ML22094A045
| ML22094A045 | |
| Person / Time | |
|---|---|
| Site: | SHINE Medical Technologies |
| Issue date: | 04/04/2022 |
| From: | Jim Costedio SHINE Technologies |
| To: | Document Control Desk, Office of Nuclear Reactor Regulation |
| References | |
| 2022-SMT-0043 | |
| Download: ML22094A045 (7) | |
Text
3400 Innovation Ct
- Janesville, WI 53546
- 877.512.6554
- info@shinemed.com
- www.SHINEtechnologies.com April 4, 2022 2022-SMT-0043 10 CFR 50.30 U.S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, DC 20555
References:
(1)
SHINE Medical Technologies, LLC letter to the NRC, SHINE Medical Technologies, LLC Application for an Operating License, dated July 17, 2019 (ML19211C143)
(2)
NRC letter to SHINE Medical Technologies, LLC, SHINE Medical Technologies, LLC - Request for Additional Information Related to the Instrumentation and Control Systems (EPID No. L-2019-NEW-0004), dated July 1, 2021 (ML21172A195)
(3)
SHINE Medical Technologies, LLC letter to the NRC, SHINE Medical Technologies, LLC Application for an Operating License Supplement No. 8 and Response to Request for Additional Information, dated September 29, 2021 (ML21272A341)
SHINE Technologies, LLC Application for an Operating License Revision 1 of SHINE Response to Part (c) of Request for Additional Information 7-9 Pursuant to 10 CFR Part 50.30, SHINE Technologies, LLC (SHINE) submitted an application for an operating license for a medical isotope production facility to be located in Janesville, Wisconsin (Reference 1). The NRC staff determined that additional information was required to enable the staffs continued review of the SHINE operating license application (Reference 2).
SHINE responded to a portion of the staffs request, including request for additional information (RAI) 7-9, via Reference 3.
SHINE has determined that the SHINE Response to Part (c) of RAI 7-9, provided via Reference 3, requires revision to accurately reflect the configuration of the safety-related instrumentation and control systems. provides Revision 1 of the SHINE Response to Part (c) of RAI 7-9. Revision 1 supersedes the previously provided SHINE Response to Part (c) of RAI 7-9, provided via Reference 3, in its entirety.
If you have any questions, please contact Mr. Jeff Bartelme, Director of Licensing, at 608/210-1735.
Document Control Desk Page 2 I declare under the penalty of perjury that the foregoing is true and correct.
Executed on April 4, 2022.
Very truly yours, James Costedio Vice President of Regulatory Affairs and Quality SHINE Technologies, LLC Docket No. 50-608 Enclosure cc:
Project Manager, USNRC SHINE General Counsel Supervisor, Radioactive Materials Program, Wisconsin Division of Public Health
Page 1 of 2 ENCLOSURE 1 SHINE TECHNOLOGIES, LLC SHINE TECHNOLOGIES, LLC APPLICATION FOR AN OPERATING LICENSE REVISION 1 OF SHINE RESPONSE TO PART (C) OF REQUEST FOR ADDITIONAL INFORMATION 7-9 The NRC staff determined that additional information was required to enable the staffs continued review of the SHINE Technologies, LLC (SHINE) operating license application (Reference 1). SHINE provided the response to a portion of the NRC staffs request for additional information (RAI), including the SHINE Response to RAI 7-9, via Reference 2. SHINE has determined that the SHINE Response to Part (c) of RAI 7-9, provided via Reference 2, requires revision to accurately reflect the configuration of the safety-related instrumentation and control systems. Revision 1 of the SHINE Response to Part (c) of RAI 7-9 is provided below.
Part (c) of RAI 7-9 (c) Separation of Protection and Control Systems - SHINE Design Criterion 18 contains the design criteria for the separation of the protection system from control systems. This criterion is normally used to address instrumentation and control configurations where the control of a process parameter (e.g., power density) and the protection against an undesirable process parameter value (e.g., exceeding power density limits) are using the same sensors. For example, from the description in the SHINE FSAR, it appears that the SHINE facility protects and controls solution power density using the same set of safety-related sensors. The NRC staff notes that IU power indications (i.e., neutron flux) are common to both protection and control.
This particular type of equipment configuration is vulnerable to a sensor failure causing an undesirable control action and could prevent the protection system from protecting against the undesirable control action due to reliance on the same sensor.
Section 7.4.2.1.6, Separation of Protection and Control Systems, of the SHINE FSAR states the following:
SHINE Design Criterion 18 - The protection system is separated from control systems to the extent that failure of any single control system component or channel, or failure or removal from service of any single protection system component or channel that is common to the control and protection systems, leaves intact a system satisfying all reliability, redundancy, and independence requirements of the protection system. Interconnection of the protection and control systems is limited to assure that safety is not significantly impaired.
Nonsafety-related inputs into the TRPS are designed and controlled so they do not prevent the TRPS from performing its safety functions (Subsection 7.4.3.4).
Page 2 of 2 The NRC staff notes that since protection systems are safety-related, then all shared sensors with the PICS should be safety-related. Therefore, the NRC staff does not agree that there are nonsafety-related inputs into the TRPS. In addition, the SHINE FSAR description quoted above does not identify what sensors are shared between the protection and control systems. Further, this description does not explain how the TRPS would perform its protection function given a failure of a shared component.
Revise the SHINE FSAR to include a description of how the TRPS design meets SHINE Design Criterion 18 to clearly reflect the intended design of components shared to protect and control certain operations.
SHINE Response
- c. There are no sensor outputs that have both a target solution vessel (TSV) reactivity protection system (TRPS) safety-related protection function and a nonsafety-related control function. As described in Subsection 7.5.2.1.6 of the FSAR, there are no sensor outputs that have both an engineered safety features actuation system (ESFAS) safety-related protection function and a nonsafety-related control function.
SHINE has revised Subsections 7.3.1.1.2 and 7.4.2.1.6 of the FSAR to clarify that there are no sensor outputs that have both a TRPS protection function and a nonsafety-related control function. A markup of the FSAR incorporating these changes is provided as Attachment 1.
References
Request for Additional Information Related to the Instrumentation and Control Systems (EPID No. L-2019-NEW-0004), dated July 1, 2021 (ML21172A195)
- 2. SHINE Medical Technologies, LLC letter to the NRC, SHINE Medical Technologies, LLC Application for an Operating License Supplement No. 8 and Response to Request for Additional Information, dated September 29, 2021 (ML21272A341)
ENCLOSURE 1 ATTACHMENT 1 SHINE TECHNOLOGIES, LLC SHINE TECHNOLOGIES, LLC APPLICATION FOR AN OPERATING LICENSE REVISION 1 OF SHINE RESPONSE TO PART (C) OF REQUEST FOR ADDITIONAL INFORMATION 7-9 FINAL SAFETY ANALYSIS REPORT CHANGES (MARK-UP)
Chapter 7 - Instrumentation and Control Systems Process Integrated Control System SHINE Medical Technologies 7.3-5 Rev. 5 Allow transition from Mode 3 to Mode 4 only when TSV level is below an allowable level indicating solution has been drained, and the TSV dump tank low-high level signal is present indicating solution is in the TSV dump tank.
Allow transition from Mode 4 to Mode 0 only when TSV level is below an allowable level indicating solution has been drained, the TSV dump tank low-high level signal is clear indicating solution has been removed from the TSV dump tank, and the TSV fill valves are closed.
Indication to the operator is provided on the PICS operator workstation displays when an interlock or permissive is bypassed.
7.3.1.1.2 Target Solution Vessel Off-Gas System The TOGS is used to manage radiolysis and fission product gases generated in the TSV during irradiation operation and present in the TSV dump tank during target solution cooldown to maintain concentrations within safe limits. The TOGS is described in Section4a2.8.
Monitoring and Alarms The PICS receives input from the TRPS and provides alarms for TOGS oxygen concentration (Subsection7.4.4.1.10), mainstream flow for both train A and B (Subsection7.4.4.1.11),
condenser demister outlet temperatures for both train A and B (Subsection7.4.4.1.13), and dump tank flow for train A (Subsection7.4.4.1.12).
The PICS directly monitors and provides alarms for TOGS hydrogen concentration, gas injection flowrate, TOGS blower outlet and sidestream pressures, instrument demister condensate high level switch and condenser demister outlet, sweep gas supply, recombiner inlet, recombiner outlet, zeolite bed inlet, and zeolite bed outlet temperatures.
Control Functions The operator is able to use the PICS to manually open and close individual valves and manually start or stop individual components unless operation is prevented by interlocks, permissives, or active sequences. Components that are capable of being actuated by TRPS are controlled by PICS as described in Subsection7.3.1.3.11.
The following functions are performed while TOGS is running (Mode 1, 2, 3, or 4):
PICS automatically controls mainstream flow for each TOGS train based on the median value of the three mainstream flow inputs received from TRPS by adjusting the variable speed motor of the associated train TOGS blower.
PICS automatically controls the temperature of the recombiners (trains A and B) and the zeolite bed (train AB) by energizing or deenergizing the associated heater based on the inlet and outlet temperature of each component.
PICS automatically opens the TOGS oxygen inlet valve when oxygen concentration is low, based on the median value of the three TOGS oxygen concentration inputs received from TRPS.
Target Solution Vessel Chapter 7 - Instrumentation and Control Systems Reactivity Protection System SHINE Medical Technologies 7.4-5 Rev. 5 components that comprise a division are physically separated to retain the capability of performing the required safety functions during a design basis accident. This division independence is maintained throughout the design, extending from the sensor to the devices actuating the protective function (Subsection 7.4.5.2.1).
Functional diversity and diversity in component design are used to prevent loss of the protection function. Functional diversity is discussed in Subsection 7.4.5.2.5. Field programmable gate arrays (FPGAs) in each division are of a different physical architecture to prevent common cause failure (CCF) (Subsection 7.4.5.2.4).
7.4.2.1.5 Protection System Failure Modes SHINE Design Criterion 17 - The protection systems are designed to fail into a safe state if conditions such as disconnection of the system, loss of energy (e.g., electric power, instrument air), or postulated adverse environments are experienced.
Controlled components associated with safety actuations are designed to go to their safe state when deenergized (Subsection 7.4.3.8). The TRPS equipment is qualified for radiological and environmental hazards present during normal operation and postulated accidents (Subsection 7.4.3.5). A failure modes and effects analysis (FMEA) was performed which verified that there are no single failures or non-detectable failures that can prevent the TRPS from performing its required safety function (Subsection 7.4.5.2.2).
7.4.2.1.6 Separation of Protection and Control Systems SHINE Design Criterion 18 - The protection system is separated from control systems to the extent that failure of any single control system component or channel, or failure or removal from service of any single protection system component or channel that is common to the control and protection systems, leaves intact a system satisfying all reliability, redundancy, and independence requirements of the protection system. Interconnection of the protection and control systems is limited to assure that safety is not significantly impaired.
Sensors with an output used to determine TRPS protective actions are safety-related and input directly to the TRPS. The TRPS provides these sensor inputs to the PICS through redundant outputs. After receiving the input from the TRPS, the PICS performs its control function, if one is associated with the input. There are no sensor outputs that have both a TRPS safety-related protection function and a nonsafety-related control function. There are no inputs to the TRPS from the PICS that are used in the determination of protective actions. Since there are no inputs from the PICS that impact a safety function in the TRPS, and no sensors that provide both a safety-related protection function and a nonsafety-related control function are routed directly to the TRPS, a failure or removal from service of any single protection system component or channel that is common to the control and protection systems leaves intact a system satisfying the reliability, redundancy, and independence requirements of the TRPS as described in Subsections 7.4.3.4, 7.4.4.3, 7.4.5.2.1, 7.4.5.2.2, and 7.4.5.2.3.
The inputs to the TRPS that have both safety-related protection functions and nonsafety-related control functions are TOGS oxygen concentration (Subsection 7.4.4.1.10) and TOGS mainstream flow (Subsection 7.4.4.1.11). For each of these inputs, the nonsafety-related control function is based upon the median value of the inputs to the TRPS (Subsection 7.3.1.1.2). Since the median value is selected, a failure of a single input will not impact the control function.