ML21243A269

Enclosure 2 - Response to Request for Additional Information Public Version

ML21243A269
Person / Time
Site:	SHINE Medical Technologies
Issue date:	08/31/2021
From:	SHINE Medical Technologies
To:	Office of Nuclear Reactor Regulation
Shared Package
ML21243A266	List: ML21243A267 ML21243A269 ML21243A270
References
2021-SMT-0095
Download: ML21243A269 (51)

Text

ENCLOSURE 2 SHINE MEDICAL TECHNOLOGIES, LLC SHINE MEDICAL TECHNOLOGIES, LLC APPLICATION FOR AN OPERATING LICENSE RESPONSE TO REQUEST FOR ADDITIONAL INFORMATION RESPONSE TO REQUEST FOR ADDITIONAL INFORMATION PUBLIC VERSION

SHINE MEDICAL TECHNOLOGIES, LLC SHINE MEDICAL TECHNOLOGIES, LLC APPLICATION FOR AN OPERATING LICENSE RESPONSE TO REQUEST FOR ADDITIONAL INFORMATION RESPONSE TO REQUEST FOR ADDITIONAL INFORMATION PUBLIC VERSION The U.S. Nuclear Regulatory Commission (NRC) staff determined that additional information was required (Reference 1) to enable the continued review of the SHINE Medical Technologies, LLC (SHINE) operating license application (Reference 2). The following information is provided by SHINE in response to the NRC staffs request.

Criticality Accident Alarm System Exemption Request RAI CE-1 to SHINEs exemption request states that each neutron flux detection system (NFDS) is able to detect the minimum accident of concern if a criticality were to occur in the TSV dump tank, which would be evident to operators through the process integrated control system due to an increased count rate on the detectors. Enclosure 1 also states that the high-high TSV dump tank level instrumentation can detect a criticality accident in the TSV offgas system (TOGS) and would alert personnel to take appropriate actions. However, no information is provided as to how the NFDS and high-high TSV dump tank level instrumentation are used for emergency response activities.

Discuss whether and how (if applicable) the NFDS and high-high TSV dump tank level instrumentation are relied upon or used for emergency response activities with respect to inadvertent criticality. State how the evidence of criticality (e.g., increased count rate, etc.) from these systems is available to personnel.

This information is necessary for the NRC staff to make the necessary evaluation findings described in the ISG augmenting NUREG-1537, Part 2, Section 6b.3. Specifically, the requested information will support the NRC staff in concluding that SHINEs nuclear criticality safety program provides reasonable assurance of the protection of the public health and safety, including that of workers.

SHINE Response As discussed in the exemption request (Reference 3), a criticality accident in the irradiation unit (IU) cell would produce a radiation hazard commensurate with that associated with normal operation of the subcritical assembly and would not produce additional risk to workers or the public. Therefore, emergency response activities related to a criticality event in the IU cell would not be required to protect the health and safety of workers and the public.

The target solution vessel (TSV) dump tank and interconnecting piping are designed to be geometrically favorable for the most reactive credible conditions, including various upset conditions. While not considered credible, if a criticality were to occur in the TSV dump tank or Page 1 of 22

interconnecting piping, an increase in the neutron count rate would be visible to operators on the process integrated control system (PICS) operator workstation displays. The PICS receives the neutron count rate from the neutron flux detection system (NFDS) via the TSV reactivity protection system (TRPS). No automatic actions are taken by TRPS because the unit is already shut down, with the target solution in the TSV dump tank. Upon indication of an actual occurrence of an inadvertent criticality, operators would activate the emergency response organization and perform off-site notifications as required by the SHINE Emergency Plan.

The only credible accident scenario identified that could result in significant fissile material entering the TSV off-gas system (TOGS) is a flood of the primary system boundary (PSB). In this scenario, a rapid ingress of water floods the TSV dump tank, overflow lines, and TSV headspace, allowing the TOGS blowers to draw the diluted target solution up into the TOGS. In the controlled scenario, the TOGS has been designed with favorable geometry for the most reactive credible conditions to prevent an inadvertent criticality. The operators would be alerted of a PSB flooding event by a high-high TSV dump tank level alarm displayed via PICS. TRPS provides this signal to PICS and automatically initiates an IU Cell Nitrogen Purge and an IU Cell Safety Actuation.

As described in the exemption request, the high-high TSV dump tank level alarm alerts operations personnel of the need to take appropriate response action, in accordance with facility operating procedures. This high-high TSV dump tank level alarm alone would not provide evidence of an inadvertent criticality in TOGS components within the IU cell. If an inadvertent criticality were to occur in TOGS components within the IU cell, subsequent to the high-high TSV dump tank level alarm, an increased neutron count rate would be detected by the NFDS and this indication would be visible to operators as described above. Upon indication of an actual occurrence of an inadvertent criticality, operators would activate the emergency response organization and perform off-site notifications as required by the SHINE Emergency Plan.

SHINE has revised Subsection 7.3.1.1.6 of the FSAR to clarify that the NFDS monitors neutron flux in the IU cell during all modes of operation. A mark-up of the FSAR incorporating these changes is provided as Attachment 1.

RAI CE-2 to SHINEs exemption request states that a criticality accident in the IU cells would produce radiation similar to that of normal operation of the subcritical assembly and, therefore, does not pose any additional risk to workers or the public. However, the exemption request does not address the potential need for personnel to enter the IU cells for activities such as maintenance.

Discuss any potential need for personnel to enter the IU cells (e.g., preventive maintenance, corrective maintenance, etc.), and provide a justification as to why CAAS coverage is not necessary for such situations.

This information is necessary for the NRC staff to make the necessary evaluation findings described in the ISG augmenting NUREG-1537, Part 2, Section 6b.3. Specifically, the requested information will support the NRC staff in concluding that SHINE will develop, implement, and maintain an acceptable criticality accident alarm system.

Page 2 of 22

SHINE Response Criticality accident alarm system (CAAS) coverage is not necessary when personnel are occupying the IU cell, because these operations (e.g., preventive maintenance, corrective maintenance) only occur when the unit is in Mode 0, when the target solution has been removed from the IU cell. Fissile material operations are not conducted in the IU cell when personnel are present; therefore, there is no risk of criticality at these times and no CAAS coverage is needed.

Personnel access to an IU cell is provided via removal of the IU cell shield plug. Limiting conditions of operation described in Section 3.4 of the technical specifications require establishment of the primary confinement boundary, including the IU cell shield plug being in place, for all modes of IU cell operation other than Mode 0.

RAI CE-3 to SHINEs exemption request states that material in the material staging building (MATB) meets the requirements of 10 CFR 71.15, Exemption from classification as fissile material, paragraph (a), and therefore, does not pose a credible criticality risk based on the incredibility argument provided in Section 4.1.1, 10 CFR 71.15(a): Individual Package Containing 2 g or Less Fissile Material, of NUREG/CR-7239, Review of Exemptions and General Licenses for Fissile Material in 10 CFR 71. However, the incredibility argument provided in Section 4.1.1 of NUREG/CR-7239 assumes a limited volume of 84.853 cubic meters (i.e., a cubic array of approximately 4.4 meters per side) based on what is considered feasible for transport applications, and it is not clear whether the MATB is limited to that same volume.

a. Provide information to demonstrate that criticality is not credible in the MATB, including a discussion of the process upsets and human errors necessary for a criticality to occur.

b. State whether material considered to be exempt from classification as fissile material per 10 CFR 71.15(a) will be stored with material considered to be exempt from classification as fissile material per 10 CFR 71.15(c), or if they will be segregated. Discuss any measures used to segregate such packages, if applicable.

c. State whether material in the MATB will be stored in compliance with 10 CFR 71.15, or merely in a state similar to what is required for compliance with 10 CFR 71.15.

This information is necessary for the NRC staff to make the necessary evaluation findings described in the ISG augmenting NUREG-1537, Part 2, Section 6b.3. Specifically, the requested information will support the NRC staff in concluding that SHINEs conduct of operations will be based on nuclear criticality safety technical practices, which will ensure that fissile material will be possessed, stored, and used safely.

SHINE Response

a. The material staging building (MATB) has three distinct fissile material operation areas, each separated by 1-foot-thick concrete walls: (1) drum storage area, (2) truck loading and processing area, and (3) radioactive material storage and machine shop area. The nuclear criticality safety evaluation of the MATB restricts the total fissile mass in each fissile material operation area to less than 600 grams, excluding exempt fissile mass contained in the drum storage racks (solidified liquid waste drums considered to be exempt from classification as fissile material per 10 CFR 71.15(c)). The combination of the individual package restriction Page 3 of 22

and a total mass restriction for packages which do not meet 10 CFR 71.15(c) is sufficient to conclude that a criticality accident in the MATB due to the accumulation of packages containing small quantities (i.e., less than 2 grams of fissile mass) is not credible.

The process upsets and human errors necessary for a criticality to occur would include either: (1) accumulation of more than 84,853 1-liter, optimally moderated packages each containing 2 grams of 100 percent enriched uranium in an optimally-spaced cubic array, or (2) introduction of multiple individual packages containing more than 2 grams of U-235 such that the allowable fissile mass in the building would be exceeded and that the arrangement, mass, and moderation conditions of such packages could lead to a criticality.

For scenario (1), the total mass of 20 percent enriched uranium that would be present in 84,853 packages with 2 grams of U-235 is nearly 850 kilograms, which greatly exceeds the anticipated inventory of slightly-contaminated material stored in the MATB. This is several orders of magnitude times the total fissile mass limit of 600 grams set for each fissile material area in the MATB. These packages are also expected to contain significant non-fissile mass and not be optimally moderated and spaced. Given the number of packages, the total mass needed, and the conditions under which they would need to be assembled, this scenario was determined to be not credible.

In scenario (2), multiple violations of facility criticality safety rules in sequential processes would be necessary. The initial assay and packaging of the material prior to transport from the main production facility would need to fail such that the individual package fissile mass exceeds 2 grams, the mass tracking system for the MATB would need to fail such that a high-mass package was not identified prior to being placed in the building inventory, the mass tracking system for the MATB would need to fail such that the total inventory exceeds the limits identified in the criticality safety evaluation without identification, and the arrangement of high-mass packages within the building itself would need to meet the physical conditions necessary (e.g., moderation, spacing) for a criticality to occur. An evaluation of these sequential failures of programmatic barriers combined with knowledge of the physical conditions necessary for a criticality to occur even after the failures have occurred leads to a reasonable determination that this scenario is not credible.

Additionally, there are material control and accounting considerations which provide an added level of assurance regarding the mass contained in various packages which contain special nuclear material. While this program is administratively separate from the criticality safety program, it provides another layer of verification which ensures that appropriate mass limits are observed.

b. Material exempt from classification as fissile material under 10 CFR 71.15(c) will be stored in the physically-segregated sub-grade portion of the MATB. Material exempt from classification as fissile material under 10 CFR 71.15(a) will not be stored in the sub-grade portion of the MATB. Physical concrete barriers which serve as part of the shielding structure for the sub-grade storage area provide physical separation between packages containing material exempted under 10 CFR 71.15(a) and material exempted under 10 CFR 71.15(c).

c. Fissile isotope-containing materials in the MATB will be stored in accordance with the controls identified in the nuclear criticality safety evaluation, as described above.

Page 4 of 22

RAI CE-4 Section 6b.3.3.2, Criticality Accident Alarm System Design, of the FSAR states, in part that:

[f]or maintenance or other conditions which would disable multiple detectors or the logic unit, administrative controls are used to secure the movement of fissile material and limit personnel access to the affected areas until alarm system coverage is restored. These administrative controls are specific to the various processes within the RPF [radioisotope production facility]

and include short time allowances to restore the system to full operation in lieu of immediate process shutdown in areas where process shutdown creates additional risk to personnel. The requirements of 10 CFR 70.24 necessitate that CAAS coverage be maintained where more than a threshold quantity of SNM is handled, used, or stored; and that all personnel be evacuated in the event of a CAAS alarm actuation. Compliance with 10 CFR 70.24, therefore, generally necessitates that CAAS coverage be maintained, even during maintenance activities, unless one or more of the following conditions are met:

1) less than the threshold quantities of SNM described in 10 CFR 70.24(a) are present;

2) all personnel have been evacuated to an area of safety in accordance with 10 CFR 70.24(a)(3); and/or

3) compensatory measures are in place that provide CAAS coverage consistent with the requirement of 10 CFR 70.24(a)(1) (e.g., use of non-CAAS detectors with audible alarms for personnel remaining in or entering the area without CAAS coverage).

However, it is not clear how SHINEs use of administrative controls to secure the movement of fissile material and limit personnel access is consistent with 10 CFR 70.24 during maintenance or other conditions which would disable multiple detectors or the logic unit (i.e., lapses in CAAS coverage) for areas requiring CAAS coverage outside of the IU cells and MATB.

Discuss how compliance with 10 CFR 70.24 is ensured during maintenance or other conditions which would disable multiple detectors or the logic unit (i.e., lapses in CAAS coverage), or request an exemption from the requirements of 10 CFR 70.24 in accordance with 10 CFR 70.17, Specific exemptions, for such situations.

This information is necessary for the NRC staff to make the necessary evaluation findings described in the ISG augmenting NUREG-1537, Part 2, Section 6b.3. Specifically, the requested information will support the NRC staff in concluding that SHINE will develop, implement, and maintain an acceptable criticality accident alarm system.

SHINE Response For maintenance or other conditions which would render the CAAS temporarily out-of-service, SHINE has established the following compensatory measures to ensure that an equivalent level of safety is ensured:

1. Temporary criticality detection equipment with audible alarms will be used for personnel remaining in or entering the affected area, and

2. Personnel access to the affected area will be limited to essential activities.

Page 5 of 22

SHINE has revised Subsection 6b.3.3.2 of the FSAR to describe the compensatory measures SHINE puts in place in the event that the CAAS is temporarily out-of-service. A mark-up of the FSAR incorporating these changes is provided as Attachment 1.

RAI CE-5 Paragraph (b)(1) of 10 CFR 70.24 requires that each licensee authorized to possess specified amounts of special nuclear material to [p]rovide the means for identifying quickly which individuals have received doses of 10 rads or more. Section 6b.3.1.8.1, Planned Response to Criticality Accidents, of the FSAR states that SHINE maintains an emergency plan, which includes the planned response to criticality accidents. Section 8.6.2, Assembly, of the SHINE Emergency Plan states that SHINE has the capability of quickly identifying individuals that may have received a dose of 10 rads or more via the electronic dosimeters worn by personnel in the radiological controlled area (RCA). However, no information is provided as to whether SHINE has the capability to quickly identify individuals that may have received a dose of 10 rads or more outside of the RCA consistent with 10 CFR 70.24(b)(1).

Discuss the method in which SHINE quickly identifies individuals that have received a dose of 10 rads or more outside of the RCA, or clarify that it is not credible for individuals outside of the RCA to receive a dose of 10 rads or more due to a criticality accident.

This information is necessary for the NRC staff to make the necessary evaluation findings described in the ISG augmenting NUREG-1537, Part 2, Section 6b.3. Specifically, the requested information will support the NRC staff in concluding that SHINEs nuclear criticality safety program provides reasonable assurance of the protection of the public health and safety, including that of workers.

SHINE Response SHINE has performed an analysis to define the perimeter of the area where an individual has the potential to receive a dose of 10 rads or more due to a criticality accident. This analysis postulates a criticality accident occurring in the uranium receipt and storage system (URSS) room, which would be the bounding event for the facility with respect to criticality accident dose outside the radiologically controlled area (RCA). The analysis is performed in a conservative manner, using a bare uranium metal criticality (bounding a solution criticality) and credits only the concrete structure for shielding.

The perimeter determined by the analysis is located entirely within the controlled access area (CAA) of the facility. Personnel will be trained on the significance of this perimeter upon being granted unescorted access to the facility.

If a criticality accident were to occur, individuals would evacuate the facility upon hearing the CAAS actuation and assemble at a designated assembly location. The assembly area used after evacuation for a criticality accident is the storage building, which is located outside of the defined perimeter. Individuals who were located within the defined perimeter when the CAAS actuated will be assumed to have received 10 rads or more until proven otherwise via reading of their issued dosimetry.

Page 6 of 22

Chapter 13 - Accident Analyses RAI 13-14 Many of the SHINE DBAs discuss programmatic administrative controls that describe actions that are required to either prevent an accident from occurring or credit recovery actions to stop further release and dispersion of radioactive material. However, there are no references to these documents or discussions as to how they are controlled through SHINEs TS Administrative Controls. Additionally, none of the accidents list programmatic controls.

Examples include:

1. For accidents resulting in a tritium release, SHINE credits recovery actions after 10-days to stop releases to the environment, indicating facility personnel would be trained to perform such actions.

2. For all accidents resulting in a release of radioactive material, SHINE credits a 10-minute evacuation time, indicating facility personnel would be trained to evacuate the immediate area upon actuation of the radiation alarms.

3. Consistent with the SHINE Design Criterion for the Control Room, SHINE credits the control room operators being present for the duration of the accident but provides no referenced procedure indicating control room operators are properly trained to respond to the accident as well as to not evacuate.

4. SHINE credits facility workers to resupply the nitrogen purge system tanks after 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> over a period of 30 days, indicating facility personnel would be trained to refill these tanks.

5. SHINE credits prevention of heavy load drops in part due to crane operation procedures which include safety load paths to avoid the radioactive liquid waste immobilization (RLWI) enclosure and supercell and required suspension of supercell and RLWI activities during a heavy lift. However, there is no reference to these procedures.

6. SHINE credits prevention of operator errors during the TSV system fill process, which limit the size of the solution addition steps. However, this is no reference to these procedures.

For each design-basis accident that discusses a procedure intended to prevent or mitigate the event, provide a reference and a discussion of how it is controlled through SHINEs TS Administrative Controls. Also, describe within the accident analysis how the procedure for recovery actions would be executed.

This information is necessary for the NRC staff to make the necessary evaluation findings described in the ISG augmenting NUREG-1537, Part 2, Section 13a.2. Specifically, the requested information will support the NRC staff in concluding that doses to the public are within acceptable limits, and the health and safety of the licensee staff and public are adequately protected.

SHINE Response The descriptions of the design basis accidents in Chapter 13 of the FSAR include a listing of the credited safety controls for each event. A number of the scenarios described in Chapter 13 also Page 7 of 22

assume the existence or performance of administrative or personnel actions that had not been specifically credited in the Chapter 13 accident sequence descriptions.

SHINE has revised the SHINE Safety Analysis (SSA) to specifically credit these actions as specific administrative controls (SACs). SHINE has additionally revised the following subsections of Chapter 13 of the FSAR to include identification of the listed administrative or personnel actions which are credited in the SSA to prevent or mitigate the consequence of the event. A mark-up of the FSAR incorporating these changes is provided as Attachment 1.

Subsection 13a2.2.3 (Reduction in Cooling) o Verification of light water pool level prior to entering Mode 1 Subsection 13a2.2.4 (Mishandling or Malfunction of Target Solution) o Facility personnel evacuate the immediate area within 10 minutes after receipt of electronic dosimeter or local radiation alarms Subsection 13a2.2.5 (Loss of Off-Site Power) o Nitrogen in the nitrogen purge system (N2PS) is refilled every 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> while in use o Verification of light water pool level prior to entering Mode 1 Subsection 13a2.2.6 (External Events) o Facility personnel evacuate the immediate area within 10 minutes after receipt of electronic dosimeter or local radiation alarms Subsection 13a2.2.7 (Mishandling or Malfunction of Equipment) o Facility personnel evacuate the immediate area within 10 minutes after receipt of electronic dosimeter or local radiation alarms Subsection 13a2.2.9 (Detonation and Deflagration affecting the Primary System Boundary) o Nitrogen in the N2PS is refilled every 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> while in use Subsection 13a2.2.12.1 (Tritium Release into an IU Cell) o Facility personnel evacuate the immediate area within 10 minutes after receipt of electronic dosimeter or local radiation alarms Subsection 13a2.2.12.1 (Additional Neutron Driver Assembly System [NDAS] Scenarios) o NDAS operating procedures require evacuation of deuterium and tritium from the NDAS and isolation of the deuterium and tritium supplies to the IU while in maintenance o Proper installation of IU cell shielding following IU cell access is verified before operation of the neutron driver o NDAS service cell (NSC) procedures prevent inadvertent operation of the NDAS while personnel are in the NSC Subsection 13a2.2.12.2 (Tritium Release into the Tritium Purification System Glovebox) o Facility personnel evacuate the immediate area within 10 minutes after receipt of electronic dosimeter or local radiation alarms o Tritium release event recovery actions are completed within 10 days Page 8 of 22

Subsection 13b.2.4.1 (Spill of Target Solution in the Supercell) o Target solution decay time requirements o Facility personnel evacuate the immediate area within 10 minutes after receipt of electronic dosimeter or local radiation alarms Subsection 13b.2.4.2 (Spill of Eluate Solution in the Supercell) o Facility personnel evacuate the immediate area within 10 minutes after receipt of electronic dosimeter or local radiation alarms Subsection 13b.2.4.3 (Spill of Target Solution in the radioisotope production facility [RPF] Pipe Trench) o Target solution decay time requirements o Facility personnel evacuate the immediate area within 10 minutes after receipt of electronic dosimeter or local radiation alarms Subsection 13b.2.4.4 (Spill of Target Solution from a Tank) o Target solution decay time requirements o Facility personnel evacuate the immediate area within 10 minutes after receipt of electronic dosimeter or local radiation alarms Subsection 13b.2.4.5 (Spill of Waste Solution in radioactive liquid waste immobilization [RLWI])

o Facility personnel evacuate the immediate area within 10 minutes after receipt of electronic dosimeter or local radiation alarms Section 13b.3 (Analyses of Accidents with Hazardous Chemicals) o Personnel evacuate within 2 minutes after chemical spills within the URSS and target solution preparation system (TSPS) rooms The directions for performing or ensuring the performance of credited administrative or personnel actions are contained within standard operating procedures performed by or under the direction of licensed operators, maintenance procedures, or emergency response procedures. The content of these procedures is controlled in accordance with Section 5.4 of the technical specifications.

Licensed operators are trained and qualified to perform their duties in accordance with Section 5.5.2 of the technical specifications.

Personnel assigned to perform safety-related maintenance activities are trained and qualified to perform those activities.

Emergency response procedures include instructions for personnel evacuation, refilling of the N2PS system during use, and completion of tritium release recovery actions within 10 days.

The SHINE facility will have an emergency response organization (ERO), as described in the Emergency Plan. Members of the ERO will receive training in accordance with the requirements of the plan, to include recovery actions required by the SSA. Control room operators are members of the on-site ERO and receive training on the emergency plan and emergency response actions.

Page 9 of 22

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)

Individuals who have been granted unescorted access to the SHINE facility will receive training on facility evacuation, including the different alarms (e.g., fire, criticality accident, and radiation) that could be actuated, evacuation routes, and assembly areas. The assembly area for control room operators is the control room. Visitors who may be present in the facility will be escorted at all times and will receive a briefing on actions to take during an emergency.

RAI 13-15 For those accidents that release fission products to the light water pool system, the iodine dissolved in the pool water is credited for partitioning according to the pool pH, temperature, pool volume, and gas volume. The SHINE TSs specificity controls for a minimum water level and maintained temperatures. However, limiting conditions of operation for the light water pool pH are not provided.

a. Provide the TS limiting conditions of operation of the light water pool pH which is credited for iodine partitioning within the DBA.

b. Confirm from the calculations supporting the iodine partitioning factor assumption utilize the most limiting parameters for pool pH, temperature, pool volume, and gas volume.

This information is necessary for the NRC staff to make the necessary evaluation findings described in the ISG augmenting NUREG-1537, Part 2, Section 13a.2. Specifically, the requested information will support the NRC staff in concluding that doses to the public are within acceptable limits, and the health and safety of the licensee staff and public are adequately protected.

SHINE Response

a. A limiting condition for operation (LCO) for the light water pool pH is not needed based on the bounding nature of the pH used in the radiological dose calculation, as described in SHINE Response to RAI 13-15(b).

b. During preparation of this response, it was identified that while bounding relative to nominal conditions, the radiological dose calculation had not utilized the most limiting values for the parameters listed. The radiological dose calculation has been revised to utilize the most limiting parameters, as described below:

The pool pH of [ ]PROP/ECI used in the revised radiological dose calculation bounds the minimum pool pH calculated. The minimum pool pH of [ ]PROP/ECI was calculated using the bounding low pool volume at bounding low pool pH mixed with the bounding high target solution volume at a bounding low pH. Calculations also show that the final pH is insensitive to the initial pH of the light water pool. Because of the bounding nature of the pool pH used in the radiological dose calculation and the insensitivity to the initial pool pH, it is not necessary to include the pH of the light water pool as an LCO in the technical specifications.

The pool temperature used is 35°C, the maximum light pool water temperature during steady state operation.

Page 10 of 22

The pool volume used is 67,200 liters, the volume corresponding to a pool depth of 14 feet. This pool depth is consistent with the minimum light water pool level allowed by LCO 3.3.1 of the technical specifications and the limiting physical configuration with respect to radiological dose.

The gas space used is 55.2 cubic meters (m3), the volume corresponding with the limiting physical configuration with respect to radiological dose. Bounding high volumes were used when accounting for equipment located above the pool, resulting in a conservatively low gas volume. A conservatively low surface area in the gas space was also used in calculating removal from iodine deposition.

SHINE has revised Tables 13a2.2-1, 13a2.2-2, and 13a3-1 of the FSAR to incorporate the results of the revised radiological dose calculation. A mark-up of the FSAR incorporating these changes is provided as Attachment 1.

RAI 13-16 The primary confinement boundary contains the primary system boundary, which contains the fission products. The primary confinement boundary is primarily passive, and the boundary for each IU is independent from the others. During normal operations, the primary confinement boundary is operated within a normally-closed atmosphere without connections to the facility ventilation system; except through the primary closed loop cooling system expansion tank. The IU and TOGS shielded cells are equipped with removable shield plugs which allow entry into the confined area. Gaskets and other non-structural features are used, as necessary, to provide sealing where separate structural components meet.

All of SHINEs design-basis accidents that result in fission product or tritium releases to the primary confinement boundary credit leak path factors found in SHINE calculation CALC-2018-0048, Rev. 6, which subsequently references calculations from the document FAI/19-0035 Rev. 1. It is unclear from the analyses whether the shield plugs will perform their intended sealing function, as described.

a. Provide information on the reliability and performance of the shield plugs to prevent and mitigate the release of radioactive material. Additionally, clarify whether flow versus pressure drop in shield plug will be verified by pressurizing primary confinement boundary. Indicate whether this is specified in TSs. If not, provide a justification for not specifying.

A review of SHINEs TSs, Section 3.4, Confinement, does not specify a maximum allowable leakage rate.

b. Provide the primary confinement boundary maximum allowable leakage rate and its limiting condition of operation.

SHINE refers to documents pertaining to the facility configuration management and maintenance systems which would ensure the reliability and integrity of the primary confinement boundary components to mitigate radiological consequences under postulated accident conditions. These documents are not listed or referenced. For example, it is unclear if there is a program to test and inspect the shield plug gaskets.

Page 11 of 22

c. Provide a reference to the primary confinement boundary shield plug gaskets maintenance procedure(s) and a discussion of how this activity is controlled through SHINEs TS Administrative Controls program.

This information is necessary for the NRC staff to make the necessary evaluation findings described in the ISG augmenting NUREG-1537, Part 2, Section 13a.2. Specifically, the requested information will support the NRC staff in concluding that doses to the public are within acceptable limits, and the health and safety of the licensee staff and public are adequately protected.

SHINE Response

a. Shield plug performance will be verified during startup testing in accordance with approved startup test plans. This testing will be done by slightly pressurizing the confinement and verifying that leakage rates are within acceptance criteria based on the analytical limits described in the SHINE Response to RAI 13-16(b).

The reliability of the shield plugs will be verified via periodic inspection and testing in accordance with the technical specifications. The shield plugs will be leak checked upon each reinstallation. See the SHINE Response to RAI 13-16(b) for a discussion of the technical specification considerations regarding the periodic inspection and testing of the shield plugs.

b. The analytical limit for leak rate out of the IU cell is 6E+04 standard cubic centimeters per minute (sccm) at 0.5 Kilopascal (kPa) differential pressure. The analytical limit for leak rate out of the TOGS cell is 4E+04 sccm at 24 inches of water column (6 kPa) differential pressure.

SHINE has revised Section 3.4 of the technical specifications to include an LCO for the primary confinement boundary. The IU cell and TOGS cell shield plugs will be leak checked to verify operability upon each installation of the shield plugs in accordance with LCO 3.4.5 surveillance requirements. A mark-up of the technical specifications incorporating these changes is provided as Attachment 2.

c. The primary confinement boundary shield plug gaskets will be maintained in accordance with SHINEs Maintenance Program, and will be inspected, repaired, and replaced in accordance with approved maintenance procedures. The content of these procedures is controlled in accordance with Section 5.4 of the technical specifications.

RAI 13-19 As part of its January 29, 2021, RAI response, SHINE indicated a distinction between safety-related controls and programmatic administrative controls, the SSA and Chapter 13 of the FSAR appear to cite procedures, maintenance, inspection and testing as safety-related controls to prevent or mitigate accident sequences. According to SHINEs definition of programmatic administrative controls and reliability management measures, SHINE establishes quality assurance elements like procedures, maintenance, inspection and testing to ensure safety-related controls are available and reliable and function, as intended. Therefore, programmatic administrative controls should not be credited as safety controls to prevent or mitigate accident sequences. Below are examples of SHINE crediting programmatic administrative controls as safety controls.

Page 12 of 22

Accident sequence 13a2.1.12-A in the SSA. Maintenance, inspection and testing appear to be credited as preventive safety-related controls. According to SHINEs definition of programmatic administrative controls, maintenance, inspection and testing should be programmatic administrative controls, not preventive safety-related controls.

Accident sequence 13b.2.7-A in the SSA. Maintenance and inspection appear to be credited as a preventive safety-related control. According to SHINEs definition of programmatic administrative controls, maintenance, inspection and testing should be programmatic administrative controls, not preventive safety-related controls.

Tritium Purification System Accident Scenario 2. Maintenance, inspection, and testing appear to be credited as defense-in-depth safety-related controls. According to SHINEs definition of programmatic administrative controls, these procedures should be programmatic administrative controls, not preventive safety-related controls.

Revise Chapter 13 of the FSAR and the SSA to consistently refer to programmatic administrative controls and reliability management measures as quality assurance measures instead of as safety-related controls. Revisions to Chapter 13 of the FSAR and the SSA to remove programmatic administrative controls and reliability management measures as safety-related controls may require designating new safety-related controls that prevent or mitigate the associated accident sequences.

This information is necessary for the NRC staff to make the necessary evaluation findings described in the ISG augmenting NUREG-1537, Part 2, Section 13a.2. Specifically, the requested information will support the NRC staff in concluding that doses to the public are within acceptable limits, and the health and safety of the licensee staff and public are adequately protected.

SHINE Response SHINE makes a distinction between programmatic administrative controls (i.e., reliability management measures) and safety-related SACs in both the FSAR and the SSA.

Programmatic administrative controls are identified in Section 5 of the technical specifications and include items such as control of procedures, maintenance of safety-related structures, systems, and components (SSCs), training and qualification, and the configuration management program. Programmatic administrative controls provide the framework for required activities at the SHINE facility to ensure that safety-related SSCs remain available and reliable, and to ensure that activities required by those programs are completed correctly and completely. For example, the programmatic administrative control related to procedures stipulates that procedures for specified types of activities in the SHINE facility shall exist, that they shall be prepared, reviewed, and approved by appropriate management, and that changes to the procedures shall also be controlled.

Conversely, SACs are particular, identified, human actions relied on to prevent or mitigate the consequences of accidents. A SAC may be one or more specific steps in a procedure, but it is not the procedure itself. Programmatic administrative controls are used to ensure that these credited actions (the SACs) are performed correctly and completely (e.g., by providing personnel written directions for accomplishing the action in the form of reviewed, approved procedures, or by providing training to the personnel tasked with performing those actions).

Page 13 of 22

To better clarify the distinction between programmatic administrative controls and SACs, SHINE has revised the SSA to clearly identify the specific actions that are credited as SACs. No programmatic administrative controls are credited as safety controls to prevent or mitigate identified accident sequences in the SSA.

SHINE has reviewed Chapter 13 of the FSAR and confirmed that no programmatic administrative controls are credited as safety controls to prevent or mitigate the identified design basis accidents.

RAI 13-20 As part of its January 29, 2021, RAI responses, SHINE submitted tables outlining the justification for certain passive engineered safety-related controls (PECs), including pipes, floor drains, and vault seals, to have failure probability indices (FPINs) of -4. Although guidance in NUREG-1520, Revision 2, Standard Review Plan for Fuel Cycle Facilities License Applications, indicates that -4 is an option, it is caveated by a statement that -4 can rarely be justified. Furthermore, it has been shown that seismically designed pipes leak and floor drains and vault seals fail at probabilities greater than 10-4.

Provide the engineering calculations (or other technical justification) or documented operating experience for single PECs or safe by design controls that resulted in crediting those controls with FPINs of -4. If engineering calculations or documented operating experience does not support applying FPINs of -4 or less, indicate the accident sequences and associated safety-related controls that will change. Alternatively, confirm that there are no single PECs or safe by design controls with FPINs of -4 or less.

This information is necessary for the NRC staff to make the necessary evaluation findings described in the ISG augmenting NUREG-1537, Part 2, Section 13a.2. Specifically, the requested information will support the NRC staff in concluding that doses to the public are within acceptable limits, and the health and safety of the licensee staff and public are adequately protected.

SHINE Response Accident scenarios with single passive engineered controls (PECs) assigned a failure probability index number (FPIN) of -4 in the SSA were reviewed. Table 13-20-1 provides a description of the SSA revisions made for each accident scenario where assignment of an FPIN of -4 to a single PEC could not be justified, or provides reference to the engineering calculation or technical document that provides justification for the continued use of an FPIN of -4. Where assignment of an FPIN of -4 could not be justified, additional safety-related controls were applied in the SSA, as necessary, to ensure an acceptable risk level is achieved.

SHINE has revised Subsections 13a2.1.4.2, 13a2.2.3.3, and 13a2.2.5.3 of the FSAR to identify additional safety controls credited in the accident sequences resulting from the above-described review. A mark-up of the FSAR incorporating these changes is provided as Attachment 1.

Page 14 of 22

Security-Related Information - Withheld from public disclosure under 10 CFR 2.390(d)

Table 13-20-1: Disposition for Controls Previously Applying FPIN = -4 (Sheet 1 of 2)

Page 15 of 22

Security-Related Information - Withheld from public disclosure under 10 CFR 2.390(d)

Table 13-20-1: Disposition for Controls Previously Applying FPIN = -4 (Sheet 2 of 2)

Page 16 of 22

RAI 13-22 Paragraph (b)(6) of 10 CFR 50.34 requires the FSAR to include:

i. [t]he applicants organizational structure, allocations or responsibilities and authorities, and personnel qualifications requirements; ii. managerial and administrative controls to be used to assure safe operation; iii. plans for preoperational testing and initial operations; iv. plans for conduct of normal operations, including maintenance, surveillance, and periodic testing of structures, systems and components;

v. plans for coping with emergencies, which shall include items specified in appendix E; and vi. proposed TSs prepared in accordance with the requirements of § 50.36.

This type of information forms the basis for safety programs that identify and manage the spectrum of hazards at the applicants facility including chemical hazards. Chemical safety is specifically discussed in the ISG augmenting NUREG-1537, Part 1, as follows:

Section 4b.4.2, Processing of Unirradiated Special Nuclear Material, states that the application should provide chemical accident prevention measures as appropriate.

Section 12.1.6, Production Facility Safety Program, states that the radioisotope production facility must have an established safety program that includes chemical hazards.

Section 13b.3, Analyses of Accidents with Hazardous Chemicals, states that the analyses of accidents for the production facility should include chemical hazards.

Section 14b, Radioisotope Production Facility Technical Specifications, states that the TSs should consider chemical hazards.

TS, Section 5.5.1, Nuclear Safety Program, states, in part, the following: The SHINE nuclear safety program documents and describes the methods used to minimize the probability and consequences of accidents resulting in radiological or chemical release.

TS, Section 5.5.8, Chemical Control, states the following:

The SHINE chemical control program ensures that on-site chemicals are stored and used appropriately to prevent undue risk to workers and the facility. The chemical control program implements the following activities, as required by the accident analysis:

1. Control of chemical quantities permitted in designated areas and processes;

2. Chemical labeling, storage and handling; and

3. Laboratory safe practices.

However, there is no description in the FSAR about how the nuclear safety program or chemical control program identifies and manages chemical hazards.

a. Provide a description of the activities associated with the nuclear safety program and chemical control program that minimize the probability and consequences of accidents Page 17 of 22

resulting in a hazardous chemical release for chemical hazards that are under NRCs regulatory jurisdiction. Additionally, provide an explanation regarding the relationship between the nuclear safety program and the chemical control program as it relates to the identification and management of chemical hazards under NRCs regulatory jurisdiction.

b. The FSAR does not clearly indicate the identification and management of chemical hazards that are under NRCs regulatory jurisdiction. Specific examples of activities that are identified in the FSAR and might be elements of the nuclear safety program that contributes to the identification and management of chemical hazards under NRCs regulatory jurisdiction include:

i. Hazard identification and analysis. The response to RAI 13-5, along with the revision of Section 13a2 of the FSAR, states that the SSA methodology includes the identification and evaluation of chemical hazards under NRCs regulatory authority and the identification of controls where necessary to meet the safety criteria limits defined in Section 3.1 of the FSAR. Clarify whether the SSA is one of the elements of the nuclear safety program that contributes to the identification and management of chemical hazards under NRCs regulatory jurisdiction.

ii. Review and audit function. The SHINE FSAR discusses the review and audit function discussed in Section 5.2, Review and Audit, of the TSs. The discussion mentions radiological hazards but does not mention chemical hazards. Clarify whether the audit function applies to chemical hazards. If it does apply, specify whether the audit verifies that assumptions used as input to the safety analysis (e.g., chemical inventory limits) are implemented and that controls developed from the safety analysis are implemented.

Specify whether there is a minimum frequency for the audit of the chemical safety aspects of the nuclear safety program.

iii. Procedures. The SHINE FSAR discusses its commitment to procedures in Section 5.4, Procedures, of the TSs. Clarify whether the SHINE commitment to procedures include its use for implementing the chemical safety aspects of its nuclear safety program and implementing controls identified as being important for the management of chemical hazards under NRCs regulatory jurisdiction.

iv. Training and qualification. The SHINE FSAR discusses its commitment to training and qualifications in Section 5.5.2, Training and Qualification, of the TSs. Clarify whether the SHINE commitment to training and qualification applies to personnel involved in the management of chemical hazards that are under NRCs regulatory jurisdiction.

v. Configuration management. The SHINE FSAR discusses its commitment to configuration management in Section 5.5.4, Configuration Management, of the TSs.

Clarify whether the SHINE commitment applies to changes that influence the management of chemical hazards that are under NRCs regulatory authority.

vi. Special Reports. The SHINE FSAR discusses its commitment to the preparation of Special Reports in Section 5.8.2, Special Reports, of the TSs. Clarify whether the SHINE commitment includes the preparation of reports following incidents involving chemical hazards that are under NRCs regulatory jurisdiction.

This information is necessary for the NRC staff to make the necessary evaluation findings described in the ISG augmenting NUREG-1537, Part 2, Section 13b.2. Specifically, the Page 18 of 22

requested information will support the NRC staff in concluding that SHINE adequately described and assessed accident consequences that could result from the handling, storage, or processing of licensed materials and that could have potentially significant chemical consequences and effects.

SHINE Response

a. SHINE considers chemical hazards of licensed material and hazardous chemicals produced from licensed material, as well as chemical hazards that could affect the safety of licensed materials and thus present an increased radiological risk (e.g., a chemical hazard that incapacitates operators and prevents their entry into an area of the facility where licensed materials are handled), to be those chemical hazards that are under the NRCs regulatory jurisdiction.

The probability and consequences of accidents resulting in a hazardous chemical release for chemical hazards that are under the NRCs regulatory jurisdiction are minimized by considering such chemical hazards in the SSA, as described in Section 13a2 of the FSAR.

The SSA includes, in part, the identification of chemical hazards, identification of potential chemical consequences to the public or facility staff, and identification of preventive and mitigative safety-related controls. The SSA is a programmatic element of the nuclear safety program.

SHINE also maintains a quantitative hazardous chemical consequence assessment for chemical hazards within the NRCs regulatory jurisdiction as part of the nuclear safety program.

Chemical hazards associated with licensed material and hazardous chemicals produced from licensed material are managed via the application of the SSA and are described in Section 13b.3 of the FSAR. These chemical hazards are excluded from the chemical control program and are instead entirely evaluated and managed under the nuclear safety program.

Safety-related controls related to these chemical hazards are incorporated into technical specifications (see the SHINE Response to RAI 13-23).

Chemical hazards that could affect the safety of licensed materials and thus present an increased radiological risk (i.e., hazards related to chemicals stored on site) are evaluated under the SHINE nuclear safety program, as described above. However, specific administrative controls (e.g., volume limitations and storage segregation) resulting from the evaluation of these chemical hazards are implemented via the chemical control program.

The chemical hazards associated with on-site storage of chemicals are described in Subsection 2.2.3.1.3.4 of the FSAR.

SHINE has revised Section 13b.3 of the FSAR to clarify the identification and management of chemical hazards that are under the NRCs regulatory jurisdiction. A mark-up of the FSAR incorporating these changes is provided as Attachment 1.

b. i. The application of the SSA methodology is the mechanism SHINE uses for the identification of chemical hazards under the NRCs regulatory jurisdiction. As described in the SHINE Response to Part a., the SSA is a programmatic element of the nuclear safety program.

Page 19 of 22

ii. The review and audit functions described in Section 5.2 of the technical specifications apply to chemical hazards that are under the NRCs regulatory jurisdiction. The following items pertaining to these chemical hazards will be audited by SHINE, in accordance with Section 5.2.4 of the technical specifications:

Facility operations for conformance to the technical specifications and applicable license conditions (including organization and responsibilities, training, operations, procedures, logs and records, health physics, technical specification compliance, and surveillances): at least once per calendar year (interval between audits not to exceed 15 months).

Technical specifications and license conditions applicable to chemical hazards under the NRCs regulatory jurisdiction will be audited as part of this audit item.

The results of action taken to correct those deficiencies that may occur in the production facility equipment, systems, structures, or methods of operations that affect nuclear safety: at least once per calendar year (interval between audits not to exceed 15 months).

Actions involving SSCs or operations impacting chemical hazards under the NRCs regulatory jurisdiction will be audited as part of this audit item.

Verification of implementation of assumptions used as input to the SSA and controls developed from the SSA is done through the configuration management program.

SHINE periodically audits the configuration management program as part of the periodic audit of the Quality Assurance Program Description (QAPD). Periodic audit of the QAPD is performed in accordance with Section 5.2.4 of the technical specifications.

iii. The SHINE commitment to procedures in Section 5.4 of the technical specifications includes those procedures for implementing the chemical safety aspects of its nuclear safety program and implementing controls identified as being important for the management of chemical hazards under the NRCs regulatory jurisdiction. The following procedure topics in Section 5.4.3 of the technical specifications include such procedures:

Maintenance of major components of systems that may have an effect on nuclear safety Administrative controls for operations and maintenance and for the conduct of irradiations that could affect nuclear safety iv. The SHINE commitment to training and qualification in Section 5.5.2 of the technical specifications applies to personnel involved in the management of chemical hazards that are under the NRCs regulatory jurisdiction. Controls identified by the SSA, including controls related to chemical hazards under the NRCs regulatory jurisdiction, are included in the training and qualification programs for licensed operators, as applicable.

v. The SHINE commitment to configuration management in Section 5.5.4 of the technical specifications applies to each change to the SHINE facility, including those changes that influence the management of chemical hazards that are under NRCs regulatory jurisdiction. Controls identified by the SSA, including controls related to chemical hazards under the NRCs regulatory jurisdiction, are included in the configuration Page 20 of 22

management program. See the SHINE Response to RAI 13-23 for additional detail on the maintenance of chemical process safety controls under the configuration management program.

vi. Incidents involving chemical hazards that are under the NRCs regulatory jurisdiction would be reported in accordance with the event reporting requirements of Section 5.8.2 or Section 5.8.3 (see the SHINE Response to RAI 6b.3-23 [Reference 4]) of the technical specifications, as appropriate.

RAI 13-23 Chapter 13 of the FSAR discusses how safety-related controls are incorporated into the FSAR and TSs. However, it does not discuss where in the TSs the limits that are important for the management of chemical hazards under NRCs regulatory authority are presented.

For example, Page 13b.3-3 of the FSAR identifies seismically qualified uranium receipt and storage system uranium storage racks and confinement barriers as important chemical process safety controls. However, these do not appear to be identified as chemical safety controls in the TSs, but they are identified as criticality controls in Table 5.5.4.

Revise the FSAR to clarify the incorporation of chemical safety controls, as identified in Chapter 13 of the FSAR, into the TSs.

This information is necessary for the NRC staff to make the necessary evaluation findings described in the ISG augmenting NUREG-1537, Part 2, Section 13b.2. Specifically, the requested information will support the NRC staff in concluding that SHINE adequately described and assessed accident consequences that could result from the handling, storage, or processing of licensed materials and that could have potentially significant chemical consequences and effects.

SHINE Response The credited chemical process safety controls identified in Section 13b.3 of the FSAR are incorporated into the technical specifications consistent with the incorporation of other safety controls identified in the SSA, as described in Section 13a2 of the FSAR (see Incorporation into the FSAR and Technical Specifications).

SHINE has revised Section 13b.3 of the FSAR to provide clarification related to the incorporation of chemical process safety controls into the technical specifications. A mark-up of the FSAR incorporating these changes is provided as Attachment 1.

SHINE inadvertently incorporated the credited chemical process safety controls identified in Section 13b.3 of the FSAR as criticality safety controls in Table 5.5.4 of the technical specifications. SHINE has revised Table 5.5.4 of the technical specifications to accurately identify these SSA-identified chemical process safety controls as related to chemical safety. A mark-up of the technical specifications incorporating these changes is provided as .

Page 21 of 22

References

1. NRC letter to SHINE Medical Technologies, LLC, SHINE Medical Technologies, LLC -

Request for Additional Information Related to Accident Analysis, Criticality Safety, and Electrical Power Systems (EPID No. L 2019-NEW-0004), dated June 2, 2021 (ML21145A060)

2. SHINE Medical Technologies, LLC letter to the NRC, SHINE Medical Technologies, LLC Application for an Operating License, dated July 17, 2019 (ML19211C143)

3. SHINE Medical Technologies, LLC letter to NRC, Request for Exemption from Criticality Accident Alarm System Monitoring Requirements for the SHINE Irradiation Unit Cells and Material Staging Building, dated January 29, 2021 (ML21029A038)

4. SHINE Medical Technologies, LLC letter to NRC, SHINE Medical Technologies, LLC Application for an Operating License Response to Request for Additional Information, dated July 2, 2021 Page 22 of 22

ENCLOSURE 2 ATTACHMENT 1 SHINE MEDICAL TECHNOLOGIES, LLC SHINE MEDICAL TECHNOLOGIES, LLC APPLICATION FOR AN OPERATING LICENSE RESPONSE TO REQUEST FOR ADDITIONAL INFORMATION FINAL SAFETY ANALYSIS REPORT CHANGES PUBLIC VERSION (MARK-UP) 23 pages follow

Nuclear Criticality Safety in the Chapter 6 - Engineered Safety Features Radioisotope Production Facility 6b.3.3.1 Minimum Accident of Concern The minimum accident of concern (MAC) for the SHINE facility is developed based on a critical sphere of 20 percent enriched uranyl sulfate solution. This system is representative of the majority of operations conducted within the SHINE facility. Process accidents involving solutions are also statistically more likely to occur, based on available historical data.

Detector placement is determined by neutron transport analysis using the MAC. The transport analysis converts the neutron and gamma spectrum of the MAC to a point source which is used with a computer model of the facility structure, shielding, and intervening equipment to determine appropriate detector placements and detection thresholds. The detection thresholds are based on the requirements of 10 CFR 70.24 and the detector response to neutron radiation. Selection of neutron detectors and neutron transport analysis are appropriate for the SHINE facility because the facility contains multiple sources of gamma radiation which could interfere with the operation of the CAAS in a way that would result in an unacceptable number of false alarms.

6b.3.3.2 Criticality Accident Alarm System Design The CAAS will energize visible and audible alarms in the affected area of the main production facilityRPF and in the facility control room if a criticality accident occurs. Mandatory evacuation areas are determined and clearly marked with evacuation routes for areas in which personnel would receive a dose exceeding 12 rads (0.12 grays) in free air. Evacuation routes are selected to ensure personnel are evacuated away from areas with potentially higher dose during a criticality accident.

The CAAS detectors are arranged so that each area outside of the irradiation unit cells in which special nuclear material is used, handled, or stored within the main production facility receives coverage from at least three detectors, which allows a single detector to be taken out of service for maintenance without impact to the operability of the system. Under normal conditions, the detector logic requires that two detectors are needed to trigger an alarm condition, which minimizes the potential for false actuations of the alarm. Protection against latent detector failures during maintenance conditions is achieved by locking in an alarm signal from any detectors which are out of service for maintenance, which reduces the detection requirement to a single detection within the affected zones.

The CAAS employs a logic unit, located in the facility control room, which contains redundant alarm logic to ensure that a latent failure in the logic unit does not preclude an alarm when needed. Electrical power is normally supplied by the facility normal electrical power supply system (NPSS), with a backup connection to the uninterruptible electrical power supply system (UPSS). Batteries are also supplied within the system itself. The system will remain in operation for at least two hours following a facility loss of off-site power, which ensures that operators have sufficient time to secure the movement of fissile material before loss of alarm system coverage.

Portable instruments may be used to provide equivalent coverage in rare circumstances.

Evaluation and deployment of portable instrumentation is managed on a case-by-case basis.

The CAAS is designed to be resistant from anticipated adverse effects such as a fire, explosion, corrosive atmosphere, seismic shock, or other adverse conditions that do not result in evacuation of the entire facility. The system is designed to preclude false alarms due to system failure and contains sufficient fault detection to alert operators as needed during failures.

SHINE Medical Technologies 6b.3-22 Rev. 4

Nuclear Criticality Safety in the Chapter 6 - Engineered Safety Features Radioisotope Production Facility For maintenance or other conditions which would disable multiple detectors or the logic unit, administrative controls are used to secure the movement of fissile material and limit personnel access to the affected areas until alarm system coverage is restoredthe following compensatory measures are implemented to ensure an equivalent level of safety:

• Temporary criticality detection equipment with audible alarms will be used for personnel remaining in or entering the affected area, and

• Personnel access to the affected area will be limited to essential activities.

These administrative controlscompensatory measures are specific to the various processes within the RPFaffected area of the main production facility and include shortprovide a time allowances to restore the system to full operation in lieu of immediate process shutdown in areas where process shutdown creates additional risk to personnel.

6b.3.4 TECHNICAL SPECIFICATIONS The controls required to maintain the criticality safety basis are contained in the SHINE technical specifications.

SHINE Medical Technologies 6b.3-23 Rev. 4

Chapter 7 - Instrumentation and Control Systems Process Integrated Control System Interlocks and Permissives The PICS provides permissive signals to the NDAS control system to:

• Allow the use of the control room NDAS control station, specific to each NDAS unit.

• Allow the control room NDAS control station to transition a specific NDAS unit to Beam On status.

• Allow the use of the local NDAS control station.

Removal of the PICS permissive signal for Beam On operation causes the beam to deenergize.

The PICS additionally provides interlocks and permissives to:

• Prevent the transition of an NDAS unit to Beam On when the NFDS source range count rate is below an allowable value.

• Allow the transition from Mode 1 to Mode 2 only when the NDAS is in Standby.

• Allow the transition from Mode 2 to Mode 3 only when the NDAS is not in Beam On.

• Allow the transition from Mode 3 to Mode 4 only when the NDAS is not in Beam On.

• Allow the transition from Mode 4 to Mode 0 only when the NDAS is not in Beam On.

Indication to the operator is provided on the PICS operator workstation displays when an interlock or permissive is bypassed.

7.3.1.1.6 Neutron Flux Detection System The NFDS monitors the neutron flux in the IU during all modes of operationTSV fill and irradiation. The NFDS is described in Section 7.8.

Monitoring and Alarms The PICS receives input from the TRPS for monitoring and provides alarms for source range neutron flux (Subsection 7.4.4.1.1), wide range neutron flux (Subsection 7.4.4.1.4), and power range neutron flux (Subsections 7.4.2.1.2 and 7.4.4.1.3), as described in Subsection 7.8.3.9.

The PICS directly receives discrete signals from the NFDS for source range missing and power range missing faults for the generation of alarms (Subsection 7.8.3.10).

Control Functions None Interlocks and Permissives None 7.3.1.2 Supercell Systems The PICS provides automated and manual control of systems associated with the supercell, which are used to transfer target solution between locations within the facility and extract and SHINE Medical Technologies 7.3-9 Rev. 4

Chapter 13 - Accident Analysis Accident-Initiating Events and Scenarios The protections in place for this scenario isare the configuration of the TSV fill line to prevent significant volume of target solution from backflowing from the TSV into the VTS lift tank and a check valve in the VTS uranium vacuum header. The TSV fill line connects to the TSV with an air gap. The connection is located at the approximate elevation of the TSV overflow lines. The fill line is sloped to allow it to drain after fill operations have occurred. Therefore, no significant volume of target solution will backflow from the TSV to the VTS lift tank in the event of pressurization of the TSV. If target solution were to enter the VTS header, the check valve would prevent the target solution from reaching non-favorable-geometry components in the VTS.

DID measures are also present to mitigate this scenario, which include:

• the VTS vacuum valve to lift tank closes from high liquid level in the lift tank, and

• a drain valve for the buffer tank opens and drains to RLWS if a high level in the buffer tank is detected.

Because of the system characteristics and preventative controls in place, further analysis is not required.

Scenario 6 - Target Solution Leakage within a Valve Pit A pipe or valve failure in the valve pit may be caused by overpressurization due to thermal expansion of target solution in an isolated section of piping. This pipe or valve failure results in leakage of target solution from the system into the valve pit, which subsequently could result in:

(1) increased worker or public dose, or (2) a criticality accident in the valve pit. The protections in place to mitigate the consequences of target solution leakage within a valve pit are: (1) drip pans and drains to the radioactive drain system (RDS), which prevent accumulation of solution within the valve pit and prevent criticality, and (2) valve pit shielding and confinement for fission products that could result from leakage, reducing potential dose to workers and the public, (3)

RDS sump tank liquid detection sensors detect fluid in-leakage, stopping in-process solution transfers within the facility, and (4) radiation monitors on the RVZ1 and RVZ2 building exhausts isolate building ventilation supply and exhaust dampers on high radiation, reducing potential dose to workers and the public.

Because this piping is potentially located in either the IF or the RPF, this event and associated dose consequences is further analyzed in Chapter 13b.

13a2.1.4.3 Accident Consequences The release of target solution from the PSB to the light water pool or connected process systems results in potential radiological exposure to workers and the public. The accident consequences associated with the mishandling or malfunction of target solution are evaluated further in Subsection 13a2.2.4.

13a2.1.5 LOSS OF OFF-SITE POWER A LOOP can occur for a variety of reasons related to the reliability and operation of the transmission system, stress during peak grid load conditions, severe weather effects from high wind, tornado, or ice and snowstorms, a seismic event, or equipment failure in the supplying substation. It may also be a result of failure or malfunction of the facility normal electrical power SHINE Medical Technologies 13a2.1-23 Rev. 5

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)

Chapter 13 - Accident Analysis Accident Analysis and Determination of Consequences TSV dump tank. The light water pool provides passive cooling to the TSV dump tank for the removal of decay heat from the target solution.

Safety Controls The following safety controls prevent a reduction in cooling event and ensure that the target solution in the TSV does not boil:

• TRPS Driver Dropout on loss of PCLS flow and high PCLS temperature

• TRPS IU Cell Safety Actuation on low PCLS flow rate and high PCLS temperature

• Light water pool

• Verification of light water pool level prior to entering Mode 1

• NDAS HVPS trip breakers

• Redundant TSV dump valves 13a2.2.3.4 Damage to Equipment The TRPS is designed to end the event and place the target solution in a safe shutdown condition without the need for operator action. The TRPS also prevents challenges to the integrity of the PSB. No equipment damage results from the postulated reduction in cooling event.

13a2.2.3.5 Radiation Source Terms Analyses show that if the PCLS supply temperature exceeds the operating limit of 77°F (25°C) or the PCLS flow rate is below the operating limit of [ ]PROP/ECI, TRPS indicates an IU Cell Safety Actuation, the target solution is transferred to the TSV dump tank where it is passively cooled by the light water pool, and there is no boiling in the TSV or in the TSV dump tank.

Because the postulated reduction in cooling events do not exceed any design limits or cause damage to the PSB, there is no radiation source term.

13a2.2.3.6 Radiological Consequences Because the postulated reduction in cooling events do not exceed any design limits or cause damage to the PSB, there are no radiological consequences to workers or the public from a reduction in cooling event.

13a2.2.4 MISHANDLING OR MALFUNCTION OF TARGET SOLUTION The bounding scenario analyzed as a DBA for mishandling or malfunction of target solution is a loss of the PSB integrity which results in a release of target solution into the IU cell. This scenario is described in Subsection 13a2.1.4.2 as Scenario 1b.

13a2.2.4.1 Initial Conditions The TSV is operating at 110 percent of its design power limit at the time of the initiating event.

Additional initial accident conditions are described in Subsection 13a2.1.4.1.

SHINE Medical Technologies 13a2.2-10 Rev. 5

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)

Chapter 13 - Accident Analysis Accident Analysis and Determination of Consequences

• RVZ1e IU cell isolation mechanisms

• Holdup volume in the RVZ1e

• Facility personnel evacuate the immediate area within 10 minutes after receipt of electronic dosimeter or local radiation alarms 13a2.2.4.4 Damage to Equipment Chemical and radiological contamination may occur to systems within the IU cell. The contamination does not affect the safety function of the affected systems.

Following isolation of the primary confinement boundary, leakage between the IU cell and the IF is driven primarily by pressure-driven flow caused by N2PS. The IU cell sealing is a significant contributor to the function of the primary confinement boundary and will maintain its function under accident conditions.

The light water pool is required to act as a passive heat sink to remove decay heat from the irradiated target solution. The light water pool is constructed with a stainless steel liner surrounded by concrete and maintains the light water pool water inventory and will not be affected by the release of target solution.

13a2.2.4.5 Radiation Source Terms The initial MAR for this scenario is the TSV target solution inventory at the end of approximately

[ ]PROP/ECI of continuous 30-day irradiation cycles with a [ ]PROP/ECI downtime between cycles. The power level used for the analysis is 137.5 kW, which is 110 percent of design operating power. The entire radionuclide inventory in the TSV is instantaneously released to the light water pool and dispersed uniformly throughout the pool.

The accident source term development is discussed in Section 13a2.2. The RAF model values used in the source term development for the public and worker doses are provided in Table 13a2.2-1 and Table 13a2.2-2, respectively.

Iodine is partitioned by assuming that the iodine present is fully dissolved into the target solution prior to the initiating event and none is present in the gas space of the TSV. Once the event occurs, the iodine is dissolved in the water and partitioned according to the pH of the pool, the temperature of the pool, and the pool and gas volumes. Deposition of iodine on the walls of the IU cell due to the temperature difference of the warm gas and the cold walls is also credited as a removal mechanism. As iodine is deposited on the cell walls, more iodine is evolved from the light water pool and into the gas space. The iodine partitioning determines the transport of volatile iodine out of the pool.

Some radionuclides deposited in the light water pool are released to the gas space as an aerosol when radiolytically-generated hydrogen gas bubbles burst at the pool surface. Radiolysis becomes a long-term source of both non-volatiles and iodine.

Once the MAR is released into the gas space of the IU cell there are several paths through which leakage could occur. The primary leak path will be around the IU cell plug perimeter. Potential leak paths are modeled as a single leakage junction to the IF.

SHINE Medical Technologies 13a2.2-12 Rev. 5

Chapter 13 - Accident Analysis Accident Analysis and Determination of Consequences 13a2.2.4.6 Radiological Consequences The radiological consequences of this accident scenario are determined as described in Section 13a2.2. The results of the determination are provided in Table 13a3-1 and meet the accident dose criteria.

13a2.2.5 LOSS OF OFF-SITE POWER 13a2.2.5.1 Initial Conditions Facility power is being supplied from off-site by the electric utility. The initial conditions for the LOOP event are further described in Subsection 13a2.1.5.1.

13a2.2.5.2 Initiating Event The initiating event is a LOOP resulting in the loss of the normal electrical power supply system (NPSS) function.

13a2.2.5.3 Sequence of Events The sequence of events for an extended LOOP is described in Subsection 13a2.1.5.2.

The facility combustible gas management system described in Chapter 6 is designed to function following a LOOP to disperse the combustible gases that are generated by radiolysis. This system removes combustible gases through the PVVS carbon beds and filters to the environment, through the PVVS alternate vent path.

Safety Controls The safety controls credited for prevention of accidents resulting from a LOOP event are:

• Uninterruptible electrical power supply system (UPSS)

• NDAS HVPS breakers

• TSV dump valves

• Light water pool

• Verification of light water pool level prior to entering Mode 1

• TOGS

• N2PS

• Nitrogen in the N2PS is refilled every 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> while in use

• PVVS alternate vent path

• PVVS carbon guard and carbon delay beds 13a2.2.5.4 Damage to Equipment The LOOP event does not result in any damage to equipment.

The safety-related functions of the equipment supplied by the UPSS are uninterrupted; therefore, the safety-related functions continue to be performed. Irradiation processes stop, and the target solution is drained from operating TSVs to their respective TSV dump tank. Decay heat is SHINE Medical Technologies 13a2.2-13 Rev. 5

Chapter 13 - Accident Analysis Accident Analysis and Determination of Consequences the holdup volume in RVZ1e to prevent radioactive gases from exiting through RVZ1e prior to isolation.

5. Tritium migrates to the IF through the IU cell plugs and is released to the environment.

6. Detection of high radiation in the RCA actuates ventilation dampers between the RCA and the environment and minimizes the transport of radioactive material to the environment.

7. Personal dosimeters, local radiation alarms, and alarms in the facility control room notify facility personnel of radiation leakage.

8. Facility personnel evacuate the immediate area within 10 minutes upon actuation of the radiation alarms.

Radiation transport is driven primarily by barometric breathing between the IU cell and the IF.

The safety-related SSCs in the IU cell do not fail during a seismic event, but the NDAS and its internal components are not safety-related and cannot be relied upon to remain intact following a design basis earthquake.

No operator actions are taken or required to reach a stabilized condition or to mitigate dose consequences.

Safety Controls The safety controls credited for mitigation of the dose consequences for this accident are:

• Primary confinement boundary

• TPS Train Isolation on high TPS target chamber supply pressure or high TPS target chamber exhaust pressure

• Ventilation isolation mechanisms

• Holdup volume in the RVZ1e

• Facility personnel evacuate the immediate area within 10 minutes after receipt of electronic dosimeter or local radiation alarms It is assumed that the primary confinement is intact and performs a mitigation function with respect to radionuclide transport from the IU cells to the IF. The primary confinement boundary components are designed to maintain their integrity under postulated accident conditions and are maintained in accordance with the facility configuration management and maintenance systems.

13a2.2.6.4 Damage to Equipment Failure of the NDAS vacuum boundary does not cause subsequent damage to equipment. While the NDAS vacuum boundary integrity is not seismically qualified to maintain integrity, the NDAS is designed to maintain structural integrity during and following a design basis earthquake.

After the initial IU cell pressurization has reached equilibrium, leakage between the IU cells and the IF is driven primarily by barometric breathing. The leakage between the cells and the IF is not impacted by the accident sequence.

SHINE Medical Technologies 13a2.2-15 Rev. 5

Chapter 13 - Accident Analysis Accident Analysis and Determination of Consequences

6. The TRPS initiates an IU Cell Safety Actuation signal which terminates irradiation operations and isolates the primary confinement boundary. The TRPS signal may be initiated by a TOGS failure or a RVZ1e high radiation signal. The N2PS actuates.

7. The main facility ventilation system (i.e., RVZ2) is isolated by the ESFAS within 30 seconds of detectable accident conditions. Leakage to the environment continues through unfiltered leakage pathways.

8. Personal dosimeters, local radiation alarms, and alarms in the facility control room notify facility personnel of radiation leakage.

9. Facility personnel evacuate the immediate area within 10 minutes upon actuation of the radiation area monitor alarms.

A portion of the gaseous iodine is adsorbed onto the cell walls, while the majority of the available MAR is transported to the IF through pressure-driven flow caused by the N2PS and leakage through the primary confinement boundary. Transport to the environment occurs through penetrations in the RCA boundary.

Safety Controls The safety controls credited for mitigation of the dose consequences for this accident are:

• Primary confinement boundary

• RVZ1e IU cell radiation monitors

• Ventilation isolation mechanisms

• Holdup volume in the RVZ1e

• Facility personnel evacuate the immediate area within 10 minutes after receipt of electronic dosimeter or local radiation alarms It is assumed that the primary confinement boundary is intact and performs a mitigation function with respect to radionuclide transport from the TOGS cell to the IF. The primary confinement boundary components are designed to maintain their integrity under postulated accident conditions and are maintained in accordance with the facility configuration management and maintenance systems.

13a2.2.7.4 Damage to Equipment The TOGS zeolite bed may continue to function following a failure of the TOGS but is not credited for source term reduction following the initiating event. Similarly, under normal operating conditions, the recirculating ventilation in the TOGS cell provides filtration which may reduce dose consequences but is not credited to remain functional under accident conditions. These assumed failures are conservative.

Leakage of the TOGS pressure boundary does not cause subsequent damage to equipment credited for safety.

Following isolation of the primary confinement boundary, leakage between the TOGS cell and the IF is driven primarily by pressure-driven flow caused by the N2PS. The leakage paths between the cell and the IF are not impacted by the accident sequence. The TOGS cell seals are a significant contributor to the function of the primary confinement boundary and maintains its function under accident conditions.

SHINE Medical Technologies 13a2.2-17 Rev. 5

Chapter 13 - Accident Analysis Accident Analysis and Determination of Consequences

3. TRPS detects the loss of flow and executes an IU Cell Safety Actuation and IU Cell Nitrogen Purge.

4. The IU Cell Safety Actuation opens the TSV dump valves and NDAS HVPS breakers, terminating the irradiation process.

5. Hydrogen generation in the TSV and TSV dump tank continues due to radiolysis caused by delayed fission and decay radiation. Hydrogen evolution from solution occurs at an increased rate as solution voids collapse.

6. Within four seconds, N2PS is at full flow to the dump tank. Hydrogen and other gases are vented to PVVS through the combustible gas management system exhaust point. Gases pass through the PVVS carbon guard and carbon delay beds before being exhausted from the building at the safety-related exhaust point.

7. The remaining TOGS blower continues operation for a minimum of five minutes.

8. The combined action of the remaining TOGS blower and N2PS maintains the peak hydrogen concentration less than 7.7 percent; therefore, the peak pressure will not exceed the design pressure of the PSB if a deflagration occurs, and no radiological materials will be released. Detonations cannot occur because this peak concentration is less than the lower detonation limit.

9. As delayed fission and decay of short-lived radionuclides decline, the production and evolution of hydrogen declines following shutdown and draining of the TSV to the TSV dump tank. The N2PS continues to provide sweep gas diluting and removing any remaining hydrogen.

Safety Controls The safety controls credited for prevention of accidents which may cause detonation or deflagration in the PSB are:

• TOGS capable of maintaining hydrogen concentration within design limits, assuming the worst case single active failure following IU trip (see Subsection 4a2.8.6)

• TOGS low-flow trips (TRPS function)

• TOGS oxygen sensor which detect incipient degradation or failure

• TOGS demister high temperature trips (TRPS function), which detect incipient degradation or failure

• N2PS

• Nitrogen in the N2PS is refilled every 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> while in use

• TSV fill line isolation valves mode-permissive interlock

• TSV overflow lines to the TSV dump tank

• TSV dump tank level sensors (TRPS function)

• TSV dump tank low flow sensors (TRPS function)

• TSV target solution dump on dump tank level sensors (TRPS function)

• PCLS expansion tank flame arrestor

• Radiation detection in RVZ1e exit from PCLS expansion tank

• Isolation valves in RVZ1e exit from PCLS expansion tank 13a2.2.9.4 Damage to Equipment If hydrogen deflagration occurs at the peak calculated concentration of 7.7 percent, the PSB remains intact. Damage to other primary system components internal to TOGS in the affected train may occur; however, such damage will not result in any release of radiological material.

SHINE Medical Technologies 13a2.2-20 Rev. 5

Chapter 13 - Accident Analysis Accident Analysis and Determination of Consequences 13a2.2.12.1.1 Initial Conditions Initial conditions for facility-specific events are described in Subsection 13a2.1.12.1.

13a2.2.12.1.2 Initiating Event An internal NDAS vacuum boundary component fails and causes a pressurized release of tritium and SF6 gas into the IU cell. Potential causes of the initiating event are discussed in Subsection 13a2.1.12.2.

13a2.2.12.1.3 Sequence of Events It is assumed that the primary confinement is intact and performs a mitigation function with respect to radionuclide transport from the IU cell to the IF. The primary confinement is designed to maintain its integrity under postulated accident conditions and is maintained in accordance with the facility configuration management and maintenance programs.

1. The initiating event is a vacuum boundary component failure in the NDAS, which instantaneously releases tritium and SF6 gas into the IU cell.

2. The IU cell becomes slightly pressurized due to the mass of released SF6 gas.

3. Tritium is transported into the IF through penetrations in the confinement boundary.

4. Detection of high TPS target chamber supply pressure or high TPS target chamber exhaust pressure actuates the primary confinement boundary isolation valves and an irradiation unit trip within 20 seconds of detection. A sufficient time delay is provided by the holdup volume in RVZ1e to prevent radioactive gases from exiting through RVZ1e prior to isolation.

5. Tritium migrates to the IF through penetrations in the primary confinement boundary and is released to the environment.

6. Detection of high radiation in the RCA actuates ventilation dampers between the RCA and the environment and minimizes the transport of radioactive material to the environment.

7. Personal dosimeters, local radiation alarms, and alarms in the facility control room notify facility personnel of radiation leakage.

8. Facility personnel evacuate the immediate area within 10 minutes upon actuation of the radiation area monitor alarms.

Radiation transport is primarily driven by barometric breathing between the IU cell and the IF.

Safety Controls The safety controls credited for mitigation of the dose consequences for this accident are:

• Primary confinement boundary (IU cell plugs and seals)

• TPS Train Isolation on high TPS target chamber supply pressure or high TPS target chamber exhaust pressure

• IU cell ventilation isolations

• Holdup volume in the RVZ1e

• Facility personnel evacuate the immediate area within 10 minutes after receipt of electronic dosimeter or local radiation alarms SHINE Medical Technologies 13a2.2-25 Rev. 5

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)

Chapter 13 - Accident Analysis Accident Analysis and Determination of Consequences Additional safety controls credited for prevention of consequences of other NDAS scenarios described in Subsection 13a2.1.12.2 are:

• NDAS operating procedures require evacuation of deuterium and tritium from the NDAS and isolation of the deuterium and tritium supplies to the IU while in maintenance

• Proper installation of IU cell shielding following IU cell access is verified before operation of the neutron driver

• NDAS service cell (NSC) procedures prevent inadvertent operation of the NDAS while personnel are in the NSC 13a2.2.12.1.4 Damage to Equipment Failure of the NDAS vacuum boundary does not cause subsequent damage to equipment.

After the initial IU cell pressurization has reached equilibrium, leakage between the IU cells and the IF is driven primarily by barometric breathing. The leakage paths between the cells and the IF are not impacted by the accident sequence.

13a2.2.12.1.5 Radiation Source Terms The initial MAR for this scenario is [ ]PROP/ECI of tritium from the neutron driver assembly in the IU cell.

The accident source term development is discussed in Section 13a2.2. The RAF model values used in the source term development for the public and worker doses are provided in Table 13a2.2-1 and Table 13a2.2-2, respectively.

13a2.2.12.1.6 Radiological Consequences The radiological consequences of this accident scenario are determined as described in Section 13a2.2.

The radiological consequences of this accident scenario are provided in Table 13a3-1 and meet the accident dose criteria.

13a2.2.12.2 Tritium Release into the Tritium Purification System Glovebox A release of the tritium inventory from the TPS is analyzed as a DBA. This accident is described in Subsection 13a2.1.12.3 as TPS Scenario 1. This analysis establishes bounding radiological conditions for a release of tritium due to a TPS process deflagration, release of tritium to the facility stack, and release of tritium from the tritium storage bed.

13a2.2.12.2.1 Initial Conditions Initial conditions for facility-specific events are described in Subsection 13a2.1.12.1.

13a2.2.12.2.2 Initiating Event An event causes a break in the tritium piping and vessels such that the uncontrolled release of the entire tritium in-process inventory occurs within the tritium confinement boundary. The tritium SHINE Medical Technologies 13a2.2-26 Rev. 5

Chapter 13 - Accident Analysis Accident Analysis and Determination of Consequences confinement boundary is described in detail in Section 6a2.2. Potential causes of the initiating event are discussed in Subsection 13a2.1.12.3.

13a2.2.12.2.3 Sequence of Events It is assumed that the tritium confinement boundary is intact and performs a mitigation function with respect to radionuclide transport from the TPS to the IF. The tritium confinement boundary components are designed to maintain their integrity under postulated accident conditions and are maintained in accordance with the facility configuration management and maintenance programs.

1. The initiating event is a seismic event that causes a break in two TPS trains and instantaneously releases the tritium inventory into their respective TPS gloveboxes.

2. For the first 20 seconds, tritium escapes from each of the gloveboxes to the IF through the glovebox pressure control exhaust process vent to RVZ1.

3. The glovebox ventilation shuts down after 20 seconds due to high TPS confinement A/B/C tritium monitors.

4. During the 30 seconds after the initiating event, the TPS room vents to the IF at an elevated rate due to the facility RVZ2 ventilation system.

5. The RVZ2 ventilation damper from the TPS room isolates after 30 seconds due to high TPS confinement A/B/C tritium monitors.

6. The radioactive material is then dispersed throughout the IF and exits the facility to the environment through building penetrations.

7. Personal dosimeters, local radiation alarms, and alarms in the facility control room notify facility personnel of radiation leakage.

8. Facility personnel evacuate the immediate area within 10 minutes upon actuation of the radiation area monitor alarms.

Throughout the accident sequence, the leakage rate between each TPS glovebox and the TPS room is constant. After the TPS room ventilation is isolated, radiation transport is driven by air exchange between each TPS glovebox and the IF. Transport to the environment occurs through RCA boundary leak paths. The accident duration used in this analysis is 10 days, after which it is assumed that recovery actions will have occurred to stop further release and dispersion of radioactive material.

Safety Controls The safety controls credited for mitigation of this accident are:

• TPS room ventilation isolations

• Glovebox pressure control and VAC/ITS ventilation isolations

• TPS confinement A/B/C tritium monitors

• Tritium confinement boundary, as described in Section 6a2.2

• Facility personnel evacuate the immediate area within 10 minutes after receipt of electronic dosimeter or local radiation alarms

• Tritium release event recovery actions are completed within 10 days SHINE Medical Technologies 13a2.2-27 Rev. 5

Chapter 13 - Accident Analysis Accident Analysis and Determination of Consequences Table 13a2.2 Summary of Radiation Transport Terms (Public)

Receptor Activity Fraction (RAF)

Nobles Iodine Non-volatiles Tritium Tritium Accident Category (30-day) (30-day) (30-day) (10-day) (30-day)

Mishandling or Malfunction of Target Solution 1.267.64E- 9.881.16E-1.2930E-03 N/A N/A (Subsection 13a2.2.4) 045 1009 External Events (Subsection 13a2.2.6) N/A N/A N/A N/A 4.07E-04 Mishandling or Malfunction of Equipment 1.41E-03 3.69E-04 0 N/A N/A (Subsection 13a2.2.7)

Facility-Specific Events (Subsection 13a2.2.12)

• Tritium Release into an IU Cell N/A N/A N/A N/A 4.07E-04

• Tritium Release into the Tritium Purification N/A N/A N/A 1.78E-04 N/A System Glovebox SHINE Medical Technologies 13a2.2-28 Rev. 5

Chapter 13 - Accident Analysis Accident Analysis and Determination of Consequences Table 13a2.2 Summary of Radiation Transport Terms (Worker)

Receptor Activity Fraction (RAF) (30 days)

Accident Category Nobles Iodine Non-volatiles Tritium 1.066.43E-Mishandling or Malfunction of Target Solution (Subsection 13a2.2.4) 8.4155E-01 6.497.45E-07 N/A 012 External Events (Subsection 13a2.2.6) N/A N/A N/A 2.87E-01 Mishandling or Malfunction of Equipment (Subsection 13a2.2.7) 9.92E-01 3.23E-01 0 N/A Facility-Specific Events (Subsection 13a2.2.12)

• Tritium Release into an IU Cell N/A N/A N/A 2.87E-01

• Tritium Release into the Tritium Purification System Glovebox 1.08E-01 N/A N/A N/A (10 days)

SHINE Medical Technologies 13a2.2-29 Rev. 5

Chapter 13 - Accident Analysis Summary and Conclusions Table 13a3 Irradiation Facility Accident Dose Consequences Public Worker Dose Dose TEDE TEDE Accident Category (Bounding Scenario) (mrem) (mrem)

Insertion of Excess Reactivity (Subsection 13a2.2.2) No consequences Reduction in Cooling (Subsection 13a2.2.3) No consequences Mishandling or Malfunction of Target Solution (Subsection 13a2.2.4)

• Primary system boundary leak into an IU cell 372440 555771 Loss of Off-Site Power (LOOP) (Subsection 13a2.2.5) No consequences External Events (Subsection 13a2.2.6) 292 588 Mishandling or Malfunction of Equipment (Subsection 13a2.2.7) 727 1940 Large Undamped Power Oscillations (Subsection 13a2.2.8) No consequences Detonation and Deflagration affecting the Primary System Boundary No consequences (Subsection 13a2.2.9)

Unintended Exothermic Chemical Reactions other than Detonation No consequences (Subsection 13a2.2.10)

System Interaction Events (Subsection 13a2.2.11) No consequences Facility-Specific Events (Subsection 13a2.2.12)

• Tritium Release into an IU Cell 37 74

• Tritium Release into the Tritium Purification System Glove 798 1380 Box SHINE Medical Technologies 13a3-2 Rev. 4

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences

4. Leakage of radioactive material from the hot cell to the RPF and the environment through the ventilation dampers occurs, resulting in radiological consequences to workers and the public.

The maximum volume of spilled target solution in this accident scenario is limited by the volume of the vacuum lift tanks and installed piping of the MEPS. The ESFAS shutdown of the VTS prevents additional target solution from entering the hot cell after high radiation has been detected. The analyzed volume of target solution for this scenario is 30 liters, which is conservatively based on the volume of two vacuum lift tanks plus additional pipe volume.

The controls credited for mitigation of the dose consequences for this accident are:

• Supercell confinement boundary

• Radiological ventilation zone 1 (RVZ1) supercell area 2/6/7 radiation monitors

• Hot cell RVZ1 outlet carbon filters (radioiodine)

• Inlet (radiological ventilation zone 2 [RVZ2]) and outlet (RVZ1) ventilation isolation dampers

• MEPS or IXP extraction pump breakers

• VTS vacuum transfer pump breakers

• VTS vacuum break valves

• ESFAS Supercell Isolation function

• ESFAS VTS Safety Actuation function

• Target solution decay time requirements

• Facility personnel evacuate the immediate area within 10 minutes after receipt of electronic dosimeter or local radiation alarms Damage to Equipment The leak of target solution in the supercell does not cause subsequent damage to equipment.

Transport of Radioactive Material The methods used to calculate radioactive material transport are described in Section 13a2.2.

The LPF model terms used in this accident are provided in Table 13b.2-1.

Radiation Source Terms The initial MAR for this scenario is 30 liters of target solution from the IU at [ ]PROP/ECI post-shutdown. The action of the TOGS during this [ ]PROP/ECI period removes more than 67 percent of the iodine present in the solution at shutdown. It is conservatively assumed that 35 percent of the post-shutdown iodine inventory is released to the supercell during the accident. Additionally, partitioning fractions are applied to the noble gases present in target solution. Development of the accident source term for this scenario is discussed further in Section 13a2.2.

Radiological Consequences The radiological consequences of this accident scenario are determined as described in Section 13a2.2. The results of the determination are shown in Table 13b.2-2.

SHINE Medical Technologies 13b.2-3 Rev. 3

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences 13b.2.4.2 Spill of Eluate Solution in the Supercell Initial Conditions At the time of the initiating event, eluate solution in the MEPS eluate tank is spilled onto the floor of the hot cell, releasing radioactive material into the hot cell atmosphere.

Initiating Event An event causes the failure of the MEPS eluate tank, which results in a spill of eluate solution.

Potential initiating events for this scenario and analogous scenarios for the purification and IXP cells are discussed further in Subsection 13b.1.2.3; Scenarios 3, 7, and 13.

Sequence of Events

1. A break in the MEPS eluate tank occurs.

2. Eluate solution spills from the tank into the hot cell, releasing radioactive material into the hot cell and causing the cell to become pressurized to the nominal pressure of the cell drain loop seal.

3. RVZ1 supercell area 3/5/8/10 radiation monitors in the hot cell exhaust ventilation detect high airborne radiation and cause ESFAS to isolate hot cell ventilation.

4. Leakage of radioactive material from the hot cell to the RPF and the environment through the ventilation dampers occurs, resulting in radiological consequences to workers and the public.

The controls credited for mitigation of the dose consequences for this accident are:

• Supercell confinement boundary

• RVZ1 supercell area 3/5/8/10 radiation monitors

• Hot cell RVZ1 outlet carbon filters (radioiodine)

• Inlet (RVZ2) and outlet (RVZ1) ventilation isolation dampers

• ESFAS Supercell Isolation function

• Facility personnel evacuate the immediate area within 10 minutes after receipt of electronic dosimeter or local radiation alarms Damage to Equipment The leak of target solution in the supercell does not cause subsequent damage to equipment.

Transport of Radioactive Material The methods used to calculate radioactive material transport are described in Section 13a2.2.

The LPF model terms used in this accident are provided in Table 13b.2-1.

Radiation Source Terms The initial MAR for this scenario is the extraction column eluate, which contains radionuclides from one entire target solution batch. The initial MAR is partitioned by the extraction column to produce the accident-specific MAR. Accident-specific partitioning factors are applied to the SHINE Medical Technologies 13b.2-4 Rev. 3

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences irradiated target solution batch as described in Section 13a2.2. Development of the accident source term for this scenario is discussed further in Section 13a2.2.

Radiological Consequences The radiological consequences of this accident scenario are determined as described in Section 13a2.2. The results of the determination are provided in Table 13b.2-2.

13b.2.4.3 Spill of Target Solution in the RPF Pipe Trench Initial Conditions A batch of irradiated target solution is being transferred within the RPF pipe trench. The target solution has been irradiated using the assumptions in Section 13a2.2 and has been held for decay in the TSV dump tank for [ ]PROP/ECI.

Initiating Event An event causes a pipe containing target solution to break in the pipe trench. Multiple pipe failures from a seismic event is considered to be highly unlikely because the pipes and their supports are seismically qualified. Therefore, the failure of multiple solution-containing pipes would require the onset of a design basis earthquake concurrent with the failure of multiple passive, seismically-qualified components. Consequently, dose consequences for multiple pipe failures are not evaluated. Potential initiating events for this scenario and the analogous scenario for a spill in a valve pit are discussed further in Subsection 13b.1.2.3; Scenarios 8, 9, and 16.

Sequence of Events

1. A pipe containing target solution within the pipe trench breaks, spilling target solution into the trench.

2. The target solution collects on one of the three drip pans in the trench and drains to the radioactive drain system (RDS).

3. Radioactive material is released into the pipe trench atmosphere.

4. A portion of the released material leaks through the process confinement boundary (trench cover) into the RPF and the environment, resulting in radiological consequences to workers and the public.

The controls credited for mitigation of the dose consequences for this accident are:

• Process confinement boundary (trench or pit cover and cover seal)

• Target solution decay time requirements

• Facility personnel evacuate the immediate area within 10 minutes after receipt of electronic dosimeter or local radiation alarms Additional controls described in Subsection 13b.1.2.3 are provided but not credited in the dose analysis.

Damage to Equipment The leak of target solution into the pipe trench does not cause further damage to equipment.

SHINE Medical Technologies 13b.2-5 Rev. 3

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences

4. A portion of the released material leaks through the process confinement boundary (vault cover) into the RPF and the environment, resulting in radiological consequences to workers and the public.

The controls credited for mitigation of the dose consequences for this accident are:

• Process confinement boundary (tank vault plugs and seals)

• Target solution decay time requirements

• Facility personnel evacuate the immediate area within 10 minutes after receipt of electronic dosimeter or local radiation alarms Additional controls described in Subsection 13b.1.2.3, including drainage of the solution out of the vault via RDS, are provided but not credited in the dose analysis.

Damage to Equipment The leak of target solution into the tank vault does not cause further damage to equipment.

Transport of Radioactive Material The methods used to calculate radioactive material transport are described in Section 13a2.2.

The LPF model terms used in this accident are listed in Table 13b.2-1.

Radiation Source Terms The initial MAR for this scenario is a full batch of target solution from the IU at

[ ]PROP/ECI post-shutdown. The action of the TOGS during the [ ]PROP/ECI hold-up period in the dump tank removes more than 67 percent of the iodine present in the solution at shutdown. It is assumed that 35 percent of the post-shutdown iodine inventory is released to the tank vault during the accident. Additionally, partitioning fractions are applied to the noble gases present in target solution. Development of the accident source term for this scenario is discussed further in Section 13a2.2.

Radiological Consequences The radiological consequences of this accident scenario are determined as described in Section 13a2.2. The results of the determination are shown in Table 13b.2-2.

13b.2.4.5 Spill of Waste Solution in RLWI Initial Conditions A 380-liter batch of waste solution (diluted target solution) is present in the radioactive liquid waste immobilization (RLWI) system immobilization feed tank at the time of the initiating event.

The volume of solution in this scenario is based on the volume of the immobilization feed tank with a conservative scaling factor to account for the highest allowable concentration of radionuclides. The waste solution has been irradiated using the assumptions in Section 13a2.2 and has been held for decay for 35 days post-shutdown. The post-shutdown hold time is based on the minimum hold time needed to reduce waste activity to within dose consequence limits and SHINE Medical Technologies 13b.2-7 Rev. 3

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences establishes an administrative control. Expected hold times for waste solution are significantly longer than 35 days.

Initiating Event An event causes the immobilization feed tank or RLWI system piping containing waste solution to break and leak within the RLWI enclosure. Potential initiating events are discussed further in Subsection 13b.1.2.3; Scenarios 17 and 18.

Sequence of Events

1. The immobilization feed tank breaks and spills waste solution into the RLWI enclosure.

2. The waste solution collects on the floor of the enclosure and leaks into the RPF and environment, resulting in radiological consequences to workers and the public.

The controls credited for mitigation of the dose consequences for this accident are:

• Waste solution holdup times in the radioactive liquid waste storage (RLWS) system before processing in RLWI

• Concentration controls applied to waste solutions

• Heavy load drop controls described in Subsection 13b.1.2.3.

• Facility personnel evacuate the immediate area within 10 minutes after receipt of electronic dosimeter or local radiation alarms Damage to Equipment The leak of waste solution into the RLWI enclosure does not cause further damage to equipment.

Transport of Radioactive Material The LPF and airborne release fraction (ARF) values used in this scenario are set at 1.0 instead of using the LPF model values described in Section 13a2.2. The LPF model terms used in this accident are provided in Table 13b.2-1.

Radiation Source Terms The initial MAR for this scenario is 380 liters of waste solution at 35 days post-shutdown. The concentration of radionuclides for the waste solution is determined by multiplication of the ratio of the maximum uranium concentration permitted in the RLWI system to the nominal uranium concentration of target solution. The action of the TOGS during the [ ]PROP/ECI period when the original target solution was held in the dump tank removes more than 67 percent of the iodine present in the solution at shutdown. It is assumed that 35 percent of the post-shutdown iodine inventory is released to the RLWI enclosure during the accident. Additionally, partitioning fractions are applied to the noble gases present in target solution. Development of the accident source term for this scenario is discussed further in Section 13a2.2.

Radiological Consequences The radiological consequences of this accident scenario are determined as described in Section 13a2.2. The results of the determination are shown in Table 13b.2-2.

SHINE Medical Technologies 13b.2-8 Rev. 3

Chapter 13 - Accident Analysis Analyses of Accidents with Hazardous Chemicals 13b.3 ANALYSES OF ACCIDENTS WITH HAZARDOUS CHEMICALS The probability and consequences of accidents resulting in a hazardous chemical release for chemical hazards that are under NRC regulatory jurisdiction are minimized by considering such chemical hazards in the SHINE Safety Analysis (SSA), as described in Section 13a2.

SHINE has evaluated the potential hazards of chemicals within the main production facility.

These include chemicals that are licensed materials or have licensed materials as precursor compounds, or substances that physically or chemically interact with licensed materials and that are toxic, explosive, flammable, corrosive, or reactive to the extent that they endanger life or health. These include substances that are comingled with licensed material or are produced by a reaction with licensed material. These do not include substances prior to process addition to licensed materials or after process separation from licensed materials (see Subsection 2.2.3.1.3). The analysis is therefore bounding for all hazardous chemicals produced from or comingled with licensed materials.

The hazardous chemical consequence assessment is performed to demonstrate that potential consequences meet the SHINE Safety Criteria, as defined in Section 3.1, for the public and workers (i.e., a radiologically controlled area [RCA] worker and a control room operator). The inventory of in-process hazardous chemicals used at the SHINE facility, compiled by process location and quantity, is provided in Table 13b.3-1.

Chemical Process Descriptions The chemical processes used in the SHINE facility are described in Sections 4b.3, 4b.4, 9a2.2, and 9b.7.

Chemical Accidents Description and Source Term Determination For each of the hazardous chemicals identified in Table 13b.3-1, a release scenario is postulated. Each postulated scenario defines the material at risk (MAR) as the largest quantity present in a single vessel or process location. The MAR may therefore be less than the maximum quantities identified in Table 13b.3-1 (e.g., the total waste stream may be subdivided into multiple tanks). The chemical source term is then evaluated using the following methodology.

The formula for determining the source term (ST), the amount of hazardous material made airborne and respirable, of each chemical release is given by the following formula:

ST = MAR ARF RF DR LPF Where:

• MAR is the material at risk, the quantity of material potentially affected;

• ARF is the airborne release fraction;

• RF is the respiratory fraction;

• DR is the damage ratio, the portion of the MAR affected by the release scenario (conservatively assumed to be 1.0 for all scenarios); and

• LPF is the leak path factor, the proportion of airborne material that leaks out of a building or enclosure. A leak path factor of 0.1 is applied for scenarios that occur in confinements SHINE Medical Technologies 13b.3-1 Rev. 2

Chapter 13 - Accident Analysis Analyses of Accidents with Hazardous Chemicals values for such chemicals. Exceptions are applied to rhodium chloride, uranyl sulfate, and uranyl peroxide, which do not have published PAC values. For these chemicals, acceptance limits were developed using guidance from DOE-HDBK-1046-2016, Temporary Emergency Exposure Limits for Chemicals: Method and Practice (USDOE, 2016).

Three chemical accident scenarios are identified that have the potential to exceed established chemical exposure acceptance limits for workers if safety-related controls are not applied:

• Sulfuric acid: A spill from a subgrade liquid waste collection tank may potentially exceed the control room chemical consequence limit. The subgrade vault is credited as a safety-related control to limit the source term to maintain the peak control room concentration to less than the PAC-2 limit.

• Uranium oxide: A seismic event resulting in the failure or overturning of the uranium receipt and storage system (URSS) uranium oxide storage rack, causing multiple storage can failures. The uranium storage racks are seismically qualified to maintain their structure and position during a seismic event, which prevents the potential chemical exposure. The failure of a single can during transfer or handling operations does not result in chemical dose consequences which exceed acceptance limits.

• Uranium oxide: A spill of uranium oxide powder in the URSS glovebox or target solution preparation system (TSPS) glovebox causes a quantity of the powder to become airborne. The gloveboxes are seismically qualified to maintain their low leakage boundary during a seismic event, which limits the chemical exposure to workers to within acceptable limits.

The acceptance limits established for chemical consequence are that the PAC-1 limit shall not be exceeded for members of the public, and that PAC-2 limits shall not be exceeded for workers.

The results in Table 13b.3-2 show that no chemical consequence exceeds PAC-1 limits at the site boundary or the nearest residence, and no chemical consequence exceeds PAC-2 limits for the worker.

Chemical Process Safety Controls The componentscontrols credited for prevention of the chemical dose consequences are:

• URSS uranium storage racks are seismically qualified to maintain their structure and position during seismic events.

The componentscontrols credited for mitigation of the chemical dose consequences are:

• Confinement barriers (i.e., supercell, gloveboxes, subgrade vaults) are credited for those chemical spill scenarios that occur within a confinement structure as identified in Table 13b.3-2.

• Personnel evacuate within two minutes after chemical spills within the URSS and TSPS rooms.

These credited chemical process safety controls are incorporated into the technical specifications as described in Section 13a2.

SHINE Medical Technologies 13b.3-3 Rev. 2

ENCLOSURE 2 ATTACHMENT 2 SHINE MEDICAL TECHNOLOGIES, LLC SHINE MEDICAL TECHNOLOGIES, LLC APPLICATION FOR AN OPERATING LICENSE RESPONSE TO REQUEST FOR ADDITIONAL INFORMATION TECHNICAL SPECIFICATIONS CHANGES PUBLIC VERSION (MARK-UP) 3 pages follow

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)

LCO 3.4.5 Primary Confinement boundary shield plugs shall be Operable. Primary Confinement boundary shield plugs are Operable if:

1. The shield plug seating surfaces have a proven satisfactory leak rate.

Note - This LCO is applied to each IU independently; actions are only applicable to the IU(s) that fail to meet the LCO during the associated condition(s) of applicability.

Applicability Associated IU in Mode 1, 2, 3, or 4 Action According to Table 3.4.5 SR 3.4.5 1. IU cell primary Confinement boundary shall be verified to be Operable by measuring leak rate past shield plug seating surfaces upon each reinstallation of the IU cell confinement boundary shield plug or inspection port. The IU cell shield plug leak rate must be less than 2.10E+06 sccm at 3.9 psi.

2. TOGS cell primary Confinement boundary shall be verified to be Operable by measuring leak rate past shield plug seating surfaces upon each reinstallation of the TOGS cell confinement boundary shield plug or inspection port. TOGS cell shield plug leak rate must be less than 1.16E+05 sccm at 3.9 psi.

Table 3.4.5 Primary Confinement Boundary Shield Plug Actions Action Completion (per IU) Time

1. If a primary Confinement boundary shield plug is not Operable Place the associated IU in Mode 3 Immediately AND Place the associated IU in Mode 0. [ ]PROP/ECI Page 3.4-7 Revision 45

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)

SR The closure testing and leak testing ensures the continued operability of the dampers and is based on recommendations from ANSI/ANS 15.1-2007.

Basis 3.4.5 LCO This LCO is applied to each IU independently; actions are only applicable to the IU(s) that fail to meet the LCO during the associated condition(s) of applicability.

The primary Confinement boundary is further described in FSAR Subsection 6a2.2.1.1. The primary Confinement boundary is primarily passive, and the boundary for each IU is independent from the other IUs. In the event of a design basis accident that results in a release within the primary Confinement boundary, radioactive material is confined primarily by the structural components of the boundary and process isolation valves which actuate to isolate the Confinement.

The primary Confinement boundary contains, in part, the IU and TOGS shielded cells equipped with removable shield plugs which allow entry into the confined area. LCO 3.4.5 addresses the role of gaskets and non-structural components in the primary Confinement boundary. Gaskets are used to provide sealing where separate structural components (e.g., shield plugs) meet.

The IU cell primary Confinement boundary and the TOGS cell primary Confinement boundary are credited in the SHINE safety analysis for mitigation of radiological hazards. The IU cell and TOGS cell primary confinement boundary leak rates are measured in facility start-up testing to ensure they meet the established leak rate requirement. A leak check of the disturbed portion(s) of the primary Confinement boundary will be performed after any maintenance which causes the primary Confinement boundary to be declared inoperable to ensure the functionality demonstrated in facility start-up testing is restored after the maintenance is complete.

With the primary Confinement boundary inoperable, the IU is required to be placed in Mode 3 immediately. This completion time recognizes the importance of securing operations to limit the generation of radionuclides available for release during a postulated design basis event. Transfer of target solution out of the IU to achieve Mode 0 requires the target solution to be held in the TSV dump tank for at least the minimum period of time specified in LCO 3.1.8 prior to transfer. Approximately [ ]PROP/ECI are required to complete the transfer of target solution to the RPF.

SR The surveillance requirement ensures the continued operability of the shield plugs and inspection ports. The primary Confinement boundary is primarily passive, with the only expected alterations to the primary Confinement boundary consisting of the removal of the IU cell shield plug, the removal of the TOGS cell shield plug, or by opening an inspection port within a shield plug. Therefore, a leak check of the seating surface of the affected components after each reinstallation reestablishes the operability of the primary Confinement boundary.

The surveillance frequency is based on the recommendations of ANSI/ANS 15.1-2007 related to post modification and post repair testing.

Page B 3.4-7 Revision 45

Category Characteristic The TPS gloveboxes limit the release of tritium in the event of a process Confinement leak. The gloveboxes are inerted with helium and are designed with a (continued) minimum free volume is specified so that the entire inventory of hydrogen cannot reach the lower flammability limit if released within the glovebox.

The ESFAS and TRPS safety-related control systems are designed to assume a safe state on a loss of electrical power, as described in FSAR Subsections 7.4.3.8 and 7.5.3.7. Divisions A and B of ESFAS and TRPS Instrumentation control cabinets are located on opposite sides of the control room, and are mounted six inches above the floor to remain above maximum credible flood height.

The TSPS and URSS gloveboxes provide a low leakage boundary for uranium oxide and metal, are equipped with high efficiency particulate air (HEPA) filters and are seismically qualified.

Criticality Safety The seismic design of the URSS storage racks prevents loss of control of fissile material geometry and confinement.

Engineered controls are identified in the criticality safety evaluations to prevent criticality in the SHINE Facility, excluding the TSVs.

The URSS storage racks are seismically qualified to maintain their structure and position during seismic events.

Chemical Process Safety Confinement boundaries are credited for those chemical spill scenarios that occur within a confinement structure.

5.5.5 Maintenance of Safety-Related SSCs The SHINE maintenance program, which includes inspection, testing, and maintenance, ensures that the safety-related SSCs are available and reliable when needed. The maintenance program includes corrective maintenance, preventative maintenance, surveillance and monitoring, and testing. The maintenance program includes the following activities to ensure that safety-related SSCs can perform their functions as required by the accident analysis:

1. Inspection and maintenance of Confinement boundaries;

2. Corrective maintenance and inspections following safety-related system or component actuations or adverse conditions;

3. Overhead crane maintenance and requirements for usage;

4. Safety-related electrical equipment preventive maintenance; and

5. Other inspections and surveillances deemed necessary to ensure the continued functionality of safety-related SSCs.

Page 5.0-11 Revision 45