ML22136A302

Shine OL SER, Chapter 13, Accident Analysis (Redacted)

ML22136A302
Person / Time
Site:	SHINE Medical Technologies
Issue date:	05/16/2022
From:	NRC/NRR/DANU
To:	SHINE Medical Technologies
Balazik M
References
Download: ML22136A302 (77)

Text

ACCIDENT ANALYSIS The accident analysis shows that the health and safety of the public and workers are protected, potential radiological and non-radiological consequences have been considered in the event of malfunctions, and the SHINE Medical Technologies, LLC (SHINE, the applicant) facility is capable of accommodating disturbances in the functioning of structures, systems, and components (SSCs). Additionally, the accident analysis demonstrates that the SHINE facility design features, safety limits, limiting safety system settings, and limiting conditions for operation have been selected to ensure that no credible accident could lead to unacceptable radiological consequences to people or the environment.

The accidents analyzed range from anticipated events such as a loss of normal electrical power to a postulated fission product release with radiological consequences that exceed those of any accident considered to be credible. This limiting accident is named the maximum hypothetical accident (MHA). Because the MHA is not expected to occur, the scenario need not be entirely credible. The initiating event and the scenario details need not be analyzed, but the potential consequences should be analyzed and evaluated.

The accident analysis establishes safety limits for SHINE facility operations and provides a technical basis for control of those limits through technical specifications.

This chapter of the SHINE operating license application safety evaluation report (SER) describes the review and evaluation by the U.S. Nuclear Regulatory Commission (NRC, the Commission) staff of the final accident analysis of the SHINE irradiation facility (IF) and radioisotope production facility (RPF), as presented in Chapter 13, Accident Analysis, of the SHINE Final Safety Analysis Report (FSAR), as supplemented by the applicants responses to staff requests for additional information (RAIs). Together, the IF and RPF constitute the SHINE facility.

13a Irradiation Facility Accident Analysis SER Section 13a, Irradiation Facility Accident Analysis, provides an evaluation of the final accident analysis of SHINEs IF as presented in SHINE FSAR Section 13a2, Irradiation Facility Accident Analysis, within which SHINE describes accident-initiating events and scenarios, as well as the accident analysis and determination of consequences.

13a.1 Areas of Review The NRC staff reviewed SHINE FSAR Section 13a2 against applicable regulatory requirements, using appropriate regulatory guidance and acceptance criteria, to assess the sufficiency of the final IF accident analysis. The final IF accident analysis was evaluated to ensure that the analysis is presented in sufficient detail to allow a clear understanding of the facility and that the facility can be operated for its intended purpose and within regulatory limits for ensuring the health and safety of the operating staff and the public. SSCs were also evaluated to ensure that they would adequately provide for the prevention of accidents and for the mitigation of consequences of accidents. The staff considered the final analysis and evaluation of the design and performance of the SSCs of the SHINE facility, including those SSCs shared by both the IF and RPF, with the objective of assessing the risk to public health and safety resulting from the operation of the facility.

1

13a.2 Summary of Application SHINE FSAR Section 13a2 identifies and describes the postulated initiating events and credible accidents that form the design basis for the IF. The FSAR also describes the accident analysis and determination of consequences for the SHINE IF. The FSAR provides details on event categories covering the MHA and credible accidents related to the IF, which are insertion of excess reactivity, reduction in cooling, mishandling or malfunction of target solution, loss of off-site power, external events, mishandling or malfunction of equipment, large undamped power oscillations, detonation and deflagration in the primary system boundary, unintended exothermic chemical reactions other than detonation, system interaction events, and facility-specific events.

13a.3 Regulatory Requirements and Guidance and Acceptance Criteria The NRC staff reviewed SHINE FSAR Section 13a2 against the applicable regulatory requirements, using appropriate regulatory guidance and acceptance criteria, to assess the sufficiency of the final accident analysis for the issuance of an operating license.

13a.3.1 Applicable Regulatory Requirements The applicable regulatory requirements for the evaluation of SHINEs IF accident analysis are as follows:

10 CFR 50.34, Contents of applications; technical information, paragraph (b), Final safety analysis report.

10 CFR 50.40, Common Standards.

10 CFR 50.57, Issuance of operating license.

10 CFR 20.1003, Definitions.

10 CFR 20.1201, Occupational dose limits for adults.

10 CFR 20.1301, Dose limits for individual members of the public.

10 CFR 70.61, Performance requirements.

13a.3.2 Applicable Regulatory Guidance and Acceptance Criteria In determining the regulatory guidance and acceptance criteria to apply, the NRC staff used its technical judgment, as the available guidance and acceptance criteria were typically developed for nuclear reactors. Given the similarities between the SHINE facility and non-power research reactors, the staff determined to use the following regulatory guidance and acceptance criteria:

NUREG-1537, Part 1, Guidelines for Preparing and Reviewing Applications for the Licensing of Non-Power Reactors, Format and Content, issued February 1996.

NUREG-1537, Part 2, Guidelines for Preparing and Reviewing Applications for the Licensing of Non-Power Reactors, Standard Review Plan and Acceptance Criteria, issued February 1996.

2

Final Interim Staff Guidance Augmenting NUREG-1537, Part 1, Guidelines for Preparing and Reviewing Applications for the Licensing of Non-Power Reactors: Format and Content, for Licensing Radioisotope Production Facilities and Aqueous Homogeneous Reactors, dated October 17, 2012.

Final Interim Staff Guidance Augmenting NUREG-1537, Part 2, Guidelines for Preparing and Reviewing Applications for the Licensing of Non-Power Reactors:

Standard Review Plan and Acceptance Criteria, for Licensing Radioisotope Production Facilities and Aqueous Homogeneous Reactors, dated October 17, 2012.

As stated in the interim staff guidance (ISG) augmenting NUREG-1537, the NRC staff determined that certain guidance originally developed for heterogeneous non-power research and test reactors is applicable to aqueous homogenous facilities and production facilities.

SHINE used this guidance to inform the design of its facility and to prepare its FSAR. The staffs use of reactor-based guidance in its evaluation of the SHINE FSAR is consistent with the ISG augmenting NUREG-1537.

As appropriate, the NRC staff used additional guidance (e.g., NRC regulatory guides, Institute of Electrical and Electronics Engineers (IEEE) standards, American National Standards Institute/American Nuclear Society (ANSI/ANS) standards, etc.) in the review of the SHINE FSAR. The additional guidance was used based on the technical judgment of the reviewer, as well as references in NUREG1537, Parts 1 and 2; the ISG augmenting NUREG-1537, Parts 1 and 2; and the SHINE FSAR. Additional guidance documents used to evaluate the SHINE FSAR are provided as references in Appendix B, References, of this SER.

13a.4 Review Procedures, Technical Evaluation, and Evaluation Findings The NRC staff performed a review of the technical information presented in SHINE FSAR Section 13a2, as supplemented, to assess the sufficiency of the final SHINE IF accident analysis for the issuance of an operating license. The sufficiency of the final accident analysis is determined by ensuring that it meets applicable regulatory requirements, guidance, and acceptance criteria, as discussed in Section 13a.3, Applicable Regulatory Guidance and Acceptance Criteria, of this SER. The results of this technical evaluation are summarized in SER Section 13a.5, Review Findings.

The review covered the methodology for analyzing the systems and operating characteristics of the SHINE facility that could affect its safe operation or shutdown. It includes the identification of limiting accidents within each design-basis accident category, an analyses of accident progression, and evaluation of the radiological and chemical exposure consequences. For each accident category, a review of its effects on designed barriers, protective systems, operator responses, and mitigating features were examined. The analysis of potential radiological consequences to the public, the facility control room operator and staff, and the environment were evaluated against the applicable accident dose criteria. Chemical exposure consequences to the same receptors were evaluated against the applicable chemical exposure criteria. These analyses use the most conservative operational condition or operating mode to determine potential radiological and chemical exposure consequences. The information and analyses presented demonstrate that the SHINE facility system designs, safety limits, limiting safety system settings, and limiting conditions for operation were selected to ensure that the consequences of analyzed accidents do not exceed acceptable radiological or chemical design criteria.

3

The primary potential consequences resulting from the operation of the SHINE facility are radiological. The design-basis accidents are postulated accidents that a nuclear facility must be designed and built to withstand without loss to the SSCs necessary to ensure public health and safety. They can be thought of as loosely defined classes of accidents that bound a number of facility processes, activities, or accident sequences identified through a type of risk-assessment, to identify the limiting event selected for detailed quantitative radiological consequence analysis.

They are not intended to be actual event sequences, but rather to be surrogates to enable deterministic evaluation of the response of a facilitys engineered safety features. They are intentionally conservative in order to compensate for known uncertainties in accident progression, fission product transport, and atmospheric dispersion.

The design-basis accidents are computed in terms of total effective dose equivalent (TEDE),

which are used as figures-of-merit to be compared to the applicable control room design and siting criterion. The TEDE is defined in 10 CFR 20.1003 as the sum of the effective dose equivalent (for external exposures) and the committed effective dose equivalent (for internal exposures). For the purposes of design and siting, this allows for a transparent assessment of the performance of minimum necessary design, fabrication, construction, testing, and performance requirements for SSCs. As discussed above, the TEDE value represents the results of a highly stylized deterministic modeling approach of design-basis accidents, which credits only safety-related emergency safety features to transport and mitigate a severe accident source term which represents an accident of exceedingly low probability. It is noted that these TEDE results do not represent actual doses given an event. However, they do help ensure that actual doses received during an accident remain below the occupational dose limits of 10 CFR Part 20, Standards for Protection Against Radiation. This would be done in combination with the general as low as is reasonably achievable (ALARA) practices of 10 CFR Part 20.

In FSAR Chapter 13, SHINE describes the overall facility safety analyses that uses both the SHINE Safety Analysis (SSA) methodology and the traditional design-basis accident (DBA) radiological consequence analyses. The SSA was developed pursuant to the ISG augmenting NUREG-1537, which endorses the use of integrated safety analysis methodologies as described in 10 CFR Part 70 and NUREG-1520, Standard Review Plan for Fuel Cycle Facilities License Applications. Those methodologies apply the consequence and likelihood criteria of 10 CFR 70.61 to determine credible accident sequences, preventive or mitigative safety features (i.e., engineered and administrative controls, which the applicant refers to as safety-related controls), and the associated quality assurance elements to ensure that those features are available and reliable. The SSA is considered a licensee-controlled document and is not a requirement for a 10 CFR Part 50 license. However, the SSA is a part of SHINEs overall licensing basis demonstrating that the SHINE facility design and operations will ensure the health and safety of facility personnel and the public. The SSA is also controlled by the SHINE administrative controls technical specifications (TSs) as a part of the SHINE Nuclear Safety Program. The SHINE DBAs analysis follows guidance found in NUREG-1537, Part 2, Chapter 13, Accident Analyses, as augmented by the ISG augmenting NUREG-1537, Part 2, which states that the standard review plan and acceptance criteria is applicable to reviewing a description of the accident analyses. SHINE also identified a number of SHINE facility-specific design basis accidents through the SSA.

13a4.1 Radiological and Design Criterion 4

Presently, no radiological accident dose criterion is set forth in regulation and subsequent guidance to assess the risk to public health and safety and control room operators for non-power production or utilization facilities. In lieu of a standard regulatory accident dose criterion, the standards of 10 CFR Part 20 have been applied for evaluating the effects of a postulated accident, for instance:

• Before January 1, 1994, the accident dose criteria used to license a non-power production or utilization facility were generally compared to the public dose limits of 10 CFR Part 20. Therefore, the accident criteria that the NRC staff generally found to be acceptable for accident analyses were the public dose limits of 0.5 rem whole body and 3 rem thyroid for members of the public.

• On January 1,1994, the NRC amended 10 CFR Part 20 to reduce the dose limits to a member of the public to 0.1 rem TEDE with an implementation date of January 1, 1994.

In lieu of an accident dose criterion, under 10 CFR 20.1301(d), a licensee or license applicant may apply for prior NRC authorization to operate up to an annual dose limit for an individual member of the public of 0.5 rem.

However, as discussed in NUREG-1537, Part 1, there are several instances in which the NRC staff has accepted very conservative accident analyses that exceed the 10 CFR Part 20 public dose limits discussed above.

The NRC staff described in the Federal Register, Volume 82, Number 60, dated March 30, 2017 (82 FR 15643), a proposal to amend the NRCs regulations that govern the license renewal process for non-power production or utilization facilities. The staff stated that it had determined that the public dose limit of 0.1 rem (0.001 Sv) TEDE is unduly restrictive to be applied as accident dose criteria for these facilities, other than those subject to 10 CFR Part 100, Reactor Site Criteria. The staff based this determination on an NRC Atomic Safety and Licensing Appeal Board statement that the standards in 10 CFR Part 20 are unduly restrictive as accident dose criteria for research reactors (Trustees of Columbia University in the City of New York, ALAB-50, 4 AEC 849, 854-855 (May 18, 1972)). Therefore, the staff proposed to amend the regulations in 10 CFR 50.34, Contents of Applications; Technical Information, to add an accident dose criterion of 1 rem TEDE for non-power production or utilization facilities not subject to 10 CFR Part 100.

The proposed accident dose criterion of 1 rem TEDE is based on the U.S. Environmental Protection Agencys (EPA) Protective Action Guides (PAGs), which were published in the EPA document 400-R-92-001, Manual of Protective Action Guides and Protective Actions for Nuclear Incidents. In January 2017, the EPA published an update to its PAGs in EPA-400/R-17/001, PAG Manual: Protective Action Guides and Planning Guidance for Radiological Incidents. The update to the EPA PAGs did not change the basis for the 1 rem TEDE early phase PAG published in 1992. The purpose of the EPA PAGs is to support decisions on protective actions to provide reasonable assurance of adequate protection of the public from unnecessary exposure to radiation.

The EPA PAGs are dose guidelines to support decisions that trigger protective actions such as staying indoors or evacuating to protect the public during a radiological incident. The PAG is defined as the projected dose to an individual from a release of radioactive material at which a specific protective action to reduce or avoid that dose is recommended. The three principles considered in the development of the EPA PAGs were: (1) prevent acute effects; (2) balance protection with other important factors and ensure that actions result in more benefit than harm; 5

and (3) reduce risk of chronic effects. In the early phase of a nuclear incident, which may last hours to days, the EPA PAG recommends the protective actions of sheltering-in-place or evacuation of the public to avoid inhalation of gases or particulates in an atmospheric plume and to minimize external radiation exposures between 1 rem to 5 rem. Therefore, if the projected dose to an individual from a nuclear incident is less than 1 rem, no protective action for the public is recommended.

SHINE chose to adopt an accident dose criterion of 1 rem TEDE based on the proposed rule described in 82 FR 15643 and the EPA PAGs discussed therein. The SHINE-selected radiological siting and design criteria (in lieu of the 10 CFR Part 20 exposure limits) are defined as follows:

• Radiological consequences to an individual located in the unrestricted area following the onset of a postulated accidental release of licensed material would not exceed 1 rem TEDE for the duration of the accident and

• Radiological consequences to workers do not exceed 5 rem TEDE during the accident.

The NRC staff finds this accident dose criterion to be acceptable based on the understanding of the EPA early phase PAG and the NRCs proposed accident dose criterion of 1 rem TEDE for non-power production or utilization facilities to provide reasonable assurance of adequate protection of the public from unnecessary exposure to radiation.

SHINE defines the control room operator as the worker receptor for calculating radiological consequences to demonstrate compliance with SHINEs General Design Criterion 6 - Control room, which states:

A control room is provided from which actions can be taken to operate the irradiation units safely under normal conditions and to perform required operator actions under postulated accident conditions.

The SHINE facility uses design criteria to ensure that the SSCs within the facility demonstrate adequate protection against the hazards present. The use of the control room operator as the worker receptor assists in ensuring that the SSCs present in the SHINE facility are those physical SSCs whose intended functions are to prevent accidents that could cause undue risk to health and safety of workers and the public and to control or mitigate the consequences of such accidents. The design criteria are selected to cover:

• The complete range of IF and RPF operating conditions.

• The response of SSCs to anticipated transients and potential accidents.

• Design features for safety-related SSCs including redundancy, environmental qualification, and seismic qualification.

• Inspection, testing, and maintenance of safety-related SSCs.

• Design features to prevent or mitigate the consequences of fires, explosions, and other man-made or natural conditions.

• Quality standards.

• Analyses and design for meteorological, hydrological, and seismic effects.

• The bases for TSs necessary to ensure the availability and operability of required SSCs.

6

In addition to the siting and design criteria mentioned above, SHINE has additional SHINE safety criteria that assist in achieving an acceptable level of safety by ensuring that events are highly unlikely or by reducing consequences less than the SHINE safety criteria. The SHINE safety criteria are:

• An acute worker dose of 5 rem or greater TEDE.

• An acute dose of 1 rem or greater TEDE to any individual located outside the owner-controlled area.

• An intake of 30 milligrams or greater of uranium in a soluble form by any individual located outside the owner-controlled area.

• An acute chemical exposure to an individual from licensed material or hazardous chemicals produced from licensed material that could lead to irreversible or other serious, long-lasting health effects to a worker or could cause mild transient health effects to any individual located outside the owner-controlled area.

• Criticality where fissionable material is used, handled, or stored (with the exception of the target solution vessel).

• Loss of capability to reach safe shutdown conditions.

The SHINE radiological-related safety criteria of acute worker dose and individual located outside the owner-controlled area dose of 5 and 1 rem, respectively, are bound by the control room design and siting criteria of 5 and 1 rem, respectively, using the TEDE methodology.

The SHINE safe shutdown safety criterion ensures that the facility is designed to automatically shut down the irradiation process, place the target solution into a safe condition, and stabilize accident conditions without immediate operator actions.

13a.4.2 SHINE Safety Analysis Methodology The NRC staff evaluated the SHINE SSA using the guidance and acceptance criteria from the ISG augmenting NUREG-1537, Part 2, which endorses the use of integrated safety analysis methodologies as described in 10 CFR Part 70 and NUREG-1520. Those methodologies apply the consequence and likelihood criteria of 10 CFR 70.61 to determine credible accident sequences, preventive or mitigative safety features (i.e., engineered and administrative controls, which the applicant refers to as safety-related controls), and the associated quality assurance elements (also referred to as management measures) to ensure that those features are available and reliable. Those consequence criteria include radiological consequences as well as chemical consequences for chemical hazards directly associated with NRC licensed radioactive material. Given the nature of the SHINE facility and processes, the chemical consequence criteria are part of ensuring that the activities authorized by the license can be conducted without endangering the health and safety of the public (10 CFR 50.57(a)(3)) and facility personnel. The chemical consequence criteria also form a part of the bases and evaluations showing that safety functions will be accomplished (10 CFR 50.34(b)(2)). As stated in the ISG augmenting NUREG-1537, Part 1, applicants may propose alternate accident analysis methodologies, consequence and likelihood criteria, safety features, and methods of assuring the availability and reliability of the safety features.

SHINE FSAR Section 13a2 states that SHINEs SSA applies a methodology based on NUREG-1520 to the IF and RPF facilities. The applicant uses its SSA methodology to identify and 7

evaluate credible accident sequences. The accident categories are the following, evaluated for the IF and RPF as appropriate:

• Excess reactivity insertion

• Reduction in cooling

• Mishandling or malfunction of target solution

• Loss of offsite power

• External events, including natural phenomenon events

• Mishandling or malfunction of equipment

• Large undamped power oscillations

• Detonation and deflagration in the primary system boundary

• System interaction events

• Facility-specific events

• Inadvertent nuclear criticality in the RPF

• Hazardous chemical accidents In its SSA, the applicant also identified and evaluated safety-related controls for accident prevention or mitigation, including the methods for ensuring their availability and reliability.

There are some differences in SHINEs methodology versus the methodology described in NUREG-1520. Additionally, while SHINE is a first-of-a-kind facility, the applicant makes use of engineering judgement and operating experience of similar systems and components and similar types of activities in industrial and nuclear applications in its evaluations of the accident sequences and safety-related controls. The NRC staffs review of the applicants methodology is described below.

The SSA considers routine activities, non-routine activities, and external events that could initiate accident sequences, such as normal and abnormal operations and maintenance activities. The SSA assesses those activities using the following steps:

• Identification and evaluation of facility hazards;

• Identification of credible accident sequences associated with the hazards;

• Assessment of radiological and chemical consequences and likelihoods associated with the accident sequences;

• Identification and description of safety-related controls to prevent the identified accident sequences or mitigate their consequences; and

• Identification of reliability management measures to ensure safety-related controls can perform their intended safety functions.

Among the hazards identified and considered are fissile material hazards for criticality accidents. As described in SHINE FSAR Section 3.1, criticality is considered in the SHINE safety criteria. SHINEs SSA methodology includes identification and evaluation of such accidents and controls for those accidents. A description of this process is provided in SHINE FSAR Section 13a2 and is evaluated below.

Identification and evaluation of facility hazards SHINE identifies and evaluates facility hazards using common hazard evaluation methods such as Hazard and Operability Analysis (HAZOP) and Failure Modes and Effects Analysis (FMEA).

8

The NRC staff finds that these methods have the necessary capabilities for assessments to satisfy 10 CFR Part 70 requirements when used in accordance with appropriate selection criteria (see NUREG-1513, Integrated Safety Analysis Guidance Document, and Section 3.4.3.2(5) of NUREG-1520). The staff used these same criteria to evaluate SHINEs use of these methods as part of SHINEs implementation of 10 CFR Part 70 methodologies to demonstrate compliance with 10 CFR Part 50 requirements. The results of SHINEs hazard evaluation identify those hazards that have the potential to harm the public, facility occupants, or the environment. The results also recommend engineered or administrative controls that may be applied to prevent or mitigate the hazards.

Identification of credible accident sequences associated with the hazards SHINE applies the results of the hazard evaluation to develop process hazards analyses and the associated credible accident sequences. SHINE designates an initiating event for each sequence that SHINE determines according to the applicable failures, process deviations (including human errors), or external events derived from the hazard evaluation.

SHINE provides criteria that define credible accident sequences. These criteria are very similar to the sets of qualities described in NUREG-1520 Section 3.4.3.2 (9) as criteria that can define an event as not credible. As appropriate, the terminology used by the applicant has been adapted to use SSA terminology and to recognize that the license includes TSs, which address those items described in Section 13a2 of the FSAR. The intent is that the argument for an event not being credible cannot depend upon the exercise or implementation of any kind of control. This includes any feature controlled by license condition or TS or by safety-related SSCs or activities, which include engineered or administrative (specific administrative controls, in the applicants terminology) safety-related controls (among which are those that meet the applicants safe-by-design definition) or reliability management measures. The NRC staff finds that this intent is consistent with the intent of the set of qualities described in NUREG-1520.

These criteria are similar to the sets of qualities described in NUREG-1520 that could define an event as not credible. For item c above, the terminology used by the applicant has been adapted to recognize that the license includes TSs, which address those items described in Section 13a2 of the FSAR. The intent is that the argument for an event not being credible cannot depend upon the exercise or implementation of any kind of control. This includes any feature controlled by license condition TS or by safety-related SSCs or activities, which include engineered or administrative (specific administrative controls, in the applicants terminology) safety-related controls (among which are those that meet the applicants safe-by-design definition) or reliability management measures. The NRC staff finds that this intent is consistent with the intent of the set of qualities described in NUREG-1520.

Assessment of radiological and chemical consequences and likelihoods SHINE defines consequence and likelihood categories in order to calculate a risk index for each credible accident sequence. The risk index methodology is based on risk index values described in NUREG-1520 where accident sequences with risk indices above a certain limit require safety controls (i.e., safety-related controls in SHINEs terminology). The SHINE consequence categories designate indices based on deterministic intermediate and high consequence limits for radiological and chemical exposures of the public and facility occupants.

SHINE determines these limits based on the SHINE safety criteria.

9

The SHINE safety criteria define the intermediate consequence limits. An exception is that the SHINE safety criteria include the high consequence limit on soluble uranium intake. The NRC staff notes that 10 CFR 70.61(c) doesnt include a soluble uranium intake limit for intermediate consequences; the limit is in 10 CFR 70.61(b), which means an event leading to an intake in excess of that amount would be a high consequence event. However, with SHINEs approach of reducing the likelihood of both high and intermediate consequence events to highly unlikely, the staff finds SHINEs use of the soluble uranium intake limit to be acceptable. The staff finds that the high consequence limits align with those specified in 10 CFR 70.61(b).

The radiological safety criteria and intermediate consequence limits use dose limit values that are noticeably less than those in 10 CFR 70.61(c) and do not include a separate release criterion like is in 10 CFR 70.61(c). As this is not an application for a 10 CFR Part 70 license, the applicant need not commit to the limits in 10 CFR 70.61 but can propose and justify alternate performance criteria (see Section 13b.1 of Part 2 of the ISG augmenting NUREG-1537). In this case, the applicant has selected radiological safety criteria and intermediate consequence limits with dose limit values that are lower than those in 10 CFR 70.61(c). These limits are 5 rem TEDE for workers and 1 rem TEDE for the public. The public accident dose limit is evaluated at the controlled area boundary as discussed in SER Section 13a.4.1 The applicant has not selected a separate release criterion, instead using the public dose criterion to cover the radiological consequences from a release. The NRC staff finds that the dose criterion is an appropriate criterion for accidents for the SHINE facility.

With regard to consequences for workers, FSAR Section 13a2 states that radiological consequences for facility staff are determined for control room operators, but chemical consequences for facility staff are determined for control room operators and other personnel in the controlled area, consistent with the approach in 10 CFR Part 70. The approach for radiological consequences is consistent with the requirements and regulatory criteria for the safety analyses for a 10 CFR Part 50 license. The NRC staff notes that while the FSAR only addresses radiological doses to control room operators, the SSA does include radiological dose to other personnel in the radiological controlled area, which is consistent with 10 CFR Part 70 for evaluating consequences to any individual that would receive an occupational dose as defined in 10 CFR 20.1003.

SHINE designates three likelihood categories: not unlikely, unlikely, and highly unlikely. For each category, SHINE establishes corresponding likelihood indices and annual event frequency limits. The NRC staff finds that the defined indices and frequency limits align with Table A-6 of NUREG-1520. SHINE determines the likelihood of credible accident sequences from the initiating event frequency and may include other factors such as component failures or human error. For each credible accident sequence, SHINE evaluates the uncontrolled risk by combining the applicable consequence and likelihood indices without crediting any safety-related controls. This evaluation results in a risk index value which determines whether the risk of the postulated accident sequence is acceptable. Acceptable risks are:

• High and intermediate consequence events that are highly unlikely or

• Low consequence events in any likelihood category.

For nuclear criticality safety, the applicant treats criticality accidents as high consequence events (see SHINE FSAR Section 6b.3). Thus, such events must be highly unlikely to have acceptable risk. The applicant defines highly unlikely for criticality accident events as meeting the double contingency principle. As noted in Section 3.4.3.2(9) of NUREG-1520, double 10

contingency addresses several reliability and availability qualities, and, where the applicable qualities are each present to an appropriate degree, a system of safety-related controls (in NUREG-1520, these controls are called items relied on for safety) possessing double contingency protection can be an acceptable definition of highly unlikely. In considering the definition of double contingency, the NRC staff notes that sometimes more than a two-fold redundancy may be needed.

The applicant also defines and applies an approach called safe-by-design (SBD) to defining a criticality accident event as highly unlikely. FSAR Table 13a2.1-4, Failure Frequency Index Numbers, includes a description of the characteristics for a component or feature to qualify as SBD. The SBD qualification applies only to passive design components or features that are passive engineered controls (PEC) that meet the following criteria:

a. The PECs dimensions fall within established single parameter limits or can be shown by calculation to be subcritical, considering bounding process conditions and including the use of the approved subcritical margin.

b. The PEC has no credible failure mechanisms (e.g., bulging, corrosion, leakage) that could disrupt the credited design characteristics.

c. The PECs design characteristics are controlled so that the only potential means to effect a change that might result in a failure to function would be to implement a design change.

The control of the PECs that are credited as SBD includes the applicants configuration management program, a description of which is given in TS 5.5.4, Configuration Management.

This program is one of several developed to ensure the availability and reliability of safety-related controls and that the facility design and operations are consistent with the safety analyses (see also reliability management measures discussion below). This program includes evaluation of changes in accordance with SHINEs 10 CFR 50.59 change control program.

Chapter 12, Conduct of Operations, of this SER describes the NRC staffs review of SHINEs process to maintain this program, which the staff considered in its review of SHINEs SSA methodology, including reliability management measures. Since the SBD component or feature is a PEC, the item is safety-related and so the applicants TS 5.5.4 configuration management program applies to these items. Additionally, as described in the applicants Quality Assurance (QA) Program Description (QAPD), these items will be controlled to Quality Level 1 (QL-1), the highest level in the applicants graded approach to quality in its QAPD.

Since the applicants method allows for qualification of items as SBD alone to be relied on to determine that a criticality accident sequence is highly unlikely, the NRC staff finds that the reliability management measures, including the applied QA elements, applied to such items need to have a commensurately high degree of rigor. This is due to the significance of the risk reduction credited for being SBD. The staff notes that the applicants QAPD follows ANSI/ANS-15.8-1995, Quality Assurance Program Requirements for Research Reactors. As described in NUREG-1537 and the ISG augmenting NUREG-1537, the NRC accepts a QA program that follows ANSI/ANS-15.8-1995 (as endorsed in Regulatory Guide (RG) 2.5, Revision 1, Quality Assurance Program Requirements for Research and Test Reactors) as fulfilling the QA requirements of 10 CFR Part 50 for the applicants type of facility. The staff evaluation of the SHINE QAPD is in Chapter 12 of this SER.

The applicants method also allows for applying a failure frequency index number (FFIN) of -5 to accident sequences besides criticality accident sequences for which SBD is applied. The NRC 11

staff notes that this aspect of the applicants method also varies from the approach described in NUREG-1520. The applicant indicated that an FFIN of -5 was applied to a limited number of accident sequences. In most cases, the uncontrolled accident sequence involves multiple failures or conditions to occur coincident with an initiating event. Thus, the FFIN for the uncontrolled accident event includes the individual contributions of each failure or condition necessary to result in an accident sequence having radiological or chemical consequences. In other instances, the applicant performed calculations that demonstrate the frequency of the event to be sufficiently low or otherwise provided information to justify the use of this FFIN.

Based on this information, the applicants method allows limited use of an FFIN of -5 for accident sequences beyond those criticality accident sequences that involve SBD. Based on a review of these accident sequences, the staff finds that the method requires appropriate evaluations and considerations for applying this FFIN. The staffs finding is also based on considerations of the applicants overall accident analysis approach for the requested 10 CFR Part 50 license.

Identification and description of safety-related controls to prevent the identified accident sequences or mitigate their consequences For accident sequences with unacceptable risk indices, SHINE designates engineered and administrative controls to reduce the risk to acceptable levels. Engineered controls include passive and active controls. SHINE refers to these engineered and administrative controls as safety-related controls. SHINE confirms the reduction in risk by reassessing the accident sequence after applying the controls. The reduction in risk can be achieved by decreasing the likelihood of occurrence and/or reducing the resulting consequences. SHINE may also identify defense-in-depth (DID) controls to provide additional risk reduction margin. SHINE does not credit these DID controls for the purposes of evaluating the risk of an accident sequence.

The NRC staff finds that the applicants method for determining failure frequency and probability indices is, with the exceptions already noted above and some other changes, consistent with the method described in NUREG-1520. However, since this facility is a first-of-a-kind for which the reliability of human actions has not been studied to the same degree as for power reactors or typical fuel cycle facilities, it was unclear to the staff that some of the indices that SHINEs method allows for administrative controls, including enhanced administrative controls, would be justifiable for those controls. The applicant did explain that while the SHINE facility is a first-of-a-kind, some of the administrative controls are similar in nature to those at other facilities.

Additionally, in selecting the index for failure probability (FSAR Table 13a2.1-5), the applicant selects the higher index from the index range applicable for the type of administrative control (i.e., an index of -2 for an enhanced administrative control). The staff finds the applicants method for assigning failure frequency and probability indices to be acceptable based on the applicant selecting the highest index in the index range and in consideration of the applicants overall accident analysis approach. Additionally, in evaluating SHINEs method for determining failure frequency and probability indices, the staff considered SHINEs process to maintain the SSA, which will ensure that the SSA reflects the actual performance of the administrative safety-related controls. The staffs evaluation of SHINEs process to maintain the SSA is located in Chapter 12 of this SER. Thus, based on these considerations, the staff finds that SHINEs failure frequency and probability index method is acceptable.

The NRC staff also finds that the applicants method for determining failure probability indices allows for engineered controls to be given a failure probability index number of -4 or -5. While this is consistent with the method as described in NUREG-1520, the method in NUREG-1520 12

and in the applicants FSAR (FSAR Table 13a2.1-5) indicates that these index values can rarely be justified by evidence. In reviewing the accident sequences and information provided in the SHINE RAI response dated January 29, 2021 (ADAMS Accession No. ML21029A105), the staff finds that the limited application of these index values along with the justifications for their application in those instances indicate appropriate consideration is taken in assigning such index values. Further, in evaluating SHINEs method of determining failure probability indices, the staff considered SHINEs process to maintain the SSA, which will ensure that the SSA reflects the actual performance of the engineered safety-related controls. The staffs evaluation of SHINEs process to maintain the SSA is located in Chapter 12 of this SER. Thus, based on these considerations, the staff finds that the applicants method for assigning failure frequency and probability indices is acceptable.

Identification of Reliability Management Measures SHINE applies reliability management measures to ensure the availability and reliability of safety-related controls. SHINE defines reliability management measures as programmatic administrative controls applied to ensure that the credited control can perform its intended safety function. Reliability management measures include activities such as design control, surveillance, procedures, training, and preventive maintenance. The applicant established programs for development and implementation of specific reliability management measures for the engineered and administrative safety-related controls. These programs include the applicants QA program described in its QAPD and the following programs in Section 5 of the TSs:

• TS 5.2, Review and Audit

• TS 5.4, Procedures

• TS 5.5.1, Nuclear Safety Program

• TS 5.5.2, Training and Qualification

• TS 5.5.4, Configuration Management

• TS 5.5.5, Maintenance of Safety-Related SSCs

• TS 5.7, Required Actions

• TS 5.8, Reports

• TS 5.9, Records In its review of the applicants SSA methodology, the NRC staff reviewed the descriptions of the reliability management measures and programs, including descriptions of specific reliability management measures for the safety-related controls identified for several accident sequences.

The programs for these measures include those programs that the staff would expect to be in place for providing specific measures to ensure the reliability and availability of the safety-related controls that are credited for accident prevention and mitigation (e.g., TS 5.5.1). In terms of the QA program, the staff recognizes that the applicants QA program includes a graded approach. In this approach, the full QA program is applied to safety-related items and activities. This means that the safety-related controls, both engineered and administrative, that the applicant relies on to prevent or mitigate accidents will be controlled to QL-1. The staff finds that this is acceptable and appropriate since treating these controls and characteristics at the highest QA level ensures that these controls and characteristics are maintained, reliable, and available as analyzed and credited in the applicants safety analysis.

13

In reviewing the different accident types, the NRC staff identified instances where it appeared that items and activities that are reliability management measures were being identified as administrative safety-related controls or identified as defense-in-depth controls. As reliability management measures ensure that safety-related controls are available and reliable, they are not themselves safety-related controls, but they are necessary to ensure that the safety-related controls perform as evaluated in the applicants analyses. Thus, a modification of a reliability management measure for a particular safety-related control can result in a change to the safety-related controls performance, reflected in its risk index, and so affect whether accident sequences relying on that safety-related control have been adequately prevented or mitigated.

This means that modification of a safety-related controls reliability management measures can result in an increase in frequency, likelihood, or consequence of an accident or malfunction.

Licensee change control programs include evaluation of increases in frequency, likelihood, and consequence. Chapter 12 of this SER describes the staffs review of SHINEs process to maintain the SSA, which the staff considered in its review of SHINEs SSA methodology, including reliability management measures.

Having clear distinctions and descriptions of the reliability management measures and the safety-related controls they support is important. For example, an administrative safety-related control may be a particular facility staff action to ensure a system parameter is maintained within an acceptable range. The procedures for performing that action would be a reliability management measure that ensures that the control is properly performed (and so is available and reliable). Training on that procedure would be an additional reliability management measure. Other items used to ensure that the facility staffs action is performed correctly or that the equipment that the facility staff use to perform that action is appropriate and functioning correctly would also be reliability management measures. Additionally, if an item is necessary to ensure that a safety-related control is available and reliable, it is a reliability management measure and cannot be treated as defense-in-depth. Thus, the applicant revised its SSA to ensure that reliability management measures are not identified as specific administrative controls and are not used as defense-in-depth controls. In its review of selected accident sequences and descriptions of safety-related controls, the NRC staff finds that there are a few instances of items identified as defense-in-depth controls that seem to be more like reliability management measures. However, these particular items do not appear to also be associated with supporting other safety-related controls for the evaluated accident sequences. Thus, the staff finds that the applicants SSA method adequately distinguishes reliability management measures from safety-related controls.

Conclusion The NRC staff reviewed the SSA methodology and the following accident types to assess the applicants implementation of its methodology:

• Facility-specific events

• Mishandling or malfunction of equipment,

• External events

• Selected accident events that could lead to criticality.

The NRC staff finds that SHINE FSAR Chapter 13 and the SSA methodology are consistent with the ISG augmenting NUREG-1537, Part 2, in that the SSA methodology reviews the systems and operating characteristics of the SHINE facility that could affect safe operation or shutdown. Furthermore, the staff finds that FSAR Chapter 13 and the SSA methodology demonstrate that the applicant applied the SSA methodology to identify limiting accidents, 14

analyze the evolution of the scenarios, evaluate the consequences, designate safety-related controls, and establish quality assurance measures.

The SSA and the SSA methodology are an important part of SHINEs safety program. An effective and adequate SSA and safety program are those that reflect the as-built and as-operated facility and demonstrate that it ensures the health and safety of personnel and the public. Chapter 12 of this SER includes the NRC staffs evaluation of SHINEs QAPD and the process to maintain the SSA. As noted above, the staff considered the outcome of those reviews in its evaluation of SHINEs SSA methodology and its implementation.

The NRC staff has determined that the SSA methodology demonstrates an adequate basis for the final design and satisfies the applicable acceptance criteria of the ISG to NUREG-1537, Part 2, allowing the staff to make the following findings, with the considerations identified above:

(1) The various methodologies that SHINE described (e.g., HAZOP, FMEA, etc.) are accepted accident analysis approaches.

(2) The definitions of accident likelihood, consequence severity, and the risk categories are comparable to the guidance in NUREG-1520 and are acceptable for use in the SSA.

(3) The SSA methodology provides reasonable assurance that SHINE has identified intermediate and high consequence accidents and established safety-related controls to decrease the likelihood of occurrence to highly unlikely and/or reduce the consequence to low.

(4) The SSA methodology supports the adequate identification of capabilities and features to prevent or mitigate potential accidents and protect the health and safety of the public and workers.

Based on these findings, the NRC staff concludes that the accident analysis methodology, as described in SHINE FSAR Chapter 13 and implemented in the SSA, is sufficient to demonstrate that the proposed equipment, facilities, and administrative controls to prevent or mitigate accidents are adequate to protect health and minimize danger to life or property.

13a.5 SHINE Design-Basis Accidents 13a.5.1 SHINE Design-Basis Accident Methodology SHINE FSAR Chapter 13 provides the DBA analyses which are evaluated against the siting and control room design criterion. These analyses evaluate the design and performance of SSCs of the facility with the objective of assessing the risk to public health and safety resulting from operation of the facility. The analyses assist in determining the margins of safety during normal operations and transient conditions anticipated during the life of the facility, and the adequacy of SSCs provided for the prevention and mitigation of accidents consequences. Therefore, SHINE identified the postulated initiating events and credible accidents that form the design-basis for the facility, consisting of the irradiation units (IUs) and supporting systems, and the RPF.

SHINE elected to utilize the following sources of information to develop applicable DBAs:

15

• NUREG-1537, Part 1, Guidelines for Preparing and Reviewing Applications for the Licensing of Non-Power Reactors, Format and Content, issued February 1996.

• NUREG-1537, Part 2, Guidelines for Preparing and Reviewing Applications for the Licensing of Non-Power Reactors, Standard Review Plan and Acceptance Criteria, issued February 1996.

• Final Interim Staff Guidance Augmenting NUREG-1537, Part 1, Guidelines for Preparing and Reviewing Applications for the Licensing of Non-Power Reactors: Format and Content, for Licensing Radioisotope Production Facilities and Aqueous Homogeneous Reactors, dated October 17, 2012.

• Final Interim Staff Guidance Augmenting NUREG-1537, Part 2, Guidelines for Preparing and Reviewing Applications for the Licensing of Non-Power Reactors:

Standard Review Plan and Acceptance Criteria, for Licensing Radioisotope Production Facilities and Aqueous Homogeneous Reactors, dated October 17, 2012.

• NUREG/CR-6410, Nuclear Fuel Cycle Facility Accident Analysis Handbook, dated March 1998, which presents methodology to compute radiological consequences utilizing the so-called five-factor formula.

• NUREG-1520, Revision 2, Standard Review Plan for Fuel Cycle Facilities License Applications, issued June 2015.

• NUREG/CR-2858, PAVAN: An Atmospheric-Dispersion Program for Evaluating Design-Basis Accidental Releases of Radioactive Materials from Nuclear Power Stations, issued November 1982.

• RG 1.145, Revision 1, Atmospheric Dispersion Models for Potential Accident Consequence Assessments at Nuclear Power Plants, issued February 1983.

• The SSA document that incorporated information from the SHINE process hazard analysis method within the safety analysis, hazard and operability studies, failure modes and affects analyses, and experience of the hazard analysis team.

For non-power reactors, the MHA is generally analyzed because it would involve a scenario involving irradiated fuel and probably include the release of fission products to the environment.

The NRC staff notes that, in many cases, non-power reactor accidents do not result in fission product releases to the environment. However, SHINE identified numerous DBAs that result in fission product releases to the environment. The DBA releasing fission products to the environment resulting in the highest offsite public consequences is considered the facilitys maximum creditable accident. SHINE also identified DBAs that result in releases of non-fission product radioactive material to the environment. These accidents involve releases of tritium.

The NRC staff review process can be generally divided into six parts, which are a review of: (1) selected bounding DBAs; (2) applicable accident source terms; (3) major SSCs of the facility that are intended to mitigate the radiological consequences of a DBA; (4) characteristics of fission product releases from the proposed site to the environment, (5) the meteorological 16

characteristics of the proposed site; and (6) the total calculated radiological consequence dose at the site boundary from the bounding DBAs.

The NRC staff generally does not accept DBA analyses that credit facility features that:

• are not safety-related;

• are not covered by TSs;

• do not meet single-failure criteria; or

• rely on the availability of offsite power.

Safety-related - Those SSCs whose intended functions are to prevent accidents that could cause undue risk to health and safety of workers and the public or to control or mitigate the consequences of such accidents are classified as safety-related SSCs. Safety-related SSCs are designed, constructed, and operated to remain functional during normal conditions and during and following design-basis events. SSCs that perform an engineered safety feature function are also classified as safety-related. The NRC staff finds that the application of SHINEs Design Criteria discussed in SHINE FSAR Chapter 3 reflect the design features of safety-related SSCs which include redundancy, environmental qualification, seismic qualification, and procedures for inspection, testing, and maintenance.

Technical Specifications - The NRC staff reviewed the SHINE TSs, which provide limiting conditions for operation of the facility pursuant to 10 CFR 50.36, Technical Specifications.

Consistent with NUREG-1537, Part 2, and the ISG to NUREG-1537, Part 2, the staff confirmed that the SSCs credited in the accident analysis are designated as safety-related and included within TS. The engineered controls credited for prevention or mitigation are incorporated into TS Section 3.0, Limiting Conditions for Operation and Surveillance Requirements. The safety margins contained within the DBAs are products of specific values and limits contained in the facilitys TSs and other values, such as assumed accident or transient initial conditions or assumed safety system response times. Specific TSs have been established for:

• A process variable, design feature, or operating restriction that is an initial condition of a DBA or transient analysis that either assumes the failure of or presents a challenge to the integrity of a fission product barrier.

• An SSC that is part of the primary success path and which functions or actuates to mitigate a DBA or transient that either assumes the failure of or presents a challenge to the integrity of a fission product barrier.

Single Failure - The Single Failure Criterion is applied when developing DBAs as a design and analysis tool which has the direct objective of promoting reliability through the enforced provision of redundancy in those systems which must perform a safety-related function. The Single Failure Criterion, as applied in DBA analyses, is a requirement that a system that is designed to carry out a defined safety function must be capable of carrying out its mission despite the failure of any single active component within the system or in an associated system that supports its operation. Application of this criterion involves a systematic search for potential single failure points and their effects on the system. The objective is to search for design weaknesses that could be overcome by increased redundancy, use of alternate systems, or use of alternate procedures. In general, only those systems or components that are judged to have a credible chance of failure are assumed to fail when the Single Failure Criterion is applied.

17

Consistent with NUREG-1537 and the ISG to NUREG-1537, the NRC staff confirmed that SHINE has designed the protection systems for high functional reliability consistent with SHINE Design Criterion 15, which ensures that redundancy and independence designed into the protection systems are sufficient to ensure that: (1) no single failure results in loss of the protection function and (2) removal from service of any component or channel does not result in loss of the required minimum redundancy unless the acceptable reliability of operation of the protection system can be otherwise demonstrated.

Emergency Power - Loss of normal electrical power and consequent reduction in cooling will not lead to a challenge to the primary boundary. A loss of normal electric power should not compromise safe IU shutdown. Consistent with NUREG-1537, Part 2, and the ISG to NUREG-1537, the NRC staff confirmed that the emergency electrical power is provided by a common safety-related uninterruptible electrical power supply system (UPSS) and a common nonsafety-related standby generator system. The purpose of the UPSS is to provide a reliable source of power to the redundant divisions of safety-related AC and DC components required to ensure and maintain safe facility shutdown and prevent or mitigate the consequences of design-basis events. The UPSS consists of two independent trains, each consisting of a 125 volts-direct current battery subsystem with associated charger, inverter, and distribution system. This UPSS is capable of delivering required emergency power for the required duration during normal operations and accident conditions. The staff finds that this is consistent with SHINE Design Criteria 27 and 28, which specify that onsite and offsite electric power systems, and their inspection and testing, be provided to permit functioning of safety-related SSCs. The safety functions of the onsite and offsite electric power systems are to provide sufficient capacity and capability to ensure that: (1) target solution design limits and primary system boundary design limits are not exceeded as a result of anticipated transients and (2) confinement integrity and other vital functions are maintained in the event of postulated accidents. The UPSS is designed to have sufficient independence, redundancy, and testability to perform its safety functions assuming a single failure. Provisions are included to minimize the probability of losing electric power from the UPSS as a result of or coincident with, the loss of power from the offsite electric power system. In addition, the SHINE facility is also equipped with a standby generator system that is not safety-related and, thus, not credited in the accident analysis. This system is, however, available as a normal back-up power supply for selected asset protection loads in the event of a loss of offsite power.

The NRC staff confirmed consistency with NUREG-1537, Part 2, and the ISG to NUREG-1537 with respect to SHINEs DBAs accident analysis by reviewing that:

• Credible accidents were categorized, and the most limiting accident in each group was chosen for detailed analyses.

• Each DBA sequence started with an initiation and ended in a stabilized condition.

• The primary boundary consists of all structures that prevent the release of fission products in solution and the fission gases generated during operation and that its integrity will be maintained under all credible accidents analyzed.

• The IU was assumed to be operating normally under applicable TSs before the initiating event.

• Instruments, controls, and automatic protective systems were assumed to be operating normally or to be operable before the initiating event.

• The single malfunction that initiates the event was identified.

18

• Credit was taken during the scenario for normally operating systems and protective actions and the initiation of emergency safety features required to be operable by TSs.

• The sequence of events and the components and systems damaged during the accident scenario were clearly discussed.

• The applicant identified the limiting phenomena that would release radionuclides within the facility and to the outside environment. For the SHINE facility, this includes:

Thermal-hydraulic safety limits; Precipitation of fission products; Precipitation of fuel (uranium);

Detonation or deflagration of combustible gas mixtures; and Excessively high radiolytic gas release.

• Reactivity limits and the functional designs of control and safety-related systems should prevent loss of primary boundary integrity during credible accidents involving insertion of some fraction of excess reactivity. The analyses should include applicable reactivity feedback coefficients and automatic protective actions.

• The applicant analyzed potential power instabilities, including unstable (growing) power oscillations that are large and undamped and that the IU will return to a stable state such that the integrity of the primary boundary is not challenged.

• The mathematical models and analytical methods employed, including assumptions, approximations, validation, and uncertainties, were clearly stated.

• The radiation source terms were presented or referenced.

• The potential radiation consequences to the facility staff and the public were presented and compared with acceptable limits.

The NRC staff reviewed the DBA analysis inputs to confirm that the most restrictive values of facility parameters were selected from the range of design values possible so that the postulated radiological consequences would be maximized. Other considerations included:

• The range of values applicable during an accident that may vary from accident to accident which could differ from the range that applies during normal operations.

• The use of different parameter values in different portions of the analyses and, when needed, sensitivity analysis to determine the limiting value.

• Facility parameters associated with a TS limiting condition for operation which specifies a range, or a value with a tolerance band where the most restrictive value should be used.

• Situations where and how some parameters may change value during the accident. In these cases, the calculation should either assume the most restrictive value for the entire duration or the calculation should be performed in time steps, with the appropriate parameter values used for each time step.

19

• For parameters based on the results of less frequent surveillance testing, for example, efficiency testing of charcoal filters, the degradation that may occur between periodic tests should be considered in establishing the analysis value.

• Analysis parameters affected by density changes that occur in the process stream. With regard to specified volumetric flow rates as limiting conditions of operation, the density used should be consistent with the density that is assumed in the surveillance procedure that demonstrates compliance with the limiting conditions of operations.

13a.5.2 General Description the SHINE Facility Safety and Design Features, and Design Bases Other chapters of the SHINE FSAR contain discussions and analyses of the facility as designed for normal operation. NUREG-1537 necessitates a discussion that considers how the facility has been designed to ensure the safe operation and shutdown of the facility to avoid undue risk to the health and safety of the public, the workers, and the environment. Therefore, this section provides an overview of SHINEs methodology in designing the SSCs and the operating characteristics of the facility that could affect its safe operation and shutdown. The purpose of this section is to provide context on how the SSCs are credited within the DBAs.

The SHINE facility is divided into two major process areas: (1) the IF and (2) the RPF. The IF and the RPF are side-by-side, separated by a central wall. Descriptions of each are as follows:

Irradiation Facility: includes eight IUs with each containing, among other components, a subcritical assembly system which includes the target solution vessel (TSV) and TSV dump tank, light water pool system, and the TSV off-gas system (TOGS).

Radioisotope Production Facility: consists of several process areas that prepare target solution, extract and purify the radioisotope products, and process waste streams. The major process systems are the uranium receipt and storage system, target solution preparation system, target solution staging system, vacuum transfer system, process vessel vent system, radioactive liquid waste storage system, and the radioactive liquid waste immobilization system. The RPF also includes the supercell, which is comprised of several internal cells, including the molybdenum extraction areas, purification areas, an iodine and xenon purification and packaging cell, process vessel vent system equipment, and packaging areas, that form one hot cell structure.

13a.5.2.1 Irradiation Facility Operations and Systems For a facility such as SHINE, margin to safety is large and few credible accidents can be sufficiently damaging to result in the release of radioactive materials to the unrestricted area.

The target solution is low-enriched uranium (LEU) in the form of a uranyl sulfate held within the TSV. During operation, the target solution is close to ambient temperature and pressure. The primary system boundary acts as the primary fission product boundary and is defined by the TSV, TSV dump tank, TOGS, and associated components. Within the IU, the target solution is irradiated in a subcritical assembly by neutrons produced by a fusion-neutron source. After irradiation, the target solution is then processed in the RPF to extract and purify molybdenum-99 (Mo-99) and other medical isotopes. Radioactive waste materials are processed and/or converted to solid wastes for shipment to offsite disposal facilities.

20

The radiological control area (RCA) incorporates both the IF and RPF which are located within a single seismic Category 1 structure. The radioactive material present in the RCA is located in the following areas:

• Irradiation Facility:

IU cells, TOGS shielded cells, Tritium purification system area, Radiological control area ventilation equipment areas.

• Radioisotope Production Facility:

Target solution preparation and storage areas, Supercell, Target solution hold tanks, Carbon delay beds, Radioactive liquid waste storage tanks, Radioactive liquid waste immobilization.

Within the RCA, the facility is designed as a series of confinement boundaries that establish a low-leakage barrier against the uncontrolled release of radioactivity to the environment. The confinement systems provide active and passive protection and are designed to limit the release of radioactive material to occupied or uncontrolled areas during and after DBAs to mitigate the consequences to facility staff, the public, and the environment.

The IF uses two confinement systems:

1. Primary Confinement Boundary and

2. Tritium Confinement Boundary.

The RPF uses three confinement systems:

1. Process Confinement Boundary,

2. Supercell Confinement Boundary, and

3. Below Grade Confinement Boundary.

Primary System Boundary The TSV, TSV dump tank, TOGS, and associated components make up the primary system boundary. The primary system boundary is designed, fabricated, erected, and tested to have an extremely low probability of abnormal leakage, of rapidly propagating failure, and of gross rupture. The primary system boundary has a design pressure of 100 pounds per square inch (psi). The TSV, TSV dump tank, and most components of TOGS have a design temperature of 200°F. The TOGS hydrogen recombiners, recombiner condensers, and the interconnecting piping have a design temperature of 650°F due to heat produced by the hydrogen recombination process resulting in normally elevated temperature within these components.

Primary Confinement Boundary 21

The primary confinement boundary contains the primary system boundary, which contains the fission products. The primary confinement boundary consists predominantly of the IU cell, the TOGS shielded cell, and the IU cell and TOGS cell heating, ventilation, and air conditioning (HVAC) enclosures. The primary confinement boundary is primarily passive, and the boundary for each IU is independent from the others. During normal operations, the primary confinement boundary is operated within a normally-closed atmosphere without connections to the facility ventilation system, except through the primary closed-loop cooling system (PCLS) expansion tank. The closed-loop ventilation units, radiological ventilation zone 1 recirculating subsystem (RVZ1r), circulate and cool the air within the IU cell and the TOGS cell. Each subsystem is equipped with a cooling coil and high-efficiency particulate air (HEPA) and carbon filters to remove contaminants in the circulated air. There are no normally-open external connections between the RVZ1r subsystem and the main RVZ1 system. The PCLS expansion tank connection to RVZ1e provides a vent path for radiolysis gases produced in the PCLS and light water pool, to avoid the buildup of hydrogen gas. The PCLS expansion tank is located in the IU cell but draws air from the TOGS cell atmosphere. A small line connecting the IU cell and TOGS cell atmospheres creates a flow path from the IU cell, into the TOGS cell, and out through the PCLS expansion tank to RVZ1e. This flow path normally maintains the cells at a slightly negative pressure. The connection to RVZ1e is equipped with redundant dampers or valves that close on a confinement actuation signal, isolating the cells from RVZ1. The IU and TOGS shielded cells are equipped with removable shield plugs which allow entry into the confined area. Gaskets and other non-structural features are used, as necessary, to provide sealing where separate structural components meet.

The primary confinement boundary shield plug gaskets will be maintained in accordance with SHINEs Maintenance Program, and will be inspected, repaired, and replaced in accordance with approved maintenance procedures. The content of these procedures is controlled in accordance with SHINE TS Section 5.4, Procedures. Each piping system capable of excessive leakage that penetrates the primary confinement boundary is equipped with one or more isolation valves which serve as active confinement components, except for the nitrogen purge supply system supply and process vessel ventilation system (PVVS) connections which may remain open to sweep gas through the primary system boundary to prevent damage from excessive hydrogen accumulation. Shield plug performance will be verified during startup testing in accordance with approved startup test plans. This testing will be done by slightly pressurizing the confinement and verifying that leakage rates are within acceptance criteria based on the analytical limits. The analytical limit for leak rate out of the IU cell is 6E+04 standard cubic centimeters per minute (sccm) at 0.5 Kilopascal (kPa) differential pressure. The analytical limit for leak rate out of the TOGS cell is 4E+04 sccm at 24 inches of water column (6 kPa) differential pressure. The reliability of the shield plugs will be verified via periodic inspection and testing in accordance with SHINE TS Section 3.4, which includes a limiting condition for operation (LCO) for the primary confinement boundary. LCO 3.4.5 includes a surveillance requirement of the IU cell and TOGS cell shield plugs to verify operability upon each installation of the shield plugs.

There are three digital instrument and control systems that monitor and control various operations throughout the IF and RPF. The process integrated control system (PICS) is a nonsafety-related digital control system that monitors and controls various operations throughout the IF and RPF. The TSV is protected by the TSV reactivity protection system (TRPS). All other engineered safety feature functions are monitored and controlled within the engineered safety features actuation system (ESFAS).

22

The purpose of the TRPS is to monitor process variables and provide automatic initiating signals in response to off-normal conditions, providing protection against unsafe IU operation during the IU filling, irradiation, and post-irradiation modes of operation. The TRPS is designed to end the event and place the target solution in a safe shutdown condition without the need for operator action. Each IU has its own TRPS. The major safety function of the TRPS is to monitor variables associated with the IU during the IU filling, irradiation, and post-irradiation modes of operation and to trip the neutron driver and actuate the engineered safety features (see FSAR Table 7.4-1, TRPS Monitored Variables). This is executed by an Irradiation Unit Cell Safety Actuation signal when specified setpoints, based on analytical limits, are reached or exceeded. An IU Cell Safety Actuation signal causes a transition of the TRPS to Mode 3 operation (shutdown) which isolates the primary system boundary and the primary confinement boundary via transition of each components to their de-energized state. The parameters indicating a release of radioactive material into the primary confinement boundary are: (1) high RVZ1e IU cell radiation indicating a release of fission products; (2) high tritium purification system target chamber supply pressure; and (3) high tritium purification system target chamber exhaust pressure indicating a release from the neutron driver assembly system. If sufficient radioactive material reaches the radiation monitors in the RVZ1 exhaust duct, the ESFAS will isolate the RVZ building supply and exhaust. The TRPS also transmits status and information signals to the nonsafety-related maintenance workstation and to the PICS for display in the control room, trending, and historical purposes. In the event of a DBA that results in a release from the primary system boundary to the primary confinement boundary, confinement is achieved through the TRPS, the radiological ventilation system, and the passive confinement structures provided by the steel and concrete comprising the walls, roofs, and penetrations of the IU cell and TOGS shielded cell.

The ESFAS monitors process variables and provides automatic initiating signals in response to off-normal conditions, providing protection against unsafe conditions in the SHINE facility (see FSAR Table 7.5-1, ESFAS Monitored Variables). The ESFAS is a plant-level protection system not specific to any operating unit or process. The two major safety functions of the ESFAS are to provide: (1) sense and command functions necessary to maintain the facility confinement strategy and (2) process actuation functions as required by the safety analysis.

The actuation functions can be initiated throughout the SHINE facility via the use of radiation monitoring and other instrumentation. If at any point a monitored variable exceeds its predetermined limits, the ESFAS automatically initiates the associated safety function.

On a Safety Actuation signal from the TRPS and/or ESFAS, the primary confinement boundary isolates, the normal flow of materials passes through the mezzanine RVZ1 exhaust filter banks before being released to the environment (RVZ filtration is not safety-related and is not credited in the accident analysis). The setpoint for fission product radiation monitors for most monitored locations identified in SHINE TS Table 3.7.1-a is less than or equal to 5 times the normal background level. The setpoint limits for TS Table 3.7.1-a, item g, TPS confinement A/B/C, and item h, TPS exhaust to facility stack, for tritium are less than or equal to 927 Ci/m3 and 0.96 Ci/m3 of tritium, respectively. These setpoint provides margin to an analytical limit of 15 times the normal background level. For TS Table 3.7.1-a, item i, MEPS heating loop extraction area A/B/C, has a setpoint of less than or equal to 1,000 mR/hour. SHINE TS 3.7, Radiation Monitoring Systems and Effluents, ensures that radiation levels within the facility and radiation released to the environment are within allowable limits. Meanwhile, the redundant fail-open TSV dump valves actuate, and the target solution is gravity-fed down to the geometrically favorable TSV dump tank within the light water pool system. The TSV dump valves are provided to drain the TSV, either as part of the process prior to transferring the target solution downstream for processing within the RPF, or as a safety-related feature utilized as part of a 23

planned response in the event of an IU abnormal of accident condition. Once the target solution is in the TSV dump tank, it is passively cooled by the light water pool.

The light water pool is safety-related and serves two primary functions: shielding and cooling. It is a concrete structure lined with stainless steel designed as Seismic Category I to remain functional after the design-basis earthquake without the loss of liner integrity that could compromise its water retention capability. The pool is approximately 15 feet deep filled with approximately 19,000 gallons water. It is designed with sufficient thermal mass to provide decay heat removal capacity to cool the target solution during normal operation and abnormal events. The minimum acceptable water levels for normal operation provide adequate radiological shielding and equipment cooling for TSV operation at the licensed power limit.

These water levels are assumed for normal operation and within the analyses for loss of cooling conditions. SHINE TS 3.3, Coolant Systems, LCO 3.3.1, indicates that verification of light water pool level occurs prior to entering Mode 1 and shall be greater than or equal to 14 feet, relative to the bottom of the pool. This pool depth is consistent with the limiting physical configuration with respect to radiological dose.

Tritium Confinement Boundary The tritium confinement boundary is defined by portions of the tritium purification system (TPS).

Tritium in the IF is confined using active and passive features of the TPS. The TPS gloveboxes and secondary enclosure cleanup subsystems are credited passive confinement barriers. The TPS gloveboxes enclose TPS process equipment. The process equipment of the secondary enclosure cleanup subsystem is a credited passive confinement barrier. The TPS gloveboxes are maintained at negative pressure relative to the TPS room and have a helium atmosphere.

The TPS gloveboxes provide confinement in the event of a breach in the TPS process equipment that results in a release of tritium from the isotope separation process equipment.

The TPS gloveboxes include isolation valves on the helium supply, the glovebox pressure control exhaust, and the vacuum/impurity treatment subsystem process vents. The TPS has isolation valves on the process connections to the neutron driver assembly system target chamber supply and exhaust lines. The TPS- neutron driver assembly system interface lines themselves are part of the credited tritium confinement boundary up to the interface with the primary confinement boundary. When the isolation valves for a process line or glovebox close, the spread of radioactive material is limited to the glovebox plus the small amount between the glovebox and its isolation valves. The liquid nitrogen supply and exhaust lines and the gaseous nitrogen pneumatic lines for the TPS equipment are credited to remain intact during a DBA and the internal interface between the gloveboxes and nitrogen lines serves as a passive section of the tritium confinement boundary.

Upon detection of high TPS exhaust to facility stack tritium concentration or high TPS glovebox tritium concentration, the ESFAS automatically initiates a TPS isolation. The active components required to function to maintain the confinement barrier are transitioned to their safe de-energized state by the ESFAS.

Process Confinement Boundary The process confinement boundary includes two areas: (1) the supercell confinement, which includes the extraction, purification, and packaging hot cells and the PVVS hot cell; and, (2) the below grade confinement, which confines the process vessel ventilation system delay beds, the target solution hold, storage, and waste tanks, the pipe trench and valve pits, and the waste 24

processing tanks. Gaskets and other non-structural features are used, as necessary, to provide sealing where components meet (e.g., shield plugs and inspection ports). Each vault is equipped with a concrete cover plug fabricated in multiple sections with one or more inspection ports which allow remote inspection of the confined areas without personnel access. Each valve pit is equipped with a concrete cover plug fabricated in multiple sections with one inspection port. The pipe trench is equipped with concrete cover plugs fabricated in multiple sections with some having inspection ports. The pipe trench, vaults, and valve pits with equipment containing fissile material are equipped with drip pans and drains to the radioactive drain system. The below grade confinement is primarily passive. Most process piping that passes through the confinement boundary is entering or exiting another confinement boundary.

Process piping for auxiliary systems entering the boundary from outside confinement is provided with manual or automatic isolation capabilities. In the event of a DBA that results in a release within the process confinement boundary, radioactive material is confined primarily by the structural components of the boundary. If sufficient radioactive material reaches the radiation monitors in the RVZ1 exhaust duct, ESFAS will isolate the RVZ building supply and exhaust.

Process Vessel Vent Isolation The PVVS captures or provides holdup for radioactive particulates, iodine, and noble gases generated within the Radioisotope Production Facility and primary system boundary. The system draws air from the process vessels through a series of processing components which remove the radioactive components by condensation, acid adsorption, mechanical filtration with HEPA filters, and adsorption in carbon beds. Two sets of carbon beds are used; the guard beds located in the supercell, and the delay beds located in the carbon delay bed vault. The PVVS guard and delay beds are equipped with isolation valves that isolate the affected guard bed or group of delay beds from the system and extinguish the fire. The isolation valves also serve to prevent the release of radioactive material to the environment. The delay beds are equipped with sensors to detect fires which provide indication to ESFAS. The isolation valves close within 30 seconds of the receipt of the actuation signal. The redundancy in the beds and the ability to isolate individual beds allows the PVVS to continue to operate following an isolation.

Hydrogen gas is produced by radiolysis in the target solution during and after irradiation. During normal operation, the PVVS removes radiolytic hydrogen and radioactive gases generated within the RPF and primary system boundary. If PVVS becomes unavailable, the buildup of hydrogen gas is limited using the combustible gas management system, which uses the nitrogen purge system (N2PS), process system piping, and the PVVS to establish an inert gas flow through the process vessels.

Nitrogen Purge System The combustible gas management system uses the N2PS, primary system boundary (PSB) piping, and the PVVS to establish an inert gas flow through the IUs. One of the functions of the TOGS is to maintain PSB hydrogen concentrations below values which could result in a hydrogen explosion overpressure capable of rupturing the PSB during normal, shutdown, and initial accident conditions. For long-term hydrogen gas mitigation during and after an accident, or if TOGS is unavailable, the N2PS provides sweep gas to dilute hydrogen within the TSV headspace, TSV dump tank, and TOGS piping and maintain the hydrogen gas concentration.

Upon initiation of an IU Cell Nitrogen Purge, active components required to function to establish and maintain the N2PS flow path are transitioned to their de-energized (safe) state by the TRPS and the ESFAS.

25

Resupply of N2PS occurs within three days which is considered a safety-related maintenance activity in accordance with Section 5.5.2 of the SHINE Technical Specifications. The procedures would be performed by the SHINE emergency response organization (ERO) who are trained and qualified to perform their duties.

The SHINE ERO is described in the SHINE Emergency Plan. Members of the ERO receive training in accordance with the requirements of the plan, to include recovery actions required by the SSA. Control room operators are members of the onsite ERO and receive training on the emergency plan and emergency response actions. The directions for performing or ensuring the performance of credited administrative or personnel actions are contained within standard operating procedures performed by or under the direction of licensed operators, maintenance procedures, or emergency response procedures. The content of these procedures is controlled in accordance with Section 5.4 of the SHINE Technical Specifications.

Supercell The supercell is a set of hot cells in which isotope extraction, purification, and packaging is performed, and gaseous waste is handled. The supercell provides shielding and confinement of airborne radioactive materials during normal operation and in the event of a release. The radiological ventilation zone 1 (RVZ1) draws air through each individual confinement box, from the general RPF area, to maintain negative pressure inside the confinement, minimizing release of radiological material to the facility. Filters and carbon adsorbers on the ventilation inlets and outlets control release of radioactive material. The supercell ventilation exhaust ductwork is fitted with radiation monitoring instrumentation to detect off-normal releases to the confinement boxes. The active components required to function to maintain the confinement barrier are actuated by the ESFAS. Upon indication of a release exceeding setpoints, isolation dampers or valves on both the inlet and outlet ducts isolate the hot cells from the ventilation system.

Contaminated air is confined to the supercell by the confinement boxes, the ventilation exhaust dampers or valves, and the process isolation valves. Additionally, the actuation signal closes isolation valves on the molybdenum extraction and purification system (MEPS) heating loops and conducts a vacuum transfer system (VTS) Safety Actuation. As part of VTS Safety Actuation, connections to the supercell from the facility chemical reagent system (FCRS) skid isolate, closing the MEPS and iodine and xenon purification and packaging (IXP) supply valves.

RCA area ventilation isolations The radiological ventilation systems include supply air, recirculating, and exhaust subsystems required to condition the air and provide the confinement and isolation needed to mitigate design-basis accidents. The facility utilizes three ventilation systems in the RCA to maintain the temperature and humidity and to progress air from areas of least potential for contamination to areas with the most potential for contamination. These systems and sub-systems are as follows:

• Radiological ventilation zone 1 (RVZ1)

RVZ1 recirculating subsystem (RVZ1r)

RVZ1 exhaust subsystem (RVZ1e)

• Radiological ventilation zone 2 (RVZ2)

RVZ2 exhaust subsystem (RVZ2e)

RVZ2 supply subsystem (RVZ2s) 26

RVZ2 recirculating subsystem (RVZ2r)

• Radiological ventilation zone 3 (RVZ3)

Radiological Ventilation Zone 1 RVZ1 provides ventilation and humidity control for ventilation zone 1 within the RCA.

Subsystem RVZ1r provides cooling for systems within the IU cell and the TOGS cell. RVZ1r recirculates, filters, and cools air within the IU cell and the TOGS cell. The system includes two fan coil units and associated ductwork and dampers per each set of lU/TOGS cells. Each set of RVZ1r units is located within the cooling room and forms a portion of the confinement boundary for the lU/TOGS cells that it serves. RVZ1r provides sampling, ventilation, and cleanup connections for the primary confinement.

Subsystem RVZ1e provides exhaust air from the areas with a high potential for contamination in the facility. The air is filtered and directed out of the SHINE facility through the exhaust stack.

The subsystem includes fans, filters, ductwork, dampers, and high-efficiency filter banks. It also includes the necessary transfer ductwork to allow makeup from the RCA general area into the exhausted areas.

RVZ1e is designed to maintain ventilation zone 1 areas at a lower pressure than ventilation zone 2 areas. The design inhibits backflow with the use of backflow dampers at the discharge of the RVZ1e and RVZ2e exhaust fans in order to minimize the spread of contamination. RVZ1e ductwork provides sampling locations for radiation detectors, fire detection equipment, stack release monitoring, and an exhaust stack connection point for RVZ2e and the PVVS.

Radiological Ventilation Zone 2 RVZ2 provides ventilation and humidity control for ventilation zone 2 rooms within the RCA.

RVZ2s supplies conditioned outside air into the RCA to provide ventilation and to make up for RVZ1e and RVZ2e exhaust volumes. The system includes air handling units, filters, ductwork, and dampers. RVZ2s provides cooling, heating, humidification for all systems within ventilation zone 2 as well as maintains the quality control lab and analytical labs at positive pressure with respect to the ventilation zone 2 general area.

RVZ2r recirculates, filters, and conditions air within the RCA. The system includes AHUs, filters, ductwork, and dampers. The RVZ2r units are located within the RCA. RVZ2r provides additional cooling for systems within ventilation zone 2. RVZ2r is also used to cool air being supplied to the supercell, which reduces the flow rate required to cool the equipment within the supercell. The filters and bubble-tight dampers on the inlet side of the supercell are part of RVZ1e.

RVZ2e exhausts air from the general areas of the RCA. It provides an exhaust path for the QC lab and analytical laboratory fume hoods within the RCA and maintains the QC lab and analytical labs at positive pressure with respect to the ventilation zone 2 general area. The system is designed to maintain the RCA at a lower pressure than areas outside of the RCA. The RVZ2e design inhibits backflow within ductwork that could spread contamination. The subsystem includes fans, filters, ductwork, dampers, and high-efficiency filter banks. It also includes the necessary transfer ductwork to allow makeup from the RCA general area into the exhausted rooms. RVZ2e ductwork provides sampling locations for ESFAS radiation detectors and fire detection equipment.

27

Radiological Ventilation Zone 3 RVZ3 provides ventilation and humidity control for ventilation zone 3 rooms within the RCA.

RVZ3 transfers air from the non-radiological area ventilation zone 4 (FVZ4) to ventilation zone 3 then from ventilation zone 3 to ventilation zone 2 via engineered pathways. RVZ3 receives air from RVZ2s in the IF exit labyrinth.

During upset and accident conditions, affected sections of the RVZ1e, RVZ2s, and RVZ2e ventilation systems are isolated as required for the specific event or indication. The IU cell exhaust flow path of RVZ1e provides ventilation of the IU cell and TOGS cell via PCLS expansion tank headspace. This path is equipped with safety-related radiation monitoring instrumentation (see SHINE Technical Specifications Table 3.7, Radiation Monitoring Systems and Effluents) and redundant isolation valves (see SHINE Technical Specifications, Confinement). Between the RVZ1e IU cell radiation instrumentation and RVZ1e IU cell ventilation valves is an isolation lag tank. The isolation lag tank of the RVZ1e provides an exhaust gas delay time greater than the closing time of the valves. If radiation measurements exceed predetermined limits (15 times background), the TRPS initiates an Irradiation Unit Cell Safety Actuation, which closes the RVZ1e IU cell ventilation valves. The RVZ1e has safety-related redundant bubble-tight dampers which are situated as near to the confinement boundary as practical close in a failsafe condition (see SHINE Technical Specifications, Confinement).

Upon loss of power, loss of signal, or ESFAS initiation of confinement, dampers seal the affected confinement areas within 30 seconds.

13a.5.2.2 Radioisotope Production Facility Operations and Systems Operations within the RPF involving SNM include the uranium receipt and storage system (URSS), target solution preparation system (TSPS), the MEPS, the IXP system, the quality control and analytical testing laboratories (LABS), the target solution staging system (TSSS),

the VTS, the radioactive liquid waste storage (RLWS) system, the radioactive liquid waste immobilization (RLWI) system, and the radioactive drain system (RDS). The operations that do not involve SNM but pose a radiological or chemical hazard from radiochemical operations and operations with hazardous chemicals include the molybdenum isotope packaging system (MIPS), the PVVS, and the FCRS. Other systems in the RPF that do not have direct radiological or chemical hazards are evaluated for impact on the systems listed above.

The URSS receives, thermally oxidizes (if needed), repackages, and stores LEU prior to target solution preparation in the TSPS. The TSPS prepares low-enriched uranyl sulfate solution, which, once qualified for use, is referred to as target solution. Both the URSS and TSPS are classified as both as an operation with unirradiated SNM and as an operation with hazardous chemicals. Due to the presence of uranium, the both the URSS and TSPS poses criticality, radiological, and chemical hazards.

The MEPS separates the molybdenum from the irradiated target solution and purifies the resulting product. The extraction portion of the MEPS is an operation involving irradiated target solution processed for radioisotope extraction and contains significant quantities of uranium.

Due to the presence of uranium, the MEPS extraction process is analyzed for criticality hazards.

In addition, the extraction process involves radiological and chemical exposure hazards. The purification portion of MEPS, as well as isotope packaging operations in MIPS, are considered radiochemical operations, but pose a lesser hazard than extraction operations because these 28

processes are physically separated from the extraction operations and involve smaller quantities of radioactive material.

The IXP system separates iodine from acidic solutions and purifies the resulting product. The separation operations handle irradiated target solution processed for radioisotope extraction and contain significant quantities of uranium. Due to the presence of uranium, the IXP process has the potential for a criticality. In addition, the IXP has radiological and chemical exposure hazards.

The LABS are used to analyze samples of target solution, radioisotope products, and other process fluids. The operations in the LABS involve small amounts of SNM, radiochemicals, and hazardous chemicals. Due to the presence of uranium, the LABS are analyzed for criticality hazards. In addition, the LABS involve radiological and chemical exposure hazards.

The TSSS receives both irradiated target solution from the radioisotope extraction processes and unirradiated target solution from the TSPS. The TSSS allows for the target solution to be sampled prior to reuse or disposal, and stages target solution for transfer to the IF or the waste system. The system is categorized as irradiated target solution processed for reuse or waste disposal. Due to the presence of uranium, the TSSS has the potential for criticality as well as radiological and chemical exposure hazards.

The VTS serves as the transfer system for irradiated target solution between RPF tanks and for transfers between the RPF and the IF. The system also provides the capability to sample tank contents in the TSSS and the RLWS. The system performs operations involving irradiated target solution processed for reuse or waste disposal. Due to the presence of uranium, the VTS has the potential for a criticality as well as radiological and chemical exposure hazards.

The RLWS serves as a waste system for solutions resulting from the processing of licensed material, and target solution batches or portions thereof that will no longer be used in facility processes. The RLWS involves operations with irradiated target solution processed for waste disposal. Due to the presence of uranium, the RLWS has the potential for a criticality. In addition, this process has radiological and chemical exposure hazards.

The RLWI serves as a waste immobilization system for solutions received from the RLWS. The RLWI involves operations with irradiated target solution processed for waste disposal. Due to the presence of uranium the RLWI has the potential for criticality. In addition, this process has radiological and chemical exposure hazards.

The RDS collects leakage and overflow of process fluids, including target solution, from process tanks and vessels and from hot cells. Fluids collected in the RDS can be returned to production or transferred to the RLWS for disposal. The RDS involves operations with irradiated target solution processed for reuse or for waste disposal. Due to the presence of uranium, the RDS has the potential for criticality as well as radiological and chemical exposure hazards.

The PVVS handles the off-gas resulting from the processes of the IF and RPF. The PVVS is classified as a radiochemical operation and poses a radiological hazard. This process contains radionuclides removed from the off-gas.

29

The FCRS stores and supplies reagents to the processes of the RPF. The FCRS is classified as an operation with hazardous chemicals and poses a chemical hazard. The system contains no SNM or radionuclides.

The supercell is designed as a confinement boundary, hot cell exhaust ventilation (RVZ1) is equipped with radiation monitors (i.e., the RVZ1 supercell area 1-10 radiation monitors) that provide a signal to ESFAS to isolate the affected cell and limit the amount of target solution introduced into the cell, hot cell inlet (RVZ2) and outlet (RVZ1) ventilation ducts are equipped with ESFAS-controlled redundant isolation dampers, hot cell outlet (RVZ1) ducts are equipped with carbon filters, and ESFAS-controlled IXP extraction pump breakers, VTS vacuum transfer pump breakers, and VTS vacuum break valves are provided to limit the amount of target solution introduced into the affected hot cell.

The pipe trench and tank vault are designed as a confinement boundary. The RDS drains prevent the accumulation of target solution in the pipe trench. The RDS sump tank liquid detection sensor detects fluid in-leakage and provides a signal to ESFAS to stop any in-process transfers of solution within the facility via opening ESFAS-controlled VTS vacuum transfer pump breakers and VTS vacuum break valves. The RVZ1 and RVZ2 building exhausts are equipped with radiation monitors (i.e., the RVZ1 and RVZ2 RCA exhaust radiation monitors) that provide a signal to ESFAS to isolate the building ventilation supply and exhaust dampers on high radiation.

13a.5.3 Accident Analysis Consequence Methodology SHINE generally followed the NUREG/CR-6410 methodology to compute radiological consequences recommended in Interim Staff Guidance Augmenting (ISG) NUREG-1537, Part

1. SHINE calculation document, CALC-2018-0048, Radiological Dose Consequences, provides the Chapter 13 supporting analysis. The purpose of this document is to determine the dose consequences to a SHINE control room operator and member of the public. SHINE FSAR Section 13a2.2, Accident Analysis and Determination of Consequences, describes the methodology as a multi-step process as follows: (1) calculation of radionuclide inventories; (2) definition of the accident-specific materials-at-risk (MAR); (3) identify transport methods of radionuclides; (4) development of accident source terms; and (5) determination of radiological consequences. The NRC staff followed the NUREG/CR-6410 methodology when reviewing SHINEs Chapter 13, Accident Analysis, and supporting calculations to assess the acceptability of safety-related SSC to mitigation radiological consequences. The methodology utilizes the so-called five-factor formula to derive accident-specific source terms, A(), as follows:

A()[Ci] = ()[Ci] x x () x () x RF(i) (Equation 1) where:

STA(i) = accident-specific airborne source term for nuclide(i);

MAR(i) = material at risk for nuclide(i);

DR = damage ratio, assumed to be 1.0; ARF(i) = airborne release fraction for nuclide(i);

LPF(i) = leak-path factor for nuclide(i); and, RF = respirable fraction(i), assumed to be 1.0.

30

The MAR is the amount of hazardous material available to be acted on by a given physical stress. Depending on the magnitude and scope of the stress, the MAR may range from the total inventory of a facility to a subset of the inventory in one operation. The DR is the fraction of MAR actually impacted by a given physical stress from a specific event. The ARF is the fraction of impacted material (MAR x DR) that can be suspended to become available for airborne transport following a specific set of induced physical stresses. The RF is the fraction of the material-of-concern initially suspended in the air and present as particles that can be inhaled into the human respiratory system. The LPF is the quantitative value that expresses the fraction of initially airborne material that successfully escapes the facility. For particles, the LPF primarily depends on three parameters: the flow rate of the aerosol through the facility, the particle sizes, and the areas available for deposition of contaminants.

The SHINE analysis combines the leak-path factor, airborne release fraction, and atmospheric dispersion factors into a single receptor activity fraction (RAF) which represents the fraction of a tracer that is present in a control volume at a specific time interval.

13a.5.3.1 Radionuclide Inventories

((

))

The TSV inventory calculation includes effects from fission, transmutation, activation, and decay. There is no partitioning due to extraction between irradiation cycles. The calculation contains time steps from the start of irradiation through the end of the irradiation cycle and additional time steps that account for decay post-shutdown, as needed. This period was selected for the irradiation cycle based on the anticipated replacement period for target solution.

Most of the peak halogen and noble gas radionuclide concentrations occur at the end of the last irradiation cycle. The percent difference for all halogen and noble gas activities at their maximum compared to shutdown is less than 1 percent, except for radon-222, which is being built into the system from the uranium-238 decay chain. SHINE demonstrated a very large 31

margin between the MAR and normal operations. The applicant identified the bounding and nominal activities and maximum generation rates of iodine-131 at the end of the last irradiation cycle. SHINE explains that the net-generation rate of iodine-131 is higher in the nominal case for the last cycle because the nominal case accounts for removal of iodine (and other elements) between irradiation cycles, where the bounding case assumes there is no removal of any elements between cycles and with the large inventory in the bounding case, decay losses are comparable to generation (i.e., the system is approaching saturation). The NRC staff finds that the MAR MHA source term is about 158x higher than their calculated nominal inventory for iodine-131 which is the primary dosimetric radionuclide contributing to TEDE. The NRC staff find this source term to be conservative due to the bounding nature of the assumption used to derive it which considers longer irradiation times and not extraction between cycles.

SHINE utilized the Los Alamos National Laboratory developed code, Monte Carlo N-Particle 5 (MCNP5), version 1.60 to calculate the neutron flux spectrums and cross sections in the target solution and PCLS. To compute material information for the target solution and PCLS water, following irradiation and decay, SHINE also utilized three modules of the Oak Ridge National Laboratory code, Standardized Computer Analyses for Licensing Evaluation (SCALE), version 6.1.2; (1) COUPLE was used to generate neutron data libraries from the MCNP5 tally results for input in ORIGEN-S; ORGIN-S was used to simulate nuclide fission, transmutation, and decay; and OPUS was used to request information from other SCALE modules. The NRC staff find these computer codes to be acceptable for the purposes of developing radionuclide inventories to derive a bounding SHINE-specific MAR. The NRC staff reviewed the applicable safety-basis SHINE calculation documents which includes validation for reactivity in solution systems for the TSV and estimated neutron fluence and target solution burnup over the length of target solution recovery. The NRC staff finds SHINE utilized the codes discussed above appropriately to derive their safety basis source term, or MAR. SHINE performed an uncertainty analysis on the MAR source term using SHINE Best Estimate Neutronics Model, to evaluate the statistical errors of the MCNP Monte Carlo-calculated neutron fluence cross sections used in the ORIGEN-S to develop 95% confidence, 95th percentile upper tolerance bounds by nuclide. The modeling produced a nuclide-dependent multiplication factors ranging from approximately 0 to 35 percent increase in the nuclide inventory per nuclide. For the radionuclides which were increased, the average increase was approximately 2.5 percent, and the total estimated increase in inventory was approximately 1 percent. The NRC staff finds that the very conservative assumptions and treatment of uncertainty to justify the MAR to be acceptable.

13a.5.3.2 Accident-Specific Materials-At-Risk

((

32

))

13a.5.3.3 Radionuclide Transport Method within Confinement

((

))

Identify control volumes and leakage paths

((

33

))

Quantify scenario progression source histories

((

When present, radioactive iodine is demonstrated to be the dominant contributor to radiological dose to the worker and public. The transport of iodine species involves two main processes in order to estimate the contribution of iodine to the total dose: 1) the radiolytic conversion of iodine from I- to I2; and 2) the partitioning of I2 between the aqueous and gas phases. To derive iodine reduction factors, SHINE utilized the following model and guidance to perform this analysis:

• Iodine partitioning was calculated using equations based on the definitions found in NUREG/CR-5950, Iodine Evolution and pH Control.

34

))

Quantify leakage rates between volumes

((

))

35

Quantify removal mechanisms

((

))

Generate LPF model

((

))

13a.5.3.4 Development of Accident Source Terms

((

))

13a.5.3.5 Assessing meteorological conditions

((

36

))

13a.5.3.5 Determination of Radiological Consequences

((

))

Control Room Operator Receptor Radiological Consequence Assumptions:

((

37

))

Public Receptor Radiological Consequences Assumptions:

((

))

Total Effective Dose Equivalent:

The TEDE is defined as the sum of the effective dose equivalent for external exposures and the committed effective dose equivalent for internal exposures. Both 10 CFR Part 50, Domestic Licensing of Production and Utilization Facilities, and 10 CFR Part 20, Standards for Protection Against Radiation, refer to the dosimetry methodologies defined by the ICRP in Publication 26, Recommendations of the ICRP, and Publication 30, Limits for Intakes of Radionuclides by Workers. The ICRP 30 dosimetry methodologies are applied in:

• 10 CFR Part 50 - through the TEDE criteria (defined in §50.2) for the design, construction, and operation of the facility under normal and accident conditions.

• 10 CFR Part 20 - through the TEDE limits (defined in §20.1003) to establish standards and practices for radiation protection purposes for occupational and public health during normal operation.

Additionally, 10 CFR Part 20, Appendix B, "Annual Limits on Intake (ALIs) and Derived Air Concentrations (DACs) of Radionuclides for Occupational Exposure; Effluent Concentrations; Concentrations for Release to Sewerage, provides direction in how to determine external and internal exposures. Among other information, the appendix provides an appropriate method to 38

compute dose-based on ICRP 30 tissue weighting factors. These tissue weighing factors are directly codified by 10 CFR 20.1003, Definitions, within the table labeled, Organ Dose Weighting Factors.

Acceptable practices for computing DBA radiological consequences in terms of TEDE are to apply the exposure-to-committed effective dose equivalent coefficients for inhalation of radioactive material found in Table 2.1 of Federal Guidance Report No. 11, Limiting Values of Radionuclide Intake and Air Concentration and Dose Conversion Factors for Inhalation, Submersion, and Ingestion. The coefficients in the column headed effective yield doses corresponding to the committed effective dose equivalent. These tables are derived from the data provided in ICRP Publication 30 and have been found acceptable to the NRC staff as they meet the applicable regulatory requirements. Likewise, the exposure-to-effective dose equivalent factors for external exposure of radioactive material apply Federal Guidance Report No. 12, External Exposure to Radionuclides. Therefore, by default, compliance with the dose-related regulations of Parts 50 and Part 20 are demonstrated when applying the exposure-to-dose conversion factors of Federal Guidance Reports 11 and 12.

The NRC staff reviewed the dosimetry methodology applied by SHINE to compute radiological consequences of DBAs to be evaluated against the applicable accident dose criteria. To compute radiological consequences in compliance with 10 CFR Part 50 and Part 20, SHINE utilized the exposure-to-dose conversion factors of Federal Guidance Reports 11 and 12. The NRC staff finds this acceptable since they comply with the applicable regulations.

13a.5.4 Irradiation Facility Design-Basis Accidents SHINE identified for the IF credible design-basis accidents scenarios that range from anticipated events, such as a loss of electrical power, to events that are still credible, but considered unlikely to occur during the lifetime of the plant. For each accident scenario, SHINE identified:

• limiting initiating event, initial conditions, and boundary conditions;

• sequence of events for functions and actions that change the course of the accident or mitigate the consequences;

• damage to equipment or the facility that affects the consequences of the accident;

• potential radiation source term and radiological consequences; and,

• safety controls to prevent or mitigate the consequences of the accident.

The SHINE facility design-basis accident categories which bound creditable accident sequences are as follows, the:

• Maximum hypothetical accident (Subsection 13a2.1.1);

• Excess reactivity insertion (Subsection 13a2.1.2);

• Reduction in cooling (Subsection 13a2.1.3);

• Mishandling or malfunction of target solution (Subsection 13a2.1.4);

• Loss of offsite power (LOOP) (Subsection 13a2.1.5);

• External events (Subsection 13a2.1.6);

• Mishandling or malfunction of equipment (Subsection 13a2.1.7);

• Large undamped power oscillations (Subsection 13a2.1.8);

• Detonation and deflagration in the primary system boundary (Subsection 13a2.1.9);

39

consequences for all other categories except for the special-case tritium release DBA. The NRC staffs review of the MHA event can be found in Section 13.5.4.7 of this SER.

13a.4.2 Insertion of Excess Reactivity In SHINE FSAR Sections 13a2.1.2, and 13a2.2.2, Insertion of Excess Reactivity, the applicant examined modes of operation including the fill process, the cold target solution prior to starting the neutron driver, and irradiation operations after the neutron driver is activated. The TSV is expected to operate in a subcritical condition during all modes of operation through a combination of automatic safety systems and administrative controls, including a passive standpipe overflow system and fill rate limits. The keff is expected to be at a maximum at the end of the filling mode. The keff will be reduced during irradiation operations due to void and temperature feedback in the target solution.

The design of the subcritical assembly system, including the TSV and TSV dump tank, is designed to operate in a subcritical state without the availability of excess reactivity. As such, there are no reactivity control systems in the SHINE system. However, as applicable to the TSV, the excess reactivity insertion event during the startup process and post-irradiation mode of the TSV has been identified as a potential initiating event which can challenge the integrity of the pressure system boundary by causing increased power density, temperature, and pressure.

The insertion of excess reactivity does not result in radiological consequences.

When in Mode 1 (Startup Mode) and Mode 3 (Post-Irradiation Mode), the subcritical assembly is not being driven by the neutron driver and excess reactivity could lead to inadvertent criticality and unplanned fission power generation, temperature increase, and gas generation. When in Mode 2 (operation), the subcritical assemble is being driven by the neutron driver where excess reactivity would result in an increase in power, temperature, and gas generation.

Consistent with NUREG-1537, Part 2, the NRC staff confirmed that the credible Insertion of Excess Reactivity scenarios were categorized, and the most limiting accident in each group was chosen for detailed analyses. The scenarios are:

• Increase in the target solution density during operations (e.g., due to pressurization).

• Target solution temperature reduction during fill/startup (e.g., excessive cooldown).

• Target solution temperature reduction during irradiation (e.g., excessive cooldown).

• High reactivity and power due to high neutron production at cold conditions.

• Moderator addition due to cooling system malfunction (e.g., cooling water in-leakage).

• Additional target solution injection during fill/startup and irradiation operations.

• Realistic, adverse geometry changes.

• Reactivity insertion due to moderator lumping effects (e.g., voiding in the cooling system).

• Inadvertent introduction of other materials into the TSV (e.g., uranium solids introduction or precipitation of uranium from target solution).

• Concentration changes of the TSV target solution (e.g., through boiling or evaporation).

• Failure to control temperature during 1/M measurements at startup.

41

Consistent with NUREG-1537, Part 2, the NRC staff finds prior to the event the system was under normal operational conditions and that accident sequence started with an initiator and ended in a stabilized condition. Before the event, the irradiation unit was assumed to be operating normally under applicable technical specifications before the initiating event. When the TSV is being filled, it is filled to an approximate keff of near 1 at a cold startup temperature range of 59°F to 77°F (15°C to 25°C). During steady-state irradiation operations, the TSV is in a subcritical state with a nominal keff of slightly less than when filled. The TSV operating with the neutron driver in-service with a source strength yielding a maximum value of 125 kilowatts (kW) power within the target solution. The operating TSV maximum average temperature is below 176°F (80°C). During all modes of operations, the target solution has high negative temperature and void coefficients.

Following a TRPS signal, the TSV is designed to dump the target solution on high neutron flux level (source, wide range, and time-averaged) to protect the primary system boundary.

Additionally, the TRPS is designed to dump the TSV contents on high PCLS temperature, low PCLS temperature, and low PCLS flow. The redundant, fail-open TSV dump valves ensure target solution can be dumped and are cycled each irradiation cycle.

Consistent with NUREG-1537, Part 2, the NRC staff finds SHINE identified the most limiting scenario as Scenario 4, High Reactivity and Power Due to High Neutron Production at Cold Conditions. This scenario can occur due to excess tritium injection into the neutron driver assembly system (NDAS) during cold conditions as a result of a TPS control system or component failure during startup that injects excess tritium before the TSV is at operating temperature. This scenario can also occur if the NDAS neutron production drops to a lower flux than expected due to focusing issues, electrical arcing, or other malfunctions. This loss of neutron source during irradiation results in a decrease in void fraction and a target solution cooldown in the TSV. If the NDAS neutron production were to rapidly return to full output subsequent to a loss of void fraction and cooldown, excessive power generation could occur that could challenge target solution power density limits or primary system boundary integrity.

Consistent with NUREG-1537, Part 2, the NRC staff finds SHINE identified the sequence of events leading to an insertion of excess reactivity event. The event is initiated when the accelerator ceases to produce source neutrons because of an upset event. The TRPS detects the loss of neutron production and begins a delay time prior to initiating a TSV reactivity protection system driver dropout, which causes the NDAS high voltage power supply breakers to open, terminating the irradiation process by the accelerator. The PCLS continues to function and cool the target solution in the TSV. As the system reduces in power, voids collapse in the solution, causing a reactivity increase. After the loss of neutron production, target solution cooling results in a temperature decrease of less than 7°C. This results in a reactivity increase.

The accelerator output is restored just prior to the TRPS Driver Dropout initiating. Power increases to a level that is greater than the steady-state power before the upset occurred, with a peak power calculated. This power level would result in a TRPS IU Cell Safety Actuation on high wide range neutron flux equivalent to fission power. This limit provides margin to an analytical limit of 240% fission power (i.e., 300 kW).

Consistent with NUREG-1537, Part 2, the NRC staff confirmed SHINE identified the safety controls which protect from excessive power resulting in damage to the pressure system boundary. They are the actuation signals from the TRPS on high flux in Mode 1 and Mode 2, which are:

• Low power range neutron flux;

• TRPS Driver Dropout, resulting in redundant NDAS high voltage power supply breakers opening; 42

• Redundant high voltage power supply (HVPS) breakers on neutron driver;

• High wide range neutron flux; and

• TRPS IU Cell Safety Actuation on high wide range neutron flux.

The TRPS prevents challenges to the integrity of the pressure system boundary as no design limits are exceeded. No equipment damage results from the postulated insertion of excess reactivity event. No releases of radioactive material are expected to occur as a result of Insertion of Excess Reactivity events described above. Therefore, because no design limits are exceeded and no damage to the pressure system boundary is expected, there are no radiological consequences to the workers or the public.

The limiting reactivity insertion event has been identified and analyzed and the consequences of this event are within the dose acceptance limits and bounded by the MHA. The TSV attains a stable condition following the limiting event. Radiation doses to the public and workers are thus within acceptable limits and the safety and health of the workers and public are adequately protected.

The NRC staff reviewed the results of SHINEs insertion of excess reactivity analyses, as discussed above. The NRC staff finds that the results of the analyses demonstrate that credible insertion of excess reactivity in the IF would result in no design limits to be exceeded and no radiological consequence to the workers and public. Therefore, the NRC staff finds that the results of SHINEs insertion of reactivity analyses is acceptable.

13a.4.3 Reduction in Cooling In SHINE FSAR Sections 13a2.1.3 and 13a2.2.3, Reduction in Cooling, the applicant evaluated a reduction PLCS cooling flow. The reduction in cooling event during normal operations is identified as a potential initiating event which can challenge the operation on the subcritical assembly system.

The subcritical assembly system components evaluated with reduce cooling include the neutron multiplier, the TSV, and the TSV dump tank. These components are cooled by the PCLS and light water pool during irradiation operations to maintain target solution average temperature at 125 kW of heat generation in the TSV. The PCLS is designed to remove 170 kW. The PCLS is designed to reject heat to the radioisotope process facility cooling system, which in turn is cooled by the process chilled water system. The PCLS, radioisotope process facility cooling system, and the process chilled water system are supplied by offsite power, a loss of coolant flow occurs due to power failure and could occur due to failure of a pump, inadvertent valve closure, or a pipe break. The light water pool provides a large heat capacity for passively rejecting heat from the TSV dump tank during shutdown operations. The temperature rise in the light water pool after a specified decay heat period, assuming the pool is at its minimum allowable level, is described in SHINE FSAR Section 4a2.4.2.2.

Consistent with NUREG-1537, Part 2, the NRC staff confirmed that the credible reduction in cooling scenarios were categorized, and the most limiting accident in each group was chosen for detailed analyses. The scenarios are:

• Loss of normal power resulting in loss of PCLS and de-energized neutron driver.

• Loss of PCLS cooling due to blockage, malfunction, or operator error where the neutron driver remains operating.

43

Consistent with NUREG-1537, Part 2, the NRC staff confirmed prior to the event the system was under normal operational conditions and that accident sequence started with an initiator and ended in a stabilized condition. The initial conditions and assumptions made to evaluate the Reduction in Cooling events assume the TSV is operating normally at steady-state in Mode 2 with a thermal power being generated as 137.5 kW which is 10% above the licensed thermal power of 125 kW. The PCLS is providing greater than the minimum flow rate at a temperature less than the maximum supply temperature of 77°F. It is assumed the TSV was filled to the minimum cold fill volume at the maximize power density. The average target solution temperature is up to 175°F. Target solution decay heat is based on end-of-life target solution conditions, which generates the highest decay heat.

Consistent with NUREG-1537, Part 2, the NRC staff confirmed SHINE identified the most limiting scenario, Scenario 2, Loss of Primary Cooling Closed-Loop System Cooling, as being the most limiting scenario because the accelerator operation could continue with reduced cooling flow. This scenario postulates a loss of PCLS flow without a loss of offsite operating power, resulting in continued operation of the neutron driver at full power which continues to generate heat.

Consistent with NUREG-1537, Part 2, the NRC staff confirmed SHINE identified the sequence of events for the reduction in cooling DBA. It is initiated by a PCLS cooling flow being reduced, resulting in increased TSV temperature. A low PCLS flow or high temperature signal (77°F (25°C)) initiates a TRPS Driver Dropout, which causes the NDAS high voltage power supply breakers to open, terminating the irradiation process by the accelerator. After a 180 second delay, an IU Cell Safety Actuation is initiated, opening the redundant TSV dump valves and draining the target solution to the TSV dump tank. The light water pool is the heat sink for removal of decay heat from the target solution in the TSV dump tank.

Consistent with NUREG-1537, the NRC staff confirmed SHINE identified the safety controls to prevent a reduction in cooling event and ensure that the target solution in the TSV does not boil:

• TRPS Driver Dropout on loss of PCLS flow and high PCLS temperature.

• TRPS IU Cell Safety Actuation on low PCLS flow rate and high PCLS temperature.

• Light water pool.

• NDAS HVPS trip breakers.

• Redundant TSV dump valves.

The TRPS is designed to end the event and place the target solution in a safe shutdown condition without the need for operator action. The system prevents challenges to the integrity of the pressure system boundary as no design limits are exceeded. If the PCLS supply temperature exceeds the maximum operating limit of 77°F (25°C) or its flow rate is below the minimum operating limit, the TRPS indicates an IU Cell Safety Actuation where the target solution is transferred to the TSV dump tank and passively cooled by the light water pool. No equipment damage results from the postulated Insertion of Excess Reactivity event. No releases of radioactive material are expected to occur as a result of the reduction in cooling events described above. Therefore, because no design limits are exceeded and no damage to the pressure system boundary is expected, there are no radiological consequences to the workers or the public.

44

The NRC staff reviewed the results of SHINEs reduction of cooling event, as discussed above.

The NRC staff finds that the consequences of reduction in cooling events have been analyzed and are bounded by the MHA. Further, the NRC staff finds radiation doses to the public and workers will be within acceptable limits, and the safety and health of the workers and public will be adequately protected. Therefore, the NRC staff finds that the results of SHINEs reduction of cooling event is acceptable.

13a.4.4 Mishandling or Malfunction of Target Solution SHINE FSAR Sections 13a2.1.4 and 13a2.2.4, Mishandling or Malfunction of Target Solution, describe the IF as containing a liquid target solution that may include radioactive fission products. This accident category includes events that involve the mishandling of the target solution and the failure of the primary system boundary within the IF. The solution may be contained within the target solution hold tank, the TSV, TSV dump tank, or any of associated piping in the system.

The design of the TSV is to hold the liquid target solution which generates fission products while being normally irradiated during Mode 2 of operation. The primary system boundary which consists of the TSV, the TSV dump tank, the TOGS, and associates connected piping and piping components contain all fission products produced during irradiation. The mishandling or malfunction of target solution event during normal operations is identified as a potential initiating event which could release fission products from the irradiated target solution in the TSV, while being transferred, or in the storage area. Mishandling and malfunction of target solution events fall broadly into two categories. The first is spills or leaks that cause target solution to migrate into unintended locations. The second category is changes in the physical or chemical form of the target solution that results in adverse effects.

Consistent with NUREG-1537, Part 2, the NRC staff confirmed SHINE systematically analyzed a series of creditable scenarios of mishandling of, or malfunction involving, target solution by postulating the following scenarios as follows:

• Failure of the pressure system boundary below the level of the light water pool.

• Failure of the TSV to the PCLS pressure boundary resulting in in-leakage to the TSV.

• Failure of the radioisotope processing facility cooling system to the pressure system boundary interface.

• Failure of the TSV to PCLS pressure boundary resulting in target solution leakage to the PCLS.

• Failure in the TOGS causes high pressure in the TSV during fill mode.

• Target solution leakage into a valve pit.

Consistent with NUREG-1537, Part 2, the NRC staff finds prior to the event, the system was under normal operational conditions and that accident sequence started with an initiator and ended in a stable condition. Prior to the event, the pressure system boundary does not contain significant pressure source. Leakage between the pressure system boundary and the light water pool will normally flow from the pool to the pressure system boundary should a break occur. The primary confinement boundary isolates the primary system boundary from the rest of the facility by robust walls, ceilings, and floors. Penetrations for piping, ducts and electrical cables, and shield plugs are sealed to limit the release of radioactive materials from the facility.

Integrated leak rate from the primary confinement boundary is less than that assumed in the 45

dose analysis. The primary confinement is cooled by the RVZ1r recirculating air ventilation system. The primary confinement is ventilated to RVZ1e exhaust system through the PCLS expansion tank. The IF tanks and piping that have the potential to contain fissile material, except the TSV, are designed with passive measures that prevent an inadvertent criticality with the most reactive uranium concentration. Drains that lead from the pipe trenches and tank vaults are designed with a geometry that prevents an inadvertent criticality of the leaked target solution.

Consistent with NUREG-1537, Part 2, the NRC staff finds SHINE identified as the most limiting scenario, Scenario 1a, Failure of the PSB Resulting in Target Solution Leakage into the Light Water Pool, as being the most limiting scenario. For this scenario, a failure in the pressure system boundary below the light water pool surface is assumed to result in target solution leakage from the primary system to the light water pool. The target solution mixes with the pool water and noble gases, volatile fission products, and particulates evolve into the IU cell gas space. Some of the radionuclides would then leak through the primary confinement boundary into the building and then into the environment.

Consistent with NUREG-1537, Part 2, the NRC staff finds SHINE identified the sequence of events is initiated by a failure of the primary system boundary which leads to mixing of irradiated target solution within the IU cell light water pool. Radioactive material that enters the gas space above the light water pool is then confined by the primary confinement boundary. Gaskets and other non-structural features are used, as necessary, to provide sealing where components meet (e.g., shield plugs and inspection ports). Some radioactive material is transported into the IF through minor leakage paths around penetrations in the primary confinement boundary.

Detection of airborne radiation in RVZ1e (15x background Fission product) actuates the primary confinement boundary isolation valves and an IU trip within 20 seconds of detection (see SHINE FSAR Table 7.4.1 - TRPS Monitored Variables). A time delay is provided by the holdup volume in RVZ1e to prevent radioactive gases from exiting through RVZ1e prior to isolation. The radioactive material is then dispersed throughout the IF and exits the facility to the environment through building penetrations. Detection of high radiation in the RCA actuates ventilation dampers between the RCA and the environment and minimizes the transport of radioactive material to the environment. No operator actions are required to reach a stable condition or to mitigate dose consequences.

Following the failure of the primary system boundary, it is assumed that the materials-at-risk (MAR) are instantly well-mixed with the light water pool. Gases immediately evolve out of the pool and into the IU cell gas space. For the purposes of the accident analysis, it is assumed that the nitrogen purge system is operating and causes pressurization of the IU cell. Radiation transport is driven by pressure-driven flow between the IU cell and the IF. Reduction in the MAR occurs during the release due to adsorption of iodine onto the Irrational Unit cell walls and other surfaces until equilibrium conditions are established. The majority of the MAR is transported to the IF through primary confinement boundary leakage. Transport to the environment occurs through leakage around penetrations in the radiologically controlled area boundary.

Consistent with NUREG-1537, Part 2, the NRC staff finds SHINE identified the Scenario 1a safety controls credited for mitigation of the dose consequences for this accident are:

• primary confinement boundary;

• ventilation radiation monitors; 46

• RVZ1e IU ventilation isolation mechanisms; and,

• holdup volume in the RVZ1e.

Consistent with NUREG-1537, Part 2, the NRC staff finds SHINE identified the radiation source term being the TSV radionuclide inventory in SHINE FSAR Section 13.5.3. The entire radionuclide inventory in the TSV is deterministically assumed to be instantaneously released to the light water pool and dispersed uniformly throughout the pool. The iodine in the TSV is assumed to be fully dissolved into the target solution prior to the initiating event where none is present in the gas space of the TSV. The iodine dissolved in the pool water is partitioned according to the pool pH, temperature, and the pool and gas volumes. The pool pH is used in the radiological dose calculation bounds the minimum pool pH calculated for nominal conditions.

The minimum pool pH was calculated using the bounding low pool volume at bounding low pool pH mixed with the bounding high target solution volume at a bounding low pH.

Deposition of iodine on the walls of the IU cell due to the temperature difference of the warm gas and the cold walls is also credited as a removal mechanism. As iodine is deposited on the cell walls, more iodine is evolved from the light water pool and into the gas space. The iodine partitioning determines the transport of volatile iodine out of the pool. Some radionuclides deposited in the light water pool are released to the gas space as an aerosol when radiolytically-generated hydrogen gas bubbles burst at the pool surface. Radiolysis becomes a long-term source of both non-volatiles and iodine. Once the MAR is released into the gas space of the IU cell, there are several paths through which leakage could occur. The primary leak-path will be around the IU cell plug perimeter. As discussed in SHINE FSAR Section 13.5.3, all potential leak paths are modeled as a single leakage junction to the IF.

The applicant considered the consequences of target solution mishandling events, such as excessive leakage or spillage that could potentially initiate an unintended criticality event in an area or location where it could pose a threat to facility workers. The MHA bounds the accidental dose consequences of such postulated events. Therefore, radiological doses to the workers and the public will be within acceptable limits, and the health and safety of the staff and public will be adequately protected.

The design of the TSV is to hold the liquid target solution which generates fission products while being normally irradiated during Mode 2 of operation. The mishandling or malfunction of target solution event during normal operations is identified as a potential initiating event which could release fission products from the irradiated target solution in the TSV, while being transferred, or in the storage area. Mishandling and malfunction of target solution events fall broadly into two categories. The first is spills or leaks that cause target solution to migrate into unintended locations. The second category is changes in the physical or chemical form of the target solution that results in adverse effects.

Consistent with NUREG-1537, Part 2, the NRC staff finds SHINE systematically analyzed a series of creditable scenarios of mishandling of, or malfunction involving, target solution by postulating the following scenarios:

• Failure of the pressure system boundary below the level of the light water pool.

• Failure of the TSV to the PCLS pressure boundary resulting in in-leakage to the TSV.

• Failure of the radioisotope processing facility cooling system to the pressure system boundary interface.

47

• Failure of the TSV to PCLS pressure boundary resulting in target solution leakage to the PCLS.

• Failure in the TOGS causes high pressure in the TSV during fill mode.

• Target solution leakage into a valve pit.

Consistent with NUREG-1537, Part 2, the NRC staff finds prior to the event, the system was under normal operational conditions and that accident sequence started with an initiator and ended in a stable condition. Prior to the event, the pressure system boundary does not contain significant sources of pressure. Leakage between the pressure system boundary and the light water pool will normally flow from the pool to the pressure system boundary should a break occur. The primary confinement boundary isolates the primary system boundary from the rest of the facility by robust walls, ceilings, and floors. Penetrations for piping, ducts and electrical cables, and shield plugs are sealed to limit the release of radioactive materials from the facility.

Integrated leak rate from the primary confinement boundary is less than that assumed in the dose analysis. The primary confinement is cooled by the RVZ1r recirculating air ventilation system. The primary confinement is ventilated to RVZ1e exhaust system through the PCLS expansion tank. The IF tanks and piping that have the potential to contain fissile material, except the TSV, are designed with passive measures that prevent an inadvertent criticality with the most reactive uranium concentration. Drains that lead from the pipe trenches and tank vaults are designed with a geometry that prevents an inadvertent criticality of the leaked target solution.

Consistent with NUREG-1537, Part 2, the NRC staff confirmed SHINE identified as the most limiting scenario, Scenario 1a, Failure of the PSB Resulting in Target Solution Leakage into the Light Water Pool, as being the most limiting scenario. For this scenario, a failure in the pressure system boundary below the light water pool surface is assumed to result in target solution leakage from the primary system to the light water pool. The target solution mixes with the pool water and noble gases, volatile fission products, and particulates evolve into the IU cell gas space. Some of the radionuclides would then leak through the primary confinement boundary into the building and then into the environment.

Consistent with NUREG-1537, Part 2, the NRC staff finds SHINE identified the sequence of events is initiated by a failure of the primary system boundary which leads to mixing of irradiated target solution within the IU cell light water pool. Radioactive material that enters the gas space above the light water pool is then confined by the primary confinement boundary. Gaskets and other non-structural features are used, as necessary, to provide sealing where components meet (e.g., shield plugs and inspection ports). Some radioactive material is transported into the IF through minor leakage paths around penetrations in the primary confinement boundary.

Detection of airborne radiation in RVZ1e (15x background Fission product) actuates the primary confinement boundary isolation valves and an IU trip within 20 seconds of detection (see Table 7.4.1 - TRPS Monitored Variables). A time delay is provided by the holdup volume in RVZ1e to prevent radioactive gases from exiting through RVZ1e prior to isolation. The radioactive material is then dispersed throughout the IF and exits the facility to the environment through building penetrations. Detection of high radiation in the RCA actuates ventilation dampers between the RCA and the environment and minimizes the transport of radioactive material to the environment. No operator actions are required to reach a stable condition or to mitigate dose consequences.

Following the failure of the primary system boundary, it is assumed that the MAR is instantly well-mixed with the light water pool. Gases immediately evolve out of the pool and into the IU cell gas space. For the purposes of the accident analysis, it is assumed that the nitrogen purge 48

system is operating and causes pressurization of the IU cell. Radiation transport is driven by pressure-driven flow between the IU cell and the IF. Reduction in the MAR occurs during the release due to adsorption of iodine onto the Irrational Unit cell walls and other surfaces until equilibrium conditions are established. The majority of the MAR is transported to the IF through primary confinement boundary leakage. Transport to the environment occurs through leakage around penetrations in the radiologically controlled area boundary.

Consistent with NUREG-1537, Part 2, the NRC staff finds SHINE identified the Scenario 1a safety controls credited for mitigation of the dose consequences for this accident are:

• primary confinement boundary;

• ventilation radiation monitors;

• RVZ1e IU ventilation isolation mechanisms; and,

• holdup volume in the RVZ1e.

Consistent with NUREG-1537, Part 2, the NRC staff finds SHINE identified the radiation source term being the TSV radionuclide inventory in SHINE FSAR Section 13.5.3. The entire radionuclide inventory in the TSV is deterministically assumed to be instantaneously released to the light water pool and dispersed uniformly throughout the pool. The iodine in the TSV is assumed to be fully dissolved into the target solution prior to the initiating event where none is present in the gas space of the TSV. The iodine dissolved in the pool water is partitioned according to pool pH, temperature, and the pool and gas volumes. The pool pH used in the radiological dose calculation bounds the minimum pool pH calculated for nominal conditions.

The minimum pool pH was calculated using the bounding low pool volume at bounding low pool pH mixed with the bounding high target solution volume at a bounding low pH.

Deposition of iodine on the walls of the IU cell due to the temperature difference of the warm gas and the cold walls is also credited as a removal mechanism. As iodine is deposited on the cell walls, more iodine is evolved from the light water pool and into the gas space. The iodine partitioning determines the transport of volatile iodine out of the pool. Some radionuclides deposited in the light water pool are released to the gas space as an aerosol when radiolytically-generated hydrogen gas bubbles burst at the pool surface. Radiolysis becomes a long-term source of both non-volatiles and iodine. Once the MAR is released into the gas space of the IU cell, there are several paths through which leakage could occur. The primary leak-path will be around the IU cell plug perimeter. As discussed in SHINE FSAR Section 13.5.3, all potential leak paths are modeled as a single leakage junction to the IF.

The NRC staff reviewed the results of SHINEs mishandling or malfunction of target solution event, as discussed above. The NRC staff finds that the applicant considered the consequences of target solution mishandling events, such as excessive leakage or spillage that could potentially initiate an unintended criticality event in an area or location where it could pose a threat to facility staff. The MHA bounds the accidental dose consequences of such postulated events. The NRC staff finds that the radiological doses to the staff and the public will be within acceptable limits, and the health and safety of the staff and public will be adequately protected.

Therefore, the NRC staff finds that the results of SHINEs mishandling or malfunction of target solution is acceptable.

13a.4.5 Loss of Electrical Power 49

In SHINE FSAR Sections 13a2.1.5 and 13a2.2.5, Loss of Off-Site Power, the applicant examined a total LOOP to the facility for an extended period of time with conservative operating conditions as an event that bounds all other loss of power events in the facility. An uninterruptable power supply system (UPSS) is available to supply battery power for safety-related loads.

The LOOP event during normal operations is identified as a potential initiating event which could result in partial or complete loss of power to the facility and potentially challenge the primary system boundary in the IF. A LOOP is defined as zero voltage/power supplied by the utility, loss of a phase, phase reversal, sustained overvoltage or sustained undervoltage. When there is loss of phase, phase reversal, sustained overvoltage or sustained undervoltage, the facility automatically disconnects from the power utility.

The design of the normal electrical power supply system is as a single overall electrical power system serving the main production facility as well as the site and support buildings. The normal electrical power supply system (NPSS) for the SHINE facility consists of the normal power service entrances from the electric utility from two separate feeds and a distribution system.

Consistent with NUREG-1537, Part 2, the NRC staff confirmed SHINE systematically analyzed a series of creditable scenarios resulting from a LOOP. The analysis examined the variety of reasons related to the reliability and operation of the transmission system, stress during peak grid load conditions, severe weather effects from high wind, tornado, or ice and snowstorms, a seismic event, or equipment failure in the supplying substation. Additionally, SHINE assessed loss of power resulting from failure, or malfunction of, the facility NPSS such as the facility transformers or switchgear. It is assumed that a complete loss of offsite AC power occurs from causes that are external to the SHINE facility or common cause failures in the NPSS. A LOOP may occur during any combination of operating modes within the IF and the RPF. Postulated scenarios include the following:

1. Degradation (reliability) of the transmission system;

2. Electrical grid stress during peak load conditions;

3. Severe weather effects from high wind, tornado, ice or snowstorms;

4. Seismic event;

5. Equipment failure in the supplying substation; or

6. Failure or malfunction of facility transformers or switchgear.

Consistent with NUREG-1537, Part 2, the NRC staff confirmed SHINE identified as the most limiting scenario to be a complete LOOP. This would potentially occur due to severe weather or a seismic event that damages substation equipment or associated transmission lines. For this scenario, the initial conditions and assumptions assumed all eight TSVs are assumed to be in Mode 2 (irradiation operations) with the maximum source term and decay heat levels. The irradiation power is assumed to be 137.5 kW, 10 percent above maximum operating power.

The average target solution temperature in the TSV is at the limit of 176°F (80°C). Bulk target solution temperature in the TSV is at the limit of 176°F (80°C). The initial light water pool temperature is assumed to be 95°F (35°C). Complete loss of PCLS flow at time of initiating event. The light water pool level is assumed not less than the level specified in SHINE FSAR Section 13a2.1.5.1, which provides sufficient passive heat sink to remove decay and residual heat from the target solution. Hydrogen concentration in TSV and TOGS is maintained within operating limits prior to the event. The TOGS mainstream low flow limit, which SHINE has 50

conservatively calculated to be sufficient to maintain hydrogen concentration within the TSV headspace of less than 4.0% during normal operations. Maintaining a hydrogen concentration below a certain level prevents a deflagration that could challenge PSB integrity. The UPSS is available providing sufficient battery capacity for essential loads for their required runtime as described in FSAR Table 8a2.2-1. Resupply of N2PS occurs within three days following a LOOP which is considered a safety-related maintenance activity in accordance with Section 5.4 of the SHINE Technical Specifications. The procedures would be performed by the SHINE emergency response organization (ERO) who are trained and qualified to perform their duties.

The SHINE ERO is described in the SHINE Emergency Plan. Members of the ERO receive training in accordance with the requirements of the plan, to include recovery actions. Control room operators are members of the onsite ERO and receive training on the emergency plan and emergency response actions. The directions for performing or ensuring the performance of credited administrative or personnel actions are contained within standard operating procedures performed by or under the direction of licensed operators, maintenance procedures, or emergency response procedures. The content of these procedures is controlled in accordance with Section 5.4, Procedures, of the SHINE Technical Specifications.

Consistent with NUREG-1537, Part 2, the NRC staff confirmed SHINE assessed the sequence of events for a long-term LOOP, during normal operations, will start with the uninterruptible power supply system automatically maintaining power supply to the 125 VDC UPSS buses A and B. Each NDAS HVPS deenergizes and the associated irradiation processes is secured.

The TSV dump valves open, draining the uranyl sulfate solution in the TSVs to their respective TSV dump tanks. The PCLS loses power to its pumps and forced convection cooling ceases while heat is removed by natural convection to the light water pool. Hydrogen generation in the TSV dump tank continues to occur due to radiolysis from the decay of fission products. The TOGS blowers and recombiner heaters operate on uninterruptible power supply system power for at least 5 minutes. The blowers continue forced flow through the TOGS recombiners for a short period of time as hydrogen production levels decrease and bubbles leave the target solution. The nitrogen purge system begins passively injecting nitrogen gas into the primary system boundary. Nitrogen gas is injected in the eight subcritical assembly systems via a connection to the TSV dump tank. The gas purges the primary system boundary of hydrogen leaving through a vent connection from the TOGS to the PVVS system header. The gas then passes through the PVVS carbon delay beds which have a minimum efficiency for iodine of 99% for removal of fission product gases before release to the environment. The N2PS has enough nitrogen capacity for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, after which the system is resupplied.

For transfer operations of uranyl sulfate solution from the TSV dump tank to the RPF, the VTS operation is automatically secured. Nitrogen gas sweeps RPF process tank and lift tank headspaces to dilute radiolytic hydrogen. Nitrogen from the N2PS is routed to the PVVS carbon beds for removal of fission product gases before release to the environment.

Consistent with NUREG-1537, Part 2, the NRC staff confirmed SHINE identified the LOOP DBA safety controls credited for mitigation of the dose consequences for this accident are:

• UPSS;

• NDAS HVPS breakers;

• Nitrogen Purge Supply system;

• TSV dump valves; and,

• Light water pool.

51

The safety-related functions of the equipment supplied by the design of uninterruptible power supply system are uninterrupted; therefore, the safety-related functions continue to be performed to place the target solution in a safe shutdown condition without the need for operator action. Irradiation processes stop, and the target solution is drained from operating TSVs to their respective TSV dump tank. Decay heat is removed by natural convection to the light water pool. The combustible gas management system eliminates the risk of a release of radioactive material due to deflagration. The combined systems prevent challenges to the integrity of the pressure system boundary as no design limits are exceeded. No equipment damage results from the postulated long-term LOOP event. No releases of radioactive material are expected to occur as a result of a long-term LOOP event. Therefore, because no postulated LOOP event result in the loss of safety functions of the equipment supplied by the UPSS, no design limits are exceeded and no damage to the pressure system boundary is expected, there are no radiological consequences to the workers or the public.

The NRC staff finds that SHINEs analysis considered the effects of radiolytic decomposition of the target solution and the formation of fission gases, addressed the system response to gas formation, and evaluated the potential for the decomposed gases to react explosively. Further, the NRC staff finds that SHINEs analyses were carried out for a sufficient duration to demonstrate that the IU reaches a stable state, and that the MHA bounds the accidental dose consequences of such postulated events. Therefore, radiological doses to the workers and the public are within acceptable limits and the health and safety of the workers and public are adequately protected.

The NRC staff reviewed the results of SHINEs loss of electrical power, as discussed above.

The NRC staff finds that the results of the analyses demonstrate that credible loss of electrical power events would result in no design limits to be exceeded and no radiological consequence to the workers and public. Therefore, the NRC staff finds that the results of SHINEs loss of electrical power event is acceptable.

13a.4.6 External Events In SHINE FSAR Sections 13a2.1.6 and 13a2.2.6, External Events, the applicant has identified seismic events, tornados or high winds, and a small aircraft crash as external events that can affect the IF. The external events represent natural or man-made events that occur outside the facility and have the potential to impact facility SSCs and challenge the primary system boundary in the IF. The SHINE facility structure is designed to withstand credible external events. Most of the analyzed accidents involving credible external events are prevented by the facility structure or seismic qualification of affected SSCs. SSCs, including their foundations and supports, that are required to perform their safety function(s) in the event of a design-basis earthquake (DBE) are classified as Seismic Category I. SSCs that are co-located with a Seismic Category I SSC and required to maintain their structural integrity in the event of a DBE to prevent unacceptable interactions are classified as Seismic Category II. Seismic Category II SSCs are not required to remain functional in the event of a DBE.

Consistent with NUREG-1537, Part 2, the NRC staff confirmed SHINE systematically analyzed a series of creditable scenarios for External Events by postulating the following scenarios:

1. Several seismic event scenarios.

2. Severe weather events.

52

3. Transportation accidents, including small aircraft crash into the IF or RPF, toxic gas releases, or explosions.

4. External flooding.

5. External fires from natural sources.

Consistent with NUREG-1537, Part 2, the NRC staff confirmed prior to the event the system was under normal operational conditions and that accident sequence started with an initiator and ended in a stabilized condition. Prior to an external event occurring, the facility is assumed to be running at nominal conditions.

Consistent with NUREG-1537, Part 2, the NRC staff confirmed SHINE identified as the most limiting scenario to be Scenario 3, seismic event causing multiple neutron driver assembly system failures. This scenario may cause the failure of one or more NDAS units. A failure of the NDAS vacuum boundary within the IU would result in a release of tritium and SF6 into the IU cells. The analysis assumes the simultaneous failure of all eight NDASs to bound the maximum allowable operating state in the IF.

Consistent with NUREG-1537, Part 2, the NRC staff confirmed SHINE identified the sequence of events a seismic event causing multiple neutron driver assembly system failures during normal operations. The IU cells become slightly pressurized due to the mass of released SF6 gas. The IU and TOGS shielded cells are equipped with removable shield plugs which allow entry into the confined area. Gaskets and other non-structural features are used, as necessary, to provide sealing where separate structural components meet. Some tritium is transported into the IF through penetrations in the primary confinement boundary. Detection of high TPS target chamber supply pressure or high TPS target chamber exhaust pressure actuates the primary confinement boundary isolation valves and the IU trips within 20 seconds of detection. A sufficient time delay is provided by the holdup volume in RVZ1e to prevent radioactive gases from exiting through RVZ1e prior to isolation. Tritium migrates to the IF through the IU cell plugs and is released to the environment. Detection of high radiation in the RCA actuates ventilation dampers between the RCA and the environment and minimizes the transport of radioactive material to the environment. The primary confinement boundary and components are intact and performs their mitigation function with respect to radionuclide transport from the IU cells to the IF. Failure of the NDAS vacuum boundary does not cause subsequent damage to equipment. While the NDAS vacuum boundary integrity is not seismically qualified to maintain integrity, the NDAS is designed to maintain structural integrity during and following a DBE. After the initial IU cell pressurization has reached equilibrium, leakage between the IU cells and the IF is driven primarily by barometric breathing. The MAR includes each of the eight neutron driver assembly systems containing maximum tritium inventory of tritium gas.

Consistent with NUREG-1537, Part 2, the NRC staff confirmed SHINE identified the Scenario 3 safety controls credited for mitigation of the dose consequences for this accident are:

• Primary confinement boundary

• TPS Train Isolation on high TPS target chamber supply pressure or high TPS target chamber exhaust pressure

• Ventilation isolation mechanisms

• Holdup volume in the RVZ1e 53

The NRC staff finds that SHINEs analysis has considered potential system interactions between the IUs and the isotope production facility for External Events. The NRC staff finds that the MHA bounds the accidental dose consequences of these postulated External Event scenarios. Therefore, doses to the public and control room operator are within acceptable limits, and the health and safety of the workers and public are adequately protected.

The NRC staff reviewed the results of SHINEs external events, as discussed above. The NRC staff finds that the result of the analyses demonstrates that credible external events would result in radiological consequence to the workers and public bounded by the MHA. Therefore, the NRC staff finds that the results of SHINEs external events are acceptable.

13a.4.7 Mishandling or Malfunction of Equipment In SHINE FSAR Sections 13a2.1.7 and 13a2.2.7, Mishandling or Malfunction of Equipment, the applicant examined scenarios where mishandling of malfunction of equipment could lead to an accident where workers or the public are exposed to radiation. This includes scenarios where the PSB is not maintained. Some of those that could lead to a release of the target solution have already been examined in Section 13a2.1.4 of the FSAR. This section examines scenarios that could lead to radiation exposure including the release of radioactive gases.

SHINE has reviewed the category of DBAs which involve the mishandling or malfunction of equipment during normal operations that could challenge the primary system boundary in the IF.

Within these categories SHINE has also identified the MHA for the facility as a failure of the TSV TOGS pressure boundary resulting in a release of off-gas into the TOGS cell. This is a credible fission product-based design-basis accident which bounds the radiological consequences to the public of all credible fission product-based accident scenarios.

The mishandling or malfunction of equipment during normal operations is identified as a potential initiating event which could challenge the primary system boundary in the IF. The waste gases from irradiation of the target solution are of two major types: the hydrogen and oxygen produced by radiolysis of water in the target solution, and radioactive fission product gases. Failure of the TOGS portion of the primary system boundary could allow escape of fission product gases or hydrogen into the primary confinement boundary and the radiologically controlled area. Analysis of this event and other potential mishandling or malfunction of equipment events, excluding detonation or deflagration of hydrogen within TOGS and other exothermic chemical reactions within the primary system boundary, are included.

Consistent with NUREG-1537, Part 2, the NRC staff finds that SHINE systematically analyzed the mishandling or malfunction of equipment events within two broad categories. The first are spills or leaks that cause target solution to migrate into unintended locations. The second category is changes in the physical or chemical form of the target solution that results in adverse effects. Within this category, three specific initiating events are considered:

1. Failure of the TOGS Pressure Boundary Resulting in Release of Off-Gas into the TOGS Cell.

2. Failure of the TOGS Vacuum Tank.

3. TOGS Vacuum Makeup Valve Fails Open.

Consistent with NUREG-1537, Part 2, the NRC staff finds prior to the event the system was under normal operational conditions. Fission product gases (e.g., Kr, Xe, and halogens) 54

produced during irradiation operations are retained within TOGS until the target solution batch irradiation cycle is completed. As the TOGS circulates sweep gas during the irradiation cycle, a portion of the iodine is removed by the zeolite beds, and hydrogen and oxygen are recombined by the catalytic recombiners, but no other gases are removed or purged. Each IU is operated on an irradiation cycle of 30 days with a minimum time for target solution residing in the TSV dump tank following irradiation. The MAR for these events is conservatively taken as the inventory at shutdown, at the end of the irradiation cycle. The IUs are operated independently, so that an event on one TOGS does not affect another TOGS or IU cell. The TOGS cells are isolated from the rest of the facility by robust walls, ceiling, and floor. The physical separation of individual TOGS prevents malfunctions in one TOGS from affecting the others. Penetrations for piping, ducts, and electrical cables are sealed to limit the release of radioactive materials from the confinement boundary. The TOGS cells are cooled by a recirculating air ventilation system and are isolated from all other facility ventilation systems. A single ventilation connection from the PCLS expansion tank to the RVZ1e subsystem is provided for hydrogen gas removal from the cooling systems and is isolated on a high radiation signal in the RVZ1e ventilation duct. The primary confinement boundary is intact and performs a mitigation function with respect to radionuclide transport from the IU cell to the IF.

Consistent with NUREG-1537, Part 2, the NRC staff finds SHINE identified as the most limiting scenario, Scenario 1, Failure of the TOGS Pressure Boundary Resulting in Release of Off-Gas into the TOGS Cell, as being the most limiting scenario. Consistent with NUREG-1537, the staff confirmed SHINE identified the sequence of events where the initiating event for this scenario is a break of the TOGS line downstream of the TOGS blower and subsequent release of noble gases and iodine into the TOGS cell. The N2PS actuates and pressurizes the TOGS cell through the leak in the TOGS pressure boundary. The gases in the TOGS cell leak into the IF and then into the environment.

Consistent with NUREG-1537, Part 2, the NRC staff finds SHINE identified the safety controls for this accident to be:

• Primary confinement boundary;

• Ventilation radiation monitors;

• Nitrogen Purge System;

• Ventilation isolation mechanisms; and

• Holdup volume in the RVZ1e.

Prior to the event, iodine is assumed to be fully dissolved within the target solution vessel and none is present in the TSV gas space. The TSV inventory at the end of approximately multiple years of continuous 30-day irradiation cycles with a downtime between cycles is described in SHINE FSAR Section 13.5.3. The power level used for the analysis is 137.5 kW, which is 110 percent of design operating power.((

)) It is assumed that the iodine in solution is predominantly the volatile (I2) species, and that aqueous to gas partitioning occurs rapidly, causing 100 percent of the iodine inventory to be released to TOGS post-shutdown. ((

)) As this accident sequence analyzes the design of the gas-handling systems where non-volatiles are not included. The waste gases from irradiation of the target solution are of two major types: the hydrogen and oxygen produced by radiolysis of water in the target solution, and radioactive fission product gases. One hundred 55

percent of the noble gases and iodine present in the TOGS gas space while it is operating.

Non-volatiles are not included in this accident sequence because the system is designed as a gas-handling system.

In performing its technical and safety review, the NRC staff evaluated SHINEs accident analysis for compliance with regulations, adherence to NRC acceptable dose consequence analysis assumptions and methods as described in the above applicable regulatory codes, guides, and standards, and approved precedents. The NRC staff also performed confirmatory accident radiological dose calculations where appropriate. The NRC staff finds the SHINE SSCs important to safety are assumed to function as designed, and radioactive material is held up temporarily in the primary confinement boundary and then released from the building.

Realistic methods are used to compute external radiation doses and dose commitments resulting from inhalation by the control room operator. Realistic but conservative methods are used to compute potential doses and dose commitments to the public in the unrestricted area.

Methods of calculating doses from inhalation and direct shine of gamma rays from dispersing plumes of airborne radioactive material are acceptable. The duration of the accident considered for the calculation of radiological doses for the facility control room operator is 30 days and for the public it is 30 days.

The calculated doses for the MHA scenario are the following:

Control Room Operator - 1940 mrem (1.94 rem)

Maximum exposed member of the public - 727 mrem (0.727 rem)

These radiological doses and dose commitments are within the acceptable limit siting criteria of 1 rem TEDE and the control room operator of 5 rem TEDE.

The NRC staff reviewed the results of SHINEs mishandling or malfunction of equipment, as discussed above. Due to the assumptions of the scenario being bounding, the doses calculated will likely not be exceeded by any accident considered credible. Thus, even for the MHA, whose consequences bound all fission product-based credible accidents possible at the facility, the NRC staff finds that the health and safety of the facility workers and the public are adequately protected. Therefore, the NRC staff finds that the results of SHINEs mishandling or malfunction of equipment event is acceptable.

13a.4.8 Large Undamped Power Oscillations SHINE FSAR Sections 13a2.1.8 and 13a2.2.8, Large Undamped Power Oscillations, describe the conditions when power oscillations may occur in the TSV in response to natural fluctuations in the target solution that result in fluctuations in reactivity. The large undamped power oscillation event during normal operations is identified as a potential initiating event which could challenge the primary system boundary in the IF. Large undamped power oscillations are power oscillations that grow over time due to positive reactivity feedback effects and challenge the design limits of the subcritical assembly. The design of the TSV is a subcritical assembly which can experience power oscillations within reactivity variations within the target solution.

Also, the neutron driver output can oscillate which can lead to power variations. Therefore, the TSV is evaluated for large undamped power oscillations as a potential event that could occur during irradiation operation due to reactivity variations in the target solution that lead to fluctuations in the neutron multiplication, keff, within the irradiated target solution.

56

Consistent with NUREG-1537, Part 2, the NRC staff finds that SHINE systematically analyzed the large undamped power oscillation events by postulating the following scenarios as follows:

1. TOGS failure results in variations in TSV gas pressure.

2. Variations in the neutron driver voltage, current, tritium concentration, or other parameter results in variations in the fusion-neutron production rate.

3. Failure in the PCLS temperature control loop or radioisotope process facility cooling system supply results in temperature oscillations.

Consistent with NUREG-1537, Part 2, the NRC staff finds prior to the event the system was under normal operational conditions.

Consistent with NUREG-1537, Part 2, the NRC staff confirmed SHINE identified the safety controls for mitigation of the dose consequences for this accident are:

• The design and safety characteristics of the TSV to resist undamped power oscillations;

• IU Cell Safety Actuation initiated by TRPS;

• TRPS high neutron flux trips; and

• TSV dump valves and TSV dump tank.

The negative temperature and void coefficients are within license limits. The TRPS neutron flux setpoints are within technical specification limits. During startup, irradiation, and shutdown operations, TOGS regulates gas pressures in the primary system boundary to maintain pressures within the acceptable range. Increased gas pressures in the TSV reduce void fraction, leading to positive reactivity addition. Excessive TSV power oscillations from TOGS pressure oscillations are prevented by redundant TRPS high neutron flux IU Cell Safety Actuation signals. The neutron driver has variability in neutron production rates due to normal variations in beam current and focusing, voltages, and tritium gas concentrations. These variations lead to corresponding variations in fission power in the subcritical assembly system.

The TRPS high wide range neutron flux IU Cell Safety Actuation signal prevents excessive TSV power oscillations that challenge design limits should the neutron driver return to full power rapidly following a reduced power transient. The PCLS provides cooling water to the TSV, and therefore, temperature variations in the primary closed-loop cooling system directly lead to TSV temperature variations. Primary closed-loop cooling system provides constant cooling water inlet temperature to the TSV. The TRPS high neutron flux IU Cell Safety Actuation signals prevent excessive TSV power oscillations from PCLS temperature variations. There are no large, undamped power oscillations that result from PCLS operation.

Consistent with NUREG-1537, Part 2, the NRC staff finds SHINE demonstrated that power oscillations that occur are self-limiting as a result of the inherent design and safety characteristics associated with the TSV, operating parameters, and plant response to transients.

SHINEs analysis identified that these large undamped oscillation scenarios do not results in damage to the primary system boundary. Large power oscillations that could potentially challenge design limits are prevented by TRPS setpoints on high neutron flux. No operator actions are required to damp power oscillations. When a TRPS high neutron flux setpoint is exceeded, the neutron driver is automatically de-energized, the TSV dump tank valves automatically open, and the target solution is dumped, by force of gravity, into the favorable geometry TSV dump tanks. Therefore, power oscillations that occur in the subcritical assembly are self-limiting as a result of the inherent design and safety characteristics of the subcritical assembly, operating parameters, and plant response to transients.

57

The TRPS is designed to end the event and place the target solution in a safe shutdown condition without the need for operator action. The TRPS prevents challenges to the integrity of the pressure system boundary as no design limits are exceeded. No equipment damage results from the postulated undamped power oscillations event. No releases of radioactive material are expected to occur as a result of undamped power oscillations events described above.

Therefore, because no design limits are exceeded and no damage to the pressure system boundary is expected, there are no radiological consequences to the workers or the public.

The NRC staff reviewed the results of SHINEs large undamped power oscillations, as discussed above. The NRC staff finds that the applicant has evaluated the potential for large undamped power oscillations and demonstrated that these oscillations can be readily detected and suppressed so that the TSV reaches a stable state. The applicant considered the potential for positive feedback to arise due to system interaction. The NRC staff finds that the power oscillations should be stable or can be readily detected and suppressed so that the consequences are bounded by the MHA. The NRC staff finds that radiological doses to the staff and the public are within acceptable limits and the health and safety of the facility workers and public are adequately protected. Therefore, the NRC staff finds that the results of SHINEs large undamped power oscillations event is acceptable.

13a.4.9 Detonation and Deflagration In SHINE FSAR Sections 13a2.1.9 and 13a2.2.9, Detonation and Deflagration in Primary System Boundary, the applicant analyzed the effects of a possible hydrogen detonation or deflagration within the primary system boundary on the IF. Irradiating the target solution produces significant quantities of hydrogen and oxygen through radiolysis and small amounts of fission product gases. The TOGS is designed to control the level of hydrogen and oxygen so that a deflagration or detonation does not occur. The hydrogen and oxygen are recombined, condensed, and returned as water to the TSV by the TOGS.

The detonation and deflagration in the primary system boundary event during normal operations is identified by SHINE as a potential initiating event which could challenge the primary system boundary in the IF. Irradiation of the target solution produces significant quantities of hydrogen and oxygen and small quantities of fission products.

The design of the TOGS is the primary control for mitigating hazards associated with the evolved gases. Functional requirements for the TOGS include maintaining the concentration of hydrogen to less than the lower flammability limit, recombining the hydrogen and oxygen, and returning the recombined water back to the TSV. The TOGS functions largely as a closed-loop during the irradiation process, with gas additions and removals as needed to maintain proper functioning. The TOGS is purged as needed to the PVVS via the VTS.

Consistent with NUREG-1537, Part 2, the NRC staff finds that SHINE analyzed credible detonation and deflagration in the primary system boundary and categorized into postulated scenarios as follows:

1. Target Solution Off-gas System Failure Resulting in Hydrogen Deflagration; and,

2. Primary Closed-Loop Cooling System Radiolysis Resulting in Hydrogen Deflagration.

58

Consistent with NUREG-1537, Part 2, the NRC staff confirmed prior to the event the system was under normal operational conditions. A hydrogen deflagration produces a maximum overpressure condition of 65 pounds per square inch absolute (psia). Each TSV is serviced by a dedicated and independent TOGS. For this event, it is assumed a single TOGS fails, allowing hydrogen to accumulate in the TSV and TSV dump tank. The target solution is at steady-state conditions at 110 percent of the licensed power limit when the TOGS failure occurs. This is conservative since it implies the maximum hydrogen generation rate in the target solution.

Consistent with NUREG-1537, Part 2, the NRC staff finds SHINE identified as the most limiting scenario, Scenario 1, failure of the target solution off-gas system resulting in hydrogen deflagration, as being the most limiting scenario. A TOGS failure may occur due to flow blockage or failure of the TOGS blowers, loss of sweep gas flow to the TSV dump tank or overfilling the TSV that causes a reduction of available headspace and sweep gas flow. The loss of TOGS functionality allows the hydrogen gas concentration to increase in the headspace in the TSV and/or TSV dump tank. The hydrogen gas may ignite and cause a deflagration in the PSB.

Consistent with NUREG-1537, Part 2, the NRC staff finds SHINE identified the sequence of events for a failure of the target solution off-gas system resulting in hydrogen deflagration, during normal operations, will start with a single TOGS blower to fail. This will result in a complete loss of flow through the affected train and total loss of TSV dump tank flow. The other single TOGS continues to operate normally. The TRPS detects the loss of flow and executes an IU Cell Safety Actuation and IU cell N2PS actuates. The IU Cell Safety Actuation opens the TSV dump valves and NDAS HVPS breakers, terminating the irradiation process. Hydrogen generation in the TSV and TSV dump tank continues due to radiolysis caused by delayed fission and decay radiation. Hydrogen evolution from solution occurs at an increased rate as solution voids collapse. Within four seconds, N2PS is at full flow to the dump tank. Hydrogen and other gases are vented to PVVS through the combustible gas management system exhaust point. Gases pass through the PVVS carbon guard and carbon delay beds before being exhausted from the building at the safety-related exhaust point. The remaining TOGS blower continues operation for a minimum of five minutes. The combined action of the remaining TOGS blower and N2PS maintains the peak hydrogen concentration as described in the FSAR, therefore, the peak pressure will not exceed the design pressure of the primary system boundary if a deflagration occurs, and no radiological materials will be released. Detonations cannot occur because this peak concentration is less than the lower detonation limit. As delayed fission and decay of short-lived radionuclides decline, the production and evolution of hydrogen declines following shutdown and draining of the TSV to the TSV dump tank. The N2PS continues to provide sweep gas diluting and removing any remaining hydrogen for a period of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. Resupply of N2PS is considered a safety-related maintenance activity in accordance with Section 5.5.2 of the SHINE Technical Specifications. The procedures would be performed by the SHINE ERO who are trained and qualified to perform their duties.

The SHINE ERO is described in the SHINE Emergency Plan. Members of the ERO receive training in accordance with the requirements of the plan, to include recovery actions required by the SSA. Control room operators are members of the onsite ERO and receive training on the emergency plan and emergency response actions. The directions for performing or ensuring the performance of credited administrative or personnel actions are contained within standard operating procedures performed by or under the direction of licensed operators, maintenance procedures, or emergency response procedures. The content of these procedures is controlled in accordance with Section 5.4 of the SHINE Technical Specifications.

59

The safety controls credited for mitigation of the dose consequences for this accident are:

• TOGS capable of maintaining hydrogen concentration within design limits, assuming the worst case single active failure following IU trip;

• TOGS low-flow trips (TRPS function);

• TOGS oxygen sensor which detect incipient degradation or failure;

• TOGS demister high temperature trips (TRPS function), which detect incipient degradation or failure N2PS;

• TSV fill line isolation valves mode-permissive interlock;

• TSV overflow lines to the TSV dump tank;

• TSV dump tank level sensors (TRPS function);

• TSV dump tank low-flow sensors (TRPS function);

• TSV target solution dump on dump tank level sensors (TRPS function);

• PCLS expansion tank flame arrestor;

• Nitrogen Purge System;

• Radiation detection in RVZ1e exit from PCLS expansion tank; and

• Isolation valves in RVZ1e exit from PCLS expansion tank.

The system prevents challenges to the integrity of the pressure system boundary as no design limits are exceeded. If hydrogen deflagration occurs at the peak calculated concentration, the primary system boundary remains intact. Damage to other primary system components internal to TOGS in the affected train may occur; however, such damage will not result in any release of radiological material. No releases of radioactive material are expected to occur as a result of a detonation and deflagration in the primary system boundary events described above.

Therefore, because no design limits are exceeded and no damage to the pressure system boundary is expected, there are no radiological consequences to the workers or the public.

The NRC staff reviewed the results of SHINEs detonation and deflagration in primary system boundary, as discussed above. The NRC staff finds that the applicant has evaluated the consequences of potential deflagration or detonation of combustible gases within the primary boundary. Further, the NRC staff finds that the assumptions regarding the impact of potential explosions on primary boundary integrity are valid. The NRC staff finds that the MHA bounds the consequences of the limiting credible detonation within the primary boundary. The NRC staff finds that the radiological doses to the workers and public are within acceptable limits, and the health and safety of the workers and public are adequately protected. Therefore, the NRC staff finds that the results of SHINEs detonation and deflagration in primary system boundary event is acceptable.

13a.4.10 Unintended Exothermic Chemical Reactions Other Than Explosion As described in SHINE FSAR Sections 13a2.1.10 and 13a2.2.10, Unintended Exothermic Chemical Reactions Other than Detonation, there is no potential for the target solution to undergo any significant exothermic chemical reactions. The unintended exothermic chemical reactions other than detonation event during normal operations is identified as a potential initiating event which could challenge the primary system boundary in the IF. In the FSAR, SHINE examines safety aspects of exothermic chemical reactions that challenge the primary system boundary integrity in the IF, other than hydrogen deflagrations or detonations.

60

Consistent with NUREG-1537, Part 2, the NRC staff finds that SHINE identified credible unintended exothermic chemical reactions other than the detonation scenarios. Specifically, SHINE systematically analyzed the uranium metal-water reaction in the neutron multiplier assembly event which breaches the neutron multiplier cladding allowing water to come into direct contact with the natural uranium metal. Possible causes include corrosion of the neutron multiplier cladding, uranium metal-cladding interaction due to radiation-induced growth, or other mechanical damage incurred during maintenance. The breach may occur at any time during the lifecycle of the neutron multiplier allowing water intrusion over an extended period of time.

Consistent with NUREG-1537, Part 2, the NRC staff finds prior to the event the system was under normal operational conditions. The PCLS provides cooling to the TSV and the neutron multiplier and transfers gases produced from radiolysis to the expansion tank. The neutron multiplier radionuclide inventory is developed assuming 30 years of continuous operation at 137.5 kW which is 10% above the operating license.

Consistent with NUREG-1537, Part 2, the NRC staff finds SHINE identified as the most limiting scenario, Scenario 1, Uranium Metal-Water Reaction in the Neutron Multiplier Assembly, as being the most limiting scenario where a small breach of the neutron multiplier cladding allows PCLS water into the cladding. The water intrusion results in an exothermic uranium metal-water reaction in the neutron multiplier assembly. The reaction generates hydrogen gas inside the neutron multiplier cladding shell. An accumulation of hydrogen gas could result in a deflagration under certain conditions. These conditions include sufficient oxygen concentration, an ignition source, or autoignition temperatures being reached. In this scenario, the hydrogen produced is prevented from potential deflagration by using certain materials within the neutron multiplier.

Hydrogen gas that migrates into the PCLS stream from the neutron multiplier leak accumulates in the expansion tank, which is vented to the RVZ1e.

Consistent with NUREG-1537, Part 2, the NRC staff finds SHINE identified the sequence of events, following the cladding breech, to results in an exothermic uranium metal-water reaction, generating hydrogen. The presence of certain material in the neutron multiplier inhibits a potential deflagration. Small amounts of hydrogen gas migrate into the PCLS and travel to the PCLS expansion tank, along with hydrogen normally generated in primary closed-loop cooling system itself via radiolysis. The expansion tank is vented to RVZ1e to prevent hydrogen accumulation in that tank. Small amounts of fission products from the multiplier migrate into the PCLS water. The presence of fission products in excess of normal operating levels is detected via in-line radiation monitoring installed in the exhaust of the PCLS expansion tank.

Consistent with NUREG-1537, Part 2, the NRC staff finds SHINE identified the safety controls for mitigation of the dose consequences for this accident to be the design of the neutron multiplier which inhibits deflagration control.

Consistent with NUREG-1537, Part 2, the NRC staff finds SHINE evaluated the consequences of potential unintended exothermic chemical reactions (other than explosions) that could occur within the primary boundary. As a precursor to this event, an excess of gases could accumulate in the primary boundary and subsequently react with oxygen to release heat. The heat could increase pressure within the primary boundary or induce thermal stress on the primary boundary.

The NRC staff reviewed the results of SHINEs unintended exothermic chemical reactions other than detonation, as discussed above. The NRC staff finds that the applicant identified the types of possible exothermic reactions and assessed the relative consequences. The NRC staff finds 61

that the MHA bounds the consequences of the limiting unintended exothermic chemical reaction within the primary boundary. The NRC staff finds radiological doses to the staff and public are within acceptable limits, and the health and safety of the staff and public are adequately protected. Therefore, the NRC staff finds that the results of SHINEs unintended exothermic chemical reactions other than detonation event is acceptable.

13a.4.11 Primary System Boundary System Interaction Events As described in SHINE FSAR Sections 13a2.1.11 and 13a2.2.11, System Interaction Events, the applicant considered events that could result from system interactions within the IF and interactions between the IF and RPF. The system interaction events normal operations have been identified as potential initiating events which could challenge the primary system boundary in the IF. SHINE identified three categories of system interactions between systems located within the IF and the RPF are considered in this analysis. Consistent with NUREG-1537, Part 2, the NRC staff confirmed that the credible system interaction events were categorized as follows:

1. Functional Interactions;

a. loss of offsite power,

b. reduction of cooling,

c. loss of ventilation,

i. loss of normal ventilation to the IU or TOGS, and ii. loss or normal ventilation to primary cooling rooms.

2. Spatial Interactions;

a. fires,

b. exothermic chemical reaction,

c. internal flooding,

d. dynamic effects, and

3. Human-Intervention Interactions.

SHINE defines Functional Interactions to be interactions between systems or subsystems that result from a common interface. A functional interaction exists if the operation of one system can affect the performance of another system or subsystem. An adverse functional interaction exists when the operation and/or performance of an (initiating) system adversely affects the operation and/or performance of an SSC as it performs its safety-related function. Functional interaction events are those that may result from failures in support systems or other shared systems that could result in an adverse impact on the primary system boundary.

SHINE defines Spatial Interactions to be interactions resulting from the presence of two or more systems in a location. Spatial interactions include a single event that could impact the operation of the adjacent systems, or the failure of one system that may impact the operation of another system.

SHINE defines Human-Intervention interactions to be adverse system interactions caused by human errors in the RPF which can cause adverse system performance in the subcritical assembly during irradiation operations.

Many of the system interaction events discussed in this section of the SHINE FSAR have already been analyzed in other parts of Chapter 13 and referenced accordingly. Two system 62

interactions that are not described in other subsections are the normal ventilation to the IU and TOGS which are:

1. loss of normal ventilation to the IU or TOGS

2. loss or normal ventilation to primary cooling rooms Consistent with NUREG-1537, Part 2, the NRC staff finds SHINE identified the sequence of events for the loss of normal ventilation to the IU or TOGS, a failure of RVZ1 may be caused by failure of a blower or cooler, including loss of cooling water. It may also be caused by a failed-shut or mispositioned damper or other equipment failure. A loss of cooling may cause instrumentation inaccuracies or failures which may lead to TOGS maloperation or loss of function. This can result in a potential deflagration and release of radiological material. The protections in place to prevent a TOGS failure due to loss of ventilation are redundant and environmentally qualified TOGS instrumentation (e.g., low-flow) that initiates a TRPS signal if TOGS failures are detected. The TRPS signal opens redundant TSV dump valves draining target solution to the TOGS dump tank and shuts down the IU. Decay heat from the target solution is removed by the light water pool.

Consistent with NUREG-1537, Part 2, the NRC staff finds SHINE identified the sequence of events for the loss or normal ventilation to primary cooling rooms, a failure of RVZ2 may be caused by failure of a blower or cooler, including loss of cooling water. Loss of ventilation to individual primary cooling rooms may also be caused by a failed-shut or mispositioned damper.

A failure of normal ventilation may lead to increased environmental temperatures within the primary cooling room with potential for increased instrument inaccuracies or failure. The consequences of an RVZ2 failure leading to equipment malfunction result in TSV overcooling causing a reactivity insertion in the TSV which is discussed in the excess reactivity insertion event section.

Consistent with NUREG-1537, Part 2, the NRC staff finds SHINE identified the safety controls in place to prevent TSV malfunctions related to ventilation failures are redundant low- and high PCLS temperature trip that initiates a TRPS signal. The TRPS signal opens redundant TSV dump valves draining target solution to the TSV dump tank and shuts down the IU. Decay heat from the target solution is removed by the light water pool system.

There are no unique initial conditions or assumptions associated with system interaction events.

Based on the preventive controls the failure of normal ventilation does not have radiological consequences, and no further analysis is necessary.

The NRC staff reviewed the results of SHINEs unintended exothermic chemical reactions other than detonation, as discussed above. The NRC staff finds that the applicants analysis has considered potential system interactions between the IF and the RPF. Further, the NRC staff finds that the MHA bounds the accidental dose consequences of these postulated events. The NRC staff finds radiological doses to the workers and the public are within acceptable limits, and the health and safety of the workers and public are adequately protected. Therefore, the NRC staff finds that the results of SHINEs unintended exothermic chemical reactions other than detonation event is acceptable.

13a.4.12 Facility-Specific Events 63

SHINE has identified facility-specific events during normal operations which could challenge the primary system boundary in the IF. Facility-specific accident scenarios are associated with the neutron driver assembly system, the TPS, and potential damage resulting from heavy load drops.

Consistent with NUREG-1537, Part 2, the NRC staff finds that the credible facility-specific events were categorized as follows:

• NDAS Events:

1. Inadvertent exposure to neutrons within the IU;

2. Inadvertent exposure to neutrons within the NSC;

3. Catastrophic failure of the NDAS; and

4. NDAS vacuum boundary failure.

• TPS Events:

1. Tritium Purification System piping failure due to deflagration;

2. Release of tritium into the IF due to glovebox deflagration;

3. Release of tritium to the facility stack;

4. Excessive release of tritium from the tritium storage bed;

5. Release of tritium into the IF due to tritium purification system-NDAS interface line mechanical damage.

• Heavy Load Drop Events:

1. Heavy load drop into an open IU cell

2. Heavy load drop onto an in-service IU cell

3. Heavy load drop onto TPS equipment Consistent with NUREG-1537, Part 2, the NRC staff finds prior to the event the system was under normal operational conditions for accident scenarios involving the NDAS. The NDAS contains the bounding inventory of tritium gas for full power. The NDAS pressure vessel contains the maximum inventory of sulfur hexafluoride (SF6) gas. The primary confinement boundary for an affected IU cell is operable, including the RVZ1e radiation detection and isolation valves.

Consistent with NUREG-1537, Part 2, the NRC staff finds prior to the event the system was under normal operational conditions for accident scenarios involving the TPS. The TPS glovebox confinement is operable, including the confinement isolation valves. The glovebox has a helium atmosphere. Automatic isolation valves are installed in the system to isolate sections of the system to minimize system release. Leakage of tritium from the glovebox enclosure or the external piping is detected by the continuous airborne monitoring system or other leakage detection systems to provide alarms for facility personnel evacuation. The TPS/NDAS interface lines contain the maximum inventory of tritium gas.

Consistent with NUREG-1537, Part 2, the NRC staff finds prior to the event the system was under normal operational conditions for accident scenarios involving heavy load drops. An IU cell is in maintenance when either the IU cell shielding plug is removed, TSV and neutron diver assembly system is empty, or an IU cell is in-service with the IU cell shielding plug in place.

64

Consistent with NUREG-1537, Part 2, the NRC staff finds that most evaluated facility-specific events do not have radiological consequences. The events which do have radiological consequences are related to the release of tritium into the facility from the neutron driver assemblies or from the TPS. Consistent with NUREG-1537, Part 2, the NRC staff confirmed SHINE identified as the most limiting scenario, to be the tritium production system scenario, Scenario 1, TPS Piping Failure Due to Deflagration, as being the most limiting event in terms of radiological consequence to the public.

Consistent with NUREG-1537, Part 2, the NRC staff finds SHINE identified the sequence of events being initiated initiating event is a vacuum boundary component failure in the NDAS, which instantaneously releases tritium and SF6 gas into the IU cell. The IU cell becomes slightly pressurized due to the mass of released SF6 gas. Tritium is transported into the IF through penetrations in the confinement boundary. Detection of high TPS target chamber supply pressure or high TPS target chamber exhaust pressure actuates the primary confinement boundary isolation valves and an IU trip within 20 seconds of detection. A time delay is provided by the holdup volume in RVZ1e to prevent radioactive gases from exiting through RVZ1e prior to isolation. Tritium migrates to the IF through penetrations in the primary confinement boundary and is released to the environment. Detection of high radiation in the RCA actuates ventilation dampers between the RCA and the environment and minimizes the transport of radioactive material to the environment. Personal dosimeters, local radiation alarms, and alarms in the facility control room notify facility personnel of radiation leakage.

Consistent with NUREG-1537, Part 2, the NRC staff confirmed SHINE identified the safety controls for mitigation of the dose consequences for this accident are:

• Primary confinement boundary (IU cell plugs and seals)

• TPS Train Isolation on high TPS target chamber supply pressure or high TPS target chamber exhaust pressure

• IU cell ventilation isolations

• Holdup volume in the RVZ1e; and

• Emergency Procedures.

In addition, TPS glovebox deflagration is prevented by the use of helium in the TPS glovebox gas space and it being designed with a minimum volume to prevents deflagration conditions.

The NRC staff reviewed the results of SHINEs facility-specific events, as discussed above. The NRC staff finds that the applicants analysis has considered potential system interactions between the IU and the RPF. Further, the NRC staff finds that the MHA bounds the accidental dose consequences of these postulated events. The NRC staff finds the radiological doses to the workers and the public are within acceptable limits, and the health and safety of the workers and public are adequately protected. Therefore, the NRC staff finds that the results of SHINEs facility-specific events are acceptable.

13a.5 Review Findings The NRC staff reviewed the descriptions and discussions of the final SHINE IF accident analysis, as described in SHINE FSAR Section 13a2, as supplemented, against the applicable regulatory requirements and using appropriate regulatory guidance and acceptance criteria.

65

Based on its review of the information in the FSAR and independent confirmatory review, as appropriate, the NRC staff determined that:

(1) SHINE described the accident analysis of the IF and identified the major features or components incorporated therein for the protection of the health and safety of the public.

(2) The processes to be performed, the operating procedures, the facility and equipment, the use of the facility, and other TSs provide reasonable assurance that the applicant will comply with the regulations in 10 CFR Part 50 and 10 CFR Part 20 and that the health and safety of the public will be protected.

(3) The issuance of an operating license for the facility would not be inimical to the common defense and security or to the health and safety of the public.

Based on the above determinations, the NRC staff finds that the descriptions and discussions of the final SHINE IF accident analysis are sufficient and meet the applicable regulatory requirements and guidance and acceptance criteria for the issuance of an operating license.

66

13b Radioisotope Production Facility Accident Analysis SER Section 13b, Radioisotope Production Facility Accident Analysis, provides an evaluation of the final accident analysis of SHINEs RPF as presented in SHINE FSAR Section 13b, Radioisotope Production Facility Accident Analyses, within which SHINE describes accident-initiating events and scenarios, as well as the accident analysis and determination of consequences.

13b.1 Areas of Review The NRC staff reviewed SHINE FSAR Section 13b against applicable regulatory requirements, using appropriate regulatory guidance and acceptance criteria, to assess the sufficiency of the final RPF accident analysis. The final RPF accident analysis was evaluated to ensure that the accident analysis is presented in sufficient detail to allow a clear understanding of the facility and that the facility can be operated for its intended purpose and within regulatory limits for ensuring the health and safety of the operating staff and the public. SSCs were also evaluated to ensure that they would adequately provide for the prevention of accidents and the mitigation of consequences of accidents. The staff considered the final analysis and evaluation of the design and performance of the SSCs of the SHINE facility, including those SSCs shared by both the IF and RPF, with the objective of assessing the risk to public health and safety resulting from the operation of the facility.

13b.2 Summary of Application SHINE FSAR Section 13b identifies and describes the postulated initiating events and credible accidents that form the design basis for the RPF. The FSAR also describes the accident analysis and determination of consequences for the SHINE RPF. The FSAR provides details on event categories covering the MHA and credible accidents related to the RPF, which are loss of electrical power, external events, RPF critical equipment malfunction, RPF inadvertent nuclear criticality, RPF fire, and analyses of accidents with hazardous chemicals.

13b.3 Regulatory Requirements and Guidance and Acceptance Criteria The NRC staff reviewed SHINE FSAR Section 13b against the applicable regulatory requirements, using appropriate regulatory guidance and acceptance criteria, to assess the sufficiency of the final accident analysis for the issuance of an operating license.

13b.3.1 Applicable Regulatory Requirements The applicable regulatory requirements for the evaluation of SHINEs RPF accident analysis are as follows:

10 CFR 50.34, Contents of applications; technical information, paragraph (b), Final safety analysis report.

10 CFR 50.40, Common Standards.

10 CFR 50.57, Issuance of operating license.

67

13b.3.2 Applicable Regulatory Guidance and Acceptance Criteria In determining the regulatory guidance and acceptance criteria to apply, the NRC staff used its technical judgment, as the available guidance and acceptance criteria were typically developed for nuclear reactors. Given the similarities between the SHINE facility and non-power research reactors, the staff determined to use the following regulatory guidance and acceptance criteria:

NUREG-1537, Part 1, Guidelines for Preparing and Reviewing Applications for the Licensing of Non-Power Reactors, Format and Content, issued February 1996.

NUREG-1537, Part 2, Guidelines for Preparing and Reviewing Applications for the Licensing of Non-Power Reactors, Standard Review Plan and Acceptance Criteria, issued February 1996.

Final Interim Staff Guidance Augmenting NUREG-1537, Part 1, Guidelines for Preparing and Reviewing Applications for the Licensing of Non-Power Reactors: Format and Content, for Licensing Radioisotope Production Facilities and Aqueous Homogeneous Reactors, dated October 17, 2012.

Final Interim Staff Guidance Augmenting NUREG-1537, Part 2, Guidelines for Preparing and Reviewing Applications for the Licensing of Non-Power Reactors:

Standard Review Plan and Acceptance Criteria, for Licensing Radioisotope Production Facilities and Aqueous Homogeneous Reactors, dated October 17, 2012.

As stated in the ISG augmenting NUREG-1537, the NRC staff determined that certain guidance originally developed for heterogeneous non-power research and test reactors is applicable to aqueous homogenous facilities and production facilities. SHINE used this guidance to inform the design of its facility and to prepare its FSAR. The staffs use of reactor-based guidance in its evaluation of the SHINE FSAR is consistent with the ISG augmenting NUREG-1537.

As appropriate, the NRC staff used additional guidance (e.g., NRC regulatory guides, IEEE standards, ANSI/ANS standards, etc.) in the review of the SHINE FSAR. The additional guidance was used based on the technical judgment of the reviewer, as well as references in NUREG1537, Parts 1 and 2; the ISG augmenting NUREG-1537, Parts 1 and 2; and the SHINE FSAR. Additional guidance documents used to evaluate the SHINE FSAR are provided as references in Appendix B, References, of this SER.

13b.4 Review Procedures, Technical Evaluation, and Evaluation Findings The NRC staff performed a review of the technical information presented in SHINE FSAR Section 13b, as supplemented, to assess the sufficiency of the final SHINE RPF accident analysis for the issuance of an operating license. The sufficiency of the final accident analysis is determined by ensuring that it meets applicable regulatory requirements, guidance, and acceptance criteria, as discussed in Section 13b.3, Applicable Regulatory Guidance and Acceptance Criteria, of this SER. The results of this technical evaluation are summarized in SER Section 13b.5, Review Findings.

13b.4.1 Accident Initiating Events 68

SHINE identified RPF credible design-basis accidents scenarios that range from anticipated events, such as a loss of electrical power, to events that, while still credible, are considered unlikely to occur during the lifetime of the facility. Within the RPF, irradiated target solution is processed for radioisotope extraction and purification. Other processes occurring within the RPF include target solution processes for reuse, waste handling, and product packaging.

SHINE performed the accident analysis of the RPF using the same methodology as the accident analysis in the IF described in Section 13.5.3 of this SER.

Process that are conducted in the RPF fall into the following categories:

• Operations with SNM; Irradiated target solution processed for radioisotope extraction, Irradiated target solution processed for reuse or for waste disposal, and Operations with unirradiated SNM.

• Radiochemical operations; and

• Operations with hazardous chemicals.

The RPF DBA categories which bound creditable accident sequences are as follows:

• MHA (FSAR Section 13b.1.2.1);

• Loss of Electrical Power (FSAR Section13b.1.2.2);

• External Events (FSAR Section 13b.1.2.3);

• Critical Equipment Malfunction (i.e., Malfunction or Mishandling of Equipment) (FSAR Section 13b.1.2.4);

• Inadvertent Nuclear Criticality in the RPF (FSAR Section 13b.1.2.5);

• RPF Fire (FSAR Section 13b.1.2.6); and

• Hazardous Chemical Accidents (FSAR Section 13b.1.2.7).

Table 13-5 lists DBA TEDE results for siting criteria and control room operator.

13b.4.3 Maximum Hypothetical Accident SHINE has identified the MHA as the failure of the TSV TOGS pressure boundary resulting in a release of off-gas into the TOGS cell within the IF. This is a credible fission product-based DBA which bounds the radiological consequences to the public of all credible fission product-based accident scenarios. The NRC staffs review of this event can be found in Section 13a.4.7 of this SER.

13b.4.4 Loss of Normal Electric Power SHINE FSAR Section 13b.2.2, Loss of Electrical Power, describes that the loss of offsite power (LOOP) was evaluated in the accident analysis as an initiating event for a number of critical equipment malfunction scenarios. A facility-wide LOOP results in automatic actuation of multiple facility engineered safety features, which act to ensure the risk associated with radiological or chemical releases is reduced to within acceptable limits. The facility-wide LOOP does not result in system or component failures within the RPF that result in unacceptable radiological or chemical consequences. The facility-wide LOOP is further discussed in Section 13a.4.5 of this SER.

69

13b.4.5 External Events In SHINE FSAR Section 13b.2.3, External Events, the applicant has identified seismic events, severe weather, flooding, and external fires as external events that can affect the RPF. The external events represent natural or man-made events that occur outside the facility and have the potential to impact facility SSCs and challenge the primary system boundary in the IF. The SHINE facility structure is designed to withstand credible External Events. Most of the analyzed accidents involving credible External Events are prevented by the facility structure or seismic qualification of affected SSCs. SSCs, including their foundations and supports, that are required to perform their safety function(s) in the event of a DBE are classified as Seismic Category I. SSCs that are co-located with a Seismic Category I SSC and required to maintain their structural integrity in the event of a DBE to prevent unacceptable interactions are classified as Seismic Category II. Seismic Category II SSCs are not required to remain functional in the event of a design-basis event. The facility-wide External Events are further discussed in Section 13a.4.6 of this SER.

13b.4.6 Mishandling or Malfunction of Equipment SHINE FSAR Section 13b.2.4, RPF Critical Equipment Malfunction, presents the evaluation of a malfunction or mishandling of equipment that leads to a loss of control of radiological material within the RPF. Two types of solutions are present in the supercell, irradiated target solution and product eluate solutions. Spills of these solution are analyzed to determine their radiological consequences. Multiple scenarios were identified as having potential radiological consequences and were selected for additional evaluation.

The identified scenarios are:

• Scenario 1 - Spill of Target Solution in the Supercell (MEPS Column Misalignment)

• Scenario 2 - Spill of Target Solution in the Supercell (MEPS Over pressurization)

• Scenario 3 - Spill of Molybdenum Eluate Solution in the Supercell (Overfill or Drop of Rotovap Flask)

• Scenario 4 - Spill of Target Solution in the Supercell (IXP Column Misalignment)

• Scenario 5 - Spill of Target Solution in the Supercell (IXP Over pressurization)

• Scenario 6 - Spill of Target Solution in the Supercell (Liquid Nitrogen Leak in IXP Hot Cell)

• Scenario 7 - Spill of Iodine Solution in the Supercell (Overfill or Drop of Iodine Solution Bottle)

• Scenario 8 - Spill of Target Solution in the Pipe Trench from a Single Pipe

• Scenario 9 - Spill of Target Solution in the Pipe Trench from Multiple Pipes

• Scenario 10 - Spill of Target Solution in a Tank Vault (Hold Tank Leak or Rupture)

• Scenario 11 - Spill of Target Solution in a Tank Vault (Hold Tank Deflagration)

• Scenario 12 - Spill of Target Solution in a Tank Vault (Seismic Event)

• Scenario 13 - Spill of Molybdenum Eluate in the Supercell (Deflagration)

• Scenario 14 - Target Solution Leaking out of the Supercell (MEPS Preheater Tube Leak)

• Scenario 15 - Extraction Column Three-Way Valve Misalignment

• Scenario 16 - Spill of Target Solution in a Valve Pit (Pipe Rupture or Leak)

• Scenario 17 - Spill of Radioactive Liquid Waste in the RLWI Shielded Enclosure.

70

• Scenario 18 - Heavy Load Drop onto RLWI Shielded Enclosure or Supercell.

• Scenario 19 - Heavy Load Drop onto a Tank Vault or Pipe Trench Cover Block Consistent with NUREG-1537, Part 2, the NRC staff finds SHINE identified as the most limiting scenario, Scenario 17, Spill of Radioactive Liquid Waste in the RLWI Shielded Enclosure, where the event is caused by the immobilization feed tank or RLWI system piping containing waste solution to break and leak within the RLWI enclosure.

Consistent with NUREG-1537, Part 2, the NRC staff finds that prior to the events the system was under normal operational conditions. A 380-liter batch of waste solution (diluted target solution) is present in the RLWI system immobilization feed tank at the time of the initiating event. The volume of solution in this scenario is based on the volume of the immobilization feed tank with a conservative scaling factor to account for the highest allowable concentration of radionuclides. The waste solution has been irradiated using the assumptions in SHINE FSAR Section 13a2.2 and has been held for decay for 35 days post-shutdown. The post-shutdown hold time is based on the minimum hold time needed to reduce waste activity to within dose consequence limits and establishes an administrative control.

Consistent with NUREG-1537, Part 2, the NRC staff finds SHINE identified the safety controls as follows:

• Waste solution holdup times in the RLWS system before processing in RLWI;

• Concentration controls applied to waste solutions;

• Heavy load drop controls; and

• Facility personnel evacuate the immediate area within 10 minutes after receipt of electronic dosimeter or local radiation alarms Consistent with NUREG-1537, Part 2, the NRC staff finds that SHINE applied a conservative MAR for this scenario is 380 liters of waste solution at 35 days post-shutdown. The concentration of radionuclides for the waste solution is determined by multiplication of the ratio of the maximum uranium concentration permitted in the RLWI system to the nominal uranium concentration of target solution. The action of the TOGS during the period when the original target solution was held in the dump tank removes more than 67 percent of the iodine present in the solution at shutdown. It is assumed that 35 percent of the post-shutdown iodine inventory is released to the RLWI enclosure during the accident.

The NRC staff reviewed the results of SHINEs RPF critical equipment malfunction, as discussed above. The NRC staff finds that SHINEs analysis has considered potential critical equipment malfunction within the RPF. Further, the NRC staff finds that the MHA bounds the accidental dose consequences of these postulated events. The NRC staff finds that the radiological doses to the workers and the public are within acceptable limits, and the health and safety of the workers and public are adequately protected. Therefore, the NRC staff finds that the results of SHINEs RPF critical equipment malfunction event is acceptable.

13b.4.7 Inadvertent Nuclear Criticality in the Radioisotope Production Facility In SHINE FSAR Section 13b.2.5, RPF Inadvertent Nuclear Criticality, SHINE evaluated inadvertent nuclear criticality events in the accident analysis using the same methodology as non-criticality accidents. Nuclear criticality safety is achieved through the use of preventative 71

controls throughout the RPF, which reduces the likelihood of a criticality accident to highly unlikely. Further discussion of the criticality safety bases for RPF processes is included in SHINE FSAR Section 6b.3 and the NRC staffs review in Section 6b.4.3 of this SER.

13b.4.8 Radioisotope Production Facility Fire As described in SHINE FSAR Section 13b.2.6, RPF Fire, SHINE evaluated fires within the RPF for internal fire risks based on the fire hazards analysis (FHA). The FHA documents the facility fire areas, with each area individually evaluated for fire risks. Internal facility fires are generally evaluated as an initiating event for the release of radioactive material.

Consistent with NUREG-1537, Part 2, the NRC staff finds that SHINE analyzed credible fire events and categorized them into two scenarios as follows:

• PVVS Carbon Delay Bed Fire; and

• PVVS Carbon Guard Bed.

Consistent with NUREG-1537, Part 2, the NRC staff finds that SHINE identified as the most limiting scenario, Scenario 2, PVVS Carbon Guard Bed.

Consistent with NUREG-1537, the NRC staff finds that prior to the event the system was under normal operational conditions. The PVVS is operating normally, with nominal flow through a carbon guard bed. The affected carbon guard bed contains iodine from RPF process streams.

Consistent with NUREG-1537, Part 2, the NRC staff finds SHINE identified the sequence of events where an upset or malfunction in the PVVS results in high moisture or high temperature flow through the carbon guard bed. The high moisture or high temperature results in ignition of the carbon guard bed absorber material. The ignition of the carbon guard bed results in an exothermic release of stored radioactive material to the PVVS downstream of the guard bed.

Radioactive material is captured by the downstream carbon delay bed and filtered. It is assumed one percent of the released radioactive material is released through PVVS and the facility stack to the environment.

Consistent with NUREG-1537, Part 2, the staff finds that SHINE identified the safety controls is PVVS delay bed filtration.

The NRC staff reviewed the results of SHINEs RPF fire, as discussed above. The NRC staff finds that SHINEs analysis has considered potential RPF fires. Further, the NRC staff finds that the MHA bounds the accidental dose consequences of these postulated events. The NRC staff finds that radiological doses to the staff and the public are within acceptable limits, and the health and safety of the staff and public are adequately protected. Therefore, the NRC staff finds that the results of SHINEs RPF fire event is acceptable.

13b.4.9 Analyses of Accidents with Hazardous Chemicals Produced from Licensed Material The staff evaluated the sufficiency of the analysis of accidents with hazardous chemicals produced from licensed material, as described in SHINE FSAR Section 13b.3, Analyses of Accidents with Hazardous Chemicals, in part, by reviewing the chemical process description, chemical accidents description and consequences estimates using the guidance and 72

acceptance criteria from Section 13b.2, Chemical Process Safety for the Radioisotope Processing Facility, of the ISG augmenting NUREG-1537, Parts 1 and 2.

SHINE has proposed safety criteria in SHINE FSAR Section 3.1 of the FSAR that include requirements for chemical safety for both individuals outside the controlled area (i.e., public) as well as facility workers. The NRC staff chemical safety review focused primarily on potential accident sequences involving chemical hazards that could impact the public.

Potential chemical exposure scenarios in the RPF were identified and evaluated by SHINE to assess chemical hazards and necessary controls. The evaluation used the limited inventories of chemicals used in the main production facility as identified in Table 13b.3-1 of the SHINE FSAR.

The NRC staff reviewed the SHINE hazard identification and analysis methodology discussed in SHINE FSAR Section 13a2. The methodology includes consideration of chemical hazards.

The methodology considers all modes of operation for potential process upsets and accident sequences. SHINEs implementation of the methodology leads to the identification of safety-related controls that are relied on to limit or prevent potential accidents or mitigate their consequences. It also identifies programmatic administrative controls that ensure the availability and reliability of identified safety systems.

The NRC staff also reviewed the SHINE implementation of the accident analysis methodology as it relates to the identification and analysis of chemical hazards. The more detailed identification and analysis of chemical hazards is documented in the SHINE SSA summary.

The consequences of accidents involving hazards are presented in CALC-2018-0049, Rev 4, Chemical Dose Analysis for Hypothetical Accidents in the SHINE Medical Production Facility.

The SHINE analysis concluded that all offsite chemical exposures consequences were limited (i.e., concentrations less than protective action criteria (PAC)-1) and that only a few chemical accidents would result in RCA workers being exposures to chemical concentrations greater than PAC-1 but less than PAC-2 levels. SHINE FSAR Table 13b.3-2, Hazardous Chemical Source Terms and Concentration Levels, identifies the hazardous chemicals, release location, source term, and concentrations to the control room operator and at the site boundary.

The NRC staff reviewed the chemical accident scenarios identified in the SHINE FSAR and supporting safety analysis document and found them to be reasonable and consistent with facility description, chemical process description and process equipment information presented in the SHINE FSAR about the RPF facility and the various RPF processes. The NRC staff notes the limited quantities of process chemicals, the small volume of process vessels and the shielded cells that contain the irradiated material processing operations.

The NRC staff also reviewed information about the consequences of accident scenarios involving the release of hazardous chemicals. The consequences are a function of the amount of material released, the release rate and dilution/dispersion of the hazardous chemical as it moves from the release point to the point of contact with the receptor.

The NRC staff reviewed the methods SHINE used to estimate release quantities and the concentrations of hazardous chemicals to offsite receptors for the postulated accident sequences. The NRC staff finds that the methods are consistent with guidance provided in NUREG/CR-6410 which is recommended in the ISG augmenting NUREG-1537, Part 1.

Independent calculations by the NRC staff confirmed the concentrations presented by SHINE for site boundary and offsite receptors and support the SHINE conclusion that the chemical 73

hazards to off-site personnel from RPF operations are minimal. The staff noted that this same general conclusion about limited potential impact to the public was made by NRC staff for the Cintichem facility which recovered Mo-99 from irradiated material and was previously licensed by NRC. (Inspection Report 70-687/87-04). This conclusion is also consistent with an environmental analysis conducted by DOE when it evaluated the environmental impact of Mo-99 production and recovery at DOE facilities (DOE/EIS-0249F, Medical Isotopes Projection Project: Molybdenum-99 and Related Isotopes, April 1996).

In addition to reviewing the consequences of chemical accidents to offsite individuals, the NRC staff reviewed the SHINE method for predicting concentrations of hazardous chemicals to RCA workers. The SHINE method assumes instantaneous release and mixing of the hazardous material into the RCA room volume. The actual release will occur over some time and so the predicted concentrations are higher than what will occur during the release period. In addition, worker evacuation is generally expected and so the actual exposure duration will be less than the 1-hour period associated with the PAC-2 concentrations used in the analysis. The staff finds that there is reasonable assurance actual RCA worker exposure to hazardous materials will be below PAC-2 levels for 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> and exposure will not exceed the chemical exposure criteria identified in Section 3.1 of the FSAR (i.e., concentrations that would present the potential for irreversible or other serious, long-lasting health effects to a worker).

The NRC staff also reviewed the method used to predict the concentration of hazardous material in the control room. The general scenario identified in the SHINE analysis involves the release of a chemical from a rollup door which is on the eastern edge (right side) of the south side of the SHINE facility. The SHINE analysis assumes the chemical released from the rollup door would be diluted as it moves to the ventilation intakes which are at a higher elevation than the rollup door and to the left of the door.

The transport of material from a release point on the right side of the southern face of the building to an intake point that is higher and near the center of the same side of the building involves complex flow processes that are influenced by many factors including wind speed and direction and the position of the release point and intake locations.

SHINE used the ALOHA (Areal Locations of Hazardous Atmospheres) code to predict control room concentrations. The ALOHA code does not specifically model the flow arrangement described in the SHINE accident sequence. SHINE describes the flow arrangement as a release and intake on a common wall. The SHINE ALOHA analysis assumed Gaussian dispersion over the short distance and used an ALOHA feature that calculates an indoor air concentration in a downwind building based on an assumed building air change rate.

The NRC staff analyzed the meteorological transport processes to gain insight into any conservatism in the SHINE ALOHA analysis for control room workers. In order to evaluate the reasonableness of the control room concentrations calculated by SHINE using the ALOHA code, the staff compared the /Q value used in the SHINE ALOHA analysis with other /Q values developed by SHINE using NRC guidance specifically intended for control room habitability analysis. The NRC staff reviewed the SHINE ALOHA results presented in CALC-2018-0049, Chemical Dose Analysis for Hypothetical Accidents in the SHINE Medical Production Facility. The staff found that the ALOHA analysis used a /Q value of around 3 sec/m3. This was compared to the /Q that SHINE developed in a separate calculation performed to support control room habitability analysis (CALC-2020-0018, Atmospheric Dispersion for Control Room Habitability Calculations). This separate analysis considered a southeasterly wind given the relative location of the rollup door and the ventilation intake 74

structures and used the ARCON96 code to estimate the /Q for transport from the rollup door to the ventilation intake structure. ((

)) The staff reviewed this SHINE ARCON96 analysis and finds it to be conservative.

The staff compared the ARCON96 /Q values developed by SHINE with other near-field /Q reported such as DOE reviews of models and methods for developing a /Q for workers at 100 meters. This review identified a conservative /Q of 3.5x10-3 for a collocated worker at 100 meters. The DOE analysis (Technical Report for Calculation of Atmospheric Dispersion at Onsite Locations for Department of Energy Nuclear Facilities, NSRD-2015-TD01) also examined different methods for estimating /Q at 100 meters including those in ARCON96 and ALOHA and found the recommended default value of 3.5 x 10-3 sec/m3 to be conservative when there was a building wake. The NRC staff also reviewed a report prepared by the Center for Nuclear Waste Regulatory Analysis (Summary of Near-Field Methods for Atmospheric Release Modeling, ADAMS Accession No. ML072500257). This report also examined different models for estimating /Q are short distances. The most conservative /Q identified in this analysis for F stability class and 1 m/sec wind speed was about 5 x 10-2 sec/m3 if there was no building and 9 x 10-3 sec/m3 if there was a building. The /Q from the analysis using the ARCON code was about 6 x 10-4 sec/m3 assuming there was a building.

The NRC staff finds that the SHINE ARCON96 (( )) to be appropriate and conservative because it considers winds from the southeast and takes into consideration the effects of the building which contains both the release point and the intake point. It is also consistent with other analysis of dispersion over short distances with building turbulence effects. Because the SHINE ALOHA analysis uses a higher /Q value, the NRC staff determined that the SHINE ALOHA dispersion analysis to be conservative by a factor of about 200 (3/1.4 x 10-2 sec/m3).

The NRC staff also reviewed the effect of the air exchange rate used in the ALOHA analysis which was assumed to be 1.2 air exchanges per hour. The SHINE ALOHA analysis predicted indoor (i.e., control room) concentrations that were reduced by up to a factor of 50 when compared to the outdoor concentration predicted in the ALOHA analysis. ((

)) The higher exchange rate means that there will be less reduction of the indoor air concentration compared to the outdoor concentration that was calculated in the SHINE ALOHA analysis.

To understand the effect of this higher air exchange rate, the staff performed an independent ALOHA analysis. The staff repeated the SHINE ALOHA analysis for nitric acid and produced results that were consistent with the SHINE analysis for the air exchange rate of 1.2. When the staff repeated the analysis with the higher air exchange rate, the NRC staffs predicted indoor air concentration was essentially the same as the outdoor air concentration. The staff determined that the SHINE ALOHA analysis used a non-conservative air exchange rate when estimating control room concentrations following chemical releases. However, the staff finds that the non-conservatism in this parameter is offset by the conservatism in the /Q value.

75

The NRC staffs review of the SHINE estimate of control room concentration concluded that the SHINE estimates of control room concentrations were conservative because of the ALOHA dilution/dispersion analysis (/Q ) was conservative and compensated for the non-conservative estimate of air exchange rate for the SHINE control room. Based on its review, the staff expects the design will meet the design criteria identified in SHINE FSAR Section 3.1 when considering the chemical exposure of control room operators.

The NRC staff also reviewed the chemical process safety controls identified in the SHINE FSAR (page 13b.3-4). The confinement barrier controls are of a general nature that lack the specificity of the controls identified in the SSA.

The NRC staff finds that the SHINE safety analysis identified and analyzed chemical hazards against its design criteria related to public health and safety which are presented in SHINE FSAR Section 3.1. The staffs review and independent analysis led the staff con conclude there was reasonable assure the design will meet the requirements of 10 CFR 50.40 for protection of public health and safety from process chemical hazards.

The NRC staff review of the analysis of consequence for hazardous chemical events to site workers, both those in the control room and those in the RPF, as discussed above. The NRC staff finds there is reasonable assurance the design will meet the design criteria SHINE established for worker chemical safety in SHINE FSAR Section 3.1 and that worker and public health and safety are protected. Therefore, the NRC staff finds that the results of SHINEs hazardous chemical accidents are acceptable.

13b.4.10 Proposed Technical Specifications In accordance with 10 CFR 50.34(a)(1), the NRC staff evaluated the sufficiency of the applicants proposed technical specifications for the SHINE facility.

The proposed TS 5.5.8, Table 2.2, Chemical Control, for SHINE Facility states the following:

The SHINE chemical control program ensures that on-site chemicals are stored and used appropriately to prevent undue risk to workers and the facility. The chemical control program implements the following activities, as required by the accident analysis:

1. Control of chemical quantities permitted in designated areas and processes;

2. Chemical labeling, storage and handling; and

3. Laboratory safe practices.

TS 5.5.8 requires that the chemical control program implement controls on chemical quantities, labeling, storage and handling, and safe laboratory practices. The NRC staff finds that the implementation of these controls will help manage the chemical process thereby minimizing the possibility of a significant chemical release and ensuring public health and safety. Therefore, the staff finds that TS 5.5.8 is acceptable.

13b.5 Review Findings The NRC staff reviewed the descriptions and discussions of the final SHINE RPF accident analysis, as described in SHINE FSAR Section 13b, as supplemented, against the applicable regulatory requirements and using appropriate regulatory guidance and acceptance criteria.

76

Based on its review of the information in the FSAR and independent confirmatory review, as appropriate, the NRC staff determined that:

(1) SHINE described the accident analysis of the RPF and identified the major features or components incorporated therein for the protection of the health and safety of the public.

(2) The processes to be performed, the operating procedures, the facility and equipment, the use of the facility, and other TSs provide reasonable assurance that the applicant will comply with the regulations in 10 CFR Part 50 and 10 CFR Part 20 and that the health and safety of the public will be protected.

(3) The issuance of an operating license for the facility would not be inimical to the common defense and security or to the health and safety of the public.

Based on the above determinations, the NRC staff finds that the descriptions and discussions of the final SHINE RPF accident analysis are sufficient and meet the applicable regulatory requirements and guidance and acceptance criteria for the issuance of an operating license.

77