ML22077A086

Shine Technologies, LLC Application for an Operating License - Supplement No. 20 and Response to Request for Additional Information

ML22077A086
Person / Time
Site:	SHINE Medical Technologies
Issue date:	03/18/2022
From:	Jim Costedio SHINE Medical Technologies
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
2022-SMT-0039
Download: ML22077A086 (44)

Text




      

March 18, 2022 2022-SMT-0039 10 CFR 50.30 U.S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, DC 20555

References:

(1) SHINE Medical Technologies, LLC letter to the NRC, SHINE Medical Technologies, LLC Application for an Operating License, dated July 17, 2019 (ML19211C143)

(2) NRC letter to SHINE Medical Technologies, LLC, SHINE Medical Technologies, LLC - Request for Additional Information Related to the Neutron Flux Detection System (EPID No. L-2019-NEW-0004), dated January 27, 2022 (ML22012A203)

SHINE Technologies, LLC Application for an Operating License Supplement No. 20 and Response to Request for Additional Information Pursuant to 10 CFR Part 50.30, SHINE Technologies, LLC (SHINE) submitted an application for an operating license for a medical isotope production facility to be located in Janesville, Wisconsin via Reference 1. Via Reference 2, the NRC staff determined that additional information was required to enable the staffs continued review of the SHINE operating license application.

Enclosure 1 provides the SHINE Final Safety Analysis Report (FSAR) Change Summary, identifying changes to the SHINE FSAR not related to the SHINE responses to the NRC staffs request for additional information.

Enclosure 2 provides the SHINE response to the NRC staffs request for additional information.

If you have any questions, please contact Mr. Jeff Bartelme, Director of Licensing, at 608/210-1735.

I declare under the penalty of perjury that the foregoing is true and correct.

Executed on March 18, 2022.

Very truly yours, James Costedio Vice President of Regulatory Affairs and Quality SHINE Technologies, LLC Docket No. 50-608 Enclosure cc: Project Manager, USNRC SHINE General Counsel Supervisor, Radioactive Materials Program, Wisconsin Division of Public Health 3400 Innovation Ct

• Janesville, WI 53546

• 877.512.6554

• info@shinemed.com

• www.SHINEtechnologies.com

ENCLOSURE 1 SHINE TECHNOLOGIES, LLC SHINE TECHNOLOGIES, LLC APPLICATION FOR AN OPERATING LICENSE SUPPLEMENT NO. 20 AND RESPONSE TO REQUEST FOR ADDITIONAL INFORMATION FINAL SAFETY ANALYSIS REPORT CHANGE

SUMMARY

Summary Description of Changes FSAR Impacts Update to change the range of the neutron flux Table 7.4-1, detection system (NFDS) wide range channel and Section 7.8 reduce the overlap between the source range and the wide range.

Final Safety Analysis Report (FSAR) mark-ups related to the SHINE Technologies, LLC (SHINE) responses to requests for additional information are provided as Attachment 1 to . FSAR mark-ups associated with the above FSAR change is included with those mark-ups provided as Attachment 1 to Enclosure 2.

The above FSAR change also affects the SHINE request for exemption from criticality accident alarm monitoring requirements for the irradiation unit (IU) cells (Reference 1), which identifies a minimum of two decades of overlap between a source range detector and a power/wide range detector. The reduction of this overlap to one decade does not impact the conclusion of the exemption request nor does it impact the SHINE Responses to related requests for additional information (RAIs) (Reference 2).

References

1. SHINE Medical Technologies, LLC letter to the NRC, Request for Exemption from Criticality Accident Alarm System Monitoring Requirements for the SHINE Irradiation Unit Cells and Material Staging Building, dated January 29, 2021 (ML21029A038)

2. SHINE Medical Technologies, LLC letter to the NRC, SHINE Medical Technologies, LLC Application for an Operating License Response to Request for Additional Information, dated August 31, 2021 (ML21243A267)

Page 1 of 1

ENCLOSURE 2 SHINE TECHNOLOGIES, LLC SHINE TECHNOLOGIES, LLC APPLICATION FOR AN OPERATING LICENSE SUPPLEMENT NO. 20 AND RESPONSE TO REQUEST FOR ADDITIONAL INFORMATION RESPONSE TO REQUEST FOR ADDITIONAL INFORMATION The U.S. Nuclear Regulatory Commission (NRC) staff determined that additional information was required (Reference 1) to enable the continued review of the SHINE Technologies, LLC (SHINE) operating license application (Reference 2). The following information is provided by SHINE in response to the NRC staffs request.

Chapter 7 - Instrumentation and Control Systems RAI 7-36 Note 2 of SHINE FSAR Chapter 3, Design of Structures, Systems, and Components, states that [t]he generally-applicable design criteria 1 - 8 from Table 3.1-3 are not specifically listed even though they are generally applicable to most SSCs. However, it is not clear to the NRC staff whether these design criteria are applicable to the NFDS.

Confirm whether SHINE Design Criteria 1 - 8 are applicable to the NFDS. Update the SHINE FSAR as appropriate to describe the relation of the NFDS design bases to the applicable SHINE Design Criteria 1-8.

This information is necessary for the NRC staff to understand the relation of the design bases to the principal design criteria of facility, as required by 10 CFR 50.34, Contents of applications; technical information.

SHINE Response SHINE Design Criteria 1, 2, 4, and 5 are applicable to the neutron flux detection system (NFDS). SHINE does not rely on the NFDS to satisfy SHINE Design Criteria 3 and 6 through 8.

SHINE has revised Subsection 7.8.2.1 of the FSAR to describe the relationship between the NFDS design basis to SHINE Design Criteria 1, 2, 4, and 5. A markup of the FSAR incorporating these changes is provided as Attachment 1.

RAI 7-37 FSAR Chapter 3, Table 3.1-1, Safety-Related Structures, Systems, and Components, states that SHINE Criterion 13, Instrumentation and controls, is applicable to the NFDS, TRPS, ESFS, and PICS.

Page 1 of 25

FSAR Chapter 3, Table 3.1-3, SHINE Design Criteria, states the SHINE Criterion 13, Instrumentation and controls, as follows:

Instrumentation is provided to monitor variables and systems over their anticipated ranges for normal operation, for anticipated transients, and for postulated accidents as appropriate to ensure adequate safety, including those variables and systems that can affect the fission process, the integrity of the primary system boundary, the primary confinement and its associated systems, and the process confinement boundary and its associated systems.

Appropriate controls are provided to maintain these variables and systems within prescribed operating ranges.

FSAR Section 7.6.1.2, Operator Workstation, states, in part:

The two [Neutron Driver Assembly System (NDAS)] control stations allow operators to monitor and make adjustments to any of the eight neutron drivers in the eight IU cells. The NDAS control stations are only allowed to provide control signals to the NDAS when a permissive provided by the PICS is satisfied. The NDAS control stations are used to interface with the vendor provided NDAS control system described in Subsection 4a2.3.4.

FSAR Section 7.8.2.2.1, General Instrumentation and Control, states, in part, the following NFDS criterion:

NFDS Criterion 1 - The range of operation of detector channels for the NFDS shall be sufficient to cover the expected range of variation of monitored neutron flux during normal and transient operation.

NFDS Criterion 2 - The NFDS shall give continuous indication of the neutron flux from subcritical source multiplication level through licensed maximum power range. The continuous indication shall ensure at least two decades of overlap in indication is maintained while observation is transferred from one channel to another.

NFDS Criterion 3 - The NFDS power range channels shall provide reliable TSV power level while the source range channel provides count rate information from detectors that directly monitor the neutron flux.

NFDS Criterion 4 - The NFDS log power range channel (i.e., wide range channel) and a linear flux monitoring channel (i.e., power range channel) shall accurately sense neutrons during irradiation, even in the presence of intense high gamma radiation.

NFDS Criterion 5 - The NFDS shall provide redundant TSV power level indication through the licensed maximum power range.

NFDS Criterion 26 - The NFDS shall be designed to provide the information necessary to support annunciation of the channel initiating a protective action to the operator.

Therefore, NFDS channels should be sufficient to cover the expected range of variation of the monitored variables (including the neutron flux) over the prescribed operating rangesincluding over its anticipated range for normal operation (from subcritical multiplication source level through the full licensed power range)for postulated accidents, and for accident conditions.

Page 2 of 25

SHINE FSAR Sections 7.8.3.1, Design Bases Functions, and 7.8.4.1, Monitored Variables, describe the variables monitored and their range measurement. These variables are listed in SHINE FSAR Table 7.4-1, TRPS Monitored Variables. Further, SHINE FSAR Section 7.8.2.1.1, Instrumentation and Controls, describes that the NFDS provides continuous indication of the neutron flux during operation, from filling through maximum power during irradiation, and SHINE FSAR Section 7.8.2.2.9, Human Factors, describes that NFDS input to TRPS safety functions are communicated to the PICS to alert the operators. However, the SHINE FSAR does not identify what variables would provide information to the operators in the control room (via the control console) to operate and monitor the neutron driver in each of the eight IU cells, including any information necessary for operators to perform manual protective actions and to meet SHINE Design Criterion 13.

Identify variables to be displayed to operate and monitor the neutron driver in each of the eight IU cells (i.e., IU operation), including any necessary information for operators to perform manual protective actions and to meet SHINE Design Criterion 13, and to verify that the facility has functional protection capability in all operating modes and conditions, as analyzed in the SHINE FSAR. Update the SHINE FSAR as necessary.

The NRC staff needs this information to make a finding that the proposed NFDS will provide all necessary information in the control room for operators to monitor power and perform manual safety actuation, if necessary, and meets the design acceptance.

The information requested is necessary to support the following finding in Section 7.6 of NUREG-1537, Part 2:

The outputs and display devices showing reactor nuclear status should be readily observable by the operator while positioned at the reactor control and manual protection systems.

SHINE Response Indications available to the operator in the facility control room to operate and monitor the neutron driver assembly system (NDAS) is provided in Subsection 7.3.1.1.5 of the FSAR.

Variables associated with the NDAS are not required to satisfy SHINE Design Criterion 13. The NDAS impacts neutron flux, which is monitored by the NFDS. The NFDS monitors neutron flux in ranges listed in Table 7.4-1 of the FSAR. The parameters listed in Table 7.4-1 are available to the Operator in the facility control room as described in the SHINE Response to Part (a) of RAI 7-20 (Reference 3). A description of how the NFDS satisfies SHINE Design Criterion 13 is provided in Subsection 7.8.2.1.1 of the FSAR.

As the above information is already provided in the SHINE licensing basis, no additional need to modify the FSAR was identified.

RAI 7-38 NUREG-1537, Part 2, Section 7.4, describes that descriptive information, including system logic and schematic diagrams, showing all instruments, computer hardware and software, electrical, and electromechanical equipment used in detecting conditions requiring protective action and in initiating the action should be provided and the logic, schematic, and circuit diagrams should show independence of detector channels and trip circuits. Therefore, the NFDS should be Page 3 of 25

designed to automatically initiate the operation of appropriate systems to assure that specified design limits are not exceeded.

SHINE FSAR Chapter 3, Table 3.1-3, states SHINE Criterion 14, Protection system functions, as follows:

The protection systems are designed to:

1) initiate, automatically, the operation of appropriate systems to ensure that specified acceptable target solution design limits are not exceeded as a result of anticipated transients; and

2) sense accident conditions and to initiate the operation of safety-related systems and components.

SHINE FSAR Section 7.8.2.2.1, states, in part, the following NFDS criterion:

NFDS Criterion 6 - The location and sensitivity of at least one NFDS detector in the source range channel, along with the location and emission rate of the subcritical multiplication source, shall be designed to ensure that changes in reactivity will be reliably indicated even with the TSV shut down.

NFDS Criterion 7 - The NFDS shall have at least one detector in the power range channel to provide reliable readings to a predetermined power level above the licensed maximum power level.

SHINE FSAR Section 7.8.4.2, Logic Processing Functions, states, in part:

The NFDS also provides a source range missing and power range missing signal to the PICS for use as an alarm to the operator in alerting that the NFDS is not operating properly.

The TRPS transmits the analog signals as nonsafety-related signals to the PICS to display for operator use when monitoring conditions in the IU cells.

This section in effect describes the signals generated and provided to PICS but does not describe the logic processing within NFDS to generate these signals.

SHINE FSAR Section 7.8.3, Design Bases, describes the measurement ranges for the NFDS.

However, the SHINE FSAR does not describe the logic performed to process the analog signals and generate the actuation signal for TRPS. SHINE FSAR Figure 7.4-1, shows the actuation signals programmed in the TRPS to activate the safety function.

1. Revise the SHINE FSAR to describe how monitored signals are input to NFDS, conditioned to determine power, and transmitted to the TRPS; and where in the two systems the signal is evaluated against defined setpoints in the safety function module with logic to generate safety signals. Revise the FSAR and confirm whether the trip setpoint and actuation is performed within NFDS as described in NFDS Criterion 17; or if trip determination is performed in TRPS and ESFAS based on analog signals from NFDS cabinets (also see RAI 7-47).

Page 4 of 25

2. Confirm if the NFDS is an entirely analog based system as stated in SHINE FSAR Section 7.8.3.2, or if the NFDS includes digital components and/or software that condition analog sensor inputs into analog output signals transmitted to the TRPS (also see RAI 7-42).

SHINE Response

1. The NFDS is a three-division system that contains six detectors.

Three of the six detectors are boron trifluoride proportional counters that provide source range indication for three divisions. The detectors provide signals to NFDS amplifiers where analog signal conditioning is performed. Each of the three divisions of NFDS amplifiers provides a discrete analog signal representative of source range neutron flux to the respective division remote input submodule (RISM) in the target solution vessel (TSV) reactivity protection system (TRPS).

The other three detectors are compensated ion chambers that provide wide range and power range indications for three divisions. Each individual detector provides both a wide range and a power range indication. The detectors provide signals to NFDS amplifiers, separate from the NFDS amplifiers specific to the source range detectors described above, where analog signal conditioning is performed. Each of the three divisions of NFDS amplifiers for the compensated ion chambers provides an analog signal representative of wide range and power range neutron flux to the respective division RISM in the TRPS.

There are no setpoints in the NFDS itself and no logic is performed within the NFDS to compare a reading from a detector to a setpoint. Setpoints associated with the NFDS are contained in the TRPS. The TRPS receives inputs from the NFDS as described above, compares these inputs to the associated setpoints, and generates an actuation signal as necessary. Inputs to the TRPS from the NFDS and the logic used to generate an actuation signal are provided in Figure 7.4-1 of the FSAR. The logic performed within the TRPS is further described in the SHINE Response to RAI 7-21 (Reference 3).

SHINE has revised Subsections 7.8.1, 7.8.2, and 7.8.3 of the FSAR to enhance the description of how signals are conditioned, input to the TRPS, and used in the determination of safety actuations. Section 7.8 of the FSAR has also been revised, as described in Enclosure 1, to update the description of the configuration of NFDS detectors. A mark-up of these changes is provided as Attachment 1.

2. The NFDS is an entirely analog based system as stated in Subsection 7.8.3.2 of the FSAR.

RAI 7-39 NUREG 1537, Part 2, Section 7.4, describes that the protection systems should be reliable and perform their intended safety functions under all conditions. Therefore, the design of the protection systems should consider features that can improve the reliability of the system such as independence, redundancy, diversity, maintenance, testing, and quality components. Further detector channels and control elements should be redundant to ensure that a single random failure or malfunction in the RCS or RPS could not prevent the RPS from performing its intended function or prevent safe shutdown.

Page 5 of 25

SHINE Design Criterion 15, Protection system reliability and testability, states:

The protection systems are designed for high functional reliability and inservice testability commensurate with the safety functions to be performed. Redundancy and independence designed into the protection systems are sufficient to ensure that:

1) no single failure results in loss of the protection function, and

2) removal from service of any component or channel does not result in loss of the required minimum redundancy unless the acceptable reliability of operation of the protection system can be otherwise demonstrated.

FSAR Section 7.8.2.2.1, states, in part, the following NFDS criterion:

NFDS Criterion 11 - The NFDS shall be designed to perform its protective functions after experiencing a single random active failure in nonsafety control systems or in the NFDS, and such failure shall not prevent the NFDS from performing its intended functions or prevent safe shutdown of an IU cell.

NFDS Criterion 12 - The NFDS shall be designed such that no single failure can cause the failure of more than one redundant component.

SHINE FSAR Section 7.8.2.2, NFDS System Design Criteria, describes how the NFDS design meets the SHINE single failure criterion. SHINE FSAR Section 7.8.2.2.2, Single Failure, identifies the NFDS criteria for single failure criteria and describes how the system meets these criteria and that the NFDS is comprised of three redundant divisions. SHINE FSAR Section 7.8.1, System Description, notes that the NFDS is a three-division system with three detectors, and SHINE FSAR Section 7.8.2.2.1, states that each NFDS division includes a fission chamber detector and a Boron Trifluoride detector pair for monitoring the NFDS power and wide range neutron flux. Based on this information, it is not clear to the NRC staff how the three NFDS division detectors operate to ensure that a single failure does not result in loss of the protection or mitigation function and whether the system is vulnerable to a common cause failure (CCF).

1. Update the SHINE FSAR to describe the design and operation of the NFDS to enable verification that single failures do not result in loss of the protection or mitigation function.

2. Update the SHINE FSAR to describe the design features of the NFDS considered to address potential vulnerabilities to CCF.

The information requested is necessary to support the following finding in Section 7.4 of NUREG-1537, Part 2:

Detector channels and control elements should be redundant to ensure that a single random failure or malfunction in the RCS or RPS could not prevent the RPS from performing its intended function, or prevent safe reactor shutdown.

SHINE Response

1. For each NFDS input to the TRPS, there are three divisions of redundant and independent detectors and equipment which provide an analog input to the respective TRPS division, as Page 6 of 25

described in the SHINE Response to RAI 7-38. Automatic protective actions associated with the NFDS utilize two-out-of-three (2oo3) voting logic. The application of the voting logic takes place internal to the TRPS.

The NFDS detectors and equipment are considered as sensors in the single failure analysis of the TRPS and engineered safety features actuation system (ESFAS) described in the SHINE Response to RAI 7-12 (Reference 4). Single failures of the NFDS detectors and equipment do not result in a loss of the protection function, as described in the SHINE Response to RAI 7-12. Subsection 7.4.5.2.2 of the FSAR was updated as part of the SHINE Response to RAI 7-12 to enhance the description of the single failure analysis of the TRPS and ESFAS. A description of failure modes associated with the NFDS is provided in the SHINE Response to RAI 7-45.

2. As described in the SHINE Response to RAI 7-38, the NFDS is an entirely analog based system. As such, the NFDS is not susceptible to digital-based common cause failures (CCFs).

RAI 7-40 SHINE FSAR Chapter 3, Table 3.1-3, states SHINE Criterion 16, Protection system independence, as follows:

The protection systems are designed to ensure that the effects of natural phenomena, and of normal operating, maintenance, testing, and postulated accident conditions on redundant channels do not result in loss of the protection function or are demonstrated to be acceptable on some other defined basis. Design techniques, such as functional diversity or diversity in component design and principles of operation, are used to the extent practical to prevent loss of the protection function.

FSAR Section 7.8.2.2.1, states, in part, the following NFDS criterion:

NFDS Criterion 8 - The NFDS shall be separated from the PICS to the extent that any removal of a component or channel common to both the NFDS and the PICS preserves the reliability, redundancy, and independence of the NFDS.

NFDS Criterion 10 - The timing of NFDS communications shall be deterministic.

NFDS Criterion 13 - Physical separation and electrical isolation shall be used to maintain the independence of NFDS circuits and equipment among redundant safety divisions or with non-safety systems so that the safety functions required during and following any maximum hypothetical accident or postulated accident can be accomplished.

NFDS Criterion 14 - The NFDS shall be designed such that no communication-within a single safety channel, between safety channels, and between safety and non-safety systems-adversely affects the performance of required safety functions.

SHINE FSAR Section 7.8.2.1.4, Protection System Independence, describes how the NFDS meets SHINE Design Criterion 16. This description refers to other sections in the FSAR that cover independence and equipment qualification for operation during normal and design basis event.

Page 7 of 25

SHINE FSAR Section 7.8.2.1.3, Protection System Reliability and Testability, describes the independent NFDS divisions interface with TRPS, which has been analyzed for single failure in accordance with the Institute of Electrical and Electronics Engineers (IEEE) Standard 379-2000, IEEE Standard Application of the Single-Failure Criterion to Nuclear Power Generating Station Safety Systems, for all inputs, including NFDS.

SHINE FSAR Section 7.8.2.2.3, Independence, identifies the NFDS criteria for single failure criteria and how the system meets these criteria. This section describes that the system is physically and electrically independent. SHINE FSAR Section 7.8.3.4, Independence, then repeats this information and adds the location where the detectors would be installed. This section further describes that each NFDS division is independent from each other.

SHINE FSAR Section 7.8.2.2.1, notes that the positioning of the NFDS source range detectors, and the location, and emission rate of the subcritical multiplication source, is designed so that all three channels are on scale throughout filling. However, the FSAR does not provide sufficient information how these designs were implemented.

Regarding independence of communication, the SHINE FSAR describes how the NFDS meets this independence in several sections of the SHINE FSAR. SHINE FSAR Section 7.8.2.1.3, Protection System Reliability and Testability, describes that interfacing systems with the NFDS are downstream of the NFDS such that a failure of an interfacing nonsafety system will not impact the NFDS. SHINE FSAR Sections 7.8.2.1.6, Separation of Protection and Control Systems, 7.8.2.2.1, 7.8.2.2.2, and 7.8.2.2.3, Independence, state that communication with TRPS and PICS are continuous through isolated outputs that only allow the data to be transmitted out of the system so that no failure from an interfacing system can affect the functions of the NFDS. However, SHINE FSAR Section 7.8.4.2, Logic Processing Functions, describes that the TRPS transmits the analog signals as nonsafety-related signals to the PICS to display for operator use when monitoring conditions in the IU cells. It is not clear to the NRC staff whether the NFDS communicates directly with PICS or if it is through the TRPS.

After reviewing the information provided in the SHINE FSAR, the NRC staff found that these sections do not provide sufficient information for the NRC staff to evaluate how the NFDS meets the independence criteria. Further during the audit performed on May 12, 2021 (ADAMS Accession No. ML21130A313), SHINE staff stated that a new signal transmitted from the TRPS to the NFDS was added to the design. This signal is not described in the SHINE FSAR. Various places in the FSAR it states that NFDS provides analog signals to TRPS, however, the NRC staff was unable to locate any specific information on methods of communication, signal scaling, linear or log based, etc. Therefore, provide in the SHINE FSAR the following information:

1. Type of signals and communication mechanisms and isolation for signals transmitted from the NFDS to the TRPS.

2. Confirm whether signals are transmitted from the NFDS directly to the PICS (as depicted in FSAR Figure 7.1-1). If so, identify type of signals and communication mechanisms and isolation for signal transitions.

3. Type of signals and communication mechanisms for signals transmitted from the TRPS to the NFDS.

Page 8 of 25

The information requested is necessary to support the following findings in Section 7.3 of NUREG-1537, Part 2:

The RCS should give continuous indication of the neutron flux from subcritical source multiplication level through the licensed maximum power range. This continuous indication should ensure about one decade of overlap in indication is maintained while observation is transferred from one detector channel to another.

The sensitivity of each sensor channel should be commensurate with the precision and accuracy to which knowledge of the variable measured is required for the control of the reactor.

The system should give reliable reactor power level and rate-of-change information from detectors or sensors that directly monitor the neutron flux.

The system should give reliable information about the status and magnitude of process variables necessary for the full range of normal reactor operation.

SHINE Response

1. In the source range, the NFDS provides a voltage pulse signal to the TRPS with each voltage pulse corresponding to a pulse from the associated boron trifluoride (BF3) proportional counter.

In the wide range and power range, the signal from the compensated ion chambers (CICs) is input to log and linear amplifiers which output 0 to 4 volt signals to TRPS, respectively.

The signals from both the BF3 proportional counters and the CICs to the TRPS are one-way through isolated outputs.

SHINE has revised Subsection 7.8.3.2 of the FSAR to enhance the description of the analog signals sent from the NFDS to the TRPS. A markup of the FSAR incorporating these changes is provided as Attachment 1.

2. The NFDS does not transmit signals directly to the process integrated control system (PICS). The NFDS sends signals to the TRPS, as shown in Figure 7.1-1 of the FSAR.

3. There are no signals transmitted from the TRPS to the NFDS during normal operations.

Signals and communication mechanisms for signals transmitted from the TRPS and NFDS during a channel test and NFDS electronics calibration are described in the SHINE Response to RAI 7-48.

RAI 7-41 SHINE FSAR Chapter 3, Table 3.1-3, SHINE Design Criteria, the SHINE Criterion 18, Separation of protection and control systems, states the protection system is separated from control systems to the extent that failure of any single control system component or channel, or failure or removal from service of any single protection system component or channel that is common to the control and protection systems leaves intact a system satisfying all reliability, Page 9 of 25

redundancy, and independence requirements of the protection system. Interconnection of the protection and control systems is limited to assure that safety is not significantly impaired.

SHINE FSAR Section 7.8.2.1.6, Separation of Protection and Control Systems, describes how the NFDS design meets this criterion. However, the FSAR description does not address separation of protection and control. This description appears to focus on the NFDS meets single failure criterion and communication independence.

It is the NRC staffs understanding that signals from the NFDS are transmitted to both the TRPS for protection and to the PICS for control and operation of the IU cells. Therefore, the neutron flux sensors and channels are shared by the protection and control systems. The SHINE FSAR should describe how failure or removal of NFDS from service would not affect the protection function of the TRPS.

Revise the SHINE FSAR to include a description of how the NFDS design meets SHINE design Criterion 18 to perform its protection function given a failure of a shared component, and clearly reflect the intended design of components shared to protect and control certain operations.

The information requested is necessary to support the following finding in Section 7.4 of NUREG-1537, Part 2:

The RPS design is sufficient to provide for all isolation and independence from other reactor subsystems required by SAR analyses to avoid malfunctions or failures caused by the other systems.

SHINE Response There are no shared signals from the NFDS that have both a TRPS safety-related protection function and a nonsafety-related control function. A description of how a failure or removal of NFDS components from service does not affect the protection function is provided in the SHINE Response to RAI 7-45.

SHINE has revised Subsection 7.8.2.1.6 of the FSAR to enhance the description of how the NFDS satisfies SHINE Design Criterion 18. A markup of the FSAR incorporating this change is included as Attachment 1.

RAI 7-42 NUREG-1537, Part 2, Section 7.4, Reactor Protection System and Section 7.5 Engineered Safety Features Actuation Systems describes in part that hardware and software for computerized systems should meet the guidelines of IEEE-7-4.3.2-1993 and Regulatory Guide (RG) 1.152, Revision 1, Criteria for Digital Computers In Safety Systems of Nuclear Power Plants, and software should meet the guidelines of American National Standards Institute/American Nuclear Society-10.4-1987, Guidelines for the Verification and Validation of Scientific and Engineering Computer Programs for the Nuclear Industry.

SHINE FSAR Section 7.8.2.2, discusses how the NFDS meets the single failure criterion. As part of this description, the licensee notes that the NFDS consists of detectors, preamplifiers, and processing circuits for single failure protection. Even though SHINE FSAR Section 7.8.3.2, Simplicity, describes that the system is analog, the description in SHINE FSAR Section 7.8.2.2.2, could imply that digital equipment is embedded to perform the functions of Page 10 of 25

preamplifiers and processing. Further, SHINE FSAR Section 7.8.2.2.7, Surveillance, notes that the NFDS transmits two discrete signals to the PICS. Based on this information, the NRC staff is not certain if the NFDS include embedded digital equipment. If this assumption is correct, the SHINE FSAR does not describe the digital equipment embedded within the NFDS. Further, the SHINE FSAR does not provide information to evaluate how the NFDS meet the acceptance criteria for software development.

Confirm whether the NFDS includes embedded digital equipment to perform the functions of preamplification and processing. If this is the case, then update the SHINE FSAR to describe software development plan, development, and testing results to verify conformance with the guidelines of IEEE Std 7-4.3.2 and RG 1.152, as applicable.

The information requested is necessary to support the following finding in Section 7.3 and 7.4 of NUREG-1537, Part 2:

Hardware and software for computerized systems should meet the guidelines of IEEE 7-4.3.2-1993, 'IEEE Standard Criteria for Digital Computers Systems in Safety Systems of Nuclear Power Generating Stations,' and Regulatory Guide (RG) 1.152, "Criteria for Digital Computers in Safety Systems of Nuclear Power Plants," Revision 1, which is attached to Chapter 7 of the format and content guide as Appendix 7.1, and software should meet the guidelines of ANSI/ANS 10.4-1987, Guidelines for the Verification and Validation of Scientific and Engineering Computer Programs for the Nuclear Industry," that apply to non-power reactor systems.

SHINE Response The NFDS does not contain embedded digital equipment to perform the functions of preamplification and processing.

RAI 7-43 NUREG-1537, Part 2 describes that the protection systems should be fail-safe against malfunction and electrical power failure, should be as close to passive as can be reasonably achieved, should go to completion once initiated, and should go to completion within the time scale derived from applicable analyses in the SAR.

FSAR Chapter 7, Section 7.8.2.2.4, Fail Safe, includes NFDS Criterion 15 which requires the NFDS and associated components shall be designed to assume a safe state on loss of electrical power. FSAR Section 7.8.2.2.4 also states, in part: The NFDS is designed so that a failure due to loss of power to the NFDS or a removal of an NFDS channel interacts the same with the TRPS as if there was a positive trip determination output to the TRPS. However, the FSAR does not contain a basic design description summary of the power supply arrangement that enables NRC staff to verify the NFDS conforms with Criterion 15. The FSAR describes the behavior, but not the equipment and how it operates to achieve the behavior. FSAR Section 7.8.3.5 describes the requirements for loss of external power and some description of the power supply design: The NFDS is supplied power from the uninterruptible power supply system (UPSS) upon a loss of off-site power. However, it is not clear how the two train UPSS is connected to the three train NFDS, and whether the configuration is aligned with TRPS power arrangement as described in FSAR.

Page 11 of 25

Update the SHINE FSAR to describe the power supply arrangement to demonstrate the NFDS design achieves a safe state for power loss.

This information is necessary to support the evaluation findings in Section 7.4 of NUREG-1537, Part 2:

The design reasonably ensures that the design bases can be achieved, the system will be built of high-quality components using accepted engineering and industrial practices, and the system can be readily tested and maintained in the designed operating condition.

SHINE Response NFDS equipment associated with division A receives power from division A of the uninterruptible power supply system (UPSS). NFDS equipment associated with division B receives power from division B of the UPSS. NFDS equipment associated with division C receives auctioneered power from division A and division B of the UPSS. The UPSS provides safety-related power to system loads, including the NFDS, as described in Subsection 8a2.2.3 of the FSAR.

SHINE has revised Subsection 7.8.3.5 of the FSAR to enhance the description of how the NFDS receives power from the UPSS. A markup of the FSAR incorporating these changes is provided as Attachment 1.

RAI 7-44 NUREG-1537, Part 1, Section 7.2.4, System Performance Analysis, describes that the applicant should conduct a performance analysis of the proposed I&C system to ensure the design criteria and design bases are met and license requirements for the performance of the system are specified. The system performance analysis should encompass the technical specification (TS) limiting safety system settings (LSSSs), limiting conditions for operation (LCOs), and surveillance requirements (SRs) for the I&C system should be established. These parameters and requirements should include system operability tests, trip, or actuation setpoint checks, trip or actuation-setpoint calibrations, and any system response-time tests that are required. Surveillance intervals should be specified and the bases for the intervals, including operating experience, engineering judgment, or vendor recommendation.

SHINE FSAR Chapter 3, Table 3.1-3, states, in part, SHINE Design Criterion 15, Protection system reliability and testability, as follows:

The protection systems are designed for high functional reliability and inservice testability commensurate with the safety functions to be performed.

SHINE FSAR Section 7.8.2.2.7, Surveillance, states, in part, the following NFDS criterion:

NFDS Criterion 21 - The NFDS shall provide the capability for calibration, inspection, and testing to validate the desired functionality of the NFDS.

NFDS Criterion 23 - Testing, calibration, and inspections of the NFDS shall be sufficient to confirm that surveillance test and self-test features address failure detection, self-test capabilities, and actions taken upon failure detection.

Page 12 of 25

NFDS Criterion 24 - The design of the NFDS and the justification for test intervals shall be consistent with the surveillance testing intervals as part of the facility technical specifications.

NFDS Criterion 22 - Equipment in the NFDS (from the input circuitry to output actuation circuitry) shall be designed to allow testing, calibration, and inspection to ensure operability.

If testing is required or can be performed as an option during operation, the NFDS shall retain the capability to accomplish its safety function while under test.

SHINE FSAR Section 7.8.4.3, Technical Specifications and Surveillance, states: Limiting Conditions for Operation and Surveillance Requirements are established for the NFDS in the technical specification. The neutron flux detector setpoints bound normal operations and accident conditions and provide margin to analytical limits.

However, the SHINE TS does not include a limited condition of operation (LCO) and SR for the NFDS. However, the SHINE TS includes TS SR 3.2.3 to require weekly channel check of the NFDS, without specifying what constitutes a channel for the NFDS (as this term is defined for each SHINE TS LCO in the corresponding SHINE TS bases).

Further, the SHINE TS Table 3.2.3-a, TRPS Instrumentation, lists the setpoint for the NFDS and SHINE FSAR Table 7.4-1, identifies the analytical limit and range for the NFDS. However, the SHINE FSAR and SHINE TS do not include sufficient information for the NRC staff to evaluate that the neutron flux detector setpoints bound normal operations and accident conditions and provide margin to analytical limits.

Based on this, the SHINE FSAR does not include a description or reference to the system performance analysis that encompasses the SHINE TS LSSSs, LCOs, and SRs for the NFDS.

Revise the SHINE FSAR to include a reference and/or description to the system performance analysis that addresses the SHINE TS LSSS, LCOs, and SRs for the NFDS.

This information is necessary to support the acceptance criteria in Section 7.4 of NUREG-1537, Part 2:

Technical specifications, including surveillance tests and intervals, should be based on discussions and analyses in the SAR of required safety functions.

SHINE Response A description of the analysis that was performed for the purpose of identifying the technical specification limiting safety system settings (LSSSs), limiting conditions for operation (LCOs),

and surveillance requirements (SRs) for the instrumentation and controls (I&C) systems, which include the NFDS, is provided in the SHINE Response to Part (a) of RAI 7-23 (Reference 3).

The NFDS is an input device to the TRPS, and as such, is included within the scope of LCO 3.2.3 of the technical specifications as items a., b., and c. of Table 3.2.3-a. The description of what constitutes an NFDS channel is included with those of the other input devices described in the Basis 3.2.3 associated with LCO 3.2.3 (i.e., a TRPS input channel consists of the field instrument through the safety function module [SFM], ending at the input to the scheduling, bypass and voting modules [SBVMs] or scheduling and bypass modules [SBMs]).

Page 13 of 25

A description of setpoints in the TRPS associated with NFDS inputs is provided in the SHINE Response to RAI 7-47.

RAI 7-45 NUREG-1537, Part 2, Section 7.4, describes that the shutdown function of the protection system be fail-safe against malfunction and electrical power failures.

SHINE FSAR, Chapter 3, Table 3.1-3, SHINE Design Criterion 15, Protection system reliability and testability, states:

The protection systems are designed for high functional reliability and inservice testability commensurate with the safety functions to be performed. Redundancy and independence designed into the protection systems are sufficient to ensure that:

1) no single failure results in loss of the protection function, and

2) removal from service of any component or channel does not result in loss of the required minimum redundancy unless the acceptable reliability of operation of the protection system can be otherwise demonstrated.

Further, SHINE Design Criteria 16, Protection system independence, and 17, Protection system failure modes, require the system be designed to fail into a safe state if conditions such as disconnection of the system, loss of power, or postulated adverse environments are experienced.

SHINE FSAR Chapter 7, Section 7.8.2.2.4, Fail Safe, states, in part, the following:

NFDS Criterion 15 - The NFDS and associated components shall be designed to assume a safe state on loss of electrical power.

NFDS Criterion 16 - The NFDS shall not be designed to fail or operate in a mode that could prevent the TRPS from performing its intended safety function. The design of the NFDS shall consider:

1) The effect of NFDS on accidents

2) The effects of NFDS failures

3) The effects of NFDS failures caused by accidents.

The failure analyses shall cover hardware and software failures associated with the NFDS.

SHINE FSAR Sections 7.8.2.1.3, Protection System Reliability and Testability, 7.8.2.1.4, and 7.8.2.1.5, Protection System Failure Modes, describe how the NFDS design meets the SHINE Design Criteria 15, Protection system reliability and testability, 16, Protection system independence, and 17, Protection system failure modes. Further, SHINE FSAR Section 7.8.2.2.4, Fail Safe, described how the system meets NFDS Criteria 15 and 16.

However, the FSAR descriptions provides information on independence of the safety systems, as well as the requirement for the systems to be protected from earthquakes, adverse environmental conditions, and loss of power. Also, SHINE FSAR Section 7.8.2.2.4, describes that the design (of the NFDS) identifies and compensates for failed system elements. However, SHINE FSAR Sections 7.8.2.2.7, Surveillance, and 7.8.3.10, Maintenance and Testing, Page 14 of 25

describes that the only form of fault detection normally available is the source range missing and power range missing, which would be provided to the PICS as discrete signals.

The SHINE FSAR does not identify what known failures can affect the systems, how they would be addressed, and the fail-safe state of variables controlled by the safety systems. SHINE FSAR does not include information on the configuration of self-test or fault detection, and how the system compensates for failed elements. Also, the provided descriptions in the SHINE FSAR do not demonstrate whether failures of connected systems, especially non-safety systems, would not prevent the NFDS and therefore the TRPS from performing its safety function. The SHINE FSAR should describe the potential vulnerabilities that can affect their operation and how the systems would behave under specific identified failure modes.

1. Update the SHINE FSAR to describe the failure modes analyzed for the NFDS, as well as the design, configuration, and implementation of fault detection considered.

2. Update the SHINE FSAR to identify what signal would be sent from the NFDS to the TRPS during a NFDS loss of power event and any other failures analyzed.

This information is necessary to support the evaluation findings in Section 7.4 of NUREG-1537, Part 2:

The automatic reactor runback or shutdown (scram) subsystem should be fail-safe against malfunction and electrical power failure, should be as close to passive as can be reasonably achieved, should go to completion once initiated, and should go to completion within the time scale derived from applicable analyses in the SAR.

SHINE Response

1. Potential failure types for inputs from the NFDS to the TRPS are evaluated in the failure modes and effects analysis (FMEA) described in the SHINE Response to RAI 7-12 (Reference 4). The failure types identified for these inputs include the signal Failing Low, Failing High, Short Circuit, Open Circuit, Fail As Is, and a Loose Connection.

For the Failing Low and Failing High failure types, automatic signal limits checking in the SFM detects the fault and generates alarm information which is provided to the PICS for alerting an operator. When this type of fault occurs, the SFM provides the fault information to its associated SBM or SBVM and the partial trip information for the failed channel is determined by the SBMs or SBVMs based on the state of the associated SFMs Trip/Bypass switch, the position of which is controlled by facility technical specifications during normal operation.

For the Short Circuit and Open Circuit failure types, the result is similar to the Failing Low/Failing High failure types in that the fault is detected by self-testing in the input submodule (ISM) or the field programmable gate array (FPGA) on the RISM, the fault information is then provided to the associated SBMs or SBVMs, and the partial trip information for the failed channel is determined by the SBMs or SBVMs based on the state of the associated SFMs Trip/Bypass switch.

For the Fail As Is failure type, the associated division is not able to determine the need for a protective action when conditions exist. Since the NFDS has 2oo3 voting, there are two other divisions available to make a trip determination.

Page 15 of 25

For the Loose Connection failure type, this would have a similar result as the Failing Low, Failing High, or Open Circuit failure types.

As described in the SHINE Response to RAI 7-41, there are no shared signals from the NFDS that have both a TRPS safety-related protection function and a nonsafety-related control function. Failures of nonsafety-related systems do not impact the NFDS from performing its safety function.

SHINE has revised Subsection 7.8.2.2.7 of the FSAR to enhance the description of fault detection in satisfying system-specific design criteria. SHINE has also revised Subsection 7.8.3.3 of the FSAR to enhance the description of how the NFDS satisfies single failure criteria. A markup of the FSAR incorporating these changes is included as Attachment 1.

2. If the NFDS were to lose power, analog outputs to the TRPS Fail Low and the partial trip information for the failed channel are determined by associated SFMs out of service status as described above. Any other known failures associated with the NFDS coincident with loss of power do not result in a failure different from the six failure types discussed above.

SHINE has revised Subsection 7.8.3.5 of the FSAR to enhance the description of a loss of power for the NFDS. A markup of the FSAR incorporating these changes is provided as Attachment 1.

RAI 7-46 NUREG-1537, Part 2, Section 7.4, describes, in part, that the design of the protection systems should be adequate to perform the functions necessary to ensure safety. Therefore, the design of the SHINE facility should include provisions for the protection systems to reliably operate in the normal range of environmental conditions and postulated credible accidents, transients, and other events at the facility that could require their operation.

FSAR Table 3.1-3, SHINE Design Criteria, states, in part, the following general design criterion:

SHINE Design Criterion 16, Protection system independence, [t]he protection systems are designed to ensure that the effects of natural phenomena, and of normal operating, maintenance, testing, and postulated accident conditions on redundant channels do not result in loss of the protection function or are demonstrated to be acceptable on some other defined basis.

SHINE Design Criterion 19, Protection against anticipated transients, [t]he protection systems are designed to ensure an extremely high probability of accomplishing their safety functions in the event of anticipated transients.

FSAR, Section 7.8.2.2.1, states the following NFDS design criterion:

NFDS Criterion 9 - The NFDS detectors shall be qualified for continuous submerged operation within the light water pool. The NFDS detector housings shall be watertight and supported by a sleeve structure, mounted to the SASS [subcritical assembly support structure], at specific locations surrounding the SASS.

Page 16 of 25

NFDS Criterion 20 - The effects of electromagnetic interference/radiofrequency interference (EMI/RFI) and power surges on the NFDS shall be adequately addressed.

SHINE FSAR Section 7.8.2.1.4, describes how the NFDS design meets the SHINE Design Criterion 16, Protection system independence, and SHINE FSAR Section 7.8.2.1.7, Protection Against Anticipated Transients, describes it for SHINE Design Criterion 19, Protection against anticipated transients. SHINE FSAR Sections 7.8.2.2.1, and 7.8.2.2.6, Equipment Qualification, describe how the NFDS design meets NFDS Design Criteria 9 and 20, respectively. Also, SHINE FSAR Section 7.8.3.7, Equipment Qualification, describe the equipment qualification for the NFDS.

SHINE FSAR Section 7.8.3.11, Codes and Standards, identifies the codes and standards to be used in qualifying the NFDS.

While these FSAR sections describe applicable environmental qualification criteria, the FSAR does not provide information to demonstrate that the NFDS has been qualified to meet the environmental qualification criteria and associated SHINE Design Criterion described above.

1. Update the SHINE FSAR to demonstrate that the NFDS equipment has undergone environmental, seismic, radiation, electrical isolation, EMI/RFI, surge and emissions qualifications and that the results envelope the operating and transient conditions identified for the facility.

2. Update the SHINE FSAR to describe how codes and standards listed in the SHINE FSAR are used to qualify the NFDS.

This information is necessary to support the evaluation findings and acceptance criteria in Section 7.4 of NUREG-1537, Part 2:

The design reasonably ensures that the design bases can be achieved, the system will be built of high-quality components using accepted engineering and industrial practices, and the system can be readily tested and maintained in the designed operating condition.

The RPS should be designed for reliable operation in the normal range of environmental conditions anticipated within the facility.

SHINE Response The NFDS is qualified by the vendor. A discussion of the environmental, seismic, and electromagnetic interference (EMI)/radio frequency interference (RFI) qualifications testing of the NFDS are as follows.

Environmental Qualification NFDS is environmentally qualified by analysis using guidance provided in Sections 4.1, 4.2, 5.1, 6.1 and 7 of Institute of Electrical and Electronics Engineers (IEEE) Standard 323-2003, Standard for Qualifying Class 1E Equipment for Nuclear Power Generating Stations (Reference 5). The NFDS is qualified to the environmental parameters provided in Tables 7.2-1, 7.2-3, and 7.2-4 of the FSAR.

Page 17 of 25

Seismic Qualification The NFDS is seismically qualified in accordance with Section 8 of IEEE Standard 344-2013, Recommended Practice for Seismic Qualification of Class 1E Equipment for Nuclear Generating Stations (Reference 6).

EMI/RFI Qualification EMI/RFI qualification of the NFDS is performed by testing for emissions, susceptibility, and power surge withstand capability. The NFDS is grounded in accordance with Section 5.2.1 of IEEE Standard 1050-2004, Guide for Instrumentation and Control Equipment Grounding in Generating Stations (Reference 7).

SHINE has revised Subsections 7.8.3 and 7.8.4 of the FSAR to enhance the explanation of how the NFDS is qualified for the seismic, environmental, and electromagnetic conditions anticipated in the facility. A markup of the FSAR incorporating these changes is provided as Attachment 1.

RAI 7-47 NUREG-1537, Part 2, Section 7.4, acceptance criteria, states, in part, that The range of operation of sensor (detector) channels should be sufficient to cover the expected range of variation of the monitored variable during normal and transient operation. NUREG-1537, Part 2, Sections 7.3, 7.4, and 7.7, acceptance criteria, state, in part, that The sensitivity of each sensor channel should be commensurate with the precision and accuracy to which knowledge of the variable measured is required. NUREG-1537, Part 2, Section 7.5, Engineered Safety Features Actuation Systems, acceptance criteria, states, The range and sensitivity of ESF

[engineered safety features] actuation system sensors should be sufficient to ensure timely and accurate signals to the actuation devices.

Subparagraph (c)(1)(ii)(A) of 10 CFR 50.36, Technical specifications, describes that LSSS are settings for automatic protective devices related to those variables having significant safety functions. This clause requires that where a LSSS is specified for a variable on which a safety limit has been placed, the setting must be chosen so that automatic protective action will correct the abnormal situation before a safety limit is exceeded.

Subparagraph (c)(3) of 10 CFR 50.36 states, Surveillance requirements are requirements relating to test, calibration, or inspection to assure that the necessary quality of systems and components is maintained, that facility operation will be within safety limits, and that the limiting conditions for operation will be met.

FSAR, Section 7.8.2.2.5, Setpoints, states the following NFDS design criterion:

NFDS Criterion 17 - Neutron flux setpoints for an actuation of the NFDS shall be based on a documented analysis methodology that identifies assumptions and accounts for uncertainties, such as environmental allowances and measurement computational errors associated with each element of the instrument channel. The setpoint analysis parameters and assumptions shall be consistent with the safety analysis, system design basis, technical specifications, facility design, and expected maintenance practices.

Page 18 of 25

NFDS Criterion 18 - Adequate margin shall exist between setpoints and safety limits so that the TRPS initiates protective actions before safety limits are exceeded.

NFDS Criterion 19 - The sensitivity of each NFDS sensor channel shall be commensurate with the precision and accuracy to which knowledge of the variable measured is required for the protective function.

The NFDS transmits the power levels to the TRPS to protect the primary system boundary (PSB) from exceeding the individual SHINE TS safety limits (SLs) using independent channels when the facility operates in accordance with the TS LCOs. SHINE TS, Section 2.0, Safety Limits and Limiting Safety System Settings, defines SLs to protect the PSB and LSSSs for safety systems to initiate their protective functions. The SHINE FSAR, Table 7.4-1, identifies the variables monitored by the TRPS. This table also provides instrument range, accuracy for each variable monitored, and its analytical limit. SHINE TS Table 3.2.3-a, TRPS Instrumentation, identifies the NFDS setpoints for the safety function to protect against analyzed events and conditions.

The SHINE FSAR does not describe the methodology used to determine the NFDS setpoints and only notes that a setpoint methodology was used to determine setpoints for the NFDS variables monitored by the TRPS. The setpoints for protective function should be based on a documented analysis methodology that identifies assumptions and accounts for instrument uncertainties, such as environmental allowances and measurement computational errors associated with each element of the instrument channel.

1. Revise the SHINE FSAR to identify and describe the functions of the setpoints within the NFDS. It is recognized that there are setpoint associated with the NFDS that are contained within the TRPS, and these setpoints are addressed by TRPS related setpoint criteria. Do the setpoint criteria and descriptions within the system boundary of the NFDS sections cause the NFDS related setpoint within the system boundary of the TRPS to be treated differently than other setpoints within the TRPS?

2. Revise the SHINE FSAR to describe the setpoint methodology used to establish the NFDS setpoints or SHINE TS LSSS from the analytical limits for the variables monitored by the NFDS. Description of the setpoint methodology should include parameters typically consider instrument precision, sensitivity, accuracy, loop uncertainties, and computational errors.

3. Provide a description how SHINE determined equipment accuracy identified in SHINE FSAR Table 7.4-1 to bound uncertainties and how the equipment accuracy is used in the setpoint methodology. (Also, see RAI 7-20(f) in which the NRC staff requested information on the setpoint methodology used to establish the setpoints or LSSS from the analytical limits for the variables monitored by the TRPS and ESFAS.)

The information requested above is necessary to support the evaluation findings in Section 7.4 of NUREG-1537, Part 2:

The protection channels and protective responses are sufficient to ensure that no safety limit, limiting safety system setting, or RPS-related limiting condition of operation discussed and analyzed in the SAR will be exceeded.

Page 19 of 25

SHINE Response

1. As described in the SHINE Response to RAI 7-38, there are no setpoints within the NFDS.

Setpoints associated with signals generated from the NFDS are contained within the TRPS.

Setpoints related to the NFDS are not treated differently than other setpoints within the TRPS.

2. The SHINE Response to Part (f) of RAI 7-20 (Reference 3) provides a description of the methodology used to determine setpoints associated with the NFDS and a revision to the FSAR that enhanced the description of the setpoint methodology used to establish the LSSS from the analytical limit for variables monitored by the TRPS.

3. The equipment accuracy identified in Table 7.4-1 of the FSAR is the sensor reference accuracy (SRA), which is determined and applied as described in the SHINE Response to Part (f) of RAI 7-20.

RAI 7-48 NUREG-1537, Part 2, Section 7.4, acceptance criteria, states, in part, that [t]he RPS be sufficiently distinct in function from the RCS that its unique safety features can be readily tested, verified, and calibrated. In addition, NUREG-1537, Part 2, Section 7.4, acceptance criteria, states, in part, that [t]he RPS function and time scale should be readily tested to ensure operability of at least minimum protection for all operations. Therefore, the NFDS should be designed to be readily tested and calibrated to ensure operability. Additionally, the SHINE proposed TSs, including surveillance tests and intervals, should ensure availability and operability of these actuation systems.

SHINE Design Criterion 15, Protection system reliability and testability, requires the protection system be designed to permit periodic testing, including a capability to test channels independently to determine failures and losses of redundancy that may have occurred.

The SHINE TS does not include a LCO for the NFDS and includes SR 3.2.3 to require weekly channel check of the NFDS. SHINE FSAR Section and 7.8.3.10 Maintenance and Testing, states that The NFDS supports testing and calibration to ensure operability as required by the technical specifications. The NFDS is designed to allow operators to remove portions of the NFDS from service when not required for operation without impacting NFDS components specific to other IU cells. Further, SHINE FSAR Section 7.8.2.1.3, Protection System Reliability and Testability, states, in part, that The protection systems are designed to permit periodic testing, including a capability to test channels independently to determine failures and losses of redundancy that may have occurred.

However, the SHINE FSAR does not include detailed information on the testing and diagnostics attributes, process, configurations to evaluate conformance to the maintenance and testing features and how SHINE Design Criterion 15 is met for the NFDS.

Update the SHINE FSAR to describe the maintenance and testing that would be performed for the NFDS diagnostic and maintenance features to ensure operability of the equipment.

Page 20 of 25

The information requested above is necessary to support the evaluation findings in Section 7.4 of NUREG-1537, Part 2:

[t]he design reasonably ensures that the design bases can be achieved, the system will be built of high-quality components using accepted engineering and industrial practices, and the system can be readily tested and maintained in the design operating condition.

SHINE Response The operability of the NFDS is demonstrated by the performance of surveillance requirements associated with LCO 3.2.3 of the technical specifications. A channel check is performed on each NFDS channel weekly to ensure continued operability of the channels. A channel calibration, which includes a channel test, is performed annually.

Channel Test The NFDS provides neutron flux inputs to the TRPS RISMs. There are two RISMs in each of Divisions A, B, and C of the TRPS, one RISM for source range neutron flux input (BF3 detector) and another RISM for wide range and power range neutron flux inputs (CIC detector). Each RISM is directly associated with a single SFM within the division that allows for remotely locating one Highly Integrated Protection System (HIPS) ISM (mounted on the RISM module) from its associated SFM. Once an input channel is in digital format on the ISM, the input information is provided by the RISM via an isolated, one-way RS-485 connection to its associated SFM within the division for triplication and trip determination. There is an additional RS-485 connection between the RISM and its associated divisional SFM which independently supports modification of tunable parameters and testing necessary on the RISM for the associated neutron flux detector.

For each NFDS BF3 input channel, the following interfaces between the associated TRPS RISM and the respective divisional NFDS equipment are provided:

Source Range analog pulse output from NFDS to the TRPS RISMs FPGA; Non-Operative analog output from NFDS to the TRPS RISMs FPGA; Threshold serial peripheral interface (SPI) output from the TRPS RISMs FPGA to the NFDS; High Voltage SPI output from the TRPS RISMs FPGA to the NFDS; Test Request analog output from the TRPS RISMs FPGA to the NFDS; Test Pulse analog output from the TRPS RISMs FPGA to the NFDS; and High Voltage Enable analog output from the TRPS RISMs FPGA to the NFDS.

Modification of the NFDS BF3 tunable parameters (i.e., Threshold SPI and High Voltage SPI) is accomplished via the TRPS and ESFAS maintenance workstation (MWS), as described in the SHINE Response to RAI 7-18 (Reference 4). The MWS allows a technician password protected access to select the system (TRPS), the specific irradiation unit (IU) cell, the division (A, B, or C), the specific RISM, and the tunable parameter which is to be modified. Then a MWS enable hardwired switch is required to be activated to allow for physical connection of the MWS to the calibration and test bus (CTB). The technician must then use the MWS to select the parameter and the associated parameter value to be updated, then the option to update the tunable parameter is enabled to allow the user to select it. When this occurs, the MWS issues a Page 21 of 25

write command to the SFM, which then sends the write command to the RISM, which then writes the data into a nonvolatile memory (NVM) location on the RISM.

The SFM, and hence the RISM, does not receive data from the MWS unless the SFM associated with the RISM is placed into out-of-service (OOS). The user must place the module into the OOS mode by selecting OOS from the modules front panel manual switch before updating a setpoint.

The write command is issued from the MWS and the data is sent to the RISMs NVM as follows:

1) The MWS calculates a Cyclic Redundancy Check (CRC) and sends the data to the divisional monitoring and indication communication module (MICM) that corresponds to the module to be updated.

2) The MICM receives and verifies the data integrity, then calculates a CRC and sends it to the intended SFM.

3) The SFM logic receives and verifies the data integrity, then calculates a CRC for the data and sends it to its RISM.

4) The RISM logic receives and verifies the data integrity, then calculates a CRC for the data and send it to its NVM.

5) The NVM receives and stores it in the intended location.

6) The RISM logic then reads back the data from the same NVM location that it just performed the data write to and verifies the datas integrity. This indicates that the data was stored successfully in the intended NVM location.

7) If the data read back integrity check fails, the module issues an NVM error, and the error is displayed by the MWS.

8) The written data and the data read back from the module are both displayed on the MWS along with the NVM location that was used during the write and read operations to allow the user to verify an accurate parameter update.

A parameter value can be read from the NVM location using the MWS by selecting the specific RISM, then selecting the Read Parameter function. The data read from the NVM location is then displayed on the MWS.

The MWS reads the modules status information and displays it to the user after each write or read operation.

Initiation of an NFDS BF3 channel test (using the Test Request analog, Test Pulse analog, and Source Range analog pulse output signals) is accomplished via the TRPS and ESFAS MWS similarly as described above, except nothing is written to the RISMs NVM. A technician uses the MWS to select the system (TRPS), the specific IU cell, the division (A, B, or C), and the specific RISM. Then a MWS enable hardwired switch is required to be activated to allow for physical connection of the MWS to the CTB. The technician must then use the MWS to select the specific pulse test to be performed, then the option to initiate the pulse test is enabled to allow the user to select it. When this occurs, the MWS issues a test command to the SFM, which then sends the test command to the RISM, which then initiates the pulse test sequence on the RISM.

The pulse test sequence is accomplished as follows:

1) The RISM provides the specific Test Request analog output signal to the NFDS equipment.

Page 22 of 25

2) The NFDS changes the Non-Operative analog output signal to the fault condition.

3) The NFDS equipment switches the normal detector input to the amplification and conditioning circuitry to the Test Pulse analog output provided from the RISMs FPGA.

4) The RISM provides the specific Test Pulse analog output to the NFDS.

5) The RISM compares the Source Range analog pulse input signal from NFDS to the Test Pulse analog output provided to the NFDS circuitry to confirm, or not, that both are the same.

6) The NFDS changes the Non-Operative analog output signal to the non-faulted condition.

For each NFDS CIC input channel, the following interfaces between the associated TRPS RISM and the respective divisional NFDS equipment are provided:

0-4 VDC Wide Range analog output from NFDS to the TRPS RISMs ISM 0-4 VDC Power Range analog output from NFDS to the TRPS RISMs ISM Non-Operative analog output from NFDS to the TRPS RISMs FPGA High Voltage SPI output from the TRPS RISMs FPGA to the NFDS Compensating Voltage SPI output from the TRPS RISMs FPGA to the NFDS Test Request analog output from the TRPS RISMs FPGA to the NFDS Test Select analog output from the TRPS RISMs FPGA to the NFDS High Voltage Enable analog output from the TRPS RISMs FPGA to the NFDS Modification of the NFDS CIC tunable parameters (High Voltage SPI, Compensating Voltage SPI, and multiple Wide and Power Range test current response output values) is accomplished via the TRPS and ESFAS MWS in the same manner as described above for modifying the BF3 tunable parameters.

Initiation of an NFDS CIC channel test (using the Test Request analog and Test Select analog output signals) is accomplished via the TRPS and ESFAS MWS similarly as described above for the BF3 channel test.

The CIC test sequence is accomplished as follows:

1) The RISM provides the Test Request analog and the specific Test Select analog output signals to the NFDS equipment.

2) The NFDS changes the Non-Operative analog output signal to the fault condition.

3) The NFDS equipment switches the normal detector input to the amplification circuitry to the on-board Test Current output

4) The NFDS equipment selects the appropriate test current signal based on the Test Select analog and injects it into the amplification circuitry.

5) The RISM compares the Wide and/or Power Range analog output signal from NFDS (depending on the specific Test Select) to the associated Wide and/or Power Range test current response output value(s) to confirm that the channel is operating correctly.

6) The NFDS changes the Non-Operative analog output signal to the non-faulted condition.

Page 23 of 25

NFDS Detector Calibration Annual calibration of the NFDS power range and wide range detectors is performed as follows:

Prior to filling a TSV for irradiation, a sample is taken from the associated target solution.

The sample is analyzed for activity to determine the volumetric activity of selected isotopes.

The TSV is filled, using the standard startup procedure, and the TSV level is recorded to determine the volume of irradiated solution.

The target solution is irradiated for a sufficient time to create activity levels of the selected isotopes sufficient for the calibration.

A sample of target solution is analyzed post-irradiation to determine the volumetric activity levels of the selected isotopes post-irradiation.

The power level during irradiation is calculated based upon the initial and final volumetric activity levels of the selected isotopes, indicated power time history, and the TSV volume. This value is used to calibrate the NFDS power range and wide range detectors.

Annual calibration of the source range detectors is performed as follows:

The Normal Startup Count Rate (NSCR), as described in Subsection 4a2.6.2.7 of the FSAR, is determined by filling the TSV to approximately 95 percent of critical by volume with optimum concentration solution and stable temperature. The source range setpoint is then set relative to the NSCR per LSSS 2.2.3 and LCO 3.2.3 of the technical specifications.

Additionally, the drift allowance relied on by the source range setpoint calculations is periodically checked using the empty TSV count rate.

The capability of performing channel tests and NFDS detector calibrations as described demonstrates the inservice testability required by SHINE Design Criterion 15.

SHINE has revised Subsection 7.8.2.1.3 of the FSAR to enhance the description of how the NFDS satisfies SHINE Design Criterion 15. A markup of the FSAR incorporating these changes is provided as Attachment 1.

References

1. NRC letter to SHINE Medical Technologies, LLC, SHINE Medical Technologies, LLC - Request for Additional Information Related to the Neutron Flux Detection System (EPID No. L-2019-NEW-0004), dated January 27, 2022 (ML22012A203)

2. SHINE Medical Technologies, LLC letter to the NRC, SHINE Medical Technologies, LLC Application for an Operating License, dated July 17, 2019 (ML19211C143)

3. SHINE Technologies, LLC letter to NRC, Application for an Operating License Supplement No. 13 and Response to Request for Additional Information, dated November 22, 2021 (ML21326A206)

4. SHINE Medical Technologies, LLC letter to NRC, Application for an Operating License Response to Request for Additional Information, dated August 27, 2021 (ML21239A049)

Page 24 of 25

5. Institute of Electrical and Electronics Engineers, Standard for Qualifying Class 1E Equipment for Nuclear Power Generating Stations, IEEE Standard 323-2003, New York, NY

6. Institute of Electrical and Electronics Engineers, Recommended Practice for Seismic Qualification of Class 1E Equipment for Nuclear Generating Stations, IEEE Standard 344-2013, New York, NY

7. Institute of Electrical and Electronics Engineers, Guide for Instrumentation and Control Equipment Grounding in Generating Stations, IEEE Standard 1050-2004, New York, NY Page 25 of 25

ENCLOSURE 2 ATTACHMENT 1 SHINE TECHNOLOGIES, LLC SHINE TECHNOLOGIES, LLC APPLICATION FOR AN OPERATING LICENSE SUPPLEMENT NO. 20 AND RESPONSE TO REQUEST FOR ADDITIONAL INFORMATION FINAL SAFETY ANALYSIS REPORT CHANGES (MARK-UP)

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)

Chapter 7 - Instrumentation and Control Systems Target Solution Vessel Reactivity Protection System Table 7.4 TRPS Monitored Variables (Sheet 1 of 2)

Instrument Variable Analytical Limit Logic Range Accuracy Response Time 2.52 times the nominal Source range neutron flux flux at 95 percent volume 2/3 1 to 1.0E+05 cps 2 percent 450 milliseconds of the critical fill height Wide range neutron flux 240 percent 2/3 2.5E-86 to 250 percent 2 percent 450 milliseconds Power range neutron flux [ ]PROP/ECI 2/3 (Low power range limit, driver 40 percent 2/3 0 to 125 percent 1 percent 1 second dropout permissive, and high time-averaged limit) 104 percent 2/3 RVZ1e IU cell exhaust radiation 15x background radiation 2/3 10-7 to 10-1 µCi/cc 20 percent 15 seconds TOGS oxygen concentration 10 percent 2/3 0 to 25 percent 1 percent 120 seconds TOGS mainstream flow [ ]PROP/ECI 2/3 [ ]PROP/ECI 3 percent 1.5 seconds TOGS dump tank flow [ ]PROP/ECI 2/3 [ ]PROP/ECI 3 percent 1.5 seconds TOGS condenser demister outlet 25°C 2/3 0 to 100°C 0.65 percent 10 seconds temperature Discrete Low-high TSV dump tank level High level 2/3 High level/not high level 1.5 seconds input signal Discrete High-high TSV dump tank level High level 2/3 High level/not high level 1.5 seconds input signal PCLS flow [ ]PROP/ECI 2/3 [ ]PROP/ECI 1 percent 1 second 15°C 2/3 PCLS temperature -1 to 121°C 1 percent 10 seconds 25°C 2/3 SHINE Medical Technologies 7.4-61 Rev. 4

Chapter 7 - Instrumentation and Control Systems Neutron Flux Detection System 7.8 NEUTRON FLUX DETECTION SYSTEM 7.8.1 SYSTEM DESCRIPTION The neutron flux detection system (NFDS) performs the task of monitoring and indicating the neutron flux to determine the multiplication factor and power level during filling of the target solution vessel (TSV) and irradiating the target solution. The signal from the detectors is transmitted to the pre-NFDS amplifiers where the signal is amplified and filtering for noise reductionconditioning is performed. The outputs of eEach pre-NFDS amplifier are used to perform measurementprovides an analog signal representative of the neutron flux signal, signal processing, indication, and interfacing with other systems. The NFDS interfaces withto a remote input submodule (RISM) in the TSV reactivity protection system (TRPS) for safety-related interfaces and monitoring and indication, which will then be transmitted. The TRPS compares these inputs to the associated setpoints and generates a protective action if necessary.

Additionally, the input signal from the NFDS to the TRPS is provided to the process integrated control system (PICS).

The NFDS monitors variables important to the safety functions of the irradiation unit (IU) to provide input to the TRPS to perform its safety functions.

The NFDS provides continuous indication of the neutron flux during operation, from filling through maximum power during irradiation. To cover the entire range of neutron flux levels, there are three different ranges provided from the NFDS: source range, wide range, and power range.

Source range covers the low levels expected while the TSV is being filled while power range covers the higher flux levels anticipated while the neutron driver is on and irradiating. To cover the gap between the source and power ranges, the wide range monitors the flux levels between the source and power range with a minimum twoone decade overlap with the high end of the source range and two decades of overlap with the low end of the power range.

The NFDS is a three-division system with threesix detectors configured in three sets of two detectors (source range and power/wide range), with each set positioned around the subcritical assembly support structure (SASS) at approximately 120-degree intervals to the TSV. Each division of the NFDS consists of a watertight detectors located in the light water pool and, an pre-NFDS amplifier mounted in the radioisotope production facility (RPF) or irradiation facility (IF),

and a signal processing unit inside the facility control room. The threesix watertight detectors are located in athe light water pool and are supported using brackets attached to the outer shell of the SASS. These brackets serve to locate the flux detectors in a fixed location relative to the TSV, ensuring flux profiles are measured consistently such that the sensitivity in the source range reliably indicates the neutron flux levels through the entire range of filling with the target solution.

7.8.2 DESIGN CRITERIA The SHINE facility design criteria applicable to the NFDS are as stated in Chapter 3, Table 3.1-1.

The facility design criteria applicable to the NFDS, and the NFDS system design criteria, are addressed in this section.

SHINE Medical Technologies 7.8-1 Rev. 4

Chapter 7 - Instrumentation and Control Systems Neutron Flux Detection System 7.8.2.1 SHINE Facility Design Criteria The generally-applicable SHINE facility design criteria 1, 2, 4, and 5 apply to the NFDS. The NFDS is designed, fabricated, and erected to quality standards commensurate to the safety functions to be performed; will perform these safety functions during external events; will perform these safety functions within the environmental conditions associated with normal operation, maintenance, and testing; and does not share components between IUs. These elements of the NFDS design contribute to satisfying SHINE facility design criteria 1, 2, 4, and 5.

SHINE facility design criteria 13 through 19 also apply to the NFDS.

7.8.2.1.1 Instrumentation and Controls SHINE Design Criterion 13 - Instrumentation is provided to monitor variables and systems over their anticipated ranges for normal operation, for anticipated transients, and for postulated accidents as appropriate to ensure adequate safety, including those variables and systems that can affect the fission process, the integrity of the primary system boundary, the primary confinement and its associated systems, and the process confinement boundary and its associated systems. Appropriate controls are provided to maintain these variables and systems within prescribed operating ranges.

The NFDS provides continuous indication of the neutron flux during operation, from filling through maximum power during irradiation (Subsection 7.8.1). TheSetpoints in the TRPS based on neutron flux detector setpointsinputs bound normal operations and accident conditions and provide margin to analytical limits (Subsection 7.8.4.3). Setpoints in the TRPS based on neutron flux detector inputs are established based on a documented methodology and accounts for uncertainties in each instrument channel (Subsection 7.8.2.2.5). The NFDS supports maintenance and testing to ensure operability as required by the technical specifications (Subsection 7.8.3.10).

7.8.2.1.2 Protection System Functions SHINE Design Criterion 14 - The protection systems are designed to:

1) initiate, automatically, the operation of appropriate systems to ensure that specified acceptable target solution design limits are not exceeded as a result of anticipated transients; and

2) sense accident conditions and to initiate the operation of safety-related systems and components.

Setpoints in the TRPS based on Nneutron flux detector setpointsinputs bound normal operations and accident conditions and provide margin to analytical limits (Subsection 7.8.4.3). Upon reaching the setpoints in the TRPS based on neutron flux signal setpointsdetector inputs (Table 7.4-1), automatic safety actuations are initiated by the TRPS, as described in Subsection 7.4.4.1.

7.8.2.1.3 Protection System Reliability and Testability SHINE Design Criterion 15 - The protection systems are designed for high functional reliability and inservice testability commensurate with the safety functions to be performed.

SHINE Medical Technologies 7.8-2 Rev. 4

Chapter 7 - Instrumentation and Control Systems Neutron Flux Detection System Redundancy and independence designed into the protection systems are sufficient to ensure that:

1) no single failure results in loss of the protection function, and

2) removal from service of any component or channel does not result in loss of the required minimum redundancy unless the acceptable reliability of operation of the protection system can be otherwise demonstrated.

The protection systems are designed to permit periodic testing, including a capability to test channels independently to determine failures and losses of redundancy that may have occurred.

The NFDS is comprised of three redundant divisions of detectors, and preNFDS amplifiers, and processing circuits for single failure protection. Interfacing systems with the NFDS are downstream of the NFDS such that a failure of an interfacing nonsafety system will not impact the NFDS (Subsection 7.8.3.3 and Figure 7.4-1). The NFDS supports maintenance and testing to ensure operability as required by the technical specifications. NFDS power range and wide range detectors are calibrated using activity samples of target solution. NFDS source range detectors are calibrated based on neutron counts with the TSV at 95 percent of critical volume with instrument drift being monitored using the empty TSV count rate. The remaining portions of the instrument channel are tested via the maintenance workstation (MWS)

(Subsection 7.4.5.3.3). The NFDS is designed to allow operators to remove portions of the NFDS from service when not required for operation without impacting NFDS components specific to other IU cells (Subsection 7.8.3.10). The independent NFDS divisions interface with TRPS, which has been analyzed for single failure in accordance with IEEE Standard 379-2000 (IEEE, 2000) for all inputs, including NFDS.

7.8.2.1.4 Protection System Independence SHINE Design Criterion 16 - The protection systems are designed to ensure that the effects of natural phenomena, and of normal operating, maintenance, testing, and postulated accident conditions on redundant channels do not result in loss of the protection function or are demonstrated to be acceptable on some other defined basis. Design techniques, such as functional diversity or diversity in component design and principles of operation, are used to the extent practical to prevent loss of the protection function.

The NFDS is qualified for operation during and after a seismic design basis event using the guidance in IEEE Standard 344-2013 (IEEE, 2013) (Subsection 7.8.3.8). The NFDS components are located in the RPF and the irradiation facility (IF) and are protected from seismic events, tornado wind, tornado missile, and external flooding (Subsection 7.8.3.8). Hurricanes, tsunamis, and seiches are not credible events at the SHINE facility (Subsections 2.4.5.1, 2.4.2.7, and 2.4.5.2). Physical and electrical independence (Subsection 7.8.3.4), redundancy (Subsection 7.8.3.3), equipment qualification (Subsection 7.8.3.7), and quality in design (Subsection 7.8.3.11) are applied in the NFDS design to prevent loss of the protective function.

7.8.2.1.5 Protection System Failure Modes SHINE Design Criterion 17 - The protection systems are designed to fail into a safe state if conditions such as disconnection of the system, loss of energy (e.g., electric power, instrument air), or postulated adverse environments are experienced.

SHINE Medical Technologies 7.8-3 Rev. 4

Chapter 7 - Instrumentation and Control Systems Neutron Flux Detection System The NFDS is designed so that a failure due to loss of power to the NFDS or a removal of an NFDS channel presents to TRPS as zero current on the analog outputs to allow TRPS to treat the condition as a positive trip determination. The interaction between NFDS and TRPS is shown in Figure 7.4-1 (Subsection 7.8.3.5).

7.8.2.1.6 Separation of Protection and Control Systems SHINE Design Criterion 18 - The protection system is separated from control systems to the extent that failure of any single control system component or channel, or failure or removal from service of any single protection system component or channel that is common to the control and protection systems leaves intact a system satisfying all reliability, redundancy, and independence requirements of the protection system. Interconnection of the protection and control systems is limited to assure that safety is not significantly impaired.

The NFDS is comprised of three redundant divisions of detectors, preand NFDS amplifiers, and processing circuits for single failure protection (Subsection 7.8.3.3). Communications from the NFDS to the TRPS and PICS (via TRPS) are continuous through isolated outputs that only allow the data to be transmitted out of the system so that no failure from an interfacing system can affect the functions of the NFDS (Subsection 7.8.3.2). There are no shared NFDS outputs that have both a TRPS safety-related protection function and a nonsafety-related control function.

Therefore, the failure or removal from service of any single NFDS component or channel leaves intact a system satisfying the reliability, redundancy, and independence requirements of the system.

7.8.2.1.7 Protection Against Anticipated Transients SHINE Design Criterion 19 - The protection systems are designed to ensure an extremely high probability of accomplishing their safety functions in the event of anticipated transients.

The NFDS is comprised of three redundant divisions of detectors, preand NFDS amplifiers, and processing circuits for single failure protection (Subsection 7.8.3.3). The three divisions of the NFDS are physically and electrically independent of each other (Subsection 7.8.3.4) and the NFDS equipment is qualified for normal and transient conditions (Subsections 7.8.3.6 and 7.8.3.7).

7.8.2.2 NFDS System Design Criteria 7.8.2.2.1 General Instrumentation and Control NFDS Criterion 1 - The range of operation of detector channels for the NFDS shall be sufficient to cover the expected range of variation of monitored neutron flux during normal and transient operation.

Setpoints in the TRPS based onThe neutron flux detector setpointsinputs bound normal operations and accident conditions and provide margin to analytical limits (Subsection 7.8.4.3).

NFDS Criterion 2 - The NFDS shall give continuous indication of the neutron flux from subcritical source multiplication level through licensed maximum power range. The continuous indication shall ensure at least twoone decades of overlap in indication is maintained while observation is transferred from one channel to another.

SHINE Medical Technologies 7.8-4 Rev. 4

Chapter 7 - Instrumentation and Control Systems Neutron Flux Detection System The NFDS provides continuous indication of the neutron flux from zero counts per second (cps) to at least 250 percent power with twoone decades of overlap (Subsection 7.8.3.1).

NFDS Criterion 3 - The NFDS power range channels shall provide reliable TSV power level while the source range channel provides count rate information from detectors that directly monitor the neutron flux.

The NFDS power range provides a signal proportional to TSV power level from 0 to 125 percent of the licensed power limit. The source range provides a current signal proportional to count rate for all expected startup count rates (Subsection 7.8.3.1).

NFDS Criterion 4 - The NFDS log power range channel (i.e., wide range channel) and a linear flux monitoring channel (i.e., power range channel) shall accurately sense neutrons during irradiation, even in the presence of intense high gamma radiation.

Each NFDS division includes an ionization chamber detector and a Boron Trifluoride (BF3) detector pair. These detector types are primarily sensitive to thermal neutrons.

NFDS Criterion 5 - The NFDS shall provide redundant TSV power level indication through the licensed maximum power range.

The NFDS is comprised of three redundant divisions of detectors, preand NFDS amplifiers, and processing circuits for single failure protection (Subsection 7.8.3.3). The wide range neutron flux monitors percent power up to 250 percent of the licensed power limit (Subsection 7.8.3.1.3). The power range neutron flux signal has a range of 0 percent to 125 percent of the licensed power limit (Subsection 7.8.3.1.2).

NFDS Criterion 6 - The location and sensitivity of at least one NFDS detector in the source range channel, along with the location and emission rate of the subcritical multiplication source, shall be designed to ensure that changes in reactivity will be reliably indicated even with the TSV shut down.

The positioning of the NFDS source range detectors, and the location, and emission rate of the subcritical multiplication source, is designed so that all three channels are on scale throughout filling. This includes while the TSV is empty of solution. NFDS source range signal increases with increasing target solution volume, and in this way, increasing reactivity will always produce an increase in count rate.

NFDS Criterion 7 - The NFDS shall have at least one detector in the power range channel to provide reliable readings to a predetermined power level above the licensed maximum power level.

The wide range neutron flux monitors percent power up to 250 percent of the licensed power limit (Subsection 7.8.3.1.3). The power range neutron flux signal has a range of 0 percent to 125 percent of the licensed power limit (Subsection 7.8.3.1.2).

NFDS Criterion 8 - The NFDS shall be separated from the PICS to the extent that any removal of a component or channel common to both the NFDS and the PICS preserves the reliability, redundancy, and independence of the NFDS.

SHINE Medical Technologies 7.8-5 Rev. 4

Chapter 7 - Instrumentation and Control Systems Neutron Flux Detection System Communications from the NFDS to the TRPS and PICS (via TRPS) are continuous through isolated outputs that only allow the data to be transmitted out of the system so that no failure from an interfacing system can affect the functions of the NFDS (Subsection 7.8.3.2).

NFDS Criterion 9 - The NFDS detectors shall be qualified for continuous submerged operation within the light water pool. The NFDS detector housings shall be watertight and supported by a sleeve structure, mounted to the SASS, at specific locations surrounding the SASS.

The NFDS detectors are housed in a watertight assembly qualified for submergence to a depth of up to 16 feet (Subsection 7.8.3.7). The detector housings are supported using brackets attached to the outer shell of the SASS (Subsection 7.8.1). The detectors are installed approximately 120 degrees equidistant around the SASS in relation to the target solution vesselTSV (Subsection 7.8.3.4).

NFDS Criterion 10 - The timing of NFDS communications shall be deterministic.

The timing of NFDS communications is deterministic.

7.8.2.2.2 Single Failure NFDS Criterion 11 - The NFDS shall be designed to perform its protective functions after experiencing a single random active failure in nonsafety control systems or in the NFDS, and such failure shall not prevent the NFDS from performing its intended functions or prevent safe shutdown of an IU cell.

The NFDS is comprised of three redundant divisions of detectors, preand NFDS amplifiers, and processing circuits for single failure protection. Interfacing systems with the NFDS are downstream of the NFDS such that a failure of an interfacing nonsafety system will not impact the NFDS (Subsection 7.8.3.3 and Figure 7.4-1). Communications from the NFDS to the TRPS and PICS (via TRPS) are continuous through isolated outputs that only allow the data to be transmitted out of the system so that no failure from an interfacing system can affect the functions of the NFDS (Subsection 7.8.3.2).

NFDS Criterion 12 - The NFDS shall be designed such that no single failure can cause the failure of more than one redundant component.

The NFDS is comprised of three redundant divisions of detectors, preand NFDS amplifiers, and processing circuits for single failure protection (Subsection 7.8.3.3). The three divisions of the NFDS are physically and electrically independent of each other (Subsection 7.8.3.4).

7.8.2.2.3 Independence NFDS Criterion 13 - Physical separation and electrical isolation shall be used to maintain the independence of NFDS circuits and equipment among redundant safety divisions or with nonsafety systems so that the safety functions required during and following any maximum hypothetical accident or postulated accident can be accomplished.

The three divisions of the NFDS are physically and electrically independent of each other (Subsection 7.8.3.4). The NFDS detector cables are routed to the TRPS electronics in physically SHINE Medical Technologies 7.8-6 Rev. 4

Chapter 7 - Instrumentation and Control Systems Neutron Flux Detection System separated electronics enclosures (Subsection 7.8.3.4) in accordance with IEEE Standard 384-2008 (IEEE, 2008) (Subsection 7.8.3.11). Interfacing systems with the NFDS are downstream of the NFDS such that a failure of an interfacing nonsafety system will not impact the NFDS (Subsection 7.8.3.3).

NFDS Criterion 14 - The NFDS shall be designed such that no communication-within a single safety channel, between safety channels, and between safety and nonsafety systems-adversely affects the performance of required safety functions.

The three divisions of the NFDS are physically and electrically independent of each other (Subsection 7.8.3.4). Interfacing systems with the NFDS are downstream of the NFDS such that a failure of an interfacing nonsafety system will not impact the NFDS (Subsection 7.8.3.3).

Communications from the NFDS to the TRPS and PICS (via TRPS are continuous through isolated outputs. The output isolation devices only allow for the data to be transmitted out of the system so that no failure from an interfacing system can affect the functions of the NFDS (Subsection 7.8.3.2).

7.8.2.2.4 Fail Safe NFDS Criterion 15 - The NFDS and associated components shall be designed to assume a safe state on loss of electrical power.

The NFDS is supplied power from the uninterruptible power supply system (UPSS). The UPSS battery backup supplies power to the NFDS for a minimum of 10 minutes following a loss of off-site power. The NFDS is designed so that a failure due to loss of power to the NFDS or a removal of an NFDS channel interacts the same with the TRPS as if there was a positive trip determination output to the TRPS. The interaction between NFDS and TRPS is shown in Figure 7.4-1 (Subsection 7.8.3.5).

NFDS Criterion 16 - The NFDS shall not be designed to fail or operate in a mode that could prevent the TRPS from performing its intended safety function. The design of the NFDS shall consider:

1) The effect of NFDS on accidents

2) The effects of NFDS failures

3) The effects of NFDS failures caused by accidents.

The failure analyses shall cover hardware and software failures associated with the NFDS.

The NFDS utilizes a fault-tolerant, triple redundant architecture. This design identifies and compensates for failed system elements. Because of the triple redundant architecture of the NFDS platform, failure mechanisms that affect a single function have no effect on plant operation.

7.8.2.2.5 Setpoints NFDS Criterion 17 - Neutron flux setpoints for an actuation ofbased on the NFDS shall be based on a documented analysis methodology that identifies assumptions and accounts for uncertainties, such as environmental allowances and measurement computational errors associated with each element of the instrument channel. The setpoint analysis parameters SHINE Medical Technologies 7.8-7 Rev. 4

Chapter 7 - Instrumentation and Control Systems Neutron Flux Detection System and assumptions shall be consistent with the safety analysis, system design basis, technical specifications, facility design, and expected maintenance practices.

Setpoints in the TRPS based on the neutron flux detectorNFDS inputs are based on a documented methodology that identifies each of the assumptions and accounts for the uncertainties in each instrument channel. The setpoint methodology is further described in Subsection 7.2.1.

NFDS Criterion 18 - Adequate margin shall exist between setpoints and safety limits so that the TRPS initiates protective actions before safety limits are exceeded.

Setpoints in the TRPS based onapplicable to the neutron flux detector NFDS inputs are determinedbased on using a documented methodology that identifies each of the assumptions and accounts for the uncertainties in each instrument channel. The setpoint methodology is further described in Subsection 7.2.1.

NFDS Criterion 19 - The sensitivity of each NFDS sensor channel shall be commensurate with the precision and accuracy to which knowledge of the variable measured is required for the protective function.

The source range neutron flux measurement supports filling of the IU cell prior to irradiation of the target solution. The power range neutron flux measurement supports operations when the neutron driver is operating and irradiating the target solution, and the wide range neutron flux measurement overlaps the source range and power range and is usable during both source and power range levels. The instrument ranges and accuracies support the design functions for each range and are provided in Subsection 7.8.3.1 and Table 7.4-1.

7.8.2.2.6 Equipment Qualification NFDS Criterion 20 - The effects of electromagnetic interference/radio-frequency interference (EMI/RFI) and power surges on the NFDS shall be adequately addressed.

Rack mounted NFDS equipment is tested to appropriate standards to show that the effects of EMI/RFI and power surges are adequately addressed (Subsection 7.8.3.7). The codes and standards applicable to the NFDS design are stated in Subsection 7.8.3.11.

7.8.2.2.7 Surveillance NFDS Criterion 21 - The NFDS shall provide the capability for calibration, inspection, and testing to validate the desired functionality of the NFDS.

The NFDS supports testing and calibration to ensure operability as required by the technical specifications. The NFDS is designed to allow operators to remove portions of the NFDS from service when not required for operation without impacting NFDS components specific to other IU cells (Subsection 7.8.3.10).

NFDS Criterion 22 - Equipment in the NFDS (from the input circuitry to output actuation circuitry) shall be designed to allow testing, calibration, and inspection to ensure operability. If testing is required or can be performed as an option during operation, the NFDS shall retain the capability to accomplish its safety function while under test.

SHINE Medical Technologies 7.8-8 Rev. 4

Chapter 7 - Instrumentation and Control Systems Neutron Flux Detection System The NFDS design supports testing and calibration to ensure operability as required by the technical specifications. The NFDS is designed to allow operators to remove portions of the NFDS from service when not required for operation without impacting NFDS components specific to other IU cells (Subsection 7.8.3.10).

NFDS Criterion 23 - Testing, calibration, and inspections of the NFDS shall be sufficient to confirm that surveillance test and self-test features address failure detection, self-test capabilities, and actions taken upon failure detection.

The sufficiency of surveillance testing and self-test features associated with the NFDS, which is an input device to the TRPS, is described in Subsection 7.4.4.4. The sufficiency of failure detection capabilities associated with the NFDS as an analog input to the TRPS was verified as part of the failure modes and effects analysis (FMEA) described in Subsection 7.4.5.2.2. As an all analog system, the only form of fault detection normally available is the source range missing and power range missing discrete signals provided to the PICSFault detection for the source range missing and power range missing discrete signals is provided to the operator in the facility control room so that action can be taken (Subsection 7.8.3.10).

NFDS Criterion 24 - The design of the NFDS and the justification for test intervals shall be consistent with the surveillance testing intervals as part of the facility technical specifications.

Limiting Conditions for Operation and Surveillance Requirements are established for the NFDS in the technical specifications (Subsection 7.8.4.3). The NFDS design supports testing and calibration to ensure operability as required by the technical specifications (Subsection 7.8.3.10).

7.8.2.2.8 Classification and Identification NFDS Criterion 25 - NFDS equipment shall be distinctively identified to indicate its safety classification and to associate equipment according to divisional or channel assignments.

Each division of the NFDS is uniquely labeled and identified in accordance with SHINE identification and classification procedures.

7.8.2.2.9 Human Factors NFDS Criterion 26 - The NFDS shall be designed to provide the information necessary to support annunciation of the channel initiating a protective action to the operator.

NFDS input to TRPS safety functions are communicated to the PICS to alert the operators. The I&C system architecture is shown in Figure 7.1-1.

7.8.2.2.10 Quality NFDS Criterion 27 - Controls over the design, fabrication, installation, and modification of the NFDS shall conform to the guidance of ANSI/ANS 15.8-1995 (ANSI/ANS, 1995), as endorsed by Regulatory Guide 2.5 (USNRC, 2010).

ANSI/ANS 15.8-1995 (ANSI/ANS, 1995) is applied to the NFDS by the SHINE Quality Assurance Program (Subsection 7.8.3.11). The SHINE Quality Assurance Program controls activities related to the system design, fabrication, installation, and modification.

SHINE Medical Technologies 7.8-9 Rev. 4

Chapter 7 - Instrumentation and Control Systems Neutron Flux Detection System NFDS Criterion 28 - The quality of the components and modules in the NFDS shall be commensurate with the importance of the safety function to be performed.

Industry codes and standards are applied to the design of the NFDS to ensure quality in the design of this safety-related system (Subsection 7.8.3.11). The NFDS is also designed for the normal and transient operating environments, as described in Subsections 7.8.3.6 and 7.8.3.7.

7.8.3 DESIGN BASES 7.8.3.1 Design Bases Functions The NFDS measures the neutron flux in the TSV over three separate ranges: source range, power range, and wide range.

7.8.3.1.1 Source Range The source range measures low flux levels common to what would be expected during the filling of the IU cell prior to irradiation of the target solution.

The NFDS provides TRPS a count rate signal for TRPS to perform a trip determination upon reaching the source range setpoint contained in the TRPS. The TRPS initiates an IU Cell Safety Actuation when two-out-of-three or more high source range neutron flux signals from NFDS are above their setpoint (Subsection 7.4.4).

The NFDS transmits the following source range analog signal to the TRPS:

• NFDS source range The analytical limit for the high source range trip determination is:

• Increasing at 2.52 times the nominal flux at 95 percent volume of the critical fill height The source range neutron flux signal has an accuracy of less than or equal to 2 percent of the full linear scale.

7.8.3.1.2 Power Range The power range measures high flux levels in the ranges that are expected when the neutron driver is operating and irradiating the target solution.

The NFDS transmits the following power range analog signal to the TRPS:

• NFDS power range The power range neutron flux signal is input to the safety-related trip determination by the TRPS.

The TRPS initiates a Driver Dropout on low power range neutron flux, as described in Subsection 7.4.4 and initiates an IU Cell Safety Actuation on high (power range) time-averaged neutron flux, as described in Subsection 7.4.4.

SHINE Medical Technologies 7.8-10 Rev. 4

Chapter 7 - Instrumentation and Control Systems Neutron Flux Detection System The power range neutron flux signal has a range of 0 percent to 125 percent of the licensed power limit and has an accuracy of less than or equal to 1 percent of the full linear scale.

7.8.3.1.3 Wide Range The wide range neutron flux connects the gap between the source range and the power range with overlap and is usable during both source and power range levels. The wide range neutron flux monitors percent power up to 250 percent of the licensed power limit.

The NFDS transmits the following wide range analog signals to the TRPS:

• NFDS wide range The NFDS wide range neutron flux signal is input to the safety-related trip determination by the TRPS. The TRPS initiates an IU Cell Safety Actuation on high wide range neutron flux, as described in Subsection 7.4.4.

The wide range neutron flux signal has an accuracy of less than or equal to 1 percent of the full logarithmic scale.

7.8.3.2 Simplicity The NFDS is an analog system with no digital communications for simplicity. In the source range, the NFDS provides voltage pulses corresponding to pulses from the associated BF3 proportional counter. In the wide range and power range, the signal from the compensated ion chambers is input to log and linear amplifiers corresponding to the neutron flux and is output to the TRPS as a 0 to 4 volt signal. Communications from the NFDS to the TRPS and PICS (via TRPS) are continuous through isolated outputs. The output isolation devices only allow for the data to be transmitted out of the system so that no failure from an interfacing system can affect the functions of the NFDS.

7.8.3.3 Single Failure The NFDS is comprised of three redundant divisions of detectors, preand NFDS amplifiers, and processing circuits. A single failure of any one of the divisions will not affect the functionality of the other two redundant divisions ensuring the required safety functions perform as designed during a design basis event. There are no shared signals from the NFDS that have both a TRPS safety-related protection function and a nonsafety-related control function. Failures of nonsafety-related systems do not impact the NFDS from performing its safety function.Interfacing systems with the NFDS are downstream of the NFDS such that a failure of an interfacing nonsafety system will not impact the NFDS.

7.8.3.4 Independence The three divisions of the NFDS are physically and electrically independent of each other.

Detectors are installed approximately 120 degrees equidistant around the SASS in relation to the target solution vesselTSV. The detector cables are routed back to the TRPS electronics in physically separated electronics enclosures.

SHINE Medical Technologies 7.8-11 Rev. 4

Chapter 7 - Instrumentation and Control Systems Neutron Flux Detection System Each division of the NFDS is capable of monitoring the neutron flux levels in the detector, reading and amplifying the levels in the preconditioning the signal in the NFDS amplifier, and processing the measurement readings within each division independentlyproviding a signal to the TRPS without aid of another NFDS division or external safety or nonsafety system.

7.8.3.5 Loss of External Power The NFDS is supplied power from the UPSS upon a loss of off-site power. The UPSS battery backup supplies power to the NFDS for a minimum of 10 minutes following a loss of off-site power. NFDS equipment associated with division A receives power from division A of the UPSS.

NFDS equipment associated with division B receives power from division B of the UPSS. NFDS equipment associated with division C receives auctioneered power from division A and division B of the UPSS. The UPSS provides safety-related power to system loads, including the NFDS (Subsection 8a2.2.3).

The NFDS is designed so that upon a failure due to loss of power to the NFDS or a removal of an NFDS channel, analog outputs to interacts the same with the TRPS fail low, and the partial trip information for the failed channel is determined by the associated safety function modules (SFMs) out of service status (Subsection 7.4.4.3)as if there was a positive trip determination in TRPS. The interaction between NFDS and TRPS is shown in Figure 7.4-1.

7.8.3.6 Operating Conditions The NFDS control and logicsignal conditioning functions are located in the RPF and IF where the environment is mild and not exposed to the irradiation process. The preNFDS amplifiers are located in the IF and RPF where operating conditions are a mild operating environment. The detectors are located within the IU cell where they are exposed to high radiation levels (approximately 3.5E+05 rad/hour) and are qualified to survive that environment.

The normal and transient environmental conditions present in areas where NFDS is located are provided in Table 7.2-2 through Table 7.2-4. The main production facility heating, ventilation, and air conditioning (HVAC) systems are relied upon to maintain the temperature and humidity parameters in these areas. The main production facility HVAC systems are described in Section 9a2.1.

During normal operation, the NFDS equipment will operate in the applicable normal radiation environments identified in Table 7.2-1 for up to 20 years, and will be replaced at a frequency sufficient such that the radiation qualification of the affected components is not exceeded.

7.8.3.7 Equipment Qualification The NFDS detectors are housed in a watertight assembly qualified for submergence to a depth up to 16 feet.

NFDS rack mounted equipment is installed in a mild operating environment and is designed to meet the normal and transient environmental conditions described in Subsection 7.8.3.6. Rack mounted NFDS equipment is tested to appropriate standards to show that the effects of EMI/RFI and power surges are adequately addressed. Appropriate grounding of the NFDS is performed in accordance with Section 5.2.1 of IEEE Standard 1050-2004 (IEEE, 2004b).

SHINE Medical Technologies 7.8-12 Rev. 4

Chapter 7 - Instrumentation and Control Systems Neutron Flux Detection System 7.8.3.8 Natural Phenomena The NFDS is qualified for operation during and after a seismic design basis event. The NFDS is qualified using the guidance in IEEE Standard 344-2013 (IEEE, 2013) (Subsection 7.8.3.11).

The NFDS is tested using independent triaxial or dependent biaxial testing.

The NFDS components are located in the RPF and the IF. The RPF and IF are classified as Seismic Class I structures (Section 3.4) that provide protection from tornado and tornado missiles (Subsection 3.2.2.3). The main production facility is protected from an external flood (Subsection 3.3.1.1.1).

7.8.3.9 Human Factors The NFDS provides the following signals to the TRPS to transmit to the PICS for display to the operator:

• Source range neutron flux

• Wide range neutron flux

• Power range neutron flux Operator display criteria and design are addressed in Section 7.6.

7.8.3.10 Maintenance and Testing The NFDS supports testing and calibration to ensure operability as required by the technical specifications. The NFDS is designed to allow operators to remove portions of the NFDS from service when not required for operation without impacting NFDS components specific to other IU cells. Fault detection for the source range missing and power range missing discrete signals is provided to the PICS (via TRPS).

7.8.3.11 Codes and Standards The following codes and standards are applied to the NFDS design:

1) Section 8 of IEEE Standard 344-2013, IEEE Standard for Seismic Qualification of Equipment for Nuclear Power Generating Stations (IEEE, 2013); invoked as guidance to meet SHINE Design Criterion 16.

2) IEEE Standard 379-2000, IEEE Standard Application of the Single-Failure Criterion to Nuclear Power Generating Station Safety Systems (IEEE, 2000); invoked to meet SHINE Design Criterion 15, Protection system reliability and testability.

3) IEEE Standard 384-2008, IEEE Standard Criteria for Independence of Class 1E Equipment and Circuits (IEEE, 2008); invoked for separation of safety-related and nonsafety-related cables and raceways, as described in Subsection 8a2.1.3 and Subsection 8a2.1.5.

4) Section 5.2.1 of IEEE Standard 1050-2004, IEEE Guide for Instrumentation and Control Equipment Grounding in Generating Stations (IEEE, 2004b); invoked as guidance to support electromagnetic compatibility qualification for digital I&C equipment.

5) The guidance of ANSI/ANS 15.8-1995, Quality Assurance Program Requirements for Research Reactors (R2013) (ANSI/ANS, 1995), as endorsed by Regulatory Guide 2.5, Quality Assurance Program Requirements for Research and Test Reactors (USNRC, SHINE Medical Technologies 7.8-13 Rev. 4

Chapter 7 - Instrumentation and Control Systems Neutron Flux Detection System 2010), is applied as part of the SHINE Quality Assurance Program for complying with the programmatic requirements of 10 CFR 50.34(b)(6)(ii).

6) IEEE Standard 323-2003, IEEE Standard for Qualifying Class 1E Equipment for Nuclear Power Generating Stations (IEEE, 2003b); invoked as guidance to support environmental qualification as described in Subsection 7.8.4.

7.8.4 OPERATION AND PERFORMANCE The NFDS supports safe and reliable operation of the SHINE facility and prevents a single failure from defeating the intended NFDS functions.

The NFDS is designed to operate under normal conditions, during anticipated transients, and during design basis accidents such that it will perform its safety functions. The NFDS is qualified by analysis to the environmental parameters provided in Tables 7.2-1, 7.2-3, and 7.2-4 by applying the guidance of Sections 4.1, 4.2, 5.1, 6.1, and 7 of IEEE Standard 323-2003 (IEEE, 2003b).

The NFDS demonstrates EMI/RFI qualification through emissions testing, susceptibility testing, and surge withstand capability testing. The NFDS is grounded in accordance with Section 5.2.1 of IEEE Standard 1050-2004 (IEEE, 2004b).

7.8.4.1 Monitored Variables The NFDS measures the flux over three separate ranges, source range, wide range, and power range.

The source range measures low flux levels common to what would be expected during the filling cycle prior to irradiation of the target solution.

The power range measures high flux levels in the ranges that are expected when the neutron driver is operating and irradiating the target solution.

The wide range connects the gap between the source range and the power range with overlap and is usable during both source and power range levels.

In the source range, individual pulses are created as a result of neutron interaction with the detector and are recorded by the NFDS. The range of the source range measurement counts pulses up to 1.0E+05 counts per second (cps). The inverse of the count rate can also be used to estimate the critical fill level using the 1/M methodology.

In the power range, the neutron flux is measured in terms of the design power levels of the TSV.

The range of measurement of the power range is indicated as 0 percent to 125 percent.

The wide range measurement monitors the power level in a logarithmic scale over 108 decades from 2.5E-0806 percent up to 250 percent covering the irradiation cycle both during deuterium-deuterium reactions and deuterium-tritium reactions.

SHINE Medical Technologies 7.8-14 Rev. 4

Chapter 7 - Instrumentation and Control Systems Neutron Flux Detection System 7.8.4.2 LogicSignal Processing Functions The NFDS provides the following analog signals to the TRPS:

• NFDS source range

• NFDS wide range

• NFDS power range The NFDS also provides a source range missing and power range missing signal to the PICS (via TRPS) for use as an alarm to the operator in alerting that the NFDS is not operating properly.

The TRPS transmits the analog signals as nonsafety-related signals to the PICS to display for operator use when monitoring conditions in the IU cells.

7.8.4.3 Technical Specifications and Surveillance Limiting Conditions for Operation and Surveillance Requirements are established for the NFDS in the technical specifications. Setpoints in the TRPS based onThe neutron flux detector setpointsinputs bound normal operations and accident conditions and provide margin to analytical limits.

7.

8.5 CONCLUSION

The NFDS monitors neutron flux levels inside the target solution vesselTSV to support safe operation of the SHINE facility. The system provides inputs to the TRPS that are used fordesign includes a high source range neutron flux trip determination and neutron flux variables that are input to the TRPS for safety actuations. The NFDS also transmits signals to TRPS (Section 7.4) that are transmitted by TRPS as nonsafety-related neutron flux values to the PICS for display to the operators.

The system design incorporates independence and redundancy to ensure no single failure prevents the NFDS from fulfilling its intended safety functions.

SHINE Medical Technologies 7.8-15 Rev. 4