ML21029A105

Enclosure 3 - Response to Final Safety Analysis Report Chapters 6 and 13 Requests for Additional Information

ML21029A105
Person / Time
Site:	SHINE Medical Technologies
Issue date:	01/29/2021
From:	SHINE Medical Technologies
To:	Office of Nuclear Reactor Regulation
Shared Package
ML21029A101	List: ML21029A102 ML21029A103 ML21029A105
References
2021-SMT-0008
Download: ML21029A105 (58)

Text

ENCLOSURE 3 SHINE MEDICAL TECHNOLOGIES, LLC SHINE MEDICAL TECHNOLOGIES, LLC OPERATING LICENSE APPLICATION RESPONSE TO REQUEST FOR ADDITIONAL INFORMATION RESPONSE TO FINAL SAFETY ANALYSIS REPORT CHAPTERS 6 AND 13 REQUESTS FOR ADDITIONAL INFORMATION (PUBLIC VERSION)

SHINE MEDICAL TECHNOLOGIES, LLC SHINE MEDICAL TECHNOLOGIES, LLC OPERATING LICENSE APPLICATION RESPONSE TO REQUEST FOR ADDITIONAL INFORMATION RESPONSE TO FINAL SAFETY ANALYSIS REPORT CHAPTERS 6 AND 13 REQUESTS FOR ADDITIONAL INFORMATION The U.S. Nuclear Regulatory Commission (NRC) staff determined that additional information was required (Reference 1) to enable the continued review of the SHINE Medical Technologies, LLC (SHINE) operating license application (Reference 2). The following information is provided by SHINE in response to the NRC staffs request.

Chapter 6 - Engineered Safety Features RAI 6b.3-10 SHINE document NCSE-2018-0011, Section 4.1.1, Subcritical Mass Limits, states that the subcritical mass limits for operations in the Quality Control and Analytical Testing Laboratories (LABS) were derived based on the single parameter limits (SPLs) from ANSI/ANS-8.1.

However, the SPLs used appear to be that of a material composition inconsistent with, and potentially nonconservative of, the materials associated with LABS operations.

a. Describe the methodology used to determine whether a composition-specific SPL may be used to establish NCS limits for another material composition.

Provide a justification for applying the SPLs of a material composition other than those associated with a specific process.

This information is necessary for the NRC staff to make the necessary evaluation findings described in the ISG augmenting NUREG-1537, Part 2, Section 6b.3. Specifically, the requested information will support the NRC staff in concluding that SHINE will have the capability to perform adequate safety analyses of all production processes that will be conducted in the facility.

SHINE Response SHINE document NCSE-2018-0011 has been revised to remove the derivation of subcritical mass limits for operations in the quality control and analytical testing laboratories (LABS) based on the single parameter limits for uranyl fluoride from American National Standards Institute/American Nuclear Society (ANSI/ANS)-8.1-2014, Nuclear Criticality Safety in Operations with Fissionable Materials Outside Reactors (Reference 3). The subcritical mass limits used in the revised NCSE are derived from ANSI/ANS-8.1-2014. Section 5.2 of ANSI/ANS-8.1-2014 states that the single parameter mass limit for 235U is 700 grams, independent of compound. For conservatism, this single parameter limit is halved, resulting in a subcritical mass limit for operations in the LABS of 350 grams 235U, and an operational limit of 250 grams totalU.

Page 1 of 21

RAI 6b.3-12 SHINE document NCSE-2018-0010, Nuclear Criticality Safety Evaluation of the Radioactive Liquid Waste Immobilization System (RLWIS), Section 4.1.1, Subcritical Limits Uranyl Sulfate, provides a methodology to derive the limits for uranium concentration. However, the proposed methodology is imprecise and does not necessarily provide an adequate demonstration that RLWIS operations are below the appropriate upper subcritical limit.

Provide a justification for using the stated methodology to determine NCS limits, demonstrating assurance that the USL is not exceeded using information from CALC-2018-0009, Single Parameter Limits for Fissile Material (2018), and any other supporting analyses, as applicable.

Update the FSAR with a justification for using the stated methodology.

This information is necessary for the NRC staff to make the necessary evaluation findings described in the ISG augmenting NUREG-1537, Part 2, Section 6b.3. Specifically, the requested information will support the NRC staff in concluding that SHINE will have the capability to perform adequate safety analyses of all production processes that will be conducted in the facility.

SHINE Response Section 4.2.7 of ANSI/ANS-8.1-2014, Nuclear Criticality Safety in Operations with Fissionable Materials Outside Reactors (Reference 3), allows derivation of subcritical limits from calculations made by a validated computational method. The subcritical limit for uranium concentration was derived by computation of the effective multiplication factor (keff) over a wide range of uranium concentration (i.e., 0.01 to 1856 grams of uranium per liter [g-U/L]) for an infinite sea of solution. The subcritical limit for the radioactive liquid waste immobilization (RLWI) system was derived by linear interpolation between data points to fit to the expanded upper subcritical limit (0.91488), which is the nominal upper subcritical limit (0.93488) with an extension (AoA = -0.02), because the uranium concentration in the system falls outside the area of applicability for the validated calculation, as described in the SHINE Response to RAI 6b.3-13 (Reference 4). In the range of data in which the linear interpolation is performed, the data used are sufficiently close to justify the use of linear interpolation. The tabulated results show the calculated system multiplication factor (kinf + 2) for an infinite sea of target solution at 50.5 g-U/L is 0.91360, which is less than the extended upper subcritical limit and is sufficient to demonstrate assurance that the upper subcritical limit is not exceeded.

Linear interpolation between the concentration values of 50.5 g-U/L and 51 g-U/L to a keff of 0.91488 gives an upper subcritical limit of 50.63 g-U/L, which is rounded down to 50.5 g-U/L for convenience. The correlation between kinf and uranium concentration in this range is sufficiently linear to justify the use of first order linear interpolation.

Additionally, comparison with the subcritical limits listed in Table 1 of ANSI/ANS-8.1-2014 shows that a subcritical limit of 50.5 g-U/L at 20 percent enrichment (10.1 g-235U/L) is less than each of the available subcritical limits for 235U solutes (11.6 g/L for fluoride and nitrate).

As described in Subsection 6b.3.1.4 of the FSAR, nuclear criticality safety (NCS) limits are derived based on optimum or most-reactive credible parameter values unless specific controls are implemented to limit parameters to a particular range. Subsection 6b.3.2.2 of the FSAR describes the radioactive liquid waste storage (RLWS) system and the RLWI system, including their criticality safety basis. The necessary controls which restrict system concentration to a Page 2 of 21

range which is below the subcritical limit are summarized in this subsection. No FSAR changes are necessary to reflect this methodology because it is consistent with the guidance of ANSI/ANS-8.1-2014 and the criticality safety basis described in the FSAR.

RAI 6b.3-14 10 CFR 50.68(a) states that the applicant shall comply with the requirements of 10 CFR 70.24, Criticality accident requirements, or meet certain alternative requirements, as described in 10 CFR 50.68(b), in lieu of maintaining a criticality accident alarm system as described in 10 CFR 70.24.

10 CFR 70.24(a) requires, in part, that each licensee authorized to possess special nuclear material (SNM) in a quantity exceeding 700 grams of contained uranium-235 (U-235),

520 grams of U-233, 450 grams of plutonium, 1.5 kilograms of contained U-235 if no uranium enriched to more than 4 wt.% U-235 is present, or 450 grams of any combination thereof, maintain in each area in which such licensed SNM is handled, used, or stored, a criticality accident alarm system.

The ISG augmenting NUREG-1537, Part 2, Chapter 6b3.2, Nuclear Criticality Safety in the Radioisotope Production Facility, states, in part, that the applicant should state clearly how the design of the facility or process provides for criticality control and should identify how the requirements of 10 CFR 70.24 were considered.

FSAR, Section 6b.3.3, Criticality Accident Alarm System, states that the SHINE facility provides a criticality accident alarm system (CAAS) to detect a criticality event in the areas in which non-exempt quantities of fissile material greater than the limits identified in 10 CFR 70.24(a) are used, handled, or stored outside the irradiation units, where exempt fissile material is defined as SNM that meets the requirements from classification as fissile material as specified in 10 CFR 71.15. However, the requirements of 10 CFR 70.24 regarding whether a CAAS is required are based on specific, objective criteria of SNM mass quantities by isotope (or combinations thereof). It does not provide any distinctions as to whether such SNM quantities are, or should be considered, fissile or fissile-exempt, nor does it provide any exceptions for SNM quantities in excess of those limits. As such, SNM quantities greater than the limits established by 10 CFR 70.24 require CAAS coverage regardless of whether they meet the requirements from classification as fissile material as specified in 10 CFR 71.15.

Revise the FSAR to be consistent with the requirements of 10 CFR 70.24, or justify why those requirements do not need to be met for certain areas of the facility.

This information is necessary for the NRC staff to make the necessary evaluation findings described in the ISG augmenting NUREG-1537, Part 2, Section 6b.3. Specifically, the requested information will support the NRC staff in concluding that SHINE will develop, implement, and maintain a criticality accident alarm system that meets the acceptance criteria in Section 6b.3 of the ISG; and will have in place an NCS program.

SHINE Response Those areas of the SHINE facility in which special nuclear material (SNM) above the threshold quantities provided in 10 CFR 70.24(a) is handled, used, or stored are the irradiation unit (IU) cells, the target solution vessel (TSV) off-gas system (TOGS) cells, the radioisotope production facility (RPF), and the material staging building (MATB). The TOGS cells and the RPF are Page 3 of 21

monitored by the criticality accident alarm system (CAAS), as described in Subsections 6a2.3.2 and 6b.3.3 of the FSAR, respectively.

SHINE is requesting exemption from the monitoring requirements of 10 CFR 70.24(a) for the IU cells and the MATB (Reference 5). The exemption request provided via Reference 5 includes justification for why the requirements of 10 CFR 70.24(a) do not need to be met for the IU cells and the MATB.

Page 4 of 21

Chapter 13 - Accident Analysis RAI 13-5 10 CFR 50.34(b) states that the FSAR shall include information that describes the facility, presents the design bases and the limits on its operation, and presents a safety analyses of the structures, systems and components and of the facility.

10 CFR 50.34(b)(2) states that a description and analyses of the structures, systems and components of the facility, with emphasis upon the performance requirements, the bases, with technical justification therefor, upon which such requirements have been established, and the evaluations required to show that safety functions will be accomplished.

10 CFR Part 50, paragraph 50.57(a)(3) states that an operating license may be issued upon finding that, There is reasonable assurance (i) that the activities authorized by the operating license can be conducted without endangering the health and safety of the public The ISG to NUREG-1537 states in Section 13a2 that the information in this chapter should achieve the objectives stated in this chapter of NUREG-1537, Part 1 by demonstrating that the applicant has considered all potential accidents at the reactor facility and adequately evaluated their consequences.

The ISG to NUREG-1537 states NRC staff have determined that the use of Integrated Safety Analysis (ISA) methodologies as described in 10 CFR 70 and NUREG-1520, application of the radiological and chemical consequence and likelihood criteria contained in the performance requirements of 10 CFR 70.61, designation of items relied on for safety, and establishment of management measures are acceptable ways of demonstrating adequate safety for the medical isotopes production facility. Applicants may propose alternate accident analysis methodologies, alternate radiological and chemical consequence and likelihood criteria, alternate safety features, and alternate methods of assuring the availability and reliability of the safety features.

SHINE has prepared a document entitled SHINE Safety Analyses (SSA) Report (TECRPT-2020-016) which discusses the safety analyses methodology; however, this methodology is not discussed in the FSAR.

Revise the FSAR to include a description of the accident analysis methodology and criteria.

Discuss the types of hazards considered (e.g., radiological, chemical), the phases of operation analyzed in the accident analysis (startup, normal operation, shutdown, non-routine operations),

the receptors considered, and the criteria used to determine the acceptability of accident consequences for each type of hazard (e.g. chemical, radiological) and each receptor (e.g.,

public, worker, control room operator). Also discuss consideration of non-routine activities such as (1) unplanned maintenance activities; (2) periods of extended shutdown, or (3) conditions outside of the established Limiting Conditions of Operations (LCOs). Maintenance activities can create situations where there could be reduced controls or barriers resulting in the release of hazardous material and extended shutdown periods or conditions exceeding LCOs could introduce new accident scenarios.

Page 5 of 21

SHINE Response SHINE has revised Section 13a2.1 of the FSAR to include a description of the SHINE accident analysis methodology and criteria. A mark-up of the FSAR incorporating these changes is provided as Attachment 1.

RAI 13-7 10 CFR 50.34(b) states that the FSAR shall include information that describes the facility, presents the design bases and the limits on its operation, and presents a safety analyses of the structures, systems and components and of the facility.

10 CFR 50.34(b)(2) states that a description and analyses of the structures, systems and components of the facility, with emphasis upon the performance requirements, the bases, with technical justification therefor, upon which such requirements have been established, and the evaluations required to show that safety functions will be accomplished.

10 CFR Part 50, paragraph 50.57(a)(3) states that an operating license may be issued upon finding that, There is reasonable assurance (i) that the activities authorized by the operating license can be conducted without endangering the health and safety of the public The ISG to NUREG-1537 states in Section 13a2 that the information in this chapter should achieve the objectives stated in this chapter of NUREG 1537, Part 1 by demonstrating that the applicant has considered all potential accidents at the reactor facility and adequately evaluated their consequences.

The ISG to NUREG-1537 states NRC staff have determined that the use of Integrated Safety Analysis methodologies as described in 10 CFR 70 and NUREG-1520, application of the radiological and chemical consequence and likelihood criteria contained in the performance requirements of 10 CFR 70.61, designation of items relied on for safety, and establishment of management measures are acceptable ways of demonstrating adequate safety for the medical isotopes production facility. Applicants may propose alternate accident analysis methodologies, alternate radiological and chemical consequence and likelihood criteria, alternate safety features, and alternate methods of assuring the availability and reliability of the safety features.

SHINE has stated in the SSA that they are using guidance from NUREG-1520 to support their accident analyses in the FSAR. The following items identified from SHINEs SSA summary are not consistent with the regulatory guidance in Chapter 3 of NUREG-1520. The staff needs this information to assess the completeness of the applicants accident analyses and the adequacy of the applicants accident analyses methodology. Furthermore, the staff needs this information to verify the applicants implementation of the SSA methodology for reasonable assurance that the applicant will conduct operations without endangering the health and safety of the public.

a. Section 2.5.2 of the SSA states that the dose calculations were made using both the site boundary and the location of the nearest resident as dose receptors. Revise the SSA dose calculations and FSAR, as necessary, to consider the distance to the end of the owner-controlled area, or the maximum exposed individual. Alternatively, justify use of the nearest resident.

b. In the SSA, SHINE assigns a failure frequency index of -5 to some safe-by-design controls without further justification. Similarly, SHINE assigns a failure probability index of -4 or -5 to Page 6 of 21

passive engineered controls with high design margin without further justification. Using these assumptions, failure of a safe-by-design component is inherently considered highly unlikely and therefore the accident sequence need not be developed and further analyzed.

According to guidance in Chapter 3 of NUREG-1520, the default failure frequency or failure probability index for such controls is -3. The approach taken in the SSA is not consistent with the guidance in NUREG-1520. Re-evaluate the applicable accident sequences using the assumptions from NUREG-1520. Alternatively, provide the analysis that justifies assigning the associated failure frequencies or failure probability indices.

c. According to Tables 2.4.1 and 2.4.2 of the SSA, SHINE may assign a failure frequency index of -4 and a failure probability index of -3 to an enhanced specific administrative control. Given that this facility is first of a kind and the reliability of human actions in its operation has not been studied to the extent of those in a nuclear reactor or typical fuel cycle facility, it is unlikely these indices could be justified without a detailed analysis.

According to the guidance in NUREG-1520, the default failure frequency or failure probability index for such controls is -2. Re-evaluate the applicable accident sequences using the assumptions from NUREG-1520 for administrative controls. Alternatively, provide the analysis that justifies assigning the associated failure frequencies or failure probability indices.

d. As cited in NUREG-1520, the methodology should contain information on management measures applied to ensure designated safety controls are reliable and available to perform their intended safety function, i.e., management measures are necessarily distinct from the IROFS to which they are applied. The applicants SSA describes Reliability Management Measures as programmatic administrative controls that are applied to credited controls.

These Reliability Management Measures include maintenance, inspections, and testing.

Appendix A appears to credit those measures as safety related. For those accident sequences in Appendix A that credit Reliability Management Measures as preventing or mitigating an accident sequence, the staff needs clarification on the credited controls to which the Reliability Management Measures are applied. If the credited controls are also Reliability Management Measures, the applicant should reevaluate the applicable accident sequences to identify and evaluate the failure likelihood of the controls to which the Reliability Management Measures are applied.

SHINE Response

a. SHINE has revised Section 2.5.2 of the SHINE Safety Analysis (SSA) to identify that the public radiological dose is only calculated at the site boundary and not the nearest resident.

b. Failure Frequency Index Number (FFIN) = -5 Table 2.3.4-1 of the SSA describes the basis for the FFINs used in the SSA to estimate the frequency of occurrence for postulated accident scenarios. With the exception of the category for FFIN = -5, the table is based on the FFINs provided in Table A-9 of NUREG-1520, Standard Review Plan for Fuel Cycle Facilities License Applications (Reference 6). The category for FFIN = -5 was included to categorize postulated initiating event failures involving passive safe-by-design systems or components, or for initiating events involving additional failures or existing conditions.

Page 7 of 21

Security-Related Information - Withheld from public disclosure under 10 CFR 2.390(d)

An FFIN = -5 is used for those passive components or systems that are considered highly unlikely to result in a postulated initiating event that meet the following three criteria:

1. Fall within single parameter limits,

2. Have no credible failure mechanisms, and

3. Design characteristics are fixed and can only be modified by design change.

A value of FFIN = -5 may also be applied for initiating events that are a composite of a larger failure frequency and an additional probability of a failure or existing condition.

In the SSA, SHINE applied an FFIN = -5 to seven postulated accident sequences in the screening of initiating events. Table 13-7-1 provides a basis for the application of an FFIN = -5 for each of these seven postulated accident sequences.

Only accident sequence 13a2.1.11-E credits an FFIN = -5. The remaining sequence initiating events are composites of an event occurring coincident with other failures or conditions (i.e., 13a2.1.11-G, 13b2.5-C, 13b.2.5-R, SW-6), a calculated frequency < 10-6/yr (FRE-2, TA-4), or a low consequence (TA-4). The internal events sequences (13a2.1.11-E, 13a2.1.11-G, 13b.2.5-C, 13b.2.5-R) occur within confinement systems which would mitigate the consequences of each event. None of these accident sequences would result in any new accident sequence that is not already bounded by the accident sequences described in Chapter 13 of the FSAR.

Failure Probability Index Numbers (FPIN) = -4 or -5 Table 2.3.4-2 of the SSA describes the basis for the FPINs used in the SSA to estimate the failure probability on demand for preventive or mitigative controls. The table is based on the FPINs provided in Table A-10 of NUREG-1520 (Reference 6).

In the SSA, SHINE applied an FPIN = -4 to selected passive engineered controls (PECs) with a single control assigned an FPIN = -5.

The controls assigned FPIN = -4 are identified as having high design margin or as safe by design components. These characterizations are assigned based on engineering judgement that included consideration of the design parameters and the service conditions that are encountered, or in some instances by meeting the double contingency principle.

Table 13-7-2 provides a basis for applying an FPIN = -4 for these controls.

[

]SRI

c. Table 2.3.4-1 of the SSA describes the basis for the FFINs used in the SSA to estimate the frequency of occurrence for postulated accident scenarios. Table 2.3.4-2 of the SSA describes the basis for the FPINs used in the SSA to estimate the failure probability on Page 8 of 21

demand for preventive or mitigative controls. As described in Part b of this response, these tables were developed based on the FFINs and FPINs provided in Table A-9 and Table A-10 of NUREG-1520 (Reference 6), respectively.

In the SSA, five accident scenarios assign an FPIN -3 to enhanced specific administrative controls (SAC), and none are assigned an FFIN < -2. Table 13-7-3 identifies these SACs and provides a basis for assigning an FPIN -3.

Although SHINE is a first of a kind facility, the types of activities that are described by the SACs in Table 13-7-3 are not unique to the SHINE design or operations. This includes a variety of activities including solution sampling and verifications, lockout/tagout procedures, chemistry control programs, combustible material control, and housekeeping. Individually, these types of activities are considered to be routine planned operations and would be assigned an FPIN = -2 in accordance with Table 2.3.4-2 of the SSA. For the cases identified in Table 13-7-3, each of the SACs are combined actions which are incorporated into plant operating and maintenance procedures as independent steps. The combination of these steps for a specific accident sequence requires multiple sequential failures to defeat the intended preventive control. Therefore, an FPIN = -3 or -4 is assigned to these composite controls to represent the failure of two or more individual human actions.

The SACs derived from the SSA are incorporated directly into SHINE procedures and are clearly identified in the precautions and limitations section of the applicable procedures.

d. Section 5.3 of the SSA provides a general description of the programmatic administrative controls (i.e., management measures) that are applied to safety-related structures, systems, and components (SSCs) to provide reasonable assurance that they will perform their intended safety functions. The SHINE maintenance program, which includes inspection, testing, and maintenance, ensures that the safety-related SSCs are available and reliable when needed. The specific references of the inspection, testing, and maintenance program in Appendix A of the SSA are identified as defense-in-depth controls and not safety-related preventive or mitigative controls. It is further noted that the activity (e.g., surveillance of flow path for blockages in accident sequence 13a2.1.9-A, failure of TOGS) refers to a maintenance surveillance procedure to periodically confirm that the TOGS flow path is properly performing its function.

Page 9 of 21

Security-Related Information - Withheld from public disclosure under 10 CFR 2.390(d)

Table 13-7-1: Basis for Initiating Events Using FFIN = -5 Page 10 of 21

Security-Related Information - Withheld from public disclosure under 10 CFR 2.390(d)

Table 13-7-2: Basis for Controls Applying FPIN = -4 (Sheet 1 of 3)

Page 11 of 21

Security-Related Information - Withheld from public disclosure under 10 CFR 2.390(d)

Table 13-7-2: Basis for Controls Applying FPIN = -4 (Sheet 2 of 3)

Page 12 of 21

Security-Related Information - Withheld from public disclosure under 10 CFR 2.390(d)

Table 13-7-2: Basis for Controls Applying FPIN = -4 (Sheet 3 of 3)

Page 13 of 21

Security-Related Information - Withheld from public disclosure under 10 CFR 2.390(d)

Table 13-7-3: Bases for Specific Administrative Control with FPIN -3 Page 14 of 21

RAI 13-8 10 CFR 50.34(b) states that the FSAR shall include information that describes the facility, presents the design bases and the limits on its operation, and presents a safety analyses of the structures, systems and components and of the facility.

10 CFR 50.34(b)(2) states that a description and analyses of the structures, systems and components of the facility, with emphasis upon the performance requirements, the bases, with technical justification therefor, upon which such requirements have been established, and the evaluations required to show that safety functions will be accomplished.

10 CFR Part 50, paragraph 50.57(a)(3) states that an operating license may be issued upon finding that, There is reasonable assurance (i) that the activities authorized by the operating license can be conducted without endangering the health and safety of the public The ISG to NUREG-1537 states in Section 13a2 that the information in this chapter should achieve the objectives stated in this chapter of NUREG 1537, Part 1 by demonstrating that the applicant has considered all potential accidents at the reactor facility and adequately evaluated their consequences.

The ISG to NUREG-1537 states NRC staff have determined that the use of Integrated Safety Analysis methodologies as described in 10 CFR 70 and NUREG-1520, application of the radiological and chemical consequence and likelihood criteria contained in the performance requirements of 10 CFR 70.61, designation of items relied on for safety, and establishment of management measures are acceptable ways of demonstrating adequate safety for the medical isotopes production facility. Applicants may propose alternate accident analysis methodologies, alternate radiological and chemical consequence and likelihood criteria, alternate safety features, and alternate methods of assuring the availability and reliability of the safety features.

The SSA included consequence categories comparable to the performance requirements in 10 CFR 70.61(b)(1) - (4), 70.61(c)(1) - (2) and 70.61(c)(4). However, the SSA does not discuss a comparable consequence category as provided in performance requirement 70.61(c)(3),

i.e., a 24-hour release of radioactive material outside the restricted area in concentrations of 5000 times the values in Table 2 of Appendix B to Part 20. Furthermore, the SSA does not include credible accident sequences exceeding a comparable threshold. This threshold, as put forth in 70.61(c)(3), protects the public from releases that may result in intermediate consequences as described in Section 2.3.2 of the SSA.

Describe how the SSA considers a consequence category comparable to performance requirement 70.61(c)(3). Alternatively, justify its exclusion as a consequence category in the SSA.

SHINE Response SHINE has not committed to meeting the performance requirements in 10 CFR 70.61; however, the performance requirements were considered in the development of the SHINE Safety Criteria, which form the basis for the consequence category definitions used in the SSA.

The concentration values given in Columns 1 and 2 of Table 2 of Appendix B to 10 CFR Part 20 are equivalent to the radionuclide concentrations which, if inhaled or ingested continuously over the course of a year, would produce a total effective dose equivalent (TEDE) of 0.05 rem.

Page 15 of 21

Therefore, 5000 times this concentration for a 24-hour duration is equivalent to 0.685 rem, as shown in the equation below.

0.05 1 1 5000 0.685 24 1 365 24 In the development of the SHINE Safety Criteria, a more restrictive limit for acute dose to the public of 0.5 rem was initially chosen, versus the 5 rem threshold in 10 CFR 70.61(c)(2). The selection of this dose criteria restricted the total release allowed for the duration of the event to less than the dose that would result from a concentration of 5000 times the values in Table 2 of Appendix B to 10 CFR Part 20 for 24-hours. Therefore, it was bounded by the acute dose limit within the SHINE Safety Criteria.

As described in the SHINE Response to RAI 13-1 (Reference 4), SHINE has chosen to adopt, with justification, the accident dose criterion of 1 rem TEDE in the proposed rule described in 82 FR 15643 (Reference 7), which provides reasonable assurance of adequate protection of the public in the unlikely event of radiological incident.

As stated in the proposed rule, and consistent with the NRC Staffs stated position in RAI 13-1 (Reference 1), the accident dose criterion of 1 rem (0.01 Sv) TEDE is based on the Environmental Protection Agencys (EPA) Protection Action Guides (PAGs), which were published in EPA 400-R-92-001, Manual of Protective Action Guides and Protective Actions for Nuclear Incidents (Reference 8). The EPA PAGs are dose guidelines to support decisions that trigger protective actions such as staying indoors or evacuating to protect the public during a radiological incident. In the early phase (i.e., the beginning of the nuclear incident, which may last hours to days), the EPA PAG that recommends the protective action of sheltering-in-place or evacuation of the public to avoid inhalation of gases or particulates in an atmospheric plume and to minimize external radiation exposures, is 1 rem (0.01 Sv) to 5 rem (0.05 Sv). If the projected dose to an individual from an incident is less than 1 rem (0.01 Sv), then no protective action for the public is recommended. In light of this understanding of the early phase EPA PAG, the NRCs proposed accident dose criterion of 1 rem (0.01 Sv) TEDE for NPUFs, other than testing facilities would provide reasonable assurance of adequate protection of the public from unnecessary exposure to radiation.

While this revised limit for acute dose to the public for the duration of the accident of 1 rem no longer bounds the 24-hour performance requirement in 10 CFR 70.61(c)(3), application of the 1 rem TEDE accident dose criterion is sufficient to protect the public from radiological releases that may result in intermediate consequences.

RAI 13-9 10 CFR 50.34(b) states that the FSAR shall include information that describes the facility, presents the design bases and the limits on its operation, and presents a safety analyses of the structures, systems and components and of the facility.

10 CFR 50.34(b)(2) states that a description and analyses of the structures, systems and components of the facility, with emphasis upon the performance requirements, the bases, with technical justification therefor, upon which such requirements have been established, and the evaluations required to show that safety functions will be accomplished.

Page 16 of 21

The ISG to NUREG-1537 states in Section 6b.3 that the applicant has designed a facility that will provide adequate protection against criticality hazards related to the storage, handling, and processing of licensed materials. The facility design must adequately protect the health and safety of workers and the public during normal operations and credible accident conditions from the accidental criticality risks in the facility. It should also protect against facility conditions that could affect the safety of licensed materials and thus present an increased risk of criticality or radiation release.

The ISG to NUREG-1537 states NRC staff have determined that the use of Integrated Safety Analysis methodologies as described in 10 CFR 70 and NUREG-1520, application of the radiological and chemical consequence and likelihood criteria contained in the performance requirements of 10 CFR 70.61, designation of items relied on for safety, and establishment of management measures are acceptable ways of demonstrating adequate safety for the medical isotopes production facility. Applicants may propose alternate accident analysis methodologies, alternate radiological and chemical consequence and likelihood criteria, alternate safety features, and alternate methods of assuring the availability and reliability of the safety features.

a. FSAR Section 6b.3 states that the CSP is intended to meet the applicable criticality safety requirements of 10 CFR 70. Explicitly state which 10 CFR 70 requirements the applicant considers applicable and intends to meet. Explicitly state whether the CSP meets, not intends to meet, these requirements.

b. The accident analyses methodology contained in the SSA (see RAI 13-5) states the risk of criticality accidents must be limited by assuring that under normal and credible abnormal conditions, all nuclear processes within the RPF are subcritical, including use of an approved margin of subcriticality for safety. Additionally, FSAR Section 6b.3, Nuclear Criticality Safety in the RPF, suggests that the CSP is only applicable to activities performed in the RPF. However, SSA Summary Table 2.8-1, FSAR Accident Analyses for the Irradiation Facility, includes accident sequences in the Irradiation Facility (IF) that could result in inadvertent criticality. Describe how subcriticality is assured under normal and credible abnormal conditions for all nuclear processes performed within the IF, excluding the target solution vessels (TSVs). Specifically, describe how subcriticality is assured in the event of failure of a target solution vessel, TSV dump tank, and/or connected systems that can result in target solution migration into unintended or unanticipated locations.

SHINE Response

a. The nuclear criticality safety program meets the following criticality safety requirements of 10 CFR Part 70:

The criticality accident requirements of 10 CFR 70.24; The criticality reporting requirements of 10 CFR 70.50; 10 CFR 70.52; and 10 CFR 70, Appendix A; Application of 10 CFR 70.61(b) to criticality accidents, considering such accidents as high-consequence events; and Application of 10 CFR 70.61(d), ensuring that nuclear processes are subcritical under normal and credible abnormal conditions, including use of an approved subcritical margin of subcriticality and the use of preventative controls as the primary means of protection.

Page 17 of 21

SHINE has revised Section 6b.3 of the FSAR to explicitly identify the applicable criticality safety requirements of 10 CFR Part 70. A mark-up of the FSAR incorporating these changes is provided as Attachment 1.

b. SHINE applies the nuclear criticality safety program to the nuclear processes in the IF, excluding the target solution vessels. Subcriticality for the nuclear processes in the IF are evaluated and shown to be subcritical under normal and credible abnormal conditions, including migration of target solution into unanticipated locations. Evaluations were performed using the processes and procedures described in the nuclear criticality safety program and are documented in a nuclear criticality safety evaluation.

SHINE has revised Chapter 6 of the FSAR to provide a description of nuclear criticality safety in the IF. A mark-up of the FSAR incorporating these changes is provided as Attachment 1. SHINE has also revised Table 5.5.4 and Section 5.5.7 of the technical specifications to include the applicability of the nuclear criticality safety program to the IF. A mark-up of the technical specifications incorporating these changes is provided as Attachment 2. SHINE will provide a revision to the technical specifications incorporating the mark-up by February 28, 2021.

RAI 13-10 10 CFR 50.34(b)(6) requires the FSAR to include:

i. the applicants organizational structure, allocations or responsibilities and authorities, and personnel qualifications requirements, ii. managerial and administrative controls to be used to assure safe operation, iii. plans for preoperational testing and initial operations, iv. plans for conduct of normal operations, including maintenance, surveillance, and periodic testing of structures, systems and components,

v. plans for coping with emergencies, which shall include items specified in appendix E, vi. proposed technical specifications prepared in accordance with the requirements of 50.36.

This type of information forms the basis for safety programs that identify and manage the spectrum of hazards at the applicants facility including chemical hazards. Chemical safety is specifically discussed in the ISG augmenting NUREG-1537, Part 1, as follows:

Section 4b.4.2, Processing of Unirradiated Special Nuclear Material, states that the application should provide chemical accident prevention measures as appropriate Section 12.1.6, Production Facility Safety Program, states that the radioisotope production facility must have an established safety program that includes chemical hazards Section 13b.3, Analyses of Accidents with Hazardous Chemicals, states that the analyses of accidents for the production facility should include chemical hazards Section 14b, Radioisotope Production Facility Technical Specifications, states that the technical specifications should consider chemical hazards Technical Specification, Section 5.5.1, Nuclear Safety Program, states, in part, the following:

Page 18 of 21

The SHINE nuclear safety program documents and describes the methods used to minimize the probability and consequences of accidents resulting in radiological or chemical release.

Technical Specification, Section 5.5.8, Chemical Control, states the following:

The SHINE chemical control program ensures that on-site chemicals are stored and used appropriately to prevent undue risk to workers and the facility. The chemical control program implements the following activities, as required by the accident analysis:

1. Control of chemical quantities permitted in designated areas and processes;

2. Chemical labeling, storage and handling; and

3. Laboratory safe practices.

However, there is no description in the FSAR how the nuclear safety program or chemical control program identifies and manages chemical hazards.

Provide a description of the activities associated with the nuclear safety program and chemical control program that minimizes the probability and consequences of accidents resulting in a hazardous chemical release. Additionally, provide an explanation regarding the relationship between the nuclear safety program and the chemical control program as it relates to the identification and management of chemical hazards under NRCs regulatory jurisdiction.

SHINE Response The nuclear safety program (NSP) and chemical control program (CCP) are used to identify and manage hazards at the SHINE facility.

The CCP is used to control chemical quantities permitted in designated areas and processes; chemical labeling, storage, and handling; and laboratory safe practices. Hazardous chemicals that are in-process that physically or chemically interact with licensed material are excluded from the requirements of the CCP. These chemical types and quantities are evaluated under the NSP.

The Chemistry Manager is responsible for the implementation, maintenance, and revision of the CCP.

Limiting permissible quantities of hazardous chemicals and verifying safe storage of chemicals is used to manage potential hazards. The maximum amount of hazardous chemicals that are allowed to be present in the three chemical storage areas for the SHINE facility (i.e., the main production facility chemical storage room, the storage building, and the main production facility laboratories) are identified within the CCP. The acceptability of these chemicals and maximum quantities are evaluated by hazard assessment or analysis of potential spill or release scenarios. Quantities of stored chemical inventories and a safety verification for proper storage of the chemicals (e.g., verification that incompatible chemicals are segregated) is confirmed via periodic walkdown of the storage locations by designated chemistry department personnel.

Requirements related to chemical labeling are also identified in the CCP. Hazardous chemicals in the SHINE facility are labeled, tagged, or marked with the identity of the chemical and appropriate hazard warnings that provide employees with information regarding the physical and health hazards of the chemical. Appropriate labeling, in accordance with Occupational Page 19 of 21

Safety and Health Administration (OSHA) and chemical manufacturer safety data sheet (SDS) requirements, promotes the appropriate storage, handling and use of chemicals to prevent potential chemical hazards.

Safe laboratory practices are also prescribed by the CCP in order to prevent or manage potential chemical hazards. These practices include the implementation of procedures for the safe handling, storage, and labeling of chemicals in accordance with OSHA and SDS requirements and the availability and proper maintenance of safety and other protective equipment.

The NSP is used to identify and manage hazards associated with in-process chemicals that physically or chemically interact with licensed material. As part of the NSP, process information for the SHINE facility is used to conduct a complete and thorough safety analysis. The NSP and sub-tier procedures set forth the process to develop and maintain process safety information to support development and ongoing maintenance of a comprehensive safety analysis. These procedures include interfaces with the SHINE configuration management program to ensure that facility design changes are properly coordinated with the SSA.

The safety analysis process identifies the hazards and potential accident sequences associated with the possession and processing of licensed nuclear materials including the engineering and administrative controls used to ensure the safe handling of the licensed materials. The results of the safety analysis process are documented as the SSA and maintained at a level of detail commensurate with the complexity of the facility and individual processes to identify hazards, including chemical hazards of licensed material and hazardous chemicals produced from licensed material, as well as potential accident sequences, consequence and likelihood of occurrence of the potential accident sequences, and each safety-related structure, system, or component, or specific administrative control relied upon to support compliance with SHINE facility performance requirements.

The NSP additionally identifies the CCP as one of the programmatic administrative controls required to provide reasonable assurance of conformance with the SHINE-specific performance criteria described in the FSAR.

Page 20 of 21

References

1. NRC letter to SHINE Medical Technologies, LLC, Issuance of Request for Additional Information Related to the SHINE Medical Technologies, LLC Operating License Application (EPID No. L-2019-NEW-0004), dated November 10, 2020

2. SHINE Medical Technologies, LLC letter to the NRC, SHINE Medical Technologies, LLC Application for an Operating License, dated July 17, 2019 (ML19211C143)

3. American National Standards Institute/American Nuclear Society, Nuclear Criticality Safety in Operations with Fissionable Materials Outside Reactors, ANSI/ANS-8.1-2014, La Grange Park, IL

4. SHINE Medical Technologies, LLC letter to NRC, SHINE Medical Technologies, LLC Operating License Application Supplement No. 5 and Response to Request for Additional Information, dated December 10, 2020

5. SHINE Medical Technologies, LLC letter to NRC, Request for Exemption from Criticality Accident Alarm System Monitoring Requirements for the SHINE Irradiation Unit Cells and Material Staging Building, dated January 29, 2021

6. U.S. Nuclear Regulatory Commission, Standard Review Plan for Fuel Cycle Facilities License Applications, NUREG-1520, Revision 2, June 2015

7. U.S. Nuclear Regulatory Commission, Non-Power Production and Utilization Facility License Renewal, Federal Register, Vol. 82, No. 60, March 30, 2017, pp.15643-15660

8. U.S. Environmental Protection Agency, Manual of Protective Action Guides and Protective Actions for Nuclear Incidents, EPA 400-R-92-001, May 1992 Page 21 of 21

ENCLOSURE 3 ATTACHMENT 1 SHINE MEDICAL TECHNOLOGIES, LLC SHINE MEDICAL TECHNOLOGIES, LLC OPERATING LICENSE APPLICATION RESPONSE TO REQUEST FOR ADDITIONAL INFORMATION FINAL SAFETY ANALYSIS REPORT CHANGES (MARK-UP) 32 pages follow

Chapter 3 - Design of Structures, Systems, and Components Design Criteria Table 3.1 SHINE Design Criteria (Sheet 11 of 11)

Criterion 36 -Target solution storage and handling and radioactivity control The target solution storage and handling, radioactive waste, and other systems that contain radioactivity are designed to assure adequate safety under normal and postulated accident conditions. These systems are designed with:

1) capability to permit appropriate periodic inspection and testing of safety-related components,

2) suitable shielding for radiation protection,

3) appropriate confinement and filtering systems, and

4) residual heat removal capability having reliability and testability that reflects the importance of decay heat and other residual heat removal.

Criterion 37 - Criticality control in the radioisotope production facility Criticality in the radioisotope production facility is prevented by physical systems or processes and the use of administrative controls.

Use of geometrically safe configurations is preferred. Control of criticality adheres to the double contingency principle.

A criticality accident alarm system to detect and alert facility personnel of an inadvertent criticality is provided.

Criterion 38 - Monitoring radioactivity releases Means are provided for monitoring the primary confinement boundary, hot cell, and glovebox atmospheres to detect potential leakage of gaseous or other airborne radioactive material. Potential effluent discharge paths and the plant environs are monitored for radioactivity that may be released from normal operations, including anticipated transients, and from postulated accidents.

Criterion 39 - Hydrogen mitigation Systems to control the buildup of hydrogen that is released into the primary system boundary and tanks or other volumes that contain fission products and produce significant quantities of hydrogen are provided to ensure that the integrity of the system and confinement boundaries are maintained.

SHINE Medical Technologies 3.1-17 Rev. 4

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)

Chapter 4 - Irradiation Unit and Radioisotope Production Facility Description Subcritical Assembly 4a2.2.2 REACTIVITY CONTROL MECHANISMS There are six principal variables affecting reactivity that are controlled by the SHINE design.

Three, once established during filling of the TSV, are not significantly altered during IU operation:

• Uranium concentration in solution

• Uranium enrichment

• TSV fill volume Three factors that are controlled to ensure that they remain stable during operational modes are:

• Neutron driver source strength

• Target solution headspace pressure

• PCLS cooling water supply temperature Note that water holdup by TOGS affects reactivity but is not a controlled variable. The design of TOGS minimizes this reactivity effect to the extent practical.

A detailed discussion of the systems used to monitor reactivity is provided in Section 7.3 and Section 7.4.

During TSV operation, the TSV dump valves can be opened to gravity drain the entire contents of the TSV to the TSV dump tank. The TSV dump tank has been designed to be criticality-safefavorable geometry for the most reactive credible uranium concentrations, including various upset conditions, and has sufficient capacity to hold the entire contents of the target solution hold tank.

The concentration of uranium in solution is measured and independently verified to ensure that concentration values remain within the limits prescribed by SHINE. Uranium concentration is prepared and measured to ensure it is within 1 percent of desired concentration. Sampling is performed after preparation of a new batch and after making adjustments to an existing batch, prior to transferring the batch to the TSV. The SHINE system provides a predictable and precisely controlled system response as the TSV fill volume rises above a fill height of approximately [ ]PROP/ECI. Target solution characteristics and allowable operating ranges are discussed in Subsection 4a2.2.1.

The uranium enrichment is verified when received, and no means are provided to increase the enrichment in the process design. The allowable operating ranges are identified in Subsection 4a2.2.1.

A number of design features are provided to establish TSV fill volumes:

• Fixed TSV configuration The volume and geometry of the TSV are known and fixed.

• Level instrumentation Instrumentation provides an inferred measurement of the TSV fill volume. Level will be correlated to volume and verified in startup testing.

SHINE Medical Technologies 4a2.2-7 Rev. 3

Chapter 4 - Irradiation Unit and Radioisotope Production Facility Description Nuclear Design the primary system boundary (PSB) should the safety parameter trip points be exceeded, including high source range neutron flux.

In addition to TSV fill volumes and reactivity, the temperature of the target solution is monitored via the temperature of the PCLS water. Due to the low decay power of the target solution, its temperature is approximately equal to the cooling water temperature during startup mode. Due to the operating characteristics of the SHINE system, a decrease in the temperature of the target solution results in an increase in system reactivity. Excessive cooldown of the target solution during startup is prevented by the TRPS initiating an IU Cell Safety Actuation on low PCLS temperature and high source range neutron flux. The IU Cell Safety Actuation results in drainage of the target solution in the TSV to the TSV dump tank, which maintains the keff below 0.954 for the most reactive credible uranium concentration.

If at any time during the fill process neutron flux, TSV fill volume, or target solution temperatures are determined to be outside allowable parameters, operators will transfer the entire contents of the TSV to the TSV dump tank via gravity by opening the TSV dump valves. Due to the location of the TSV dump tank in the light water pool, decay heat removal requirements from the target solution are satisfied.

Mode 2: Irradiation Mode After filling the TSV with target solution, the TSV is isolated from the TSV fill lift tank and the target solution hold tank by closing two redundant (in series) fill valves. During Mode 2, there is no capability to increase reactivity by adding target solution to the TSV. Given the aqueous target solution negative void and temperature coefficients, reactivity decreases as the irradiation process begins. Furthermore, any increase in operating power levels beyond normal operating conditions results in a temperature increase and a corresponding increase in the void fraction of the target solution itself, reducing the power level.

Testing has demonstrated that the pH of the uranyl sulfate remains stable during full power operation. The TSV, TSV dump tank, and TOGS are operated as a closed system, except for gas adjustments in TOGS for pressure and oxygen concentration control, to prevent an inadvertent addition of material that could affect reactivity or system chemistry. Malfunctions in the TOGS gas adjustments are evaluated for potential reactivity effects in the accident analysis discussed in Subsection 13a2.1.2. The introduction of water into the system as a result of the failure of the pressure boundary is also analyzed in Subsection 13a2.1.2.

During irradiation of the subcritical assembly, the TOGS is used to purge radiolytic hydrogen from the headspace in the TSV. Section 4a2.8 provides a detailed discussion of the TOGS. The PCLS has the capability to remove approximately 137.5 kilowatts (kW) (469,000 British thermal units per hour [Btu/hr]) of heat from the TSV during irradiation. Cooling water is supplied to the external surfaces of the TSV and neutron multiplier at approximately 68°F (20°C) and exits the TSV and neutron multiplier at a maximum temperature of approximately 77°F (25°C). The TRPS monitors the PCLS during irradiation for low flow, high temperature, and low temperature and initiates an IU Cell Safety Actuation if the limits are exceeded.

The light water pool is not directly cooled. The light water pool provides a large thermal mass that absorbs heat and passively rejects heat to the PCLS-cooled components submerged in the pool and the surrounding concrete and air in the IU cell. The operating temperature of the pool ranges between 50°F and 95°F (10°C and 35°C).

SHINE Medical Technologies 4a2.6-3 Rev. 3

Chapter 4 - Irradiation Unit and Radioisotope Production Facility Description Nuclear Design The difference between the weighted average keff and 1 is the bias. The bias is calculated using the methodology in Section 2.4.1 of NUREG/CR-6698, Guide for Validation of Nuclear Criticality Safety Calculational Methodology (NRC, 2001b).

For conservatism, positive bias (i.e., where MCNP is found on average to over-predict keff) is assumed to be zero for the purposes of determining TSV dump tank and TOGS reactivity.

Bias uncertainty is calculated based on the pooled variance of the data used to calculate the bias and a one-sided tolerance factor. The bias uncertainty is calculated using the methodology described in Section 2.4.1 of NUREG/CR-6698 (NRC, 2001b).

MCNP statistical uncertainty is accounted for in the calculation by adding two times the standard deviation in keff reported by MCNP (keff,MCNP) to the keff reported by MCNP (keff,MCNP).

The TSV dump tank and TOGS are designed to a keff value of less than 0.954 at the most credible reactive uranium concentration and at cold conditions. Reactivity analysis for the TSV dump tank and TOGS satisfies the following inequality:

k eff, MCNP + 2 keff, MCNP K L - 0.06 - A0A Where:

• KL is the weighted single-sided lower tolerance limit.

• A0A is an additional margin of subcriticality that may be necessary as a result of extensions to the area of applicability.

Both of these values are determined following the methodology of Section 2.4.4 of NUREG/CR-6698 (NRC, 2001b). KL includes the effects of bias and bias uncertainty.

The methodology ensures with a high degree of confidence that the target solution is safely shut down by appropriately accounting for uncertainty in MCNP and providing margin to criticality.

See Subsection 4a2.6.3.4 for detailed discussion on TSV dump tank subcriticality.

See Section 4a2.8 for detailed discussion on TOGS subcriticality.

4a2.6.2.7 Trip Requirements to Limit Reactivity in Mode 1 In conjunction with the additional engineered and administrative controls described below, the limiting trip setpoint for TRPS high source range neutron flux signal is designed such that during normal operation and anticipated transients, the subcritical assembly keff remains below 1.0.

Anticipated transients in the subcritical assembly are described in Subsection 4a2.6.3.3.

Postulated accidents that could add reactivity to the system are described in Subsection 13a2.1.2.

The trip setpoint is set to ensure a trip occurs prior to exceeding a percentage above the normal startup flux as measured by the neutron detection system, per the equation below:

SHINE Medical Technologies 4a2.6-25 Rev. 3

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)

Chapter 4 - Irradiation Unit and Radioisotope Production Facility Description Nuclear Design methodology are accounted for are discussed in Subsection 4a2.6.2.6.1. The methodology ensures that keff in the dump tank remains less than 0.954.

The TSV dump tank is analyzed to remain safely shutdown for the most reactive credible uranium concentration. The most reactive uranium concentration was found by calculating keff for a range of uranium concentrations that spanned the peak reactivity (approximately 1000 gU/L).

Then, SHINE selected the concentration that resulted in the highest reactivity and used this concentration for calculating dump tank keff.

The most reactive uranium concentration results in an increase of approximately

[ ]PROP/ECI relative to the nominal concentration. This methodology ensures that the TSV dump tank will be subcritical at any uranium concentration, which provides very high confidence in shutdown margin for the range of normal conditions and accident scenarios. This significantly increases margins when the system contains expected uranium concentrations, as specified in Table 4a2.2-2.

The TSV dump tank reactivity increases as the target solution temperature cools down from its operating temperature of approximately 118°F (48°C) to the light water pool temperature of approximately 68°F (20°C). Dump tank reactivity is calculated assuming the target solution has cooled down and achieved equilibrium with the pool.

Abnormal conditions were also evaluated within the TSV dump tank, including a design basis seismic event, excessive corrosion, overfilling, salt accumulation, and water intrusion. The increases in keff due to the single abnormal conditions analyzed do not result in keff values exceeding 0.954. Therefore, the dump tank is able to maintain the solution in a subcritical state when undergoing these analyzed single abnormal conditions.

Normal electrical power is not required to shut down the subcritical assembly or maintain it in a safe shutdown condition. After a loss of normal electrical power, the target solution is allowed to remain in the TSV for up to 3 minutes, with the dump valves receiving power from the uninterruptible electrical power supply system (UPSS). After this period of time, the TSV dump valves are automatically opened by TRPS disconnecting power to the valves, resulting in a dump of the solution to the TSV dump tank. The TSV dump tank does not require active cooling given the low decay heat loading of the target solution. Rejection of decay heat is achieved through passive convection with the light water pool.

Safety-related electrical power from the UPSS is required by the TOGS for 5 minutes following a loss of off-site power in order to maintain hydrogen concentrations at acceptable levels in the PSB. See Section 4a2.8.

Transient poisons, such as xenon, are not credited in the reactivity analysis.

Verification of the keff and shutdown margin in the TSV dump tank is not required. This approach to safety is acceptable given the largesubcritical margin to critical of 0.056 k, the consideration of relevant uncertainties in the calculation process, and the consideration of abnormal conditions to which the vessel may be exposed while still maintaining the subcritical margin to critical of 0.05 k.

The subcritical assembly is capable of being safely shutdown for any postulated reactivity loading in the TSV. In the TSV dump tank, the target solution is maintained below a keff of 0.954 SHINE Medical Technologies 4a2.6-37 Rev. 3

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)

Chapter 4 - Irradiation Unit and Radioisotope Production Facility Description Nuclear Design after cooldown for the most reactive credible uranium concentrations for normal and abnormal conditions. Combined with the analyses described in Subsection 4a2.6.3.7, the target solution can be shut down safely and maintained in a safe shutdown condition.

4a2.6.3.5 Limiting Core Configuration The limiting core configuration is that core that produces the highest power density possible for the target solution. This power density is then compared to power density limits determined from historical stability data and solution chemistry effects to ensure acceptability.

Power Density Limits The power density is important for ensuring thermal hydraulic stability. If the average power density is too high, the bubbles generated through radiolysis can cause surface effects such as sloshing from turbulent liquid contacting the vessel walls. Section 3.2 of IAEA-TECDOC-1601 (IAEA, 2008) summarizes historical data on power density instabilities. Based on experiments conducted at historic aqueous homogeneous reactor (AHR) facilities (Russian ARGUS facility and French SILENE facility), steady state, stable core conditions could be sustained at power densities below approximately 1.8 thermal kilowatts/liter (kW/L) (BNL, 2010; IAEA, 2008; Barbry Francis, 2007). The SHINE system is designed to ensure that power density is maintained less than [ ]PROP/ECI. However, the chemical stability data below provides additional restriction on the limiting power densities.

Power density is a key parameter for chemical stability. Uranyl peroxide is known to precipitate out of uranyl sulfate solution under certain conditions of irradiation, due to the presence of hydrogen peroxide formed from radiolysis effects. The formation of uranium precipitates is dependent on the rates of hydrogen peroxide production, the peroxide solubility, and the rate of decomposition. The key factors influencing these parameters include the solution chemistry (including pH and catalysts), temperature, and power density. SHINE has evaluated the available literature and found that in operating within the power density limits presented in Table 4a2.6-9 and the other operating limits of Table 4a2.2-2, formation of significant uranyl peroxide precipitates is not expected. Supporting literature is from existing operating reactor data and experimental investigations. The average steady-state power density limit to prevent precipitation is determined to be [ ]PROP/ECI at cold conditions of 68°F (20°C). The transient power density limit is determined to be [ ]PROP/ECI at cold conditions of 68°F (20°C), the duration of which is limited by the high time-average neutron flux trip within the TRPS.

The operational limits related to preventing uranyl peroxide precipitation include a correlation for the steady-state power density as a function of temperature, a correlation for the minimum concentration of [ ]PROP/ECI catalyst required as a function of pH, and a transient power density limit.

Peroxide decomposition rates are highly dependent on temperature and catalyst concentrations, while peroxide solubility is highly dependent on the pH of the solution. Uranium concentration also has a lesser effect on peroxide solubility but a compensating effect in the rate of hydrogen production, as a result the power density limits are independent of uranium concentration over the operating range.

For higher pH in the target solution, the peroxide solubility decreases, requiring an increase in the catalyst concentration to achieve a corresponding increase in the peroxide decomposition SHINE Medical Technologies 4a2.6-38 Rev. 3

Chapter 4 - Irradiation Unit and Radioisotope Production Facility Description Nuclear Design The dump system consists of two completely independent flow paths between the TSV and the TSV dump tank. The physical design connects the flow paths to different parts of the TSV and dump tank. Each path consists of a dump line from the TSV to the TSV dump tank, and a dump valve to control the drainage of the target solution into the TSV dump tank. Two completely independent overflow lines are also present, which serve as vent lines from the TSV dump tank to the TSV to equalize gas pressures during solution dumps.

The dump valves are highly reliable fail-open units designed for service in the environmental conditions present. Both valves are actuated by isolating power to them, which is a method resistant to common mode failures. Both TRPS and PICS can independently open the TSV dump valves. The PICS and TRPS are configured in series configuration for the TSV dump valve control. When the TRPS output is energized, the PICS has control of the TSV dump valves independent from the TRPS. If either system de-energizes the output, the dump valves open.

Each dump valve is equipped with a valve position indicator, which immediately alerts the operator of a failure of the valve to respond. Any failure of a valve to respond to a commanded signal will be thoroughly investigated and corrected, as part of the corrective action program, to ensure the valves can be relied upon when required.

Valves are maintained appropriately to ensure high reliability. Design considerations allow for underwater maintenance of the valves, when needed. The valves are designed for a lifetime of 30 years.

There is internal redundancy within the TRPS such that a single failure does not result in a spurious actuation. Either TRPS or PICS can open the dump valves.

As the dump valves are actuated with each irradiation cycle, they undergo regular normal cycling. This frequent actuation provides data that could indicate degraded performance prior to failure to perform their safety function. A decrease in drain rate indicates potential for dump line blockage, overflow line blockage, or valve failure to fully open. An increase in valve opening time indicates potential future valve failure. SHINE will monitor drain rates and opening time at least yearly to ensure early indication of failures are identified.

Given the high valve reliability, automatic valve opening on control system or electrical power failure, and ability to frequently actuate and trend performance of the dump valves, no additional shutdown mechanisms are required for ensuring target solution can be shut down safely.

The target solution is maintained in a criticality-safefavorable geometry shutdown condition (keff less than 0.954) in locations outside the TSV by passive engineered controls. TRPS IU Cell Safety Actuations also lead to de-energizing the HVPS of the NDAS, which eliminates fusion neutron production and terminates the fission process within the subcritical assembly.

The TSV dump valves and TPS provide a high degree of confidence in the ability to drain the target solution to a safe shutdown configuration.

4a2.6.3.8 Technical Specifications Certain material in this subsection provides information that is used in the technical specifications. This includes limiting conditions for operation, setpoints, design features, and SHINE Medical Technologies 4a2.6-41 Rev. 3

Chapter 4 - Irradiation Unit and Radioisotope Production Facility Description Gas Management System There is no significant nitrogen oxide (NOx) gas present in the off-gas; therefore, there is no postulated accident scenario resulting in the release or accumulation of NOx gas. The SHINE target solution is a sulfuric/sulfate system. Nitric acid is not used to prepare the target solution or to adjust the target solution chemistry.

Additionally, no significant amount of SOx gas is present in the off-gas. Sulfuric/sulfate was chosen as the acid/counter ion system because of the stability it maintains in the presence of radiation. Furthermore, the vapor pressure of sulfuric acid is known to be extremely low, so very little SOx gases will leave the liquid phase. Therefore, it is not necessary to consider scenarios related to SOx gas in the abnormal conditions of the TOGS.

Pressure safety valves are connected to the PSB piping to passively prevent an over-pressurization of the PSB, which may cause structural damage to the IU or malfunction of TOGS.

The setpoint of the pressure safety valves does not exceed the design pressure of the PSB components. The pressure safety valves are connected to the PVVS. PVVS is capable of receiving the calculated maximum gas relieving rate from TOGS. The relief gas is then processed through the PVVS filters, guard beds, and carbon delay beds to remove particulates, remove iodine, and sufficiently delay noble gas release. This process ensures that the radioactive release and dose requirements of 10 CFR 20 are met. See Subsection 9b.6.1 for a discussion on the PVVS.

Transients can occur in the nuclear system due to pressure fluctuations, neutron driver interruptions, cooling system malfunctions, and other causes. See Subsection 4a2.6.1 for kinetic behavior of the TSV. Variations in TSV power lead to variations in hydrogen and oxygen generation rates. TOGS is designed to handle transient and accident hydrogen generation rates while maintaining hydrogen concentrations in the PSB below those that could cause damage to the PSB.

SHINE has considered the long-term accumulation of fissionable material entrained in the system. Long term accumulation of material could lead to flow blockages and subsequent system malfunction, or it could present a hazard for inadvertent criticality. Inadvertent criticality is discussed below. Monitoring is performed for flow blockages due to long term accumulation of material by periodically trending system flow rates. Long term accumulation would result in changes in pressure drops in the system, especially in the demisters and catalytic recombiner beds.

4a2.8.5.1 Protection Against Inadvertent Criticality The potential exists for fissile material from the TSV, such as uranium solution droplets, to enter TOGS. Water leakage from the light water pool could cause flooding of the target solution into TOGS. Droplet carryover from TOGS could lead to uranium entrainment in TOGS. Fissile material, without proper design, could lead to inadvertent criticality in TOGS.

To prevent the potential for an inadvertent criticality in TOGS, the sections of TOGS that form a portion of the PSB are designed to be geometrically favorable if fully flooded. Analyses are performed in accordance with the methodology described in Subsection 4a2.6.2.6.1. The TOGS keff analysis is evaluated at the most reactive credible uranium concentration, which ensures the system will be subcritical at any uranium concentration. As discussed in Subsection 4a2.6.2.6.1, TOGS is designed to a keff value of less than 0.954 at the most reactive credible uranium concentration and at cold conditions.

SHINE Medical Technologies 4a2.8-4 Rev. 4

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)

Chapter 4 - Irradiation Unit and Radioisotope Production Facility Description Gas Management System Since TOGS is designed to be at a keff below 0.954 even if fully flooded at the most reactive credible uranium concentration, TOGS is protected against inadvertent criticality.

4a2.8.6 RADIATION AND HYDROGEN CONCENTRATION CONTROL/MONITORING The TOGS is connected to the vacuum transfer system (VTS) for purging between irradiations, as needed. The VTS discharges collected TOGS gases to the PVVS, where they are treated through the PVVS filters, guard beds, and carbon delay beds. Purging the off-gas to the VTS allows SHINE to decrease gaseous fission products contained within the system. TOGS is purged to VTS prior to maintenance operations in which lower dose rates in and surrounding the TOGS equipment are desired. The TOGS components are designed and shielded to limit personnel exposure to radiation.

Hydrogen concentration monitoring instrumentation is included to measure the concentration of hydrogen in the TOGS piping. The TOGS is designed to maintain hydrogen concentrations at or less than 2 percent during normal operation.

If the hydrogen concentration exceeds 2.5 percent by volume, an alarm alerts the operator to take action. If the neutron driver is shut down, the blowers and recombiners remain active to circulate and recombine the hydrogen and oxygen in the off-gas.

The alarm setpoint of 2.5 percent is slightly higher than normal operating conditions to provide advanced warning of abnormal conditions to the operator prior to reaching the operating limit of 3 percent while not resulting in excessive alarms that distract the operators in the control room.

The hydrogen concentration limit of 3.0 percent provides sufficient margin to hydrogen concentrations that could result in a deflagration pressure exceeding 65 psia should the failure of a single active component occur. A minimum TOGS mainstream flow of [ ]PROP/ECI PROP/ECI and a TOGS dump tank flow of [ ] is required to ensure hydrogen can be maintained below this limit.

The worst postulated single active failure is that of the blower ventilating the TSV dump tank. The TSV reactivity protection system (TRPS) detects loss of flow and initiates an IU Cell Safety Actuation and an IU Cell Nitrogen Purge. This opens the TSV dump valves and de-energizes the high voltage power supply to the neutron driver, rapidly reducing hydrogen production.

Conservatively assuming that the TOGS and TSV were uniformly at 3.0 percent hydrogen concentration prior to the trip, the peak hydrogen concentration has been calculated. This peak hydrogen concentration results in deflagration pressures less than 65 psia assuming a deflagration occurred immediately at the peak concentration.

Oxygen concentration monitoring instrumentation is also included to measure the concentration of oxygen in the TOGS piping. Oxygen holdup in the target solution can lead to non-stoichiometric releases of hydrogen and oxygen from the solution. A minimum oxygen concentration of 10 percent is required to ensure hydrogen recombination in the TSV off-gas recombiner occurs satisfactorily.

TOGS condenser demister outlet temperature sensors monitor the health of the condenser demisters. A temperature over 25°C is indicative of a failure of the condenser demister, which could lead to increased water holdup in TOGS and potential reduction in hydrogen recombination. In the event of a failure, the TRPS would initiate an IU Cell Nitrogen Purge.

SHINE Medical Technologies 4a2.8-5 Rev. 4

Chapter 4 - Irradiation Unit and Special Nuclear Material Radioisotope Production Facility Description Processing and Storage 4b.4 SPECIAL NUCLEAR MATERIAL PROCESSING AND STORAGE Special nuclear material (SNM) is used throughout the radioisotope production facility (RPF) radiologically controlled area (RCA) in both unirradiated and irradiated forms for the production of medical isotopes.

Molybdenum (Mo) is extracted from the irradiated SNM in the Mo extraction and purification system (MEPS) and iodine (I) is extracted from the irradiated SNM in the iodine and xenon purification and packaging (IXP) system as described in Section 4b.3. Following isotope extraction, the target solution is directed to one of the target solution hold tanks, the target solution storage tanks, or the radioactive liquid waste storage (RLWS) system. In the target solution hold tanks, sampling and adjustments to chemistry are performed as required. Target solution is stored in favorable geometry tanks that are designed to remain subcritical.

Subsection 4b.4.1 discusses the processing of irradiated SNM.

The following are the major SNM processing steps:

• Dissolve uranium oxide in sulfuric acid to form target solution.

• Extract radioisotopes from irradiated target solution.

• Store and transport irradiated target solution, allowing for in-process adjustments.

The facility receives and stores new shipments of uranium metal and uranium oxide. Uranium metal is converted to uranium oxide in the uranium receipt and storage system (URSS). Uranium oxide is used to prepare unirradiated target solution. Uranium oxide is stored in uranium oxide storage canisters and is transported from the URSS to the target solution preparation system (TSPS) area. Subsection 4b.4.2 discusses the preparation of the target solution.

Shipments of SNM are received at the facility in solid form. The shipments consist of low enriched uranium (LEU), uranium metal or uranium oxide enriched to 19.75 +/- 0.2 percent uranium-235 (U-235). The SNM is shipped in approved shipping containers (a general-purpose Type B fissile material shipping container). The SNM is removed from the shipping containers and stored in uranium metal storage canisters or uranium oxide storage canisters in a favorable configuration storage rack. Subsection 4b.4.2 provides more detail on the receipt and storage of unirradiated SNM.

The RPF contains uranium in multiple forms: uranium metal, uranium oxide, and uranyl sulfate. A small amount of plutonium is generated during the irradiation cycle, as described in Section 4a2.6, and is transferred to the RPF in aqueous form within the target solution.

Table 4b.4-1 provides the total inventory of SNM in the RCA. Table 4b.4-2 provides the physical and chemical forms of SNM within RPF processes. Refer to Table 4a2.2-1 for the target solution batch uranium inventory. See Table 4a2.6-2 for the target solution batch plutonium inventory.

Refer to Section 4b.1 for maximum SNM inventory within each RPF process system.

The SNM processing and storage systems prevent inadvertent criticality through criticality safety controls applied to the design of tanks, process equipment, storage containers, and other components that may handle the SNM, as well as through other controls detailed in the nuclear criticality safety evaluations, as described in Section 6b.3.

Favorable geometry tanks are designed to be subcritical at the most reactive credible uranium concentration, [

SHINE Medical Technologies 4b.4-1 Rev. 3

Chapter 6 - Engineered Safety Features Nuclear Criticality Safety in the Irradiation Facility 6a2.3 NUCLEAR CRITICALITY SAFETY IN THE IRRADIATION FACILITY SHINE maintains a nuclear criticality safety program (CSP) that complies with applicable American National Standards Institute/American Nuclear Society (ANSI/ANS) standards, as endorsed by Regulatory Guide (RG) 3.71, Revision 3, Nuclear Criticality Safety Standards for Fuels and Material Facilities (USNRC, 2018). A description of the CSP is provided in Section 6b.3.

Use, handling, and storage of fissile material in the irradiation facility (IF) is evaluated in accordance with the CSP, with the exception of the target solution vessel (TSV).

6a2.3.1 CRITICALITY SAFETY CONTROLS Criteria used to select controls and the use of controlled parameters are described in Section 6b.3.2.

6a2.3.1.1 Subcritical Assembly System A detailed description of the subcritical assembly system (SCAS) is provided in Section 4a2.2.

The system is designed to maintain fissile material in a subcritical state during irradiation and to safely store the target solution following irradiation in the TSV dump tank.

Criticality Safety Basis The nuclear criticality safety evaluation (NCSE) for the SCAS shows that the evaluated sections of the process will remain subcritical under normal and credible abnormal conditions. The TSV is designed to operate at a higher keff for the production of medical isotopes and is not considered as part of the NCSE. The effects of reactivity changes in the SCAS are provided in Subsections 4a2.6.3.3 and 4a2.6.3.4.

The remaining portions of the SCAS are safe-by-design. The TSV dump tank is shown to remain under the upper subcritical limit under the most reactive credible conditions of concentration, reflection, and corrosion. Piping which contains fissile solutions between the TSV and the TSV dump tank is shown to be within the evaluated single parameters limits.

6a2.3.1.2 Target Solution Vessel Off-Gas System A detailed description of the TSV off-gas system (TOGS) is provided in Section 4a2.8. The major components of the system are condenser demisters, a zeolite bed, blowers, hydrogen recombiners, recombiner condensers, a recombiner demister, and a vacuum tank. Components of TOGS are located in the irradiation unit (IU) cell and the adjacent TOGS cell. Components in the IU cell are the vacuum tank, condenser demisters, recombiner demister, and associated piping. The remaining components are arranged on a skid in the TOGS cell.

The system is designed to maintain the hydrogen concentration in the primary system boundary below the lower flammability limit by circulating gas from the TSV during irradiation and from the TSV dump tank during cool-down through its demisters, zeolite bed, and recombiner. The TOGS operates at slightly negative pressure. Under normal conditions, the system does not contain significant quantities of fissile material.

SHINE Medical Technologies 6a2.3-1 Rev. 0

Chapter 6 - Engineered Safety Features Nuclear Criticality Safety in the Irradiation Facility Criticality Safety Basis The NCSE for the TOGS shows that the entire system will remain subcritical under normal and credible abnormal conditions.

Under abnormal conditions, it is credible that significant quantities of fissile material enter the TOGS. Each of the individual components located in the IU cell and the skid arrangement of components in the TOGS cell has favorable geometry under the most reactive credible conditions.

Additional criticality safety considerations of the TOGS are provided in Subsection 4a2.8.5.1.

6a2.3.2 CRITICALITY ACCIDENT ALARM SYSTEM The IF utilizes a criticality accident alarm system (CAAS) to detect a criticality event in the areas in which special nuclear material is used, handled, or stored outside of the IU cells. Coverage of special nuclear material storage in the TSV dump tanks and interconnecting piping is provided by the neutron flux detection system (NFDS) and level instrumentation in the TSV dump tank, which provides indication of abnormal conditions in the IU cells.

A description of the CAAS is provided in Subsection 6b.3.3.

SHINE Medical Technologies 6a2.3-2 Rev. 0

Chapter 6 - Engineered Safety Features References 6a

2.4 REFERENCES

NoneUSNRC, 2018. Nuclear Criticality Safety Standards for Fuels and Material Facilities, Regulatory Guide 3.71, Revision 3, 2018.

SHINE Medical Technologies 6a2.4-1 Rev. 1

Nuclear Criticality Safety in the Chapter 6 - Engineered Safety Features Radioisotope Production Facility 6b.3 NUCLEAR CRITICALITY SAFETY IN THE RADIOISOTOPE PRODUCTION FACILITY SHINE maintains a nuclear criticality safety program (CSP) that complies with applicable American National Standards Institute/American Nuclear Society (ANSI/ANS) standards, as endorsed by Regulatory Guide (RG) 3.71, Revision 3, Nuclear Criticality Safety Standards for Fuels and Material Facilities (USNRC, 2018). The CSP is intended to meets the applicablefollowing criticality safety requirements of 10 CFR 70:

• The criticality accident requirements of 10 CFR 70.24;

• The criticality reporting requirements of 10 CFR 70.50, 10 CFR 70.52, and 10 CFR 70, Appendix A;

• Application of 10 CFR 70.61(b) to criticality accidents, considering such accidents as high-consequence events; and

• Application of 10 CFR 70.61(d), ensuring that nuclear processes are subcritical under normal and credible abnormal conditions, including use of an approved margin of subcriticality and the use of preventative controls as the primary means of protection.

6b.3.1 NUCLEAR CRITICALITY SAFETY PROGRAM The CSP is administered through a written nuclear criticality safety (NCS) policy and program description, with an additional program description for NCS training and qualification. The CSP is executed by qualified NCS staff using written procedures. The program description and written procedures are formally controlled through the SHINE document control procedure.

The goal of the CSP is to ensure that workers, the public, and the environment are protected from the consequences of a nuclear criticality event. In order to accomplish this goal, all practicable measures are implemented to prevent an inadvertent criticality from occurring. The CSP also contains provisions necessary to mitigate the consequences (i.e., criticality accident alarm system [CAAS] and emergency response activities) should an inadvertent criticality occur.

6b.3.1.1 Nuclear Criticality Safety Program Organization The SHINE Chief Executive Officer holds overall responsibility for the CSP. The Safety Analysis Manager is the Responsible Manager for the CSP and may delegate administrative authority to an NCS Lead.

SHINE facility management holds the following responsibilities with respect to the CSP:

• Formulate and maintain the NCS policy and ensure that personnel involved in fissionable material operations (FMOs) are informed of the policy.

• Assign responsibility and delegate commensurate authority to implement the criticality safety policy and program.

• Ensure that everyone, regardless of position, is made aware of their responsibilities for implementing the requirements of the CSP.

• Ensure that appropriately trained and qualified NCS staff are available to provide technical guidance appropriate for the FMOs performed at the SHINE facility.

• Establish and maintain a training and qualification program for NCS staff.

• Establish a method to monitor the CSP.

• Participate in auditing the overall effectiveness of the CSP at least once every three years.

SHINE Medical Technologies 6b.3-1 Rev. 3

Nuclear Criticality Safety in the Chapter 6 - Engineered Safety Features Radioisotope Production Facility

• ANSI/ANS-8.17-2004 (R2014), Criticality Safety Criteria for the Handling, Storage and Transportation of LWR Fuel Outside Reactors.

SHINE does not handle, store, or transport LWR fuel rods or units.

• ANSI/ANS-8.21-1995 (R2011), Use of Fixed Neutron Absorbers in Nuclear Facilities Outside Reactors (ANSI/ANS, 1995)

SHINE does not use fixed neutron absorbers for control of criticality.

• ANSI/ANS-8.27-2015, Burnup Credit for LWR Fuel.

SHINE does not possess irradiated LWR fuel assemblies.

6b.3.1.4 Nuclear Criticality Safety Evaluations NCSEs are conducted for each FMO within the radioisotope production facility (RPF) to ensure that under normal and credible abnormal conditions, all nuclear processes remain subcritical with an approved margin of subcriticality for safety. An FMO is any process or system that has the potential to contain more than 250 g of non-exempt fissile material. This limit is selected based on one-half of the single parameter mass limit for uranium-233 identified in ANSI/ANS-8.1-2014.

For the purposes of application of this limit, all fissionable isotopes in the process or system are considered to be fissile.

Exempt fissile material is defined as special nuclear material (SNM) that meets the requirements from classification as fissile nuclear material as specified in 10 CFR 71.15. The limits specified in 10 CFR 71.15 are derived for use in nuclear material transport and long-term storage and are acceptably conservative. When 10 CFR 71.15 is invoked to exempt a process or system, the NCSE must show that there are no credible means of changing the physical composition or configuration of the material.

NCS limits are derived based on assuming optimum or most-reactive credible parameter values unless specific controls are implemented to limit parameters to a particular range. If less-than-optimum values are used, the basis for use is included in the NCSE. Operating limits which take process variability and uncertainty into account are used to ensure NCS limits are unlikely to be exceeded. Controls used to enforce safety and operating limits are specified in the NCSEs.

The subcritical margin used for RPF solution processes is 0.06. An initial 0.05 margin was selected based on completion of a validation study that meets the guidelines of NUREG/CR-6698, Guide for Validation of Nuclear Criticality Safety Methodology, using a wide variety of critical experiment benchmarks that encompass the material compositions, neutron energy spectra, and geometric forms (USNRC, 2001) to bound SHINE solution processes. An additional subcritical margin of 0.01 is applied for conservatism to account for the limited number of experimental benchmarks for uranyl sulfate systems.

The NCSEs are conducted using appropriate hazard evaluation techniques, including "What-if,"

"What-if Checklist," and Event Tree Analysis, to determine potential scenarios which could result in an inadvertent criticality event. Process hazards evaluations are referenced to identify additional potential scenarios that have been determined to have potential criticality safety implications (e.g. chemical safety, fire, radiological events). The identified scenarios are screened based on a qualitative determination of likelihood and those events which are deemed to be credible are evaluated for appropriate control selection. For the purposes of NCSEs, criticality events are always considered to be "high" consequence, with a strict emphasis on selection of controls to prevent criticality. Where the double contingency principle (DCP) is employed, the NCSE contains a description of its implementation.

SHINE Medical Technologies 6b.3-5 Rev. 3

Nuclear Criticality Safety in the Chapter 6 - Engineered Safety Features Radioisotope Production Facility prevent improper FCRS hookups. Additionally, the wash sequence of the column is administratively controlled to prevent precipitation.

6b.3.3 CRITICALITY ACCIDENT ALARM SYSTEM The SHINE facility provides a CAAS to detect a criticality event in the areas in which non-exempt quantities of fissile material greater than the limits identified in 10 CFR 70.24(a) are used, handled, or stored outside the irradiation unitsTSVs. The criticality accident alarm system at the SHINE facility is designed to meet the requirements of 10 CFR 70.24, and conforms to the requirements in ANSI/ANS-8.3-1997 (R2017), as endorsed by RG 3.71.

The CAAS consists of several detectors located within the RPFthroughout the main production facility at locations designated to provide sufficient coverage of areas in which SNM is used, handled, and stored.

6b.3.3.1 Minimum Accident of Concern The minimum accident of concern (MAC) for the SHINE facility is developed based on a critical sphere of 20 percent enriched uranyl sulfate solution. This system is representative of the majority of operations conducted within the SHINE facility. Process accidents involving solutions are also statistically more likely to occur, based on available historical data.

Detector placement is determined by neutron transport analysis using the MAC. The transport analysis converts the neutron and gamma spectrum of the MAC to a point source which is used with a computer model of the facility structure, shielding, and intervening equipment to determine appropriate detector placements and detection thresholds. The detection thresholds are based on the requirements of 10 CFR 70.24 and the detector response to neutron radiation. Selection of neutron detectors and neutron transport analysis are appropriate for the SHINE facility because the facility contains multiple sources of gamma radiation which could interfere with the operation of the CAAS in a way that would result in an unacceptable number of false alarms.

6b.3.3.2 Criticality Accident Alarm System Design The CAAS will energize visible and audible alarms in the affected area of the RPF and in the facility control room if a criticality accident occurs. Mandatory evacuation areas are determined and clearly marked with evacuation routes for areas in which personnel would receive a dose exceeding 12 rads (0.12 grays) in free air. Evacuation routes are selected to ensure personnel are evacuated away from areas with potentially higher dose during a criticality accident.

The CAAS detectors are arranged so that each area outside of the irradiation unit cells in which special nuclear material is used, handled, or stored within the RPF generallymain production facility receives coverage from at least three detectors, which allows a single detector to be taken out of service for maintenance without impact to the operability of the system. Under normal conditions, the detector logic requires that two detectors are needed to trigger an alarm condition, which minimizes the potential for false actuations of the alarm. Protection against latent detector failures during maintenance conditions is achieved by locking in an alarm signal from any detectors which are out of service for maintenance, which reduces the detection requirement to a single detection within the affected zones.

SHINE Medical Technologies 6b.3-22 Rev. 3

Chapter 9 - Auxiliary Systems Handling and Storage of Target Solution 9a2.2.4 STORAGE OF TARGET SOLUTION Storage of target solution in the IF is limited to storage in the TSV dump tanks following irradiation in the TSV.

9a2.2.5 CRITICALITY CONTROL FEATURES Protection against inadvertent criticality in the TSV dump tank is discussed in Subsection 4a2.6.3 and Subsection 6a2.3.1.1. Protection against inadvertent criticality in the TOGS is discussed in Subsection 4a2.8.5 and Subsection 6a2.3.1.2. Reactivity control for the SCAS is discussed in Section 4a2.6.

9a2.2.6 BIOLOGICAL SHIELDING The irradiation cell biological shield (ICBS) ensures that the projected radiation dose rates and accumulated doses in occupied areas within the IF do not exceed the limits of 10 CFR 20.

Furthermore, the dose reduction by the ICBS supports the radiation exposure goals defined in the as low as reasonably achievable (ALARA) Program, as described in Section 11.1.

Section 4a2.5 provides a detailed description of the ICBS.

9a2.2.7 TECHNICAL SPECIFICATIONS Controls on target solution during handling and storage, including testing and surveillance, are described in the technical specifications.

SHINE Medical Technologies 9a2.2-2 Rev. 1

Chapter 11 - Radiation Protection Program and Waste Management Radiation Protection

• Allowing periodic collection of filters to allow for laboratory analysis for particulate and iodine.

The SRM provides continuous on-line sampling of releases of gaseous effluents from the facility to demonstrate that releases are within the regulatory limits. The CDBEM is provided to monitor the safety-related alternate release path.

e. Detection and Monitoring of Radioactivity in Liquid Systems and Liquid Effluents There are no piped radioactive liquid effluent discharges from the facility; therefore, there are no installed liquid effluent monitors. However, liquid effluent releases are collected and sampled prior to release.

Closed loop process cooling water systems are monitored (through sampling or installed instrumentation) to detect leakage between process fluids and cooling water due to failure in a heat exchanger or other system boundary component.

f. Radiation Area Monitors Radiation area monitors (RAMs) provide radiation monitoring and alarms to alert personnel and the control room of radiation levels that are in excess of normal background levels. RAMs are located in areas to monitor the environment for radioactivity during normal operations, operational occurrences and postulated accidents. Procedures provide detailed instructions for determining and employing alarm set points for RAMs.

RAMs may be provided in High Radiation Areas in order to provide a remote readout. If a RAM is not provided in a particular High Radiation Area, then portable instruments are required by the RWP to measure dose rates when personnel access the area.

g. Control Point Monitoring Monitor stations are located at the access points for restricted areas. Monitors are provided to detect radioactive contamination of personnel. Monitoring station locations are evaluated and moved as necessary in response to changes in the facility radiological conditions.

Monitoring equipment used at the facility access points are shown in Table 11.1-12.

h. Criticality Monitoring Criticality monitoring in the RPFmain production facility is provided by the criticality accident alarm system (CAAS). This system is described in Subsection 6b.3.3.

Radiation monitoring systems, their functions, and their interfaces with the engineered safety features in the facility are described in Section 7.7.

SHINE Medical Technologies 11.1-19 Rev. 3

Chapter 13 - Accident Analysis Accident-Initiating Events and Scenarios 13a2 IRRADIATION FACILITY ACCIDENT ANALYSIS The purpose of this section is to identify the postulated initiating events and credible accidents that form the design basis for the irradiation facility (IF), which includes the irradiation units (IUs) and supporting systems. Section 13b identifies the postulated initiating events and credible accidents within the radioisotope production facility (RPF).

Design basis accidents (DBAs) were identified using the following sources of information:

• NUREG-1537 (USNRC, 1996) and the Interim Staff Guidance (ISG) Augmenting NUREG-1537 (USNRC, 2012a);

• Process hazard analysis (PHA) method within the safety analysis; and

• Experience of the hazard analysis team.

Each identified accident scenario was qualitatively evaluated for its potential chemical or radiological consequences. For accident scenarios with potential consequences that could exceed the appropriate evaluation guidelines for worker or public exposure, controls were applied to ensure that the scenario is prevented or that consequences are mitigated to within acceptable limits. For accident scenarios which are not prevented, the radiological or chemical consequences were quantitatively evaluated to demonstrate the effectiveness of the selected mitigative controls or shown to be bounded by other quantitative analysis.

The quantitative analysis includes:

1) Identification of the limiting initiating event, initial conditions, and boundary conditions.

2) Review of the sequence of events for functions and actions that change the course of the accident or mitigate the consequences.

3) Identification of damage to equipment or the facility that affects the consequences of the accident.

4) Review of the potential radiation source term and radiological consequences.

5) Identification of safety controls to prevent or mitigate the consequences of the accident.

The results of these analyses are provided in Section 13a3. The analyses identify those safety-related structures, systems, and components (SSCs) and engineered safety features for each accident, and demonstrate that the mitigated consequences do not exceed the radiological accident dose criteria, described in Section 13a2.2.

SHINE Safety Analysis (SSA) Methodology SHINE applies a SHINE-specific, risk-based methodology similar to the guidance described in NUREG-1520, Standard Review Plan for Fuel Cycle Facilities License Applications (USNRC, 2015) in the development of the detailed accident analysis. This methodology is applied to both the IF and the RPF for consistency of the safety analysis for the entire SHINE facility.

The SSA is a systematic analysis of facility processes used to identify facility hazards associated with the processing and possession of licensed materials. The SSA has been performed for the purpose of identifying relevant hazards, potential accident sequences and consequences, equipment and specific human actions credited for safety, and programmatic administrative controls necessary to ensure the availability and reliability of safety-related SSCs. This analysis SHINE Medical Technologies 13a2.1-1 Rev. 4

Chapter 13 - Accident Analysis Accident-Initiating Events and Scenarios takes into consideration the facility structure, equipment, activities, personnel, processes, and administrative controls in an integrated manner to identify and analyze hazards.

Applicability Normal operation at the SHINE facility includes IF operations as well as chemical extraction and purification operations, target solution preparation and storage activities, and waste handling and immobilization activities in the RPF.

The SSA considers all modes of operation for potential process upsets and accident sequences.

The subcritical assembly system (SCAS) for each IU is analyzed for each mode of operation (i.e.,

Solution Removed, Startup, Irradiation, Post-Irradiation, Transfer to RPF). The associated target solution vessel (TSV) off-gas system (TOGS) operation is combined with the SCAS analysis as they are tightly coupled systems. Since the tritium purification system (TPS) services all eight IUs, it is analyzed as a continuously operating integrated system. The operating modes for the TPS include normal gas feed, recovery and purification, and TPS glovebox cleanup.

SHINE systems which operate in a batch mode are analyzed for active operation while hazardous materials are present. The molybdenum extraction and purification system (MEPS) and the iodine and xenon purification and packaging (IXP) system are either in use or idle. They are therefore analyzed for normal extraction, purification, and packaging activities. Similarly, the target solution and preparation system (TSPS) and the uranium receipt and storage system (URSS) are analyzed for normal target solution preparation activities. The radioactive liquid waste system (RLWS) and the radioactive liquid waste immobilization (RLWI) system are also analyzed for normal storage and processing of liquid wastes.

The SSA considers maintenance activities as potential initiators for accident sequences including maintenance errors, improper system restoration, impacts on operating equipment, and fires.

These types of initiators were identified during the accident sequence development phase of the SSA.

Non-routine activities may include the repair or replacement of major components such as the neutron drivers or the high voltage power supplies (HVPS). Accident sequences considered in the SSA include heavy load drops on systems or components containing radiological material and inadvertent exposure to neutrons.

Periods of extended shutdown are not explicitly identified as a class of accident sequences in the SSA; however, SHINE systems are designed to achieve and maintain a safe condition for radiological materials in extended storage.

Technical specifications require limiting conditions for operation (LCO) be met during the specified conditions of applicability. When an LCO is not met, the applicable actions specified in the technical specifications are required to be completed.

SHINE Medical Technologies 13a2.1-2 Rev. 4

Chapter 13 - Accident Analysis Accident-Initiating Events and Scenarios General Approach The SSA is developed based on the following major steps:

• Identification and systematic evaluation of hazards at the facility

• Comprehensive identification of potential accident/event sequences that would result in unacceptable consequences, and the expected likelihoods of those sequences

• Assessment of radiological and chemical consequences for postulated accident sequences to demonstrate compliance with acceptable limits

• Identification and description of safety-related controls (i.e., structures, systems, equipment, components, or specific actions) that are relied on to limit or prevent potential accidents or mitigate their consequences

• Identification of programmatic administrative controls that ensure the availability and reliability of identified safety systems.

The results of the SSA consist of postulated accident sequences for inclusion in this chapter.

This includes a description of the accident sequences, potential consequences, controls credited to prevent or mitigate the accident sequence, and a summary of calculated dose consequences.

Hazard Identification and Evaluation Hazard identification is performed by identifying, for each process, radiological or chemical hazards that have the potential for causing harm to the public, facility staff, or the environment.

This includes physical process hazards (e.g., deflagration, fire, flooding) that could result in adverse effects on licensed materials. Radiological hazards include radiation sources from the SHINE processes (e.g., neutron driver, TSV), fission products, activation products, and tritium.

Fissile material hazards are also considered for postulated criticality accidents. Chemical hazards are identified that could affect licensed materials or the safe operation of the facility.

Chemical effects considered include flammable, reactive, oxidation, and chemical incompatibility effects.

The hazard identification and evaluation is performed using standard hazard evaluation methods such as Hazard and Operability Analysis (HAZOP) and Failure Modes and Effects Analysis (FMEA). The types of hazards identified for the SHINE facility are identified in Table 13a2.1-1.

Hazard evaluations are conducted to assess potential failures, causes, and consequences that provide a basis for the development of potential accident sequences. The output of the hazard evaluations are those failure-cause-consequences that have the potential for causing harm to the public, facility staff, or the environment and the possible engineered or administrative controls that may be applied for prevention or mitigation.

Process Hazard Analysis and Accident Sequence Development The results of the hazard evaluations are used to inform the PHA and accident sequence development phase. The PHA uses the results of the hazard evaluations to develop accident sequences in alignment with the accident sequence categories described in Section 13a2.1 for the IF and Subsection 13b.1.2 for the RPF.

Accident sequence development uses the risk index methodology based on risk index values described in NUREG-1520 (USNRC, 2015). Potential accident sequences are defined based on SHINE Medical Technologies 13a2.1-3 Rev. 4

Chapter 13 - Accident Analysis Accident-Initiating Events and Scenarios the failures, process deviations, or external events as identified in the hazard evaluations. An initiating event is defined for each scenario that may include equipment failures, human errors, external events, or combinations of these elements.

External event-induced accident sequences are treated on a site-wide basis. The external events PHA also includes fires and flooding from causes internal to the IF and the RPF. External event initiating events that are considered include:

• external events such as earthquake, external flooding, external fires, high winds, and tornadoes;

• events that are external to the process being analyzed such as internal fires and internal flooding;

• deviations from normal process operations (credible abnormal events);

• failures of process components; and

• human errors that result in process upsets or failures.

Potential consequences are also identified for each accident sequence as one or more of the following:

• Radiological dose to the public or facility staff (i.e., control room operator)

• Chemical dose to the public or facility staff (i.e., control room operator and radiologically controlled area [RCA] worker)

• Criticality event

• No consequence of concern The radiological consequence analysis is described in Section 13a2.2 for the IF and Section 13b.2 for the RPF. The chemical consequence analysis is described in Section 13b.3.

Accident sequences that may result in a consequence of concern are first evaluated with no engineered or administrative controls applied, referred to as an uncontrolled accident sequence. A total risk index number is determined based on an estimate for the likelihood of occurrence and severity of consequences. For accident sequences with unacceptable risk indices, engineered and administrative controls are applied that reduce the likelihood of occurrence and/or the severity of the consequences such that an acceptable risk level is reached. Acceptable risk levels for SHINE require that the postulated sequence is highly unlikely and/or the consequence severity is low. The final accident sequence is referred to as a controlled accident sequence. The credited engineered and administrative controls are identified as safety-related controls.

Risk Matrix Development The risk matrix applied in the SSA is provided in Table 13a2.1-2. The risk matrix approach provides a method of determining the risk of various accident sequences based on a quantitative estimate of the likelihood of occurrence and the severity of the consequences. The likelihood of occurrence and the consequence severity for each uncontrolled accident sequence is estimated and corresponding categories are assigned. The risk matrix then identifies those credible accidents which have the potential to exceed the acceptable risk index values, and therefore require engineered and/or administrative controls for prevention or mitigation. The risk index values are then reassessed after application of engineered or administrative controls that result in an acceptable risk outcome.

SHINE Medical Technologies 13a2.1-4 Rev. 4

Chapter 13 - Accident Analysis Accident-Initiating Events and Scenarios Likelihood Evaluation The likelihood category definitions applied in the SSA are provided in Table 13a2.1-3. The determination of the likelihood of occurrence consists of the initiating event frequency (e.g.,

seismic event, process component failure, human error) and may be combined with an additional component failure or human error, including any recovery times (i.e., failure duration). In most cases, the initiating events are represented by single events or single failures.

The frequency of occurrence of an initiating event for an accident sequence is represented by a failure frequency index number (FFIN). The FFINs applied in the SSA are provided in Table 13a2.1-4. The bases for determining the FFIN for an accident sequence may include evidence or the type of control.

To determine the FFIN selected for an accident sequence initiator based on the type of control, several factors are considered including:

• administrative (i.e., human error);

• type of component failure (i.e., active versus passive);

• degree of redundancy (i.e., single component, redundant component);

• design margin (e.g., design pressure versus nominal pressure); and

• other factors including degree of enhancement for administrative controls (e.g.,

independent verification and step sign-off).

If the accident sequence is postulated to occur only if another condition or failure is present, an additional probability of component failure or condition is included in the evaluation. The failure probability index number (FPIN) represents this as a failure on demand, or as a probability that the condition exists. This can be evaluated as a simple probability of failure on demand or approximated as the product of a failure rate and a recovery time, defined in this analysis as a duration index number (DIN). The quantitative characterization of the FPIN and DIN applied in the SSA is provided in Table 13a2.1-5 and Table 13a2.1-6, respectively.

Consequence Category Definitions The consequence category definitions applied in the SSA are provided in Table 13a2.1-7.

Numerical limits for the radiological and chemical exposure effects are included in the definitions for high and intermediate consequence for the public and facility staff. The low consequence category is implicitly defined as resulting in consequences that are less than intermediate and meet the SHINE safety criteria limits defined in Section 3.1.

Safety-Related Controls The accident sequences developed in the PHA phase identify the controls that are credited for prevention and/or mitigation of accident sequences. The types of safety-related controls that are credited for prevention and/or mitigation of accident sequences are:

• Engineered controls (active or passive), identified as safety-related SSCs; and

• Specific administrative controls (e.g., procedural controls)

Safety-related controls that are credited for prevention and/or mitigation are identified for each accident scenario in Section 13a2.2 and Section 13b.2.

SHINE Medical Technologies 13a2.1-5 Rev. 4

Chapter 13 - Accident Analysis Accident-Initiating Events and Scenarios Programmatic administrative controls are also implemented to assure that safety-related controls can perform their intended functions. Defense-in-depth (DID) controls may also be identified that are not credited in accident sequences but provide additional margin for risk reduction.

Incorporation into the FSAR and Technical Specifications Accident sequences developed in the SSA inform the accident analysis and determination of consequences of the limiting accident scenarios described in Section 13a2.2 for the IF and Section 13b.2 for the RPF.

The safety-related SSCs that are required to be operable to meet the assumptions underlying the SSA are included within Section 3.0 of the technical specifications, Limiting Conditions for Operation and Surveillance Requirements.

Section 4.0 of the technical specifications, Design Features, includes design features that are identified in the SSA. These are aspects of the facility design and other physical conditions (e.g.,

distance to the site boundary, building free volume) that are inputs or assumptions in the radiological dose calculations that support the SSA dose consequence analysis.

The SSA also identifies the programmatic administrative controls that are required to be implemented to ensure that safety-related SSCs will be capable of performing their intended functions. Section 5.0 of the technical specifications, Administrative Controls, includes the programmatic administrative controls identified in the SSA (e.g., maintenance of safety-related SSCs) and requires that those programs are established, implemented, and maintained.

Section 5.0 additionally requires the development and use of procedures that implement the specific administrative controls identified in the SSA. Section 5.0 also includes discussion of the configuration management program, which provides oversight and control of design information, safety information, and records of modifications that might impact the ability of safety-related SSCs to perform their intended functions. The configuration management program also lists SSA-identified controls not otherwise included in Sections 3.0, 4.0, or 5.0 of the technical specifications that will be maintained under the configuration management program and will not be modified as described in the technical specifications without prior NRC approval.

13a2.1 ACCIDENT-INITIATING EVENTS AND SCENARIOS The design basis accidents (DBAs) identified in this section are credible accident scenarios that range from anticipated events, such as a loss of electrical power, to events that are still credible, but considered unlikely to occur during the lifetime of the plant. The IF maximum hypothetical accident (MHA) is also defined to result in the bounding radiological consequences for the IFSHINE facility.

Based on the guidance provided in the Interim Staff Guidance (ISG) Augmenting NUREG-1537 (USNRC, 2012a), the following accident categories were used to identify potential accident sequences:

• Maximum hypothetical accidentMHA (Subsection 13a2.1.1)

• Excess reactivity insertion (Subsection 13a2.1.2)

• Reduction in cooling (Subsection 13a2.1.3)

• Mishandling or malfunction of target solution (Subsection 13a2.1.4)

• Loss of off-site power (LOOP) (Subsection 13a2.1.5)

SHINE Medical Technologies 13a2.1-6 Rev. 4

Chapter 13 - Accident Analysis Accident-Initiating Events and Scenarios Table 13a2.1 Hazard Types Hazard Type Hazards Fission products (in solution, aerosol, and off-gas), decay products, Radiological activation products, tritium, neutron, gamma Uranium oxide, uranium metal, uranyl sulfate (target solution),

Fissile uranyl peroxide, uranium salts Uranium, SF6 gas, SF6 decomposition products, fission and decay Chemical - Toxic products Chemical - Flammable/Explosive Hydrogen gas, oxygen gas, uranium metal Chemical - Reactivity Sulfuric acid, nitric acid, NaOH Chemical - Oxidizer Oxygen gas, hydrogen peroxide Chemical - Incompatibility Acids and bases Chemical - Asphyxiant Nitrogen gas, SF6 gas, clean agent for fire protection Deflagration/Detonation Hydrogen gas, oxygen gas High voltage Accelerator high voltage power supply High pressure Compressed gas cylinders (nitrogen, oxygen, helium), SF6 gas High temperature Accelerator ion beam, process heaters, hydrogen recombiners Low temperature Liquid nitrogen Kinetic energy Ventilation and process steam blowers & fans Pressurized gas cylinders (nitrogen, oxygen, helium), SF6 pressure Potential energy vessel Initiators (electrical equipment, maintenance), combustible Internal fire materials, hydrogen gas Internal flooding Process equipment, fire protection, cooling water systems Seismic, tornado, tornado generated missiles, severe weather, External events flooding (possible maximum precipitation), external fire, aircraft impact, industrial and transportation events (toxic gas, explosion)

SHINE Medical Technologies 13a2.1-50 Rev. 4

Chapter 13 - Accident Analysis Accident-Initiating Events and Scenarios Table 13a2.1 Likelihood Category Definitions Likelihood of Occurrence Severity of Likelihood Category 1 Likelihood Category 2 Likelihood Category 3 Consequences Highly Unlikely Unlikely Not Unlikely (1) (2) (3)

Consequence Category 3 Acceptable Unacceptable Unacceptable High 3 6 9 (3)

Consequence Category 2 Acceptable Unacceptable Unacceptable Intermediate 2 4 6 (2)

Consequence Category 1 Acceptable Acceptable Acceptable Low 1 2 3 (1)

SHINE Medical Technologies 13a2.1-51 Rev. 4

Chapter 13 - Accident Analysis Accident-Initiating Events and Scenarios Table 13a2.1 Likelihood Category Definitions Likelihood Category Likelihood Index (T) Event Frequency Limit Risk Index Limits Less than 10-5 per Highly Unlikely 1 T -5 event, per year Between 10-4 and 10-5 Unlikely 2 -5 < T -4 per event, per year More than 10-4 per Not Unlikely 3 -4 < T event, per year SHINE Medical Technologies 13a2.1-52 Rev. 4

Chapter 13 - Accident Analysis Accident-Initiating Events and Scenarios Table 13a2.1 Failure Frequency Index Numbers Failure Frequency Based on Based on Type of Control Comments Index Number (FFIN) Evidence External event If initiating event, no controls

-6 N/A with freq. < 10-6/yr needed.

For passive safe-by-design components or systems; failure is considered highly unlikely for robust passive engineered controls:

1. Whose dimensions fall within established single parameter limits or that can be shown by calculation to be subcritical Initiating event including the use of the approved

-5 N/A with freq. < 10-5/yr subcritical margin,

2. That have no credible failure mechanisms that could disrupt the credited design characteristics, and

3. Whose design characteristics are controlled so that the only potential means to effect a change that might result in a failure to function would be to implement a design change No failures in 1. Exceptionally robust passive engineered control (PEC), Rarely can be justified by 30 years for

2. Two independent active evidence. Further, most types of

-4 hundreds of engineered control (AECs), PECs, single control have been similar controls in or enhanced specific observed to fail.

industry administrative control (SAC)

No failures in 30 years for tens A single control with redundant

-3 None of similar controls parts, each a PEC or AEC in industry No failure of this

-2 type in the faclity A single PEC None in 30 years A few failures may 1. A single AEC

-1 occur during 2. Enhanced SAC None facility lifetime 3. Redundant SAC Failure occurs 0 None every 1 to 3 years A single SAC Several Frequent event, inadequate Not for controls, just initialing 1 occurrences per control events.

year Occurs every Very frequent event, inadequate Not for controls, just initialing 2 week or more control events.

often SHINE Medical Technologies 13a2.1-53 Rev. 4

Chapter 13 - Accident Analysis Accident-Initiating Events and Scenarios Table 13a2.1 Failure Probability Index Numbers Failure Probability Probability of Failure Based on Type of Comments Index Number (FPIN) on Demand Control If initiating event, no

-6 10-6 N/A control needed.

1. Passive engineered control (PEC) with high design margin.

Can rarely be justified

2. Inherently safe by evidence. Most process.

-4 or -5 10 10-5 types of single controls

3. Two redundant controls more robust have been observed to than a simple AEC, fail.

PEC, or enhanced SAC.

1. Single PEC 10 10-4

-3 or -4 2. Single AEC with high None availability

1. Single AEC 10 10-3 2. Enhanced SAC

-2 or -3 None

3. SAC for routine planned operations A SAC that must be 10 10-2 performed in response 1- or -2 None to a rare unplanned demand.

SHINE Medical Technologies 13a2.1-54 Rev. 4

Chapter 13 - Accident Analysis Accident-Initiating Events and Scenarios Table 13a2.1 Duration Index Numbers Duration Index Average Failure Duration in Years Comments Number (DIN) Duration 1 > 3 years 10 None 0 1 year 1 None Formal monitoring to

-1 1 month 0.1 justify indices < -1

-2 A few days 0.01 None

-3 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> 10-3 None

-4 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> 10-4 None

-5 5 minutes 10-5 None SHINE Medical Technologies 13a2.1-55 Rev. 4

Chapter 13 - Accident Analysis Accident-Initiating Events and Scenarios Table 13a2.1 Consequence Category Definitions Consequence Category Facility Staff Off-Site Public RD > 25 rem RD > 100 rem High Consequence 3 30 milligrams sol U intake CD > PAC-3 CD > PAC-2 Intermediate Consequence 5 rem < RD 100 rem 1 rem < RD 25 rem 2

PAC-2 < CD < PAC-3 PAC-1 < CD PAC-2 Accidents with lower Accidents with lower Low Consequence radiological and chemical radiological and chemical 1

exposures than those above exposures than those above SHINE Medical Technologies 13a2.1-56 Rev. 4

Chapter 13 - Accident Analysis References Reactors, Interim Staff Guidance Augmenting NUREG-1537, Part 1, U.S. Nuclear Regulatory Commission, 2012.

USNRC, 2012b. Interim Staff Guidance Augmenting NUREG-1537, Part 2, "Guidelines for Preparing and Reviewing Applications for the Licensing of Non-Power Reactors: Standard Review Plan and Acceptance Criteria," for Licensing Radioisotope Production Facilities and Aqueous Homogeneous Reactors, Interim Staff Guidance Augmenting NUREG-1537, Part 2, U.S. Nuclear Regulatory Commission, 2012.

USNRC, 2015. Standard Review Plan for Fuel Cycle Facilities License Applications, NUREG-1520, Revision 2, U.S. Nuclear Regulatory Commission, June 2015.

LANL, 2011. MCNP5-1.60 Release & Verification, LA-UR-11-00230, F.B. Brown, B.C.

Kiedrowski, J.S. Bull, M.A. Gonzales, N.A. Gibson, Los Alamos National Laboratory, Los Alamos, NM, 2011.

ORNL, 2011. ORIGEN-S: Depletion Module to Calculate Neutron Activation, Actinide Transmutation, Fission Product Generation, and Radiation Source Terms, Oak Ridge National Laboratory, Oak Ridge, Tennessee, 2011.

SHINE Medical Technologies 13a4-2 Rev. 1

ENCLOSURE 3 ATTACHMENT 2 SHINE MEDICAL TECHNOLOGIES, LLC SHINE MEDICAL TECHNOLOGIES, LLC OPERATING LICENSE APPLICATION RESPONSE TO REQUEST FOR ADDITIONAL INFORMATION TECHNICAL SPECIFICATIONS CHANGES (MARK-UP) 2 pages follow

Category Characteristic The TPS gloveboxes limit the release of tritium in the event of a process Confinement leak. The gloveboxes are inerted with helium and are designed with a (continued) minimum free volume is specified so that the entire inventory of hydrogen cannot reach the lower flammability limit if released within the glovebox.

The ESFAS and TRPS safety-related control systems are designed to assume a safe state on a loss of electrical power, as described in FSAR Subsections 7.4.3.8 and 7.5.3.7. Divisions A and B of ESFAS and TRPS Instrumentation control cabinets are located on opposite sides of the control room, and are mounted six inches above the floor to remain above maximum credible flood height.

The TSPS and URSS gloveboxes provide a low leakage boundary for uranium oxide and metal, are equipped with high efficiency particulate air (HEPA) filters and are seismically qualified.

Criticality Safety The seismic design of the URSS storage racks prevents loss of control of fissile material geometry and confinement.

Engineered controls are identified in the criticality safety evaluations to prevent criticality in the RPFSHINE Facility, excluding the TSVs.

5.5.5 Maintenance of Safety-Related SSCs The SHINE maintenance program, which includes inspection, testing, and maintenance, ensures that the safety-related SSCs are available and reliable when needed. The maintenance program includes corrective maintenance, preventative maintenance, surveillance and monitoring, and testing. The maintenance program includes the following activities to ensure that safety-related SSCs can perform their functions as required by the accident analysis:

1. Inspection and maintenance of Confinement boundaries;

2. Corrective maintenance and inspections following safety-related system or component actuations or adverse conditions;

3. Overhead crane maintenance and requirements for usage;

4. Safety-related electrical equipment preventive maintenance; and

5. Other inspections and surveillances deemed necessary to ensure the continued functionality of safety-related SSCs.

5.5.6 Fire Protection The SHINE fire protection program documents and describes the methods used to minimize the probability of and the consequences of fire. The fire protection program ensures, through defense-in-depth, that a fire will not prevent the performance of necessary safety-related functions and that radioactive releases to the environment, in the event of fire, will be minimized. The fire protection program implements the following activities to prevent and mitigate potential fire events in the SHINE Facility:

Page 5.0-11 Revision 34

1. Periodic surveillances;

2. Control of hot work;

3. Control of transient combustibles;

4. Control of physical design characteristics of the facility relied on to prevent or mitigate the effects of fires; and

5. Maintenance of the fire hazards analysis and safe shutdown analysis for the facility.

5.5.7 Nuclear Criticality Safety The SHINE nuclear criticality safety program ensures that workers, the public, and the environment are protected from the consequences of a nuclear criticality event. The nuclear criticality safety program complies with applicable national consensus standards, as clarified by Regulatory Guide 3.71, Revision 3, Nuclear Criticality Safety Standards for Fuels and Material Facilities, and is described in FSAR Subsection 6b.3.1.

The nuclear criticality safety program evaluates the fissionable material operations in the SHINE RPFFacility and establishes appropriate criticality safety controls which are described in the criticality safety evaluations and the accident analysis. The criticality safety controls are preventative in nature and comply with the preferred hierarchy of controls: passive controls over active controls and engineered controls over administrative controls.

A criticality accident alarm system (CAAS) is provided for the SHINE Facility. The CAAS meets the requirements of 10 CFR 70.24(a) and follows the guidance of ANSI/ANS 8.3-1997. Maintenance and testing of the CAAS is performed in accordance with ANSI/ANS 8.31997. The CAAS is further described in FSAR Subsection 6b.3.3.

5.5.8 Chemical Control The SHINE chemical control program ensures that on-site chemicals are stored and used appropriately to prevent undue risk to workers and the facility. The chemical control program implements the following activities, as required by the accident analysis:

1. Control of chemical quantities permitted in designated areas and processes;

2. Chemical labeling, storage and handling; and

3. Laboratory safe practices.

5.6 Experiments Review and Approval Experiments, as defined in ANSI/ANS 15.1-2007, are not conducted at the SHINE Facility.

5.7 Required Actions 5.7.1 Safety Limit Violation In the event of a safety limit violation:

1. The operations leading to the violation shall be shut down immediately and operation of those affected processes shall not be resumed until authorized by the NRC; Page 5.0-12 Revision 34