior Licensed Operator: An individual who is Licensed to direct the activities of Licensed Operators. Such an individual is also a Licensed Operator.

SHINE Facility: The area within the site boundary where the Shift Supervisor has direct authority over all activities. The controlled access area fence and the perimeter walls of the main production facility, the material staging building, the storage building, and the resource building are the extent of the SHINE Facility.

Should, Shall, and May: The word "shall" is used to denote a requirement; the word "should" is used to denote a recommendation; and the word "may" denotes permission, neither a requirement nor a recommendation.

Surveillance Intervals: Allowable surveillance intervals shall not exceed the following:

Quinquennially (Every five years) interval not to exceed 72 months Biennially (Every two years) interval not to exceed 30 months Annually interval not to exceed 15 months Semi-annually interval not to exceed 7.5 months Quarterly interval not to exceed 4 months Monthly interval not to exceed 6 weeks Weekly interval not to exceed 10 days Daily interval not to exceed 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months Hourly interval not to exceed 75 minutes Unscheduled Shutdown: An Unscheduled Shutdown is defined as any unplanned shutdown of an IU caused by actuation of a safety system, operator error, equipment malfunction, or a manual shutdown in response to conditions that could adversely affect safe operation, not including shutdowns that occur during testing or checkout operations.

Page 1.0-3 Revision 3

2.0 Safety Limits and Limiting Safety System Settings 2.1 Safety Limits Objective: To protect physical barriers that guard against the uncontrolled release of radioactivity.

The combination of differential pressure across the low temperature portion of the PSB and the wall temperature averaged through the thickness shall be within the Acceptable region defined by Figure 2.1.1.

AND Average wall temperature for the low temperature portion of the PSB shall be 950 degrees Fahrenheit (°F) for differential pressure 95 pounds per square inch (psi).

Applicability This safety limit applies at all times to the differential pressure and the wall temperature of the low temperature section of the PSB. The low temperature portion of the PSB includes all PSB components except the hydrogen recombiner housings, the recombiner condensers, the piping between the recombiners and the recombiner condensers, and the piping between the recombiner condensers and the TSV.

Figure 2.1.1 PSB Low Temperature Portion Safety Limit 120 115 Pressure (psi) 110 Unacceptable 105 Acceptable 100 95 0 100 200 300 400 500 600 700 800 900 1000 Temperature (°F)

Page 2.1-1 Revision 3

The differential pressure across the high temperature portion of the PSB shall be 115 psi and the wall temperature averaged through the thickness shall be 950°F.

Applicability This safety limit applies at all times to the differential pressure and the wall temperature of the high temperature portion of the PSB. The high temperature portion of the PSB includes the hydrogen recombiner housings, the recombiner condensers, the piping between the recombiners and the recombiner condensers, and the piping between the recombiner condensers and the TSV.

The pressure within process tanks containing irradiated uranyl sulfate in the radioisotope production facility (RPF) and connected piping up to the first valve shall be 18 psi gauge (psig).

Applicability This specification applies at all times to the gauge pressure within the irradiated uranyl sulfate process tanks in the RPF. This specification also applies to piping and piping components, up to the first valve, that share a pressure boundary with the irradiated uranyl sulfate process tanks.

Page 2.1-2 Revision 3

Basis 2.1.1 The PSB consists primarily of American Society of Mechanical Engineers (ASME) Boiler & Pressure Vessel Code (BPVC),Section VIII pressure vessels and ASME B31.3 piping. The principal failure modes for pressure vessels and pipes are excessive pressure and temperature. If pressures are too high within a vessel or pipe, the stresses induced could exceed the allowable conditions of the material of construction, and the vessel or pipe could yield or rupture. A rupture would result in an uncontrolled release of fission product inventory.

High temperatures will decrease the strength of the material, resulting in a reduction of the pressure retaining ability of the vessel or pipe. Excessively high temperatures, concurrent with pressure loading, could result in loss of pressure boundary integrity followed by an uncontrolled release of fission product inventory.

The design pressure of the PSB is 100 psi (689 kPa). Per Section VIII of the ASME BPVC, overpressure protection prevents the pressure from rising more than 16% above the design pressure. To ensure integrity, PSB components are hydrostatically tested at not less than 130% of design pressure.

PSB components, except the hydrogen recombiner housings, the recombiner condensers, the piping between the recombiners and the recombiner condensers, and the piping between the recombiner condensers and the TSV, have a design temperature of 200°F (93.3°C). The safe pressure at temperatures above the design temperature was determined based on the reduction in allowable stress of the material of construction at elevated temperatures. PSB characteristics are described in Final Safety Analysis Report (FSAR) Section 4a2.2.

Basis 2.1.2 The PSB consists primarily of ASME BPVC,Section VIII pressure vessels and ASME B31.3 piping. The principal failure modes for pressure vessels and pipes are excessive pressure and temperature. If pressures are too high within a vessel or pipe, the stresses induced could exceed the allowable conditions of the material of construction, and the vessel or pipe could yield or rupture. A rupture would result in an uncontrolled release of fission product inventory.

High temperatures will decrease the strength of the material, resulting in a reduction of the pressure retaining ability of the vessel or pipe Excessively high temperatures concurrent with pressure loading could result in loss of pressure boundary integrity followed by an uncontrolled release of fission product inventory.

The design pressure of the PSB is 100 psi (689 kPa). Per Section VIII of the ASME BPVC, overpressure protection prevents the pressure from rising more than 16% above the design pressure. To ensure integrity, PSB components are hydrostatically tested at not less than 130% of design pressure.

The portions of the PSB consisting of the hydrogen recombiner housings, the recombiner condensers, the piping between the recombiners and the recombiner condensers, and the piping between the recombiner condensers and the TSV have a design temperature of 650°F (343.3°C). The safe pressure at temperatures above the design temperature was determined based on the reduction in allowable stress of the material of construction at elevated temperature. PSB characteristics are described in FSAR Section 4a2.2.

Page B 2.1-1 Revision 3

Basis 2.1.3 The process tanks containing irradiated uranyl sulfate consist of the target solution staging system (TSSS), radioactive liquid waste storage (RLWS) system, radioactive liquid waste immobilization (RLWI) system, and radioactive drain system (RDS) tanks. The process tanks containing irradiated uranyl sulfate are non-code-stamped tanks designed and fabricated following the rules for pressure vessels in ASME BPVC Section VIII. The principal failure modes for pressure vessels and pipes are excessive pressure and temperature.

If pressures are too high within a tank or piping, the stresses induced could exceed the allowable conditions of the material of construction and the tank or piping could yield or rupture. A rupture would result in an uncontrolled release of fission product inventory. A change in geometry of a tank (e.g., plastic deformation) could place the vessel outside of criticality safety analysis inputs and assumptions.

The irradiated uranyl sulfate process tanks are not exposed to high heat sources, such as fission processes or hydrogen recombiners, so a temperature limit is not required to assure pressure boundary integrity.

The design pressure of the irradiated target solution process tanks in the RPF is 15 psi (103 kPa). Per Section VIII of the ASME BPVC, overpressure protection prevents the pressure from rising more than 3 psi (20.7 kPa) above the design pressure. To ensure integrity, the process tanks containing irradiated uranyl sulfate are hydrostatically tested at not less than 130% of design pressure (19.5 psig [134 kPa gauge]).

Page B 2.1-2 Revision 3

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3) 2.2 Limiting Safety System Settings (LSSS)

Objective: To ensure that automatic Protective Action is initiated before exceeding a safety limit.

Table 2.2 Limiting Safety System Settings LSSS Variable Setpoint Applicability LSSS 2.2.1 High wide range 176% power Modes 1 and 2 neutron flux LSSS 2.2.2 High time-averaged 85% power; averaged Modes 1 and 2 power range over 45 seconds neutron flux LSSS 2.2.3 High source range 1.5 times the nominal Mode 1 neutron flux flux at 95% volume of the critical fill height LSSS 2.2.4 Low TOGS [ Modes 1, 2, 3, and 4 mainstream flow ]PROP/ECI LSSS 2.2.5 Low TOGS dump [ ]PROP/ECI Modes 1, 2, 3, and 4 tank flow LSSS 2.2.6 High-high TSV 85% Modes 1, 2, 3, and 4 dump tank level LSSS 2.2.7 Low primary closed [ Modes 1 and 2 loop cooling system ]PROP/ECI; IU Cell (PCLS) flow Safety Actuation delayed by 180 seconds LSSS 2.2.8 High PCLS 72.9°F; IU Cell Safety Modes 1 and 2 temperature Actuation delayed by 180 seconds LSSS 2.2.9 Low process vessel 7.1 SCFM Facility not Secured vent system (PVVS) flow Page 2.2-1 Revision 3

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)

Basis 2.2.1 The high wide range neutron flux limit is set at a neutron flux equivalent to 176%

fission power (i.e., 219.5 kilowatt (kW)). This limit provides margin to an analytical limit of 240% fission power (i.e., 300 kW). Additional discussion of TSV power analyses and the high wide range neutron flux limit is provided in FSAR Subsections 4a2.6.3.6, and 7.4.4.1.4. This LSSS prevents overheating of the target solution, which could lead to boiling and pressurization of the vessel, protecting the PSB pressure safety limit. See also the basis for LCO 3.2.3, item a., for additional discussion of this limit.

Basis 2.2.2 The high time-averaged power range neutron flux limit is set at a neutron flux equivalent to 85% fission power (i.e., 106.25 kW). This limit provides margin to an analytical limit of 104% fission power (i.e., 130 kW) and ensures that the TSV power does not exceed analyzed conditions related to thermal hydraulic considerations, radiolytic gas generation, or fission product source term.

Additional discussion of TSV power analyses and the high time-averaged power range neutron flux limit is provided in FSAR Subsections 4a2.6.3.6 and 7.4.4.1.3.

This LSSS prevents overheating of the target solution, which could lead to boiling and pressurization of the vessel, protecting the PSB pressure safety limit. This LSSS also prevents the buildup of hydrogen that could result in a hydrogen deflagration that could exceed the PSB pressure safety limit. See also the basis for LCO 3.2.3, item b., for additional discussion of this limit.

Basis 2.2.3 The high source range neutron flux limit is set to a neutron flux equivalent to 1.5 times the nominal flux at 95% by volume of the critical fill height. This limit provides margin to an analytical limit of [ ] PROP/ECI times the nominal flux at 95% by volume of the critical fill height, as described in FSAR Subsections 4a2.6.2.7 and 7.4.4.1.1. This LSSS protects against a sudden increase in reactivity during the fill process, which could cause pressurization of the vessel, and therefore protects the PSB pressure safety limit. See also the basis for LCO 3.2.3, item c., for additional discussion of this limit.

Basis 2.2.4 The low TOGS mainstream flow limit is based on an analytical limit of

[ ]PROP/ECI (defined at 68°F [20°C] and 1 atmosphere (atm) [101 kPa]),

which has been conservatively calculated to be sufficient to maintain hydrogen concentration within the TSV headspace of less than 4.0% during normal operations. Maintaining a hydrogen concentration below 7.7% prevents a deflagration that could challenge PSB integrity, as described in FSAR Subsections 4a2.8.6 and 7.4.4.1.11. This LSSS prevents the buildup of hydrogen that could result in a hydrogen deflagration that could exceed the PSB pressure safety limit. See also the basis for LCO 3.2.3, item i., for additional discussion of this limit.

Basis 2.2.5 The low TOGS dump tank flow limit is based on an analytical limit of [

]PROP/ECI (defined at 68°F [20°C] and 1 atm [101 kPa]), which has been conservatively calculated to be sufficient to maintain hydrogen concentration within the TSV dump tank of less than 4.0% during normal operations.

Page B 2.2-1 Revision 3

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)

Maintaining a hydrogen concentration below 7.7% prevents a deflagration that could challenge PSB integrity, as described in FSAR Subsections 4a2.8.6 and 7.4.4.1.12. This LSSS prevents the buildup of hydrogen that could result in a hydrogen deflagration that could exceed the PSB pressure safety limit. See also the basis for LCO 3.2.3, item j., for additional discussion of this limit.

Basis 2.2.6 The high-high TSV dump tank level limit is based on an analytical limit of [

]PROP/ECI, which equates to 87.9% of the [

]PROP/ECI span of the tank. The TSV dump tank high-high level ensures the TSV dump tank solution height does not obstruct the required TOGS gas flow area, as described in FSAR Subsection 7.4.4.1.9. Maintaining the TSV dump tank solution height below the specified maximum value is also required to provide adequate hydrogen dilution volume in the TSV dump tank headspace for transient conditions. Lack of adequate headspace in the TSV dump tank may lead to a hydrogen deflagration that could challenge the PSB pressure safety limit. See also the basis for LCO 3.2.3, item h., for additional discussion of this limit.

Basis 2.2.7 The low PCLS flow limit is based on an analytical limit of [

]PROP/ECI, as described in FSAR Subsection 4a2.7.9. PCLS is required to maintain cooling to the TSV during irradiation, as described in FSAR Subsection 7.4.4.1.7. The time delay prior to an IU Cell Safety Actuation is based on the acceptability of a complete loss of cooling without neutron driver operation for up to three minutes prior to transferring target solution to the TSV dump tank, as described in FSAR Subsection 4a2.7.3. This LSSS prevents overheating of the target solution, which could lead to boiling and pressurization of the vessel, protecting the PSB pressure safety limit. See also the basis for LCO 3.2.3, item e., for additional discussion of this limit.

Basis 2.2.8 The high PCLS temperature limit is based on an analytical limit of 77°F (25°C),

as described in FSAR Subsection 4a2.7.9. PCLS is required to maintain cooling to the TSV during irradiation, as described in FSAR Subsection 7.4.4.1.5. The time delay prior to an IU Cell Safety Actuation is based on the acceptability of a complete loss of cooling without neutron driver operation for up to three minutes prior to transferring target solution to the TSV dump tank, as described in FSAR Subsection 4a2.7.3. This LSSS prevents overheating of the target solution, which could lead to boiling and pressurization of the vessel, protecting the PSB pressure safety limit. See also the basis for LCO 3.2.3, item f., for additional discussion of this limit.

Basis 2.2.9 PVVS flow through RPF tanks is required to dilute radiolytic hydrogen generated from irradiated target solution and radioactive liquid waste located in tanks in the RPF. The low PVVS flow limit of 7.1 SCFM is based on an analytical limit of 5.0 SCFM, which is calculated to prevent the concentration of hydrogen in RPF tanks from exceeding 3.0% by volume. Maintaining this hydrogen concentration provides margin to the lower flammability limit of 4.0%. Indication of low PVVS flow results in an RPF Nitrogen Purge Actuation, as described in Page B 2.2-2 Revision 3

FSAR Subsection 7.5.4.1.15. This LSSS ensures the hydrogen mitigation function is maintained, preventing a deflagration in an RPF tank that could challenge the RPF tank pressure safety limit. See also the basis for LCO 3.2.4, item e., for additional discussion of this limit.

Page B 2.2-3 Revision 3

3.0 Limiting Conditions for Operation and Surveillance Requirements Limiting conditions for operation (LCO) are those administratively established constraints on equipment and operational characteristics that shall be adhered to during operation of the facility. The LCOs are the lowest functional capability or performance level required for safe operation of the facility. Deviations from LCOs may be allowed under specified conditions stated in the LCO.

LCOs shall be met during the specified conditions in the applicability.

Upon discovery of a failure to meet an LCO, the actions of the applicable portion of the LCO shall be met. If the LCO is met or is no longer applicable prior to expiration of the specified completion time(s), completion of the associated action(s) is not required unless otherwise specified.

When an LCO is not met and the associated actions are not met, an associated action is not provided, or if directed by the associated action(s), action shall be initiated within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months to shut down or return the affected processes to normal conditions.

LCOs are accompanied by surveillance requirements (SR) that prescribe the frequency and scope of surveillance to demonstrate minimum performance levels established by the associated LCO.

SRs shall be met during the specified conditions in the applicability for individual LCOs, unless otherwise stated in the SR. Failure to meet a surveillance, whether such failure is experienced during the performance of the surveillance or between performances of the surveillance, shall be failure to meet the LCO. Failure to perform a surveillance within the specified frequency shall be failure to meet the LCO except as provided below. Surveillances do not have to be performed on inoperable equipment or variables outside specified limits.

Surveillances shall be performed within the specified frequency. The specified frequency for each SR is met if the surveillance is performed within the applicable Surveillance Interval.

Maximum allowable intervals defined in Section 1.3 are to provide operational flexibility only and are not used to reduce frequency.

If it is discovered that a surveillance was not performed within its specified frequency, then compliance with the requirement to declare the LCO not met may be delayed, from the time of discovery, up to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . This delay period is permitted to allow performance of the surveillance. If the surveillance is not performed within the delay period, the LCO must immediately be declared not met, and the applicable action(s) must be completed.

In general, the SRs established herein conform to the guidance of ANSI/ANS 15.1-2007 and the assumptions used in the accident analyses underlying statements in the FSAR.

Surveillance requirements may be deferred when outside the condition of applicability, unless specifically noted in the SR.

Surveillance requirements that establish operability shall be met and within their specified frequency prior to entering the condition of applicability.

Page 3.1-1 Revision 3

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3) 3.1 Irradiation Unit Parameters Objective: To ensure the IU remains within analyzed conditions.

LCO 3.1.1 TOGS shall be Operable. TOGS is considered Operable if:

1. Both Train A and Train B blowers are Operating,

2. Power is supplied to both Train A and Train B recombiner heaters, and

3. Mainstream flow, dump tank flow, oxygen concentration, and condenser demister outlet temperature meet the conditions specified in Table 3.2.3-a for both Train A and Train B.

Note - This LCO is applied to each IU independently; actions are only applicable to the IU(s) that fail to meet the LCO during the associated condition(s) of applicability.

Applicability According to Table 3.1.1 Action According to Table 3.1.1 SR 3.1.1 Check that both TOGS trains are Operating prior to entering Mode 1.

Table 3.1.1 TOGS Actions Applicability Action Completion (per IU) (per IU) Time

1. Mode 1 or 2 If TOGS Train B is not Operable, Place the associated IU in Mode 3. Immediately

2. Mode 1 or 2 If TOGS Train A or both trains are not Operable, Place the associated IU in Mode 3 Immediately AND Actuate an IU Cell Nitrogen Purge for the Immediately associated IU.

3. Mode 3 or 4 If TOGS Train B is not Operable, Place the associated IU in Mode 0 [ ]PROP/ECI

4. Mode 3 or 4 If TOGS Train A or both trains are not Operable, Actuate an IU Cell Nitrogen Purge for the Immediately associated IU.

Page 3.1-2 Revision 3

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)

LCO 3.1.2 The pressure in the TSV headspace shall be (-) 4.5 psig and (+) 0.3 psig.

Note - This LCO is applied to each IU independently; actions are only applicable to the IU(s) that fail to meet the LCO during the associated condition(s) of applicability.

Applicability Associated IU in Mode 1 or 2 Action According to Table 3.1.2 SR 3.1.2 1. A Channel Check shall be performed on the TOGS pressure instrumentation quarterly.

2. A Channel Calibration shall be performed on the TOGS pressure instrumentation annually.

Table 3.1.2 TSV Headspace Pressure Actions Action Completion (per IU) Time

1. If TSV headspace pressure is not within limits Place the associated IU in Mode 3. 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months LCO 3.1.3 Target solution volume in the TSV shall be [ ]PROP/ECI.

Note - This LCO is applied to each IU independently; actions are only applicable to the IU(s) that fail to meet the LCO during the associated condition(s) of applicability.

Applicability Associated IU in Mode 2 Action According to Table 3.1.3 SR 3.1.3 1. Verify the minimum target solution volume in the TSV is achieved prior to transition to Mode 2.

2. A Channel Check shall be performed on the TSV level indication quarterly.

3. A Channel Calibration shall be performed on the TSV level indication annually.

Page 3.1-3 Revision 3

Table 3.1.3 TSV Volume Actions Action Completion (per IU) Time

1. If the volume of target solution in the TSV is less than the minimum volume, Place the associated IU in Mode 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months LCO 3.1.4 The average temperature of the target solution within the TSV shall be 176°F.

Note - This LCO is applied to each IU independently; actions are only applicable to the IU(s) that fail to meet the LCO during the associated condition(s) of applicability.

Applicability Associated IU in Mode 2 Action According to Table 3.1.4 SR 3.1.4 1. A Channel Check shall be performed on the TSV temperature indication quarterly.

2. A Channel Calibration shall be performed on the TSV temperature indication annually.

Table 3.1.4 Target Solution Temperature Actions Action Completion (per IU) Time

1. If target solution temperature is not below the limit, Place the associated IU in Mode 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Page 3.1-4 Revision 3

LCO 3.1.5 Both TSV dump valves shall be Operable. TSV dump valves are considered Operable if:

1. Each valve is capable of fully opening within two seconds of demand.

AND

2. Each dump line flow path is capable of draining the TSV from 95% full within 250 seconds of demand.

Note - This LCO is applied to each IU independently; actions are only applicable to the IU(s) that fail to meet the LCO during the associated condition(s) of applicability.

Applicability Associated IU in Mode 1 or 2 Action According to Table 3.1.5 SR 3.1.5 1. Verify each TSV dump valve opens in 2 seconds of demand quarterly.

2. Verify the drain time of each TSV dump line is 250 seconds when the TSV is 95% full quarterly.

Table 3.1.5 TSV Dump Valve Actions Action Completion (per IU) Time

1. If one or more TSV dump valve(s) are not Operable, Place the associated IU in Mode 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Page 3.1-5 Revision 3

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)

LCO 3.1.6 Temperature and average power density of the target solution in the TSV shall be within the Acceptable region of Figure 3.1.6, defined by the following equation:

Power Density Limit (kW/L) = [

] PROP/ECI Note - This LCO does not apply during loss of driver and restart transients, see LCO 3.1.7 for the transient average power density limit.

Note - This LCO is applied to each IU independently; actions are only applicable to the IU(s) that fail to meet the LCO during the associated condition(s) of applicability.

Applicability Associated IU in Mode 2 Action According to Table 3.1.6 SR 3.1.6 Verify temperature and average power density of the target solution in the TSV is within the Acceptable region of Figure 3.1.6 hourly.

Note - This SR is only required to be performed during power ramp up [

] PROP/ECI.

Table 3.1.6 Power Density Limit Actions Action Completion (per IU) Time

1. If the power density-temperature conditions are not within the acceptable region, Place the associated IU in Mode 3. Immediately Page 3.1-6 Revision 3

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)

Figure 3.1.6 Target Solution Average Power Density vs Temperature PROP/ECI Page 3.1-7 Revision 3

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)

LCO 3.1.7 Transient average power density of target solution within the TSV shall be

[ ]PROP/ECI.

Note - This LCO is applied to each IU independently; actions are only applicable to the IU(s) that fail to meet the LCO during the associated condition(s) of applicability.

Applicability Associated IU in Mode 2 Action According to Table 3.1.7 SR 3.1.7 Verify transient average power density of the target solution in the TSV did not exceed [ ]PROP/ECI following any driver restart after a loss of driver event.

Table 3.1.7 Transient Average Power Density Actions Action Completion (per IU) Time

1. If the transient average power density limit is exceeded, Place the associated IU in Mode 3. Immediately LCO 3.1.8 Target solution shall be held in the TSV dump tank for the required minimum hold time specified in Table 3.1.8 if the target solution batch has been irradiated at > 1 effective full power minute during the immediately preceding irradiation cycle.

Applicability Mode 4 SR 3.1.8 Verify the minimum hold time requirement has been achieved prior to transfer of target solution from the TSV dump tank.

Table 3.1.8 Required Minimum Hold Time Maximum Historical Irradiation Power Required Minimum Hold Time

> 0 kW but 10 kW [ ]PROP/ECI

> 10 kW but 70 kW [ ]PROP/ECI

> 70 kW [ ]PROP/ECI Page 3.1-8 Revision 3

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)

Basis 3.1.1 LCO This LCO is applied to each IU independently; actions are only applicable to the IU(s) that fail to meet the LCO during the associated condition(s) of applicability.

The TOGS serves to maintain hydrogen in the PSB below the lower flammability limit and to maintain iodine concentrations within analyzed limits, as described in FSAR Section 4a2.8. TOGS is designed with two off-gas recirculation trains per IU, that protect against unacceptable deflagrations resulting from TOGS equipment failures.

Hydrogen concentrations in TOGS are normally less than 2.0%. The TOGS blower minimum flowrate is set to maintain hydrogen concentration below the lower flammability limit of 4.0% and ensures a deflagration risk is not present in the TOGS, as described in FSAR Subsection 4a2.8.6. TOGS provides the ability to recombine hydrogen and oxygen through electrically heated recombiners.

During irradiation startup, hydrogen is expected to evolve from the target solution more quickly than oxygen; therefore, TOGS also provides the function to inject oxygen during irradiation as required to support the hydrogen recombination function.

While mainstream flow is provided by both TOGS trains, dump tank flow is only provided by TOGS Train A. Iodine removal via the installed zeolite bed is only provided by TOGS Train B. Both TOGS trains are required to be Operating to provide the required functions. The TOGS hydrogen mitigation function is not required when target solution is not present in the IU (Mode 0).

The TOGS is considered Operable when both blowers are Operating, power is supplied to the recombiner heaters, and mainstream flow, dump tank flow, oxygen concentration, and condenser demister outlet temperature meet their specified conditions in LCO 3.2.3 (Table 3.2.3-a).

If TOGS Train B is not Operable in Mode 1 or 2, the associated IU is placed in Mode 3 immediately to stop the irradiation process and limit the generation of hydrogen, although hydrogen generation continues in the TSV dump tank via radiolysis generated by radioactive decay. The immediate completion time reflects the importance of ensuring hydrogen generation is controlled. Actuation of the nitrogen purge system is not required because TOGS Train A is designed to provide hydrogen mitigation of the TSV dump tank.

If TOGS Train A or both trains are not Operable in Mode 1 or 2, the associated IU is placed in Mode 3 immediately to stop the irradiation process, although hydrogen generation continues in the TSV dump tank via radiolysis generated by radioactive decay. The nitrogen purge system is required to be actuated for the affected IU immediately to provide the hydrogen mitigation function that has been lost.

If TOGS Train B is not Operable in Mode 3 or 4, the associated IU is placed in Mode 0 within [ ]PROP/ECI to remove target solution from the dump tank and to place the solution in a location within the RPF where the hydrogen mitigation function is provided by PVVS. This completion time allows for the required decay of short-lived fission products (typically [ ]PROP/ECI) prior to the completion of solution transfer out of the IU, as well as additional time to complete the solution Page B 3.1-1 Revision 3

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3) transfer in an orderly manner. The completion time is acceptable due to the continued availability of TOGS Train A and the nitrogen purge system.

If TOGS Train A or both trains are not Operable in Mode 3 or 4, the nitrogen purge system is required to be actuated for the affected IU immediately to provide the hydrogen mitigation function that has been lost.

SR The surveillance requirement ensures both TOGS trains are Operating prior to the introduction of target solution into the TSV (Mode 1).

Basis 3.1.2 LCO This LCO is applied to each IU independently; actions are only applicable to the IU(s) that fail to meet the LCO during the associated condition(s) of applicability.

The PSB is normally maintained at slightly negative pressure. The lower TSV headspace pressure limit prevents excessive water uptake into TOGS via increased evaporation. The upper pressure limit corresponds to the initial conditions from a postulated deflagration event, as described in FSAR Subsection 13a2.1.9. The postulated deflagration causes a rapid pressure increase above the initial pressure in the PSB. By maintaining the maximum operating pressure below the LCO limit, the maximum credible deflagration peak pressure remains below the design pressure of the PSB. The limit prevents excessive pressure within the PSB that could result in a PSB leak or rupture.

These scenarios are further described in FSAR Section 4a2.8 and Subsection 13a2.1.9.

If the pressure is not within allowable limits, the associated IU is placed in Mode 3 within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months to remove target solution from the TSV and to limit hydrogen generation in the IU. This completion time recognizes the importance of minimizing the time when pressure is outside of allowable limits. The allowed completion time is acceptable based on the low likelihood that a loss of TOGS event would occur during the time period. Transfer of solution to the TSV dump tank may be accomplished by initiating a manual IU Cell Safety Actuation, or by cycling the IU Mode through Mode 2 to Mode 3 to perform a normal shutdown.

SR Pressure excursions within the TSV headspace will result in control room alarms to alert the operator. Channel Check and Channel Calibration frequencies are based on guidance from ANSI/ANS 15.1-2007 and ensure the instrumentation is capable of performing its intended function when required.

Basis 3.1.3 LCO This LCO is applied to each IU independently; actions are only applicable to the IU(s) that fail to meet the LCO during the associated condition(s) of applicability.

The minimum TSV liquid volume during irradiation is [ ]PROP/ECI. To meet this limit during Mode 2, approximately [ ]PROP/ECI is required to be added to the TSV in Mode 1 to provide margin for up to 3 L of water anticipated to be held-up in TOGS during irradiation, as described in FSAR Subsection 4a2.6.1.1. The Page B 3.1-2 Revision 3

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3) minimum target solution volume is required to maintain the peak target solution temperature below 194°F (90°C) and the average target solution temperature below 176°F (80°C) during irradiation to ensure the solution does not boil (see LCO 3.1.4). The maximum target solution volume is limited by the 1/M startup methodology. The system is filled to a height that is approximately five percent by volume below critical. If a minimum volume of [ ]PROP/ECI of target solution in the TSV has not been achieved when the final fill height is reached, as determined by 1/M calculations, the solution is transferred from the associated IU to the TSV dump tank. TSV solution fill volume requirements are further described in FSAR Subsection 4a2.6.1.

During irradiation, the volume of target solution may lower due to leak by past the TSV dump valves and water hold up in the TOGS. If the volume of target solution in the TSV is reduced below the minimum volume of [ ]PROP/ECI, the target solution in the TSV is transferred to the TSV dump tank, in accordance with the specified action. The completion time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months provides adequate time to determine the reason for lowering level indication and repair minor problems. The completion time is acceptable based on the continued availability of the TRPS to respond to events where level is lost rapidly (e.g., IU Cell Safety Actuation on low-high dump tank level due to leakage past the TSV dump valves, or on loss of TOGS functionality due to excessive water hold-up).

Transfer of solution to the TSV dump tank may be accomplished by initiating a manual IU Cell Safety Actuation, or by cycling the IU Mode through Mode 2 to Mode 3 to perform a normal shutdown without irradiating the target solution.

SR The surveillance requirement ensures the volume of target solution is within limits prior to irradiation and ensures continued operability of the instrumentation when required. Channel Check and Channel Calibration frequencies are based on guidance from ANSI/ANS 15.1-2007 and ensure the instrumentation is capable of performing its intended function when required.

Basis 3.1.4 LCO This LCO is applied to each IU independently; actions are only applicable to the IU(s) that fail to meet the LCO during the associated condition(s) of applicability.

The target solution in the TSV must remain within the analyzed temperature range to ensure boiling does not occur in the TSV or in the TSV dump tank after the target solution has been dumped (194.4°F [90.2°C] at 10.2 psi absolute [psia]

[70.3 kPa absolute]), as described in FSAR Section 4a2.7 and Subsection 13a2.1.3. Average target solution temperature in the TSV must be 176°F (80°C) to prevent boiling in the TSV dump tank after the solution is dumped from the TSV to the TSV dump tank as described in FSAR Subsection 4a2.7.6.

Temperature in the TSV is measured using nine thermocouples; the average of these readings is the average TSV solution temperature. If the average temperature is not within allowable limits, the associated IU is placed in Mode 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to stop adding heat via irradiation and to place the solution in a configuration within the TSV dump tank where reactivity is controlled. This completion time provides a reasonable time to investigate the reason for rising Page B 3.1-3 Revision 3

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)

TSV temperature. The completion time is acceptable based on temperature trending capabilities and the ability to anticipate reaching the threshold of 176°F and react accordingly. Transfer of solution to the TSV dump tank may be accomplished by initiating a manual IU Cell Safety Actuation, or by cycling the IU Mode to Mode 3 to perform a normal shutdown.

SR The surveillance requirements ensure the continued operability of the instrumentation when required. Channel Check and Channel Calibration frequencies are based on guidance from ANSI/ANS 15.1-2007 and ensure the instrumentation is capable of performing its intended function when required.

Basis 3.1.5 LCO This LCO is applied to each IU independently; actions are only applicable to the IU(s) that fail to meet the LCO during the associated condition(s) of applicability.

One TSV dump valve is required to be fully open within two seconds of demand in order to drain solution from the TSV to the TSV dump tank within the time assumed in the accident analysis, as described in FSAR Section 4a2.6. The LCO drain time limit is based on the nominal expected volume of a target solution batch. If the TSV is filled to the minimum volume of [ ]PROP/ECI (see LCO 3.1.3), the maximum drain time for one valve is 183 seconds. Both TSV dump valves are required to be Operable whenever target solution is in the TSV to allow for a single failure of one valve to open.

If one or more TSV dump valve(s) are not Operable, target solution is required be removed from the associated TSV by transitioning to Mode 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . A TSV dump valve that is declared inoperable due to slow opening time or slow drain rate through the dump line flow path is still expected to be able to open, since the valves are cycled frequently and are designed to fail open on a loss of power. It is not considered credible for both valves to remain fully closed on a demand to open.

A completion time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months provides a reasonable time to investigate and repair minor problems, and, if necessary, provides a reasonable time to complete the action in an orderly manner. The allowed completion time is acceptable based on the availability of a parallel flow path to transfer TSV contents to the TSV dump tank. Transfer to Mode 3 may be accomplished by initiating a manual IU Cell Safety Actuation, or by cycling the associated IU Mode to Mode 3 to perform a normal shutdown.

SR Quarterly verification of the valve opening time and line drain rate is used to confirm proper valve operation and is consistent with the frequency recommendations from ANSI/ANS 15.1-2007 for operability checks.

Basis 3.1.6 LCO This LCO is applied to each IU independently; actions are only applicable to the IU(s) that fail to meet the LCO during the associated condition(s) of applicability.

The potential for uranyl peroxide precipitation in target solution undergoing irradiation is a function of the peroxide generation rate, peroxide decomposition Page B 3.1-4 Revision 3

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3) rate, and peroxide solubility. Uranyl peroxide results from a reaction of hydrogen peroxide (formed from the radiolysis of water) and uranyl ions available in the target solution.

Parameters that affect peroxide decomposition rate are temperature and catalyst concentration. Peroxide solubility is primarily affected by target solution pH. The power density of the target solution controls the peroxide generation rate, since a higher power density results in an increased hydrogen and hydrogen peroxide production rate.

This LCO 3.1.6 provides limits on target solution power density and temperature.

The pH and catalyst concentration in target solution are controlled in accordance with LCO 3.8.3.

Because the peroxide decomposition rate is highly dependent on temperature, the acceptable power density is also highly dependent on temperature.

Experimental data and correlations were used to generate data points forming the basis if Figure 3.1.6. These data points define a region of safe operation and confirm the SHINE power density limit curve was conservatively defined.

During steady-state operation at power, the thermal hydraulic properties of the system result in an inherent relationship between the power density and temperature. Based on the minimum PCLS supply temperature (see LCO 3.2.3, item f.), the system maintains approximately 30% margin between the steady-state power and the power density limit. At the nominal PCLS temperature, the system maintains approximately 90% margin.

At zero power with cold conditions, there is not significant peroxide being generated in the target solution and the system remains well below the peroxide solubility limit. During the transition from zero power cold conditions to steady-state operation, the power density as a function of temperature exceeds that of steady-state operation because the target solution is still heating up. Figure 3.1.6 defines the acceptable region for power density and temperature during this transition (i.e., power ramp up). The [ ]PROP/ECI and PCLS flow rate may be adjusted as necessary to maintain the system within the Acceptable region of Figure 3.1.6 during power ramp up.

This LCO does not apply to loss of driver and restart transients, which are addressed in LCO 3.1.7.

SR The hourly verification surveillance requirement ensures that the temperature and average power density in the TSV is maintained within limits during the ramp to full power. The neutron flux detectors, used to determine TSV power, are maintained Operable per LCO 3.2.3. The solution volume for the associated batch is ensured to be within limits per LCO 3.1.3. Instrumentation used to determine target solution temperature in the TSV is maintained operable per LCO 3.1.4. Power excursions will result in control room alarms to alert the operator. The frequency of the hourly verification surveillance is based on industry experience. The surveillance is only required to be performed during power ramp up because the thermal hydraulic properties of the system during steady-state operation at power result in an relationship between power density and temperature that inherently maintains the solution within the Acceptable region of Figure 3.1.6.

Page B 3.1-5 Revision 3

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)

Basis 3.1.7 LCO This LCO is applied to each IU independently; actions are only applicable to the IU(s) that fail to meet the LCO during the associated condition(s) of applicability.

This LCO 3.1.7 applies to the average power density of target solution in the TSV during driver restart transients following a loss of driver event.

The transient power density limit is set to [ ]PROP/ECI to limit temperature, pressure, and hydrogen generation in transient events. Transient events are not a concern for uranyl sulfate precipitation (described in LCO 3.1.6) because durations are too short to reach steady-state peroxide concentrations. The transient power density limit allows for momentary power spikes caused by the start or restart of the neutron driver (within the allowed Driver Dropout timeframe). Reaching the transient power density limit is prevented by the rate of ramp up used during startup and the duration of the allowed Driver Dropout. In addition, the high wide range neutron flux setpoint will initiate an automatic IU Cell Safety Actuation at 176% power, equivalent to approximately [

]PROP/ECI at the minimum acceptable target solution volume. If the power density limit is exceeded, the associated IU is placed in Mode 3 immediately.

This completion time recognizes the importance of placing the IU in an analyzed condition.

SR The verification surveillance requirement following a driver restart event ensures that the transient average power density in the TSV was maintained within analyzed limits during the restart. The neutron flux detectors, used to determine TSV power, are maintained Operable per LCO 3.2.3. The solution volume for the associated batch is ensured to be within limits per LCO 3.1.3. Power excursions will result in control room alarms to alert the operator. The frequency of the verification surveillance is based on the event to which the LCO applies.

Basis 3.1.8 LCO Target solution must be held in the TSV dump tank for a minimum period of time after irradiation has occurred, depending on the maximum historical irradiation power of the target solution batch. The maximum historical irradiation power for a target solution batch is the highest power achieved for that batch in any previous irradiation cycle. The hold time limits the radionuclide inventory of target solution that is transferred to the RPF and ensures the source term does not exceed the initial conditions assumed in the accident analysis or biological shielding dose calculations, as described in FSAR Subsection 4a2.6.3.2. An aborted batch may be transferred to the RPF without any required hold time if the solution has not been irradiated in the immediately preceding cycle. Target solution is considered to have been irradiated in the immediately preceding cycle if the neutron driver has produced a deuterium beam, directed into a gas target, for greater than 1 effective full power minute after the transition to Mode 2 for that irradiation cycle.

SR The surveillance requirement ensures the solution is not transferred prior to the minimum decay time required for each irradiation cycle.

Page B 3.1-6 Revision 3

3.2 Instrumentation and Control Safety Systems Objective: To ensure instrumentation and control Safety Systems are able to perform their designed safety functions LCO 3.2.1 Three target solution vessel reactivity protection system (TRPS) logic and actuation Divisions shall be Operable. A TRPS logic and actuation division is Operable if:

1. Three SBVMs or SBMs are Operable

2. Two 5V power supplies are Operable

3. Two EIMs for each TRPS actuation device are Operable Note - Conditions 1, 2, 3, 4 and 5 in Table 3.2.1 may be applied separately to each Division of TRPS associated with each IU. Condition 6 may be applied separately to each IU.

Applicability Modes 1, 2, 3, and 4 (per IU)

Action According to Table 3.2.1 SR 3.2.1 Simulated automatic and manual actuation priority logic testing shall be performed every five years.

Note - This SR cannot be deferred.

Table 3.2.1 TRPS Logic and Actuation Actions Action Completion Time

1. If one SBVM or SBM in a single Division is inoperable, Restore the module to Operable. 30 days

2. If one 5V power supply in a single Division is inoperable, Restore the power supply to Operable. 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months

3. If one EIM in a single Division is inoperable, Restore the module to Operable 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months OR Enter the corresponding action(s) for the inoperable flow path 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months according to Tables 3.4.1-a and 3.6.2-a.

4. If two EIMs associated with a single actuation component in a single Division are inoperable, Enter the corresponding action(s) for the inoperable flow path Immediately according to Tables 3.4.1-a and 3.6.2-a.

Page 3.2-1 Revision 3

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)

Action Completion Time

5. If two or more SBVMs or SBMs in a single Division are inoperable, OR If two 5V power supplies in a single Division are inoperable, OR Action and associated completion time of Condition 1 or 2 not met, Place the associated IU in Mode 3 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months AND Place the associated IU in Mode 0. [ ]PROP/ECI

6. If two or more Divisions are inoperable, Place the associated IU in Mode 3 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months AND Place the associated IU in Mode 0. [ ]PROP/ECI LCO 3.2.2 Three engineered safety features actuation system (ESFAS) logic and actuation Divisions shall be Operable. An ESFAS logic and actuation Division is Operable if:

1. Three SBVMs or SBMs are Operable

2. Two 5V power supplies are Operable

3. Two EIMs for each ESFAS actuation device are Operable Note - Conditions 1, 2, 3, 4 and 5 in Table 3.2.2 may be applied separately to each division of ESFAS.

Applicability Facility not Secured Action According to Table 3.2.2 SR 3.2.2 Simulated automatic and manual actuation priority logic testing shall be performed every five years.

Note - This SR cannot be deferred.

Page 3.2-2 Revision 3

Table 3.2.2 ESFAS Logic and Actuation Actions Action Completion Time

1. If one SBVM or SBM in a single Division is inoperable, Restore the module to Operable. 30 days

2. If one 5V power supply in a single Division is inoperable, Restore the power supply to Operable. 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months

3. If one EIM in a single Division is inoperable, Restore the module to Operable 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months OR Enter the corresponding action(s) for the inoperable actuation 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months device according to Tables 3.4.3-a, 3.4.4-a, 3.6.2-a, 3.8.9-a and 3.8.10-a.

4. If two EIMs associated with a single actuation component in a single Division are inoperable, Enter the corresponding action(s) for the inoperable actuation Immediately device according to Tables 3.4.3-a, 3.4.4-a, 3.6.2-a, 3.8.9-a and 3.8.10-a.

5. If two or more SBVMs or SBMs in a single Division are inoperable, OR If two 5V power supplies in a single Division are inoperable, OR Action and associated completion time of Condition 1 or 2 not met, Place all IUs undergoing irradiation in Mode 3 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months AND Open the VTS vacuum pump breakers 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months AND Open at least one VTS vacuum break valve 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months AND Place tritium in all three trains of TPS process equipment in its storage location 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months OR Initiate a TPS Train Isolation for all three gloveboxes. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Page 3.2-3 Revision 3

Action Completion Time

6. If two or more Divisions are inoperable, Place all IUs undergoing irradiation in Mode 3 1 hours1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months AND Open the VTS vacuum pump breakers 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months AND Open at least one VTS vacuum break valve 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months AND Initiate a TPS Train Isolation for all three gloveboxes. 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months LCO 3.2.3 TRPS input channels listed in Table 3.2.3-a shall be Operable.

Note - Any single SFM may be bypassed for up to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months while the variable(s) associated with the SFM is in the condition of applicability for the purpose of performing a Channel Test or Channel Calibration.

Applicability According to Table 3.2.3-a Action According to Table 3.2.3 SR 3.2.3 1. A Channel Check shall be performed on each channel of the neutron flux detection system (NFDS) weekly.

2. A Channel Check shall be performed on TRPS process variable instrument channels quarterly.

3. A Channel Test shall be performed on TRPS process variable instrument channels quarterly.

4. A Channel Calibration shall be performed on each channel annually.

Page 3.2-4 Revision 3

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)

Table 3.2.3 TRPS Input Channel Actions Action Completion Time

1. If one channel is inoperable, Place the SFM for the associated channel in trip 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months AND Restore the channel to Operable. 30 days

2. If two redundant channels are inoperable, Place the associated IU in Mode 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months

3. If two redundant channels are inoperable, OR Action and associated completion time of Condition 1 not met, Place the associated IU in Mode 3 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months AND Place the associated IU in Mode 0. [ ]PROP/ECI

4. If two redundant channels are inoperable, Close at least one TSV fill valve. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months

5. If one or more channel is inoperable, Close at least one TSV fill valve 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months OR Place the associated IU in Mode 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months

6. If three redundant channels are inoperable, Place the associated IU in Mode 3. 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months

7. If three redundant channels are inoperable, Place the associated IU in Mode 3 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months AND Place the associated IU in Mode 0. [ ]PROP/ECI Page 3.2-5 Revision 3

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)

Table 3.2.3-a TRPS Instrumentation Required Applicability Variable Setpoint Action SR Channels (per IU)

Wide range

a. 176% power 3 Modes 1 and 2 1, 2, 6 1, 4 neutron flux 85% power; averaged over 45 seconds Power range

b. 3 Modes 1 and 2 1, 2, 6 1, 4 neutron flux [

]PROP/ECI 1.5 times the nominal flux at Source range

c. 95% volume of 3 Mode 1 1, 4, 6 1, 4 neutron flux the critical fill height TSV fill valve

d. position Not Closed 2 Mode 2 5 3 indication

[

]PROP/ECI; IU Cell Safety

e. PCLS flow 3 Modes 1 and 2 1, 2, 6 2, 4 Actuation delayed by 180 seconds 72.9°F; IU Cell Safety Actuation PCLS delayed by

f. 180 seconds 3 Modes 1 and 2 1, 2, 6 2, 4 temperature 63.5°F Low-high TSV

g. dump tank 3% 3 Modes 1 and 2 1, 2, 6 3 level High-high Modes 1, 2, 3,

h. TSV dump 85% 3 1, 3, 7 3 and 4 tank level TOGS 3

[ Modes 1, 2, 3,

i. mainstream 1, 3, 7 2, 4

]PROP/ECI (per train) and 4 flow Page 3.2-6 Revision 3

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)

Required Applicability Variable Setpoint Action SR Channels (per IU)

TOGS dump [ Modes 1, 2, 3,

j. 3 1, 3, 7 2, 4 tank flow ]PROP/ECI and 4 TOGS oxygen Modes 1, 2, 3,

k. 11% 3 1, 3, 7 2, 4 concentration and 4 TOGS condenser 3 Modes 1, 2, 3,

l. demister 73.4°F 1, 3, 7 2, 4 (per train) and 4 outlet temperature Page 3.2-7 Revision 3

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)

LCO 3.2.4 ESFAS input Channels listed in Table 3.2.4-a shall be Operable.

Note - Any single SFM may be bypassed for up to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months while the variable is the condition of applicability for the purpose of performing a Channel Test or Channel Calibration.

Applicability According to Table 3.2.4-a Action According to Table 3.2.4 SR 3.2.4 1. A Channel Check shall be performed on ESFAS process variable instrument Channels quarterly.

2. A Channel Calibration shall be performed on ESFAS process variable instrument Channels annually.

3. A Channel Test shall be performed on ESFAS process variable instrument Channels quarterly.

Table 3.2.4 ESFAS Process Instrumentation Actions Action Completion Time

1. If one channel of PVVS flow is inoperable, Place the SFM for the associated channel in trip 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months AND Restore the channel to Operable. 30 days

2. If two or more channels of PVVS flow are inoperable, OR Action and associated completion time of Condition 1 not met, Actuate the RPF Nitrogen Purge. 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months

3. If one channel of MEPS [ ] PROP/ECI conductivity is inoperable, Place the associated MEPS [ ]PROP/ECI 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Isolation actuation components in the actuated state.

4. If both channels of MEPS [ ] PROP/ECI conductivity are inoperable, Place the associated MEPS [ ]PROP/ECI Isolation 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months actuation components in the actuated state.

Page 3.2-8 Revision 3

Action Completion Time

5. If one channel is inoperable, Open the VTS vacuum pump breakers 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months AND Open the VTS vacuum break valves. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months

6. If both channels are inoperable, Open the VTS vacuum pump breakers 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months AND Open the VTS vacuum break valves. 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months

7. If one channel for a single carbon delay bed group is inoperable, Close the associated carbon delay bed group isolation valves 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months AND Verify at least 5 carbon delay beds are operating. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months

8. If both channels for a single carbon delay bed group are inoperable, Close the associated carbon delay bed group isolation valves 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months AND Verify at least 5 carbon delay beds are operating. 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months

9. If one channel of dissolution tank level is inoperable, Place the dissolution tank isolation actuation components in their 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months actuated states.

10. If both channels of dissolution tank level are inoperable, Place the dissolution tank isolation actuation components in their 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months actuated states.

11. If one channel of UPSS Loss of External Power is inoperable Restore the channel to Operable. 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months

12. If both channels of UPSS Loss of External Power are inoperable OR Action and associated completion time of Condition 11 not met Place all IUs undergoing irradiation in Mode 3. 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months

13. If one required channel is inoperable, Place the associated Alignment Actuation components in the actuated state. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Page 3.2-9 Revision 3

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)

Action Completion Time

14. If both required channels are inoperable, Place the associated Alignment Actuation components in the actuated state. 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months

15. If one required channel is inoperable, Close at least one associated TPS target chamber supply line valve per associated IU. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months

16. If both required channels are inoperable, Close at least one associated TPS target chamber supply line valve per associated IU. 1 hours1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Table 3.2.4-a ESFAS Process Instrumentation Required Variable Setpoint Applicability Action SR Channels

a. MEPS [ 478 2 Target solution or 3, 4 1, 2

]PROP/ECI µmho/cm (per hot radioactive process conductivity cell) fluids present in the associated hot cell

b. PVVS carbon 42 ppm 2 Associated carbon 7, 8 1, 2 delay bed carbon (per delay delay bed group monoxide bed Operating group)

c. VTS vacuum Active 2 Solution transfers 5, 6 3 header liquid using VTS in-detection progress

d. RDS liquid Active 2 Solution transfers 5, 6 3 detection using VTS in-progress

e. PVVS flow 7.1 SCFM 3 Facility not Secured 1, 2 3

f. Dissolution tank 98% 2 Dissolution tank or 9, 10 1, 2 level TSPS glovebox contains uranium

g. Uninterruptible Loss of Power; 2 Any IU in Mode 1, 2, 11, 12 3 electrical power actuation 3, or 4 supply system delayed by (UPSS) loss of 180 seconds external power Page 3.2-10 Revision 3

Required Variable Setpoint Applicability Action SR Channels

h. MEPS three-way Supplying 2 Target solution 13, 14 3 valve position (per valve) present in the indication associated hot cell

i. IXP three-way Supplying 2 Target solution 13, 14 3 valve position (per valve) present in the IXP hot indication cell

j. TPS target 7.7 psia 2 Tritium in associated 15, 16 1, 2 chamber supply (per IU) TPS process pressure equipment not in storage k TPS target 7.7 psia 2 Tritium in associated 15, 16 1, 2 chamber exhaust (per IU) TPS process pressure equipment not in storage Page 3.2-11 Revision 3

Basis 3.2.1 LCO Each TRPS subsystem, one associated with each IU, is required to perform safety functions specified by the SHINE safety analysis, as described in FSAR Subsection 7.4.3.1.

LCO 3.2.1 addresses only the logic, voting, and actuation portions of the TRPS.

The scope of this LCO begins at the inputs to the scheduling, bypass and voting modules (SBVMs) or scheduling and bypass modules (SBMs) and extends through the equipment interface modules (EIMs), ending at the output to the actuated components. The safety function modules (SFMs) and the input channels are addressed in LCO 3.2.3. The actuated components themselves are addressed in LCO 3.4.1 (for primary Confinement and primary system boundary components), and LCO 3.6.2 (for safety-related breakers).

LCO 3.2.1 additionally addresses the two redundant 5V power supplies per TRPS subsystem, per Division. The 48V power supplies for each Division of TRPS cabinets are addressed in LCO 3.6.1.

The TRPS bypass logic is implemented in all three Divisions. The TRPS voting and actuation logic is implemented in only Divisions A and B. For Divisions A and B, the three SBVMs, in each division, generate actuation signals when the SFMs in any two of the three Divisions determine that an actuation is required. Both TRPS Divisions A and B evaluate the input signals from the SFMs in each of three redundant SBVMs. Each SBVM compares the inputs received from the SFMs and generates an appropriate actuation signal if required by two or more of the three Divisions.

The output of the three redundant SBVMs in Divisions A and B is communicated via three independent safety data buses to the associated EIMs. There are two independent EIMs for each actuation component, associated with each Division A and B of TRPS. The EIMs compare inputs from the three SBVMs and initiate an actuation if two out of three signals agree on the need to actuate. Both EIMs associated with a component are required to be deenergized for the actuation component(s) to fail to their actuated (deenergized) states.

If one SBVM or SBM in a single Division is inoperable, the module is required to be restored to Operable within 30 days. This completion time allows for replacement of failed components, while limiting the amount of time the IUs are allowed to operate with reduced TRPS reliability. The 30 day duration is acceptable because the output of a failed SBVM is received as a trip signal by the associated EIMs, and the output of a failed SBM is received as a trip signal by the Division A and B SBVMs, preserving the single failure criterion for the remaining Operable modules.

If one 5V power supply in a single Division is inoperable, the power supply is required to be restored to Operable within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . This completion time allows for adequate time for replacement of failed components, while limiting the amount of time the IUs are allowed to operate with reduced TRPS reliability. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months duration is acceptable due to the low likelihood of an additional power supply failure on the affected Division while a power supply is inoperable, and the ability of the redundant TRPS Division(s) to sense adverse conditions and actuate equipment in response to an event.

Page B 3.2-1 Revision 3

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)

If a single EIM in a single Division is inoperable, the EIM is required to be restored to Operable within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . This allows adequate time to diagnose, repair, and retest the inoperable component(s). The completion time is acceptable based on the continued availability of the redundant actuation component (or redundant check valve) to perform the required function. The likelihood of equipment requiring automatic actuation during the 72-hour completion time is low. Additionally, manual actuation of the components is still available and provides defense-in-depth mitigation during the allotted 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

If two EIMs for a single actuation component in a single Division are inoperable, the associated actuation component is inoperable, and the corresponding action(s) from LCO(s) 3.4.1 or 3.6.2 are required to be entered immediately.

Completion times for associated actions are prescribed in the applicable LCO(s).

If two or more SBVMs or SBMs in a single Division are inoperable, both 5V power supplies in a single Division are inoperable, one SBVM or SBM is inoperable for greater than 30 days, or one 5V power supply is inoperable for greater than 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months , the associated TRPS Division is inoperable. The associated IU will be placed in Mode 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and Mode 0 within

[ ]PROP/ECI to place the IU in a condition of applicability where the TRPS safety functions are not required. Transfer of target solution out of the IU to achieve Mode 0 requires the target solution to be held in the TSV dump tank for at least the minimum period of time specified in LCO 3.1.8 prior to transfer.

Approximately [ ]PROP/ECI are required to complete the transfer of target solution to the RPF. This completion time allows for the performance of minor repairs and allows for the affected IU to be shut down in an orderly manner. The completion time is acceptable based on the continued availability of the redundant TRPS Division(s) to sense adverse conditions and actuate equipment in response to an event.

If two or more Divisions are inoperable, the associated IU will be placed in Mode 3 within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months and Mode 0 within [ ]PROP/ECI. This completion time recognizes the importance of removing the potential for an event by placing the IU in a condition of applicability where the functionality of the TRPS is no longer required.

This LCO also addresses the ESFAS loss of external power signal, which is received from the ESFAS directly and triple-redundantly onto the three redundant SBVMs in each of TRPS Divisions A and B. The TOGS is required to provide hydrogen mitigation within the IU, as described in FSAR Section 4a2.8. The ESFAS loss of external power signal protects against the expected loss of TOGS blowers and recombiners after the runtime on the UPSS has been exceeded.

The ESFAS implements a 180 second timer (see LCO 3.2.4, item g.), which provides margin to the five-minute UPSS runtime, as described in FSAR Subsection 8a2.2.3. With only one SBVM inoperable, the communication from the ESFAS to the TRPS is still received within the affected Division on the two remaining Operable SBVMs, and the actions associated with a single inoperable SBVM apply. When Division A or B of TRPS is inoperable (e.g., when two or more SBVMs within a single Division are inoperable), the associated IU is required to be placed in Mode 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and Mode 0 within

[ ]PROP/ECI as described above.

Page B 3.2-2 Revision 3

SR The TRPS platform has end-to-end self-testing that covers each module from sensor input to the output switching logic (except for the discrete circuitry of the actuation and priority logic). The individual self-tests on the different components of the highly integrated protection system (HIPS) platform evaluate whether the entire platform is functioning correctly, as described in FSAR Subsection 7.4.4.4.

HIPS modules include light emitting diodes (LEDs) that are used to determine the state of the module latches, the operational state of the module, and the presence of any faults. The HIPS platform self-testing features and the associated front panel LEDs allow for the timely identification of certain malfunctions within the HIPS equipment. Only manual actuation and priority logic functions are not covered by the self-testing features and therefore require periodic surveillance. The actuation priority logic test verifies the functionality of the discrete priority logic circuits of the TRPS safety-related control system. The test includes testing of the manual actuation functions of TRPS. Built-in redundancy and notification of failures within the TRPS supports the surveillance frequency.

Basis 3.2.2 LCO The ESFAS is required to perform safety functions specified by the SHINE safety analysis, as described in FSAR Subsection 7.5.3.1.

LCO 3.2.2 addresses only the logic, voting, and actuation portions of the ESFAS.

The scope of this LCO begins at the inputs to the SBVMs or SBMs and extends through the EIMs, ending at the output to the actuated components. The SFMs and the input channels are addressed in LCO 3.2.4. The actuated components themselves are addressed in LCO 3.4.3 (for tritium Confinement boundary components), LCO 3.4.4 (for supercell Confinement dampers), LCO 3.6.2 (for safety-related breakers), LCO 3.8.9 (for RCA isolation dampers), and LCO 3.8.10 (for facility-specific safety-related valves and dampers).

LCO 3.2.2 also addresses the two redundant 5V power supplies per ESFAS Division. The 48V power supplies for each Division of ESFAS cabinets are addressed in LCO 3.6.1.

The ESFAS bypass logic is implemented in all three Divisions. The ESFAS voting and actuation logic is implemented in only Divisions A and B. For Divisions A and B, the three SBVMs, in each division, generate actuation signals when the SFMs in any two of three (or one of two) Divisions determine that an actuation is required. Both ESFAS Divisions A and B evaluate the input signals from the SFMs in each of three redundant SBVMs. Each SBVM compares the inputs received from the SFMs and generates an appropriate actuation signal if required by two or more of the three (or one or more of the two) Divisions.

The output of the three redundant SBVMs in Divisions A and B is communicated via three independent safety data buses to the associated EIMs. There are two independent EIMs for each actuation component, associated with each Division A and B of ESFAS. The EIMs compare inputs from the three SBVMs and initiate an actuation if two out of three signals agree on the need to actuate. Both EIMs associated with a component are required to be deenergized for the actuation component(s) to fail to their actuated (deenergized) states, with the exception of Page B 3.2-3 Revision 3

the PVVS carbon delay bed three-way and outlet isolation valves (items d. and e.). These valves are energized to actuate.

If one SBVM or SBM in a single Division is inoperable, the module is required to be restored to Operable within 30 days. This completion time allows for replacement of failed components, while limiting the amount of time equipment protected by the ESFAS is allowed to operate with reduced ESFAS reliability.

The 30 day duration is acceptable because the output of a failed SBVM is received as a trip signal by the associated EIMs, and the output of a failed SBM is received as a trip signal by the Division A and B SBVMs, preserving the single failure criterion for the remaining Operable modules.

If one 5V power supply in a single Division is inoperable, the power supply is required to be restored to Operable within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . This completion time allows for adequate time for replacement of failed components, while limiting the amount of time equipment protected by the ESFAS is allowed to operate with reduced ESFAS reliability. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months duration is acceptable due to the low likelihood of an additional power supply failure on the affected Division while a power supply is inoperable, and the ability of the redundant ESFAS Division(s) to sense adverse conditions and actuate equipment in response to an event.

If a single EIM in a single Division is inoperable, the EIM is required to be restored to Operable within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . This allows adequate time to diagnose, repair, and retest the inoperable component(s). The completion time is acceptable based on the continued availability of the redundant actuation component (or redundant check valve) to perform the required function. The likelihood of equipment requiring automatic actuation during the 72-hour completion time is low. Additionally, manual actuation of the components is still available and provides defense-in-depth mitigation during the allotted 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

If two EIMs for a single actuation component in a single Division are inoperable, the associated actuation component is inoperable, and the corresponding action(s) from LCO(s) 3.4.3, 3.4.4, 3.6.2, 3.8.9, or 3.8.10 are required to be entered immediately. Completion times for associated actions are prescribed in the applicable LCO(s).

If two or more SBVMs or SBMs in a single Division are inoperable, both 5V power supplies in a single Division are inoperable, one SBVM or SBM is inoperable for greater than 30 days, or one 5V power supply is inoperable for greater than 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months , the associated ESFAS Division is inoperable. All IUs undergoing irradiation will be placed in Mode 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , VTS vacuum pump breakers will be opened within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months , at least one VTS vacuum break valve will be opened within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months , and a TPS Train Isolation will be initiated for all three gloveboxes or tritium in all three trains of TPS process equipment will be placed in its storage location, within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . This completion time allows for the performance of minor repairs and allows for facility systems to be shut down in an orderly manner. The completion time is acceptable based on the continued availability of the redundant ESFAS Division(s) to sense adverse conditions and actuate equipment in response to an event.

If two or more Divisions are inoperable, within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months all IUs undergoing irradiation will be placed in Mode 3, VTS vacuum pump breakers will be opened, at least one VTS vacuum break valve will be opened, and a TPS Train Isolation will be initiated for all three gloveboxes. This completion time recognizes the Page B 3.2-4 Revision 3

importance of removing the potential for an event by placing facility systems in a condition of applicability where the functionality of the ESFAS is no longer required.

SR The ESFAS platform has end-to-end self-testing that covers each module from sensor input to the output switching logic (except for the discrete circuitry of the actuation and priority logic). The individual self-tests on the different components of the HIPS platform evaluate whether the entire platform is functioning correctly, as described in FSAR Subsection 7.5.4.5. HIPS modules include LEDs that are used to determine the state of the module latches, the operational state of the module, and the presence of any faults. The HIPS platform self-testing features and the associated front panel LEDs allow for the timely identification of certain malfunctions within the HIPS equipment. Only manual actuation and priority logic functions are not covered by the self-testing features, and therefore require periodic surveillance. The actuation priority logic test verifies the functionality of the discrete priority logic circuits of the ESFAS safety-related control system. The test includes testing of the manual actuation functions of ESFAS. Built-in redundancy and notification of failures within the ESFAS supports the surveillance frequency.

Basis 3.2.3 LCO TRPS process variable instrumentation is required to initiate safety functions specified by the SHINE safety analysis, as described in FSAR Subsection 7.4.3.1.

LCO 3.2.3 addresses the input devices and the trip determination portions of TRPS. The scope of this LCO (i.e., each channel) begins at the input devices, includes the associated safety function modules (SFMs) and hardwired modules (HWMs) and extends to the inputs to the SBVMs or SBMs. Radiation monitors that provide inputs to TRPS are addressed in LCO 3.7.1. The TRPS input for ESFAS loss of external power signal is addressed in LCO 3.2.1.

More than one input device provides a signal to each SFM or HWM. The following table describes the allocation of inputs to the TRPS modules:

Page B 3.2-5 Revision 3

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)

Table B-3.2.3 TRPS Input Variable Allocation Variable Division A Division B Division C Wide range

a. [

neutron flux Power range b.

neutron flux Source range c.

neutron flux TSV fill valve

d. position indication

e. PCLS flow PCLS f.

temperature Low-high TSV g.

dump tank level High-high TSV h.

dump tank level TOGS i.

mainstream flow TOGS dump j.

tank flow TOGS oxygen k.

concentration TOGS condenser

l. ]PROP/ECI demister outlet temperature Three TRPS process variable instrumentation channels are provided for each of the variables in Table 3.2.3-a, one channel for each of Divisions A, B, and C, with the exception of TSV fill valve position indication (item d.) for which only two channels are provided. Only two channels of any process variable instrumentation are required to be Operable to provide redundancy to protect against a single failure.

Each SFM can be placed in maintenance bypass or in a trip state by use of the out-of-service (OOS) switch located on the front of the SFM and an associated trip/bypass switch located below the SFM, as described in FSAR Subsection 7.4.4.3. Placing an SFM in trip or bypass causes all channels associated with that SFM to be placed in trip or bypass, respectively.

When all three channels are Operable for a variable provided with three Divisions, actuation of the safety function occurs on 2-out-of-3 voting logic. When any single channel is inoperable for variables provided with three Divisions, the Page B 3.2-6 Revision 3

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)

SFM associated with the inoperable channel is required to be placed in trip within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , effectively changing the voting logic to 1-out-of-2, preserving the single failure protection. A completion time of 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months allows for the action to be accomplished in an orderly manner.

For the TSV fill valve position indication, which is provided with only two channels, actuation of the safety function occurs on 1-out-of-2 voting logic. The field input for TSV fill valve position indication is provided to a HWM, and not an SFM, and therefore cannot be placed in trip or bypass.

Performance of a Channel Test or Channel Calibration may cause a channel to be unable to perform its safety function during the SR. To allow the performance of these SRs duing IU operation, any single SFM may be placed in bypass for up to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months during performance of a required SR on a channel associated with that SFM, effectively changing the voting logic to 2-out-of-2 (with two other channels Operable) or 1-out-of-1 (with one other channel Operable). A time limit of 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months is acceptable based on the small amount of time the channel could be in bypass, the continual attendance by operations or maintenance personnel during the test, the continued operability of the redundant channel(s), and the low likelihood that an accident would occur during the 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months time period.

When a channel is declared inoperable due to an inoperable input device or other issue associated with only one input on an SFM, only the applicable action(s) listed in Table 3.2.3-a for the affected channel are required to be completed within the specified completion time, or the condition of applicability exited, for the associated IU.

When a channel is declared inoperable due to an inoperable module (SFM or HWM), all variables (i.e., channels) associated with that module as listed in Tables B-3.2.3 and B-3.7.1 are inoperable. Applicable action(s) listed in Tables 3.2.3-a and 3.7.1-a for all affected channels are required to be completed within the specified completion time, or the condition(s) of applicability exited, for the associated IU.

Any inoperable SFM that has been placed in trip in accordance with this LCO is required to be restored to Operable within 30 days. A completion time of 30 days allows for replacement of failed components, while limiting the amount of time the affected IU is allowed to operate with reduced TRPS reliability. The 30-day duration is acceptable because placing the SFM in trip preserves the single failure criterion for the remaining Operable modules.

When two redundant channels for any of the variables identified in Table 3.2.3-a are inoperable, the associated action to either place the IU in Mode 3 (i.e., action 2 or 3) or close at least one TSV fill valve (i.e., action 4 or 5) has a completion time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . A 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months completion time allows for the performance of minor repairs and allows for the affected IU to be shut down or the affected processes to be halted in an orderly manner. The completion time is acceptable based on the continued availability of the redundant TRPS Division(s) to sense adverse conditions and actuate equipment in response to an event.

When three redundant channels for any of the variables provided with three channels as identified in Table 3.2.3-a are inoperable, the IU is required to be placed in Mode 3 within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months , and, if necessary to exit the condition of applicability, Mode 0 within [ ]PROP/ECI. These completion times recognize Page B 3.2-7 Revision 3

the importance of removing the potential for an event by placing the IU in a condition of applicability where the functionality of the TRPS is no longer required.

Additional discussion for each variable listed in Table 3.2.3-a is provided below:

a. During irradiation, the NFDS monitors percent power on the three wide range channels up to 250% of 125 kW fission power, the licensed power limit. The high wide range neutron flux limit is set at a neutron flux equivalent to 176%

power (i.e., 219.5kW). This setpoint provides margin to an analytical limit of 240% power (i.e., 300 kW). TSV power limits are discussed in FSAR Subsection 4a2.6.3.6. The high wide range neutron flux setpoint protects against high power density conditions as described in FSAR Subsections 13a2.1.2 (Scenario 4) and 13a2.1.8. Exceeding the high wide range neutron flux setpoints results in an IU Cell Safety Actuation, as described in FSAR Subsection 7.4.4.1.4. With one channel inoperable, the SFM for the associated channel is placed in trip within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months and the associated channel is restored to operable within 30 days. With two redundant channels inoperable, the associated IU is required to be placed in Mode 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . With three redundant channels inoperable, the associated IU is required to be placed in Mode 3 within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . Transition to Mode 3 may be accomplished by initiating a manual IU Cell Safety Actuation, or by cycling the IU Mode to Mode 3 to perform a normal shutdown.

b. The power range neutron flux signal is used to provide both a high time-averaged power range neutron flux limit and a low power range neutron flux limit. The power range neutron flux signal is required to be Operable in Mode 1, during filling operations, and in Mode 2, the only Mode where neutron driver operation is allowed.

During irradiation, the NFDS monitors percent power on the three power range channels up to 125% of 125 kW (i.e., 156 kW) fission power. The high time-averaged power range neutron flux limit is set at a neutron flux equivalent to 85% power (i.e., 106.25 kW), and is further described in FSAR Subsection 7.4.4.1.3. This setpoint provides margin to an analytical limit of 104% power (i.e., 130 kW) and ensures that the TSV power does not exceed analyzed conditions related to thermal hydraulic considerations, radiolysis gas generation, or fission product source term. TSV power limits are discussed in FSAR Subsection 4a2.6.3.6. The measured neutron flux is averaged to prevent unnecessary actuations of the Safety Systems during startup of the neutron driver. The averaging time is based on thermal hydraulic considerations, as described in FSAR Subsection 4a2.7.6. The high time-averaged neutron flux setpoint protects against sustained high power that could cause overheating of target solution or excessive hydrogen generation. Exceeding the high time-averaged power range neutron flux setpoint results in an IU Cell Safety Actuation.

The low power range neutron flux limit is provided to detect a loss of the neutron driver during irradiation and prevent restart of the driver outside of analyzed conditions. TRPS initiates a loss of neutron driver Driver Dropout on low power range neutron flux by opening the NDAS HVPS breakers with a timed delay. The driver is not permitted to restart if target solution has cooled, as a restart could result in a power excursion that could challenge the power Page B 3.2-8 Revision 3

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3) density limit (see LCO 3.1.6). The [ ]PROP/ECI power setpoint is based on an analytical limit of [ ]PROP/ECI power, which is set such that it is above a flux level expected to be caused by delayed neutrons continuing to be produced after the neutron driver has stopped Operating.

With one channel inoperable, the SFM for the associated channel is placed in trip within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months and the associated channel is restored to operable within 30 days. With two redundant channels inoperable, the associated IU is required to be placed in Mode 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . With three redundant channels inoperable, the associated IU is required to be placed in Mode 3 within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . Transition to Mode 3 may be accomplished by initiating a manual IU Cell Safety Actuation, or by cycling the IU Mode to Mode 3 to perform a normal shutdown.

c. During the filling process, the NFDS measures the counts per second, up to 1E+05 cps. The three source range neutron flux channels are required to be Operable to ensure the TSV neutron flux is measured during Mode 1, the only Mode where TSV filling is allowed. The high source range neutron flux limit protect against an insertion of excess positive reactivity during the filling process, as discussed in FSAR Subsection 7.4.4.1.1. The high source range neutron flux setpoint of 1.5 times the nominal flux at 95% volume of the critical fill height is set to ensure an IU Cell Safety Actuation occurs prior to exceeding a percentage above the normal startup flux as measured by the NFDS, as described in FSAR Subsection 4a2.6.2.7. The setpoint provides margin to an analytical limit of [ ]PROP/ECI times the nominal flux at 95%

volume of the critical fill height. This analytical limit provides protection against positive reactivity insertions that could challenge the PSB integrity from an uncontrolled fill at [ ]PROP/ECI, the physical limit of the TSV fill system.

Exceeding the high source range neutron flux setpoint results in an IU Cell Safety Actuation.

With one channel inoperable, the SFM for the associated channel is placed in trip within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months and the associated channel is restored to operable within 30 days. With two channels inoperable, at least one TSV fill valve is required to be closed within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to prevent addition of target solution to the TSV.

With three redundant channels inoperable, the associated IU is required to be placed in Mode 3 within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

d. The TSV fill valve position indication protects against an inadvertent addition of target solution to the TSV during irradiation. Two position indication channels are provided per valve. At least one TSV fill valve must be closed in Mode 2; opening both TSV fill valves in Mode 2 results in an IU Cell Safety Actuation. The TSV fill valve position indication also provides an input to the Fill Stop function. The TSV fill valves being opened early, or opened too long, while the IU is in Mode 1 results in a Fill Stop actuation, which automatically closes both TSV fill valves.

With one or more channels inoperable, at least one TSV fill valve is required to be closed within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months or the associated IU must be placed in Mode 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

e. The PCLS flow signal is used to monitor for a loss of PCLS cooling of the TSV. The low PCLS flow limit of [ ]PROP/ECI is based on an analytical limit of [ ]PROP/ECI , as described in Page B 3.2-9 Revision 3

FSAR Subsection 4a2.7.9. PCLS is required to maintain cooling to the TSV during irradiation to prevent boiling of the target solution, as described in FSAR Subsection 7.4.4.1.7. The low PCLS flow limit results in an IU Cell Safety Actuation with a time delay of 180 seconds. The time delay prior to an IU Cell Safety Actuation on low PCLS flow is based on the acceptability of a complete loss of cooling without neutron driver operation for up to 180 seconds prior to transferring target solution to the TSV dump tank (an IU Cell Safety Actuation). The TRPS also initiates a loss of cooling Driver Dropout on low PCLS cooling water flow to open the NDAS HVPS breakers without a timed delay. This actuation shuts down the neutron driver to prevent overheating of the target solution, while allowing the target solution to remain within the TSV. The breakers are then interlocked open until the PCLS flow and temperature are in the allowable range. If PCLS flow and temperature are not in the allowable range within 180 seconds, an IU Cell Safety Actuation is initiated, as described above.

With one channel inoperable, the SFM for the associated channel is placed in trip within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months and the associated channel is restored to operable within 30 days. With two redundant channels inoperable, the associated IU is required to be placed in Mode 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , during which PCLS cooling is not required. With three redundant channels inoperable, the associated IU is required to be placed in Mode 3 within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

f. The PCLS temperature signal is used to provide both a high PCLS temperature limit and a low PCLS temperature limit. The PCLS temperature signal is required to be Operable in Modes 1 and 2 to monitor temperature while target solution is in the TSV.

The high PCLS temperature limit of 72.9°F (22.7°C) is based on an analytical limit of 77°F (25°C) as described in FSAR Subsection 4a2.7.9. PCLS is required to maintain cooling to the TSV during irradiation to prevent boiling of the target solution as described in FSAR Subsection 7.4.4.1.5. The high PCLS temperature limit results in an IU Cell Safety Actuation with a time delay of 180 seconds. The time delay prior to an IU Cell Safety Actuation is based on the acceptability of a complete loss of cooling for up to 180 seconds prior to transferring target solution to the TSV dump tank (an IU Cell Safety Actuation). This parameter also ensures the temperature of solution during the fill of the TSV during Mode 1 is within analyzed limits, as described in FSAR Subsection 7.4.4.1.5. The TRPS also initiates a loss of cooling Driver Dropout on high PCLS cooling water supply temperature to open the NDAS HVPS breakers without a timed delay. This actuation shuts down the neutron driver to prevent overheating of the target solution, while allowing the target solution to remain within the TSV. The breakers are then interlocked open until the PCLS flow and temperature are in the allowable range. If PCLS flow and temperature are not in the allowable range within 180 seconds, an IU Cell Safety Actuation is initiated, as described above.

The low PCLS temperature limit of 63.5°F (17.6°C) is based on an analytical limit of 59°F (15°C). The low temperature signal protects against overcooling of the target solution that could cause an excess positive reactivity insertion, as described in FSAR Subsection 7.4.4.1.6. This parameter also ensures the temperature of solution during the fill of the TSV during Mode 1 is within Page B 3.2-10 Revision 3

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3) analyzed limits, as described in FSAR Subsection 7.4.4.1.6. Falling below this setpoint results in an IU Cell Safety Actuation.

With one channel of PCLS temperature inoperable, the SFM for the associated channel is placed in trip within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months and the associated channel is restored to operable within 30 days. With two redundant channels inoperable, the associated IU is required to be placed in Mode 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , during which PCLS cooling is not required and target solution is drained to the favorable geometry TSV dump tank. With three redundant channels inoperable, the associated IU is required to be placed in Mode 3 within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

g. The TSV dump tank low-high limit of 3% is based on an analytical limit of

[ ]PROP/ECI, which equates to 6.2% of the [ ]PROP/ECI vertical span of the annular tank. The TSV dump tank low-high level protects against a leak of liquid into the TSV dump tank when the tank is expected to be empty, ensuring there is enough capacity in the TSV dump tank to receive a full TSV solution batch, as described in FSAR Subsections 4a2.2.1.10 and 7.4.4.1.8. Exceeding this setpoint results in an IU Cell Safety Actuation and an IU Cell Nitrogen Purge.

With one channel inoperable, the SFM for the associated channel is placed in trip within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months and the associated channel is restored to operable within 30 days. With two redundant channels inoperable, the associated IU is required to be placed in Mode 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . With three redundant channels inoperable, the associated IU is required to be placed in Mode 3 within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . Leak indication in Mode 3 is provided by the high-high TSV dump tank level.

h. The TSV dump tank high-high limit of 85% is based on an analytical limit of

[ ]PROP/ECI, which equates to 87.9% of the [ ]PROP/ECI vertical span of the annular tank. The TSV dump tank high-high level ensures the TSV dump tank solution height does not interfere with TOGS operation, as described in FSAR Subsection 7.4.4.1.9. Exceeding this setpoint results in an IU Cell Safety Actuation and an IU Cell Nitrogen Purge.

With one channel inoperable, the SFM for the associated channel is placed in trip within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months and the associated channel is restored to operable within 30 days. With two redundant channels inoperable, the associated IU is required to be placed in Mode 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and Mode 0 within

[ ]PROP/ECI. With three redundant channels inoperable, the associated IU is required to be placed in Mode 3 within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months and Mode 0 within

[ ]PROP/ECI. Transfer of target solution out of the IU to achieve Mode 0 requires the target solution to be held in the TSV dump tank for at least the minimum period of time specified in LCO 3.1.8 prior to transfer. Approximately

[ ]PROP/ECI are required to complete the transfer of target solution to the RPF.

i. TOGS mainstream flow is measured independently for both TOGS Train A and TOGS Train B. The low TOGS mainstream flow limit of [ ]PROP/ECI is based on an analytical limit of [ ]PROP/ECI , which has been conservatively calculated to be sufficient to maintain hydrogen concentration within the TSV headspace at less than 4.0% by volume during normal operations. Maintaining a hydrogen concentration below 7.7% prevents a Page B 3.2-11 Revision 3

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3) deflagration that could challenge the PSB pressure safety limit. Additional description of TOGS mainstream flow is found in FSAR Subsections 4a2.8.6 and 7.4.4.1.11. Falling below the low TOGS mainstream flow setpoint results in an IU Cell Safety Actuation and an IU Cell Nitrogen Purge.

With one channel inoperable on either TOGS train, the SFM for the associated channel is placed in trip within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months and the associated channel is restored to operable within 30 days. With two redundant channels inoperable, the associated IU is required to be placed in Mode 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and Mode 0 within [ ]PROP/ECI. With three redundant channels inoperable, the associated IU is required to be placed in Mode 3 within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months and Mode 0 within [ ]PROP/ECI. Transfer of target solution out of the IU to achieve Mode 0 requires the target solution to be held in the TSV dump tank for at least the minimum period of time specified in LCO 3.1.8 prior to transfer. Approximately [ ]PROP/ECI are required to complete the transfer of target solution to the RPF.

j. TOGS dump tank flow is only measured on TOGS Train A, the only TOGS train that serves the TSV dump tank. The low TOGS dump tank flow limit of

[ ]PROP/ECI is based on an analytical limit of [ ]PROP/ECI, which has been conservatively calculated to be sufficient to maintain hydrogen concentration within the TSV dump tank of less than 4.0% during normal operations. Maintaining a hydrogen concentration below 7.7% prevents a deflagration that could challenge the PSB pressure safety limit. Additional description of TOGS mainstream flow is found in FSAR Subsections 4a2.8.6 and 7.4.4.1.12. Falling below this setpoint results in an IU Cell Safety Actuation and an IU Cell Nitrogen Purge.

With one channel inoperable, the SFM for the associated channel is placed in trip within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months and the associated channel is restored to operable within 30 days. With two redundant channels inoperable, the associated IU is required to be placed in Mode 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and Mode 0 within

[ ]PROP/ECI. Transfer of target solution out of the IU to achieve Mode 0 requires the target solution to be held in the TSV dump tank for at least the minimum period of time specified in LCO 3.1.8 prior to transfer. Approximately

[ ]PROP/ECI are required to complete the transfer of target solution to the RPF.

k. The low TOGS oxygen concentration limit of 11% is based on an analytical limit of 10%, which is sufficient to support the hydrogen/oxygen recombination function of the TOGS. Exceeding this setpoint results in an IU Cell Safety Actuation and an IU Cell Nitrogen Purge.

With one channel inoperable, the SFM for the associated channel is placed in trip within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months and the associated channel is restored to operable within 30 days. With two redundant channels inoperable, the associated IU is required to be placed in Mode 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and Mode 0 within

[ ]PROP/ECI. With three redundant channels inoperable, the associated IU is required to be placed in Mode 3 within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months and Mode 0 within [

]PROP/ECI. Transfer of target solution out of the IU to achieve Mode 0 requires the target solution to be held in the TSV dump tank for at least the minimum period of time specified in LCO 3.1.8 prior to transfer.

Page B 3.2-12 Revision 3

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)

Approximately [ ]PROP/ECI are required to complete the transfer of target solution to the RPF.

l. The high TOGS condenser demister outlet temperature limit of 73.4°F (23°C) is based on an analytical limit of 77°F (25°C). A high temperature is indicative of a failure of the condenser demister, with the potential for increased water holdup in TOGS. An increased water holdup in TOGS could adversely impact the ability for TOGS to perform its recombination function, as described in FSAR Subsection 7.4.4.1.13. In normal operation, TOGS maintains hydrogen concentrations below levels that could result in a hydrogen deflagration in the PSB via hydrogen and oxygen recombination. Exceeding this setpoint results in an IU Cell Safety Actuation and an IU Cell Nitrogen Purge.

With one channel inoperable, the SFM for the associated channel is placed in trip within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months and the associated channel is restored to operable within 30 days. With two redundant channels inoperable, the associated IU is required to be placed in Mode 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and Mode 0 within

[ ]PROP/ECI. With three redundant channels inoperable, the associated IU is required to be placed in Mode 3 within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months and Mode 0 within

[ ]PROP/ECI. Transfer of target solution out of the IU to achieve Mode 0 requires the target solution to be held in the TSV dump tank for at least the minimum period of time specified in LCO 3.1.8 prior to transfer. Approximately

[ ]PROP/ECI are required to complete the transfer of target solution to the RPF.

SR The surveillance requirements ensure the continued operability of the TRPS process variable instrument channels. Channel Check, Channel Test, and Channel Calibration frequencies are based on guidance from ANSI/ANS 15.1-2007 and ensure the instrumentation is capable of performing its intended function when required. Performance of these surveillances may require the channel to be temporarily inoperable (bypassed). The temporary bypass is acceptable based on continuous attendance to the instrumentation by personnel performing the surveillance, the limited time duration of the activity, and industry experience.

Basis 3.2.4 LCO ESFAS process variable instrumentation is required to initiate safety functions specified by the SHINE safety analysis, as described in FSAR Subsection 7.5.3.1.

LCO 3.2.4 addresses the input devices and the trip determination portions of ESFAS. The scope of this LCO (i.e., each channel) begins at the input devices, includes the safety function modules (SFMs) and extends to the inputs to the SBVMs or SBMs. Radiation monitors that provide inputs to ESFAS are addressed in LCO 3.7.1.

More than one input device provides a signal to each SFM. The following table describes the allocation of inputs to the ESFAS modules:

Page B 3.2-13 Revision 3

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)

Table B-3.2.4 ESFAS Input Variable Allocation Variable Division A Division B Division C

a. MEPS A [ [

]PROP/ECI conductivity MEPS B [

]PROP/ECI conductivity MEPS C [

]PROP/ECI conductivity

b. PVVS carbon delay bed group 1 carbon monoxide PVVS carbon delay bed group 2 carbon monoxide PVVS carbon delay bed group 3 carbon monoxide

c. VTS vacuum header liquid detection

d. RDS liquid detection

e. PVVS flow

f. Dissolution tank level

g. UPSS loss of external power

h. MEPS Area A three-way valve position indication MEPS Area B three-way valve position indication MEPS Area C three-way valve position indication

i. IXP three-way valve position indication

j. TPS IU Cell 1 target chamber supply pressure TPS IU Cell 2 target ]PROP/ECI chamber supply pressure Page B 3.2-14 Revision 3

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)

Variable Division A Division B Division C TPS IU Cell 3 target [

chamber supply pressure TPS IU Cell 4 target chamber supply pressure TPS IU Cell 5 target chamber supply pressure TPS IU Cell 6 target chamber supply pressure TPS IU Cell 7 target chamber supply pressure TPS IU Cell 8 target chamber supply pressure

k. TPS IU Cell 1 target chamber exhaust pressure TPS IU Cell 2 target chamber exhaust pressure TPS IU Cell 3 target chamber exhaust pressure TPS IU Cell 4 target chamber exhaust pressure TPS IU Cell 5 target chamber exhaust pressure TPS IU Cell 6 target chamber exhaust pressure TPS IU Cell 7 target chamber exhaust pressure TPS IU Cell 8 target ]PROP/ECI chamber exhaust pressure Two ESFAS process variable instrumentation channels are provided for the variables in Table 3.2.4-a, one channel for each of Divisions A and B, with the exception of low PVVS flow (item e.), which is provided three channels. Two channels of any process variable instrumentation are required to be Operable to provide redundancy to protect against a single failure.

Each SFM can be placed in maintenance bypass or in a trip state by use of the out-of-service (OOS) switch located on the front of the SFM and an associated trip/bypass switch located below the SFM, as described in FSAR Subsection Page B 3.2-15 Revision 3

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3) 7.5.4.4. Placing an SFM in trip or bypass causes all channels associated with that SFM to be placed in trip or bypass, respectively.

For variables provided with two channels, actuation of the safety function occurs on 1-out-of-2 voting logic. For the low PVVS flow signal (item e.), when all three channels are Operable, actuation of the safety function occurs on 2-out-of-3 voting logic. When any single channel is inoperable, the inoperable channel is required to be placed in trip within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , effectively changing the voting logic to 1-out-of-2, preserving the single failure protection. A completion time of 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months allows for the action to be accomplished in an orderly manner.

Performance of a Channel Test or Channel Calibration may cause a channel to be unable to perform its safety function during the SR. To allow the performance of these SRs during operation of equipment protected by ESFAS, any single channel for any of the ESFAS process instrumentation variables may be placed in bypass for up to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months during performance of a required SR on a channel associated with that SFM, effectively changing the voting logic to 2-out-of-2 (with two other channels Operable) or 1-out-of-1 (with one other channel Operable). A time limit of 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months is acceptable based on the small amount of time the channel could be in bypass, the continual attendance by operations or maintenance personnel during the test, the continued operability of the redundant channel(s),

and the low likelihood that an accident would occur during the 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months time period.

When a channel is declared inoperable due to an inoperable input device or other issue associated with only one input on an SFM, only the applicable action(s) listed in Table 3.2.4-a for the affected channel are required to be completed within the specified completion time, or the condition of applicability exited.

When a channel is declared inoperable due to an inoperable module (SFM), all variables (i.e., channels) associated with that module as listed in Tables B-3.2.4 and B-3.7.1 are inoperable. Applicable action(s) listed in Tables 3.2.4-a and 3.7.1-a for all affected channels are required to be completed within the specified completion time, or the condition(s) of applicability exited.

Any inoperable SFM that has been placed in trip in accordance with this LCO is required to be restored to Operable within 30 days. A completion time of 30 days allows for replacement of failed components, while limiting the amount of time equipment protected by the ESFAS is allowed to operate with reduced ESFAS reliability. The 30 day duration is acceptable because placing the SFM in trip preserves the single failure criterion for the remaining Operable modules.

Additional discussion for each variable listed in Table 3.2.4-a is provided below:

a. The ESFAS monitors conductivity in the MEPS [ ]PROP/ECI to protect against a leakage of high radiation solutions into the MEPS [

]PROP/ECI, as described in FSAR Section 4b.3 and Subsection 7.5.4.1.6. The MEPS [ ]PROP/ECI extend outside of the supercell; radioactive material in the loop would lead to increased radiological doses to workers, as described in FSAR Subsection 13b.1.2.3 (Scenario 14). Two channels of conductivity instrumentation are provided for each extraction hot cell. Conductivity exceeding 478 µmho/cm results in a MEPS [

]PROP/ECI Isolation for that [ ]PROP/ECI for the associated extraction cell, and provides margin to an analytical limit of 500 µmho/cm.

Page B 3.2-16 Revision 3

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)

With one channel inoperable, the MEPS [ ]PROP/ECI isolation valves are required to be closed, and the extraction feed pump breakers are required to be opened within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months , to complete the MEPS [

]PROP/ECI Isolation function. A completion time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allows for the performance of minor repairs and is acceptable based on the continued availability of the redundant channel. With both channels inoperable, the MEPS [ ]PROP/ECI isolation valves are required to be closed, and the extraction feed pump breakers are required to be opened within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months , to complete the MEPS [ ]PROP/ECI Isolation function. A completion time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months recognizes the importance of promptly isolating the equipment to mitigate a potential accident once the safety function has been lost.

b. The ESFAS monitors the carbon monoxide concentration of the gases leaving the PVVS carbon delay beds to protect against a fire in the carbon delay beds, as described in FSAR Subsections 6b.2.2 and 7.5.4.1.7. The setpoint of 42 ppm provides indication of combustion occurring inside of a carbon delay bed within the delay bed group and provides margin to an analytical limit of 50 ppm. Two channels of carbon monoxide instrumentation is provided for each carbon delay bed group. Exceeding the carbon monoxide setpoint results in a Carbon Delay Bed Isolation for the affected delay bed group.

With one channel for a single carbon delay bed group inoperable, the group is required to be isolated within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months to fulfill the Carbon Delay Bed Isolation function. Five carbon delay beds must also be verified to be Operating within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . A completion time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allows for the performance of minor repairs and is acceptable based on the continued availability of the redundant channel. With both channels for a single carbon delay bed inoperable, the group is required to be isolated within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months to fulfill the Carbon Delay Bed Isolation function. Five carbon delay beds must also be verified to be Operating within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . A completion time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months recognizes the importance of promptly isolating the equipment to prevent the potential for an event when the safety function has been lost. The completion time is acceptable based on the low likelihood of an event during the limited time. When a carbon delay bed group is isolated in accordance with this LCO, the applicable actions from LCO 3.5.1 are also required to be entered to manage the length of time the carbon delay beds are inoperable.

Verification of the number of Operating carbon delay beds additionally allows the prompt entry into LCO 3.5.1 if necessary.

Additional individual isolation valves are provided on the inlet and outlet of each carbon delay bed to isolate an individual bed as required for maintenance. At least seven of the eight carbon delay beds are required to be Operating to provide the design noble gas residence time. If only five or six carbon delay beds are Operating, the noble gas residence time is reduced, affecting the total curies released from the facility. The total curies released from the facility are managed in accordance with LCO 3.7.2.

c. The ESFAS monitors for the presence of liquid in the VTS vacuum header to protect against an overflow of liquid out of the VTS lift tanks, as described in FSAR Subsections 6b.3.1.5, 7.5.4.1.8, and 9b.2.5.3. Two Divisions of liquid detection are located in the VTS vacuum header serving all lift tanks that may contain target solution. The detection of liquid results in a VTS Safety Page B 3.2-17 Revision 3

Actuation to stop any in-progress transfers of fluid. The function is required to prevent degrading one of the controls to prevent a criticality, by preventing target solution entering non-favorable geometry locations in the VTS system, as described in FSAR Subsection 6b.3.2.5.

With one channel inoperable, the VTS vacuum pump breakers and VTS vacuum break valves are required to be opened within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months to stop the transfer of solution within the facility. A completion time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allows for the performance of minor repairs and is acceptable based on the continued availability of the redundant channel. With both channels inoperable, the VTS vacuum pump breakers and VTS vacuum break valves are required to be opened within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months to stop the transfer of solution within the facility. A completion time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months recognizes the importance of taking prompt action when equipment credited for the prevention of an unintended criticality is unable to perform its required function. The completion time is acceptable based on the low likelihood of an event during the limited time.

d. The ESFAS monitors for the presence of liquid in the RDS to protect against overflow of high radiation liquids into the RDS sump tanks, as described in FSAR Subsections 7.5.4.1.9 and 9b.2.5.3. The detection of liquid in the RDS sump tanks results in a VTS Safety Actuation to stop any in-progress transfers of liquid. A filled RDS sump tank prevents that tank from accepting leakage in the event of a leak of target solution into a tank vault, valve pit, pipe trench or in the supercell. The VTS Safety Actuation signal is allowed to be bypassed to restart the VTS and remove solution from the RDS sump tanks as part of the recovery from an instance where liquid has entered the tank.

With one channel inoperable, the VTS vacuum pump breakers and VTS vacuum break valves are required to be opened within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months to stop the transfer of target solution and radioactive liquid wastes within the facility. A completion time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allows for the performance of minor repairs and is acceptable based on the continued availability of the redundant channel.

With both channels inoperable, the VTS vacuum pump breakers and VTS vacuum break valves are required to be opened within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months to stop the transfer of target solution and radioactive liquid wastes within the facility. A completion time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months recognizes the importance of taking prompt action when the safety function has been lost. The completion time is acceptable based on the low likelihood of an event during the limited time.

e. PVVS blowers are required to dilute radiolytic hydrogen generated from irradiated target solution and radioactive liquid waste located in tanks in the RPF, as described in FSAR Subsection 6b.2.3. The low PVVS flow limit of 7.1 SCFM is based on an analytical limit of 5.0 SCFM and is indicative of a loss of the PVVS function. Low PVVS flow results in an RPF Nitrogen Purge Actuation, as described in FSAR Subsection 7.5.4.1.15. Three channels of PVVS flow are provided.

With one channel inoperable, the SFM for the associated channel is placed in trip within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months and must be restored to Operable within 30 days. With two or more channels inoperable, or when the required action and completion time for one inoperable channel is not met, the nitrogen purge system is actuated within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months to provide hydrogen mitigation for RPF tanks. A Page B 3.2-18 Revision 3

completion time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months recognizes the importance of taking prompt action when the safety function has been lost. The completion time is acceptable based on the low likelihood of an event during the limited time.

f. Level in the TSPS dissolution tank is monitored to prevent overflow of the tank and protect against a criticality event in a non-favorable geometry location, as described in FSAR Subsections 6b.3.1.4 and 7.5.4.1.18. The setpoint of 98% provides margin to an analytical limit of 100%; exceeding the setpoint results in a Dissolution Tank Isolation.

With one channel inoperable, the Dissolution Tank Isolation components (i.e.,

RPCS supply cooling valves and the TSPS air inlet and RVZ1 exhaust isolation valves) are required to be closed within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . A completion time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allows for the performance of minor repairs and is acceptable based on the continued availability of the redundant channel. With both channels inoperable, the Dissolution Tank Isolation components (i.e., RPCS supply cooling valves and the supply and exhaust ventilation dampers) are required to be closed within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . A completion time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months recognizes the importance of taking prompt action when equipment credited for the prevention of an unintended criticality is unable to perform its required function. The completion time is acceptable based on the low likelihood of an event during the limited time.

g. The ESFAS monitors for a loss of external power to the UPSS to protect against an impending loss of hydrogen mitigation via the TOGS in any IU in Modes 1 through 4, as described in FSAR Section 4a2.8 and Subsection 7.5.4.1.19. The ESFAS implements a 180 second timer prior to sending a signal to TRPS to provide margin to the five-minute UPSS runtime for the TOGS blowers and recombiners, as described in FSAR Subsection 8a2.2.3. Two channels are provided; one signal is received from each Division of the UPSS. This signal results in an IU Cell Nitrogen Purge.

With one channel inoperable, the channel is required to be restored within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . A completion time of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months allows for the performance of repairs, including issues that affect operability of the UPSS (see LCO 3.8.1), while minimizing the time that the reliability of the ESFAS is reduced. The completion time is acceptable based on the continued availability of the redundant channel. If both channels are inoperable, or one channel is inoperable for greater than 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months , all IUs undergoing irradiation are required to be placed in Mode 3 within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months to limit the production of hydrogen via radiolysis in the IUs. A completion time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months recognizes the importance of taking prompt action with the safety function has been lost. The completion time is acceptable based on the low likelihood of an event during the limited time.

h. Upper and lower MEPS three-way valves are provided for the extraction process in each extraction hot cell. The ESFAS monitors three-way valve position indication in the MEPS extraction column to protect against an incorrect valve configuration leading to misdirection of chemical reagents or target solution, as described in FSAR Subsection 7.5.4.1.16. Misdirected flow could result in uranium precipitation (if target solution is mixed with basic reagents). Misdirection also degrades one of the barriers relied on to prevent target solution from exiting the supercell, as described in FSAR Subsection Page B 3.2-19 Revision 3

13b.1.2.3 (Scenario 15). Both three-way valves in the supplying position results in an Extraction Column Alignment Actuation.

With one channel inoperable, the three-way valves and the eluate valve are required to be placed in their actuated states (i.e., three-way valves in discharging and the eluate valve closed) within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . A completion time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allows for the performance of minor repairs and is acceptable based on the continued availability of the redundant channel. With both channels inoperable, the three-way valves and the eluate valve are required to be placed in their actuated states within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . A completion time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months allows for the shutdown of the affected process in an orderly manner and is acceptable based on the low likelihood of an event during the controlled shutdown.

i. Upper and lower IXP three-way valves are provided for the extraction process in the IXP hot cell. The ESFAS monitors three-way valve position indication in the IXP extraction column to protect against an incorrect valve configuration leading to misdirection of chemical reagents or target solution, as described in FSAR Subsection 7.5.4.1.17. Misdirected flow could result in uranium precipitation (if target solution is mixed with basic reagents). Misdirection additionally degrades one of the barriers relied on to prevent target solution from exiting the supercell. Both three-way valves in the supplying position results in an IXP Alignment Actuation.

With one channel inoperable, the three-way valves and the eluate valve are required to be placed in their actuated states (i.e., three-way valves in discharging and the eluate valve closed) within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . A completion time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allows for the performance of minor repairs and is acceptable based on the continued availability of the redundant channel. With both channels inoperable, the three-way valves and the eluate valve are required to be placed in their actuated states within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . A completion time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months allows for the shutdown of the affected process in an orderly manner and is acceptable based on the low likelihood of an event during the controlled shutdown.

j. - k The high TPS target chamber supply and exhaust pressure limit of 7.7 psia (53.1 kPa absolute) is based on an analytical limit of 8 psia (55.2 kPa absolute). The supply and exhaust lines are normally maintained at near vacuum. The high pressure signal indicates a loss of vacuum within a neutron driver or TPS system and a potential tritium release inside the IU cell, as described in FSAR Subsections 7.5.4.1.10 and 7.5.4.1.11. Exceeding the setpoint results in a TPS Train Isolation.

With one channel inoperable, tritium supply is required to be isolated to the NDAS target chamber within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months by closing at least one TPS target chamber supply line valve per associated IU. A completion time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allows for the shutdown of the affected IUs in an orderly manner and is acceptable based on the low likelihood of an event during the controlled shutdown. With both channels inoperable, tritium supply is required to be isolated to the NDAS target chamber within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months by closing at least one TPS target chamber supply line valve per associated IU. A completion time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months reflects the importance isolating tritium to the IU cell when Page B 3.2-20 Revision 3

instrumentation relied on for detection of an event is lost. The completion time is acceptable based on the low likelihood of an event during the time period.

SR The surveillance requirements ensure the continued operability of the ESFAS process variable instrument channels. Channel Check, Channel Test, and Channel Calibration frequencies are based on guidance from ANSI/ANS 15.1-2007 and ensure the instrumentation is capable of performing its intended function when required. Performance of these surveillances may require the channel to be temporarily inoperable (bypassed). The temporary bypass is acceptable based on continuous attendance to the instrumentation by personnel performing the surveillance, the limited time duration of the activity, and industry experience.

Page B 3.2-21 Revision 3

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3) 3.3 Coolant Systems Objective: To ensure that target solution heat removal is adequate to maintain the target solution temperature within an acceptable range.

LCO 3.3.1 The light water pool water level shall be 14 feet, relative to the bottom of the pool.

Note - This LCO is applied to each IU independently; actions are only applicable to the IU(s) that fail to meet the LCO during the associated condition(s) of applicability.

Applicability According to Table 3.3.1 Action According to Table 3.3.1 SR 3.3.1 The light water pool water level shall be verified to be above the minimum specified level prior to entering Mode 1.

Table 3.3.1 Light Water Pool Level Actions Applicability Action Completion (per IU) (per IU) Time

1. Mode 1 or 2 If the light water pool is less than the minimum level, Place the associated IU in Mode 3 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months AND Place the associated IU in Mode 0. [ ]PROP/ECI

2. Mode 3 or 4 If the light water pool is less than the minimum level, Place the associated IU in Mode 0. [ ]PROP/ECI Page 3.3-1 Revision 3

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)

Basis 3.3.1 LCO The light water pool has a nominal height of 15 feet. The light water pool minimum water level of 14 feet is required to provide additional biological shielding in conjunction with the concrete shielding as described in FSAR Subsection 4a2.4.2.3. The minimum water level is required to ensure radiation levels to metal components are within analyzed levels to prevent unacceptable activation of metal components. The water in the light water pool also ensures that the temperature and energy flux incident upon the concrete of the irradiation unit cell biological shield (ICBS) are below one or both of the allowable limits of 1E10 MeV/cm2-s or 149°F (65°C), as described in FSAR Subsection 4a2.5.3.2. A minimum level of [ PROP/ECI is required for decay heat removal, as described in FSAR Subsections 4a2.4.2.2 and 13a2.1.5.

A rapid loss of pool level is not expected, as piping penetrations through the light water pool liner are either above the pool water level required for decay heat removal, or a specific evaluation is performed to determine the potential for loss of pool water through the penetration. Piping penetrations into the light water pool with the potential for siphoning below the minimum acceptable water level contain anti-siphon devices or other means to prevent inadvertent loss of pool water. Additional discussion is provided in FSAR Subsection 4a2.4.2.1.

With the pool level not within limits, the IU shall be placed in Mode 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and Mode 0 within [ ]PROP/ECI. The transfer to Mode 3 may be accomplished by initiating a manual IU Cell Safety Actuation, or by cycling the IU Mode through Mode 2 to Mode 3 to perform a normal shutdown. The completion time is acceptable due to a low likelihood of a rapid loss of pool water level and the margin between the LCO limit of 14 feet and the minimum water level required for decay heat removal. This completion time is adequate to verify light water pool indications and, if necessary, place the affected IU first in a shutdown, then in an empty, condition. Transfer of target solution out of the IU to achieve Mode 0 requires the target solution to be held in the TSV dump tank for at least the minimum period of time specified in LCO 3.1.8 prior to transfer.

Approximately [ ]PROP/ECI are required to complete the transfer of target solution to the RPF.

SR The surveillance requirement ensures the light water pool water level meets minimum requirements prior to entering the condition of applicability. A rapid loss of pool level during operation is not expected. During operation, loss of pool level would result in control room alarms to alert the operator.

Page B 3.3-1 Revision 3

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3) 3.4 Confinement Objective: To prevent radiation exposure to workers or the public in excess of acceptable limits.

LCO 3.4.1 Each primary Confinement boundary or PSB isolation valve listed in Table 3.4.1-a shall be Operable. A valve is considered Operable if:

1. The valve is capable of opening or closing on demand from TRPS Note - A single isolation valve in a flow path may be inoperable for up to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months during the performance of required surveillances.

Note - This LCO is applied to each IU independently; actions are only applicable to the IU(s) that fail to meet the LCO during the associated condition(s) of applicability.

Applicability Associated IU in Mode 1, 2, 3, or 4 Action According to Table 3.4.1 SR 3.4.1 Valves and dampers listed in Table 3.4.1-a shall be stroke tested quarterly.

Table 3.4.1 Confinement Boundary and Isolation Actions Action Completion (per IU) Time

1. If one or more flow path(s) with one or more isolation valve(s) is inoperable, Close at least one valve in the affected flow path 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months OR Place the associated IU in Mode 3 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months AND Place the associated IU in Mode 0. [ ]PROP/ECI

2. If one or more flow path(s) with one or more isolation valve(s) is inoperable, Place the associated IU in Mode 3 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months AND Place the associated IU in Mode 0. [ ]PROP/ECI Page 3.4-1 Revision 3

Table 3.4.1-a Isolation Valves Number Component Provided per Action Flow Path

a. TSV fill isolation valves 2 1

b. TSV dump tank drain isolation valve 1 1

c. VTS lower lift tank target solution valve 1 1

d. TOGS gas supply isolation valves 2 1

e. TOGS vacuum tank isolation valves 2 1

f. N2PS inerting gas supply isolation valves 2 2

g. TOGS nitrogen vent isolation valves 2 2

h. TOGS RPCS return isolation valve 1 2

i. TOGS RPCS supply isolation valves 2 2

j. RVZ1e IU cell exhaust (PCLS expansion tank) ventilation 2 2 valves

k. RVZ1r RPCS supply isolation valve 1 2

l. RVZ1r RPCS return isolation valve 1 2

m. PCLS supply isolation valve 1 2

n. PCLS return isolation valves 2 2

o. TPS target chamber supply isolation valves 2 1

p. TPS deuterium supply isolation valves 2 1

q. TPS target chamber exhaust isolation valves 2 1

r. TPS neutron driver evacuation isolation valves 2 1

s. NDAS target/ion source cooling supply isolation valve 1 1

t. NDAS target/ion source cooling return isolation valve 1 1

u. NDAS vacuum pump cooling supply isolation valve 1 1

v. NDAS vacuum pump cooling return isolation valve 1 1 Page 3.4-2 Revision 3

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)

LCO 3.4.2 The Confinement check valves listed in Table 3.4.2-a shall be Operable.

Note - This LCO is applied to each IU or TPS train independently; actions are only applicable to the IU(s) or TPS train(s) that fail to meet the LCO during the associated condition(s) of applicability.

Applicability According to Table 3.4.2-a Action According to Table 3.4.2 SR 3.4.2 The check valves listed in Table 3.4.2-a shall be inspected annually.

Table 3.4.2 Confinement Check Valve Actions Action Completion (per IU or per TPS train) Time

1. If the check valve is inoperable, Place the associated IU in Mode 3 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months AND Place the associated IU in Mode 0. [ ]PROP/ECI

2. If the check valve is inoperable, Place the associated IU in Mode 3 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months AND Close the PCLS supply isolation valve. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months

3. If the check valve is inoperable, Close the TPS isolation valve in the affected flow path. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Table 3.4.2-a Confinement Check Valves Component Applicability Action

a. TOGS RPCS return check valve Associated IU in Mode 1, 2, 3, or 4 1

b. N2PS inerting gas supply check valves Associated IU in Mode 1, 2, 3, or 4 1 (per parallel N2PS inerting gas supply flow path)

c. PCLS supply check valve Associated IU in Mode 1, 2, 3, or 4 2

d. TPS glovebox pressure control check Tritium in associated TPS process 3 valve equipment not in storage

e. TPS helium supply check valve Tritium in associated TPS process 3 equipment not in storage Page 3.4-3 Revision 3

LCO 3.4.3 Each tritium Confinement boundary valve for each TPS glovebox listed in Table 3.4.3-a shall be Operable. A valve is considered Operable if:

1. The valve is capable of closing on demand from ESFAS Note - A single valve in a flow path may be inoperable for up to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months during the performance of required surveillances.

Note - This LCO is applied to each TPS train independently; actions are only applicable to the TPS train(s) that fail to meet the LCO during the associated condition(s) of applicability.

Applicability Tritium in associated TPS process equipment not in storage Action According to Table 3.4.3 SR 3.4.3 1. Valves listed in Table 3.4.3-a shall be closure tested quarterly.

2. Each TPS glovebox shall be leak-tested every two years.

Table 3.4.3 TPS Glovebox Confinement Boundary Valve Actions Action Completion (per TPS Train) Time

1. If one or more flow path(s) with one or more isolation valve(s) is inoperable, Place tritium in the associated train of TPS process equipment in its storage location 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months OR Close at least one valve in the affected flow path. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Table 3.4.3-a TPS Glovebox Confinement Valves Number Provided per Component TPS Train, per Flow Path

a. TPS glovebox pressure control isolation valves 1

b. TPS impurity treatment system (ITS) isolation valves 2

c. TPS helium supply valves 1

d. TPS vacuum isolation valves 2 Page 3.4-4 Revision 3

LCO 3.4.4 Each supercell Confinement damper listed in Table 3.4.4-a shall be Operable. A damper is considered Operable if:

1. The damper is capable of closing on demand from ESFAS Note - A single damper in a flow path may be inoperable for up to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months during the performance of required surveillances.

Applicability Supercell process operations in-progress in the associated hot cell Action According to Table 3.4.4 SR 3.4.4 1. Dampers listed in Table 3.4.4-a shall be closure tested quarterly.

2. Dampers listed in Table 3.4.4-a shall be leak-tested every two years.

Table 3.4.4 Supercell Confinement Damper Actions Action Completion Time

1. If one or more flow path(s) with one isolation damper is inoperable, Close at least one damper in the affected flow path 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months OR Suspend hot cell operations involving the introduction of liquids into the associated hot cell 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months AND Drain target solution and radioactive liquids in process lines from the associated hot cell. 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months

2. If one or more flow path(s) with two isolation dampers are inoperable, Close at least one damper in the affected flow path 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months OR Suspend hot cell operations involving the introduction of liquids into the associated hot cell 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months AND Drain target solution and radioactive liquids in process lines from the associated hot cell. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Page 3.4-5 Revision 3

Table 3.4.4-a Supercell Confinement Dampers Number Component Provided per Flow Path

a. Supercell area 1 2

1. RVZ2 inlet isolation dampers (per location)

2. RVZ1 outlet isolation dampers

b. Supercell area 2 2

1. RVZ2 inlet isolation dampers (per location)

2. RVZ1 outlet isolation dampers

c. Supercell area 3 2

1. RVZ2 inlet isolation dampers (per location)

2. RVZ1 outlet isolation dampers

d. Supercell area 4 2

1. RVZ2 inlet isolation dampers (per location)

2. RVZ1 outlet isolation dampers

e. Supercell area 5 2

1. RVZ2 inlet isolation dampers (per location)

2. RVZ1 outlet isolation dampers

f. Supercell area 6 2

1. RVZ2 inlet isolation dampers (per location)

2. RVZ1 outlet isolation dampers

g. Supercell area 7 2

1. RVZ2 inlet isolation dampers (per location)

2. RVZ1 outlet isolation dampers

h. Supercell area 8 2

1. RVZ2 inlet isolation dampers (per location)

2. RVZ1 outlet isolation dampers

i. Supercell area 9 2

1. RVZ2 inlet isolation dampers (per location)

2. RVZ1 outlet isolation dampers

j. Supercell area 10 2

1. RVZ2 inlet isolation dampers (per location)

2. RVZ1 outlet isolation dampers Page 3.4-6 Revision 3

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)

Basis 3.4.1 LCO Primary Confinement and PSB isolation valves ensure Confinement of postulated radioactive material releases is provided. A number of process systems penetrate the primary Confinement boundary. Piping systems that penetrate the primary Confinement boundary capable of excessive leakage are equipped with one or more isolation valve(s) that serve as active Confinement or isolation components, except for the N2PS inerting gas supply and TOGS nitrogen vent to PVVS connections, which do not change state on an IU Cell Safety Actuation, and open on an IU Cell Nitrogen Purge to provide hydrogen gas mitigation.

Actuation of the valves is controlled by TRPS. The primary Confinement boundary is further described in FSAR Subsection 6a2.2.1.1. The PSB is further described in FSAR Section 4a2.2.

LCO 3.4.1 addresses only the primary Confinement and PSB isolation valves actuated by the associated TRPS subsystem. The scope of this LCO begins at the outputs from the EIM(s) for the associated actuated components and extends through the actuated components.

When an isolation valve in a flow path is inoperable, the flow path may be isolated by closing at least one valve in the affected flow path within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months if permitted by Tables 3.4.1 and 3.4.1-a, or the associated IU may be placed in Mode 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and Mode 0 within [ ]PROP/ECI. The 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months completion time allows for investigation and the performance of minor repairs. If repairs are unable to restore the affected valves to Operable status, the completion time allows for the affected IU to be shut down or the affected processes to be halted in an orderly manner. For piping systems other than the NDAS cooling water lines, the action completion time is acceptable based on the continued availability of the redundant actuation valve (or redundant check valve) to perform the required function. The action completion time for inoperable NDAS cooling water isolation valves is acceptable based on the closed-loop design of the system and the low likelihood of a failure requiring the affected valve to isolate during the completion time. Transfer of target solution out of the IU to achieve Mode 0 requires the target solution to be held in the TSV dump tank for at least the minimum period of time specified in LCO 3.1.8 prior to transfer.

Approximately [ ]PROP/ECI are required to complete the transfer of target solution to the RPF. One valve in a flow path is allowed to be temporarily inoperable for up to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months for the performance of required surveillances.

Additional discussion for each component listed in Table 3.4.1-a is provided below:

a. TSV fill isolation valves isolate the PSB and are provided to prevent the introduction of target solution into the TSV outside of Mode 1 and to control the rate of TSV fill. The valves close on an IU Cell Safety Actuation and a Fill Stop. Two redundant valves, in series, are provided.

b. - c. The TSV dump tank drain isolation valve is provided to prevent inadvertent transfer of irradiated target solution or misdirected flow of liquids into the TSV dump tank. The valve isolates the PSB on an IU Cell Safety Actuation.

Redundant isolation valves to the dump tank drain isolation valves are provided by the VTS lower lift tank target solution valves. A single VTS lower lift tank target solution valve is provided for IU cell 1 and for IU cell 8. Piping Page B 3.4-1 Revision 3

downstream of the TSV dump tank drain isolation valve for IU cells 2 through 7 contains a branch; therefore, two parallel VTS lower lift tank target solution valves are provided for each of IU cells 2 through 7, one for each parallel branch.

d. - e. TOGS gas supply and vacuum tank isolation valves are provided to isolate the PSB and close on an IU Cell Safety Actuation. Two redundant valves, in series, are provided per flow path.

f. - g. N2PS inerting gas and TOGS nitrogen vent isolation valves provide a flow path for the N2PS to provide hydrogen mitigation for the IU on a loss of TOGS. The valves are opened on an IU Cell Nitrogen Purge. Two redundant valves, in parallel, are provided for each location. The N2PS inerting gas valves are also each equipped with a check valve to protect against reverse flow out of the IU cell. The option to close at least one valve in the affected flow path in response to an inoperable valve is not provided as the N2PS inerting gas and TOGS nitrogen vent isolation valves are required to be opened on an IU Cell Nitrogen Purge.

h. - i. TOGS RPCS supply and return isolation valves provide isolation of the Confinement boundary and prevent flooding of the PSB in the event of a leak into TOGS. The valves are closed on an IU Cell Safety Actuation. Two redundant TOGS RPCS supply isolation valves, in series, are provided, but only one TOGS RPCS return isolation valve is provided. Redundant isolation (to prevent water intrusion into the PSB) is provided by the TOGS RPCS return line check valve (see LCO 3.4.2). The option to close at least one valve in the affected flow path in response to an inoperable valve is not provided because RPCS cooling of TOGS is required when the TOGS is Operating.

j. RVZ1e IU cell exhaust ventilation valves are provided in the exhaust flow path of the PCLS expansion tank. These valves isolate the primary Confinement boundary and are closed on an IU Cell Safety Actuation. Two redundant dampers, in series, are provided. The option to close at least one valve in the affected flow path in response to an inoperable valve is not provided because ventilation of the PCLS expansion tank is required when the IU is Operating.

k. - l. RVZ1r RPCS supply and return isolation valves are provided to isolate the primary Confinement boundary and close on an IU Cell Safety Actuation. One supply and one return valve are provided. Redundant isolation is not required because the RVZ1r cooling coil is not open to the primary Confinement atmosphere. The option to close at least one valve in the affected flow path in response to an inoperable valve is not provided because RPCS cooling of RVZ1r is required when the IU is Operating.

m. - n. PCLS isolation valves are provided on the cooling water supply and return lines to isolate the primary Confinement boundary and close on an IU Cell Safety Actuation. Redundant PCLS return isolation valves and a single PCLS supply isolation valve is provided for each IU. Redundant isolation for the PCLS supply is provided by the PCLS supply check valve (see LCO 3.4.2).

The valves confine a leak of radioactive material into the PCLS to the primary Confinement. The PCLS communicates with the primary Confinement atmosphere (via the PCLS expansion tank vent line). The option to close at Page B 3.4-2 Revision 3

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3) least one valve in the affected flow path in response to an inoperable valve is not provided because PCLS cooling of the TSV is required when the IU is Operating.

o. - r. TPS valves are provided to isolate the primary Confinement boundary and close on an IU Cell Safety Actuation or on an IU Cell TPS Actuation. Two redundant valves, in series, are provided for each location.

s. - v. NDAS cooling water valves are provided to isolate the primary Confinement boundary and close on an IU Cell Safety Actuation. The NDAS cooling water lines are normally closed loops inside of the primary Confinement boundary.

One valve is provided for each location.

SR The closure testing ensures the continued operability of the valves and dampers.

The surveillance frequency is consistent with the recommendations from ANSI/ANS 15.1-2007.

Basis 3.4.2 LCO Check valves provide isolation functions as described below:

a. The TOGS RPCS return check valve, as described in FSAR Subsection 4a2.8.7, provides redundant isolation with the TOGS RPCS return isolation valve (see LCO 3.4.1, item h.), which allows TOGS to meet single failure criteria following the receipt of an isolation signal from TRPS.

With the check valve inoperable, the IU is required to be placed in Mode 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in Mode 0 within [ ]PROP/ECI in order to place the IU in a condition where the operation of TOGS is not required. Transfer of target solution out of the IU to achieve Mode 0 requires the target solution to be held in the TSV dump tank for at least the minimum period of time specified in LCO 3.1.8 prior to transfer. Approximately [ ]PROP/ECI are required to complete the transfer of target solution to the RPF. The completion time is adequate to perform the shutdown of the IU in an orderly manner and is acceptable based on the continued availability of redundant components.

b. The N2PS inerting gas supply check valves prevent backflow of a potential release in the IU cell into the N2PS header. One check valve is provided per parallel N2PS inerting gas supply flow path.

With a check valve inoperable, the IU is required to be placed in Mode 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in Mode 0 within [ ]PROP/ECI in order to remove target solution from the IU. Transfer of target solution out of the IU to achieve Mode 0 requires the target solution to be held in the TSV dump tank for at least the minimum period of time specified in LCO 3.1.8 prior to transfer. Approximately

[ ]PROP/ECI are required to complete the transfer of target solution to the RPF. The completion time is adequate to perform the shutdown of the IU in an orderly manner and is acceptable based on the continued availability of redundant components.

c. The PCLS supply check valve, as described in FSAR Subsection 4a2.8.7, provides redundant isolation with the PCLS supply isolation valve (see Page B 3.4-3 Revision 3

LCO 3.4.1, item l.), which allows PCLS to meet single failure criteria following the receipt of an isolation signal from TRPS.

With the check valve inoperable, the IU is required to be placed in Mode 3 (where PCLS cooling is not required), and the PCLS supply isolation valve is required to be closed within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to provide the isolation function. This completion time provides a reasonable time to investigate and repair minor problems, and, if necessary, provides adequate time to place the affected IU in a shutdown condition. The completion time is acceptable based on the continued availability of the redundant isolation valve.

d. - e. The TPS glovebox pressure control check valve and helium supply check valve provide redundant isolation with the TPS glovebox pressure control isolation valves and helium supply valves, respectively (see LCO 3.4.3, items

a. and c.). The tritium Confinement boundary is further described in FSAR Subsection 6a2.2.1.2.

With a check valve inoperable, the TPS isolation valve in the affected flow path is closed within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to provide the isolation function. This completion time provides a reasonable time to investigate and repair minor problems, and, if necessary, provides adequate time to isolate the affected flow path by a different means. The completion time is acceptable based on the availability of the automatic redundant isolation component.

SR The surveillance requirement ensures the continued operability of the check valves. The surveillance frequency is adequate based on the expected reliability of the passive components.

Basis 3.4.3 LCO Tritium Confinement boundary isolation valves for the TPS gloveboxes ensure that Confinement of postulated tritium releases is provided for each of the three TPS gloveboxes.

LCO 3.4.3 addresses only the tritium Confinement boundary isolation valves actuated by the ESFAS. The scope of this LCO begins at the outputs from the EIM(s) for the associated actuated components and extends through the actuated components.

The TPS gloveboxes use active isolation valves on the outlet ventilation ports of the glovebox and isolation valves for the tritium process piping. The valves close automatically upon loss of power or receipt of a TPS Train Isolation signal generated by the ESFAS. Redundancy for flow paths with only one isolation valve is provided by check valves (see LCO 3.4.2, items d. and e.). The two TPS glovebox pressure control isolation valves and two TPS helium supply valves are each arranged in parallel configurations; both parallel valves must be closed to provide the isolation function. The tritium Confinement boundary is further described in FSAR Subsection 6a2.2.1.2. The valves are required to be Operable to support the TPS Train A/B/C protective functions described in FSAR Subsections 7.5.3.1.18, 7.5.3.1.19, and 7.5.3.1.20. With one or more valve(s) inoperable in a flow path, tritium is required to be placed in its storage location (i.e., a depleted uranium bed), otherwise, at least one valve in the affected flow Page B 3.4-4 Revision 3

path into the affected TPS glovebox is required to be isolated. One valve in a flow path is allowed to be temporarily inoperable for up to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months to allow required surveillances to be performed.

If an isolation valve is inoperable, tritium is the associated train of TPS process equipment must be placed in its storage location, or the affected flow path must be isolated, within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . This completion time allows for investigation and correction of minor problems, and, if necessary, adequate time to place the components in a safe position; either by placing the tritium in a storage location or by isolating the affected flow path. The completion time is acceptable due to the continued availability of the redundant isolation valve (or redundant check valve). The likelihood of a system failure during this completion time is low.

SR The closure testing and leak testing ensures the continued operability of the safety-related valves and dampers and is based on recommendations from ANSI/ANS 15.1-2007.

Basis 3.4.4 LCO Supercell Confinement isolation dampers ensure Confinement of postulated radioactive material releases is provided.

LCO 3.4.4 addresses only the supercell Confinement isolation dampers actuated by the ESFAS. The scope of this LCO begins at the outputs from the EIM(s) for the associated actuated components and extends through the actuated components.

The supercell ventilation exhaust ductwork is fitted with radiation monitoring instrumentation to detect off-normal releases to the supercell Confinement areas (i.e., hot cells). Upon indication of a release exceeding setpoints, a Supercell Isolation of the affected hot cell is initiated by ESFAS, causing isolation dampers on both the inlet and outlet ducts to close and isolate the affected hot cell from the ventilation system. The supercell dampers are required to be Operable to support the Supercell Isolation protective functions described in FSAR Subsections 7.5.3.1.1 through 7.5.3.1.10.

With one damper inoperable in a flow path, at least one damper in the affected flow path is required to be isolated within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months ; otherwise, hot cell operations involving the introduction of liquids into the cell (e.g., extraction, column washing, elution) are suspended and target solution and radioactive liquids are drained from the associated hot cell within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . This completion time provides a reasonable time to investigate and repair minor problems, and, if necessary, isolate the affected flow path or remove the material at risk from the affected hot cell. The completion time is acceptable based on the continued availability of the redundant isolation damper. When both dampers in a flow path are inoperable, at least one damper in the affected flow path is required to be isolated within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months ; otherwise, hot cell operations involving the introduction of liquids into the cell (e.g., extraction, column washing, elution) are suspended and target solution and radioactive liquids are drained from the associated hot cell within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

This completion time is acceptable based on the low likelihood of release during Page B 3.4-5 Revision 3

the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months duration. One damper in a flow path is allowed to be temporarily inoperable for up to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months to allow required surveillances to be performed.

SR The closure testing and leak testing ensures the continued operability of the dampers and is based on recommendations from ANSI/ANS 15.1-2007.

Page B 3.4-6 Revision 3

3.5 Ventilation Systems Objective: To maintain ventilation systems within required parameters.

LCO 3.5.1 The PVVS shall be Operable. PVVS is considered Operable if:

1. At least 2 PVVS blowers are Operating, with total flow 7.1 SCFM,

2. At least 1 PVVS inlet header flow path is open,

3. At least 7 carbon delay beds are Operating, and

4. PVVS flow from the individual tanks listed in Table 3.5.1-a is above corresponding minimum flowrate.

Note - PVVS flow from individual tanks is allowed to drop below the minimum required flowrate during tank sparging or fluid transfer operations.

Applicability Facility not Secured Action According to Table 3.5.1 SR 3.5.1 1. Verify total flowrate at the exhaust of the PVVS is above the limit daily.

2. Verify flow from individual tanks listed in Table 3.5.1-a quarterly.

Table 3.5.1 PVVS Actions Action Completion Time

1. If fewer than 2 PVVS blowers are Operating, OR If PVVS total flow is < 7.1 SCFM, OR If no PVVS inlet header flow path is open, Actuate the RPF Nitrogen Purge. 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months

2. If fewer than 7 carbon delay beds are Operating, Restore at least 7 carbon delay beds to Operating. 60 days Page 3.5-1 Revision 3

Action Completion Time

3. If PVVS fewer than 5 carbon delay beds are Operating, OR Action and completion time of Condition 2 not met, Suspend operations to transition any IU in Mode 0 to Mode 1 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months AND Place all Mode 1 IUs in Mode 3 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months AND Verify a flow path exists for PVVS flow through the carbon 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months guard bed or its bypass, and through the Operating delay beds to the facility exhaust.

4. If PVVS flow from the individual tanks listed in Table 3.5.1-a is the corresponding minimum flowrate, Remove target solution or radioactive liquids from affected 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months tank(s).

Table 3.5.1-a PVVS Tank Flowrates Number of Minimum Flowrate Component Tanks Per Tank (SCFM)

a. Target solution hold tank 8 1.1E-01

b. Target solution storage tank 2 1.1E-01

c. Uranium waste tank 2 1.1E-01

d. Radioactive liquid waste collection tank 4 2.8E-01

e. Radioactive liquid waste blending tank 8 2.8E-01

f. Radioactive drain sump tank 2 1.1E-01 Page 3.5-2 Revision 3

Basis 3.5.1 LCO The PVVS ensures there is sufficient flow through process vessels to provide hydrogen mitigation and contamination control, as described in FSAR Subsection 9b.6.1. A minimum total PVVS flowrate of 7.1 SCFM, measured at the exhaust of PVVS, is based on an analytical limit of 5.0 SCFM and is calculated to maintain hydrogen concentration 3% by volume in tanks served by PVVS. The PVVS design flowrate is 16 SCFM, which is selected to achieve a xenon residence time of 40 days, preventing effluents from the facility from exceeding 10 CFR 20 limits. For PVVS to be considered Operable:

1. At least two PVVS blowers must be running providing flow above the minimum total exhaust flowrate. A loss of minimum PVVS flow results in an automatic RPF Nitrogen Purge.

2. Either the north or south inlet header flow path must be open. The N2PS RVZ2 north and south header valves provide the normal inlet flow path to PVVS. Inadvertent isolation of both flow paths valves renders the PVVS inoperable.

3. Seven (of eight) carbon delay beds are required to be Operating to capture iodine and provide the required noble gas residence time. A carbon delay bed is considered Operating when it contains carbon material and is not isolated.

4. PVVS flow from individual tanks ventilated by the PVVS are within required specification to maintain hydrogen concentration 3% by volume.

The carbon guard bed(s) function to protect the long-term capacity and efficiency of the carbon delay beds but are not required to be Operating to consider the PVVS Operable.

With PVVS inoperable due to fewer than the minimum number of PVVS blowers operating, PVVS total flow below the required minimum flowrate, or an insufficient PVVS inlet flow path, an RPF Nitrogen Purge is required to be actuated within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months to provide the hydrogen mitigation function. This completion time recognizes the importance of ensuring that the hydrogen mitigation function for the RPF is maintained.

Nonsafety-related isolation valves are provided on the inlet and outlet of each carbon delay bed to isolate an individual bed as required for maintenance. At least seven of the eight carbon delay beds are required to be Operating to provide the design noble gas residence time. If only five or six carbon delay beds are Operating, the noble gas residence time is reduced. With PVVS inoperable due to fewer than seven PVVS carbon delay beds Operating, at least seven carbon delay beds are required to be restored to Operating within 60 days. This condition is only allowed for up to 60 days, after which actions are taken to minimize the radionuclide inventory in the PVVS in accordance with action 3. The 60 day completion time allows for investigation and repair of a carbon delay bed if required. The completion time is acceptable based on the limited duration (less than one calendar quarter), allowing time for administrative mitigation actions to be taken in order for the facility to remain in compliance with annual release limits. The total curies released from the facility are managed in accordance with LCO 3.7.2.

Page B 3.5-1 Revision 3

With PVVS inoperable due to fewer than five PVVS carbon delay beds Operating, the valve alignments for the carbon guard and delay bed three-way valves and isolation valves and the carbon guard bed bypass valves are checked to confirm a flow path exists for the PVVS to the facility exhaust within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months to ensure the sweep gas flow path is sufficient. The completion time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is acceptable due to the availability of the ESFAS automatic safety function to initiate an RPF nitrogen purge on low PVVS flow (e.g., a blocked flow path).

Operations to start irradiation in any IU are not allowed, as irradiation increases the radionuclide inventory in the facility. Transition from Mode 1 to Mode 3 for all IUs in Mode 1 must be completed within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and may be accomplished by initiating a manual IU Cell Safety Actuation, or by cycling the IU Operating Mode through Mode 2 to Mode 3 to perform a normal shutdown without irradiating the target solution. The completion time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is acceptable based on the expected availability of at least one carbon delay bed or carbon guard bed to continue to provide limited hold up of radionuclides prior to release.

Additionally, when fewer than five PVVS carbon delay beds are Operating, operations to transition any IU to Mode 1 (filling) are not allowed and must be suspended within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months , since filling the TSV displaces gas from the TOGS to PVVS, increasing the radionuclide inventory in the PVVS. With fewer than the minimum number of PVVS carbon delay beds Operating, the radionuclide inventory is required to be limited due to the reduced available capacity of the PVVS to capture or delay radionuclides. IUs already in Modes 2, 3, or 4 may continue to be transitioned through the applicable IU Modes to Mode 0 as normal, but no new irradiation cycles are allowed to be started.

With PVVS inoperable due to low PVVS flow to one or more individual tank(s),

target solution or radioactive liquids are required to be removed (i.e., drained or vacuum lifted) from the affected tank(s) within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months to eliminate the need for sweep gas in that tank. This provides adequate time to repair a minor problem or remove radioactive liquids from affected tanks. The completion time is acceptable due to the low rate of hydrogen generation in these tanks.

SR The verification of flowrates ensures PVVS is Operating within design limits. The daily and quarterly verifications are based on industry experience. Flow excursions will result in control room alarms to alert the operator.

Page B 3.5-2 Revision 3

3.6 Emergency Power Objective: To ensure that safety-related emergency power is available to prevent or mitigate the consequences of design basis accidents.

LCO 3.6.1 Two Divisions of the UPSS shall be Operable.

Applicability Facility not Secure Action According to Table 3.6.1 SR 3.6.1 1. UPSS battery voltage and specific gravity shall be checked semi-annually.

2. UPSS discharge test shall be performed every five years.

Table 3.6.1 UPSS Actions Action Completion Time

1. If one Division of UPSS is inoperable, Restore the Division to Operable. 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months

2. If both Divisions of UPSS are inoperable, OR Associated action and completion time of Condition 1 not met Place all IUs undergoing irradiation in Mode 3 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months AND Open the VTS vacuum pump breakers 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months AND Open at least one VTS vacuum break valve 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months AND Place tritium in all three trains of TPS process equipment in 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months its storage location OR Initiate a TPS Train Isolation for all three gloveboxes. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Page 3.6-1 Revision 3

LCO 3.6.2 Safety-related breakers listed in Table 3.6.2-a shall be Operable. A breaker is considered Operable if:

1. The breaker is capable of tripping on demand from TRPS or ESFAS Applicability According to Table 3.6.2-a Action According to Table 3.6.2 SR 3.6.2 Safety-related breakers listed in Table 3.6.2-a shall be cycled annually.

Table 3.6.2 Safety-Related Breakers Actions Action Completion Time

1. If one Division of breakers for a single load listed in Table 3.6.2-a is inoperable, Open at least one redundant breaker. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months

2. If both Divisions of breakers for a single load listed in Table 3.6.2-a are inoperable, Open at least one redundant breaker. 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Table 3.6.2-a Safety-Related Breakers Required Component Applicability Divisions

a. RVZ1 exhaust blower breakers 2 Associated RVZ1 exhaust train (per train) operating

b. RVZ2 exhaust blower breakers 2 Associated RVZ2 exhaust train (per train) operating

c. RVZ2 supply blower breakers 2 Associated RVZ2 supply train (per train) operating

d. VTS vacuum transfer pump 2 Solution transfers using VTS in-breakers (per pump) progress

e. MEPS extraction feed pump 2 Target solution present in the breakers (per train) associated MEPS extraction hot cell

f. NDAS HVPS breakers 2 Associated IU in Mode 1, 2, 3, or 4 (per IU)

Page 3.6-2 Revision 3

Basis 3.6.1 LCO The safety-related uninterruptible electrical power supply system (UPSS) for the facility consists of two redundant Divisions of 125-volt direct current (VDC) batteries, inverters, bypass transformers, distribution panels, and other breakers and distribution equipment necessary to feed safety-related alternating current (AC) and direct current (DC) loads, as described in FSAR Section 8a2.2. The 48V power supplies for the TRPS and ESFAS cabinets are also within the scope of this LCO for the UPSS distribution system. The UPSS provides an emergency back-up power supply for safety-related equipment and monitoring which protects against a total or partial loss of normal facility power.

The UPSS minimum Operable Divisions ensures there is adequate backup battery power for postulated accident scenarios, as described in FSAR Subsection 8a2.2.3. A Division of the UPSS is Operable if it is capable of supplying power to its safety-related AC and DC loads from the battery, the breakers integral to the UPSS are capable of protecting the UPSS from an upstream fault, and the battery is sufficiently charged such that it is capable of supplying power for the minimum runtimes specified in FSAR Table 8a2.2-1.

A single overall electrical power system serves the main production facility, including both the irradiation facility and the radioisotope production facility, as well as the site and support buildings, as described in FSAR Section 8a2.1. The normal electrical power supply system receives off-site power from the local utility in two separate feeds for improved reliability.

The standby generator system (SGS) consists of a 480Y/277 VAC, 60 Hertz natural gas-driven generator, as described in FSAR Subsection 8a2.2.6.

Although not required by the accident analysis, the SGS is designed to automatically start and begin step loading within one minute of and complete power transfers within five minutes of the loss of off-site power (LOOP). The SGS is sized to carry the full load of both Divisions of the UPSS. The SGS supplies power to the UPSS buses, re-charges the UPSS batteries, supplies additional loads used for life-safety or facility monitoring, and allows operational flexibility while responding to the LOOP.

One Division of UPSS may be inoperable for 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to perform corrective or preventative maintenance. The 72-hour completion time is based on the availability of off-site power and the SGS. This provides a reasonable time to restore the UPSS to Operable status with an acceptably low risk. It also provides sufficient time to prepare and implement an orderly and safe facility shutdown if the UPSS is not restored to Operable status.

With both Divisions of UPSS inoperable, or if one Division is inoperable for greater than 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months , facility processes are required to be shut down to the extent practicable to minimize the risk of an accident coincident with a loss of off-site power. Placing all IUs undergoing irradiation in Mode 3 within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months minimizes the hydrogen production in IUs via radiolysis and may be performed via a manual IU Cell Safety Actuation or by cycling the IU Operating Mode through Mode 2 to Mode 3 to perform a normal shutdown. Opening the VTS vacuum pump breakers and at least one VTS vacuum break valve within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months stops the transfer of radioactive liquids throughout the facility and may be performed via a manual VTS Safety Actuation or by performing the actions individually. Placing tritium in the TPS gloveboxes in its storage location within 12 Page B 3.6-1 Revision 3

hours minimizes the risk of a release; otherwise, isolating the TPS gloveboxes within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months via a TPS Train Isolation places the TPS gloveboxes in an isolated condition. The likelihood of an event requiring the UPSS to be used during the allowed completion time is low. The completion times allow for adequate time to place the affected components in a safe condition and minimize the risk of extended operation with both divisions of UPSS inoperable.

SR The battery voltage, specific gravity, and discharge surveillance requirements ensure the operability of the UPSS and are consistent with the frequencies stated in ANSI/ANS 15.1-2007.

Basis 3.6.2 LCO The safety-related breakers are required to be Operable to support the safety functions described in FSAR Sections 7.4.3.1 and 7.5.3.1. Safety-related breakers are Operable if they are capable of being automatically opened on a receipt of a signal from the safety-related control system.

LCO 3.6.2 addresses only the safety-related breakers actuated by the TRPS or ESFAS. The scope of this LCO begins at the outputs from the EIM(s) for the associated actuated components and extends through the actuated components.

With one breaker for a single load inoperable, at least one redundant breaker is required to be opened within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months to shut down the associated equipment and fulfill the safety function. This allows adequate time to investigate and repair minor problems and limits the amount of time equipment is running with an inoperable breaker. The completion time is acceptable based on the continued availability of the redundant breaker Division to open if required. With two breakers for a single load inoperable at least one redundant breaker is required to be opened within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . This completion time recognizes the importance of taking prompt action when the automatic shutdown capability has been lost.

a. Two trains of RVZ1 exhaust blowers are provided. Each blower is provided with two Divisions of redundant safety-related breakers. These breakers are opened by ESFAS on an isolation of the RVZ1 RCA exhaust isolation dampers on an RCA Isolation, as described in FSAR Subsection 7.5.3.1.24.

Continued operation of the blowers can cause damage or excessive leakage of the isolation dampers.

b. Two trains of RVZ2 exhaust blowers are provided. Each blower is provided with two Divisions of redundant safety-related breakers. These breakers are opened by ESFAS on an isolation of the RVZ2 RCA exhaust isolation dampers on an RCA Isolation, as described in FSAR Subsection 7.5.3.1.24.

Continued operation of the blowers can cause damage or excessive leakage of the isolation dampers.

c. Two trains of RVZ2 supply blowers are provided. Each blower is provided with two Divisions of redundant safety-related breakers. These breakers are opened by ESFAS on an isolation of the RVZ2 RCA supply isolation dampers on an RCA Isolation, as described in FSAR Subsection 7.5.3.1.24. Continued operation of the blowers can cause damage or excessive leakage of the isolation dampers.

Page B 3.6-2 Revision 3

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)

d. Two VTS vacuum transfer pumps are provided. Each vacuum transfer pump is provided with two Divisions of redundant safety-related breakers. These breakers are opened by ESFAS on a VTS Safety Actuation, as described in FSAR Subsection 7.5.3.1.17. Opening these breakers prevents the vacuum transfer pump from moving target solution during an accident scenario limiting the amount of radioactive material that is potentially released.

e. Three trains of MEPS extraction cells are located in the supercell. Each extraction cell contains an extraction feed pump, and each extraction pump is provided with two Divisions of redundant safety-related breakers. These breakers are opened by ESFAS on a MEPS [ ]PROP/ECI Isolation for the associated extraction cell A, B, or C, as described in FSAR Subsections 7.5.3.1.11, 7.5.3.1.12, and 7.5.3.1.13. Opening these breakers prevents the extraction feed pump from moving target solution during an accident scenario, limiting the amount of radioactive material that is potentially released.

f. Each neutron driver in an IU is provided with two Divisions of redundant safety-related HVPS breakers. These breakers are opened on an IU Cell Safety Actuation, as described in FSAR Subsection 7.4.3.1.1 or a Driver Dropout, as described in FSAR Subsection 7.4.3.1.4. Opening the HVPS breakers prevents the neutron driver from producing neutrons in the target chamber. Terminating this neutron source removes a major heat input into the TSV and is an important step in moving the SCAS towards a shutdown condition SR Safety-related breakers are functionally tested annually, to ensure they will be capable of opening on demand. The frequency is based on industry experience.

Page B 3.6-3 Revision 3

3.7 Radiation Monitoring Systems and Effluents Objective: To ensure radiation levels within the facility and radiation released to the environment are within allowable limits.

LCO 3.7.1 Radiation monitoring instruments listed in Table 3.7.1-a shall be Operable.

Note - Any single SFM may be bypassed for up to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months while in the condition of applicability for the purpose of performing a Channel Calibration.

Applicability According to Table 3.7.1-a Action According to Table 3.7.1 SR 3.7.1 1. A Channel Check shall be performed for radiation monitors monthly.

2. A Channel Calibration shall be performed for radiation monitors annually.

Table 3.7.1 Safety-Related Radiation Monitor Actions Action Completion Time

1. If one channel is inoperable, Place the SFM for the associated channel in trip 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months AND Restore the channel to Operable. 30 days

2. If two channels are inoperable, OR Action and associated completion time of Condition 1 not met, Close at least one damper in each of the inlet and outlet ventilation for the associated hot cell. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months

3. If three channels are inoperable, Close at least one damper in each of the inlet and outlet ventilation for the associated hot cell. 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months

4. If one channel is inoperable, Close at least one damper in each of the inlet and outlet ventilation for the associated hot cell. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months

5. If two channels are inoperable, Close at least one damper in each of the inlet and outlet ventilation for the associated hot cell. 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Page 3.7-1 Revision 3

Action Completion Time

6. If two channels are inoperable, OR Action and associated completion time of Condition 1 not met, Place RCA Isolation actuation components in the actuated state. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months

7. If three channels are inoperable, Place RCA Isolation actuation components in the actuated state. 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months

8. If two or more channels are inoperable, Place the associated Mode 1 or Mode 2 IU in Mode 3 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months AND Close at least one RVZ1e IU cell ventilation damper for the associated IU cell. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months

9. If one or more channels are inoperable, Place tritium in the associated train(s) of TPS process equipment in its storage location 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months OR Close at least one redundant TPS Train Isolation device per TPS glovebox confinement flow path. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months

10. If two or more channels are inoperable, Place tritium in the associated train(s) of TPS process equipment in its storage location 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months OR Close at least one redundant TPS Train Isolation device per TPS glovebox confinement flow path. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Table 3.7.1-a Safety-Related Radiation Monitoring Instruments Applicability Setpoint and Required (per IU, TPS train, Monitored Location Monitored Action Channels or monitored Material location)

Supercell exhaust 5x background

a. ventilation (PVVS 3 Facility not Secured 1, 2, 3 hot cell) Fission products Page 3.7-2 Revision 3

Applicability Setpoint and Required (per IU, TPS train, Monitored Location Monitored Action Channels or monitored Material location)

Supercell exhaust 2 Target solution or ventilation 5x background radioactive process

b. (per hot 4, 5 (Extraction and IXP Fission products fluids present in the hot cells) cell) associated hot cell Radioisotope Supercell exhaust 2 5x background products or ventilation

c. (per hot radioactive process 4, 5 (Purification and Fission products cell) fluids present in the packaging hot cells) associated hot cell 5x background

d. RVZ1 RCA exhaust 3 Facility not Secured 1, 6, 7 Fission products 5x background

e. RVZ2 RCA exhaust 3 Facility not Secured 1, 6, 7 Fission products RVZ1e IU cell 5x background Associated IU in

f. 2 1, 8 exhaust Fission products Mode 1, 2, 3, or 4 2 Tritium in 927 Ci/m3 associated TPS

g. TPS confinement (per TPS 9 Tritium process equipment train) not in storage 0.96 Ci/m3 Tritium in any TPS TPS exhaust to

h. 3 process equipment 1, 10 facility stack Tritium not in storage LCO 3.7.2 The annually averaged concentration of radioactive material released in gaseous effluents to unrestricted areas shall be limited to 2800 times the concentrations specified in 10 CFR 20, Appendix B, Table 2, Column 1.

Applicability Facility not Secured Action According to Table 3.7.2 SR 3.7.2 1. Total curies released shall be assessed monthly.

2. A Channel Calibration of the stack release monitor shall be performed annually.

3. A Channel Calibration of the PVVS carbon delay bed effluent monitor shall be performed annually.

Page 3.7-3 Revision 3

Table 3.7.2 Gaseous Effluents Actions Action Completion Time

1. If the monthly curie assessment exceeds 1/12th of the limit, Verify the annual curie assessment is within the limit. 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Page 3.7-4 Revision 3

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)

Basis 3.7.1 LCO Safety-related radiation monitors are used to detect elevated levels of radiation that may result in radiation exposure to workers or individual members of the public in excess of allowable limits, as described in FSAR Subsection 7.7.1.

These radiation monitors also provide input in order to initiate safety functions specified by the SHINE safety analysis, as described in FSAR Subsections 7.4.3.1 and 7.5.3.1.

LCO 3.7.1 addresses the radiation monitoring input devices to the TRPS or ESFAS, and the associated trip determination portions of the TRPS or ESFAS.

The scope of this LCO, i.e., each channel, begins at the radiation monitoring input devices, includes the associated safety function modules (SFMs) and extends to the inputs to the SBVMs or SBMs. Additional inputs to the TRPS are addressed in LCO 3.2.3. Additional inputs to the ESFAS are addressed in LCO 3.2.4.

More than one input device provides a signal to each SFM. The following table describes the allocation of inputs to the TRPS and ESFAS modules:

Table B-3.7.1 Safety-Related Radiation Monitoring Input Allocation Input Division A Division B Division C

a. Supercell Area 1 [

exhaust ventilation (PVVS hot cell)

b. Supercell Area 2 exhaust ventilation (Extraction A hot cell)

Supercell Area 6 exhaust ventilation (Extraction B hot cell)

Supercell Area 7 exhaust ventilation (Extraction C hot cell)

Supercell Area ] PROP/ECI 10 exhaust ventilation (IXP hot cells)

Page B 3.7-1 Revision 3

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)

Input Division A Division B Division C

c. Supercell Area 3 [

exhaust ventilation (Purification A hot cell)

Supercell Area 5 exhaust ventilation (Purification B hot cell)

Supercell Area 8 exhaust ventilation (Purification C hot cell)

Supercell Area 4 exhaust ventilation (Packaging 1 hot cell)

Supercell Area 9 exhaust ventilation (Packaging 2 hot cell)

d. RVZ1 exhaust

e. RVZ2 exhaust

f. RVZ1e IU cell exhaust

g. TPS confinement A TPS confinement B TPS confinement C

h. TPS exhaust to facility stack

]PROP/ECI Page B 3.7-2 Revision 3

At least two channels of safety-related radiation monitors are provided for each monitored location. Some monitored locations are provided with three channels, as indicated in Table 3.7.1-a and FSAR Table 7.7-1. Only two channels are required to be Operable to provide redundancy to protect against a single failure.

Each SFM can be placed in maintenance bypass or in a trip state by use of the out-of-service (OOS) switch located on the front of the SFM and an associated trip/bypass switch located below the SFM, as described in FSAR Subsections 7.4.4.3 and 7.5.4.4. Placing an SFM in trip or bypass causes all channels associated with that SFM to be placed in trip or bypass, respectively.

For variables provided with three channels, actuation of the safety function occurs on 2-out-of-3 voting logic when all three channels are Operable.

When any single channel is inoperable for variables provided with three channels, the inoperable channel is required to be placed in trip within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , effectively changing the voting logic to 1-out-of-2, preserving the single failure protection. A completion time of 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months allows for the action to be accomplished in an orderly manner.

For variables provided with only two channels, actuation of the safety function occurs on 1-out-of-2 voting logic.

Performance of a Channel Calibration may cause a channel to be unable to perform its safety function during the SR. To allow the performance of these SRs during operation of equipment protected by TRPS or ESFAS, any single channel for any of the radiation monitoring instruments may be placed in bypass during performance of a required SR, effectively changing the voting logic to 2-out-of-2 (with two other channels Operable) or 1-out-of-1 (with one other channel Operable). A time limit of 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months is acceptable based on the small amount of time the channel could be in bypass, the continual attendance by operations or maintenance personnel during the test, the continued operability of the redundant channel(s), and the low likelihood that an accident would occur during the 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months time period.

When a channel is declared inoperable due to an inoperable radiation monitor or other issue associated with only one input on an SFM, only the applicable action(s) listed in Table 3.7.1-a for the affected channel are required to be completed within the specified completion time, or the condition of applicability exited.

When a channel is declared inoperable due to an inoperable module (SFM), all variables (i.e., channels) associated with that module as listed in Tables B-3.2.4 and B-3.7.1 are inoperable. Applicable action(s) listed in Tables 3.2.4-a and 3.7.1-a for all affected channels are required to be completed within the specified completion time, or the condition(s) of applicability exited.

Any inoperable SFM that has been placed in trip in accordance with LCO is required to be restored to Operable within 30 days. A completion time of 30 days allows for replacement of failed components, while limiting the amount of time equipment protected by the TRPS or ESFAS is allowed to operate with reduced Safety System reliability. The 30 day duration is acceptable because placing the SFM in trip preserves the single failure criterion for the remaining Operable modules.

Page B 3.7-3 Revision 3

The setpoint for fission product radiation monitors, i.e., all monitored locations identified in Table 3.7.1-a except item g. and item h., is 5 times the normal background radiation. This setpoint provides margin to an analytical limit of 60 times the normal background radiation.

Additional discussion for each variable listed in Table 3.7.1-a is provided below:

a. The supercell PVVS hot cell contains equipment for the PVVS and VTS, which contain fission product gases. The radiation monitors provide an actuation signal that isolates the affected hot cell and initiates a VTS Safety Actuation to minimize the spread of radioactive material, as described in FSAR Subsection 7.5.4.1.2. Three channels of radiation monitoring are provided.

With one channel inoperable, the SFM for the associated channel is placed in trip within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months and must be restored to Operable within 30 days. With two channels inoperable, or if actions for one channel inoperable are not met, at least one damper in the inlet and outlet of the associated hot cell must be closed within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . A completion time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allows for the performance of minor repairs and is acceptable based on the continued availability of the redundant channel. With 3 channels inoperable, at least one damper in the inlet and outlet of the associated hot cell must be closed within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . A completion time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months recognizes the importance of promptly isolating the equipment to mitigate a potential accident once the safety function has been lost.

b. The supercell extraction and IXP hot cells periodically contain irradiated target solution. The radiation monitors provide an actuation signal that isolates the affected hot cell to minimize the spread of radioactive material, as described in FSAR Subsections 7.5.4.1.3 and 7.5.4.1.4. Two channels of radiation monitoring are provided.

With one channel inoperable, at least one damper in the inlet and outlet of the associated hot cell must be closed within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . A completion time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allows for the performance of minor repairs and is acceptable based on the continued availability of the redundant channel. With two channels inoperable, at least one damper in the inlet and outlet of the associated hot cell must be closed within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . A completion time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months recognizes the importance of promptly isolating the equipment to mitigate a potential accident once the safety function has been lost.

c. The supercell purification and packaging hot cells periodically contain isotope products. The radiation monitors provide an actuation signal that isolates the affected hot cell to minimize the spread of radioactive material, as described in FSAR Subsection 7.5.4.1.5. Two channels of radiation monitoring are provided. With one channel inoperable, at least one damper in the inlet and outlet of the associated hot cell must be closed within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . A completion time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allows for the performance of minor repairs and is acceptable based on the continued availability of the redundant channel. With two channels inoperable, at least one damper in the inlet and outlet of the associated hot cell must be closed within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . A completion time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months recognizes the importance of taking prompt action once the safety function has been lost.

Page B 3.7-4 Revision 3

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)

d. The RVZ1 exhaust location is monitored for elevated radiation originating from RVZ1 spaces, including the supercell and the PCLS expansion tanks, which communicate with the IU cell atmosphere. The radiation monitors provide an actuation signal that performs an RCA Isolation to minimize the spread of radioactive material, as described in FSAR Subsection 7.5.4.1.1. Three channels of radiation monitoring are provided.

With one channel inoperable, the SFM for the associated channel is placed in trip within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months and must be restored to Operable within 30 days. With two channels inoperable, the RCA isolation actuation components must be placed in their actuated state within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . A completion time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allows for the performance of minor repairs and is acceptable based on the continued availability of the redundant channel. With three channels inoperable, the RCA isolation actuation components must be placed in their actuated state within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . A completion time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months recognizes the importance of taking prompt action once the safety function has been lost.

e. The RVZ2 RCA exhaust location is monitored for elevated radiation originating from RVZ2 spaces, which include the general area of the IF and RPF. The radiation monitors provide an actuation signal that performs an RCA Isolation to minimize the spread of radioactive material, as described in FSAR Subsection 7.5.4.1.1. Three channels of radiation monitoring are provided.

With one channel inoperable the SFM for the associated channel is placed in trip within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months and must be restored to Operable within 30 days. With two channels inoperable, the RCA isolation actuation components must be placed in their actuated state within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . A completion time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allows for the performance of minor repairs and is acceptable based on the continued availability of the redundant channel. With three channels inoperable, the RCA isolation actuation components must be placed in their actuated state within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . A completion time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months recognizes the importance of taking prompt action once the safety function has been lost.

f. The RVZ1e IU cell exhaust location is monitored for elevated radiation in the PCLS or IU cell atmosphere. The radiation monitors provide an actuation signal that results in an IU Cell Safety Actuation to minimize the spread of radioactive material, as described in FSAR Subsection 7.4.4.1.15. Three channels of radiation monitoring are provided.

With fewer than two required channels Operable, the IU is placed in Mode 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months by automatic or manual transitions. At least one RVZ1e IU cell ventilation damper for the associated IU cell is also required to be closed within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . This completion time allows for the performance of minor repairs and allows for the affected IU to be shut down or the affected processes to be halted in an orderly manner. The completion time is acceptable based on the continued availability of the redundant TRPS Division(s) to sense adverse conditions and actuate equipment in response to an event. Transfer of target solution out of the IU to achieve Mode 0 requires the target solution to be held in the TSV dump tank for at least the minimum period of time specified in LCO 3.1.8 prior to transfer. Approximately [

]PROP/ECI are required to complete the transfer of target solution to the RPF.

Page B 3.7-5 Revision 3

g. The TPS confinement glovebox atmosphere is monitored for tritium. There is normally a low tritium concentration on the order of less than 1 mCi/m3 in the TPS glovebox due to process equipment leakage and tritium permeation. The TPS glovebox tritium concentration setpoint of 927 Ci/m3 considers instrument uncertainties and is based on an analytical limit of 1000 Ci/m3. A tritium concentration in excess of this limit is indicative of excessive amounts of tritium leaking from TPS process equipment, as described in FSAR Subsection 7.5.4.1.13. The radiation monitors provide an actuation signal that isolates the associated glovebox and ventilation of the TPS room to minimize the spread of radioactive material. Two channels of radiation monitoring are provided.

With fewer than two required channels Operable, tritium is required to be returned to its storage location within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months (i.e., a depleted uranium bed) or at least one redundant TPS Train Isolation device per associated TPS glovebox confinement flow path is closed within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months to provide the isolation function. A completion time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allows for the performance of minor repairs and is acceptable based on the low likelihood of a tritium release during the allowed time.

h. The TPS exhaust to the facility stack is monitored for tritium. The TPS secondary enclosure cleanup (SEC) normally reduces tritium concentrations that enter RVZ1e to less than 10 µCi/m3. The TPS exhaust to the facility stack tritium concentration setpoint of 0.96 Ci/m3 considers instrument uncertainties and is based on an analytical limit of 1 Ci/m3. A tritium concentration in excess of this limit is indicative of a malfunction of the TPS or a tritium release, as described in FSAR Subsection 7.5.4.1.12. The radiation monitors limit the spread of tritium throughout and outside the facility via the ventilation system by providing an actuation signal that isolates the potential release paths to the facility stack from all three TPS gloveboxes via a TPS Process Vent Actuation. Three channels of radiation monitoring are provided.

With one channel inoperable, the SFM for the associated channel is placed in trip within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months and must be restored to Operable within 30 days. With two or three required channels inoperable, tritium is required to be returned to its storage location within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months (i.e., a depleted uranium bed) or at least one redundant TPS Process Vent Actuation device per TPS exhaust flow path is closed within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months to provide the isolation function. A completion time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allows for the performance of minor repairs and is acceptable based on the low likelihood of a tritium release during the allowed time.

SR The surveillance requirements ensure the continued operability of the radiation monitors when required. Channel Check and Channel Calibration frequencies are based on guidance from ANSI/ANS 15.1-2007 and ensure the instrumentation is capable of performing its intended function when required.

Basis 3.7.2 LCO Release limits on radioactive effluents ensure the facility does not release excessively high levels of radioactive effluents, as described in FSAR Section 11.1. The factor of 2800 times the values listed in 10 CFR 20, Page B 3.7-6 Revision 3

Appendix B, Table 2, Column 1 is based on the SHINE site-specific atmospheric dispersion factor (/Q) value of 7.1E-5 sec/m3 for the maximally exposed individual (MEI), which is taken to be the nearest point on the site boundary. The estimated annual dose to the MEI is 3.9 mrem, as discussed in FSAR Subsection 11.1.1.1. The factor of 2800 times values listed in 10 CFR 20, Appendix B, Table 2, Column 1 limits the MEI dose to less than 10 mrem.

The stack release monitor provides the ability to monitor the normal effluent release pathway. The carbon delay bed effluent monitor provides information about the health of the PVVS carbon delay beds and provides the ability to monitor the safety-related exhaust point effluent release pathway when it is in use to demonstrate that gaseous effluents from the SHINE Facility are within regulatory limits, as described in FSAR Subsection 7.7.5.

If the monthly curie assessment (SR 3.7.2.1) exceeds 1/12th of the annual limit, the annual curie assessment shall be verified within the limit within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . This completion time is adequate to properly review assessment data for errors and, if necessary, to verify annual assessment data. The completion time is acceptable because the likelihood of exceeding annual limits within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months of exceeding 1/12th the annual limit is low. Additional actions may be taken as necessary to reduce releases of radioactive material to maintain compliance with LCO 3.7.2.

SR The surveillance requirement ensures that the gaseous effluents from normal operations released to uncontrolled areas are within the allowable limits. The stack release monitor and carbon delay bed effluent monitor calibrations ensure the continued operability of the instruments and the accuracy of the measurements. The surveillance requirements are consistent with industry experience.

Page B 3.7-7 Revision 3

3.8 Facility-Specific Objective: To ensure systems are Operating within analyzed limits and prevent excessive radiation exposure to workers and the public.

LCO 3.8.1 The N2PS shall be Operable. The N2PS is considered Operable if:

1. At least 11 nitrogen storage tubes are filled with nitrogen at a minimum pressure of 2,100 psig per tube, and

2. The N2PS is capable of delivering a total of 16 SCFM of sweep gas flow.

Applicability Facility not Secured Action According to Table 3.8.1 SR 3.8.1 1. Nitrogen pressure in each tube shall be verified to be above the minimum pressure weekly.

2. A Channel Calibration of the pressure sensor for each tube shall be performed annually.

3. A verification of the N2PS capability to deliver the required sweep gas flow shall be performed every five years.

Table 3.8.1 Nitrogen Purge System Actions Action Completion Time

1. If fewer than 11 nitrogen storage tubes are pressurized to 2,100 psig, OR If N2PS is unable to deliver a total of 16 SCFM of sweep gas flow, Place all IUs undergoing irradiation in Mode 3 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months AND Restore N2PS to Operable. 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Page 3.8-1 Revision 3

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)

LCO 3.8.2 The concentration of uranium in the target solution in the TSV shall be

[ ]PROP/ECI.

Applicability Target solution in the associated TSV SR 3.8.2 1. After preparing a new batch of target solution, the target solution uranium concentration shall be verified to be below the uranium concentration limit prior to transferring the batch to a TSV in Mode 1

2. After adding additional target solution to an existing batch, the target solution uranium concentration shall be verified to be below the uranium concentration limit prior to transferring the batch to a TSV in Mode 1 LCO 3.8.3 [ ]PROP/ECI and pH of the target solution shall be within the Acceptable region of Figure 3.8.3, defined by the following equation:

]PROP/ECI Applicability Target solution in the associated TSV SR 3.8.3 1. After preparing a new batch of target solution, the [

]PROP/ECI and pH shall be verified to be within the Acceptable region of Figure 3.8.3 prior to transferring the batch to a TSV in Mode 1

2. After adding additional target solution to an existing batch, the

[ ]PROP/ECI and pH shall be verified to be within the Acceptable region of Figure 3.8.3 prior to transferring the batch to a TSV in Mode 1 Page 3.8-2 Revision 3

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)

Figure 3.8.3 Target Solution Catalyst Concentration vs pH PROP/ECI Page 3.8-3 Revision 3

LCO 3.8.4 The concentration of uranium present in the second uranium liquid waste tank and the liquid waste blending tank shall be less than 25 gU/L.

Applicability At all times Action According to Table 3.8.4 SR 3.8.4 1. Uranium concentration in the first uranium liquid waste tank shall be measured and verified to be below the limit in accordance with the requirements of the criticality safety program and prior to transfer of liquid to the second uranium liquid waste tank.

2. Uranium concentration in the second uranium liquid waste tank shall be measured and verified to be below the limit in accordance with the requirements of the criticality safety program and prior to transfer of liquid to the liquid waste blending tank.

3. Uranium concentration in the liquid waste blending tank shall be measured and verified to be below the limit in accordance with the requirements of the criticality safety program.

Table 3.8.4 Waste Tank Uranium Concentration Actions Action Completion Time

1. If uranium concentration is above the limit in either the second uranium liquid waste tank or the liquid waste blending tank, Stop transfers of solution to the liquid waste blending tank Immediately AND Return solution in the liquid waste blending tank to a 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months favorable geometry location AND Dilute solution in the second uranium liquid waste tank until 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months the uranium concentration is verified to be below the limit.

Page 3.8-4 Revision 3

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)

LCO 3.8.5 The NDAS two-key interlocks shall be in the open position.

Applicability Associated IU cell plug not installed or personnel present in the neutron driver service cell (NSC)

SR 3.8.5 1. The function of the NSC driver interlock shall be tested quarterly.

Note - This SR cannot be deferred.

2. The function of the IU cell driver interlock shall be tested prior to removal of the IU cell plug, and quarterly thereafter, while the IU cell plug is removed.

LCO 3.8.6 The beam off pressure in the target chamber shall be [ ]PROP/ECI.

Note - This LCO is applied to each IU independently; actions are only applicable to the IU(s) that fail to meet the LCO during the associated condition(s) of applicability.

Applicability Associated IU in Mode 2 Action According to Table 3.8.6 SR 3.8.6 Verify the tritium pressure in each NDAS target chamber is below the limit daily.

Table 3.8.6 Target Chamber Pressure Actions Action Completion (per IU) Time

1. If the target chamber pressure is above the allowable limit, Open at least one HVPS breaker 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months AND Evacuate tritium from the NDAS target chamber. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Page 3.8-5 Revision 3

LCO 3.8.7 Each TPS glovebox shall have a helium atmosphere with dew point -4°F.

Note - This LCO is applied to each TPS train independently; actions are only applicable to the TPS train(s) that fail to meet the LCO during the associated condition(s) of applicability.

Applicability Associated TPS glovebox tritium in TPS process equipment not in storage Action According to Table 3.8.7 SR 3.8.7 1. A Channel Check shall be performed on the TPS glovebox dew point monitor quarterly.

2. A Channel Calibration shall be performed on the TPS glovebox dew point monitor annually.

Table 3.8.7 TPS Glovebox Atmosphere Actions Action Completion (per TPS glovebox) Time

1. If the TPS glovebox atmosphere is not within the allowable limit, Initiate actions to purge the TPS glovebox with helium 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months LCO 3.8.8 Each TPS SEC shall be Operable. An SEC is considered to be Operable if:

1. The circulating blower is Operating,

2. At least 1 molecular sieve bed is Operating, and

3. The hydride bed is Operating.

Note - This LCO is applied to each TPS train independently; actions are only applicable to the TPS train(s) that fail to meet the LCO during the associated condition(s) of applicability.

Applicability Tritium in the associated train of TPS process equipment not in storage.

Action According to Table 3.8.8 SR 3.8.8 Verify each SEC is Operating daily.

Page 3.8-6 Revision 3

Table 3.8.8 TPS SEC Actions Action Completion (per TPS glovebox) Time

1. If an SEC is inoperable, Place tritium in the associated train of TPS process equipment in its storage location. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months LCO 3.8.9 Each RCA isolation damper listed in Table 3.8.9-a shall be Operable. A damper is considered Operable if:

1. The damper is capable of closing on demand from ESFAS Note - A single Division of required components may be inoperable for up to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months during the performance of required surveillances.

Applicability Facility not Secured Action According to Table 3.8.9 SR 3.8.9 Dampers listed in Table 3.8.9-a shall be closure tested quarterly.

Table 3.8.9 RCA Isolation Damper Actions Action Completion Time

1. If one or more flow path(s) with one isolation damper is inoperable, Close at least one damper in the affected flow path. 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months

2. If one or more flow path(s) with two isolation dampers are inoperable, Close at least one damper in the affected flow path. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Page 3.8-7 Revision 3

Table 3.8.9-a RCA Isolation Dampers Number Component Provided per Flow Path

a. RVZ1 RCA exhaust isolation dampers 2

b. RVZ2 RCA exhaust isolation dampers 2

c. RVZ2 RCA supply isolation dampers 2

d. RVZ3 RCA transfer isolation dampers 2

1. Shipping/receiving IF (per location)

2. Shipping/receiving RPF

3. Main RCA ingress/egress

4. RPF emergency exit

5. IF emergency exit

6. Mezzanine emergency exit

e. RVZ2 TPS room supply and exhaust isolation dampers 2 (per location)

LCO 3.8.10 Each safety-related valve listed in Table 3.8.10-a shall be Operable. A valve is considered Operable if:

1. The valve is capable of opening or closing on demand from ESFAS.

Note - A single Division of required component(s) may be inoperable for up to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months during the performance of required surveillances.

Applicability According to Table 3.8.10-a Action According to Table 3.8.10 SR 3.8.10 Safety-related valves listed in Table 3.8.10-a shall be stroke tested annually.

Page 3.8-8 Revision 3

Table 3.8.10 Safety-Related Valves Actions Action Completion Time

1. If one Division is inoperable, Restore the Division to Operable 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months

2. If two Divisions are inoperable, OR Action and associated completion time of Condition 1 not met, Open the VTS vacuum pump breakers 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months AND Open at least one VTS vacuum break valve. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months

3. If two Divisions are inoperable, OR Action and associated completion time of Condition 1 not met, Open at least one PVVS blower bypass valve 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months AND Close the PVVS blower makeup air supply valve. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months

4. If two Divisions are inoperable, OR Action and associated completion time of Condition 1 not met, Open at least one carbon guard bed bypass valve. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months

5. If two Divisions for a single carbon delay bed group are inoperable, OR Action and associated completion time of Condition 1 not met, Close the associated carbon delay bed group isolation valves 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months AND Verify at least 5 carbon delay beds are Operating. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months

6. If the required Division is inoperable, Suspend RLWI immobilization feed operations 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months AND Close at least one RLWI PVVS valve. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Page 3.8-9 Revision 3

Action Completion Time

7. If two Divisions are inoperable, OR Action and associated completion time of Condition 1 not met, Open at least one N2PS IU cell header valve. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months

8. If two Divisions are inoperable, OR Action and associated completion time of Condition 1 not met, Place RPF Nitrogen Purge Actuation components in their actuated states. 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months

9. If two Divisions in a single flow path are inoperable, OR Action and associated completion time of Condition 1 not met, Isolate the affected flow path by closing at least one N2PS RVZ2 header valve. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months

10. If one or more Division(s) are inoperable, Suspend dissolution tank operations 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months AND Isolate RPCS supply to and return from the dissolution tanks 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months AND Remove uranium from the TSPS glovebox. 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months

11. If one or more three-way valve(s) are inoperable, Place at least one three-way valve in the discharging position 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months AND Close the associated eluent valve. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months

12. If a required valve is inoperable, Close at least one valve in the flow path of the inoperable valve 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months OR Suspend hot cell operations involving the introduction of liquids into the associated hot cell 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months AND Drain target solution and radioactive liquids in process lines from the associated hot cell. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Page 3.8-10 Revision 3

Table 3.8.10-a Automatically-Actuated Safety-Related Valves Number Provided Component Applicability Action per Flow Path

a. VTS vacuum break valves 2 VTS Operating 1, 2

b. PVVS blower bypass 2 Facility not Secured 1, 3 valves

c. PVVS carbon guard bed 2 Facility not Secured 1, 4 bypass valves

d. PVVS carbon delay bed 2 Associated carbon delay bed group 1, 5 group three-way valves (per delay Operating bed group)

e. PVVS carbon delay bed 2 Associated carbon delay bed group 1, 5 group outlet isolation valves (per delay Operating bed group)

f. RLWI PVVS isolation valve 1 Facility not Secured 6

g. N2PS IU cell header valves 2 Facility not Secured 1, 7

h. N2PS RPF header valves 2 Facility not Secured 1, 8

i. N2PS RVZ2 header valves 2 Facility not Secured 1, 9

1. North (per

2. South location)

j. TSPS RPCS supply cooling 2 Dissolution tank or TSPS glovebox 10 valves contains uranium k TSPS RPCS return cooling 1 Dissolution tank or TSPS glovebox 10 valve contains uranium

l. TSPS ventilation isolation 1 Dissolution tank or TSPS glovebox 10 valves (per contains uranium

1. Air Inlet location)

2. RVZ1 Exhaust

m. MEPS extraction column 1 Target solution or radioactive 11 three-way valves (per process fluids present in the

1. Upper location, associated extraction hot cell

2. Lower per hot cell)

n. IXP extraction column 1 Target solution or radioactive 11 three-way valves (per process fluids present in the IXP

1. Upper location) hot cell

2. Lower Page 3.8-11 Revision 3

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)

Number Provided Component Applicability Action per Flow Path

o. MEPS [ ]PROP/ECI 1 Target solution or radioactive 12 isolation valves (per process fluids present in the

1. Inlet location, associated extraction hot cell

2. Outlet per hot cell)

p. MEPS extraction column 1 Target solution or radioactive 12 wash supply valve (per hot process fluids present in the cell) associated extraction hot cell

q. MEPS extraction column 1 Target solution or radioactive 12 eluent valve (per hot process fluids present in the cell) associated extraction hot cell

r. MEPS [ 1 Target solution or radioactive 12

]PROP/ECI wash supply (per hot process fluids present in the valve cell) associated extraction hot cell

s. MEPS [ 1 Target solution or radioactive 12

]PROP/ECI eluent valve (per hot process fluids present in the cell) associated extraction hot cell

t. IXP recovery column wash 1 Target solution or radioactive 12 supply valve process fluids present in the IXP hot cell

u. IXP recovery column eluent 1 Target solution or radioactive 12 valve process fluids present in the IXP hot cell

v. IXP [ 1 Target solution or radioactive 12

]PROP/ECI wash supply process fluids present in the IXP valve hot cell

w. IXP [ 1 Target solution or radioactive 12

]PROP/ECI eluent valve process fluids present in the IXP hot cell

x. IXP facility nitrogen 1 Target solution or radioactive 12 handling system supply process fluids present in the IXP valve hot cell

y. IXP liquid nitrogen supply 1 Target solution or radioactive 12 valve process fluids present in the IXP hot cell Page 3.8-12 Revision 3

LCO 3.8.11 The safety-related check valves listed in Table 3.8.11-a shall be Operable.

Applicability According to Table 3.8.11-a Action According to Table 3.8.11 SR 3.8.11 The check valves listed in Table 3.8.11-a shall be inspected semi-annually.

Table 3.8.11 Safety-related Check Valve Actions Action Completion Time

1. If the check valve is inoperable, Suspend hot cell operations involving the introduction of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months liquids into any extraction hot cell.

2. If the check valve is inoperable, Close at least one valve in the flow path of the inoperable 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months valve OR Suspend hot cell operations involving the introduction of liquids into the associated hot cell 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months AND Drain target solution and radioactive liquids in process lines from the associated hot cell. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months

3. If the check valve is inoperable, Suspend RLWI immobilization feed operations 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months AND Close at least one RLWI PVVS valve. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months

4. If the check valve is inoperable, Suspend dissolution tank operations 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months AND Isolate RPCS supply and return water to the dissolution tanks 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months AND Remove uranium from the TSPS glovebox and dissolution 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months tank.

Page 3.8-13 Revision 3

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)

Table 3.8.11-a Safety-Related Check Valves Check Valve Applicability Action

a. MEPS target solution [ Target solution or radioactive process 1

]PROP/ECI check valve fluids present in the associated hot cell (per extraction hot cell)

b. MEPS extraction column wash supply Target solution or radioactive process 2 check valve (per extraction hot cell) fluids present in the associated hot cell

c. MEPS extraction column eluent check Target solution or radioactive process 2 valve (per extraction hot cell) fluids present in the associated hot cell

d. MEPS [ ]PROP/ECI Target solution or radioactive process 2 wash supply check valve (per fluids present in the associated hot cell extraction hot cell)

e. MEPS [ ]PROP/ECI Target solution or radioactive process 2 eluent check valve (per extraction fluids present in the associated hot cell hot cell)

f. IXP recovery column wash supply Target solution or radioactive process 2 check valve fluids present in the associated hot cell

g. IXP recovery column eluent check Target solution or radioactive process 2 valve fluids present in the associated hot cell

h. IXP [ ]PROP/ECI wash Target solution or radioactive process 2 supply check valve fluids present in the associated hot cell

i. IXP [ ]PROP/ECI eluent Target solution or radioactive process 2 check valve fluids present in the associated hot cell

j. IXP facility nitrogen handling system Target solution or radioactive process 2 supply check valve fluids present in the associated hot cell

k. IXP liquid nitrogen excess flow check Target solution or radioactive process 2 valve fluids present in the associated hot cell

l. RLWI PVVS check valve Facility not Secured 3

m. TSPS RPCS return check valve Dissolution tank or TSPS glovebox 4 contains uranium Page 3.8-14 Revision 3

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)

Basis 3.8.1 LCO There are 12 N2PS nitrogen storage tubes provided, each normally maintained above 2,100 psig. The availability of 11 Operable N2PS nitrogen storage tubes, each pressurized with nitrogen to a minimum pressure of 2,100 psig, ensures there is sufficient nitrogen capacity to provide flow to adequately control hydrogen concentrations in process tanks and IUs during accident scenarios for the required operational time of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months , as described in FSAR Subsection 9b.6.2.

The N2PS nitrogen storage tubes are located in a separate structure from the main production facility. The minimum pressure of 2,100 psig is evaluated to be valid over a temperature range of -40°F to 125°F.

With fewer than 11 nitrogen storage tubes Operable, or with N2PS unable to deliver a total of 16 SCFM of sweep gas flow, all IUs currently undergoing irradiation in Mode 2 are required to placed in Mode 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months to limit the amount of hydrogen generated in the facility via radiolysis. This completion time allows for adequate time restore N2PS to Operable, or, if necessary, to safely transition any operating IUs to Mode 3 in a controlled manner. The likelihood of an event requiring an N2PS activation during this completion time is low, and the completion time is acceptable based on the continued availability of the normal facility systems (i.e., TOGS and PVVS) to provide hydrogen mitigation. IU Mode 2 operations in any IU cannot be resumed until the minimum supply of nitrogen is restored to at least 11 nitrogen storage tubes.

Although the hydrogen generation rate of the facility is minimized by stopping irradiation activities, hydrogen generation continues in facility tanks containing irradiated target solution or radioactive liquid waste via radiolysis generated by radioactive decay. The N2PS is required to be restored to Operable within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to provide the hydrogen mitigation safety function. This completion time allows for more extensive maintenance of the N2PS to be performed if required.

SR The pressure verification ensures there is sufficient capacity in the N2PS to perform its required function. The frequency of the pressure verification is based on industry experience. Channel Calibration frequencies are based on guidance from ANSI/ANS 15.1-2007 and ensure the instrumentation is capable of performing its intended function when required.

The periodic functional test is performed to ensure the N2PS can deliver sweep gas at required flowrates and pressures. The initial verification of the N2PS nitrogen delivery capability is performed during start-up testing; the frequency of periodic verification of nitrogen delivery capability is based on the passive design of the N2PS and the limited number of active components.

Basis 3.8.2 LCO The reactivity equivalent of fresh [ ]PROP/ECI target solution in conjunction with the Fill Stop function is calculated to maintain keff below 1.0 in an inadvertent fill scenario, as described in FSAR Subsection 4a2.6.2.7. The limit also ensures that the thermal-hydraulic properties of the target solution are within analyzed Page B 3.8-1 Revision 3

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3) conditions to prevent boiling of the target solution and protect the integrity of the PSB, as described in FSAR Subsection 4a2.7.5.5.

Target solution batches that do not meet the allowable uranium concentration cannot be transferred into a TSV. As the SR precludes transfer of target solution that does not meet the LCO to the TSV, a separate action statement is not required for this LCO.

SR Target solution parameters are confirmed after preparation or adjustments are made to batches to ensure parameters are within limits. The uranium concentration of the target solution is not expected to change during irradiation.

The adequacy of the frequency of target solution parameter measurements is confirmed during facility start-up testing.

Basis 3.8.3 LCO Maintaining sufficient [ ]PROP/ECI and pH level within acceptable bounds prevents uranyl peroxide precipitation from occurring during irradiation, as described in FSAR Subsection 4a2.6.3.5. The catalyst concentration limit is defined such that it will counteract the effects of increasing pH in the prevention of uranyl peroxide precipitation. Higher pH in the target solution decreases the peroxide solubility. The catalyst concentration is correspondingly increased for higher pH target solution to increase the destruction rate of the peroxide, to keep the peroxide concentration under the solubility limit. Unlike nitric acid systems, sulfuric acid is stable under irradiation, and [

]PROP/ECI. Therefore, the target solution chemistry (i.e., pH, catalyst concentration, and uranium concentration) does not change during irradiation, other than the small effects of water holdup in the TOGS. See also the bases for LCO 3.1.6 for additional discussion of uranyl peroxide precipitation.

Target solution batches that do not meet the allowable [ ]PROP/ECI at the measured pH cannot be transferred into a TSV. As the SR precludes transfer of target solution that does not meet the LCO to the TSV, a separate action statement is not required for this LCO.

SR Target solution parameters are confirmed after preparation or adjustments are made to batches to ensure parameters are within limits. The [

]PROP/ECI and pH of target solution are not expected to change during irradiation. The adequacy of the frequency of target solution parameter measurements is confirmed during facility start-up testing.

Basis 3.8.4 LCO The first and second uranium liquid waste tanks are designed with favorable geometry. The liquid waste blending tanks are not geometrically favorable.

Uranium concentration is required to be below limits evaluated in the nuclear criticality safety program prior to transfer of uranium-bearing solutions to tanks that have not been designed with favorable geometry. The nuclear criticality Page B 3.8-2 Revision 3

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3) safety program includes additional requirements for the transfer process to ensure that inadvertent criticality is prevented, as described in FSAR Subsection 6b.3.2.2. If uranium concentration is found to be above the limit of 25 gU/L, all transfer of solution to the liquid waste blending tank is required to be stopped immediately. The immediate completion time reflects the importance of criticality safety requirements.

Any solution in the liquid waste blending tank is required to be returned to a favorable geometry location within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and the uranium concentration in the second uranium liquid tank is required to be lowered via dilution and verified below the limit within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to prevent a criticality in the RPF. This completion time allows for adequate time to safely transfer the solution to a favorable geometry location and restore the concentration to below the limit while limiting the time allowed with uranium concentrations above the limit.

SR Uranium concentration is confirmed to be within limits prior to each applicable liquid transfer.

Basis 3.8.5 LCO A two-key interlock on NDAS operation prevents inadvertent production of neutrons when personnel may be present, to prevent exposing personnel to excessive dose, as described in FSAR Subsection 13a2.1.12 (NDAS Scenarios 1 and 2). A two-key interlock is provided for each IU cell and for the neutron driver service cell (NSC). Personnel are not allowed to enter an IU cell or the NSC if the ability of the associated NDAS to produce a beam has not been disabled, therefore a separate action statement is not required for this LCO.

SR The interlocks are tested periodically to ensure their operability when required.

The IU cells can only be entered via removal of the IU cell plug; therefore, the testing of the IU cell driver interlock is only performed when it is required to be Operable. The NSC can be entered via a door, therefore, the operation of the interlock is required to be tested at regular periodicity. The quarterly operability test is consistent with the recommendations of ANSI/ANS 15.1-2007.

Basis 3.8.6 LCO The [ ]PROP/ECI pressure limit ensures that the amount of tritium in an IU cell is below the [ ]PROP/ECI limit, as described in FSAR Subsection 13a2.2.12.1. The pressure limit is derived from the curie limit. The total tritium inventory is used as an input into the dose consequence analysis. Exceeding the pressure, and therefore tritium inventory, would result in increased radiological doses to workers and the public in the event of a release into the IU cell. With pressure in the target chamber above [ ]PROP/ECI, the neutron driver is required to be shut down by opening at least one HVPS breaker within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . This completion time provides adequate time to respond to a high pressure condition in the target chamber and react accordingly. The time is limited to 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months to minimize the probability of a release exceeding that assumed in the Page B 3.8-3 Revision 3

SHINE safety analysis. Additionally, tritium is required to be removed from the target chamber to return to within the allowable limit within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months to further minimize the probability of a release. The completion time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allows for adequate time to complete the required action.

SR Verification of the pressure during the irradiation cycle confirms the limit is not exceeded. The frequency of the pressure verification is based on industry experience. Additionally, PICS monitors the pressure in the target chamber, and pressure excursions will result in control room alarms to alert the operator.

Basis 3.8.7 LCO The dew point in the TPS gloveboxes is monitored as an indication of air-ingress into the glovebox, to ensure flammability risks are minimized and to ensure oxygen does not excessively react with TPS process components, as described in FSAR Subsection 9a2.7.1. Low dew points in the TPS glovebox are indicative of a dry, helium atmosphere, which minimizes flammability risks to TPS process equipment, such as TPS cryopumps, and minimizes air (oxygen) exposure to TPS process equipment that is sensitive to oxygen exposure. If the helium atmosphere is lost, or the dew point temperature is above the allowable limit, action is taken within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to purge the TPS with helium to return the glovebox atmosphere to within allowable parameters. The completion time is acceptable based on the low risk of a fire during the completion time. The flammability risk is minimized to the completion time plus the amount of time required to complete the purge of the glovebox.

SR Channel Check and Channel Calibration frequencies are based on guidance from ANSI/ANS 15.1-2007 and ensure the instrumentation is capable of performing its intended function when required.

Basis 3.8.8 LCO The TPS SEC system prevents the accumulation of tritium in its associated glovebox, as described in FSAR Subsections 6a2.2.1.2 and 9a2.7.1. Maintaining low tritium levels minimizes leakage of tritium from the glovebox and prevents excessive doses to workers. Part of the tritium storage and separation system is a depleted uranium storage bed that holds tritium when not in use. The depleted uranium storage bed allows tritium to be safely stored during maintenance operations on the TPS. An SEC is Operable when the circulating blower is flowing gas through the series of molecular sieve and hydride beds that capture tritiated water and elemental tritium, respectively. With the SEC inoperable, the tritium in the associated train of TPS process equipment is required to be placed in its storage location within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . This completion time provides a reasonable time to investigate and repair minor problems associated with the SEC, and if necessary, allows for adequate time to store the tritium in a safe location.

Page B 3.8-4 Revision 3

SR The surveillance ensures the continued operability of the system. The frequency of the pressure verification is based on industry experience. Additionally, SEC parameters are monitored via the PICS and control room alarms of SEC blower functionality are provided to alert the operator of a sudden failure.

Basis 3.8.9 LCO RCA isolation dampers ensure the potential for a release to the environment is limited in the event of a postulated radioactive material release within the facility.

The dampers are automatically closed on an RCA Isolation, either directly, as described in FSAR Subsection 7.5.3.1.24 or via a TPS Train A/B/C Isolation, as described in FSAR Subsections 7.5.3.1.18, 7.5.3.1.19, and 7.5.3.1.20. The dampers are required to be Operable to support these safety functions. The dampers are not required to be Operable when the facility is Secured.

LCO 3.8.9 addresses only the RCA isolation dampers actuated by the ESFAS.

The scope of this LCO begins at the outputs from the EIM(s) for the associated actuated components and extends through the actuated components.

With one damper inoperable in a flow path, at least one damper in that flow path is required to be closed within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to fulfil the isolation function. With both dampers inoperable in a flow path, at least one damper in that flow path is required to be closed within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months to fulfil the isolation function. These completion times allow for investigating and repairing minor problems prior to isolating the affected flow path, which may require partial shutdown of facility ventilation. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months completion time is acceptable based on the continued availability of the redundant isolation damper. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months completion time is acceptable because the likelihood of a release within the completion time is low.

One damper in a flow path is allowed to be temporarily inoperable for up to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months for the performance of required surveillances.

SR The closure testing ensures the continued operability of the dampers. The frequency is based on industry experience.

Basis 3.8.10 LCO The safety-related valves are required to be Operable to support the protective functions described in FSAR Section 7.5.3.1.

LCO 3.8.10 addresses only the identified safety-related valves actuated by the ESFAS. The scope of this LCO begins at the outputs from the EIM(s) for the associated actuated components and extends through the actuated components.

Additional discussion for each component listed in Table 3.8.10-a is provided below:

a. VTS vacuum break valves are used to break vacuum in the VTS, stopping transfer of target solution or radioactive liquids within the facility. The valves are opened by a VTS Safety Actuation signal. With one Division inoperable, the valve is required to be restored to Operable within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . This Page B 3.8-5 Revision 3

completion time is acceptable based on the continued availability of the redundant isolation valve. With both Divisions inoperable, the VTS vacuum pump breakers are opened to shut down the VTS, and at least one VTS vacuum break valve is opened to break vacuum in the system within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The completion time allows for investigation and correction of minor problems, and is acceptable based on the low likelihood of an event during the allotted time.

b. PVVS blower bypass valves are used to bypass the PVVS blowers during operation of the N2PS to ensure a flow path for N2PS to the safety-related release point is available. The valves are opened on an RPF Nitrogen Purge signal. With one Division inoperable, the valve is required to be restored to Operable within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . This completion time is acceptable based on the continued availability of the redundant isolation valve. With both Divisions inoperable, at least one PVVS blower bypass valve is opened within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months to ensure the availability of the flow path. With the PVVS blowers Operating, opening these valves could reduce the flowrate of sweep gas to the RPF tanks by providing another source of makeup air. Therefore, the normal PVVS blower makeup air supply is required to be closed within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months when the PVVS blower bypass valves are open to ensure the blowers are capable providing adequate sweep gas flow for RPF tanks. The completion time allows for investigation and correction of minor problems and is acceptable based on the low likelihood of an event during the allotted time.

c. PVVS carbon guard bed bypass valves are used to ensure a flow path exists around the PVVS carbon guard beds to ensure the hydrogen mitigation function of N2PS is maintained. The valves are opened on an RPF Nitrogen Purge actuation signal to ensure a flow path exists for N2PS. With one Division inoperable, the valve is required to be restored to Operable within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . This completion time is acceptable based on the continued availability of the redundant isolation valve. With both Divisions inoperable, at least one PVVS carbon guard bed bypass valve is opened within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months to ensure the N2PS flow path is maintained. The completion time allows for investigation and correction of minor problems and is acceptable based on the low likelihood of an event during the allotted time.

d. - e. PVVS carbon delay bed three-way and outlet isolation valves are used to isolate a PVVS carbon delay bed group in the event of a fire in a bed within that group. The valves are deenergized to isolate the affected group on a Carbon Delay Bed Isolation signal. With one Division inoperable, the valve is required to be restored to Operable within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . This completion time is acceptable based on the continued availability of the redundant isolation valve. With both Divisions inoperable, the associated carbon delay bed group is required to be isolated, and the remaining carbon delay beds are verified to be Operating within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The completion time allows for investigation and correction of minor problems and is acceptable based on the low likelihood of an event during the allotted time.

f. The RLWI PVVS isolation valve is used to isolate the RLWI immobilization feed tank from the PVVS in the event of an RPF Nitrogen Purge actuation to prevent backflow of nitrogen into the RLWI skid. PVVS normally provides ventilation for the RLWI, but this function is not required to prevent unacceptable levels of hydrogen accumulation in the RLWI system and is not Page B 3.8-6 Revision 3

connected to N2PS sweep gas supply. Only one RLWI PVVS isolation valve is provided; redundancy is provided via the use of a check valve (see LCO 3.8.11). With the required Division inoperable, operations involving the addition of solution to the RLWI immobilization feed tank are suspended within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months , and at least one valve in the flow path from RLWI to PVVS is closed within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months to provide the function. The completion time allows for investigation and correction of minor problems and for the removal of radioactive material from the RLWI before the PVVS flow is isolated. The completion time is acceptable based on the low likelihood of an event during the allotted time.

g. N2PS IU cell header valves are used to provide nitrogen to the IU cell header; individual IU cell nitrogen purge isolation valves are controlled by TRPS to introduce nitrogen into the IUs. The valves are automatically opened on an IU Cell Nitrogen Purge actuation. With one Division inoperable, the valve is required to be restored to Operable within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . This completion time is acceptable based on the continued availability of the redundant isolation valve. With both Divisions inoperable, at least one N2PS IU cell header valve is required to be opened within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . Opening at least on N2PS IU cell header valve pressurizes the header with nitrogen but does not introduce nitrogen into any IU cell. The completion time allows for investigation and correction of minor problems and is acceptable based on the low likelihood of an event during the allotted time.

h. N2PS RPF header valves are used to provide nitrogen to the RPF tanks containing radioactive solutions. The valves are automatically opened on an RPF Nitrogen Purge actuation. With one Division inoperable, the valve is required to be restored to Operable within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . This completion time is acceptable based on the continued availability of the redundant isolation valve. With both Divisions inoperable, the RPF header valves and PVVS blower bypass valves are required to be opened, and the N2PS RVZ2 north and south header valves are required to be closed to actuate nitrogen purge in the RPF within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . Repositioning these valves introduces nitrogen into areas served by N2PS in the RPF. The completion time allows for investigation and correction of minor problems prior to preemptively actuating a Safety System and is acceptable based on the low likelihood of an event during the allotted time.

i. N2PS RVZ2 north and south header valves provide the normal inlet flow path to PVVS. Inadvertent isolation of both flow paths valves renders the PVVS inoperable. The valves are automatically closed on an RPF Nitrogen Purge actuation. With one Division inoperable, the valve is required to be restored to Operable within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . This completion time is acceptable based on the continued availability of the redundant isolation valve. With both Divisions inoperable in a single flow path (north or south), the affected flow path is required to be isolated within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months using at least one N2PS RVZ2 header valve to ensure N2PS will operate if required. The completion time allows for investigation and correction of minor problems and is acceptable based on the low likelihood of an event during the allotted time.

j. - l. TSPS RPCS supply cooling valves, TSPS RPCS return cooling valve, and the TSPS air inlet and RVZ1 exhaust isolation valves prevent overflow of the TSPS dissolution tank into the uranium handling glovebox and isolate the Page B 3.8-7 Revision 3

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3) glovebox. The valves automatically close on a Dissolution Tank Isolation.

These components are required by the nuclear criticality safety evaluation for the TSSS. Other controls on the dissolution process identified by the evaluation are implemented by the criticality safety program (see Administrative Control 5.5.7). Only one TSPS RPCS return cooling valve is provided; redundancy is provided via the use of a check valve (see LCO 3.8.11). With fewer than the minimum required Division(s) Operable, operations involving the dissolution of uranium are suspended within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months , the RPCS water supply and return to the tanks are isolated within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months , and uranium is removed from the TSPS glovebox within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to mitigate the potential criticality hazard. RPCS water may be isolated using local manual valve(s) or automatic isolation valve(s). The completion times are acceptable based on the prompt action to mitigate the risk, and the low likelihood of an event during the allotted time after in-progress operations have been suspended.

m. - n. MEPS and IXP three-way valves are used to direct target solution and other reagent solutions during extraction operations. The valves automatically reposition on an associated Alignment Actuation signal. One upper and one lower three-way valve is provided. The three-way valves must be properly coordinated to prevent a misdirection of target solution towards the chemical addition line or an inadvertent flow of other reagent solutions towards the upper lift tanks. Inadvertent three-way valve misalignments could lead to uranium precipitation. With one or more valve(s) inoperable for a single extraction hot cell, at least one three-way valve is placed in the discharging position within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months , and the extraction column eluate valve is closed within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The completion time allows for investigation and correction of minor problems and is acceptable based on the low likelihood of an event during the allotted time.

o. - y MEPS [ ]PROP/ECI inlet and outlet isolation valves are used to isolate the MEPS [ ]PROP/ECI in the event of a leak of target solution from the extraction column [ ]PROP/ECI.

The valves automatically close on a MEPS [ ] PROP/ECI Isolation.

One inlet and one outlet valve is provided for each extraction hot cell. With one or more valve(s) inoperable for a single extraction hot cell, the MEPS

[ ]PROP/ECI is isolated; otherwise, hot cell operations involving the introduction of liquids into the cell (e.g., extraction, column washing, elution) are suspended and target solution and radioactive liquids are drained from the associated hot cell. The MEPS [ ]PROP/ECI may be isolated using local manual valves or the automatic isolation valves if they are inoperable but still capable of performing the isolation function when closed MEPS and IXP wash supply and eluent valves are used to supply reagents and washes to the MEPS extraction, [ ]PROP/ECI, and IXP recovery columns. IXP facility nitrogen handling system supply and liquid nitrogen supply valves provide supply nitrogen and liquid nitrogen to the IXP hot cell to support processes in the cell. These valves automatically close on a VTS Safety Actuation signal. One valve is provided for each supercell penetration; redundancy is provided via the use of check valves (see LCO 3.8.11).

Page B 3.8-8 Revision 3

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)

With any required valve inoperable, the flow path affected by the inoperable valve is required to be isolated within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months ; otherwise, hot cell operations involving the introduction of liquids into the cell (e.g., extraction, column washing, elution) are suspended and target solution and radioactive liquids are drained from the associated hot cell within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The affected flow path may be isolated using local manual valves or automatic isolation valves if they are inoperable but still capable of performing the isolation function when closed. This completion time provides a reasonable time to investigate and repair minor problems, and, if necessary, isolate the affected flow path or remove the material at risk from the affected hot cell. The completion time is acceptable based on the low likelihood of release during the 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months duration.

SR The surveillance requirements ensure the continued operability of the safety-related valves and dampers. The surveillance frequency is consistent with the recommendations from ANSI/ANS 15.1-2007 and industry experience.

Basis 3.8.11 LCO Check valves provide isolation functions as described below.

a. The MEPS target solution [ ]PROP/ECI check valve prevents target solution from other extraction cells to inadvertently back flow into the molybdenum eluate tank in the associated hot cell. Since multiple valve misalignment in the other extraction cells would need to occur, redundancy is not required for this function per the accident analysis. With the check valve inoperable, hot cell operations involving the introduction of liquids into the cell (e.g., extraction, column washing, elution) are suspended immediately to prevent the inadvertent backflow of solution into the affected cell. This completion time reflects the importance of minimizing radioactive liquids introduced into a hot cell with an inoperable check valve.

b. - i. MEPS and IXP wash supply and eluent check valves prevent the misdirection of target solution in the event of a three-way valve failure or leakage. A misdirection could result in the target solution migrating outside of the hot cell or target solution exposure to base reagent, which could lead to uranium precipitation. With any required check valve inoperable, the flow path affected by the inoperable valve is isolated within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months ; otherwise, hot cell operations involving the introduction of liquids into the cell (e.g., extraction, column washing, elution) are suspended and target solution and radioactive liquids are drained from the associated hot cell within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The affected flow path may be isolated using local manual valves or automatic isolation valves (see LCO 3.8.10). This completion time provides a reasonable time to investigate and repair minor problems, and, if necessary, isolate the affected flow path or remove the material at risk from the affected hot cell. The completion time is acceptable based on the low likelihood of release during the 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months duration.

j. The IXP facility nitrogen handling system supply check valve is used to prevent backflow of nitrogen from the IXP hot cell and provides redundancy to the IXP supply nitrogen isolation valve (see LCO 3.8.10, item x). With the check valve inoperable, nitrogen is required to be isolated to the IXP hot cell Page B 3.8-9 Revision 3

within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months ; otherwise, hot cell operations involving the introduction of liquids into the cell (e.g., extraction, column washing, elution) are suspended and target solution and radioactive liquids are drained from the associated hot cell within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . This completion time provides a reasonable time to investigate and repair minor problems, and, if necessary, isolate the affected flow path or remove the material at risk from the affected hot cell. The completion time is acceptable based on the low likelihood of release during the 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months duration.

k. The IXP liquid nitrogen excess flow check valve is described in FSAR Subsection 9b.7.8.2 and limits potential equipment damage due to being exposed to liquid nitrogen in the event of a liquid nitrogen line break. With the check valve inoperable, liquid nitrogen is required to be isolated to the IXP hot cell (see LCO 3.8.10, item y.) within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months ; otherwise, hot cell operations involving the introduction of liquids into the cell (e.g., extraction, column washing, elution) are suspended and target solution and radioactive liquids are drained from the associated hot cell within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The completion time is acceptable based on the low likelihood of release during the 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months duration.

l. The RLWI PVVS check valve is used to prevent backflow of nitrogen into the RLWI skid via PVVS in the event of an RPF Nitrogen Purge actuation. The check valve provides redundancy with the RLWI PVVS isolation valve (see LCO 3.8.10). With the check valve inoperable, operations involving the addition of solution to the RLWI immobilization feed tank are suspended within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months , and at least one valve in the flow path from RLWI to PVVS is closed within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months to provide the function. The completion time allows for investigation and correction of minor problems and for the removal of radioactive material from the RLWI before the PVVS flow is isolated. The completion times are acceptable based on the prompt action to mitigate the risk, and the low likelihood of an event during the allotted time after in-progress operations have been suspended.

m. The TSPS RPCS return check valve prevents overflow of the TSPS dissolution tank into the uranium handling glovebox in the event of an RPCS leak. The check valve provides redundancy for the TSPS RPCS return cooling valve (see LCO 3.8.10). With the check valve inoperable, operations involving the dissolution of uranium are suspended within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months , the RPCS water supply and return to the tanks are isolated within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months , and uranium is removed from the TSPS glovebox within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to mitigate the potential criticality hazard. RPCS water may be isolated using local manual valve(s) or automatic isolation valve(s). The completion times are acceptable based on the prompt action to mitigate the risk, and the low likelihood of an event during the allotted time after in-progress operations have been suspended.

SR The surveillance requirements ensure the continued operability of the safety-related check valves. The surveillance frequency is adequate based on the expected reliability of the passive components.

Page B 3.8-10 Revision 3

4.0 Design Features 4.1 Site and Facility Description DF 4.1.1 1. The SHINE Facility is owned and operated by SHINE Medical Technologies, LLC and is located at 4021 S. U.S. Highway 51, Janesville, WI, 53546. The SHINE Facility includes the main production facility, N2PS structure, resource building, material staging building, and the storage building.

2. The nearest distance from a potential release point from the main production facility to the site boundary is 756 ft.

3. The site boundary corresponds to the property line around the perimeter of the SHINE site and encompasses approximately 91 acres of land. The owner controlled area is the area within the site boundary.

4. The operations boundary is the area within the site boundary where the Shift Supervisor has direct authority over all activities. The controlled access area fence and the perimeter walls of the main production facility, the material staging building, the storage building, and the resource building constitute the SHINE operations boundary. The operations boundary is the emergency planning zone.

DF 4.1.2 1. The building free volume of the irradiation facility is approximately 13,400 m3.

2. The building free volume of the radioisotope production facility is approximately 18,000 m3.

3. The accident dose effluent release height is 0 feet above grade.

4. The normal effluent release height is 67 feet above grade.

DF 4.1.3 1. The PVVS carbon delay bed minimum efficiency for iodine is 99%.

2. The PVVS carbon delay bed delay time is 40 days, based on the travel time of xenon and the depth of the bed.

3. The TOGS zeolite bed minimum efficiency for iodine is 95%.

4. The TOGS recombiner minimum efficiency for hydrogen recombination is 95% for hydrogen concentrations above 3% by volume when heated to operating temperature.

5. The supercell RVZ1 outlet carbon filter minimum efficiency for iodine is 99%.

Page 4.0-1 Revision 3

DF 4.1.4 Supercell ventilation is designed with a maximum flowrate of 40 air exchanges per hour (ACH) for extraction and purification cells.

DF 4.1.5 The design of the N2PS contains the following characteristics to protect its equipment from the effects of external events:

1. Reinforced concrete structure for the compressed gas supply tanks and piping to protect against severe weather and tornado generated missiles.

2. Nitrogen gas purge exhaust height designed to be above the design snow accumulation depth.

3. Seismic design of the N2PS to ensure operability during and after a seismic event.

4.2 Coolant Systems DF 4.2.1 1. Each subcritical assembly system is submerged in an individual light water pool.

2. Each light water pool is provided a seismically qualified stainless steel liner.

3. Piping penetrations into the stainless steel liner are located above the minimum acceptable light water pool water level for decay heat removal, or a specific evaluation is performed to determine the potential for loss of pool water through the penetration. Piping penetrations into the light water pool with the potential for siphoning below the minimum acceptable water level contain anti-siphon devices or other means to prevent inadvertent loss of pool water.

4. Each light water pool is designed to maintain temperatures 50°F and 95°F.

4.3 Subcritical Assembly System and Target Solution DF 4.3.1 Target solution is an aqueous uranyl sulfate solution containing uranium enriched to less than 20 wt. % in U-235.

Page 4.0-2 Revision 3

DF 4.3.2 1. The subcritical assembly system principally consists of the TSV, subcritical assembly support structure (SASS), neutron multiplier and TSV dump tank, and is described in FSAR Section 4a2.2.

2. Redundant overflow tubes are provided for the TSV to protect the TSV headspace to allow for TOGS operation.

4.4 Fissionable Material Storage DF 4.4.1 The margin of subcriticality for uranyl sulfate systems in the RPF shall be greater than or equal to 0.06.

Page 4.0-3 Revision 3

5.0 Administrative Controls 5.1 Organization 5.1.1 Structure This section describes the SHINE organizational structure, functional responsibilities, and levels of authority. The levels employed are adapted from the definitions from ANSI/ANS 15.1-2007:

Level 1: Individuals responsible for the SHINE Facility License; Level 2: Individuals responsible for SHINE Facility operation; Level 3: Individuals responsible for day-to-day operation or shift; Level 4: Operating staff.

Alternates may perform the functions required in the absence of the normal designee.

The management for operation of the SHINE Facility shall consist of the organizational elements described below and shown in Figure 5.1.1:

1. Chief Executive Officer (CEO) - Level 1

2. Chief Operating Officer (COO) - Level 1 Alternate

3. Plant Manager (PM) - Level 2

4. Operations Manager (OM) - Level 2 Alternate

5. Shift Supervisors - Level 3

6. Senior Licensed Operators, Licensed Operators, and Field Operators - Level 4

7. Radiation Protection Manager (RPM)

8. Review and Audit Committee (RAC)

Page 5.0-1 Revision 3

Figure 5.1.1 SHINE Operational Organization Chart 5.1.2 Responsibility Responsibility for the safe operation of the SHINE Facility shall be with the chain of command established in Figure 5.1.1. Individuals at the various management levels shall be responsible for the policies and operation of the SHINE Facility, for safeguarding the public and facility personnel from undue radiation exposures, and for adhering to all requirements of the License and technical specifications.

1. The CEO is responsible for the overall design, management, and technical leadership of the company and is also responsible for all technical and administrative support activities provided by SHINE. The CEO reports to the Board of Directors with respect to all matters.

2. The COO is responsible for operational aspects of the company including safety, management, and training. The COO is also responsible for matters regarding environment, safety, and health. The COO delegates sufficient responsibility and authority to direct reports that ensures appropriate controls have been Page 5.0-2 Revision 3

established and for verifying that activities have been correctly performed. The COO has the overall responsibility for any programs that are established to ensure appropriate control of measures pertaining to safety, operability, and maintenance of the facility. The COO encourages managers and employees to identify problems and initiate, recommend, or provide corrective action, and ensures corrective action implementation. The COO reports to the CEO.

3. The PM is responsible for the operation and management of the SHINE Facility.

The PM is also responsible for establishing and managing the required training programs to support the organization, and for establishing and maintaining the programs and systems to ensure protection of the companys assets. The PM reports to the COO.

4. The OM is responsible for safe, reliable, and efficient plant operations within the constraints of the operating License and regulatory requirements. This position is also responsible for the development and implementation of appropriate operational controls in accordance with the QAPD. The OM reports to the PM.

5. The Shift Supervisors are responsible for the safe day-to-day operation of the facility. The Shift Supervisors report to the OM.

6. Senior Licensed Operators, Licensed Operators, and Field Operators are responsible for conforming to applicable rules, regulations, and procedures for operation of the facility. Senior Licensed Operators are responsible for safe and efficient operation of a portion of the facility when designated by the Shift Supervisor. Senior Licensed Operators and Licensed Operators are responsible for maintaining Senior Licensed Operator and Licensed Operator status, respectively. Field Operators are non-licensed operations personnel. Senior Licensed Operators, Licensed Operators, and Field Operators report to Shift Supervisors.

7. The RPM fulfills the radiation safety function and is responsible for establishing and implementing the RPP, monitoring worker doses, and the calibration and quality assurance of health physics instrumentation. The RPM reports to the PM.

8. The RAC is responsible for the independent review and audit of the safety aspects of the SHINE Facility operations. The RAC duties, authorities, and responsibilities are described in FSAR Section 12.2.

5.1.3 Facility Staffing Required

1. The minimum staffing when the facility is not Secured shall be:

a. A Senior Licensed Operator present in the facility,

b. A second Senior Licensed Operator or Licensed Operator present in the control room, and

c. An additional designated person present at the facility able to carry out prescribed written instructions.

Unexpected absence of any of the minimum staffing positions for as long as two hours to accommodate a personal emergency may be acceptable provided immediate action is taken to obtain a replacement.

Page 5.0-3 Revision 3

2. A list of facility personnel by name and telephone number shall be readily available in the control room for use by the operators. The list shall include:

a. Management personnel,

b. Radiation safety personnel, and

c. Other operations personnel.

5.1.4 Selection and Training of Personnel SHINE establishes and maintains training programs for personnel performing, verifying, or managing facility operation activities to ensure that suitable proficiency is achieved and maintained. The Training Manager (TM) reports to the PM and is responsible for development and implementation of training that ensures satisfactory operational behavior and performance in the areas of nuclear, industrial, and radiological safety.

ANSI/ANS 15.4-2016 is used in the selection and training of personnel and compliance is maintained with 10 CFR Part 55. Records of personnel training and qualification are maintained.

In general, personnel have the combination of academic training, job-related experience, health, and skills commensurate with their level of responsibility that provides reasonable assurance that decisions and actions during normal and abnormal conditions are such that the facility is operated in a safe manner.

Additional information is detailed in FSAR Subsection 12.1.4.

5.2 Review and Audit The COO establishes the RAC and ensures that the appropriate technical expertise is available for review and audit activities. The COO holds approval authority for review and audit activities. Independent audits of the SHINE Facility are conducted periodically.

The RAC will interact with facility management through the dissemination of meeting minutes and meeting reports.

5.2.1 Composition and Qualifications The RAC shall have the appropriate expertise and experience such that members provide the SHINE management an independent assessment of the operation. The COO shall be the chair of the RAC and shall appoint additional members. The minimum number of the members shall be three. The qualifications for the RAC members shall include a broad spectrum of technical, operational, and managerial expertise. Non-SHINE employees may be appointed as committee members, at the discretion of the COO.

5.2.2 Charter and Rules The charter for the RAC requires at least one meeting per year, with a quorum being a minimum of 50 percent of committee members where the operating staff does not constitute a majority. Dissemination, review, and approval of minutes shall happen in a timely manner. The RAC charter shall include provisions for the use of subgroups.

Committee reports and reviews shall be distributed by memorandum to Level 1 management and other management as designated in the charter. Voting may be conducted at the meeting or by polling members with a majority required for approval.

Page 5.0-4 Revision 3

5.2.3 Review Function

1. At a minimum, the following items shall be reviewed:

a. Determinations that proposed changes in equipment, systems, tests, or procedures are allowed without prior authorization by the responsible authority (e.g., 10 CFR 50.59 safety reviews);

b. All new procedures and major revisions thereto having safety significance;

c. Proposed changes in facility equipment or systems having safety significance;

d. Proposed changes in technical specifications or License;

e. Violations of technical specifications or License;

f. Violations of internal procedures or instructions having safety significance;

g. Operating abnormalities having safety significance;

h. Reportable occurrences; and

i. Audit/Assessment reports

2. A written report or minutes of the findings and recommendations of the RAC shall be submitted to Level 1 and the RAC group members in a timely manner after any review has been completed.

5.2.4 Audit Function

1. The audit function shall include selective (but comprehensive) examination of operating records, logs, and other documents. Discussions with personnel and observation of operations will be used as appropriate. In no case shall the individual immediately responsible for the area perform an audit in that area.

SHINE will work to establish relationships with other entities to participate in audits of the facility. The following items shall be audited:

a. Facility operations for conformance to the technical specifications and applicable License conditions (including organization and responsibilities, training, operations, procedures, logs and records, health physics, technical specification compliance, and surveillances): at least once per calendar year (interval between audits not to exceed 15 months);

b. The retraining and requalification program for the operating staff: at least once every other calendar year (interval between audits not to exceed 30 months);

c. The results of action taken to correct those deficiencies that may occur in the production facility equipment, systems, structures, or methods of operations that affect nuclear safety: at least once per calendar year (interval between audits not to exceed 15 months);

d. The SHINE Facility emergency plan and implementing procedures: at least once every other calendar year (interval between audits not to exceed 30 months);

Page 5.0-5 Revision 3

e. The radiation protection plan: at least once per calendar year (interval between audits not to exceed 15 months);

f. The QAPD: at least once every other calendar year (interval between audits not to exceed 30 months); and

g. The physical security plan: at least once every other calendar year (interval between audits not to exceed 30 months).

2. Deficiencies identified during the audit will be entered into the Corrective Action Program. Deficiencies uncovered that affect nuclear safety shall immediately be reported to Level 1 management. A written report of the findings of the audit shall be submitted to Level 1 management and the review and audit committee members within three months after the audit has been completed.

5.3 Radiation Safety The RPM shall be responsible for the implementation of the radiation protection program. The requirements of the radiation protection program are established by 10 CFR Part 20. The program shall use the guidelines of ANSI/ANS 15.11-1993, Radiation Protection at Research Reactor Facilities. Furthermore, SHINE is committed to ensuring that radiation exposures are ALARA and in maintaining and effective ALARA Program.

The radiation protection department is independent of facility operations. This independence ensures that the radiation protection department maintains its objectivity and is focused only on implementing sound radiation protection principals necessary to achieve occupational doses and doses to members of the public that are ALARA.

Radiation protection staff maintain the ability to raise safety issues with the review and audit committee or executive management.

5.4 Procedures

1. Procedures for the operation and use of the SHINE Facility provide appropriate direction to ensure that the facility is operated normally within its design basis, and in compliance with technical specifications. These procedures are written, reviewed, approved by appropriate management, as well as controlled and monitored to ensure that the content is technically correct, and the wording and format are clear and concise.

2. The process required to make changes to procedures, including substantive and minor permanent changes, and temporary deviations to accommodate special or unusual circumstances during operation shall be in compliance with ANSI/ANS 15.1-2007.

3. SHINE shall prepare, review, and approve written procedures for the following basic topics:

a. startup, operation, and shutdown of the IU;

b. target solution fill, draining, and movement within the SHINE Facility;

c. maintenance of major components of systems that may have an effect on nuclear safety; Page 5.0-6 Revision 3

d. surveillance checks, calibrations and inspections required by the technical specifications;

e. personnel radiation protection, consistent with applicable regulatory guidance. The procedures shall include management commitment and programs to maintain exposures and releases as low as reasonably achievable in accordance with applicable guidance;

f. administrative controls for operations and maintenance and for the conduct of irradiations that could affect nuclear safety;

g. implementation of required plans (e.g., emergency, security); and

h. use, receipt, and transfer of byproduct material.

4. The specific procedures within these topic areas are developed in accordance with SHINE QAPD Section 2.5.

5. SHINE shall review and approve written procedures prior to initiating any of the activities listed above. The procedures shall be reviewed by the SHINE review and audit committee and approved by Level 2 management or designated alternates, and such reviews and approvals shall be documented in a timely manner.

6. Substantive changes to procedures related to the activities listed above shall be made effective only after documented review by the SHINE review and audit committee and approval by Level 2 management or designated alternates. Minor modifications to the original procedure that do not change their original intent may be made by Level 3 management or higher, but the modifications must be approved by Level 2 or designated alternates. Temporary deviations from the procedures may be made by a Senior Licensed Operator or higher individual present, in order to accommodate special or unusual circumstances or conditions. Such deviations shall be documented and reported within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or the next working day to Level 2 management or designated alternates. Review and approval of procedural changes shall be documented in a timely manner, in accordance with the SHINE Document Control procedure.

7. Revisions to the procedures for the operation and use of the SHINE Facility are initiated and tracked through the document control processes. Following preparation, procedure revisions receive a technical review, which will include a screening for 10 CFR 50.59 applicability and are then reviewed and approved as described above.

8. The extent of detail in a procedure is dependent on the complexity of the task; the experience, education, and training of the users; and the potential significance of the consequences of error. The process for making changes and revisions to procedures is documented. A controlled copy of all operations procedures is maintained in the control room. Activities and tasks are performed in accordance with approved implementing procedures.

Page 5.0-7 Revision 3

5.5 Programs The following programs shall be established, implemented, and maintained.

5.5.1 Nuclear Safety Program The SHINE nuclear safety program documents and describes the methods used to minimize the probability and consequences of accidents resulting in radiological or chemical release. The program applies a graded approach to the design and management of processes to assure plant safety through risk reduction and satisfaction of SHINEs performance goals. The safety program accomplishes these goals through development and maintenance of the accident analysis, identification of safety-related structures, systems, and components (SSCs) credited for accident mitigation, and establishment of programmatic administrative controls to ensure reliability of the credited SSCs.

5.5.2 Training and Qualification The SHINE training and qualification programs include initial and requalification training programs for Licensed Operators, which were developed to conform to the requirements of 10 CFR Part 55, as it pertains to non-power facilities, following the guidance contained in ANSI/ANS 15.4-2016, Selection and Training of Personnel for Research Reactors.

5.5.3 Radiation Protection The SHINE radiation protection program is provided to protect the radiological health and safety of workers and the public. The program meets the requirements of 10 CFR 20, Subpart B, and is consistent with the guidance provided in ANSI/ANS 15.11-2016, Radiation Protection at Research Reactor Facilities, and Regulatory Guide 8.2, Revision 1, Administrative Practices in Radiation Surveys and Monitoring. In addition, SHINE has established this program to maintain occupational radiation exposures and releases to the environment ALARA.

5.5.4 Configuration Management The SHINE configuration management program provides oversight and control of design information, safety information, and records of modifications that might impact the ability of safety-related SSCs to perform their functions. The configuration management program is applied to all safety-related SSCs. The configuration management program is used to maintain consistency among the design requirements, the physical configuration and the facility documentation, and ensures changes are made in accordance with 10 CFR 50.59, 10 CFR 70.72, and the administrative controls and reviews specified by this program.

Table 5.5.4 lists controls derived from the accident analysis not otherwise included in Sections 3, 4, or 5 of the technical specifications. SHINE maintains these controls under the configuration management program and will not modify the characteristics of the items listed in Table 5.5.4 without prior NRC approval.

Page 5.0-8 Revision 3

Table 5.5.4 Controls Category Characteristic The facility structure is designed to protect safety-related SSCs from tornado winds and missile loads, heavy snow and ice loading, and the impact of design basis (small) aircraft, including the effects of fire, as described in FSAR Section 3.4.

The design of the facility includes provisions for the prevention of adverse effects of flooding from external sources, barriers in the RPCS room prevent flooding from leaving the RPCS room, and the floor of the URSS and TSPS room is elevated to prevent water intrusion in the event of internal flood or use of water for fire suppression in other areas of the facility. The RPF sub-grade vaults and trenches are sealed to resist water intrusion that could compromise the function of the RDS sump.

The interior design includes shield walls for line of sight trajectory paths Main Production from the overhead doors to the interior structure to protect against Facility Structure possible intrusion of tornado missiles.

The overhead crane in the irradiation facility is designed as single-failure proof to protect against heavy load drops.

The RPF shielding cover plugs are designed to maintain their structural integrity, to protect equipment located in the vaults, trench, and pits, in the event of a heavy load drop, or a specific evaluation of the potential for and effects of a dropped load is performed.

The TPS-NDAS Interface lines are protected from damage due to external impacts by 1) the majority of tube lengths are run through subgrade sleeves and are protected by rebar re-enforced concrete, and

2) sections that are above grade in the TPS rooms are protected by mechanical guards.

The PSB piping and structural supports for SCAS and TOGS safety-related equipment are seismically qualified.

The VTS is designed such that the TSV fill lift tank has a drain path to the target solution hold tank The external design pressure of the TSV is greater than the maximum Irradiation Unit design cooling water pressure of the PCLS.

The TSV fill line is designed to prevent reverse flow of target solution from the TSV from occurring.

The PSB contains redundant pressure relief valves and redundant vacuum relief valves to limit pressure transients.

Page 5.0-9 Revision 3

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)

Category Characteristic The fill rate of target solution into the TSV is not more than

[ ]PROP/ECI. This rate is set and verified during Startup Testing using a throttle valve that is subsequently locked in place.

The overflow lines in the TSV are located at a height sufficient to protect the TSV headspace to allow proper operation of the TOGS.

Irradiation Unit The TSV dump tank is designed with keff < 0.95 for the most reactive (continued) uranium concentration for the prevention of criticality.

The TOGS physical design ensures keff is < 0.95 for the most reactive uranium concentration for the prevention of criticality.

[

]PROP/ECI The PCLS expansion tank is provided with a flame arrester at the tank Coolant Systems vent inlet to prevent ignition of hydrogen accumulated in the expansion tank from ignition sources in the primary Confinement boundary.

The TSSS process pipes are seismically qualified.

The MEPS [ ]PROP/ECI is seismically qualified.

The design of the MEPS upper three-way valve prevents reverse flow from the target solution return header to the eluate tank.

Isotope Production The MEPS extraction feed pump discharge lines have overpressure Systems protection.

Vaults, trenches, valve pits, and hot cells where high concentration uranium-bearing solutions may be present are equipped with drains to the favorable geometry RDS sump tanks. The RDS drain in the supercell additionally provides over pressure protection via a relief path to the RDS.

Confinement boundaries within the facility are provided to limit the release of effluents from the enclosure to the external environment through controlled or defined pathways.

Confinement The holdup volume in RVZ1e from the PCLS expansion tank, between radiation detectors and isolation devices, provides a time delay for isolation of IU cell gases exiting the confinement boundary.

Page 5.0-10 Revision 3

Category Characteristic The TPS gloveboxes limit the release of tritium in the event of a process Confinement leak. The gloveboxes are inerted with helium and are designed with a (continued) minimum free volume is specified so that the entire inventory of hydrogen cannot reach the lower flammability limit if released within the glovebox.

The ESFAS and TRPS safety-related control systems are designed to assume a safe state on a loss of electrical power, as described in FSAR Subsections 7.4.3.8 and 7.5.3.7. Divisions A and B of ESFAS and TRPS Instrumentation control cabinets are located on opposite sides of the control room, and are mounted six inches above the floor to remain above maximum credible flood height.

The TSPS and URSS gloveboxes provide a low leakage boundary for uranium oxide and metal, are equipped with high efficiency particulate air (HEPA) filters and are seismically qualified.

Criticality Safety The seismic design of the URSS storage racks prevents loss of control of fissile material geometry and confinement.

Engineered controls are identified in the criticality safety evaluations to prevent criticality in the RPF.

5.5.5 Maintenance of Safety-Related SSCs The SHINE maintenance program, which includes inspection, testing, and maintenance, ensures that the safety-related SSCs are available and reliable when needed. The maintenance program includes corrective maintenance, preventative maintenance, surveillance and monitoring, and testing. The maintenance program includes the following activities to ensure that safety-related SSCs can perform their functions as required by the accident analysis:

1. Inspection and maintenance of Confinement boundaries;

2. Corrective maintenance and inspections following safety-related system or component actuations or adverse conditions;

3. Overhead crane maintenance and requirements for usage;

4. Safety-related electrical equipment preventive maintenance; and

5. Other inspections and surveillances deemed necessary to ensure the continued functionality of safety-related SSCs.

5.5.6 Fire Protection The SHINE fire protection program documents and describes the methods used to minimize the probability of and the consequences of fire. The fire protection program ensures, through defense-in-depth, that a fire will not prevent the performance of necessary safety-related functions and that radioactive releases to the environment, in the event of fire, will be minimized. The fire protection program implements the following activities to prevent and mitigate potential fire events in the SHINE Facility:

Page 5.0-11 Revision 3

1. Periodic surveillances;

2. Control of hot work;

3. Control of transient combustibles;

4. Control of physical design characteristics of the facility relied on to prevent or mitigate the effects of fires; and

5. Maintenance of the fire hazards analysis and safe shutdown analysis for the facility.

5.5.7 Nuclear Criticality Safety The SHINE nuclear criticality safety program ensures that workers, the public, and the environment are protected from the consequences of a nuclear criticality event. The nuclear criticality safety program complies with applicable national consensus standards, as clarified by Regulatory Guide 3.71, Revision 3, Nuclear Criticality Safety Standards for Fuels and Material Facilities, and is described in FSAR Subsection 6b.3.1.

The nuclear criticality safety program evaluates the fissionable material operations in the SHINE RPF and establishes appropriate criticality safety controls which are described in the criticality safety evaluations and the accident analysis. The criticality safety controls are preventative in nature and comply with the preferred hierarchy of controls: passive controls over active controls and engineered controls over administrative controls.

A criticality accident alarm system (CAAS) is provided for the SHINE Facility. The CAAS meets the requirements of 10 CFR 70.24(a) and follows the guidance of ANSI/ANS 8.3-1997. Maintenance and testing of the CAAS is performed in accordance with ANSI/ANS 8.3-1997. The CAAS is further described in FSAR Subsection 6b.3.3.

5.5.8 Chemical Control The SHINE chemical control program ensures that on-site chemicals are stored and used appropriately to prevent undue risk to workers and the facility. The chemical control program implements the following activities, as required by the accident analysis:

1. Control of chemical quantities permitted in designated areas and processes;

2. Chemical labeling, storage and handling; and

3. Laboratory safe practices.

5.6 Experiments Review and Approval Experiments, as defined in ANSI/ANS 15.1-2007, are not conducted at the SHINE Facility.

5.7 Required Actions 5.7.1 Safety Limit Violation In the event of a safety limit violation:

1. The operations leading to the violation shall be shut down immediately and operation of those affected processes shall not be resumed until authorized by the NRC; Page 5.0-12 Revision 3

2. The safety limit violation shall be promptly reported to Level 2 management or designated alternates;

3. The safety limit violation shall be reported to the NRC; and

4. A safety limit violation report shall be prepared. The report shall describe the following:

a. Applicable circumstances leading to the violation including, when known, the cause and contributing factors;

b. Effect of the violation upon facility components, systems, or structures and on the health and safety of personnel and the public; and

c. Corrective action to be taken to prevent recurrence.

5. The report shall be reviewed by the RAC, and any follow-up report shall be submitted to the NRC when authorization is sought to resume operation of the affected processes.

5.7.2 Occurrence of Events Requiring a Special Report.

In the event of an occurrence requiring a special report as specified in Section 5.8.2.1, other than a violation of a safety limit:

1. The affected processes or areas of the facility shall be returned to normal conditions or shut down. If it is necessary to shut down processes to correct the occurrence, operation of those affected processes shall not be resumed unless authorized by Level 2 management or designated alternates.

2. The occurrence shall be reported to Level 2 management or designated alternates and to the NRC.

3. The occurrence shall be reviewed by the RAC at its next scheduled meeting.

5.8 Reports 5.8.1 Operating Reports An annual report covering the operation of the facility during the previous calendar year will be submitted to the NRC Document Control Desk within 30 days of the end of the calendar year providing the following information:

1. A narrative summary of operating experience including the energy produced by each IU or the hours each IU was Operating, or both;

2. The Unscheduled Shutdowns including, where applicable, corrective action taken to preclude recurrence;

3. Tabulation of major preventative and corrective maintenance operations having safety significance;

4. Tabulation of major changes in the facility and procedures, including a summary of the evaluation leading to the conclusions that they are allowed without prior NRC approval;

5. A summary of the nature and amount of radioactive effluents released or discharged to environs beyond SHINEs effective control, as determined at, or before, the point of such release or discharge. The summary will include to the Page 5.0-13 Revision 3

extent practicable an estimate of individual radionuclides present in the effluent.

If the estimated average release after dilution or diffusion is less than 25 percent of the concentration allowed or recommended, a statement to this effect is sufficient;

6. A summarized result of environmental surveys performed outside the facility; and

7. A summary of exposures received by facility personnel and visitors where such exposures are greater than 25 percent of that allowed or recommended.

5.8.2 Special Reports Special reports are used to report unplanned events as well as planned major facility and administrative changes. Special reports will follow the schedule below:

1. There will be a report not later than the following working day by telephone and confirmed in writing by facsimile or similar conveyance to the NRC Operations Center, to be followed by a written report to the NRC Document Control Desk that describes the circumstances of the event within 14 days of any of the following:

a. Violation of a safety limit;

b. Release of radioactivity from the site above allowed limits;

c. Operations with actual Safety System settings for required systems less conservative than the limiting safety system settings specified in Section 2.2;

d. Operation in violation of limiting conditions for operation established in Section 3, unless prompt remedial action is taken as permitted in Section 3;

e. A Safety System component malfunction that renders or could render the Safety System incapable of performing its intended safety function. If the malfunction or condition is caused by maintenance, then no report is required;

f. An unanticipated or uncontrolled change in reactivity greater than one dollar;

g. Abnormal and significant degradation of the PSB (excluding minor leaks);

and

h. An observed inadequacy in the implementation of administrative or procedural controls such that the inadequacy causes or could have caused the existence or development of an unsafe condition with regard to operations.

2. There will be a written report within 30 days to the NRC Document Control Desk of the following:

a. Permanent changes in the facility organization involving Level 1 or Level 2 management, and

b. Significant changes in the transient or accident analysis as described in the FSAR.

Page 5.0-14 Revision 3

5.8.3 Startup Report SHINE shall conduct startup testing in accordance with the Startup Testing Program, as described in FSAR Section 12.11. Following completion of startup testing, SHINE will submit a Startup Report to the NRC Document Control Desk that identifies the startup tests performed.

The Startup Report shall be submitted within 6 months of the completion of all startup testing activities.

5.9 Records 5.9.1 Lifetime Records The following records are to be retained for the lifetime of the SHINE Facility:

1. Gaseous and liquid radioactive effluents released to the environs;

2. Offsite environment-monitoring surveys required by the technical specifications;

3. Radiation exposure for all monitored personnel; and

4. Updated drawings of the SHINE Facility.

Applicable annual reports, if they contain all of the required information, may be used as records in this section.

5.9.2 Five Year Records The following records are to be maintained for a period of at least five years or for the life of the component involved if less than five years:

1. Normal SHINE Facility operation (but not including supporting documents such as checklists, log sheets, etc., which shall be maintained for a period of at least one year);

2. Principal maintenance operations;

3. Reportable occurrences;

4. Surveillance activities required by the technical specifications;

5. Facility radiation and contamination surveys where required by applicable regulations;

6. Radioactive material inventories, receipts, and shipments;

7. Approved changes in operating procedures; and

8. Records of meeting and audit reports of the review and audit group.

5.9.3 Records to be retained for at least one certification cycle Records of retraining and requalification of operations personnel who are Licensed pursuant to 10 CFR Part 55 shall be maintained at all times while the individual is employed or until License is renewed.

Page 5.0-15 Revision 3

ML20255A048

Text

Navigation menu

Search