ML22012A203

Shine Medical Technologies, LLC - Request for Additional Information Related to the Neutron Flux Detection System

ML22012A203
Person / Time
Site:	SHINE Medical Technologies
Issue date:	01/27/2022
From:	Michael Balazik NRC/NRR/DANU/UNPL
To:	Piefer G SHINE Technologies
Gavello M
References
EPID L-2019-NEW-0004
Download: ML22012A203 (24)

Text

January 27, 2022 Dr. Gregory Piefer Chief Executive Officer SHINE Technologies, LLC 3400 Innovation Court Janesville, WI 53546

SUBJECT:

SHINE MEDICAL TECHNOLOGIES, LLC - REQUEST FOR ADDITIONAL INFORMATION RELATED TO THE NEUTRON FLUX DETECTION SYSTEM (EPID NO. L-2019-NEW-0004)

Dear Dr. Piefer:

By letter dated July 17, 2019 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML19211C044), as supplemented by letters dated November 14, 2019 (ADAMS Accession No. ML19337A275), March 27, 2020 (ADAMS Accession No. ML20105A295), August 28, 2020 (ADAMS Accession No. ML20255A027),

November 13, 2020 (ADAMS Accession No. ML20325A026), December 10, 2020 (ADAMS Package Accession No. ML20357A084), December 15, 2020 (ADAMS Package Accession No. ML21011A264), and March 23, 2021 (ADAMS Accession No. ML21095A235), SHINE Medical Technologies, LLC (SHINE) submitted to the U.S. Nuclear Regulatory Commission (NRC) an operating license application for its proposed SHINE Medical Isotope Production Facility in accordance with the requirements contained in Title 10 of the Code of Federal Regulations (10 CFR) Part 50, Domestic Licensing of Production and Utilization Facilities.

During the NRC staffs review of SHINEs operating license application, questions have arisen for which additional information is needed. The enclosed request for additional information (RAI) identifies information needed for the NRC staff to continue its review of the SHINE final safety analysis report, submitted in connection with the operating license application, and prepare a safety evaluation report. The specific technical area of the SHINE operating license application covered by this RAI is Chapter 7, Instrumentation and Control Systems.

It is requested that SHINE provide responses to the enclosed RAI within 60 days from the date of this letter. To facilitate a timely and complete response to the enclosed RAI, the NRC staff is available to meet with SHINE to clarify the scope of information and level of detail expected to be included in the RAI response. SHINE may coordinate the scheduling and agendas for any such meetings with the responsible project manager assigned to this project.

In accordance with 10 CFR 50.30(b), Oath or affirmation, SHINE must execute its response in a signed original document under oath or affirmation. The response must be submitted in accordance with 10 CFR 50.4, Written communications. Information included in the response that is considered sensitive or proprietary, that SHINE seeks to have withheld from the public, must be marked in accordance with 10 CFR 2.390, Public inspections, exemptions, requests for withholding. Any information related to safeguards should be submitted in accordance with 10 CFR 73.21, Protection of Safeguards Information: Performance Requirements. Following receipt of the additional information, the NRC staff will continue its evaluation of the subject chapters and technical areas of the SHINE operating license application.

G. Piefer As the NRC staff continues its review of SHINEs operating license application, additional RAIs for other chapters and technical areas may be developed. The NRC staff will transmit any further questions to SHINE under separate correspondence.

If SHINE has any questions, or needs additional time to respond to this request, please contact me at 301-415-2856, or by electronic mail at Michael.Balazik@nrc.gov.

Sincerely, Signed by Balazik, Michael on 01/27/22 Michael Balazik, Project Manager Non-Power Production and Utilization Facility Licensing Branch Division of Advanced Reactors and Non-Power Production and Utilization Facilities Office of Nuclear Reactor Regulation Docket No. 50-608 Construction Permit No. CPMIF-001

Enclosure:

As stated cc: See next page

SHINE Medical Technologies, LLC Docket No. 50-608 cc:

Jeff Bartelme Director of Licensing SHINE Technologies, LLC 3400 Innovation Court Janesville, WI 53546 Nathan Schleifer General Counsel SHINE Technologies, LLC 3400 Innovation Court Janesville, WI 53546 Christopher Landers Director, Office of Conversion National Nuclear Security Administration, NA 23 U.S. Department of Energy 1000 Independence Avenue, SW Washington, DC 20585 Mark Paulson, Supervisor Radiation Protection Section Wisconsin Department of Health Services P.O. Box 2659 Madison, WI 53701-2659 Test, Research and Training Reactor Newsletter Attention: Amber Johnson Dept. of Materials Science and Engineering University of Maryland 4418 Stadium Drive College Park, MD 20742-2115 Mark Freitag City Manager P.O. Box 5005 Janesville, WI 53547-5005 Bill McCoy 1326 Putnam Avenue Janesville, WI 53546 Alfred Lembrich 541 Miller Avenue Janesville, WI 53548

ML22012A203 NRR-088 OFFICE NRR/DANU/PM NRR/DANU/LA NRR/DANU/BC NRR/DANU/DD (A) NRR/DANU/PM NAME MBalaizk NParker JBorromeo SAnderson MBalazik DATE 1/12/2022 1/13/2022 1/13/2022 1/14/2022 1/27/2022 OFFICE OF NUCLEAR REACTOR REGULATION REQUEST FOR ADDITIONAL INFORMATION REGARDING THE NEUTRON FLUX DETECTION SYSTEM DESCRIBED IN OPERATING LICENSE APPLICATION CONSTRUCTION PERMIT NO. CPMIF-001 SHINE MEDICAL TECHNOLOGIES, LLC SHINE MEDICAL ISOTOPE PRODUCTION FACILITY DOCKET NO. 50-608 By letter dated July 17, 2019 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML19211C044), as supplemented by letters dated November 14, 2019 (ADAMS Accession No. ML19337A275), March 27, 2020 (ADAMS Accession No. ML20105A295), August 28, 2020 (ADAMS Accession No. ML20255A027), November 13, 2020 (ADAMS Accession No. ML20325A026), December 10, 2020 (ADAMS Package Accession No. ML20357A084), December 15, 2020 (ADAMS Package Accession No. ML21011A264), and March 23, 2021 (ADAMS Accession No. ML21095A235), SHINE Medical Technologies, LLC (SHINE) submitted to the U.S. Nuclear Regulatory Commission (NRC) an operating license application for its proposed SHINE Medical Isotope Production Facility in accordance with the requirements contained in Title 10 of the Code of Federal Regulations (10 CFR) Part 50, Domestic Licensing of Production and Utilization Facilities.

During the NRC staffs review of SHINEs operating license application, questions have arisen for which additional information is needed. The request for additional information (RAI) identifies information needed for the NRC staff to continue its review of the SHINE final safety analysis report (FSAR), submitted in connection with the operating license application, and prepare a safety evaluation report. The specific chapter of the SHINE operating license application covered by this RAI is Chapter 7, Instrumentation and Control Systems.

Several instrumentation and control (I&C) systems are used to monitor and control the SHINE facility. This includes the neutron flux detection system (NFDS). The NFDS monitors neutron flux levels to determine multiplication level and power levels. Each irradiation unit includes an independent safety related NFDS, consisting of three divisions.

On May 26, 2020 (ADAMS Accession No. ML20148M279), the NRC staff issued a RAI requesting information on how the radiation monitoring system (RMS) meet the applicable SHINE design criteria. SHINE submitted responses to these RAIs and associated FSAR updates on August 28, 2020 (ADAMS Package Accession No. ML20255A026). These RAIs were necessary for the NRC staff to determine that there is reasonable assurance that the NFDS are appropriately designed and will reliably provide adequate protection of public health and safety, and that applicable regulatory requirements are met. The following requests for information identify additional information needed for the NRC staff to perform its review of the NFDS.

Enclosure

The NRC staff previously issued a set of RAIs related to the highly integrated protection system platform on July 1, 2021 (ADAMS Accession No. ML21172A195), target solution vessel (TSV) reactivity protection system (TRPS) engineered safety features actuation system (ESFAS) on September 27, 2021 (ADAMS Accession No. ML21252A753), and RMS January 10, 2021 (ADAMS Accession No. ML22007A217). The NRC staff is preparing an additional set of RAIs related to SHINEs instrumentation and control systems focused on the Process Integrated Control System.

Applicable Regulatory Requirements and Guidance Documents The NRC staff is reviewing the SHINE operating license application, which describes the SHINE irradiation facility, including the irradiation units (IUs), and radioisotope production facility, using the applicable regulations, as well as the guidance contained in NUREG-1537, Part 1, Guidelines for Preparing and Reviewing Applications for the Licensing of Non-Power Reactors, Format and Content, issued February 1996 (ADAMS Accession No. ML042430055), and NUREG-1537, Part 2, Guidelines for Preparing and Reviewing Applications for the Licensing of Non-Power Reactors, Standard Review Plan and Acceptance Criteria, issued February 1996 (ADAMS Accession No. ML042430048). The NRC staff is also using the Final Interim Staff Guidance [ISG] Augmenting NUREG-1537, Part 1, Guidelines for Preparing and Reviewing Applications for the Licensing of Non-Power Reactors: Format and Content, for Licensing Radioisotope Production Facilities and Aqueous Homogeneous Reactors, dated October 17, 2012 (ADAMS Accession No. ML12156A069), and Final Interim Staff Guidance Augmenting NUREG-1537, Part 2, Guidelines for Preparing and Reviewing Applications for the Licensing of Non-Power Reactors: Standard Review Plan and Acceptance Criteria, for Licensing Radioisotope Production Facilities and Aqueous Homogeneous Reactors, dated October 17, 2012 (ADAMS Accession No. ML12156A075). As applicable, additional guidance cited in SHINEs FSAR or referenced in NUREG-1537, Parts 1 and 2, or the ISG Augmenting NUREG-1537, Parts 1 and 2, has been utilized in the review of the SHINE operating license application.

For the purposes of this review, the term reactor, as it appears in NUREG-1537, the ISG Augmenting NUREG-1537, and other relevant guidance can be interpreted to refer to SHINEs irradiation unit, irradiation facility, or radioisotope production facility, as appropriate within the context of the application and corresponding with the technology described by SHINE in its application. Similarly, for the purposes of this review, the term reactor fuel, as it appears in the relevant guidance listed above, may be interpreted to refer to SHINEs target solution.

Chapter 7 - Instrumentation and Control Systems Neutron Flux Detection System FSAR Section 7.8, Neutron Flux Detection System, states, in part:

The neutron flux detection system (NFDS) performs the task of monitoring and indicating the neutron flux to determine the multiplication factor and power level during filling of the target solution vessel (TSV) and irradiating the target solution. The signal from the detectors is transmitted to the pre-amplifiers where the signal is amplified and filtering for noise reduction is performed. The output of the pre-amplifier is transmitted to cabinets in the facility control room where the signal processing units are located. The signal processing units perform measurement of the neutron flux signal from the pre-amplifier, signal processing, indication and interfacing with other

systems. The NFDS interfaces with the TSV reactivity protection system (TRPS) for safety-related interfaces and monitoring and indication, and interfaces with the process integrated control system (PICS) for nonsafety-related functions.

In effect, the NFDS provides inputs to the protection system.

NUREG-1537, Part 2, Section 7.4, Reactor Protection System, describes, in part, that the safety analysis report (SAR) should describe operation of the protection system, listing the protective functions performed by the protection system, and the parameters monitored to detect the need for protective action. Section 7.4 further describes that the facility should have operable protection capability in all operating modes and conditions, as analyzed in the SAR, and the range of operation of sensor (detector) channels should be sufficient to cover the expected range of variation of the monitored variable during normal and transient reactor operation. NUREG-1537, Part 2, Section 7.4, states, in part, that [t]he RPS to be designed to perform its safety function after a single failure and to meet requirements for seismic and environmental qualification, redundancy, diversity, and independence.

NUREG-1537, Part 2, Section 7.4, also describes that the protection systems should be reliable and perform their intended safety functions under all conditions. Therefore, the design of the protection systems should consider features that can improve the reliability of the system such as independence, redundancy, diversity, maintenance, testing, and quality components. The NFDS include nuclear instrumentation for all power ranges and provide data to PICS and TRPS for ensuring operation and protection of the IU cell.

NUREG-1537, Part 2 Section 7.6 Control Console and Display Instruments, also describe guidance for evaluating the control console and display instruments to determine that they include signals from instrument systems monitoring activities, and other system process variables analytically or digitally processed outputs based on monitored variables. NUREG-1537, Part 2, Section 7.3 provides guidance for verifying that the system provides reliable information about the status and magnitude of process variables necessary for the full range of normal operations.

RAI 7-36 SHINE Design Criteria 1-8 Note 2 of SHINE FSAR Chapter 3, Design of Structures, Systems, and Components, states that [t]he generally-applicable design criteria 1 - 8 from Table 3.1-3 are not specifically listed even though they are generally applicable to most SSCs. However, it is not clear to the NRC staff whether these design criteria are applicable to the NFDS.

Confirm whether SHINE Design Criteria 1 - 8 are applicable to the NFDS.

Update the SHINE FSAR as appropriate to describe the relation of the NFDS design bases to the applicable SHINE Design Criteria 1-8.

This information is necessary for the NRC staff to understand the relation of the design bases to the principal design criteria of facility, as required by 10 CFR 50.34, Contents of applications; technical information.

RAI 7-37 Monitored Variables FSAR Chapter 3, Table 3.1-1, Safety-Related Structures, Systems, and Components, states that SHINE Criterion 13, Instrumentation and controls, is applicable to the NFDS, TRPS, ESFS, and PICS.

FSAR Chapter 3, Table 3.1-3, SHINE Design Criteria, states the SHINE Criterion 13, Instrumentation and controls, as follows:

Instrumentation is provided to monitor variables and systems over their anticipated ranges for normal operation, for anticipated transients, and for postulated accidents as appropriate to ensure adequate safety, including those variables and systems that can affect the fission process, the integrity of the primary system boundary, the primary confinement and its associated systems, and the process confinement boundary and its associated systems.

Appropriate controls are provided to maintain these variables and systems within prescribed operating ranges.

FSAR Section 7.6.1.2, Operator Workstation, states, in part:

The two [Neutron Driver Assembly System (NDAS)] control stations allow operators to monitor and make adjustments to any of the eight neutron drivers in the eight IU cells. The NDAS control stations are only allowed to provide control signals to the NDAS when a permissive provided by the PICS is satisfied. The NDAS control stations are used to interface with the vendor provided NDAS control system described in Subsection 4a2.3.4.

FSAR Section 7.8.2.2.1, General Instrumentation and Control, states, in part, the following NFDS criterion:

NFDS Criterion 1 - The range of operation of detector channels for the NFDS shall be sufficient to cover the expected range of variation of monitored neutron flux during normal and transient operation.

NFDS Criterion 2 - The NFDS shall give continuous indication of the neutron flux from subcritical source multiplication level through licensed maximum power range. The continuous indication shall ensure at least two decades of overlap in indication is maintained while observation is transferred from one channel to another.

NFDS Criterion 3 - The NFDS power range channels shall provide reliable TSV power level while the source range channel provides count rate information from detectors that directly monitor the neutron flux.

NFDS Criterion 4 - The NFDS log power range channel (i.e., wide range channel) and a linear flux monitoring channel (i.e., power range channel) shall accurately sense neutrons during irradiation, even in the presence of intense high gamma radiation.

NFDS Criterion 5 - The NFDS shall provide redundant TSV power level indication through the licensed maximum power range.

NFDS Criterion 26 - The NFDS shall be designed to provide the information necessary to support annunciation of the channel initiating a protective action to the operator.

Therefore, NFDS channels should be sufficient to cover the expected range of variation of the monitored variables (including the neutron flux) over the prescribed operating rangesincluding over its anticipated range for normal operation (from subcritical multiplication source level through the full licensed power range)for postulated accidents, and for accident conditions.

SHINE FSAR Sections 7.8.3.1, Design Bases Functions, and 7.8.4.1, Monitored Variables, describe the variables monitored and their range measurement. These variables are listed in SHINE FSAR Table 7.4-1, TRPS Monitored Variables. Further, SHINE FSAR Section 7.8.2.1.1, Instrumentation and Controls, describes that the NFDS provides continuous indication of the neutron flux during operation, from filling through maximum power during irradiation, and SHINE FSAR Section 7.8.2.2.9, Human Factors, describes that NFDS input to TRPS safety functions are communicated to the PICS to alert the operators. However, the SHINE FSAR does not identify what variables would provide information to the operators in the control room (via the control console) to operate and monitor the neutron driver in each of the eight IU cells, including any information necessary for operators to perform manual protective actions and to meet SHINE Design Criterion 13.

Identify variables to be displayed to operate and monitor the neutron driver in each of the eight IU cells (i.e., IU operation), including any necessary information for operators to perform manual protective actions and to meet SHINE Design Criterion 13, and to verify that the facility has functional protection capability in all operating modes and conditions, as analyzed in the SHINE FSAR. Update the SHINE FSAR as necessary.

The NRC staff needs this information to make a finding that the proposed NFDS will provide all necessary information in the control room for operators to monitor power and perform manual safety actuation, if necessary, and meets the design acceptance.

The information requested is necessary to support the following finding in Section 7.6 of NUREG-1537, Part 2:

The outputs and display devices showing reactor nuclear status should be readily observable by the operator while positioned at the reactor control and manual protection systems.

RAI 7-38 Configuration and Logic NUREG-1537, Part 2, Section 7.4, describes that descriptive information, including system logic and schematic diagrams, showing all instruments, computer hardware and software, electrical, and electromechanical equipment used in detecting conditions requiring protective action and in initiating the action should be provided and the logic, schematic, and circuit diagrams should show independence of detector channels and trip circuits. Therefore, the NFDS should be designed to automatically initiate the operation of appropriate systems to assure that specified design limits are not exceeded.

SHINE FSAR Chapter 3, Table 3.1-3, states SHINE Criterion 14, Protection system functions, as follows:

The protection systems are designed to:

1) initiate, automatically, the operation of appropriate systems to ensure that specified acceptable target solution design limits are not exceeded as a result of anticipated transients; and

2) sense accident conditions and to initiate the operation of safety-related systems and components.

SHINE FSAR Section 7.8.2.2.1, states, in part, the following NFDS criterion:

NFDS Criterion 6 - The location and sensitivity of at least one NFDS detector in the source range channel, along with the location and emission rate of the subcritical multiplication source, shall be designed to ensure that changes in reactivity will be reliably indicated even with the TSV shut down.

NFDS Criterion 7 - The NFDS shall have at least one detector in the power range channel to provide reliable readings to a predetermined power level above the licensed maximum power level.

SHINE FSAR Section 7.8.4.2, Logic Processing Functions, states, in part:

The NFDS also provides a source range missing and power range missing signal to the PICS for use as an alarm to the operator in alerting that the NFDS is not operating properly.

The TRPS transmits the analog signals as nonsafety-related signals to the PICS to display for operator use when monitoring conditions in the IU cells.

This section in effect describes the signals generated and provided to PICS but does not describe the logic processing within NFDS to generate these signals.

SHINE FSAR Section 7.8.3, Design Bases, describes the measurement ranges for the NFDS. However, the SHINE FSAR does not describe the logic performed to process the analog signals and generate the actuation signal for TRPS. SHINE FSAR Figure 7.4-1, shows the actuation signals programmed in the TRPS to activate the safety function.

1. Revise the SHINE FSAR to describe how monitored signals are input to NFDS, conditioned to determine power, and transmitted to the TRPS; and where in the two systems the signal is evaluated against defined setpoints in the safety function module with logic to generate safety signals. Revise the FSAR and confirm whether the trip setpoint and actuation is performed within NFDS as described in NFDS Criterion 17; or if trip determination is performed in TRPS and ESFAS based on analog signals from NFDS cabinets (also see RAI 7-47).

2. Confirm if the NFDS is an entirely analog based system as stated in SHINE FSAR Section 7.8.3.2, or if the NFDS includes digital components and/or software that condition analog sensor inputs into analog output signals transmitted to the TRPS (also see RAI 7-42).

RAI 7-39 System Design NUREG 1537, Part 2, Section 7.4, describes that the protection systems should be reliable and perform their intended safety functions under all conditions.

Therefore, the design of the protection systems should consider features that can improve the reliability of the system such as independence, redundancy, diversity, maintenance, testing, and quality components. Further detector channels and control elements should be redundant to ensure that a single random failure or malfunction in the RCS or RPS could not prevent the RPS from performing its intended function or prevent safe shutdown.

SHINE Design Criterion 15, Protection system reliability and testability, states:

The protection systems are designed for high functional reliability and inservice testability commensurate with the safety functions to be performed.

Redundancy and independence designed into the protection systems are sufficient to ensure that:

1) no single failure results in loss of the protection function, and

2) removal from service of any component or channel does not result in loss of the required minimum redundancy unless the acceptable reliability of operation of the protection system can be otherwise demonstrated.

FSAR Section 7.8.2.2.1, states, in part, the following NFDS criterion:

NFDS Criterion 11 - The NFDS shall be designed to perform its protective functions after experiencing a single random active failure in nonsafety control systems or in the NFDS, and such failure shall not prevent the NFDS from performing its intended functions or prevent safe shutdown of an IU cell.

NFDS Criterion 12 - The NFDS shall be designed such that no single failure can cause the failure of more than one redundant component.

SHINE FSAR Section 7.8.2.2, NFDS System Design Criteria, describes how the NFDS design meets the SHINE single failure criterion. SHINE FSAR Section 7.8.2.2.2, Single Failure, identifies the NFDS criteria for single

failure criteria and describes how the system meets these criteria and that the NFDS is comprised of three redundant divisions. SHINE FSAR Section 7.8.1, System Description, notes that the NFDS is a three-division system with three detectors, and SHINE FSAR Section 7.8.2.2.1, states that each NFDS division includes a fission chamber detector and a Boron Trifluoride detector pair for monitoring the NFDS power and wide range neutron flux. Based on this information, it is not clear to the NRC staff how the three NFDS division detectors operate to ensure that a single failure does not result in loss of the protection or mitigation function and whether the system is vulnerable to a common cause failure (CCF).

1. Update the SHINE FSAR to describe the design and operation of the NFDS to enable verification that single failures do not result in loss of the protection or mitigation function.

2. Update the SHINE FSAR to describe the design features of the NFDS considered to address potential vulnerabilities to CCF.

The information requested is necessary to support the following finding in Section 7.4 of NUREG-1537, Part 2:

Detector channels and control elements should be redundant to ensure that a single random failure or malfunction in the RCS or RPS could not prevent the RPS from performing its intended function, or prevent safe reactor shutdown.

RAI 7-40 Independence SHINE FSAR Chapter 3, Table 3.1-3, states SHINE Criterion 16, Protection system independence, as follows:

The protection systems are designed to ensure that the effects of natural phenomena, and of normal operating, maintenance, testing, and postulated accident conditions on redundant channels do not result in loss of the protection function or are demonstrated to be acceptable on some other defined basis. Design techniques, such as functional diversity or diversity in component design and principles of operation, are used to the extent practical to prevent loss of the protection function.

FSAR Section 7.8.2.2.1, states, in part, the following NFDS criterion:

NFDS Criterion 8 - The NFDS shall be separated from the PICS to the extent that any removal of a component or channel common to both the NFDS and the PICS preserves the reliability, redundancy, and independence of the NFDS.

NFDS Criterion 10 - The timing of NFDS communications shall be deterministic.

NFDS Criterion 13 - Physical separation and electrical isolation shall be used to maintain the independence of NFDS circuits and equipment among

redundant safety divisions or with non-safety systems so that the safety functions required during and following any maximum hypothetical accident or postulated accident can be accomplished.

NFDS Criterion 14 - The NFDS shall be designed such that no communication-within a single safety channel, between safety channels, and between safety and non-safety systems-adversely affects the performance of required safety functions.

SHINE FSAR Section 7.8.2.1.4, Protection System Independence, describes how the NFDS meets SHINE Design Criterion 16. This description refers to other sections in the FSAR that cover independence and equipment qualification for operation during normal and design basis event.

SHINE FSAR Section 7.8.2.1.3, Protection System Reliability and Testability, describes the independent NFDS divisions interface with TRPS, which has been analyzed for single failure in accordance with the Institute of Electrical and Electronics Engineers (IEEE) Standard 379-2000, IEEE Standard Application of the Single-Failure Criterion to Nuclear Power Generating Station Safety Systems, for all inputs, including NFDS.

SHINE FSAR Section 7.8.2.2.3, Independence, identifies the NFDS criteria for single failure criteria and how the system meets these criteria. This section describes that the system is physically and electrically independent. SHINE FSAR Section 7.8.3.4, Independence, then repeats this information and adds the location where the detectors would be installed. This section further describes that each NFDS division is independent from each other.

SHINE FSAR Section 7.8.2.2.1, notes that the positioning of the NFDS source range detectors, and the location, and emission rate of the subcritical multiplication source, is designed so that all three channels are on scale throughout filling. However, the FSAR does not provide sufficient information how these designs were implemented.

Regarding independence of communication, the SHINE FSAR describes how the NFDS meets this independence in several sections of the SHINE FSAR. SHINE FSAR Section 7.8.2.1.3, Protection System Reliability and Testability, describes that interfacing systems with the NFDS are downstream of the NFDS such that a failure of an interfacing nonsafety system will not impact the NFDS. SHINE FSAR Sections 7.8.2.1.6, Separation of Protection and Control Systems, 7.8.2.2.1, 7.8.2.2.2, and 7.8.2.2.3, Independence, state that communication with TRPS and PICS are continuous through isolated outputs that only allow the data to be transmitted out of the system so that no failure from an interfacing system can affect the functions of the NFDS. However, SHINE FSAR Section 7.8.4.2, Logic Processing Functions, describes that the TRPS transmits the analog signals as nonsafety-related signals to the PICS to display for operator use when monitoring conditions in the IU cells. It is not clear to the NRC staff whether the NFDS communicates directly with PICS or if it is through the TRPS.

After reviewing the information provided in the SHINE FSAR, the NRC staff found that these sections do not provide sufficient information for the NRC staff to evaluate how the NFDS meets the independence criteria. Further during the audit performed on May 12, 2021 (ADAMS Accession No. ML21130A313),

SHINE staff stated that a new signal transmitted from the TRPS to the NFDS was added to the design. This signal is not described in the SHINE FSAR. Various places in the FSAR it states that NFDS provides analog signals to TRPS, however, the NRC staff was unable to locate any specific information on methods of communication, signal scaling, linear or log based, etc. Therefore, provide in the SHINE FSAR the following information:

1. Type of signals and communication mechanisms and isolation for signals transmitted from the NFDS to the TRPS.

2. Confirm whether signals are transmitted from the NFDS directly to the PICS (as depicted in FSAR Figure 7.1-1). If so, identify type of signals and communication mechanisms and isolation for signal transitions.

3. Type of signals and communication mechanisms for signals transmitted from the TRPS to the NFDS.

The information requested is necessary to support the following findings in Section 7.3 of NUREG-1537, Part 2:

The RCS should give continuous indication of the neutron flux from subcritical source multiplication level through the licensed maximum power range. This continuous indication should ensure about one decade of overlap in indication is maintained while observation is transferred from one detector channel to another.

The sensitivity of each sensor channel should be commensurate with the precision and accuracy to which knowledge of the variable measured is required for the control of the reactor.

The system should give reliable reactor power level and rate-of-change information from detectors or sensors that directly monitor the neutron flux.

The system should give reliable information about the status and magnitude of process variables necessary for the full range of normal reactor operation.

RAI 7-41 Separation of protection and control SHINE FSAR Chapter 3, Table 3.1-3, SHINE Design Criteria, the SHINE Criterion 18, Separation of protection and control systems, states the protection system is separated from control systems to the extent that failure of any single control system component or channel, or failure or removal from service of any single protection system component or channel that is common to the control and protection systems leaves intact a system satisfying all reliability,

redundancy, and independence requirements of the protection system.

Interconnection of the protection and control systems is limited to assure that safety is not significantly impaired.

SHINE FSAR Section 7.8.2.1.6, Separation of Protection and Control Systems, describes how the NFDS design meets this criterion. However, the FSAR description does not address separation of protection and control. This description appears to focus on the NFDS meets single failure criterion and communication independence.

It is the NRC staffs understanding that signals from the NFDS are transmitted to both the TRPS for protection and to the PICS for control and operation of the IU cells. Therefore, the neutron flux sensors and channels are shared by the protection and control systems. The SHINE FSAR should describe how failure or removal of NFDS from service would not affect the protection function of the TRPS.

Revise the SHINE FSAR to include a description of how the NFDS design meets SHINE design Criterion 18 to perform its protection function given a failure of a shared component, and clearly reflect the intended design of components shared to protect and control certain operations.

The information requested is necessary to support the following finding in Section 7.4 of NUREG-1537, Part 2:

The RPS design is sufficient to provide for all isolation and independence from other reactor subsystems required by SAR analyses to avoid malfunctions or failures caused by the other systems.

RAI 7-42 Digital Components NUREG-1537, Part 2, Section 7.4, Reactor Protection System and Section 7.5 Engineered Safety Features Actuation Systems describes in part that hardware and software for computerized systems should meet the guidelines of IEEE 4.3.2-1993 and Regulatory Guide (RG) 1.152, Revision 1, Criteria for Digital Computers In Safety Systems of Nuclear Power Plants, and software should meet the guidelines of American National Standards Institute/American Nuclear Society-10.4-1987, Guidelines for the Verification and Validation of Scientific and Engineering Computer Programs for the Nuclear Industry.

SHINE FSAR Section 7.8.2.2, discusses how the NFDS meets the single failure criterion. As part of this description, the licensee notes that the NFDS consists of detectors, preamplifiers, and processing circuits for single failure protection.

Even though SHINE FSAR Section 7.8.3.2, Simplicity, describes that the system is analog, the description in SHINE FSAR Section 7.8.2.2.2, could imply that digital equipment is embedded to perform the functions of preamplifiers and processing. Further, SHINE FSAR Section 7.8.2.2.7, Surveillance, notes that the NFDS transmits two discrete signals to the PICS. Based on this information, the NRC staff is not certain if the NFDS include embedded digital equipment. If this assumption is correct, the SHINE FSAR does not describe the digital equipment embedded within the NFDS. Further, the SHINE FSAR does not

provide information to evaluate how the NFDS meet the acceptance criteria for software development.

Confirm whether the NFDS includes embedded digital equipment to perform the functions of preamplification and processing. If this is the case, then update the SHINE FSAR to describe software development plan, development, and testing results to verify conformance with the guidelines of IEEE Std 7-4.3.2 and RG 1.152, as applicable.

The information requested is necessary to support the following finding in Section 7.3 and 7.4 of NUREG-1537, Part 2:

Hardware and software for computerized systems should meet the guidelines of IEEE 7-4.3.2-1993, 'IEEE Standard Criteria for Digital Computers Systems in Safety Systems of Nuclear Power Generating Stations,' and Regulatory Guide (RG) 1.152, "Criteria for Digital Computers in Safety Systems of Nuclear Power Plants," Revision 1, which is attached to Chapter 7 of the format and content guide as Appendix 7.1, and software should meet the guidelines of ANSI/ANS 10.4-1987, Guidelines for the Verification and Validation of Scientific and Engineering Computer Programs for the Nuclear Industry," that apply to non-power reactor systems.

RAI 7-43 Power Supply NUREG-1537, Part 2 describes that the protection systems should be fail-safe against malfunction and electrical power failure, should be as close to passive as can be reasonably achieved, should go to completion once initiated, and should go to completion within the time scale derived from applicable analyses in the SAR.

FSAR Chapter 7, Section 7.8.2.2.4, Fail Safe, includes NFDS Criterion 15 which requires the NFDS and associated components shall be designed to assume a safe state on loss of electrical power. FSAR Section 7.8.2.2.4 also states, in part: The NFDS is designed so that a failure due to loss of power to the NFDS or a removal of an NFDS channel interacts the same with the TRPS as if there was a positive trip determination output to the TRPS. However, the FSAR does not contain a basic design description summary of the power supply arrangement that enables NRC staff to verify the NFDS conforms with Criterion 15. The FSAR describes the behavior, but not the equipment and how it operates to achieve the behavior. FSAR Section 7.8.3.5 describes the requirements for loss of external power and some description of the power supply design: The NFDS is supplied power from the uninterruptible power supply system (UPSS) upon a loss of off-site power. However, it is not clear how the two train UPSS is connected to the three train NFDS, and whether the configuration is aligned with TRPS power arrangement as described in FSAR.

Update the SHINE FSAR to describe the power supply arrangement to demonstrate the NFDS design achieves a safe state for power loss.

This information is necessary to support the evaluation findings in Section 7.4 of NUREG-1537, Part 2:

The design reasonably ensures that the design bases can be achieved, the system will be built of high-quality components using accepted engineering and industrial practices, and the system can be readily tested and maintained in the designed operating condition.

RAI 7-44 NFDS Technical Specifications NUREG-1537, Part 1, Section 7.2.4, System Performance Analysis, describes that the applicant should conduct a performance analysis of the proposed I&C system to ensure the design criteria and design bases are met and license requirements for the performance of the system are specified. The system performance analysis should encompass the technical specification (TS) limiting safety system settings (LSSSs), limiting conditions for operation (LCOs), and surveillance requirements (SRs) for the I&C system should be established.

These parameters and requirements should include system operability tests, trip, or actuation setpoint checks, trip or actuation-setpoint calibrations, and any system response-time tests that are required. Surveillance intervals should be specified and the bases for the intervals, including operating experience, engineering judgment, or vendor recommendation.

SHINE FSAR Chapter 3, Table 3.1-3, states, in part, SHINE Design Criterion 15, Protection system reliability and testability, as follows:

The protection systems are designed for high functional reliability and inservice testability commensurate with the safety functions to be performed.

SHINE FSAR Section 7.8.2.2.7, Surveillance, states, in part, the following NFDS criterion:

NFDS Criterion 21 - The NFDS shall provide the capability for calibration, inspection, and testing to validate the desired functionality of the NFDS.

NFDS Criterion 23 - Testing, calibration, and inspections of the NFDS shall be sufficient to confirm that surveillance test and self-test features address failure detection, self-test capabilities, and actions taken upon failure detection.

NFDS Criterion 24 - The design of the NFDS and the justification for test intervals shall be consistent with the surveillance testing intervals as part of the facility technical specifications.

NFDS Criterion 22 - Equipment in the NFDS (from the input circuitry to output actuation circuitry) shall be designed to allow testing, calibration, and inspection to ensure operability. If testing is required or can be performed as an option during operation, the NFDS shall retain the capability to accomplish its safety function while under test.

SHINE FSAR Section 7.8.4.3, Technical Specifications and Surveillance, states: Limiting Conditions for Operation and Surveillance Requirements are established for the NFDS in the technical specification. The neutron flux detector setpoints bound normal operations and accident conditions and provide margin to analytical limits.

However, the SHINE TS does not include a limited condition of operation (LCO) and SR for the NFDS. However, the SHINE TS includes TS SR 3.2.3 to require weekly channel check of the NFDS, without specifying what constitutes a channel for the NFDS (as this term is defined for each SHINE TS LCO in the corresponding SHINE TS bases).

Further, the SHINE TS Table 3.2.3-a, TRPS Instrumentation, lists the setpoint for the NFDS and SHINE FSAR Table 7.4-1, identifies the analytical limit and range for the NFDS. However, the SHINE FSAR and SHINE TS do not include sufficient information for the NRC staff to evaluate that the neutron flux detector setpoints bound normal operations and accident conditions and provide margin to analytical limits.

Based on this, the SHINE FSAR does not include a description or reference to the system performance analysis that encompasses the SHINE TS LSSSs, LCOs, and SRs for the NFDS.

Revise the SHINE FSAR to include a reference and/or description to the system performance analysis that addresses the SHINE TS LSSS, LCOs, and SRs for the NFDS.

This information is necessary to support the acceptance criteria in Section 7.4 of NUREG-1537, Part 2:

Technical specifications, including surveillance tests and intervals, should be based on discussions and analyses in the SAR of required safety functions.

RAI 7-45 System Failures NUREG-1537, Part 2, Section 7.4, describes that the shutdown function of the protection system be fail-safe against malfunction and electrical power failures.

SHINE FSAR, Chapter 3, Table 3.1-3, SHINE Design Criterion 15, Protection system reliability and testability, states:

The protection systems are designed for high functional reliability and inservice testability commensurate with the safety functions to be performed. Redundancy and independence designed into the protection systems are sufficient to ensure that:

1) no single failure results in loss of the protection function, and

2) removal from service of any component or channel does not result in loss of the required minimum redundancy unless the acceptable reliability of operation of the protection system can be otherwise demonstrated.

Further, SHINE Design Criteria 16, Protection system independence, and 17, Protection system failure modes, require the system be designed to fail into a safe state if conditions such as disconnection of the system, loss of power, or postulated adverse environments are experienced.

SHINE FSAR Chapter 7, Section 7.8.2.2.4, Fail Safe, states, in part, the following:

NFDS Criterion 15 - The NFDS and associated components shall be designed to assume a safe state on loss of electrical power.

NFDS Criterion 16 - The NFDS shall not be designed to fail or operate in a mode that could prevent the TRPS from performing its intended safety function. The design of the NFDS shall consider:

1) The effect of NFDS on accidents

2) The effects of NFDS failures

3) The effects of NFDS failures caused by accidents.

The failure analyses shall cover hardware and software failures associated with the NFDS.

SHINE FSAR Sections 7.8.2.1.3, Protection System Reliability and Testability, 7.8.2.1.4, and 7.8.2.1.5, Protection System Failure Modes, describe how the NFDS design meets the SHINE Design Criteria 15, Protection system reliability and testability, 16, Protection system independence, and 17, Protection system failure modes. Further, SHINE FSAR Section 7.8.2.2.4, Fail Safe, described how the system meets NFDS Criteria 15 and 16. However, the FSAR descriptions provides information on independence of the safety systems, as well as the requirement for the systems to be protected from earthquakes, adverse environmental conditions, and loss of power. Also, SHINE FSAR Section 7.8.2.2.4, describes that the design (of the NFDS) identifies and compensates for failed system elements. However, SHINE FSAR Sections 7.8.2.2.7, Surveillance, and 7.8.3.10, Maintenance and Testing, describes that the only form of fault detection normally available is the source range missing and power range missing, which would be provided to the PICS as discrete signals.

The SHINE FSAR does not identify what known failures can affect the systems, how they would be addressed, and the fail-safe state of variables controlled by the safety systems. SHINE FSAR does not include information on the configuration of self-test or fault detection, and how the system compensates for failed elements. Also, the provided descriptions in the SHINE FSAR do not demonstrate whether failures of connected systems, especially non-safety systems, would not prevent the NFDS and therefore the TRPS from performing its safety function. The SHINE FSAR should describe the potential vulnerabilities

that can affect their operation and how the systems would behave under specific identified failure modes.

1. Update the SHINE FSAR to describe the failure modes analyzed for the NFDS, as well as the design, configuration, and implementation of fault detection considered.

2. Update the SHINE FSAR to identify what signal would be sent from the NFDS to the TRPS during a NFDS loss of power event and any other failures analyzed.

This information is necessary to support the evaluation findings in Section 7.4 of NUREG-1537, Part 2:

The automatic reactor runback or shutdown (scram) subsystem should be fail-safe against malfunction and electrical power failure, should be as close to passive as can be reasonably achieved, should go to completion once initiated, and should go to completion within the time scale derived from applicable analyses in the SAR.

RAI 7-46 Equipment Qualification NUREG-1537, Part 2, Section 7.4, describes, in part, that the design of the protection systems should be adequate to perform the functions necessary to ensure safety. Therefore, the design of the SHINE facility should include provisions for the protection systems to reliably operate in the normal range of environmental conditions and postulated credible accidents, transients, and other events at the facility that could require their operation.

FSAR Table 3.1-3, SHINE Design Criteria, states, in part, the following general design criterion:

SHINE Design Criterion 16, Protection system independence, [t]he protection systems are designed to ensure that the effects of natural phenomena, and of normal operating, maintenance, testing, and postulated accident conditions on redundant channels do not result in loss of the protection function or are demonstrated to be acceptable on some other defined basis.

SHINE Design Criterion 19, Protection against anticipated transients, [t]he protection systems are designed to ensure an extremely high probability of accomplishing their safety functions in the event of anticipated transients.

FSAR, Section 7.8.2.2.1, states the following NFDS design criterion:

NFDS Criterion 9 - The NFDS detectors shall be qualified for continuous submerged operation within the light water pool. The NFDS detector housings shall be watertight and supported by a sleeve structure, mounted to the SASS [subcritical assembly support structure], at specific locations surrounding the SASS.

NFDS Criterion 20 - The effects of electromagnetic interference/radio-frequency interference (EMI/RFI) and power surges on the NFDS shall be adequately addressed.

SHINE FSAR Section 7.8.2.1.4, describes how the NFDS design meets the SHINE Design Criterion 16, Protection system independence, and SHINE FSAR Section 7.8.2.1.7, Protection Against Anticipated Transients, describes it for SHINE Design Criterion 19, Protection against anticipated transients.

SHINE FSAR Sections 7.8.2.2.1, and 7.8.2.2.6, Equipment Qualification, describe how the NFDS design meets NFDS Design Criteria 9 and 20, respectively. Also, SHINE FSAR Section 7.8.3.7, Equipment Qualification, describe the equipment qualification for the NFDS.

SHINE FSAR Section 7.8.3.11, Codes and Standards, identifies the codes and standards to be used in qualifying the NFDS.

While these FSAR sections describe applicable environmental qualification criteria, the FSAR does not provide information to demonstrate that the NFDS has been qualified to meet the environmental qualification criteria and associated SHINE Design Criterion described above.

1. Update the SHINE FSAR to demonstrate that the NFDS equipment has undergone environmental, seismic, radiation, electrical isolation, EMI/RFI, surge and emissions qualifications and that the results envelope the operating and transient conditions identified for the facility.

2. Update the SHINE FSAR to describe how codes and standards listed in the SHINE FSAR are used to qualify the NFDS.

This information is necessary to support the evaluation findings and acceptance criteria in Section 7.4 of NUREG-1537, Part 2:

The design reasonably ensures that the design bases can be achieved, the system will be built of high-quality components using accepted engineering and industrial practices, and the system can be readily tested and maintained in the designed operating condition.

The RPS should be designed for reliable operation in the normal range of environmental conditions anticipated within the facility.

RAI 7-47 Setpoints NUREG-1537, Part 2, Section 7.4, acceptance criteria, states, in part, that The range of operation of sensor (detector) channels should be sufficient to cover the expected range of variation of the monitored variable during normal and transient operation. NUREG-1537, Part 2, Sections 7.3, 7.4, and 7.7, acceptance criteria, state, in part, that The sensitivity of each sensor channel should be commensurate with the precision and accuracy to which knowledge of the variable measured is required. NUREG-1537, Part 2, Section 7.5, Engineered Safety Features Actuation Systems, acceptance criteria, states, The range and sensitivity of ESF [engineered safety features] actuation system sensors should be sufficient to ensure timely and accurate signals to the actuation devices.

Subparagraph (c)(1)(ii)(A) of 10 CFR 50.36, Technical specifications, describes that LSSS are settings for automatic protective devices related to those variables having significant safety functions. This clause requires that where a LSSS is specified for a variable on which a safety limit has been placed, the setting must be chosen so that automatic protective action will correct the abnormal situation before a safety limit is exceeded.

Subparagraph (c)(3) of 10 CFR 50.36 states, Surveillance requirements are requirements relating to test, calibration, or inspection to assure that the necessary quality of systems and components is maintained, that facility operation will be within safety limits, and that the limiting conditions for operation will be met.

FSAR, Section 7.8.2.2.5, Setpoints, states the following NFDS design criterion:

NFDS Criterion 17 - Neutron flux setpoints for an actuation of the NFDS shall be based on a documented analysis methodology that identifies assumptions and accounts for uncertainties, such as environmental allowances and measurement computational errors associated with each element of the instrument channel. The setpoint analysis parameters and assumptions shall be consistent with the safety analysis, system design basis, technical specifications, facility design, and expected maintenance practices.

NFDS Criterion 18 - Adequate margin shall exist between setpoints and safety limits so that the TRPS initiates protective actions before safety limits are exceeded.

NFDS Criterion 19 - The sensitivity of each NFDS sensor channel shall be commensurate with the precision and accuracy to which knowledge of the variable measured is required for the protective function.

The NFDS transmits the power levels to the TRPS to protect the primary system boundary (PSB) from exceeding the individual SHINE TS safety limits (SLs) using independent channels when the facility operates in accordance with the TS LCOs. SHINE TS, Section 2.0, Safety Limits and Limiting Safety System Settings, defines SLs to protect the PSB and LSSSs for safety systems to initiate their protective functions. The SHINE FSAR, Table 7.4-1, identifies the

variables monitored by the TRPS. This table also provides instrument range, accuracy for each variable monitored, and its analytical limit. SHINE TS Table 3.2.3-a, TRPS Instrumentation, identifies the NFDS setpoints for the safety function to protect against analyzed events and conditions.

The SHINE FSAR does not describe the methodology used to determine the NFDS setpoints and only notes that a setpoint methodology was used to determine setpoints for the NFDS variables monitored by the TRPS. The setpoints for protective function should be based on a documented analysis methodology that identifies assumptions and accounts for instrument uncertainties, such as environmental allowances and measurement computational errors associated with each element of the instrument channel.

1. Revise the SHINE FSAR to identify and describe the functions of the setpoints within the NFDS. It is recognized that there are setpoint associated with the NFDS that are contained within the TRPS, and these setpoints are addressed by TRPS related setpoint criteria. Do the setpoint criteria and descriptions within the system boundary of the NFDS sections cause the NFDS related setpoint within the system boundary of the TRPS to be treated differently than other setpoints within the TRPS?

2. Revise the SHINE FSAR to describe the setpoint methodology used to establish the NFDS setpoints or SHINE TS LSSS from the analytical limits for the variables monitored by the NFDS. Description of the setpoint methodology should include parameters typically consider instrument precision, sensitivity, accuracy, loop uncertainties, and computational errors.

3. Provide a description how SHINE determined equipment accuracy identified in SHINE FSAR Table 7.4-1 to bound uncertainties and how the equipment accuracy is used in the setpoint methodology. (Also, see RAI 7-20(f) in which the NRC staff requested information on the setpoint methodology used to establish the setpoints or LSSS from the analytical limits for the variables monitored by the TRPS and ESFAS.)

The information requested above is necessary to support the evaluation findings in Section 7.4 of NUREG-1537, Part 2:

The protection channels and protective responses are sufficient to ensure that no safety limit, limiting safety system setting, or RPS-related limiting condition of operation discussed and analyzed in the SAR will be exceeded.

RAI 7-48 Maintenance and Testing NUREG-1537, Part 2, Section 7.4, acceptance criteria, states, in part, that [t]he RPS be sufficiently distinct in function from the RCS that its unique safety features can be readily tested, verified, and calibrated. In addition, NUREG-1537, Part 2, Section 7.4, acceptance criteria, states, in part, that [t]he RPS function and time scale should be readily tested to ensure

operability of at least minimum protection for all operations. Therefore, the NFDS should be designed to be readily tested and calibrated to ensure operability. Additionally, the SHINE proposed TSs, including surveillance tests and intervals, should ensure availability and operability of these actuation systems.

SHINE Design Criterion 15, Protection system reliability and testability, requires the protection system be designed to permit periodic testing, including a capability to test channels independently to determine failures and losses of redundancy that may have occurred.

The SHINE TS does not include a LCO for the NFDS and includes SR 3.2.3 to require weekly channel check of the NFDS. SHINE FSAR Section and 7.8.3.10 Maintenance and Testing, states that The NFDS supports testing and calibration to ensure operability as required by the technical specifications. The NFDS is designed to allow operators to remove portions of the NFDS from service when not required for operation without impacting NFDS components specific to other IU cells. Further, SHINE FSAR Section 7.8.2.1.3, Protection System Reliability and Testability, states, in part, that The protection systems are designed to permit periodic testing, including a capability to test channels independently to determine failures and losses of redundancy that may have occurred.

However, the SHINE FSAR does not include detailed information on the testing and diagnostics attributes, process, configurations to evaluate conformance to the maintenance and testing features and how SHINE Design Criterion 15 is met for the NFDS.

Update the SHINE FSAR to describe the maintenance and testing that would be performed for the NFDS diagnostic and maintenance features to ensure operability of the equipment.

The information requested above is necessary to support the evaluation findings in Section 7.4 of NUREG-1537, Part 2:

[t]he design reasonably ensures that the design bases can be achieved, the system will be built of high-quality components using accepted engineering and industrial practices, and the system can be readily tested and maintained in the design operating condition.