ML22314A271

Safety Evaluation Report for Shine Technologies, LLC Operating License Application - Chapter 13

ML22314A271
Person / Time
Site:	SHINE Medical Technologies
Issue date:	11/10/2022
From:	Michael Balazik NRC/NRR/DANU/UNPL
To:	Piefer G SHINE Technologies
References
Download: ML22314A271 (80)

Text

13-1 ACCIDENT ANALYSIS The accident analysis shows that the health and safety of the public and workers are protected, potential radiological and non-radiological consequences have been considered in the event of malfunctions, and the SHINE Medical Technologies, LLC (SHINE, the applicant) facility is capable of accommodating disturbances in the functioning of structures, systems, and components (SSCs). Additionally, the accident analysis demonstrates that the SHINE facility design features, safety limits, limiting safety system settings, and limiting conditions for operation (LCOs) have been selected to ensure that no credible accident could lead to unacceptable radiological consequences to people or the environment.

The accidents analyzed range from anticipated events such as a loss of normal electrical power to a postulated fission product release with radiological consequences that exceed those of any accident considered to be credible. This limiting accident is named the maximum hypothetical accident (MHA). Because the MHA is not expected to occur, the scenario need not be entirely credible. The initiating event and the scenario details need not be analyzed, but the potential consequences should be analyzed and evaluated.

The accident analysis establishes safety limits for SHINE facility operations and provides a technical basis for control of those limits through technical specifications (TSs).

This chapter of the SHINE operating license application safety evaluation report (SER) describes the review and evaluation by the U.S. Nuclear Regulatory Commission (NRC, the Commission) staff of the final accident analysis of the SHINE irradiation facility (IF) and radioisotope production facility (RPF) (together, the SHINE facility), as presented in chapter 13, Accident Analysis, of the SHINE final safety analysis report (FSAR) and supplemented by the applicants responses to staff requests for additional information (RAIs).

13a Irradiation Facility Accident Analysis SER section 13a, Irradiation Facility Accident Analysis, provides an evaluation of the final accident analysis of SHINEs IF as presented in SHINE FSAR section 13a2, Irradiation Facility Accident Analysis, within which SHINE described accident-initiating events and scenarios, as well as the accident analysis and determination of consequences.

13a.1 Areas of Review The NRC staff reviewed SHINE FSAR section 13a2 against applicable regulatory requirements, using appropriate regulatory guidance and acceptance criteria, to assess the sufficiency of the final IF accident analysis. The final IF accident analysis was evaluated to ensure that the analysis is presented in sufficient detail to allow a clear understanding of the facility and that the facility can be operated for its intended purpose and within regulatory limits for ensuring the health and safety of the operating staff and the public. SSCs were also evaluated to ensure that they would adequately provide for the prevention of accidents and for the mitigation of consequences of accidents. The staff considered the final analysis and evaluation of the design and performance of the SSCs of the SHINE facility, including those SSCs shared by both the IF and RPF, with the objective of assessing the risk to public health and safety resulting from the operation of the facility.

13-2 13a.2 Summary of Application SHINE FSAR section 13a2 identifies and describes the postulated initiating events and credible accidents that form the design basis for the SHINE IF. The FSAR also describes the accident analysis and determination of consequences for the IF. The FSAR provides details on event categories covering the MHA and credible accidents related to the IF, which are insertion of excess reactivity, reduction in cooling, mishandling or malfunction of target solution, loss of off-site power, external events, mishandling or malfunction of equipment, large undamped power oscillations, detonation and deflagration in the primary system boundary, unintended exothermic chemical reactions other than detonation, system interaction events, and facility-specific events.

13a.3 Regulatory Requirements and Guidance and Acceptance Criteria The NRC staff reviewed SHINE FSAR section 13a2 against the applicable regulatory requirements, using appropriate regulatory guidance and acceptance criteria, to assess the sufficiency of the final IF accident analysis for the issuance of an operating license.

13a.3.1 Applicable Regulatory Requirements The applicable regulatory requirements for the evaluation of SHINEs IF accident analysis are as follows:

Title 10 of the Code of Federal Regulations (10 CFR) section 50.34, Contents of applications; technical information, paragraph (b), Final safety analysis report 10 CFR 50.40, Common Standards 10 CFR 50.57, Issuance of operating license 10 CFR Part 20, Standards for Protection Against Radiation 10 CFR 70.61, Performance requirements 13a.3.2 Applicable Regulatory Guidance and Acceptance Criteria In determining the regulatory guidance and acceptance criteria to apply, the NRC staff used its technical judgment, as the available guidance and acceptance criteria were typically developed for nuclear reactors. Given the similarities between the SHINE facility and non-power research reactors, the staff determined to use the following regulatory guidance and acceptance criteria:

NUREG-1537, Part 1, Guidelines for Preparing and Reviewing Applications for the Licensing of Non-Power Reactors, Format and Content, issued February 1996.

NUREG-1537, Part 2, Guidelines for Preparing and Reviewing Applications for the Licensing of Non-Power Reactors, Standard Review Plan and Acceptance Criteria, issued February 1996.

13-3 Final Interim Staff Guidance Augmenting NUREG-1537, Part 1, Guidelines for Preparing and Reviewing Applications for the Licensing of Non-Power Reactors: Format and Content, for Licensing Radioisotope Production Facilities and Aqueous Homogeneous Reactors, dated October 17, 2012.

Final Interim Staff Guidance Augmenting NUREG-1537, Part 2, Guidelines for Preparing and Reviewing Applications for the Licensing of Non-Power Reactors: Standard Review Plan and Acceptance Criteria, for Licensing Radioisotope Production Facilities and Aqueous Homogeneous Reactors, dated October 17, 2012.

NUREG-1520, Revision 2, Standard Review Plan for Fuel Cycle Facilities License Applications, issued June 2015.

As stated in the interim staff guidance (ISG) augmenting NUREG-1537, the NRC staff determined that certain guidance originally developed for heterogeneous non-power research and test reactors is applicable to aqueous homogenous facilities and production facilities.

SHINE used this guidance to inform the design of its facility and to prepare its FSAR. The staffs use of reactor-based guidance in its evaluation of the SHINE FSAR is consistent with the ISG augmenting NUREG-1537.

As appropriate, the NRC staff used additional guidance (e.g., NRC regulatory guides, Institute of Electrical and Electronics Engineers (IEEE) standards, American National Standards Institute/American Nuclear Society (ANSI/ANS) standards, etc.) in the review of the SHINE FSAR. The additional guidance was used based on the technical judgment of the reviewer, as well as references in NUREG1537, Parts 1 and 2; the ISG augmenting NUREG-1537, Parts 1 and 2; and the SHINE FSAR. Additional guidance documents used to evaluate the SHINE FSAR are provided as references in Appendix B, References, of this SER.

13a.4 Review Procedures, Technical Evaluation, and Evaluation Findings The NRC staff performed a review of the technical information presented in SHINE FSAR section 13a2, as supplemented, to assess the sufficiency of the final SHINE IF accident analysis for the issuance of an operating license. The sufficiency of the final accident analysis is determined by ensuring that it meets applicable regulatory requirements, guidance, and acceptance criteria, as discussed in section 13a.3, Applicable Regulatory Guidance and Acceptance Criteria, of this SER. The results of this technical evaluation are summarized in section 13a.5, Review Findings, of this SER.

The review covered the methodology for analyzing the systems and operating characteristics of the SHINE facility that could affect its safe operation or shutdown. It includes the identification of limiting accidents within each design-basis accident (DBA) category, an analyses of accident progression, and evaluation of the radiological and chemical exposure consequences. For each accident category, a review of its effects on designed barriers, protective systems, operator responses, and mitigating features were examined. The analysis of potential radiological consequences to the public, the facility control room operators and staff, and the environment were evaluated against the applicable accident dose criteria. Chemical exposure consequences to the same receptors were evaluated against the applicable chemical exposure criteria. These analyses use the most conservative operational condition or operating mode to determine potential radiological and chemical exposure consequences. The information and analyses

13-4 presented demonstrate that the SHINE facility system designs, safety limits, limiting safety system settings, and LCOs were selected to ensure that the consequences of analyzed accidents do not exceed acceptable radiological or chemical design criteria.

The primary potential consequences resulting from the operation of the SHINE facility are radiological. The DBAs are postulated accidents that a nuclear facility must be designed and built to withstand without loss to the SSCs necessary to ensure public health and safety. They can be thought of as loosely defined classes of accidents that bound a number of facility processes, activities, or accident sequences identified through a type of risk-assessment, to identify the limiting event selected for detailed quantitative radiological consequence analysis.

They are not intended to be actual event sequences, but rather to be surrogates to enable deterministic evaluation of the response of a facilitys engineered safety features. They are intentionally conservative in order to compensate for known uncertainties in accident progression, fission product transport, and atmospheric dispersion.

The DBAs are computed in terms of total effective dose equivalent (TEDE), which are used as figures-of-merit to be compared to the applicable control room design and siting criterion. The TEDE is defined in 10 CFR 20.1003, Definitions, as the sum of the effective dose equivalent (for external exposures) and the committed effective dose equivalent (for internal exposures).

For the purposes of design and siting, this allows for a transparent assessment of the performance of minimum necessary design, fabrication, construction, testing, and performance requirements for SSCs. As discussed above, the TEDE value represents the results of a highly stylized deterministic modeling approach of DBAs, which credits only safety-related emergency safety features to transport and mitigate a severe accident source term which represents an accident of exceedingly low probability. It is noted that these TEDE results do not represent actual doses given an event. However, they do help ensure that actual doses received during an accident remain below the occupational dose limits of 10 CFR Part 20, Standards for Protection Against Radiation. This would be done in combination with the general as low as is reasonably achievable (ALARA) practices of 10 CFR Part 20.

SHINE presented two types of safety analyses for the NRC staff to review: (1) the SHINE Safety Analysis (SSA) and (2) traditional DBA radiological consequence analyses. The SSA was developed pursuant to the ISG augmenting NUREG-1537, which endorses the use of integrated safety analysis methodologies as described in 10 CFR Part 70, Domestic Licensing of Special Nuclear Material, and NUREG-1520, Standard Review Plan for Fuel Cycle Facilities License Applications. Those methodologies apply the consequence and likelihood criteria of 10 CFR 70.61 to determine credible accident sequences, preventive or mitigative safety features (i.e., engineered and administrative controls, which the applicant refers to as safety-related controls), and the associated quality assurance elements to ensure that those features are available and reliable. The SSA is considered a licensee-controlled document and is not a requirement for a 10 CFR Part 50, Domestic Licensing of Production and Utilization Facilities, license. However, consistent with the ISG augmenting NUREG-1537, the SSA is a part of SHINEs overall licensing basis demonstrating that the SHINE facility design and operations will ensure the health and safety of facility personnel and the public. The SSA is also controlled by the SHINE administrative controls TSs as a part of the SHINE Nuclear Safety Program. The SHINE DBA analyses follow guidance found in NUREG-1537, Part 2, chapter 13, Accident Analyses, as augmented by the ISG augmenting NUREG-1537, Part 2, which states that the standard review plan and acceptance criteria are applicable to reviewing a description of the accident analyses. SHINE also identified a number of SHINE facility-specific DBAs through the SSA.

13-5 Radiological and Design Criterion Presently, no radiological accident dose criterion is set forth in regulation or guidance to assess the risk to public health and safety and control room operators for non-power production or utilization facilities. In lieu of a standard regulatory accident dose criterion, the standards of 10 CFR Part 20 have been applied for evaluating the effects of a postulated accident, for instance:

Before January 1, 1994, the accident dose criteria used to license a non-power production or utilization facility were generally compared to the public dose limits of 10 CFR Part 20. Therefore, the accident criteria that the NRC staff generally found to be acceptable for accident analyses were the public dose limits of 0.5 roentgen equivalent man (rem) whole body and 3 rem thyroid for members of the public.

On January 1,1994, the NRC amended 10 CFR Part 20 to reduce the dose limits to a member of the public to 0.1 rem TEDE with an implementation date of January 1, 1994. In lieu of an accident dose criterion, under 10 CFR 20.1301(d), a licensee or license applicant may apply for prior NRC authorization to operate up to an annual dose limit for an individual member of the public of 0.5 rem.

However, as discussed in NUREG-1537, Part 1, there are several instances in which the NRC staff has accepted very conservative accident analyses that exceed the 10 CFR Part 20 public dose limits discussed above.

The NRC staff described in the Federal Register, Volume 82, Number 60, dated March 30, 2017 (82 FR 15643), a proposal to amend the NRCs regulations that govern the license renewal process for non-power production or utilization facilities. The staff stated that it had determined that the public dose limit of 0.1 rem (0.001 sievert (Sv)) TEDE is unduly restrictive to be applied as accident dose criteria for these facilities, other than those subject to 10 CFR Part 100, Reactor Site Criteria. The staff based this determination on an NRC Atomic Safety and Licensing Appeal Board statement that the standards in 10 CFR Part 20 are unduly restrictive as accident dose criteria for research reactors (Trustees of Columbia University in the City of New York, ALAB-50, 4 AEC 849, 854-855 (May 18, 1972)). Therefore, the staff proposed to amend the regulations in 10 CFR 50.34, Contents of applications; Technical Information, to add an accident dose criterion of 1 rem TEDE for non-power production or utilization facilities not subject to 10 CFR Part 100.

The proposed accident dose criterion of 1 rem TEDE is based on the U.S. Environmental Protection Agencys (EPA) Protective Action Guides (PAGs), which were published in the EPA document 400-R-92-001, Manual of Protective Action Guides and Protective Actions for Nuclear Incidents. In January 2017, the EPA published an update to its PAGs in EPA-400/R-17/001, PAG Manual: Protective Action Guides and Planning Guidance for Radiological Incidents. The update to the EPA PAGs did not change the basis for the 1 rem TEDE early phase PAG published in 1992. The purpose of the EPA PAGs is to support decisions on protective actions to provide reasonable assurance of adequate protection of the public from unnecessary exposure to radiation.

The EPA PAGs are dose guidelines to support decisions that trigger protective actions such as staying indoors or evacuating to protect the public during a radiological incident. The PAG is defined as the projected dose to an individual from a release of radioactive material at which a

13-6 specific protective action to reduce or avoid that dose is recommended. The three principles considered in the development of the EPA PAGs were: (1) prevent acute effects; (2) balance protection with other important factors and ensure that actions result in more benefit than harm; and (3) reduce risk of chronic effects. In the early phase of a nuclear incident, which may last hours to days, the EPA PAG recommends the protective actions of sheltering-in-place or evacuation of the public to avoid inhalation of gases or particulates in an atmospheric plume and to minimize external radiation exposures between 1 rem to 5 rem. Therefore, if the projected dose to an individual from a nuclear incident is less than 1 rem, no protective action for the public is recommended.

SHINE chose to adopt an accident dose criterion of 1 rem TEDE based on the proposed rule described in 82 FR 15643 and the EPA PAGs discussed therein. The SHINE-selected radiological siting and design criteria (in lieu of the 10 CFR Part 20 exposure limits) are defined as follows:

Radiological consequences to an individual located in the unrestricted area following the onset of a postulated accidental release of licensed material would not exceed 1 rem TEDE for the duration of the accident and Radiological consequences to workers do not exceed 5 rem TEDE during the accident.

As also discussed in section 3.4.1.2 of this SER, the NRC staff finds this accident dose criterion to be acceptable based on the understanding of the EPA early phase PAGs and the NRCs proposed accident dose criterion of 1 rem TEDE for non-power production or utilization facilities to provide reasonable assurance of adequate protection of the public from unnecessary exposure to radiation. As stated in the proposed rule at 82 FR 15643, the NRC is proposing to amend its regulations in 10 CFR 50.34 to add an accident dose criterion of 1 rem (0.01 Sv)

TEDE for non-power production or utilization facilities not subject to 10 CFR Part 100. As also stated in the proposed rule, the accident dose criterion of 1 rem (0.01 Sv) TEDE is based on the EPAs PAGs, which in the early phase recommend the protective action of sheltering-in-place or evacuation of the public to avoid inhalation of gases or particulates in an atmospheric plume and to minimize external radiation exposures to 1 rem (0.01 Sv) to 5 rem (0.05 Sv). If the projected dose to an individual from an incident is less than 1 rem (0.01 Sv), then no protective action for the public is recommended. Therefore, the accident dose criterion of 1 rem (0.01 Sv)

TEDE provides reasonable assurance of adequate protection of the public from unnecessary exposure to radiation.

SHINE defines the control room operator as the worker receptor for calculating radiological consequences to demonstrate compliance with SHINEs General Design Criterion 6 - Control room, which states:

A control room is provided from which actions can be taken to operate the irradiation units safely under normal conditions and to perform required operator actions under postulated accident conditions.

SHINE uses design criteria to ensure that the SSCs within the SHINE facility demonstrate adequate protection against the hazards present. The use of the control room operator as the worker receptor assists in ensuring that the SSCs present in the SHINE facility are those physical SSCs whose intended functions are to prevent accidents that could cause undue risk to

13-7 health and safety of workers and the public and to control or mitigate the consequences of such accidents. The design criteria are selected to cover:

The complete range of IF and RPF operating conditions.

The response of SSCs to anticipated transients and potential accidents.

Design features for safety-related SSCs including redundancy, environmental qualification, and seismic qualification.

Inspection, testing, and maintenance of safety-related SSCs.

Design features to prevent or mitigate the consequences of fires, explosions, and other man-made or natural conditions.

Quality standards.

Analyses and design for meteorological, hydrological, and seismic effects.

The bases for TSs necessary to ensure the availability and operability of required SSCs.

In addition to the siting and design criteria mentioned above, SHINE has additional SHINE safety criteria that assist in achieving an acceptable level of safety by ensuring that events are highly unlikely or by reducing their consequences to less than the SHINE safety criteria. The SHINE safety criteria are:

An acute worker dose of 5 rem or greater TEDE.

An acute dose of 1 rem or greater TEDE to any individual located outside the owner-controlled area.

An intake of 30 milligrams or greater of uranium in a soluble form by any individual located outside the owner-controlled area.

An acute chemical exposure to an individual from licensed material or hazardous chemicals produced from licensed material that could lead to irreversible or other serious, long-lasting health effects to a worker or could cause mild transient health effects to any individual located outside the owner-controlled area.

Criticality where fissionable material is used, handled, or stored (with the exception of the target solution vessel).

Loss of capability to reach safe shutdown conditions.

13-8 The SHINE radiological-related safety criteria of acute worker dose and individual located outside the owner-controlled area dose of 5 and 1 rem, respectively, are bound by the control room design and siting criteria of 5 and 1 rem, respectively, using the TEDE methodology.

The SHINE safe shutdown safety criterion ensures that the facility is designed to automatically shut down the irradiation process, place the target solution into a safe condition, and stabilize accident conditions without immediate operator actions.

Based on the above, the NRC staff finds the SHINE radiological and design criterion to be an acceptable basis for the SHINE facility accident analysis.

SHINE Safety Analysis Methodology The NRC staff evaluated the SHINE SSA using the guidance and acceptance criteria from the ISG augmenting NUREG-1537, Part 2, which endorses the use of integrated safety analysis methodologies as described in 10 CFR Part 70 and NUREG-1520. Those methodologies apply the consequence and likelihood criteria of 10 CFR 70.61 to determine credible accident sequences, preventive or mitigative safety features (i.e., engineered and administrative controls, which the applicant refers to as safety-related controls), and the associated quality assurance elements (also referred to as management measures) to ensure that those features are available and reliable. Those consequence criteria include radiological consequences as well as chemical consequences for chemical hazards directly associated with NRC licensed radioactive material. Given the nature of the SHINE facility and processes, the chemical consequence criteria are part of ensuring that the activities authorized by the license can be conducted without endangering the health and safety of the public (10 CFR 50.57(a)(3)) and facility personnel. The chemical consequence criteria also form a part of the bases and evaluations showing that safety functions will be accomplished (10 CFR 50.34(b)(2)). As stated in the ISG augmenting NUREG-1537, Part 1, applicants may propose alternate accident analysis methodologies, consequence and likelihood criteria, safety features, and methods of assuring the availability and reliability of the safety features.

SHINE FSAR section 13a2 states that SHINEs SSA applies a methodology based on NUREG-1520 to the SHINE IF and RPF. The applicant used its SSA methodology to identify and evaluate credible accident sequences. The accident categories are the following, evaluated for the IF and RPF as appropriate:

Excess reactivity insertion Reduction in cooling Mishandling or malfunction of target solution Loss of offsite power External events, including natural phenomenon events Mishandling or malfunction of equipment Large undamped power oscillations

13-9 Detonation and deflagration in the primary system boundary System interaction events Facility-specific events Inadvertent nuclear criticality in the RPF Hazardous chemical accidents In its SSA, the applicant also identified and evaluated safety-related controls for accident prevention or mitigation, including the methods for ensuring their availability and reliability.

There are some differences between SHINEs methodology and the methodology described in NUREG-1520, as noted below. Additionally, while SHINE is a first-of-a-kind facility, the applicant makes use of engineering judgement and operating experience of similar systems and components and similar types of activities in industrial and nuclear applications in its evaluations of the accident sequences and safety-related controls. The NRC staffs review of the applicants methodology is described below.

The SSA considers routine activities, non-routine activities, and external events that could initiate accident sequences, such as normal and abnormal operations and maintenance activities. The SSA assesses those activities using the following steps:

Identification and evaluation of facility hazards; Identification of credible accident sequences associated with the hazards; Assessment of radiological and chemical consequences and likelihoods associated with the accident sequences; Identification and description of safety-related controls to prevent the identified accident sequences or mitigate their consequences; and Identification of reliability management measures to ensure safety-related controls can perform their intended safety functions.

Among the hazards identified and considered are fissile material hazards for criticality accidents. As described in SHINE FSAR section 3.1, criticality is considered in the SHINE safety criteria. SHINEs SSA methodology includes identification and evaluation of such accidents and controls for those accidents. A description of this process is provided in SHINE FSAR section 13a2 and is evaluated below.

Identification and evaluation of facility hazards SHINE identifies and evaluates facility hazards using common hazard evaluation methods such as Hazard and Operability Analysis (HAZOP) and Failure Modes and Effects Analysis (FMEA).

The NRC staff finds that these methods have the necessary capabilities for assessments to satisfy 10 CFR Part 70 requirements when used in accordance with appropriate selection criteria (see NUREG-1513, Integrated Safety Analysis Guidance Document, and section 3.4.3.2(5) of NUREG-1520). The staff used these same criteria to evaluate SHINEs use

13-10 of these methods as part of SHINEs implementation of 10 CFR Part 70 methodologies to demonstrate compliance with 10 CFR Part 50 requirements. The results of SHINEs hazard evaluation identify those hazards that have the potential to harm the public, facility occupants, or the environment. The results also recommend engineered or administrative controls that may be applied to prevent or mitigate the hazards.

Identification of credible accident sequences associated with the hazards SHINE applied the results of the hazard evaluation to develop process hazards analyses and the associated credible accident sequences. SHINE designated an initiating event for each sequence that SHINE determined according to the applicable failures, process deviations (including human errors), or external events derived from the hazard evaluation.

SHINE defined credible accident sequences as those that do not meet the following conditions:

a.

An external event for which the frequency of occurrence can conservatively be estimated as less than once in a million years.

b.

A process deviation that consists of a sequence of many unlikely events or errors for which there is no reason or motive. In determining that there is no reason for such errors, a wide range of possible motives, short of intent to cause harm, must be considered.

c.

A convincing argument exists that, given physical laws, process deviations are not possible, or are extremely unlikely. The validity of the argument is not dependent on any feature of the design or materials controlled by the TSs or safety-related SSCs or activities.

These criteria are similar to the sets of qualities described in NUREG-1520 that could define an event as not credible. For item c above, the terminology used by the applicant has been adapted to recognize that the license includes TSs, which address those items described in section 13a2 of the SHINE FSAR. The intent is that the argument for an event not being credible cannot depend upon the exercise or implementation of any kind of control. This includes any feature controlled by license condition or TS or by safety-related SSCs or activities, which include engineered or administrative (specific administrative controls, in the applicants terminology) safety-related controls (among which are those that meet the applicants safe-by-design definition) or reliability management measures. The NRC staff finds that this intent is consistent with the intent of the set of qualities described in NUREG-1520.

Assessment of radiological and chemical consequences and likelihoods SHINE defined consequence and likelihood categories in order to calculate a risk index for each credible accident sequence. The risk index methodology is based on risk index values described in NUREG-1520 where accident sequences with risk indices above a certain limit require safety controls (i.e., safety-related controls, in SHINEs terminology). The SHINE consequence categories designate indices based on deterministic intermediate and high consequence limits for radiological and chemical exposures of the public and facility occupants.

SHINE determined these limits based on the SHINE safety criteria.

13-11 The SHINE safety criteria define the intermediate consequence limits. An exception is that the SHINE safety criteria include the high consequence limit on soluble uranium intake. The NRC staff notes that 10 CFR 70.61(c) doesnt include a soluble uranium intake limit for intermediate consequences; the limit is in 10 CFR 70.61(b), which means an event leading to an intake in excess of that amount would be a high consequence event. However, with SHINEs approach of reducing the likelihood of both high and intermediate consequence events to highly unlikely, the staff finds SHINEs use of the soluble uranium intake limit to be acceptable. The staff finds that the high consequence limits align with those specified in 10 CFR 70.61(b).

The radiological safety criteria and intermediate consequence limits use dose limit values that are noticeably less than those in 10 CFR 70.61(c) and do not include a separate release criterion like is in 10 CFR 70.61(c). As this is not an application for a 10 CFR Part 70 license, the applicant need not commit to the limits in 10 CFR 70.61 but can propose and justify alternate performance criteria (see section 13b.1 of Part 2 of the ISG augmenting NUREG-1537). In this case, the applicant has selected radiological safety criteria and intermediate consequence limits with dose limit values that are lower than those in 10 CFR 70.61(c). These limits are 5 rem TEDE for workers and 1 rem TEDE for the public.

The public accident dose limit is evaluated at the controlled area boundary as discussed in section 13a.4 of this SER. The applicant has not selected a separate release criterion, instead using the public dose criterion to cover the radiological consequences from a release. The NRC staff finds that the dose criterion is an appropriate criterion for accidents for the SHINE facility.

With regard to consequences for workers, SHINE FSAR section 13a2 states that radiological consequences for facility staff are determined for control room operators, but chemical consequences for facility staff are determined for control room operators and other personnel in the controlled area, consistent with the approach in 10 CFR Part 70. The approach for radiological consequences is consistent with the requirements and regulatory criteria for the safety analyses for a 10 CFR Part 50 license. The NRC staff notes that while the FSAR only addresses radiological doses to control room operators, the SSA does include radiological dose to other personnel in the radiologically controlled area, which is consistent with 10 CFR Part 70 for evaluating consequences to any individual that would receive an occupational dose as defined in 10 CFR 20.1003.

SHINE designated three likelihood categories: not unlikely, unlikely, and highly unlikely. For each category, SHINE established corresponding likelihood indices and annual event frequency limits. The NRC staff finds that the defined indices and frequency limits align with table A-6 of NUREG-1520. SHINE determined the likelihood of credible accident sequences from the initiating event frequency and may include other factors such as component failures or human error. For each credible accident sequence, SHINE evaluated the uncontrolled risk by combining the applicable consequence and likelihood indices without crediting any safety-related controls. This evaluation results in a risk index value which determines whether the risk of the postulated accident sequence is acceptable. Acceptable risks are:

High and intermediate consequence events that are highly unlikely or Low consequence events in any likelihood category.

For nuclear criticality safety, the applicant treated criticality accidents as high consequence events (see SHINE FSAR section 6b.3). Thus, such events must be highly unlikely to have acceptable risk. The applicant defined highly unlikely for criticality accident events as meeting the double contingency principle. As noted in section 3.4.3.2(9) of NUREG-1520, double

13-12 contingency addresses several reliability and availability qualities, and where the applicable qualities are each present to an appropriate degree, a system of safety-related controls (in NUREG-1520 these controls are called items relied on for safety) possessing double contingency protection can be an acceptable definition of highly unlikely. In considering the definition of double contingency, the NRC staff notes that sometimes more than a two-fold redundancy may be needed. The staff evaluation of nuclear criticality safety is in chapter 6 of this SER.

The applicant also defined and applied an approach called safe-by-design (SBD) to defining a criticality accident event as highly unlikely. SHINE FSAR table 13a2.1-4, Failure Frequency Index Numbers, includes a description of the characteristics for a component or feature to qualify as SBD. The SBD qualification applies only to passive design components or features that are passive engineered controls (PEC) that meet the following criteria:

a.

The PECs dimensions fall within established single parameter limits or can be shown by calculation to be subcritical, considering bounding process conditions and including the use of the approved subcritical margin.

b.

The PEC has no credible failure mechanisms (e.g., bulging, corrosion, leakage) that could disrupt the credited design characteristics.

c.

The PECs design characteristics are controlled so that the only potential means to effect a change that might result in a failure to function would be to implement a design change.

The control of the PECs that are credited as SBD includes the applicants configuration management program, a description of which is given in TS 5.5.4, Configuration Management.

This program is one of several developed to ensure the availability and reliability of safety-related controls and that the facility design and operations are consistent with the safety analyses (see also reliability management measures discussion below). This program includes evaluation of changes in accordance with SHINEs 10 CFR 50.59, Changes, tests, and experiments, change control program. Chapter 12, Conduct of Operations, of this SER describes the NRC staffs review of SHINEs process to maintain this program, which the staff considered in its review of SHINEs SSA methodology, including reliability management measures. Since the SBD component or feature is a PEC, the item is safety-related and so the applicants TS 5.5.4 configuration management program applies to these items. Additionally, as described in the applicants Quality Assurance (QA) Program Description (QAPD), these items will be controlled to Quality Level 1 (QL-1), the highest level in the applicants graded approach to quality in its QAPD.

Since the applicants method allows for qualification of items as SBD alone to be relied on to determine that a criticality accident sequence is highly unlikely, the NRC staff finds that the reliability management measures, including the applied QA elements, applied to such items need to have a commensurately high degree of rigor. This is due to the significance of the risk reduction credited for being SBD. The staff notes that the applicants QAPD follows ANSI/ANS-15.8-1995, Quality Assurance Program Requirements for Research Reactors. As described in NUREG-1537 and the ISG augmenting NUREG-1537, the NRC accepts a QA program that follows ANSI/ANS-15.8-1995 (as endorsed in Regulatory Guide (RG) 2.5, Revision 1, Quality Assurance Program Requirements for Research and Test Reactors) as fulfilling the QA requirements of 10 CFR Part 50 for the applicants type of facility. The staff evaluation of the SHINE QAPD is in chapter 12 of this SER.

13-13 The applicants method also allows for applying a failure frequency index number (FFIN) of -5 to accident sequences besides criticality accident sequences for which SBD is applied. The NRC staff notes that this aspect of the applicants method also varies from the approach described in NUREG-1520. The applicant indicated that an FFIN of -5 was applied to a limited number of accident sequences. In most cases, the uncontrolled accident sequence involves multiple failures or conditions to occur coincident with an initiating event. Thus, the FFIN for the uncontrolled accident event includes the individual contributions of each failure or condition necessary to result in an accident sequence having radiological or chemical consequences. In other instances, the applicant performed calculations that demonstrate the frequency of the event to be sufficiently low or otherwise provided information to justify the use of this FFIN.

Based on this information, the applicants method allows limited use of an FFIN of -5 for accident sequences beyond those criticality accident sequences that involve SBD. Based on a review of these accident sequences, the staff finds that the method requires appropriate evaluations and considerations for applying this FFIN. The staffs finding is also based on considerations of the applicants overall accident analysis approach for the requested 10 CFR Part 50 license.

Identification and description of safety-related controls to prevent the identified accident sequences or mitigate their consequences For accident sequences with unacceptable risk indices, SHINE designated engineered and administrative controls to reduce the risk to acceptable levels. Engineered controls include passive and active controls. SHINE referred to these engineered and administrative controls as safety-related controls. SHINE confirmed the reduction in risk by reassessing the accident sequence after applying the controls. The reduction in risk can be achieved by decreasing the likelihood of occurrence and/or reducing the resulting consequences. SHINE may also identify defense-in-depth (DID) controls to provide additional risk reduction margin. SHINE did not credit these DID controls for the purposes of evaluating the risk of an accident sequence.

The NRC staff finds that the applicants method for determining failure frequency and probability indices is, with the exceptions already noted above and some other changes, consistent with the method described in NUREG-1520. However, since this facility is a first-of-a-kind for which the reliability of human actions has not been studied to the same degree as for power reactors or typical fuel cycle facilities, it was unclear to the staff that some of the indices that SHINEs method allows for administrative controls, including enhanced administrative controls, would be justifiable for those controls. The applicant did explain that while the SHINE facility is a first-of-a-kind, some of the administrative controls are similar in nature to those at other facilities.

Additionally, in selecting the index for failure probability (SHINE FSAR table 13a2.1-5), the applicant selected the higher index from the index range applicable for the type of administrative control (i.e., an index of -2 for an enhanced administrative control). The staff finds the applicants method for assigning failure frequency and probability indices to be acceptable based on the applicant selecting the highest index in the index range and in consideration of the applicants overall accident analysis approach. Additionally, in evaluating SHINEs method for determining failure frequency and probability indices, the staff considered SHINEs process to maintain the SSA, which will ensure that the SSA reflects the actual performance of the administrative safety-related controls. SHINE confirmed in response to RCI 13-9, that TS 5.5.1, Nuclear Safety Program, ensures the SSA and its supporting documentation will remain accurate and current, including prompt updates when changes are made to the facility, operations, or FSAR descriptions. The staffs evaluation of SHINEs process to maintain the

13-14 SSA is in chapter 12 of this SER. Thus, based on these considerations, the staff finds that SHINEs failure frequency and probability index method is acceptable.

The NRC staff also finds that the applicants method for determining failure probability indices allows for engineered controls to be given a failure probability index number of -4 or -5. While this is consistent with the method described in NUREG-1520, the method in NUREG-1520 and in the applicants FSAR (SHINE FSAR table 13a2.1-5) indicates that these index values can rarely be justified by evidence. In reviewing the accident sequences and information provided in the SHINE RAI response dated January 29, 2021 (Agencywide Documents Access and Management System Accession No. ML21029A105), the staff finds that the limited application of these index values along with the justifications for their application in those instances indicate appropriate consideration was taken in assigning such index values. Further, in evaluating SHINEs method of determining failure probability indices, the staff considered SHINEs process to maintain the SSA per TS 5.5.1, which will ensure that the SSA reflects the actual performance of the engineered safety-related controls. The staffs evaluation of SHINEs process to maintain the SSA is located in chapter 12 of this SER. Thus, based on these considerations, the staff finds that the applicants method for assigning failure frequency and probability indices is acceptable.

Identification of Reliability Management Measures SHINE applied reliability management measures to ensure the availability and reliability of safety-related controls. SHINE defined reliability management measures as programmatic administrative controls applied to ensure that the credited control can perform its intended safety function. Reliability management measures include activities such as design control, surveillance, procedures, training, and preventive maintenance. The applicant established programs for development and implementation of specific reliability management measures for the engineered and administrative safety-related controls. These programs include the applicants QA program described in its QAPD and the following programs in section 5 of the TSs:

TS 5.2, Review and Audit TS 5.4, Procedures TS 5.5.1, Nuclear Safety Program TS 5.5.2, Training and Qualification TS 5.5.4, Configuration Management TS 5.5.5, Maintenance of Safety-Related SSCs TS 5.7, Required Actions TS 5.8, Reports TS 5.9, Records

13-15 In its review of the applicants SSA methodology, the NRC staff reviewed the descriptions of the reliability management measures and programs, including descriptions of specific reliability management measures for the safety-related controls identified for several accident sequences.

The programs for these measures include those programs that the staff would expect to be in place for providing specific measures to ensure the reliability and availability of the safety-related controls that are credited for accident prevention and mitigation (e.g., TS 5.5.1). In terms of the QA program, the staff recognizes that the applicants QA program includes a graded approach. In this approach, the full QA program is applied to safety-related items and activities.

This means that the safety-related controls, both engineered and administrative, that the applicant relies on to prevent or mitigate accidents will be controlled to QL-1. The staff finds that this is acceptable and appropriate since treating these controls and characteristics at the highest QA level ensures that these controls and characteristics are maintained, reliable, and available as analyzed and credited in the applicants safety analysis.

In reviewing the different accident types, the NRC staff identified instances where it appeared that items and activities that are reliability management measures were being identified as administrative safety-related controls or identified as defense-in-depth controls. As reliability management measures ensure that safety-related controls are available and reliable, they are not themselves safety-related controls, but they are necessary to ensure that the safety-related controls perform as evaluated in the applicants analyses. Thus, a modification of a reliability management measure for a particular safety-related control can result in a change to the safety-related controls performance, reflected in its risk index, and so affect whether accident sequences relying on that safety-related control have been adequately prevented or mitigated.

This means that modification of a safety-related controls reliability management measures can result in an increase in frequency, likelihood, or consequence of an accident or malfunction.

Change control programs include evaluation of increases in frequency, likelihood, and consequence. Chapter 12 of this SER describes the staffs review of SHINEs process to maintain the SSA, which the staff considered in its review of SHINEs SSA methodology, including reliability management measures.

Having clear distinctions and descriptions of the reliability management measures and the safety-related controls they support is important. For example, an administrative safety-related control may be a particular facility staff action to ensure that a system parameter is maintained within an acceptable range. The procedures for performing that action would be a reliability management measure that ensures that the control is properly performed (and so is available and reliable). Training on that procedure would be an additional reliability management measure. Other items used to ensure that the facility staffs action is performed correctly or that the equipment that the facility staff use to perform that action is appropriate and functioning correctly would also be reliability management measures. Additionally, if an item is necessary to ensure that a safety-related control is available and reliable, it is a reliability management measure and cannot be treated as defense-in-depth. Thus, the applicant revised its SSA to ensure that reliability management measures are not identified as specific administrative controls and are not used as defense-in-depth controls. In its review of selected accident sequences and descriptions of safety-related controls, the NRC staff finds that there are a few instances of items identified as defense-in-depth controls that seem to be more like reliability management measures. However, these particular items do not appear to also be associated with supporting other safety-related controls for the evaluated accident sequences. Thus, the staff finds that the applicants SSA method adequately distinguishes reliability management measures from safety-related controls.

13-16 Conclusion The NRC staff reviewed the SSA methodology and the following accident types to assess the applicants implementation of its methodology:

Facility-specific events, Mishandling or malfunction of equipment, External events, and Selected accident events that could lead to criticality.

The NRC staff finds that SHINE FSAR chapter 13 and the SSA methodology are consistent with the ISG augmenting NUREG-1537, Part 2, in that the SSA methodology reviews the systems and operating characteristics of the SHINE facility that could affect safe operation or shutdown.

Furthermore, the staff finds that SHINE FSAR chapter 13 and the SSA methodology demonstrate that the applicant applied the SSA methodology to identify limiting accidents, analyze the evolution of the scenarios, evaluate the consequences, designate safety-related controls, and establish quality assurance measures.

The SSA and the SSA methodology are an important part of SHINEs safety program. An effective and adequate SSA and safety program are those that reflect the as-built and as-operated facility and demonstrate that it ensures the health and safety of personnel and the public. Chapter 12 of this SER includes the NRC staffs evaluation of SHINEs QAPD and the process to maintain the SSA. As noted above, the staff considered the outcome of those reviews in its evaluation of SHINEs SSA methodology and its implementation.

The NRC staff determined that the SSA methodology demonstrates an adequate basis for the final design and satisfies the applicable acceptance criteria of the ISG augmenting NUREG-1537, Part 2, allowing the staff to make the following findings, with the considerations identified above:

(1)

The various methodologies that SHINE described (e.g., HAZOP, FMEA, etc.)

are accepted accident analysis approaches.

(2)

The definitions of accident likelihood, consequence severity, and the risk categories are comparable to the guidance in NUREG-1520 and are acceptable for use in the SSA.

(3)

The SSA methodology provides reasonable assurance that SHINE has identified intermediate and high consequence accidents and established safety-related controls to decrease the likelihood of occurrence to highly unlikely and/or reduce the consequence to low.

(4)

The SSA methodology supports the adequate identification of capabilities and features to prevent or mitigate potential accidents and protect the health and safety of the public and workers.

13-17 Based on these findings, the NRC staff concludes that the accident analysis methodology, as described in SHINE FSAR chapter 13 and implemented in the SSA, is sufficient to demonstrate that the proposed equipment, facilities, and administrative controls to prevent or mitigate accidents are adequate to protect health and minimize danger to life or property.

SHINE Design-Basis Accidents SHINE Design-Basis Accident Methodology SHINE FSAR chapter 13 provides the DBA analyses which are evaluated against the siting and control room design criterion. These analyses evaluate the design and performance of SSCs of the facility with the objective of assessing the risk to public health and safety resulting from operation of the facility. The analyses assist in determining the margins of safety during normal operations and transient conditions anticipated during the life of the facility, and the adequacy of SSCs provided for the prevention and mitigation of accident consequences. Therefore, SHINE identified the postulated initiating events and credible accidents that form the design-basis for the facility, consisting of the irradiation units (IUs) and supporting systems and the RPF.

SHINE elected to utilize the following sources of information to develop applicable DBAs:

NUREG-1537, Part 1, Guidelines for Preparing and Reviewing Applications for the Licensing of Non-Power Reactors, Format and Content, issued February 1996.

NUREG-1537, Part 2, Guidelines for Preparing and Reviewing Applications for the Licensing of Non-Power Reactors, Standard Review Plan and Acceptance Criteria, issued February 1996.

Final Interim Staff Guidance Augmenting NUREG-1537, Part 1, Guidelines for Preparing and Reviewing Applications for the Licensing of Non-Power Reactors: Format and Content, for Licensing Radioisotope Production Facilities and Aqueous Homogeneous Reactors, dated October 17, 2012.

Final Interim Staff Guidance Augmenting NUREG-1537, Part 2, Guidelines for Preparing and Reviewing Applications for the Licensing of Non-Power Reactors: Standard Review Plan and Acceptance Criteria, for Licensing Radioisotope Production Facilities and Aqueous Homogeneous Reactors, dated October 17, 2012.

NUREG/CR-6410, Nuclear Fuel Cycle Facility Accident Analysis Handbook, dated March 1998, which presents methodology to compute radiological consequences utilizing the so-called five-factor formula.

NUREG-1520, Revision 2, Standard Review Plan for Fuel Cycle Facilities License Applications, issued June 2015.

NUREG/CR-2858, PAVAN: An Atmospheric-Dispersion Program for Evaluating Design-Basis Accidental Releases of Radioactive Materials from Nuclear Power Stations, issued November 1982.

13-18 RG 1.145, Revision 1, Atmospheric Dispersion Models for Potential Accident Consequence Assessments at Nuclear Power Plants, issued February 1983.

The SSA document that incorporated information from the SHINE process hazard analysis method within the safety analysis, hazard and operability studies, failure modes and affects analyses, and experience of the hazard analysis team.

For non-power reactors, the MHA is generally analyzed because it would involve a scenario involving irradiated fuel and probably include the release of fission products to the environment.

The NRC staff notes that, in many cases, non-power reactor accidents do not result in fission product releases to the environment. However, SHINE identified numerous DBAs that result in fission product releases to the environment. The DBA releasing fission products to the environment resulting in the highest offsite public consequences is considered the facilitys maximum creditable accident. SHINE also identified DBAs that result in releases of non-fission product radioactive material to the environment. These accidents involve releases of tritium.

The NRC staff review process can be generally divided into six parts, which are a review of: (1) selected bounding DBAs; (2) applicable accident source terms; (3) major SSCs of the facility that are intended to mitigate the radiological consequences of a DBA; (4) characteristics of fission product releases from the proposed site to the environment; (5) the meteorological characteristics of the proposed site; and (6) the total calculated radiological consequence dose at the site boundary from the bounding DBAs.

The NRC staff generally does not accept DBA analyses that credit facility features that:

a.

are not safety-related;

b.

are not covered by TSs;

c.

do not meet single-failure criteria; or

d.

rely on the availability of offsite power.

Safety-related - Those SSCs whose intended functions are to prevent accidents that could cause undue risk to health and safety of workers and the public or to control or mitigate the consequences of such accidents are classified as safety-related SSCs. Safety-related SSCs are designed, constructed, and operated to remain functional during normal conditions and during and following design-basis events. SSCs that perform an engineered safety feature function are also classified as safety-related. The NRC staff finds that the application of SHINEs Design Criteria discussed in SHINE FSAR chapter 3 reflect the design features of safety-related SSCs which include redundancy, environmental qualification, seismic qualification, and procedures for inspection, testing, and maintenance.

Technical Specifications - The NRC staff reviewed the SHINE TSs, which provide LCOs of the facility pursuant to 10 CFR 50.36. Consistent with NUREG-1537, Part 2, and the ISG augmenting NUREG-1537, Part 2, the staff confirmed that the SSCs credited in the accident analysis are designated as safety-related and included within TSs. The engineered controls credited for prevention or mitigation are incorporated into TS section 3.0, Limiting Conditions for Operation and Surveillance Requirements. The safety margins contained within the DBAs are products of specific values and limits contained in the facilitys TSs and other values, such

13-19 as assumed accident or transient initial conditions or assumed safety system response times.

Specific TSs have been established for:

A process variable, design feature, or operating restriction that is an initial condition of a DBA or transient analysis that either assumes the failure of or presents a challenge to the integrity of a fission product barrier.

An SSC that is part of the primary success path and which functions or actuates to mitigate a DBA or transient that either assumes the failure of or presents a challenge to the integrity of a fission product barrier.

Single Failure - The Single Failure Criterion is applied when developing DBAs as a design and analysis tool which has the direct objective of promoting reliability through the enforced provision of redundancy in those systems that must perform a safety-related function. The Single Failure Criterion, as applied in DBA analyses, is a requirement that a system that is designed to carry out a defined safety function must be capable of carrying out its mission despite the failure of any single active component within the system or in an associated system that supports its operation. Application of this criterion involves a systematic search for potential single failure points and their effects on the system. The objective is to search for design weaknesses that could be overcome by increased redundancy, use of alternate systems, or use of alternate procedures. In general, only those systems or components that are judged to have a credible chance of failure are assumed to fail when the Single Failure Criterion is applied.

Consistent with NUREG-1537 and the ISG augmenting NUREG-1537, the NRC staff confirmed that SHINE had designed the protection systems for high functional reliability consistent with SHINE Design Criterion 15, which ensures that redundancy and independence designed into the protection systems are sufficient to ensure that: (1) no single failure results in loss of the protection function and (2) removal from service of any component or channel does not result in loss of the required minimum redundancy unless the acceptable reliability of operation of the protection system can be otherwise demonstrated.

Emergency Power - Loss of normal electrical power and consequent reduction in cooling will not lead to a challenge to the primary boundary. A loss of normal electric power should not compromise safe IU shutdown. Consistent with NUREG-1537, Part 2, and the ISG augmenting NUREG-1537, the NRC staff confirmed that the emergency electrical power is provided by a common safety-related uninterruptible electrical power supply system (UPSS) and a common nonsafety-related standby generator system. The purpose of the UPSS is to provide a reliable source of power to the redundant divisions of safety-related AC and DC components required to ensure and maintain safe facility shutdown and prevent or mitigate the consequences of design-basis events. The UPSS consists of two independent trains, each consisting of a 125 volts-direct current (VDC) battery subsystem with associated charger, inverter, and distribution system. This UPSS is capable of delivering required emergency power for the required duration during normal operations and accident conditions. The staff finds that this is consistent with SHINE Design Criteria 27 and 28, which specify that onsite and offsite electric power systems, and their inspection and testing, be provided to permit functioning of safety-related SSCs. The safety functions of the onsite and offsite electric power systems are to provide sufficient capacity and capability to ensure that: (1) target solution design limits and primary system boundary design limits are not exceeded as a result of anticipated transients and (2) confinement integrity and other vital functions are maintained in the event of postulated accidents. The UPSS is designed to have sufficient independence, redundancy, and testability to perform its safety functions assuming a single failure. Provisions are included to minimize the probability of losing electric power from the UPSS as a result of or coincident with, the loss of

13-20 power from the offsite electric power system. In addition, the SHINE facility is also equipped with a standby generator system that is not safety-related and, thus, not credited in the accident analysis. This system is, however, available as a normal back-up power supply for selected asset protection loads in the event of a loss of offsite power.

The NRC staff confirmed consistency with NUREG-1537, Part 2, and the ISG augmenting NUREG-1537 with respect to SHINEs DBAs accident analysis by reviewing that:

Credible accidents were categorized, and the most limiting accident in each group was chosen for detailed analyses.

Each DBA sequence started with an initiation and ended in a stabilized condition.

The primary boundary consists of all structures that prevent the release of fission products in solution and the fission gases generated during operation and that its integrity will be maintained under all credible accidents analyzed.

The IU was assumed to be operating normally under applicable TSs before the initiating event.

Instruments, controls, and automatic protective systems were assumed to be operating normally or to be operable before the initiating event.

The single malfunction that initiates the event was identified.

Credit was taken during the scenario for normally operating systems and protective actions and the initiation of emergency safety features required to be operable by TSs.

The sequence of events and the components and systems damaged during the accident scenario were clearly discussed.

The applicant identified the limiting phenomena that would release radionuclides within the facility and to the outside environment. For the SHINE facility, this includes:

Thermal-hydraulic safety limits; Precipitation of fission products; Precipitation of target solution (uranium);

Detonation or deflagration of combustible gas mixtures; and Excessively high radiolytic gas release.

Reactivity limits and the functional designs of control and safety-related systems should prevent loss of primary boundary integrity during credible accidents involving insertion of some fraction of excess reactivity. The analyses

13-21 should include applicable reactivity feedback coefficients and automatic protective actions.

The applicant analyzed potential power instabilities, including unstable (growing) power oscillations that are large and undamped and that the IU will return to a stable state such that the integrity of the primary boundary is not challenged.

The mathematical models and analytical methods employed, including assumptions, approximations, validation, and uncertainties, were clearly stated.

The radiation source terms were presented or referenced.

The potential radiation consequences to the facility staff and the public were presented and compared with acceptable limits.

The NRC staff reviewed the DBA analysis inputs to confirm that the most restrictive values of facility parameters were selected from the range of design values possible so that the postulated radiological consequences would be maximized. Other considerations included:

The range of values applicable during an accident that may vary from accident to accident which could differ from the range that applies during normal operations.

The use of different parameter values in different portions of the analyses and, when needed, sensitivity analysis to determine the limiting value.

Facility parameters associated with a TS LCO which specifies a range, or a value with a tolerance band where the most restrictive value should be used.

Situations where and how some parameters may change value during the accident. In these cases, the calculation should either assume the most restrictive value for the entire duration or the calculation should be performed in time steps, with the appropriate parameter values used for each time step.

For parameters based on the results of less frequent surveillance testing, for example, efficiency testing of charcoal filters, the degradation that may occur between periodic tests should be considered in establishing the analysis value.

Analysis parameters affected by density changes that occur in the process stream. With regard to specified volumetric flow rates as LCOs, the density used should be consistent with the density that is assumed in the surveillance procedure that demonstrates compliance with the LCOs.

General Description the SHINE Facility Safety and Design Features, and Design Bases Other chapters of the SHINE FSAR contain discussions and analyses of the facility as designed for normal operation. NUREG-1537 necessitates a discussion that considers how the facility has been designed to ensure the safe operation and shutdown of the facility to avoid undue risk to the health and safety of the public, the workers, and the environment. Therefore, this section of this SER provides an overview of SHINEs methodology in designing the SSCs and the

13-22 operating characteristics of the facility that could affect its safe operation and shutdown. The purpose of this section is to provide context on how the SSCs are credited within the DBAs.

The SHINE facility is divided into two major process areas: (1) the IF and (2) the RPF. The IF and the RPF are side-by-side within a single structure, separated by a central wall. Descriptions of each are as follows:

Irradiation Facility: includes eight IUs with each containing, among other components, a subcritical assembly system which includes the target solution vessel (TSV) and TSV dump tank, light water pool system, and the TSV off-gas system (TOGS).

Radioisotope Production Facility: consists of several process areas that prepare target solution, extract and purify the radioisotope products, and process waste streams. The major process systems are the uranium receipt and storage system, target solution preparation system, target solution staging system, vacuum transfer system, process vessel vent system, radioactive liquid waste storage system, and the radioactive liquid waste immobilization system. The RPF also includes the supercell, which is comprised of several internal cells, including the molybdenum extraction areas, purification areas, an iodine and xenon purification and packaging cell, process vessel vent system equipment, and packaging areas, that form one hot cell structure.

Irradiation Facility Operations and Systems For a facility such as the SHINE facility, margin to safety is large and few credible accidents can be sufficiently damaging to result in the release of radioactive materials to the unrestricted area.

The target solution is low-enriched uranium (LEU) in the form of a uranyl sulfate held within the TSV. During operation, the target solution is close to ambient temperature and pressure. The primary system boundary acts as the primary fission product boundary and is defined by the TSV, TSV dump tank, TOGS, and associated components. Within the IU, the target solution is irradiated in a subcritical assembly by neutrons produced by a fusion-neutron source. After irradiation, the target solution is then processed in the RPF to extract and purify molybdenum-99 (Mo-99) and other medical isotopes. Radioactive waste materials are processed and/or converted to solid wastes for shipment to offsite disposal facilities.

The radiologically controlled area (RCA) incorporates both the IF and RPF, which are located within a single seismic Category 1 structure. The radioactive material present in the RCA is located in the following areas:

Irradiation Facility:

IU cells, TOGS shielded cells, Tritium purification system area, RCA ventilation equipment areas.

13-23 Radioisotope Production Facility:

Target solution preparation and storage areas, Supercell, Target solution hold tanks, Carbon delay beds, Radioactive liquid waste storage tanks, Radioactive liquid waste immobilization.

Within the RCA, the facility is designed as a series of confinement boundaries that establish a low-leakage barrier against the uncontrolled release of radioactivity to the environment. The confinement systems provide active and passive protection and are designed to limit the release of radioactive material to occupied or uncontrolled areas during and after DBAs to mitigate the consequences to facility staff, the public, and the environment.

The IF uses two confinement systems:

1.

Primary Confinement Boundary and

2.

Tritium Confinement Boundary.

The RPF uses three confinement systems:

1.

Process Confinement Boundary,

2.

Hot cells and gloveboxes, and

3.

RCA ventilation isolations.

Primary System Boundary The TSV, TSV dump tank, TOGS, and associated components make up the primary system boundary. The primary system boundary is designed, fabricated, erected, and tested to have an extremely low probability of abnormal leakage, of rapidly propagating failure, and of gross rupture. The primary system boundary has a design pressure of 100 pounds per square inch (psi). The TSV, TSV dump tank, and most components of TOGS have a design temperature of 200°F. The TOGS hydrogen recombiners, recombiner condensers, and the interconnecting piping have a design temperature of 650°F to accommodate the heat produced by the hydrogen recombination process that results in normally elevated temperature within these components.

Primary Confinement Boundary The primary confinement boundary contains the primary system boundary, which contains the fission products. The primary confinement boundary consists predominantly of the IU cell, the

13-24 TOGS shielded cell, and the IU cell and TOGS cell heating, ventilation, and air conditioning (HVAC) enclosures. The primary confinement boundary is primarily passive, and the boundary for each IU is independent from the others. During normal operations, the primary confinement boundary is operated within a normally closed atmosphere without connections to the facility ventilation system, except through the primary closed-loop cooling system (PCLS) expansion tank. The closed-loop ventilation units, radiological ventilation zone 1 (RVZ1) recirculating subsystem (RVZ1r), circulate and cool the air within the IU cell and the TOGS cell. Each subsystem is equipped with a cooling coil and high-efficiency particulate air (HEPA) and carbon filters to remove contaminants in the circulated air. There are no normally open external connections between the RVZ1r subsystem and the main RVZ1 system. The PCLS expansion tank connection to the RVZ1 exhaust subsystem (RVZ1e) provides a vent path for radiolysis gases produced in the PCLS and light water pool, to avoid the buildup of hydrogen gas. The PCLS expansion tank is located in the IU cell but draws air from the TOGS cell atmosphere. A small line connecting the IU cell and TOGS cell atmospheres creates a flow path from the IU cell, into the TOGS cell, and out through the PCLS expansion tank to RVZ1e. This flow path normally maintains the cells at a slightly negative pressure. The connection to RVZ1e is equipped with redundant dampers or valves that close on a confinement actuation signal, isolating the cells from RVZ1. The IU and TOGS shielded cells are equipped with removable shield plugs which allow entry into the confined area. Gaskets and other non-structural features are used, as necessary, to provide sealing where separate structural components meet.

The primary confinement boundary shield plug gaskets are maintained in accordance with SHINEs Maintenance Program, and inspected, repaired, and replaced in accordance with approved maintenance procedures. The content of these procedures is controlled in accordance with SHINE TS section 5.4. Each piping system capable of excessive leakage that penetrates the primary confinement boundary is equipped with one or more isolation valves that serve as active confinement components, except for the nitrogen purge supply system supply and process vessel ventilation system (PVVS) connections that may remain open to sweep gas through the primary system boundary to prevent damage from excessive hydrogen accumulation. Shield plug performance will be verified during startup testing in accordance with approved startup test plans. This testing will be done by slightly pressurizing the confinement and verifying that leakage rates are within acceptance criteria based on the analytical limits.

The analytical limit for leak rate out of the IU cell is 6E+04 standard cubic centimeters per minute (sccm) at 0.5 Kilopascal (kPa) differential pressure. The analytical limit for leak rate out of the TOGS cell is 4E+04 sccm at 24 inches of water column (6 kPa) differential pressure.

The reliability of the shield plugs will be verified via periodic inspection and testing in accordance with SHINE TS section 3.4, which includes an LCO for the primary confinement boundary. LCO 3.4.5 includes a surveillance requirement of the IU cell and TOGS cell shield plugs to verify operability upon each installation of the shield plugs.

There are three digital instrumentation and control systems that monitor and control various operations throughout the IF and RPF. The process integrated control system (PICS) is a nonsafety-related digital control system that monitors and controls various operations throughout the IF and RPF. The TSV is protected by the TSV reactivity protection system (TRPS). All other engineered safety feature functions are monitored and controlled within the engineered safety features actuation system (ESFAS).

The purpose of the TRPS is to monitor process variables and provide automatic initiating signals in response to off-normal conditions, providing protection against unsafe IU operation during the IU filling, irradiation, and post-irradiation modes of operation. The TRPS is designed to end the event and place the target solution in a safe shutdown condition without the need for

13-25 operator action. Each IU has its own TRPS. The major safety function of the TRPS is to monitor variables associated with the IU during the IU filling, irradiation, and post-irradiation modes of operation and to trip the neutron driver and actuate the engineered safety features (see SHINE FSAR table 7.4-1, TRPS Monitored Variables). This is executed by an Irradiation Unit Cell Safety Actuation signal when specified setpoints, based on analytical limits, are reached or exceeded. An IU Cell Safety Actuation signal causes a transition of the TRPS to Mode 3 operation (shutdown) which isolates the primary system boundary and the primary confinement boundary via transition of each component to its de-energized state. The parameters indicating a release of radioactive material into the primary confinement boundary are: (1) high RVZ1e IU cell radiation indicating a release of fission products; (2) high tritium purification system target chamber supply pressure; and (3) high tritium purification system target chamber exhaust pressure indicating a release from the neutron driver assembly system. If sufficient radioactive material reaches the radiation monitors in the RVZ1 exhaust duct, the ESFAS will isolate the radiological ventilation system building supply and exhaust. The TRPS also transmits status and information signals to the nonsafety-related maintenance workstation and to the PICS for display in the control room, trending, and historical purposes. In the event of a DBA that results in a release from the primary system boundary to the primary confinement boundary, confinement is achieved through the TRPS, the radiological ventilation system, and the passive confinement structures provided by the steel and concrete comprising the walls, roofs, and penetrations of the IU cell and TOGS shielded cell.

The ESFAS monitors process variables and provides automatic initiating signals in response to off-normal conditions, providing protection against unsafe conditions in the SHINE facility (see SHINE FSAR table 7.5-1, ESFAS Monitored Variables). The ESFAS is a plant-level protection system not specific to any operating unit or process. The two major safety functions of the ESFAS are to provide: (1) sense and command functions necessary to maintain the facility confinement strategy and (2) process actuation functions as required by the safety analysis. The actuation functions can be initiated throughout the SHINE facility via the use of radiation monitoring and other instrumentation. If at any point a monitored variable exceeds its predetermined limits, the ESFAS automatically initiates the associated safety function.

On a Safety Actuation single from the TRPS and/or ESFAS, the primary confinement boundary isolates, the normal flow of materials passes through the mezzanine RVZ1 exhaust filter banks before being released to the environment (radiological ventilation system filtration is not safety-related and is not credited in the accident analysis). The setpoint for fission product radiation monitors, i.e., all monitored locations identified in SHINE TS table 3.7.1-a except item g. and item h. (tritium concentrations), is 5 times the normal background level. The setpoint limits for item g. and item h. for tritium are less than or equal to 927 Ci/m3 and 0.96 Ci/m3 of tritium, respectively. These setpoint provides margin to an analytical limit of 15 times the normal background level. SHINE TS 3.7, Radiation Monitoring Systems and Effluents, ensures that radiation levels within the facility and radiation released to the environment are within allowable limits. Meanwhile, the redundant fail-open TSV dump valves actuate, and the target solution is gravity-fed down to the geometrically favorable TSV dump tank within the light water pool system. The TSV dump valves are provided to drain the TSV, either as part of the process prior to transferring the target solution downstream for processing within the RPF, or as a safety-related feature utilized as part of a planned response in the event of an IU abnormal or accident condition. Once the target solution is in the TSV dump tank, it is passively cooled by the light water pool.

The light water pool is safety-related and serves two primary functions: shielding and cooling. It is a concrete structure lined with stainless steel designed as Seismic Category I to remain

13-26 functional after the design-basis earthquake without the loss of liner integrity that could compromise its water retention capability. The pool is approximately 15 feet deep filled with approximately 19,000 gallons water. It is designed with sufficient thermal mass to provide decay heat removal capacity to cool the target solution during normal operation and abnormal events.

The minimum acceptable water levels for normal operation provide adequate radiological shielding and equipment cooling for TSV operation at the licensed power limit. These water levels are assumed for normal operation and within the analyses for loss of cooling conditions.

SHINE TS 3.3, Coolant Systems, LCO 3.3.1, indicates that verification of light water pool level occurs prior to entering Mode 1 and shall be greater than or equal to 14 feet, relative to the bottom of the pool. This pool depth is consistent with the limiting physical configuration with respect to radiological dose.

Tritium Confinement Boundary The tritium confinement boundary is defined by portions of the tritium purification system (TPS).

Tritium in the IF is confined using active and passive features of the TPS. The TPS gloveboxes and secondary enclosure cleanup subsystems are credited passive confinement barriers. The TPS gloveboxes enclose TPS process equipment. The process equipment of the secondary enclosure cleanup subsystem is a credited passive confinement barrier. The TPS gloveboxes are maintained at negative pressure relative to the TPS room and have a helium atmosphere.

The TPS gloveboxes provide confinement in the event of a breach in the TPS process equipment that results in a release of tritium from the isotope separation process equipment.

The TPS gloveboxes include isolation valves on the helium supply, the glovebox pressure control exhaust, and the vacuum/impurity treatment subsystem process vents. The TPS has isolation valves on the process connections to the neutron driver assembly system target chamber supply and exhaust lines. The TPS neutron driver assembly system interface lines themselves are part of the credited tritium confinement boundary up to the interface with the primary confinement boundary. When the isolation valves for a process line or glovebox close, the spread of radioactive material is limited to the glovebox plus the small amount between the glovebox and its isolation valves. The liquid nitrogen supply and exhaust lines and the gaseous nitrogen pneumatic lines for the TPS equipment are credited to remain intact during a DBA and the internal interface between the gloveboxes and nitrogen lines serves as a passive section of the tritium confinement boundary.

Upon detection of high TPS exhaust to facility stack tritium concentration or high TPS glovebox tritium concentration, the ESFAS automatically initiates a TPS isolation. The active components required to function to maintain the confinement barrier are transitioned to their safe de-energized state by the ESFAS.

Process Confinement Boundary The process confinement boundary includes two areas: (1) the supercell confinement, which includes the extraction, purification, and packaging hot cells and the PVVS hot cell and (2) the below grade confinement, which confines the PVVS delay beds, the target solution hold, storage, and waste tanks, the pipe trench and valve pits, and the waste processing tanks.

Gaskets and other non-structural features are used, as necessary, to provide sealing where components meet (e.g., shield plugs and inspection ports). Each vault is equipped with a concrete cover plug fabricated in multiple sections with one or more inspection ports that allow remote inspection of the confined areas without personnel access. Each valve pit is equipped with a concrete cover plug fabricated in multiple sections with one inspection port. The pipe

13-27 trench is equipped with concrete cover plugs fabricated in multiple sections with some having inspection ports. The pipe trench, vaults, and valve pits with equipment containing fissile material are equipped with drip pans and drains to the radioactive drain system. The below grade confinement is primarily passive. Most process piping that passes through the confinement boundary is entering or exiting another confinement boundary. Process piping for auxiliary systems entering the boundary from outside confinement is provided with manual or automatic isolation capabilities. In the event of a DBA that results in a release within the process confinement boundary, radioactive material is confined primarily by the structural components of the boundary. If sufficient radioactive material reaches the radiation monitors in the RVZ1 exhaust duct, ESFAS will isolate the radiological ventilation system building supply and exhaust.

Process Vessel Vent Isolation The PVVS captures or provides holdup for radioactive particulates, iodine, and noble gases generated within the RPF and primary system boundary. The system draws air from the process vessels through a series of processing components that remove the radioactive components by condensation, acid adsorption, mechanical filtration with HEPA filters, and adsorption in carbon beds. Two sets of carbon beds are used; the guard beds located in the supercell and the delay beds located in the carbon delay bed vault. The PVVS guard and delay beds are equipped with isolation valves that isolate the affected guard bed or group of delay beds from the system and extinguish any fire. The isolation valves also serve to prevent the release of radioactive material to the environment. The delay beds are equipped with sensors to detect fires which provide indication to ESFAS. The isolation valves close within 30 seconds of the receipt of the actuation signal. The redundancy in the beds and the ability to isolate individual beds allow the PVVS to continue to operate following an isolation.

Hydrogen gas is produced by radiolysis in the target solution during and after irradiation. During normal operation, the PVVS removes radiolytic hydrogen and radioactive gases generated within the RPF and primary system boundary. If the PVVS becomes unavailable, the buildup of hydrogen gas is limited using the combustible gas management system, which uses the nitrogen purge system (N2PS), process system piping, and the PVVS to establish an inert gas flow through the process vessels.

Nitrogen Purge System The combustible gas management system uses the N2PS, primary system boundary (PSB) piping, and the PVVS to establish an inert gas flow through the IUs. One of the functions of the TOGS is to maintain PSB hydrogen concentrations below values that could result in a hydrogen explosion overpressure capable of rupturing the PSB during normal, shutdown, and initial accident conditions. For long-term hydrogen gas mitigation during and after an accident, or if TOGS is unavailable, the N2PS provides sweep gas to dilute hydrogen within the TSV headspace, TSV dump tank, and TOGS piping and maintain the hydrogen gas concentration.

Upon initiation of an IU Cell Nitrogen Purge, active components required to function to establish and maintain the N2PS flow path are transitioned to their de-energized (safe) state by the TRPS and the ESFAS.

Resupply of N2PS occurs within three days which is considered to be a safety-related maintenance activity in accordance with SHINE TS 5.4. The procedures would be performed by the SHINE emergency response organization (ERO) whose members are trained and qualified to perform their duties in accordance with SHINE TS 5.5.2.

13-28 The SHINE ERO is described in the SHINE Emergency Plan. Members of the ERO receive training in accordance with the requirements of the plan, to include recovery actions required by the SSA. Control room operators are members of the onsite ERO and receive training on the emergency plan and emergency response actions. The directions for performing or ensuring the performance of credited administrative or personnel actions are contained within standard operating procedures performed by or under the direction of licensed operators, maintenance procedures, or emergency response procedures. The content of these procedures is controlled in accordance with SHINE TS 5.4.

Supercell The supercell is a set of hot cells in which isotope extraction, purification, and packaging is performed, and gaseous waste is handled. The supercell provides shielding and confinement of airborne radioactive materials during normal operation and in the event of a release. The RVZ1 draws air through each individual confinement box, from the general RPF area, to maintain negative pressure inside the confinement, minimizing the release of radiological material to the facility. Filters and carbon adsorbers on the ventilation inlets and outlets control the release of radioactive material. The supercell ventilation exhaust ductwork is fitted with radiation monitoring instrumentation to detect off-normal releases to the confinement boxes. The active components required to function to maintain the confinement barrier are actuated by the ESFAS. Upon indication of a release exceeding setpoints, isolation dampers or valves on both the inlet and outlet ducts isolate the hot cells from the ventilation system. Contaminated air is confined to the supercell by the confinement boxes, the ventilation exhaust dampers or valves, and the process isolation valves. Additionally, the actuation signal closes isolation valves on the molybdenum extraction and purification system (MEPS) heating loops and conducts a vacuum transfer system (VTS) Safety Actuation. As part of the VTS Safety Actuation, connections to the supercell from the facility chemical reagent system (FCRS) skid isolate, closing the MEPS and iodine and xenon purification and packaging (IXP) supply valves.

Radiologically controlled area ventilation isolations The radiological ventilation systems include supply air, recirculating, and exhaust subsystems required to condition the air and provide the confinement and isolation needed to mitigate DBAs.

The SHINE facility utilizes three ventilation systems in the RCA to maintain the temperature and humidity and to progress air from areas with the least potential for contamination to areas with the most potential for contamination. These systems and sub-systems are as follows:

Radiological ventilation zone 1 (RVZ1)

RVZ1 recirculating subsystem (RVZ1r)

RVZ1 exhaust subsystem (RVZ1e)

Radiological ventilation zone 2 (RVZ2)

RVZ2 exhaust subsystem (RVZ2e)

RVZ2 supply subsystem (RVZ2s)

RVZ2 recirculating subsystem (RVZ2r)

Radiological ventilation zone 3 (RVZ3)

13-29 Radiological Ventilation Zone 1 RVZ1 provides ventilation and humidity control for ventilation zone 1 within the RCA. Subsystem RVZ1r provides cooling for systems within the IU cell and the TOGS cell. RVZ1r recirculates, filters, and cools air within the IU cell and the TOGS cell. The system includes two fan coil units and associated ductwork and dampers per each set of lU/TOGS cells. Each set of RVZ1r units is located within the cooling room and forms a portion of the confinement boundary for the lU/TOGS cells that it serves. RVZ1r provides sampling, ventilation, and cleanup connections for the primary confinement.

Subsystem RVZ1e provides exhaust air from the areas with a high potential for contamination in the SHINE facility. The air is filtered and directed out of the facility through the exhaust stack.

The subsystem includes fans, filters, ductwork, dampers, and HEPA filter banks. It also includes the necessary transfer ductwork to allow makeup from the RCA general area into the exhausted areas.

RVZ1e is designed to maintain ventilation zone 1 areas at a lower pressure than ventilation zone 2 areas. The design inhibits backflow with the use of backflow dampers at the discharge of the RVZ1e and RVZ2e exhaust fans in order to minimize the spread of contamination. RVZ1e ductwork provides sampling locations for radiation detectors, fire detection equipment, stack release monitoring, and an exhaust stack connection point for RVZ2e and the PVVS.

Radiological Ventilation Zone 2 RVZ2 provides ventilation and humidity control for ventilation zone 2 rooms within the RCA.

RVZ2s supplies conditioned outside air into the RCA to provide ventilation and to make up for RVZ1e and RVZ2e exhaust volumes. The system includes air handling units, filters, ductwork, and dampers. RVZ2s provides cooling, heating, and humidification for all systems within ventilation zone 2 as well as maintains the quality control lab and analytical labs at positive pressure with respect to the ventilation zone 2 general area.

RVZ2r recirculates, filters, and conditions air within the RCA. The system includes air handling units (AHUs), filters, ductwork, and dampers. The RVZ2r AHUs are located within the RCA.

RVZ2r provides additional cooling for systems within ventilation zone 2. RVZ2r is also used to cool air being supplied to the supercell, which reduces the flow rate required to cool the equipment within the supercell. The filters and bubble-tight dampers on the inlet side of the supercell are part of RVZ1e.

RVZ2e exhausts air from the general areas of the RCA. It provides an exhaust path for the quality control (QC) laboratory and analytical testing laboratory fume hoods within the RCA and maintains the QC laboratory and analytical testing laboratory at positive pressure with respect to the ventilation zone 2 general area. The system is designed to maintain the RCA at a lower pressure than areas outside of the RCA. The RVZ2e design inhibits backflow within ductwork that could spread contamination. The subsystem includes fans, filters, ductwork, dampers, and HEPA filter banks. It also includes the necessary transfer ductwork to allow makeup from the RCA general area into the exhausted rooms. RVZ2e ductwork provides sampling locations for ESFAS radiation detectors and fire detection equipment.

13-30 Radiological Ventilation Zone 3 RVZ3 provides ventilation and humidity control for ventilation zone 3 rooms within the RCA.

RVZ3 transfers air from the non-radiological area ventilation zone 4 (FVZ4) to ventilation zone 3 then from ventilation zone 3 to ventilation zone 2 via engineered pathways. RVZ3 receives air from RVZ2s in the IF exit labyrinth.

During upset and accident conditions, affected sections of the RVZ1e, RVZ2s, and RVZ2e ventilation systems are isolated as required for the specific event or indication. The IU cell exhaust flow path of RVZ1e provides ventilation of the IU cell and TOGS cell via PCLS expansion tank headspace. This path is equipped with safety-related radiation monitoring instrumentation (see SHINE TS table 3.7, Radiation Monitoring Systems and Effluents) and redundant isolation valves (see SHINE TS 3.4, Confinement). Between the RVZ1e IU cell radiation instrumentation and RVZ1e IU cell ventilation valves is an isolation lag tank. The isolation lag tank of the RVZ1e provides an exhaust gas delay time greater than the closing time of the valves. If radiation measurements exceed predetermined limits (15 times background),

the TRPS initiates an IU Cell Safety Actuation, which closes the RVZ1e IU cell ventilation valves. The RVZ1e has safety-related redundant bubble-tight dampers that are situated as near to the confinement boundary as practical and close in a failsafe condition (see SHINE TS 3.4).

Upon loss of power, loss of signal, or ESFAS initiation of confinement, dampers seal the affected confinement areas within 30 seconds.

Radioisotope Production Facility Operations and Systems Operations within the RPF involving SNM include the uranium receipt and storage system (URSS), target solution preparation system (TSPS), the MEPS, the IXP system, the quality control and analytical testing laboratories (LABS), the target solution staging system (TSSS),

the VTS, the radioactive liquid waste storage (RLWS) system, the radioactive liquid waste immobilization (RLWI) system, and the radioactive drain system (RDS). The operations that do not involve SNM but that pose a radiological or chemical hazard from radiochemical operations and operations with hazardous chemicals include the molybdenum isotope packaging system (MIPS), the PVVS, and the FCRS. Other systems in the RPF that do not have direct radiological or chemical hazards are evaluated for impact on the systems listed above.

The URSS receives, thermally oxidizes (if needed), repackages, and stores LEU prior to target solution preparation in the TSPS. The TSPS prepares low-enriched uranyl sulfate solution, which, once qualified for use, is referred to as target solution. The URSS and TSPS are both classified as both an operation with unirradiated SNM and an operation with hazardous chemicals. Due to the presence of uranium, both the URSS and TSPS pose criticality, radiological, and chemical hazards.

The MEPS separates the molybdenum from the irradiated target solution and purifies the resulting product. The extraction portion of the MEPS is an operation involving irradiated target solution processed for radioisotope extraction and contains significant quantities of uranium.

Due to the presence of uranium, the MEPS extraction process is analyzed for criticality hazards.

In addition, the extraction process involves radiological and chemical exposure hazards. The purification portion of MEPS, as well as isotope packaging operations in MIPS, are considered radiochemical operations, but pose a lesser hazard than extraction operations because these processes are physically separated from the extraction operations and involve smaller quantities of radioactive material.

13-31 The IXP system separates iodine from acidic solutions and purifies the resulting product. The separation operations handle irradiated target solution processed for radioisotope extraction and contain significant quantities of uranium. Due to the presence of uranium, the IXP process has the potential for criticality. In addition, the IXP has radiological and chemical exposure hazards.

The LABS are used to analyze samples of target solution, radioisotope products, and other process fluids. The operations in the LABS involve small amounts of SNM, radiochemicals, and hazardous chemicals. Due to the presence of uranium, the LABS are analyzed for criticality hazards. In addition, the LABS involve radiological and chemical exposure hazards.

The TSSS receives both irradiated target solution from the radioisotope extraction processes and unirradiated target solution from the TSPS. The TSSS allows for the target solution to be sampled prior to reuse or disposal, and stages target solution for transfer to the IF or the waste system. The system is categorized as irradiated target solution processed for reuse or waste disposal. Due to the presence of uranium, the TSSS has the potential for criticality as well as radiological and chemical exposure hazards.

The VTS serves as the transfer system for irradiated target solution between RPF tanks and for transfers between the RPF and the IF. The system also provides the capability to sample tank contents in the TSSS and the RLWS. The system performs operations involving irradiated target solution processed for reuse or waste disposal. Due to the presence of uranium, the VTS has the potential for criticality as well as radiological and chemical exposure hazards.

The RLWS serves as a waste system for solutions resulting from the processing of licensed material, and target solution batches or portions thereof that will no longer be used in facility processes. The RLWS involves operations with irradiated target solution processed for waste disposal. Due to the presence of uranium, the RLWS has the potential for criticality. In addition, this process has radiological and chemical exposure hazards.

The RLWI serves as a waste immobilization system for solutions received from the RLWS. The RLWI involves operations with irradiated target solution processed for waste disposal. Due to the presence of uranium the RLWI has the potential for criticality. In addition, this process has radiological and chemical exposure hazards.

The RDS collects leakage and overflow of process fluids, including target solution, from process tanks and vessels and from hot cells. Fluids collected in the RDS can be returned to production or transferred to the RLWS for disposal. The RDS involves operations with irradiated target solution processed for reuse or for waste disposal. Due to the presence of uranium, the RDS has the potential for criticality as well as radiological and chemical exposure hazards.

The PVVS handles the off-gas resulting from the processes of the IF and RPF. The PVVS is classified as a radiochemical operation and poses a radiological hazard. This process contains radionuclides removed from the off-gas.

The FCRS stores and supplies reagents to the processes of the RPF. The FCRS is classified as an operation with hazardous chemicals and poses a chemical hazard. The system contains no SNM or radionuclides.

The supercell is designed as a confinement boundary. Hot cell exhaust ventilation (RVZ1) is equipped with radiation monitors (i.e., the RVZ1 supercell area 1-10 radiation monitors) that

13-32 provide a signal to ESFAS to isolate the affected cell and limit the amount of target solution introduced into the cell, hot cell inlet (RVZ2) and outlet (RVZ1) ventilation ducts are equipped with ESFAS-controlled redundant isolation dampers, hot cell outlet (RVZ1) ducts are equipped with carbon filters, and ESFAS-controlled IXP extraction pump breakers, VTS vacuum transfer pump breakers, and VTS vacuum break valves are provided to limit the amount of target solution introduced into the affected hot cell. Due to the presence of uranium, the supercell has the potential for criticality as well as radiological and chemical exposure hazards.

The pipe trench and tank vault are designed as a confinement boundary. The RDS drains prevent the accumulation of target solution in the pipe trench. The RDS sump tank liquid detection sensor detects fluid in-leakage and provides a signal to ESFAS to stop any in-process transfers of solution within the facility via opening ESFAS-controlled VTS vacuum transfer pump breakers and VTS vacuum break valves. The RVZ1 and RVZ2 building exhausts are equipped with radiation monitors (i.e., the RVZ1 and RVZ2 RCA exhaust radiation monitors) that provide a signal to ESFAS to isolate the building ventilation supply and exhaust dampers on high radiation. Due to the presence of uranium, the pipe trench and tank vaults has the potential for criticality as well as radiological and chemical exposure hazards.

Accident Analysis Consequence Methodology SHINE generally followed the NUREG/CR-6410 methodology to compute radiological consequences recommended in the ISG augmenting NUREG-1537, Part 1. SHINE calculation document, CALC-2018-0048, Radiological Dose Consequences, provides the SHINE FSAR chapter 13 supporting analysis. The purpose of this document is to determine the dose consequences to a SHINE facility control room operator and a member of the public for fourteen DBAs. The methodology is presented as a multi-step process as follows: (1) calculation of radionuclide inventories; (2) definition of the accident-specific materials-at-risk (MAR); (3) identification of transport methods of radionuclides; (4) development of accident source terms; (5) assessment of meteorological conditions; and (6) determination of radiological consequences. The NRC staff followed the NUREG/CR-6410 methodology when reviewing SHINEs accident analysis and supporting calculations to assess the acceptability of safety-related SSCs to mitigate radiological consequences. The methodology utilizes the so-called five-factor formula to derive accident-specific source terms, A(), as follows:

A()[Ci] = ()[Ci] x x () x () x RF(i)

(Equation 1) where:

STA(i) = accident-specific airborne source term for nuclide(i);

MAR(i) = material at risk for nuclide(i);

DR = damage ratio, assumed to be 1.0; ARF(i) = airborne release fraction for nuclide(i);

LPF(i) = leak-path factor for nuclide(i); and RF = respirable fraction(i), assumed to be 1.0.

The MAR is the amount of hazardous material available to be acted on by a given physical stress. Depending on the magnitude and scope of the stress, the MAR may range from the total inventory of a facility to a subset of the inventory in one operation. The DR is the fraction of MAR actually impacted by a given physical stress from a specific event. The ARF is the fraction of impacted material (MAR x DR) that can be suspended to become available for airborne transport following a specific set of induced physical stresses. The RF is the fraction of the

13-33 material-of-concern initially suspended in the air and present as particles that can be inhaled into the human respiratory system. The LPF is the quantitative value that expresses the fraction of initially airborne material that successfully escapes the facility. For particles, the LPF primarily depends on three parameters: (1) the flow rate of the aerosol through the facility; (2) the particle sizes; and (3) the areas available for deposition of contaminants.

The SHINE accident analysis combines the leak-path factor, airborne release fraction, and atmospheric dispersion factors into a single receptor activity fraction (RAF) which represents the fraction of a tracer that is present in a control volume at a specific time interval.

Radionuclide Inventories SHINE calculation document, CALC-2018-0010, Bounding Fission Product Inventories and Source Terms, provide the safety basis fission product inventories and safety basis source terms for the SHINE facility. The safety basis source terms are intended to be used in bounding calculations for shielding and safety analysis. In addition to providing source terms, these calculations also evaluate the effects of the statistical uncertainties of the Monte Carlo N-Particle (MCNP)-calculated neutron fluxes and cross sections on the final source terms.

For most accident scenarios, the MAR was derived from the TSV target solution inventory at the end of a time period of continuous 30-day irradiation cycles (normal operation is 5.5 days) with a downtime between cycles. A conservative constant power level 137.5 kilowatts (kW) was used for the analysis, which is 110 percent of the licensed-limit design operating power. The 110 percent increase in power has a near linear increase in MAR radionuclide inventory and a subsequent similar increase in computed radiological consequence. SHINE assumed this increase in power level to accommodate known uncertainties and error limits of the nuclear systems. Uncertainties in generating the target solution MAR could include target solution void profiles, target solution temperature profiles, core configuration (solution height and uranium concentration), and geometrical tolerances of the TSV. These sources of uncertainty are negligible and modeling the power as 110 percent of the licensed-limit is adequate because the transmutation calculation in ORIGEN-S is held at a constant power level meaning that the neutron flux will be as high as necessary to reach the given power level. During actual operation of the SHINE system, the high time-averaged neutron flux signal, as described in SHINE FSAR Subsection 7.4.4.1.3, protects against exceeding analyzed TSV power levels.

The TSV inventory calculation includes effects from fission, transmutation, activation, and decay. There is no partitioning due to extraction between irradiation cycles. The calculation contains time steps from the start of irradiation through the end of the irradiation cycle and additional time steps that account for decay post-shutdown, as needed. This period was selected for the irradiation cycle based on the anticipated replacement period for target solution.

Most of the peak halogen and noble gas radionuclide concentrations occur at the end of the last irradiation cycle. The percent difference for all halogen and noble gas activities at their maximum compared to shutdown is less than 1 percent, except for radon-222, which is being built into the system from the uranium-238 decay chain. SHINE demonstrated a very large margin between the MAR and normal operations. The applicant identified the bounding and nominal activities and maximum generation rates of iodine-131 at the end of the last irradiation cycle. SHINE explained that the net-generation rate of iodine-131 is higher in the nominal case for the last cycle because the nominal case accounts for removal of iodine (and other elements) between irradiation cycles, where the bounding case assumes that there is no removal of any elements between cycles and with the large inventory in the bounding case, decay losses are

13-34 comparable to generation (i.e., the system is approaching saturation). The NRC staff finds that the MAR MHA source term is about 158 times higher than the calculated nominal inventory for iodine-131 which is the primary dosimetric radionuclide contributing to TEDE. The NRC staff find this source term to be conservative due to the bounding nature of the assumption used to derive it which considers longer irradiation times and no extraction between cycles.

SHINE utilized the Los Alamos National Laboratory developed code, Monte Carlo N-Particle 5 (MCNP5), version 1.60 to calculate the neutron flux spectrums and cross sections in the target solution and PCLS. To compute material information for the target solution and PCLS water, following irradiation and decay, SHINE also utilized three modules of the Oak Ridge National Laboratory code, Standardized Computer Analyses for Licensing Evaluation (SCALE),

version 6.1.2: (1) COUPLE was used to generate neutron data libraries from the MCNP5 tally results for input in ORIGEN-S; (2) ORGIN-S was used to simulate nuclide fission, transmutation, and decay; and (3) OPUS was used to request information from other SCALE modules. The NRC staff finds these computer codes to be acceptable for the purpose of developing radionuclide inventories to derive a bounding SHINE-specific MAR. The staff reviewed the applicable safety-basis SHINE calculation documents which include validation for reactivity in solution systems for the TSV and estimated neutron fluence and target solution burnup over the length of target solution recovery. The staff finds that SHINE utilized the codes discussed above appropriately to derive the safety basis source term, or MAR. SHINE performed an uncertainty analysis on the MAR source term using SHINE Best Estimate Neutronics Model to evaluate the statistical errors of the MCNP-calculated neutron fluence cross sections used in the ORIGEN-S to develop 95 percent confidence, 95th percentile upper tolerance bounds by nuclide. The modeling produced nuclide-dependent multiplication factors ranging from an approximately 0 to a 35 percent increase in the nuclide inventory per nuclide. For the radionuclides that were increased, the average increase was approximately 2.5 percent, and the total estimated increase in inventory was approximately 1 percent. The staff finds the use of conservative assumptions and the treatment of uncertainty to justify the MAR to be acceptable.

Accident-Specific Materials-At-Risk Accident-specific MARs were developed for each accident scenario. The starting inventory was selected based on the assumed start-time and then partitioned based on scenario-specific removal mechanisms. For the source term determination, the radionuclides are grouped into three groups: (1) iodine; (2) noble gases; and (3) non-volatiles (all others). For scenarios involving the release of tritium, the available MAR was determined based on the limiting operational values for the affected systems or components. Consistent with NUREG-1537 and the ISG augmenting NUREG-1537, the NRC staff audited scenario-specific MARs or referenced source documents, as documented in the NRCs audit report (ML22301A149).

The accident-specific MAR for the MHA, SHINE FSAR section 13a2.2.7, Mishandling or Malfunction of Equipment, was derived to assess the consequences of a TOGS malfunction leading to the TOGS gas inventory being released into the TOGS cell. The analysis deterministically assumes that 25 percent of iodine in the TSV solution is initially within the TOGS. This assumption is based on a rule-of-thumb recommendation from NUREG/CR-6410, section 3.4.3, Estimation of ARF and RF for Nuclear Criticality Accidents, for liquid systems where most of the volatile iodine isotopes are retained in the liquid and 25 percent is released for a criticality accident. It is assumed that the iodine in solution is predominantly volatile (i.e., I2) and that aqueous to gas partitioning occurs rapidly, causing 100 percent of the iodine inventory to be released to TOGS post shutdown. SHINE conservatively assumes that 100 percent of the safety-basis MAR is released. However, for the SHINE facility, when a transient or event occurs

13-35 that initiates the TRPS IU Cell Safety Actuation signal, for instance on a high neutron flux level signal (source, wide range, and time-averaged), the TSV is designed to dump the target solution into the favorable geometry dump tank to protect the primary system boundary. The physical phenomena of transporting radionuclides from the target solution are not those from a prompt critical event, but rather from well understood processes such as the evolution of iodine due to the low pH of the target solution and the radiolytic generation of hydrogen which can cause early and long-term release of iodine and non-volatiles through bubble burst. SHINE modelled these processes within its accident analysis as more long-term releases utilizing models and recommendations from the experimental studies performed at the Oak Ridge National Laboratory contained in NUREG/CR-5950 (ORNL/TM-12242), Iodine Evolution and pH Control. The NRC staff finds these modeling assumptions to be conservative and acceptable.

The NRC staff performed a number of confirmatory calculations. Among those were inventory calculations, simplified iodine evolution and transport calculations using the assumed elevated iodine inventory. An additional calculation to estimate the transient iodine concentration in the TOGS system during operation and following shutdown that factors in the reduction in iodine inventory due to evolution during operation was considered but ultimately not performed because SHINE could meet its safety criteria limits even assuming the elevated iodine inventory.

Radionuclide Transport Method within Confinement SHINEs evaluation of the transport of radioactive material is generally consistent with the methods described in NUREG/CR-6410 when developing control volumes and leak path factors (LPFs). The model yields the fraction of a given radionuclide that is released to the environment. To support this method, the staff audited scenarios and analyses which identified the control volumes and leakage paths.

Identify control volumes and leakage paths.

SHINE identified the control volumes, leakage paths, and heat sinks that define the model geometry. The performance of this step establishes the geometric information for the LPF calculations including: gas and liquid volumes, surface areas for deposition, flow path areas and characteristics that influence leakage, elevations, surface areas for liquid and air heat sinks, and system information for ventilation rates and filtering. The control volumes used in the analysis include the source volume, the building volume, and the environment. Leakage paths are treated as junctions between the control volumes.

The analysis considers each part of the facility as a fixed volume that the material is free to disperse into. Dispersion within these volumes is assumed to be instantaneous. Each volume is connected by one or more junctions which allow flow in one direction at a volumetric flow rate, either pressure-driven or constant. Counter-current flow, or flow back into the previous control volume, is not considered in this calculation. The NRC staff determined that this is a conservative modeling decision.

SHINE identified scenarios that can be organized into four leak-path combinations that include:

release location, initial confinement, secondary confinement, and release to environment. These control volumes and leak-path combinations are:

1.

Confinement by IU cell or concrete cell -> IF building -> environment;

13-36

2.

Confinement by glovebox -> TPS room -> IF building -> environment;

3.

Confinement by hot cell -> RPF building -> environment; and

4.

Confinement by concrete vault -> RPF building -> environment.

The NRC staff finds SHINEs identification of control volumes and leak paths based on the thirteen leak-path scenarios to be acceptable as it is consistent with NUREG/CR-6410 which presents the methodology to compute radiological consequences utilizing the five-factor formula.

Quantify scenario progression source histories The performance of this step quantifies initial sources and source rate histories for radionuclides and other mass and energy sources that drive material transport. To do so, the specific physical phenomena for each scenario are defined. This includes the accident initiator and source volume location to quantify the amount or rate at which materials and energy can be released.

Where pertinent, this also includes the amounts or rates at which gases and aerosols are evolved. It also includes the initial conditions including gas temperature and pressure, liquid mass and temperature, as appropriate, and initial released activity. Further rates of activity release are also specified for evolution of iodine and non-volatile evolution. The most pertinent quantification is the identification of the physical form of the radionuclides to be tracked: non-condensable gases, condensable species, and/or aerosols.

For each scenario the initial MAR comprised of individual radionuclides is assumed to be released instantaneously. Once released, all noble gas radionuclides are released to the gas space. Iodine is partitioned between gas and liquid depending on the pH level of the solution and temperature. The rest of the radionuclides are considered to be in condensed form, either dissolved in the solution, in liquid form, or in solid form. The radionuclides in condensed form can become airborne due to bubble bursting, spray leak, or spill, and be transported to the environment with gas flows.

When present, radioactive iodine is demonstrated to be the dominant contributor to radiological dose to the worker and public. The transport of iodine species involves two main processes in order to estimate the contribution of iodine to the total dose: (1) the radiolytic conversion of iodine from I-to I2 and (2) the partitioning of I2 between the aqueous and gas phases. To derive iodine reduction factors, SHINE utilized the following modeling assumptions and guidance:

Iodine partitioning was calculated using equations based on the definitions found in NUREG/CR-5950, Iodine Evolution and pH Control.

Bursting bubble aerosols were treated using a linear relationship between entrainment coefficients and the volumetric flow rate with entrainment coefficients consistent with the small amount of dissolved materials present in the target solution.

Spray and free-fall aerosols used a constant airborne release fraction found in NUREG/CR-6410.

13-37 Radiolysis was treated as either an instantaneous release of hydrogen or as sentrainment with source generation based on decay power inputs for long-term scenarios.

During normal operations in the IU cell, iodine isotopes are removed from the TSV gas space through the operation of the TOGS. The two types of iodine removal occur at two different steps in the process. One occurs during normal irradiation of the target solution in the TSV. The other occurs during the time period that the target solution sits in the TSV dump tank after a normal irradiation period. The TOGS contains a zeolite bed on one train through which the off-gas from the target solution is moved. The zeolite bed preferentially removes iodine isotopes from the gas stream.

All scenarios containing iodine use isotope reduction factors that account for TOGS running during normal operations. Scenarios that are downstream from the IU cell take an additional removal factor of iodine due to the operation of the TOGS during the post-irradiation TSV dump tank hold time.

SHINE calculation CALC-2018-0048, Appendix B, Justification for Treatment of Iodine, contains the justification for the removal factors that were utilized in this calculation as well as the isotope-specific reduction factors. The NRC staff reviewed the iodine isotope-specific reduction factors applied in the DBA dose calculations. Table 13-1 provides a list for each DBA scenario that assumes iodine removal factors for the IU, the TSV dump tank, or both.

Table 13-1: Design-Basis Accident Scenarios Utilizing Iodine Removal Factors Scenario Number Irradiation Reduction Factor Dump Tank Reduction Factor 1a x

1b x

3 x

9a x

x 9b x

x 10 x

11 x

x 12 x

x 14 x

x The NRC staff performed a series of confirmatory calculations to derive the iodine removal factors that SHINE utilized in its DBA dose calculation. The staff finds that SHINEs quantify scenario progression for each of the thirteen leak-path scenarios is acceptable as it is consistent with NUREG/CR-6410 which presents the methodology to compute radiological consequences utilizing the five-factor formula.

Quantify leakage rates between volumes SHINE defined leakage rates between volumes driven by pressure, gas density differences, and barometric breathing and used the outcome of this sub-step to establish expressions for removal rates in the LPF model. The gas pressure in each volume is determined using a combination of conservation laws for mass and energy, temperature-dependent specific heats,

13-38 and the ideal gas law. Pressure-driven flow through each junction was calculated using the standard compressible flow equation for pressure-driven flow. Pressure-driven flow through shielding cover plug gaps was calculated using the equation for plane Poiseuille flow. In the absence of pressure-driven flow, counter-current flow was assumed to be induced and was calculated based on the difference in pressure from one side of the cover plug to the other.

There is no assumed flow from the IF to the RPF or vice versa; all material in the IF or RPF control volumes exits the SHINE facility to the environment. The NRC staff determined that the assumption of no flow between the IF and the RPF is conservative.

The NRC staff determined that SHINEs quantification of leakage rates between volumes for each of the thirteen leak-path scenarios is acceptable as it is consistent with the ISG augmenting NUREG-1537, Part 2 and NUREG/CR-6410 which presents the methodology to compute radiological consequences utilizing the five-factor formula.

Quantify removal mechanisms SHINE established expressions for removal rates of radionuclides for use in the LPF model, specifically, iodine adsorption, non-volatile aerosol deposition, and removal by filters along flow paths. Removal by aerosol settling was evaluated using Stokes law and the calculated equilibrium particle size for a hygroscopic particle. The use of the equilibrium particle size is valid based on the time scale of the accident sequences and is found to be acceptable by the NRC staff. Consideration of removal by filters in the accident flow paths was done by assigning decontamination factors for noble gases, iodine, and aerosols to each filter. Removal due to barometric breathing was based on an analysis of the peak-to-peak magnitude of environmental pressure fluctuations. Eight years of pressure data were collected and analyzed to provide a bounding estimate of the barometric breathing flow rate for the facility.

The NRC staff determined that SHINEs quantification of removal mechanisms of radionuclides for use in the LPF model scenarios is acceptable as it is consistent with NUREG/CR-6410.

Development Accident Source Terms SHINE developed accident source terms for each of the thirteen accident scenarios using the five-factor formula described in NUREG/CR-6410. Radioactive decay of the MAR for various times after the initiation of an accident was included in the source term development. SHINEs LPF model combines the ARF and LPF terms which represent the time-dependent leakage of radionuclides. The ARF multiplied by LPF values are calculated for the leakage from the source volume to the building for the control room operator (duration of the event), worker dose (10 minutes), and the source volume to the environment for the public dose (duration of the event).

The tritium-related events assume that the functional secondary enclosure cleanup component of the TPS train will be able to begin recovery operations within 10 days of the initiating event.

The RF and DR are conservatively set at 1.0.

Assessing meteorological conditions SHINE developed short-term atmospheric dispersion (/Q) factors for an effluent release from the SHINE site. The results are used to assess the consequences of an accident release.

SHINEs approach utilized a Gaussian plume diffusion model with a building vent release to compute the nuclide concentrations and consequent doses external to the facility. This methodology conservatively assumes that the release occurs at ground level. Factors were developed at the offsite public dose locations and the control room. Details on the

13-39 meteorological measurements used to calculate the /Q values can be found in chapter 2 of this SER.

The /Q values are calculated at each receptor location as a function of time following the effluent release. The /Q values are calculated for periods of 0-2 hours, 0-8 hours, 8-24 hours, 1-4 days, and 4-30 days following the effluent release. The calculations are performed with the NRC computer program, PAVAN, which implements the guidance provided in RG 1.145.

The atmospheric dispersion /Q values utilized in the SHINE accident analysis are provided in SHINEs response to NRC staff RAI 13-3 (ML20357A087) and CALC-2018-0048, Rev. 6, table 3-1, 95th Percentile Site Boundary /Q values, and reproduced in the table 13-3 below.

Table 13-3: 95th Percentile Atmospheric Dispersion /Q Values Locations Time Bin (hours) 0-2 2-8 8-24 24-96 96-720 Public /Q Values (s/m3) 5.66E-3 3.45E-3 2.70E-3 1.58E-3 7.31E-4 Control Room /Q Values (s/m3) 1.40E-2 1.09E-2 4.61E-3 2.99E-3 2.33E-3 Determination of Radiological Consequences SHINE computed the radiological consequences for each of the thirteen DBAs for the facility worker (i.e., control room operator, RCA worker) or member of the public. The radiological consequences are computed using the NUREG/CR-6410 methodology discussed above in conjunction with dosimetry methodologies utilizing Federal Guidance Report (FGR) No. 11, Limiting Values of Radionuclides Intake and Air Concentration and Dose Conversion Factors for Inhalation, Submersion, and Ingestion, and FGR No. 12, External Exposure to Radionuclides in Air, Water, and Soil, dose conversion factors which are consistent with the dose-based criteria and limits specified in 10 CFR Part 50 and 10 CFR Part 20 in terms of TEDE. Assumptions for each receptor and applied dosimetry methodologies are described below.

Control Room Operator Receptor Radiological Consequence Assumptions:

The volume of the control room is conservatively estimated to be 350 m3 based on the dimensions of the control room minus estimated sizes of the equipment in the control room.

SHINE assumed no cross contamination from the IF and the RPF as the control room is not part of the radiologically controlled area. Therefore, the radionuclide flow path from the MAR source to the control room is accident-dependent but generally flows to the environment and to the FVZ4 using the control room atmospheric /Q values. The FVZ4 is responsible for delivering air to the control room and many other rooms in the non-radiologically controlled area of the SHINE facility where approximately 20 percent of the FVZ4 inlet flow is delivered to the control room.

The FVZ4 is assumed to continue running after all initiating events as it is not safety-related.

Material that reaches the control room is assumed to instantaneously diffuse within the control room volume. The ventilation system is assumed to continue running after all initiating events for a period of 30 days. The breathing rate for control room operators is assumed to

13-40 be 3.50E-04 m3/s based on RG 1.195 for the duration of the scenario. Control room occupancy factors sourced from RG 1.195 item 4.2.6 are in table 13-4 below.

Table 13-4: Control Room Occupancy Factors Control Room Occupancy Factors 0-24 hours 24-96 hours96-720 hours Occupancy Factor 1.0 0.6 0.4 The NRC staff finds that the assumptions made to compute radiological consequences to the control room operator are conservative and appropriate when demonstrating that the SHINE Design Criterion 6 is met which permits the control room operator to perform their intended functions under accident conditions.

Public Receptor Radiological Consequence Assumptions:

The public radiological consequences are computed by modeling the radionuclide flow path from the MAR source to the environment in combination with the siting public atmospheric /Q values over a 30-day period. The breathing rate for the public receptor is 3.50E-04 m3/s based on RG 1.195 for the duration of the scenario.

The NRC staff finds that the assumptions made to compute radiological consequences to the public are conservative and appropriate when demonstrating the SHINE public dose acceptance criterion of 1 rem TEDE.

Total Effective Dose Equivalent:

The TEDE is defined as the sum of the effective dose equivalent for external exposures and the committed effective dose equivalent for internal exposures. Both 10 CFR Part 50 and 10 CFR Part 20 refer to the dosimetry methodologies defined by the International Commission on Radiological Protection (ICRP) in Publication 26, Recommendations of the ICRP, and in Publication 30, Limits for Intakes of Radionuclides by Workers. The ICRP 30 dosimetry methodologies are applied in:

10 CFR Part 50 - through the TEDE criteria (defined in 10 CFR 50.2, Definitions) for the design, construction, and operation of the facility under normal and accident conditions.

10 CFR Part 20 - through the TEDE limits (defined in 10 CFR 20.1003) to establish standards and practices for radiation protection purposes for occupational and public health during normal operation.

Additionally, 10 CFR Part 20, Appendix B, Annual Limits on Intake (ALIs) and Derived Air Concentrations (DACs) of Radionuclides for Occupational Exposure; Effluent Concentrations; Concentrations for Release to Sewerage, provides direction on how to determine external and internal exposures. Among other things, this appendix provides an appropriate method to compute dose based on ICRP 30 tissue weighting factors. These tissue weighing factors are directly codified by 10 CFR 20.1003 within the table labeled, Organ Dose Weighting Factors.

Acceptable practices for computing DBA radiological consequences in terms of TEDE are to apply the exposure-to-committed effective dose equivalent coefficients for inhalation of

13-41 radioactive material found in table 2.1 of FGR No. 11. The coefficients in the column headed effective yield doses corresponding to the committed effective dose equivalent. These tables are derived from the data provided in ICRP Publication 30 and have been found acceptable to the NRC staff as they meet the applicable regulatory requirements. Likewise, the exposure-to-effective dose equivalent factors for external exposure of radioactive material apply FGR No. 12. Therefore, compliance with the dose-related regulations of 10 CFR Part 50 and 10 CFR Part 20 is demonstrated when applying the exposure-to-dose conversion factors of FGR Nos. 11 and 12.

The NRC staff reviewed the dosimetry methodology applied by SHINE to compute radiological consequences of DBAs to be evaluated against the applicable accident dose criteria. To compute radiological consequences in compliance with 10 CFR Part 50 and 10 CFR Part 20, SHINE utilized the exposure-to-dose conversion factors of FGR Nos. 11 and 12. The NRC staff finds this approach acceptable because it complies with the applicable regulations.

Irradiation Facility Design-Basis Accidents SHINE identified for the IF credible DBA scenarios that range from anticipated events, such as a loss of electrical power, to events that are still credible, but considered unlikely to occur during the lifetime of the facility. For each accident scenario, SHINE identified:

limiting initiating event, initial conditions, and boundary conditions; sequence of events for functions and actions that change the course of the accident or mitigate the consequences of the accident; damage to equipment or the facility that affects the consequences of the accident; potential radiation source term and radiological consequences; and safety controls to prevent or mitigate the consequences of the accident.

The IF DBA categories that bound credible accident sequences are as follows:

Maximum hypothetical accident (SHINE FSAR Subsection 13a2.1.1);

Insertion of excess reactivity (SHINE FSAR Subsection 13a2.1.2);

Reduction in cooling (SHINE FSAR Subsection 13a2.1.3);

Mishandling or malfunction of target solution (SHINE FSAR Subsection 13a2.1.4);

Loss of offsite power (LOOP) (SHINE FSAR Subsection 13a2.1.5);

External events (SHINE FSAR Subsection 13a2.1.6);

Mishandling or malfunction of equipment (SHINE FSAR Subsection 13a2.1.7);

13-42 Large undamped power oscillations (SHINE FSAR Subsection 13a2.1.8);

Detonation and deflagration in the primary system boundary (SHINE FSAR Subsection 13a2.1.9);

Unintended exothermic chemical reactions other than detonation (SHINE FSAR Subsection 13a2.1.10);

System interaction events (SHINE FSAR Subsection 13a2.1.11); and Facility-specific events (SHINE FSAR Subsection 13a2.1.12).

The DBA TEDE results for the public and the control room operator are listed in table 13-5 below.

Table 13-5: Irradiation Facility and Radioisotope Production Facility Accident Dose Consequences Accident Category (Bounding Scenario)

Public TEDE (mrem)

Control Room TEDE (mrem)

Irradiation Facility Insertion of Excess Reactivity No consequences No consequences Reduction in Cooling No consequences No consequences Mishandling or Malfunction of Target Solution Primary system boundary leak into an IU cell 440 771 Loss of Offsite Power (LOOP)

No consequences No consequences External Events 292 588 Mishandling or Malfunction of Equipment -

MHA 727 1,940 Large Undamped Power Oscillations No consequences No consequences Detonation and Deflagration in the Primary System Boundary No consequences No consequences Unintended Exothermic Chemical Reactions other than Detonation No consequences No consequences System Interaction Events No consequences No consequences Facility-Specific Events No consequences No consequences Tritium Release into an IU Cell 37 74 Tritium Release into the Tritium Purification System Glove box 798 1,380 Radioisotope Production Facility Spill of Target Solution in the Supercell 42 76 Spill of Eluate Solution in the Supercell 88 122 Spill of Target Solution in the RPF Piping Trench 22 40 Spill of Target Solution from a Tank 24 42 Spill of Waste Solution in RLWI 557 1,880 PVVS Carbon Delay Bed Fire 532 40 PVVS Carbon Guard Bed Fire 546 1,390

13-43 13a.4.1 Maximum Hypothetical Accident As described in SHINE FSAR sections 13a2.1.1 and 13a2.2.1, IF Maximum Hypothetical Accident, SHINE considered an MHA for the IF as well as the RPF. SHINE identified the MHA as the failure of the TSV TOGS pressure boundary resulting in a release of off-gas into the TOGS cell. This is a credible fission product-based DBA that bounds the radiological consequences for all other DBA categories except for the special-case tritium release DBA. The NRC staffs review of the MHA event is in section 13a.4.7 of this SER.

13a.4.2 Insertion of Excess Reactivity The NRC staff evaluated the sufficiency of the applicants descriptions and discussions of this DBA category using the guidance and acceptance criteria from chapter 13, Accident Analyses, of NUREG-1537, Parts 1 and 2, and the ISG augmenting NUREG-1537, Parts 1 and 2.

SHINE FSAR sections 13a2.1.2 and 13a2.2.2, Insertion of Excess Reactivity, examine the modes of operation including the fill process, the cold target solution prior to starting the neutron driver, and irradiation operations after the neutron driver is activated. The TSV is expected to operate in a subcritical condition during all modes of operation through a combination of automatic safety systems and administrative controls, including a passive standpipe overflow system and fill rate limits. The effective neutron multiplication factor (keff) is expected to be at a maximum at the end of the filling mode. The keff will be reduced during irradiation operations due to void and temperature feedback in the target solution.

The subcritical assembly system, including the TSV and TSV dump tank, is designed to operate in a subcritical state without the availability of excess reactivity. As such, there are no reactivity control systems in the SHINE system. However, as applicable to the TSV, the excess reactivity insertion event during the startup process and post-irradiation mode of the TSV has been identified as a potential initiating event that can challenge the integrity of the pressure system boundary by causing increased power density, temperature, and pressure. The insertion of excess reactivity does not result in radiological consequences.

When in Mode 1 (Startup) and Mode 3 (Post-Irradiation (Shutdown)), the subcritical assembly is not being driven by the neutron driver and excess reactivity could lead to inadvertent criticality and unplanned fission power generation, temperature increase, and gas generation. When in Mode 2 (Irradiation), the subcritical assembly is being driven by the neutron driver where excess reactivity would result in an increase in power, temperature, and gas generation.

Consistent with NUREG-1537, Part 2, the NRC staff confirmed that the credible insertion of excess reactivity accident scenarios were categorized and that the most limiting accident in each group was chosen for detailed analysis. These scenarios are:

Increase in the target solution density during operations (e.g., due to pressurization).

Target solution temperature reduction during fill/startup (e.g., excessive cooldown).

Target solution temperature reduction during irradiation (e.g., excessive cooldown).

13-44 High reactivity and power due to high neutron production at cold conditions.

Moderator addition due to cooling system malfunction (e.g., cooling water in-leakage).

Additional target solution injection during fill/startup and irradiation operations.

Realistic, adverse geometry changes.

Reactivity insertion due to moderator lumping effects (e.g., voiding in the cooling system).

Inadvertent introduction of other materials into the TSV (e.g., uranium solids introduction or precipitation of uranium from target solution).

Concentration changes of the TSV target solution (e.g., through boiling or evaporation).

Failure to control temperature during inverse subcritical multiplication factor (1/M) measurements at startup.

Consistent with NUREG-1537, Part 2, the NRC staff confirmed that prior to the event the system was assumed to be under normal operational conditions and that the accident sequence started with an initiator and ended in a stabilized condition. Before the event, the IU was assumed to be operating normally under applicable TSs. When the TSV is being filled, it is filled to an approximate keff of near 1 at a cold startup temperature range of 59°F to 77°F (15°C to 25°C).

During steady-state irradiation operations, the TSV is in a subcritical state with a nominal keff of slightly less than when filled. The TSV operates with the neutron driver in-service with a source strength yielding a maximum value of 125 kW power within the target solution. The operating TSV maximum average temperature is below 176°F (80°C). During all modes of operations, the target solution has high negative temperature and void coefficients.

Following a TRPS signal, the TSV is designed to dump the target solution on high neutron flux level (source, wide range, and time-averaged) to protect the primary system boundary.

Additionally, the TRPS is designed to dump the TSV contents on high PCLS temperature, low PCLS temperature, and low PCLS flow. The redundant, fail-open TSV dump valves ensure that target solution can be dumped and are cycled each irradiation cycle.

Consistent with NUREG-1537, Part 2, the NRC staff confirmed that SHINE identified the most limiting scenario as Scenario 4, High Reactivity and Power Due to High Neutron Production at Cold Conditions. This scenario can occur due to excess tritium injection into the neutron driver assembly system (NDAS) during cold conditions as a result of a TPS control system or component failure during startup before the TSV is at operating temperature. This scenario can also occur if the NDAS neutron production drops to a lower flux than expected due to focusing issues, electrical arcing, or other malfunctions. This loss of neutron source during irradiation results in a decrease in void fraction and a target solution cooldown in the TSV. If the NDAS neutron production were to rapidly return to full output subsequent to a loss of void fraction and cooldown, excessive power generation could occur that could challenge target solution power density limits or primary system boundary integrity.

13-45 Consistent with NUREG-1537, Part 2, the NRC staff confirmed that SHINE identified the sequence of events for the insertion of excess reactivity event. The event is initiated when the accelerator ceases to produce source neutrons because of an upset event. The TRPS detects the loss of neutron production and begins a delay time prior to initiating a TSV reactivity protection system driver dropout, which would cause the NDAS high voltage power supply breakers to open, terminating the irradiation process by the accelerator. The PCLS continues to function and cool the target solution in the TSV. As the system reduces in power, voids collapse in the target solution, causing a reactivity increase. After the loss of neutron production, target solution cooling results in a temperature decrease of less than 7°C. This results in a reactivity increase. The accelerator output is restored just prior to the TRPS Driver Dropout actuation signal. Power increases to a level that is greater than the steady-state power before the upset occurred. This power level would result in a TRPS IU Cell Safety Actuation on high wide range neutron flux equivalent to fission power. This limit provides margin to an analytical limit of 240 percent fission power (i.e., 300 kW).

Consistent with NUREG-1537, Part 2, the NRC staff confirmed that SHINE identified the safety controls that protect from excessive power resulting in damage to the pressure system boundary. They are the actuation signals from the TRPS on high flux in Mode 1 and Mode 2, which are:

Low power range neutron flux; TRPS Driver Dropout, resulting in redundant NDAS high voltage power supply breakers opening; Redundant high voltage power supply (HVPS) breakers on neutron driver; High wide range neutron flux; and TRPS IU Cell Safety Actuation on high wide range neutron flux.

The TRPS prevents challenges to the integrity of the pressure system boundary as no design limits are exceeded. No equipment damage results from the postulated insertion of excess reactivity event. No releases of radioactive material are expected to occur as a result of the postulated insertion of excess reactivity event. Therefore, because no design limits are exceeded and no damage to the pressure system boundary is expected, there are no radiological consequences to the workers or the public.

The limiting reactivity insertion event has been identified and analyzed and the consequences of this event are within the dose acceptance limits and bounded by the MHA. The TSV attains a stable condition following the limiting event. Radiation doses to the public and workers are thus within acceptable limits and the safety and health of the workers and public are adequately protected.

The NRC staff reviewed the results of SHINEs insertion of excess reactivity event analyses, as discussed above. The staff finds that the results of the analyses demonstrate that a credible insertion of excess reactivity in the IF would result in no design limits being exceeded and no radiological consequences to the workers and public. Therefore, the staff concludes that SHINEs insertion of excess reactivity event analyses are acceptable.

13-46 13a.4.3 Reduction in Cooling The NRC staff evaluated the sufficiency of the applicants descriptions and discussions of this DBA category using the guidance and acceptance criteria from chapter 13, Accident Analyses, of NUREG-1537, Parts 1 and 2, and the ISG augmenting NUREG-1537, Parts 1 and 2.

SHINE FSAR sections 13a2.1.3 and 13a2.2.3, Reduction in Cooling, evaluate a reduction in PLCS cooling flow. The reduction in cooling event during normal operations is identified as a potential initiating event which can challenge the operation on the subcritical assembly system.

The subcritical assembly system components evaluated with reduced cooling were the neutron multiplier, the TSV, and the TSV dump tank. These components are cooled by the PCLS and light water pool during irradiation operations to maintain target solution average temperature at 125 kW of heat generation in the TSV. The PCLS is designed to remove 170 kW and to reject heat to the RPF cooling system, which in turn is cooled by the process chilled water system.

The PCLS, RPF cooling system, and the process chilled water system are supplied by offsite power; therefore, a loss of coolant flow occurs due to power failure and could also occur due to failure of a pump, inadvertent valve closure, or a pipe break. The light water pool provides a large heat capacity for passively rejecting heat from the TSV dump tank during shutdown operations. The temperature rise in the light water pool after a specified decay heat period, assuming the pool is at its minimum allowable level, is described in SHINE FSAR section 4a2.4.2.2.

Consistent with NUREG-1537, Part 2, the NRC staff confirmed that the credible reduction in cooling accident scenarios were categorized and that the most limiting accident in each group was chosen for detailed analysis. These scenarios are:

Loss of normal power resulting in loss of PCLS and de-energized neutron driver.

Loss of PCLS cooling due to blockage, malfunction, or operator error where the neutron driver remains operating.

Consistent with NUREG-1537, Part 2, the NRC staff confirmed that prior to the event the system was assumed to be under normal operational conditions and that the accident sequence started with an initiator and ended in a stabilized condition. The initial conditions and assumptions for the reduction in cooling events are that the TSV is operating normally at steady-state in Mode 2 with a thermal power being generated as 137.5 kW which is 10 percent above the licensed thermal power of 125 kW. The PCLS is providing greater than the minimum flow rate at a temperature less than the maximum supply temperature of 77°F. It is assumed that the TSV was filled to the minimum cold fill volume at the maximize power density. The average target solution temperature is up to 175°F. Target solution decay heat is based on end-of-life target solution conditions, which generates the highest decay heat.

Consistent with NUREG-1537, Part 2, the NRC staff confirmed that SHINE identified the most limiting scenario as Scenario 2, Loss of PCLS Cooling, because in this scenario the accelerator operation could continue with reduced cooling flow. This scenario postulates a loss of PCLS flow without a loss of offsite operating power, resulting in continued operation of the neutron driver at full power which continues to generate heat.

13-47 Consistent with NUREG-1537, Part 2, the NRC staff confirmed that SHINE identified the sequence of events for the reduction in cooling DBA. It is initiated by a PCLS cooling flow being reduced, resulting in increased TSV temperature. A low PCLS flow or high temperature signal (77°F (25°C)) initiates a TRPS Driver Dropout actuation signal, which causes the NDAS high voltage power supply breakers to open, terminating the irradiation process by the accelerator. After a 180 second delay, an IU Cell Safety Actuation is initiated, opening the redundant TSV dump valves and draining the target solution to the TSV dump tank. The light water pool is the heat sink for removal of decay heat from the target solution in the TSV dump tank.

Consistent with NUREG-1537, Part 2, the NRC staff confirmed that SHINE identified the safety controls to prevent a reduction in cooling event and that ensure that the target solution in the TSV does not boil:

TRPS Driver Dropout on loss of PCLS flow and high PCLS temperature.

TRPS IU Cell Safety Actuation on low PCLS flow rate and high PCLS temperature.

Light water pool.

NDAS HVPS breakers.

Redundant TSV dump valves.

The TRPS is designed to end the event and place the target solution in a safe shutdown condition without the need for operator action. The system prevents challenges to the integrity of the pressure system boundary as no design limits are exceeded. If the PCLS supply temperature exceeds the maximum operating limit of 77°F (25°C) or its flow rate is below the minimum operating limit, the TRPS indicates an IU Cell Safety Actuation where the target solution is transferred to the TSV dump tank and passively cooled by the light water pool. No equipment damage results from the postulated reduction in cooling event. No releases of radioactive material are expected to occur as a result of the event. Therefore, because no design limits are exceeded and no damage to the pressure system boundary is expected, there are no radiological consequences to the workers or the public.

The NRC staff reviewed the results of SHINEs reduction in cooling event analyses, as discussed above. The staff finds that the consequences of the event have been analyzed and are bounded by the MHA. Further, the staff finds that radiation doses to the public and workers will be within acceptable limits and that the safety and health of the workers and public will be adequately protected. Therefore, the staff concludes that SHINEs reduction in cooling event analyses are acceptable.

13a.4.4 Mishandling or Malfunction of Target Solution The NRC staff evaluated the sufficiency of the applicants descriptions and discussions of this DBA category using the guidance and acceptance criteria from chapter 13, Accident Analyses, of NUREG-1537, Parts 1 and 2, and the ISG augmenting NUREG-1537, Parts 1 and 2.

13-48 SHINE FSAR sections 13a2.1.4 and 13a2.2.4, Mishandling or Malfunction of Target Solution, describe the IF as containing a liquid target solution that may include radioactive fission products. This accident category includes events that involve the mishandling of the target solution and the failure of the primary system boundary within the IF. The solution may be contained within the target solution hold tank, the TSV, TSV dump tank, or any of the associated piping.

The design of the TSV is to hold the liquid target solution which generates fission products while being normally irradiated during Mode 2 of operation. The primary system boundary which consists of the TSV, the TSV dump tank, the TOGS, and associated connected piping and piping components contains all fission products produced during irradiation. The mishandling or malfunction of target solution event during normal operations is identified as a potential initiating event which could release fission products from the irradiated target solution in the TSV, while being transferred, or in the storage area. Mishandling and malfunction of target solution events fall broadly into two categories. The first is spills or leaks that cause target solution to migrate into unintended locations. The second is changes in the physical or chemical form of the target solution that results in adverse effects.

Consistent with NUREG-1537, Part 2, the NRC staff confirmed that SHINE systematically analyzed a series of credible scenarios of mishandling of, or malfunction involving, target solution by postulating the following scenarios:

Failure of the pressure system boundary below the level of the light water pool.

Failure of the TSV to the PCLS pressure boundary resulting in in-leakage to the TSV.

Failure of the RPF cooling system to the pressure system boundary interface.

Failure of the TSV to the PCLS pressure boundary resulting in target solution leakage to the PCLS.

Failure in the TOGS causing high pressure in the TSV during fill mode.

Target solution leakage into a valve pit.

Consistent with NUREG-1537, Part 2, the NRC staff confirmed that prior to the event the system was assumed to be under normal operational conditions and that the accident sequence started with an initiator and ended in a stable condition. Prior to the event, the pressure system boundary does not a contain significant pressure source. Leakage between the pressure system boundary and the light water pool will normally flow from the pool to the pressure system boundary should a break occur. The primary confinement boundary isolates the primary system boundary from the rest of the facility by robust walls, ceilings, and floors. Penetrations for piping, ducts and electrical cables, and shield plugs are sealed to limit the release of radioactive materials from the facility. Integrated leak rate from the primary confinement boundary is less than that assumed in the dose analysis. The primary confinement is cooled by the RVZ1r recirculating air ventilation system. The primary confinement is ventilated to the RVZ1e exhaust system through the PCLS expansion tank. The IF tanks and piping that have the potential to contain fissile material, except the TSV, are designed with passive measures that prevent an inadvertent criticality with the most reactive uranium concentration. Drains that lead from the

13-49 pipe trenches and tank vaults are designed with a geometry that prevents an inadvertent criticality of the leaked target solution.

Consistent with NUREG-1537, Part 2, the NRC staff confirmed that SHINE identified the most limiting scenario as Scenario 1a, Failure of the PSB Below the Level of the Light Water Pool.

For this scenario, a failure in the pressure system boundary below the light water pool surface is assumed to result in target solution leakage from the primary system to the light water pool. The target solution mixes with the pool water and noble gases, volatile fission products, and particulates evolve into the IU cell gas space. Some of the radionuclides would then leak through the primary confinement boundary into the building and then into the environment.

Consistent with NUREG-1537, Part 2, the NRC staff confirmed that SHINE identified that this sequence of events is initiated by a failure of the primary system boundary which leads to mixing of irradiated target solution within the IU cell light water pool. Radioactive material that enters the gas space above the light water pool is then confined by the primary confinement boundary. Gaskets and other non-structural features are used, as necessary, to provide sealing where components meet (e.g., shield plugs and inspection ports). Some radioactive material is transported into the IF through minor leakage paths around penetrations in the primary confinement boundary. Detection of airborne radiation in RVZ1e (15 times background fission product) actuates the primary confinement boundary isolation valves and an IU trip within 20 seconds of detection (see SHINE FSAR table 7.4.1, TRPS Monitored Variables). A time delay is provided by the holdup volume in RVZ1e to prevent radioactive gases from exiting through RVZ1e prior to isolation. The radioactive material is then dispersed throughout the IF and exits the facility to the environment through building penetrations. Detection of high radiation in the RCA actuates ventilation dampers between the RCA and the environment and minimizes the transport of radioactive material to the environment. No operator actions are required to reach a stable condition or to mitigate dose consequences.

Following the failure of the primary system boundary, it is assumed that the MAR is instantly well-mixed with the light water pool and that gases immediately evolve out of the pool and into the IU cell gas space. For the purposes of the accident analysis, it is assumed that the nitrogen purge system is operating and causes pressurization of the IU cell. Radiation transport is driven by pressure-driven flow between the IU cell and the IF. Reduction in the MAR occurs during the release due to adsorption of iodine onto the IU cell walls and other surfaces until equilibrium conditions are established. The majority of the MAR is transported to the IF through primary confinement boundary leakage. Transport to the environment occurs through leakage around penetrations in the RCA boundary.

Consistent with NUREG-1537, Part 2, the NRC staff confirmed that SHINE identified the safety controls credited for mitigation of the dose consequences for this accident, which are:

primary confinement boundary; ventilation radiation monitors; RVZ1e IU ventilation isolation mechanisms; and holdup volume in the RVZ1e.

13-50 Consistent with NUREG-1537, Part 2, the NRC staff determined that SHINE identified the radiation source term as being the TSV radionuclide inventory as described in Accident Analysis Consequence Methodology, of section 13a.4 of this SE. The entire radionuclide inventory in the TSV is deterministically assumed to be instantaneously released to the light water pool and dispersed uniformly throughout the pool. The iodine in the TSV is assumed to be fully dissolved into the target solution prior to the initiating event where none is present in the gas space of the TSV. The iodine dissolved in the pool water is partitioned according to the pool pH, temperature, and the pool and gas volumes. The pool pH used in the radiological dose calculation bounds the minimum pool pH calculated for nominal conditions. The minimum pool pH was calculated using the bounding low pool volume at bounding low pool pH mixed with the bounding high target solution volume at a bounding low pH.

Deposition of iodine on the walls of the IU cell due to the temperature difference of the warm gas and the cold walls is also credited as a removal mechanism. As iodine is deposited on the cell walls, more iodine is evolved from the light water pool and into the gas space. The iodine partitioning determines the transport of volatile iodine out of the pool. Some radionuclides deposited in the light water pool are released to the gas space as an aerosol when radiolytically-generated hydrogen gas bubbles burst at the pool surface. Radiolysis becomes a long-term source of both non-volatiles and iodine. Once the MAR is released into the gas space of the IU cell, there are several paths through which leakage could occur. The primary leak-path would be around the IU cell plug perimeter. As discussed in Accident Analysis Consequence Methodology, of section 13a.4 of this SER, all potential leak paths are modeled as a single leakage junction to the IF.

The applicant also considered the consequences of target solution mishandling events, such as excessive leakage or spillage that could potentially initiate an unintended criticality event in an area or location where it could pose a threat to facility workers. The MHA bounds the accidental dose consequences of such postulated events. Therefore, radiological doses to the workers and the public will be within acceptable limits, and the health and safety of the staff and public will be adequately protected.

The NRC staff reviewed the results of SHINEs mishandling or malfunction of target solution event analyses, as discussed above. The staff finds that the consequences of the event have been analyzed and are bounded by the MHA. Further, the staff finds that radiation doses to the workers and the public will be within acceptable limits and that the health and safety of the workers and public will be adequately protected. Therefore, the staff concludes that SHINEs mishandling or malfunction of target solution event analyses are acceptable.

13a.4.5 Loss of Electrical Power The NRC staff evaluated the sufficiency of the applicants descriptions and discussions of this DBA category using the guidance and acceptance criteria from chapter 13, Accident Analyses, of NUREG-1537, Parts 1 and 2, and the ISG augmenting NUREG-1537, Parts 1 and 2.

SHINE FSAR sections 13a2.1.5 and 13a2.2.5, Loss of Off-Site Power, examine a LOOP at the facility for an extended period of time with conservative operating conditions as an event that bounds all other loss of power events for the facility. An UPSS is available to supply battery power for safety-related loads.

The LOOP event during normal operations is identified as a potential initiating event which could result in partial or complete loss of power to the facility and potentially challenge the primary

13-51 system boundary in the IF. A LOOP is defined as zero voltage/power supplied by the utility, loss of a phase, phase reversal, sustained overvoltage, or sustained undervoltage. When there is loss of phase, phase reversal, sustained overvoltage, or sustained undervoltage the facility automatically disconnects from the power utility.

The design of the normal electrical power supply system (NPSS) is as a single overall electrical power system serving the SHINE facility as well as the site and support buildings. The NPSS consists of the normal power service entrances from the electric utility from two separate feeds and a distribution system.

Consistent with NUREG-1537, Part 2, the NRC staff confirmed that SHINE systematically analyzed a series of credible scenarios resulting from a LOOP. The analysis examines the variety of reasons related to the reliability and operation of the transmission system, stress during peak grid load conditions, severe weather effects from high wind, tornado, or ice and snowstorms, a seismic event, or equipment failure in the supplying substation. Additionally, SHINE assessed loss of power resulting from failure, or malfunction of, the facility NPSS such as the facility transformers or switchgear. It is assumed that a complete loss of offsite power occurs from causes that are external to the SHINE facility or common cause failures in the NPSS. A LOOP may occur during any combination of operating modes within the IF and the RPF. Postulated LOOP scenarios are the following:

1.

Degradation (reliability) of the transmission system.

2.

Electrical grid stress during peak load conditions.

3.

Severe weather effects from high wind, tornado, ice or snowstorms.

4.

Seismic event.

5.

Equipment failure in the supplying substation.

6.

Failure or malfunction of facility transformers or switchgear.

Consistent with NUREG-1537, Part 2, the NRC staff confirmed that SHINE identified the most limiting scenario as a complete LOOP. This would potentially occur due to severe weather or a seismic event that damages substation equipment or associated transmission lines. For this scenario, the initial conditions and assumptions are that all eight TSVs are in Mode 2 (Irradiation) with the maximum source term and decay heat levels. The irradiation power is assumed to be 137.5 kW, which is 10 percent above maximum operating power. The average target solution temperature in the TSV is at the limit of 176°F (80°C). Bulk target solution temperature in the TSV is at the limit of 176°F (80°C). The initial light water pool temperature is assumed to be 95°F (35°C). Complete loss of PCLS flow at the time of the initiating event is also assumed. The light water pool level is assumed to be not less than the level specified in SHINE FSAR section 13a2.1.5.1, which provides a passive heat sink sufficient to remove decay and residual heat from the target solution. Hydrogen concentration in the TSV and TOGS is assumed to be maintained within operating limits prior to the event. The TOGS mainstream low flow limit has been conservatively calculated by SHINE to be sufficient to maintain the hydrogen concentration within the TSV headspace at less than 4.0 percent during normal operations, which prevents a deflagration that could challenge PSB integrity. The UPSS is assumed to be available and thus to provide sufficient battery capacity for essential loads for their required runtime as described in SHINE FSAR table 8a2.2-1. Resupply of N2PS is assumed to occur

13-52 within three days following a LOOP which is considered to be a safety-related maintenance activity in accordance with SHINE TS 5.4. The procedures would be performed by the SHINE ERO whose members are trained and qualified to perform their duties in accordance with SHINE TS 5.5.2.

Consistent with NUREG-1537, Part 2, the NRC staff confirmed that SHINE assessed that the sequence of events for a long-term LOOP, during normal operations, will start with the UPSS automatically maintaining power supply to the 125 VDC UPSS buses A and B. Each NDAS HVPS deenergizes and the associated irradiation processes are secured. The TSV dump valves open, draining the target solution in the TSVs to their respective TSV dump tanks. The PCLS loses power to its pumps and forced convection cooling ceases while heat is removed by natural convection to the light water pool. Hydrogen generation in the TSV dump tanks continues to occur due to radiolysis from the decay of fission products. The TOGS blowers and recombiner heaters operate on UPSS power for at least 5 minutes. The blowers continue forced flow through the TOGS recombiners for a short period of time as hydrogen production levels decrease and bubbles leave the target solution. The N2PS begins passively injecting nitrogen gas into the primary system boundary. Nitrogen gas is injected in the eight subcritical assembly systems via a connection to the TSV dump tank. The nitrogen gas purges the primary system boundary of hydrogen leaving through a vent connection from the TOGS to the PVVS system header. The gas then passes through the PVVS carbon delay beds which have a minimum efficiency for iodine of 99 percent for removal of fission product gases before release to the environment. The N2PS has enough nitrogen capacity for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, after which the system is resupplied.

For transfer operations of target solution from the TSV dump tanks to the RPF, the VTS operation is automatically secured. Nitrogen gas sweeps RPF process tank and lift tank headspaces to dilute radiolytic hydrogen. Nitrogen from the N2PS is routed to the PVVS carbon beds for removal of fission product gases before release to the environment.

Consistent with NUREG-1537, Part 2, the NRC staff confirmed that SHINE identified the safety controls credited for mitigation of the dose consequences for this accident, which are:

UPSS; NDAS HVPS breakers; N2PS; TSV dump valves; and Light water pool.

The safety-related functions of the equipment supplied by the UPSS are uninterrupted; therefore, the safety-related functions continue to be performed to place the target solution in a safe shutdown condition without the need for operator action. Irradiation processes stop and the target solution is drained from operating TSVs to their respective TSV dump tanks. Decay heat is removed by natural convection to the light water pool. The combustible gas management system eliminates the risk of a release of radioactive material due to deflagration. The combined systems prevent challenges to the integrity of the pressure system boundary as no design limits are exceeded. No equipment damage results from the postulated LOOP event. No releases of

13-53 radioactive material are expected to occur as a result of the event. Therefore, because no postulated LOOP event result in the loss of safety functions of the equipment supplied by the UPSS, no design limits are exceeded, and no damage to the pressure system boundary is expected, there are no radiological consequences to the workers or the public.

The NRC staff finds that SHINEs analysis considered the effects of the radiolytic decomposition of the target solution and the formation of fission gases, addressed the system response to gas formation, and evaluated the potential for the decomposed gases to react explosively. Further, the staff finds that SHINEs analysis was carried out for a sufficient duration of time to demonstrate that the IU reaches a stable state, and that the MHA bounds the dose consequences of such postulated events. Therefore, radiological doses to the workers and the public will be within acceptable limits and the health and safety of the workers and public will be adequately protected.

The NRC staff reviewed the results of SHINEs loss of electrical power event analyses, as discussed above. The staff finds that the results of the analyses demonstrate that credible loss of electrical power events would result in no design limits being exceeded and no radiological consequences to the workers and public. Therefore, the staff concludes that SHINEs loss of electrical power event analyses are acceptable.

13a.4.6 External Events The NRC staff evaluated the sufficiency of the applicants descriptions and discussions of this DBA category using the guidance and acceptance criteria from chapter 13, Accident Analyses, of NUREG-1537, Parts 1 and 2, and the ISG augmenting NUREG-1537, Parts 1 and 2.

SHINE FSAR sections 13a2.1.6 and 13a2.2.6, External Events, identify seismic events, tornados or high winds, and a small aircraft crash as external events that can credibly affect the IF. The external events represent natural or man-made events that occur outside the facility and have the potential to impact facility SSCs and challenge the primary system boundary in the IF. The SHINE facility structure is designed to withstand credible external events. Most of the analyzed accidents involving credible external events are prevented by the facility structure or the seismic qualification of affected SSCs. SSCs, including their foundations and supports, that are required to perform their safety function(s) in the event of a design-basis earthquake (DBE) are classified as Seismic Category I. SSCs that are co-located with a Seismic Category I SSC and required to maintain their structural integrity in the event of a DBE to prevent unacceptable interactions are classified as Seismic Category II. Seismic Category II SSCs are not required to remain functional in the event of a DBE.

Consistent with NUREG-1537, Part 2, the NRC staff confirmed that SHINE systematically analyzed a series of credible scenarios for external events by postulating the following scenarios:

1.

Several seismic event scenarios.

2.

Severe weather events.

3.

Transportation accidents, including small aircraft crash into the IF or RPF, toxic gas releases, or explosions.

13-54

4.

External flooding.

5.

External fires from natural sources.

Consistent with NUREG-1537, Part 2, the NRC staff confirmed that prior to the event the system was assumed to be under normal operational conditions and that the accident sequence started with an initiator and ended in a stabilized condition. Prior to an external event occurring, the SHINE facility is assumed to be running at nominal conditions.

Consistent with NUREG-1537, Part 2, the NRC staff confirmed that SHINE identified the most limiting scenario as Scenario 3, seismic event causing multiple NDAS failures. This scenario may cause the failure of one or more NDAS units. A failure of the NDAS vacuum boundary within the IU would result in a release of tritium and sulfur hexafluoride (SF6) gas into the IU cell.

The accident analysis assumes the simultaneous failure of all eight NDASs so as to bound the maximum allowable operating state in the IF.

Consistent with NUREG-1537, Part 2, the NRC staff confirmed that SHINE identified the sequence of events for a seismic event causing multiple NDAS failures during normal operations. This sequence is that first the IU cells become slightly pressurized due to the mass of the released SF6 gas. The IU and TOGS shielded cells are equipped with removable shield plugs which allow entry into the confined area. Gaskets and other non-structural features are used, as necessary, to provide sealing where separate structural components meet. Some tritium released from the NDASs is transported into the IF through penetrations in the primary confinement boundary and then to the environment. A detection of high TPS target chamber supply pressure or high TPS target chamber exhaust pressure actuates the primary confinement boundary isolation valves and minimizes the transport of radioactive material to the environment and the IU trips within 20 seconds of detection. A sufficient time delay is provided by the holdup volume in RVZ1e to prevent radioactive gases from exiting through RVZ1e prior to isolation. The primary confinement boundary and components are assumed to remain intact and perform their mitigation function with respect to radionuclide transport from the IU cells to the IF. Failure of the NDAS vacuum boundary does not cause subsequent damage to equipment. While the NDAS vacuum boundary integrity is not seismically qualified to maintain integrity, the NDAS is designed to maintain structural integrity during and following a DBE. After the initial IU cell pressurization has reached equilibrium, leakage between the IU cells and the IF is driven primarily by barometric breathing. The MAR includes each of the eight NDASs containing the maximum tritium inventory of tritium gas.

Consistent with NUREG-1537, Part 2, the NRC staff confirmed that SHINE identified the safety controls credited for mitigation of the dose consequences for this accident, which are:

Primary confinement boundary; TPS Train Isolation on high TPS target chamber supply pressure or high TPS target chamber exhaust pressure; Ventilation isolation mechanisms; and Holdup volume in the RVZ1e.

13-55 The NRC staff finds that SHINEs analysis considered the potential system interactions between the IUs and the RPF for external events. The staff finds that the MHA bounds the dose consequences of the postulated external events scenarios. Therefore, radiological doses to the workers and the public will be within acceptable limits and the health and safety of the workers and public will be adequately protected.

The NRC staff reviewed the results of SHINEs external events analyses, as discussed above.

The staff finds that the results of the analyses demonstrate that credible external events would result in radiological consequences to the workers and public bounded by the MHA. Therefore, the staff concludes that SHINEs external events analyses are acceptable.

13a.4.7 Mishandling or Malfunction of Equipment The NRC staff evaluated the sufficiency of the applicants descriptions and discussions of this DBA category using the guidance and acceptance criteria from chapter 13, Accident Analyses, of NUREG-1537, Parts 1 and 2, and the ISG augmenting NUREG-1537, Parts 1 and 2.

SHINE FSAR sections 13a2.1.7 and 13a2.2.7, Mishandling or Malfunction of Equipment, examine scenarios where the mishandling or malfunction of equipment could lead to an accident where workers or the public are exposed to radiation. This includes scenarios where the PSB is not maintained. Scenarios related to the mishandling or malfunction of equipment that could lead to a release of target solution are reviewed in section 13a.4.4 of this SER. This section of this SER examines those scenarios that could lead to radiation exposure including the release of radioactive gases.

SHINE reviewed the category of DBAs that involve the mishandling or malfunction of equipment during normal operations and that could challenge the PSB in the IF. Within this category, SHINE also identified the MHA for the SHINE facility as a failure of the TSV TOGS pressure boundary resulting in a release of off-gas into the TOGS cell. This is a credible fission product-based DBA that bounds the radiological consequences to the public of all credible fission product-based accident scenarios.

SHINE identified the mishandling or malfunction of equipment during normal operations as a potential initiating event that could challenge the PSB in the IF. The waste gases from the irradiation of the target solution are of two major types: (1) the hydrogen and oxygen produced by the radiolysis of water in the target solution and (2) radioactive fission product gases. Failure of the TOGS portion of the PSB could allow the escape of hydrogen or fission product gases into the primary confinement boundary and the RCA. SHINE included analyses of this event and other potential mishandling or malfunction of equipment events, excluding the detonation or deflagration of hydrogen within TOGS and other exothermic chemical reactions within the PSB, which are discussed in sections 13a.4.9 and 13a.4.10, respectively, of this SER.

Consistent with NUREG-1537, Part 2, the NRC staff confirmed that SHINE systematically analyzed the mishandling or malfunction of equipment events within two broad categories. The first is spills or leaks that cause target solution to migrate into unintended locations (reviewed in section 13a.4.4 of this SER). The second is changes in the physical or chemical form of the target solution that result in adverse effects. Within this category, three specific initiating events were considered:

1.

Failure of the TOGS pressure boundary resulting in release of off-gas into the TOGS cell.

13-56

2.

Failure of the TOGS vacuum tank.

3.

TOGS vacuum makeup valve fails open.

Consistent with NUREG-1537, Part 2, the NRC staff confirmed that prior to the events the system is assumed to be under normal operational conditions. Fission product gases (e.g., Kr, Xe, and halogens) produced during irradiation operations are retained within TOGS until the target solution batch irradiation cycle is completed. As the TOGS circulates sweep gas during the irradiation cycle, a portion of the iodine is removed by the zeolite beds, and hydrogen and oxygen are recombined by the catalytic recombiners, but no other gases are removed or purged. Each IU is assumed to be operated on an irradiation cycle of 30 days with a minimum time for target solution residing in the TSV dump tank following irradiation. The MAR for these events is conservatively assumed to be the inventory at shutdown, at the end of the irradiation cycle, with the most limiting burnup. The IUs are operated independently, so that an event on one TOGS does not affect another TOGS or IU cell. The TOGS cells are isolated from the rest of the facility by robust walls, ceiling, and floor. The physical separation of individual TOGS prevents malfunctions in one TOGS from affecting the others. Penetrations for piping, ducts, and electrical cables are sealed to limit the release of radioactive materials from the confinement boundary. The TOGS cells are cooled by a recirculating air ventilation system and are isolated from all other facility ventilation systems. A single ventilation connection from the PCLS expansion tank to the RVZ1e subsystem is provided for hydrogen gas removal from the cooling systems and is isolated on a high radiation signal in the RVZ1e ventilation duct. The primary confinement boundary is assumed to be intact and perform a mitigation function with respect to radionuclide transport from the IU cell to the IF.

Consistent with NUREG-1537, Part 2, the NRC staff confirmed that SHINE identified the most limiting scenario as Scenario 1, Failure of the TOGS Pressure Boundary Resulting in Release of Off-Gas into the TOGS Cell. Consistent with NUREG-1537, Part 2, the staff confirmed that SHINE identified the sequence of events for this scenario with the initiating event being a break of the TOGS line downstream of the TOGS blower and the subsequent release of noble gases and iodine into the TOGS cell. The N2PS then actuates and pressurizes the TOGS cell through the leak in the TOGS pressure boundary. The gases in the TOGS cell leak into the IF and then into the environment.

Consistent with NUREG-1537, Part 2, the NRC staff confirmed that SHINE identified the safety controls credited for mitigation of the dose consequences for this accident, which are:

Primary confinement boundary; Ventilation radiation monitors; N2PS; Ventilation isolation mechanisms; and Holdup volume in the RVZ1e.

Prior to the event, iodine is assumed to be fully dissolved within the TSV with none present in the TSV gas space. The TSV inventory at the end of multiple years of continuous 30-day

13-57 irradiation cycles with a downtime between cycles is assumed. The power level used for the analysis is 137.5 kW, which is 110 percent of design operating power. The initial radiation source term MAR is assumed to be 25 percent of the TSV target solution inventory at the end of the multiple years of continuous 30-day irradiation cycles with a specified downtime between cycles. It is assumed that the iodine in solution is predominantly the volatile (I2) species and that aqueous to gas partitioning occurs rapidly, causing 100 percent of the iodine inventory to be released to TOGS post-shutdown. To model this, the iodine MAR was multiplied by four, essentially assuming that 100 percent of the MAR is used for the dose calculation. One hundred percent of the noble gases and iodine is assumed to be present in the TOGS gas space while it is operating. Non-volatiles are not included in this accident sequence because the system is designed as a gas-handling system.

The NRC staff evaluated SHINEs analysis of the MHA scenario for compliance with regulations, adherence to acceptable dose consequence analysis assumptions and methods as described in the above applicable regulatory codes, guides, and standards, and approved precedents. The staff also performed confirmatory accident radiological dose calculations where appropriate. The staff determined that SHINE assumed that the SSCs important to safety function as designed and that radioactive material is held up temporarily in the primary confinement boundary and then released from the building. SHINE used realistic methods to compute external radiation doses and dose commitments resulting from inhalation by the control room operator. SHINE used realistic but conservative methods to compute potential doses and dose commitments to the public in the unrestricted area. The staff determined that the methods used for calculating doses from inhalation and direct shine of gamma rays from dispersing plumes of airborne radioactive material are acceptable. The duration of the accident considered for the calculation of radiological doses is 30 days for the facility control room operator and 30 days for the public.

The calculated doses for the MHA scenario are the following:

Control room operator - 1940 mrem (1.94 rem)

Maximally exposed member of the public - 727 mrem (0.727 rem)

These doses are within the SHINE-selected radiological siting and design criteria of (1) radiological consequences to an individual located in the unrestricted area following the onset of a postulated accidental release of licensed material of not to exceed 1 rem TEDE for the duration of the accident and (2) radiological consequences to workers of not to exceed 5 rem TEDE during the accident, which the NRC staff found acceptable in section 13a.4 of this SER.

The NRC staff reviewed the results of SHINEs mishandling or malfunction of equipment event analyses, as discussed above. Due to the assumptions of the scenario being bounding, the doses calculated will likely not be exceeded by any accident considered credible. Thus, even for the MHA, whose consequences bound all fission product-based credible accidents at the facility, the NRC staff finds that the health and safety of the workers and public are adequately protected. Therefore, the staff concludes that SHINEs mishandling or malfunction of equipment event analyses are acceptable.

13-58 13a.4.8 Large Undamped Power Oscillations The NRC staff evaluated the sufficiency of the applicants descriptions and discussions of this DBA category using the guidance and acceptance criteria from chapter 13, Accident Analyses, of NUREG-1537, Parts 1 and 2, and the ISG augmenting NUREG-1537, Parts 1 and 2.

SHINE FSAR sections 13a2.1.8 and 13a2.2.8, Large Undamped Power Oscillations, describe the conditions when power oscillations may occur in the TSV in response to natural fluctuations in the target solution that result in fluctuations in reactivity. The large undamped power oscillations event during normal operations is identified as a potential initiating event that could challenge the PSB in the IF. Large undamped power oscillations are power oscillations that grow over time due to positive reactivity feedback effects and that challenge the design limits of the subcritical assembly. The design of the TSV is a subcritical assembly which can experience power oscillations within reactivity variations within the target solution. Also, the neutron driver output can oscillate which can lead to power variations. Therefore, SHINE evaluated the TSV for large undamped power oscillations as a potential event that could occur during irradiation operation due to reactivity variations in the target solution that lead to fluctuations in the keff within the irradiated target solution.

Consistent with NUREG-1537, Part 2, the NRC staff confirmed that SHINE systematically analyzed the large undamped power oscillations event by postulating the following scenarios:

1.

TOGS failure results in variations in TSV gas pressure.

2.

Variations in the neutron driver voltage, current, tritium concentration, or other parameter results in variations in the fusion-neutron production rate.

3.

Failure in the PCLS temperature control loop or RPF cooling system supply results in temperature oscillations.

Consistent with NUREG-1537, Part 2, the NRC staff confirmed that prior to the event the system was assumed to be under normal operational conditions.

Consistent with NUREG-1537, Part 2, the NRC staff confirmed that SHINE identified the safety controls credited for mitigation of the dose consequences for this accident, which are:

The design and safety characteristics of the TSV to resist undamped power oscillations; IU Cell Safety Actuation initiated by TRPS; TRPS high neutron flux trips; and TSV dump valves and TSV dump tank.

The analyses for the large undamped power oscillations event assume that negative temperature and void coefficients are within license limits and that the TRPS neutron flux setpoints are within TS limits. During startup, irradiation, and shutdown operations, TOGS regulates gas pressures in the PSB to maintain pressures within the acceptable range.

Increased gas pressures in the TSV reduce void fraction, leading to positive reactivity addition.

13-59 Excessive TSV power oscillations from TOGS pressure oscillations are prevented by redundant TRPS high neutron flux IU Cell Safety Actuation signals. The neutron driver has variability in neutron production rates due to normal variations in beam current and focusing, voltages, and tritium gas concentrations. These variations lead to corresponding variations in fission power in the subcritical assembly system. The TRPS high wide range neutron flux IU Cell Safety Actuation signal prevents excessive TSV power oscillations that challenge design limits should the neutron driver return to full power rapidly following a reduced power transient. The PCLS provides cooling water to the TSV and, therefore, temperature variations in the PCLS directly lead to TSV temperature variations. PCLS provides constant cooling water inlet temperature to the TSV. The TRPS high neutron flux IU Cell Safety Actuation signals prevent excessive TSV power oscillations from PCLS temperature variations. Therefore, there are no large undamped power oscillations that result from PCLS operation.

Consistent with NUREG-1537, Part 2, the NRC staff confirmed that SHINE demonstrated that power oscillations that may occur are self-limiting as a result of the inherent design and safety characteristics associated with the TSV, operating parameters, and system response to transients. SHINEs analyses identified that these large undamped oscillation scenarios do not results in damage to the PSB. Large power oscillations that could potentially challenge design limits are prevented by TRPS setpoints on high neutron flux. No operator actions are required to dampen power oscillations. When a TRPS high neutron flux setpoint is exceeded, the neutron driver is automatically de-energized, the TSV dump tank valves automatically open, and the target solution is dumped, by force of gravity, into the favorable geometry TSV dump tank.

Therefore, power oscillations that may occur in the subcritical assembly are self-limiting as a result of the inherent design and safety characteristics of the subcritical assembly, operating parameters, and system response to transients.

The TRPS is designed to end a large undamped power oscillations event and place the target solution in a safe shutdown condition without the need for operator action. The TRPS prevents challenges to the integrity of the PSB as no design limits are exceeded. No equipment damage results from the postulated large undamped power oscillations event and no releases of radioactive material are expected to occur as a result of the event. Therefore, because no design limits are exceeded and no damage to the PSB is expected, there are no radiological consequences to the workers or the public.

The NRC staff reviewed the results of SHINEs large undamped power oscillations event analyses, as discussed above. The staff finds that the applicant evaluated the potential for large undamped power oscillations and demonstrated that these events can be readily detected and suppressed so that the TSV reaches a stable state. The applicant considered the potential for positive feedback to arise due to system interaction. The staff finds that the power oscillations at the SHINE facility should be stable or can be readily detected and suppressed so that the consequences are bounded by the MHA. The staff finds that radiological doses to the workers and the public are within acceptable limits and that the health and safety of the workers and public are adequately protected. Therefore, the staff concludes that SHINEs large undamped power oscillations event analyses are acceptable.

13a.4.9 Detonation and Deflagration The NRC staff evaluated the sufficiency of the applicants descriptions and discussions of this DBA category using the guidance and acceptance criteria from chapter 13, Accident Analyses, of NUREG-1537, Parts 1 and 2, and the ISG augmenting NUREG-1537, Parts 1 and 2.

13-60 SHINE FSAR sections 13a2.1.9 and 13a2.2.9, Detonation and Deflagration in the Primary System Boundary, examine the effects of a possible hydrogen detonation or deflagration within the PSB on the IF. Irradiating the target solution produces significant quantities of hydrogen and oxygen through radiolysis and small amounts of fission product gases. The TOGS is designed to control the level of hydrogen and oxygen so that a deflagration or detonation does not occur.

The hydrogen and oxygen are recombined, condensed, and returned as water to the TSV by the TOGS.

The detonation and deflagration in the PSB event during normal operations is identified by SHINE as a potential initiating event that could challenge the PSB in the IF. The design of the TOGS is the primary control for mitigating hazards associated with the gases evolved from the irradiation of the target solution. Functional requirements for the TOGS include maintaining the concentration of hydrogen to less than the lower flammability limit, recombining the hydrogen and oxygen, and returning the recombined water back to the TSV. The TOGS functions largely as a closed loop during the irradiation process, with gas additions and removals as needed to maintain proper functioning. The TOGS is purged as needed to the PVVS via the VTS.

Consistent with NUREG-1537, Part 2, the NRC staff confirmed that SHINE systematically analyzed the detonation and deflagration in the PSB event by postulating the following scenarios:

1.

Target solution off-gas system failure resulting in hydrogen deflagration.

2.

PCLS radiolysis resulting in hydrogen deflagration.

Consistent with NUREG-1537, Part 2, the NRC staff confirmed that prior to the event the system was assumed to be under normal operational conditions. A hydrogen deflagration produces a maximum overpressure condition of 65 pounds per square inch absolute (psia). Each TSV is serviced by a dedicated and independent TOGS. For this event, it is assumed that a single TOGS fails, allowing hydrogen to accumulate in the TSV and TSV dump tank. The target solution is assumed to be at steady-state conditions at 110 percent of the licensed power limit when the TOGS failure occurs. This is conservative since it results in the maximum hydrogen generation rate in the target solution.

Consistent with NUREG-1537, Part 2, the NRC staff confirmed that SHINE identified the most limiting scenario as Scenario 1, TOGS Failure Resulting in Hydrogen Deflagration. A TOGS failure may occur due to flow blockage or failure of the TOGS blowers, loss of sweep gas flow to the TSV dump tank, or overfilling the TSV which causes a reduction of available headspace and sweep gas flow. The loss of TOGS functionality allows the hydrogen gas concentration to increase in the headspace in the TSV and/or TSV dump tank. The hydrogen gas may ignite and cause a deflagration in the PSB.

Consistent with NUREG-1537, Part 2, the NRC staff confirmed that SHINE identified the sequence of events for a failure of the TOGS resulting in hydrogen deflagration during normal operations. The failure of a single TOGS blower will result in a complete loss of flow through the affected train and total loss of TSV dump tank flow. The other single TOGS blower continues to operate normally. The TRPS detects the loss of flow and executes an IU Cell Safety Actuation and IU cell N2PS actuates. The IU Cell Safety Actuation opens the TSV dump valves and NDAS HVPS breakers, terminating the irradiation process. Hydrogen generation in the TSV and TSV dump tank continues due to radiolysis caused by delayed fission and decay radiation.

13-61 Hydrogen evolution from the target solution occurs at an increased rate as target solution voids collapse. Within four seconds, N2PS is at full flow to the TSV dump tank. Hydrogen and other gases are vented to PVVS through the combustible gas management system exhaust point.

Gases pass through the PVVS carbon guard and carbon delay beds before being exhausted from the building at the safety-related exhaust point. The remaining TOGS blower continues operation for a minimum of five minutes. The combined action of the remaining TOGS blower and the N2PS maintains the peak hydrogen concentration as described in the SHINE FSAR; therefore, the peak pressure will not exceed the design pressure of the PSB if a deflagration were to occur and no radiological materials would be released. Detonations cannot occur because this peak hydrogen concentration is less than the lower detonation limit. As delayed fission and decay of short-lived radionuclides decline, the production and evolution of hydrogen declines following shutdown and draining of the TSV to the TSV dump tank. The N2PS continues to provide sweep gas for diluting and removing any remaining hydrogen for a period of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. Resupply of N2PS within three days is considered to be a safety-related maintenance activity in accordance with SHINE TS 5.4. The procedures would be performed by the SHINE ERO whose members are trained and qualified to perform their duties in accordance with SHINE TS 5.5.2.

Consistent with NUREG-1537, Part 2, the NRC staff confirmed that SHINE identified the safety controls credited for mitigation of the dose consequences for this accident, which are:

TOGS capable of maintaining hydrogen concentration within design limits, assuming the worst case single active failure following IU trip; TOGS low-flow trips (TRPS function);

TOGS oxygen sensor, which detects incipient degradation or failure; TOGS demister high temperature trips (TRPS function), which detect incipient degradation or failure of N2PS; TSV fill line isolation valves mode-permissive interlock; TSV overflow lines to the TSV dump tank; TSV dump tank level sensors (TRPS function);

TSV dump tank low-flow sensors (TRPS function);

TSV target solution dump on dump tank level sensors (TRPS function);

PCLS expansion tank flame arrestor; N2PS; Radiation detection in RVZ1e exit from PCLS expansion tank; and Isolation valves in RVZ1e exit from PCLS expansion tank.

13-62 The system prevents challenges to the integrity of the PSB as no design limits are exceeded. If hydrogen deflagration occurs at the peak calculated hydrogen concentration, the PSB remains intact. Damage to other primary system components internal to TOGS in the affected train may occur; however, such damage will not result in any release of radiological material. No releases of radioactive material are expected to occur as a result of the detonation and deflagration in the PSB events described above. Therefore, because no design limits are exceeded and no damage to the PSB is expected, there are no radiological consequences to the workers or the public.

The NRC staff reviewed the results of SHINEs detonation and deflagration in the PSB event analyses, as discussed above. The staff finds that the applicant evaluated the consequences of potential deflagrations or detonations of combustible gases within the PSB. Further, the staff finds that the assumptions regarding the impact of potential deflagrations or detonations on PSB integrity are valid. The staff finds that the MHA bounds the dose consequences of the limiting credible detonation within the PSB. The staff finds that the radiological doses to the workers and the public will be within acceptable limits and the health and safety of the workers and public will be adequately protected. Therefore, the staff concludes that SHINEs detonation and deflagration in the PSB event analyses are acceptable.

13a.4.10 Unintended Exothermic Chemical Reactions Other Than Detonation The NRC staff evaluated the sufficiency of the applicants descriptions and discussions of this DBA category using the guidance and acceptance criteria from chapter 13, Accident Analyses, of NUREG-1537, Parts 1 and 2, and the ISG augmenting NUREG-1537, Parts 1 and 2.

As described in SHINE FSAR sections 13a2.1.10 and 13a2.2.10, Unintended Exothermic Chemical Reactions Other than Detonation, there is no potential for the target solution to undergo any significant exothermic chemical reactions. The unintended exothermic chemical reactions other than detonation event during normal operations is identified by SHINE as a potential initiating event that could challenge the PSB in the IF. The FSAR examines safety aspects of exothermic chemical reactions that challenge the PSB integrity in the IF, other than hydrogen deflagrations and detonations, which are discussed in section 13a.4.9 of this SER.

Consistent with NUREG-1537, Part 2, the NRC staff finds that SHINE identified credible unintended exothermic chemical reactions other than the detonation scenarios. Specifically, SHINE systematically analyzed the uranium metal-water reaction in the neutron multiplier assembly event. Possible causes of breaches of the neutron multiplier assembly cladding that would allow water to come into direct contact with the natural uranium metal in the neutron multiplier assembly include corrosion of the neutron multiplier cladding, uranium metal-cladding interaction due to radiation-induced growth, or other mechanical damage incurred during maintenance. Such a breach may occur at any time during the lifecycle of the neutron multiplier allowing water intrusion over an extended period of time.

Consistent with NUREG-1537, Part 2, the NRC staff confirmed that prior to the event the system was assumed to be under normal operational conditions. The PCLS provides cooling to the TSV and the neutron multiplier and transfers gases produced from radiolysis to the expansion tank.

The neutron multiplier radionuclide inventory is developed assuming 30 years of continuous operation at 137.5 kW, which is 110 percent of the licensed power limit.

Consistent with NUREG-1537, Part 2, the NRC staff confirmed that SHINE identified the most limiting scenario as Scenario 1, Uranium Metal-Water Reaction in the Neutron Multiplier

13-63 Assembly. Water intrusion is assumed to result in an exothermic uranium metal-water reaction in the neutron multiplier assembly. This reaction would generate hydrogen gas inside the neutron multiplier cladding shell. An accumulation of hydrogen gas could result in a deflagration under certain conditions. These conditions include sufficient oxygen concentration, an ignition source, or autoignition temperatures being reached. In this scenario, the hydrogen produced is prevented from potential deflagration by using certain materials within the neutron multiplier.

Hydrogen gas that migrates into the PCLS stream from the neutron multiplier leak accumulates in the expansion tank, which is vented to the RVZ1e.

Consistent with NUREG-1537, Part 2, the NRC staff confirmed that SHINE identified the sequence of events, following the assumed cladding breech, that result in an exothermic uranium metal-water reaction generating hydrogen. The presence of certain material in the neutron multiplier inhibits a potential deflagration. Small amounts of hydrogen gas migrate into the PCLS and travel to the PCLS expansion tank, along with hydrogen normally generated in the PCLS itself via radiolysis. The expansion tank is vented to RVZ1e to prevent hydrogen accumulation in that tank. Small amounts of fission products from the multiplier also migrate into the PCLS water. The presence of fission products in excess of normal operating levels is detected via in-line radiation monitoring installed in the exhaust of the PCLS expansion tank.

Consistent with NUREG-1537, Part 2, the NRC staff confirmed that SHINE identified the safety controls credited for mitigation of the dose consequences for this accident to be the design of the neutron multiplier which inhibits deflagration.

Consistent with NUREG-1537, Part 2, the NRC staff confirmed that SHINE evaluated the consequences of potential unintended exothermic chemical reactions (other than explosions) that could occur within the PSB. As a precursor to this event, an excess of gases could accumulate in the PSB and subsequently react with oxygen to release heat. The heat could increase pressure within the PSB or induce thermal stress on the PSB.

The NRC staff reviewed the results of SHINEs unintended exothermic chemical reactions other than detonation event analyses, as discussed above. The staff finds that the applicant identified the types of possible exothermic reactions and evaluated their consequences. The staff finds that the MHA bounds the dose consequences of the limiting unintended exothermic chemical reaction within the PSB. The staff finds that the radiological doses to the workers and the public will be within acceptable limits and the health and safety of the workers and public will be adequately protected. Therefore, the staff concludes that SHINEs unintended exothermic chemical reactions other than detonation event analyses are acceptable.

13a.4.11 System Interaction Events The NRC staff evaluated the sufficiency of the applicants descriptions and discussions of this DBA category using the guidance and acceptance criteria from chapter 13, Accident Analyses, of NUREG-1537, Parts 1 and 2, and the ISG augmenting NUREG-1537, Parts 1 and 2.

As described in SHINE FSAR sections 13a2.1.11 and 13a2.2.11, System Interaction Events, the applicant considered events that could result from system interactions within the IF and interactions between the IF and RPF. The system interaction events during normal operations are identified by SHINE as potential initiating events that could challenge the PSB in the IF.

SHINE identified three categories of system interaction events. Consistent with NUREG-1537,

13-64 Part 2, the NRC staff confirmed that SHINE systematically analyzed the credible system interaction events, which were categorized as follows:

1.

Functional Interactions:

a. loss of offsite power;

b. reduction of cooling; and

c. loss of ventilation:

i. loss of normal ventilation to the IU or TOGS and ii. loss or normal ventilation to primary cooling rooms.

2.

Spatial Interactions:

a. fires;

b. exothermic chemical reaction;

c. internal flooding; and

d. dynamic effects.

3.

Human-Intervention Interactions.

SHINE defined Functional Interactions to be interactions between systems or subsystems that result from a common interface. A functional interaction exists if the operation of one system can affect the performance of another system or subsystem. An adverse functional interaction exists when the operation and/or performance of an (initiating) system adversely affects the operation and/or performance of an SSC as it performs its safety-related function. Functional interaction events are those that may result from failures in support systems or other shared systems that could result in an adverse impact on the PSB.

SHINE defines Spatial Interactions to be interactions resulting from the presence of two or more systems in a location. Spatial interactions include a single event that could impact the operation of the adjacent systems, or the failure of one system that may impact the operation of another system.

SHINE defines Human-Intervention Interactions to be adverse system interactions caused by human errors in the RPF which can cause adverse system performance in the subcritical assembly during irradiation operations.

The identified system interaction events are discussed in other sections of the SHINE FSAR and evaluated in other sections of this SER, with the exception of the following scenarios:

1.

Loss of normal ventilation to the IU or TOGS.

2.

Loss of normal ventilation to primary cooling rooms.

13-65 Consistent with NUREG-1537, Part 2, the NRC staff confirmed that SHINE identified the sequence of events for the loss of normal ventilation to the IU or TOGS as being caused by a failure of an RVZ1 blower or cooler, including a loss of cooling water. Loss of normal ventilation to individual IUs or TOGSs may also be caused by a failed-shut or mispositioned damper or other equipment failure. A loss of cooling may cause instrumentation inaccuracies or failures which may lead to TOGS maloperation or loss of function. This can result in a potential deflagration and release of radiological material. The protections in place to prevent a TOGS failure due to a loss of normal ventilation are redundant and environmentally qualified TOGS instrumentation (e.g., low-flow) that initiates a TRPS signal if TOGS failures are detected. The TRPS signal opens redundant TSV dump valves draining target solution to the TOGS dump tank and shuts down the IU. Decay heat from the target solution is removed by the light water pool.

Consistent with NUREG-1537, Part 2, the NRC staff confirmed that SHINE identified the sequence of events for the loss of normal ventilation to primary cooling rooms as being caused by a failure of an RVZ2 blower or cooler, including a loss of cooling water. Loss of normal ventilation to individual primary cooling rooms may also be caused by a failed-shut or mispositioned damper or other equipment failure. A failure of normal ventilation may lead to increased environmental temperatures within the primary cooling room with a potential for increased instrument inaccuracies or failure. The consequences of an RVZ2 failure leading to equipment malfunction may result in TSV overcooling causing a reactivity insertion in the TSV which is discussed in the excess reactivity insertion event section of this SER.

Consistent with NUREG-1537, Part 2, the NRC staff confirmed that SHINE identified that the safety controls in place to prevent TSV malfunctions related to ventilation failures are redundant low-and high PCLS temperature trip that initiates a TRPS signal. The TRPS signal opens redundant TSV dump valves draining target solution to the TSV dump tank and shuts down the IU. Decay heat from the target solution is removed by the light water pool system.

There are no unique initial conditions or assumptions associated with system interaction events.

Based on the preventive controls, the failure of normal ventilation does not have radiological consequences, and no further analysis is necessary.

The NRC staff reviewed the results of SHINEs system interaction events analyses, as discussed above. The staff finds that the applicant considered potential system interactions between the IF and the RPF. Further, the staff finds that the MHA bounds the dose consequences of these postulated events. The staff finds that the radiological doses to the workers and the public will be within acceptable limits and the health and safety of the workers and public will be adequately protected. Therefore, the staff concludes that SHINEs system interaction events analyses are acceptable.

13a.4.12 Facility-Specific Events The NRC staff evaluated the sufficiency of the applicants descriptions and discussions of this DBA category using the guidance and acceptance criteria from chapter 13, Accident Analyses, of NUREG-1537, Parts 1 and 2, and the ISG augmenting NUREG-1537, Parts 1 and 2.

As described in SHINE FSAR sections 13a2.1.12 and 13a2.2.12, Facility-Specific Events, the applicant considered facility-specific events during normal operations that could challenge the PSB in the IF. Identified facility-specific accident scenarios are associated with the neutron driver assembly system, the TPS, and potential damage resulting from heavy load drops.

13-66 Consistent with NUREG-1537, Part 2, the NRC staff confirmed that SHINE systematically analyzed the credible facility-specific events, which were categorized as follows:

NDAS Events:

1. Inadvertent exposure to neutrons within the IU;

2. Inadvertent exposure to neutrons within the NDAS service cell;

3. Catastrophic failure of the NDAS; and

4. NDAS vacuum boundary failure.

TPS Events:

1. TPS piping failure due to deflagration;

2. Release of tritium into the IF due to glovebox deflagration;

3. Release of tritium to the facility stack;

4. Excessive release of tritium from the tritium storage bed; and

5. Release of tritium into the IF due to TPS-NDAS interface line mechanical damage.

Heavy Load Drop Events:

1. Heavy load drop into an open IU cell;

2. Heavy load drop onto an in-service IU cell; and

3. Heavy load drop onto TPS equipment.

Consistent with NUREG-1537, Part 2, the NRC staff confirmed that prior to the event the system was assumed to be under normal operational conditions for accident scenarios involving the NDAS. The NDAS was assumed to contain the bounding inventory of tritium gas for full power.

The NDAS pressure vessel was assumed to contain the maximum inventory of SF6 gas. The primary confinement boundary for an affected IU cell is operable, including the RVZ1e radiation detection and isolation valves.

Consistent with NUREG-1537, Part 2, the NRC staff confirmed that prior to the event the system was assumed to be under normal operational conditions for accident scenarios involving the TPS. The TPS glovebox confinement is operable, including the confinement isolation valves.

The glovebox has a helium atmosphere. Automatic isolation valves are installed in the system to isolate sections of the system to minimize system release. Leakage of tritium from the glovebox enclosure or the external piping is detected by the continuous airborne monitoring system or other leakage detection systems to provide alarms for facility personnel evacuation. The TPS-NDAS interface lines were assumed to contain the maximum inventory of tritium gas.

13-67 Consistent with NUREG-1537, Part 2, the NRC staff confirmed that prior to the event the system was assumed to be under normal operational conditions for accident scenarios involving heavy load drops. An IU cell was assumed to be in maintenance when either the IU cell shielding plug is removed with the TSV and neutron diver assembly system is empty or an IU cell was assumed to be in-service when the IU cell shielding plug is in place.

Consistent with NUREG-1537, Part 2, the NRC staff determined that most of the facility-specific events do not have radiological consequences. The events that do have radiological consequences are related to the release of tritium into the facility from the neutron driver assemblies or from the TPS. Consistent with NUREG-1537, Part 2, the NRC staff confirmed that SHINE identified the most limiting scenario as TPS Scenario 1, TPS Piping Failure due to Deflagration.

Consistent with NUREG-1537, Part 2, the NRC staff confirmed that SHINE identified the sequence of events, which begin with the initiating event of a vacuum boundary component failure in the NDAS, which is assumed to instantaneously releases tritium and SF6 gas into the IU cell. The IU cell becomes slightly pressurized due to the mass of the released SF6 gas.

Tritium is then transported into the IF through penetrations in the confinement boundary and then to the environment. A detection of high TPS target chamber supply pressure or high TPS target chamber exhaust pressure actuates the primary confinement boundary isolation valves and the ventilation dampers between the RCA and the environment and minimizes the transport of radioactive material to the environment and the IU trips within 20 seconds of detection. A sufficient time delay is provided by the holdup volume in RVZ1e to prevent radioactive gases from exiting through RVZ1e prior to isolation. Personal dosimeters, local radiation alarms, and alarms in the facility control room notify facility personnel of radiation leakage.

Consistent with NUREG-1537, Part 2, the NRC staff confirmed that SHINE identified the safety controls credited for mitigation of the dose consequences for this accident, which are:

Primary confinement boundary (IU cell plugs and seals);

TPS Train Isolation on high TPS target chamber supply pressure or high TPS target chamber exhaust pressure; IU cell ventilation isolations; Holdup volume in the RVZ1e; and Emergency procedures.

In addition, TPS glovebox deflagration is prevented by the use of helium in the TPS glovebox gas space and it being designed with a minimum volume to prevents deflagration conditions.

The NRC staff reviewed the results of SHINEs facility-specific events analyses, as discussed above. The staff finds that the applicants analysis considered potential facility-specific events.

Further, the staff finds that the MHA bounds the dose consequences of these postulated events.

The staff finds that the radiological doses to the workers and the public will be within acceptable limits and the health and safety of the workers and public will be adequately protected.

Therefore, the staff concludes that SHINEs facility-specific events analyses are acceptable.

13-68 13a.5 Review Findings The NRC staff reviewed the descriptions and discussions of the final SHINE IF accident analysis, as described in SHINE FSARsection 13a2, as supplemented, against the applicable regulatory requirements and using appropriate regulatory guidance and acceptance criteria.

Based onits review of the information in the FSAR and independent confirmatory review, as appropriate, the NRC staff determined that:

(1)

SHINE described theaccident analysisof the IF and identified the major features or components incorporated therein for the protection of the health and safety of thepublic.

(2)

The processes to be performed,the operating procedures, the facility andequipment, the use of the facility,and other TSs provide reasonable assurance that theapplicant will comply with the applicable regulations in 10 CFR Part 50 and 10 CFR Part20 and that the health and safety of the public willbeprotected.

(3)

The issuance of an operating licensefor thefacility would not be inimical to the common defense and security or to the health and safety of thepublic.

Based on the above determinations, the NRC staff finds that the descriptions and discussions of the final SHINE IF accident analysis are sufficient and meet the applicable regulatory requirements and guidance and acceptance criteria for the issuance of an operating license.

13-69 13b Radioisotope Production Facility Accident Analysis SER section 13b, Radioisotope Production Facility Accident Analysis, provides an evaluation of the final accident analysis of SHINEs RPF as presented in SHINE FSAR section 13b, Radioisotope Production Facility Accident Analyses, within which SHINE described accident -initiating events and scenarios, as well as the accident analysis and determination of consequences.

13b.1 Areas of Review The NRC staff reviewed SHINE FSAR section 13b against applicable regulatory requirements, using appropriate regulatory guidance and acceptance criteria, to assess the sufficiency of the final RPF accident analysis. The final RPF accident analysis was evaluated to ensure that the accident analysis is presented in sufficient detail to allow a clear understanding of the facility and that the facility can be operated for its intended purpose and within regulatory limits for ensuring the health and safety of the operating staff and the public. SSCs were also evaluated to ensure that they would adequately provide for the prevention of accidents and the mitigation of consequences of accidents. The staff considered the final analysis and evaluation of the design and performance of the SSCs of the SHINE facility, including those SSCs shared by both the IF and RPF, with the objective of assessing the risk to public health and safety resulting from the operation of the facility.

13b.2 Summary of Application SHINE FSAR section 13b identifies and describes the postulated initiating events and credible accidents that form the design basis for the SHINE RPF. The FSAR also describes the accident analysis and determination of consequences for the RPF. The FSAR provides details on event categories covering the MHA and credible accidents related to the RPF, which are loss of electrical power, external events, RPF critical equipment malfunction, RPF inadvertent nuclear criticality, RPF fire, and analyses of accidents with hazardous chemicals.

13b.3 Regulatory Requirements and Guidance and Acceptance Criteria The NRC staff reviewed SHINE FSAR section 13b against the applicable regulatory requirements, using appropriate regulatory guidance and acceptance criteria, to assess the sufficiency of the final RPF accident analysis for the issuance of an operating license.

13b.3.1 Applicable Regulatory Requirements The applicable regulatory requirements for the evaluation of SHINEs RPF accident analysis are as follows:

10 CFR 50.34, Contents of applications; technical information, paragraph (b),

Final safety analysis report 10 CFR 50.36, Technical specifications 10 CFR 50.40, Common Standards

13-70 10 CFR 50.57, Issuance of operating license 10 CFR Part 20, Standards for Protection Against Radiation 13b.3.2 Applicable Regulatory Guidance and Acceptance Criteria In determining the regulatory guidance and acceptance criteria to apply, the NRC staff used its technical judgment, as the available guidance and acceptance criteria were typically developed for nuclear reactors. Given the similarities between the SHINE facility and non-power research reactors, the staff determined to use the following regulatory guidance and acceptance criteria:

NUREG-1537, Part 1, Guidelines for Preparing and Reviewing Applications for the Licensing of Non-Power Reactors, Format and Content, issued February 1996.

NUREG-1537, Part 2, Guidelines for Preparing and Reviewing Applications for the Licensing of Non-Power Reactors, Standard Review Plan and Acceptance Criteria, issued February 1996.

Final Interim Staff Guidance Augmenting NUREG-1537, Part 1, Guidelines for Preparing and Reviewing Applications for the Licensing of Non-Power Reactors: Format and Content, for Licensing Radioisotope Production Facilities and Aqueous Homogeneous Reactors, dated October 17, 2012.

Final Interim Staff Guidance Augmenting NUREG-1537, Part 2, Guidelines for Preparing and Reviewing Applications for the Licensing of Non-Power Reactors: Standard Review Plan and Acceptance Criteria, for Licensing Radioisotope Production Facilities and Aqueous Homogeneous Reactors, dated October 17, 2012.

As stated in the ISG augmenting NUREG-1537, the NRC staff determined that certain guidance originally developed for heterogeneous non-power research and test reactors is applicable to aqueous homogenous facilities and production facilities. SHINE used this guidance to inform the design of its facility and to prepare its FSAR. The staffs use of reactor-based guidance in its evaluation of the SHINE FSAR is consistent with the ISG augmenting NUREG-1537.

As appropriate, the NRC staff used additional guidance (e.g., NRC regulatory guides, IEEE standards, ANSI/ANS standards, etc.) in the review of the SHINE FSAR. The additional guidance was used based on the technical judgment of the reviewer, as well as references in NUREG1537, Parts 1 and 2; the ISG augmenting NUREG-1537, Parts1 and 2; and the SHINE FSAR. Additional guidance documents used to evaluate the SHINE FSAR are provided as references in Appendix B, References, of this SER.

13b.4 Review Procedures, Technical Evaluation, and Evaluation Findings The NRC staff performed a review of the technical information presented in SHINE FSAR section 13b, as supplemented, to assess the sufficiency of the final SHINE RPF accident analysis for the issuance of an operating license. The sufficiency of the final accident analysis is determined by ensuring that it meets applicable regulatory requirements, guidance, and acceptance criteria, as discussed in section 13b.3, Applicable Regulatory Guidance and

13-71 Acceptance Criteria, of this SER. The results of this technical evaluation are summarized in section 13b.5, Review Findings, of this SER.

13b.4.1 Accident Initiating Events SHINE identified for the RPF credible DBA scenarios that range from anticipated events, such as a loss of electrical power, to events that, while still credible, are considered unlikely to occur during the lifetime of the facility. Within the RPF, irradiated target solution is processed for radioisotope extraction and purification. Other processes occurring within the RPF include target solution processes for reuse, waste handling, and product packaging. SHINE performed the accident analysis of the RPF using the same methodology as the accident analysis of the IF described in Accident Analysis Consequence Methodology, of section 13a.4 of this SER.

Processes that are conducted in the RPF fall into the following categories:

Operations with SNM:

Irradiated target solution processed for radioisotope extraction; Irradiated target solution processed for reuse or for waste disposal; and Operations with unirradiated SNM.

Radiochemical operations.

Operations with hazardous chemicals.

The RPF DBA categories that bound credible accident sequences are as follows:

MHA (SHINE FSAR section 13b.2.1);

Loss of Electrical Power (SHINE FSAR section 13b.2.2);

External Events (SHINE FSAR section 13b.2.3);

RPF Critical Equipment Malfunction (i.e., Mishandling or Malfunction of Equipment) (SHINE FSAR section 13b.2.4);

RPF Inadvertent Nuclear Criticality (SHINE FSAR section 13b.2.5);

RPF Fire (SHINE FSAR section 13b.2.6); and Hazardous Chemical Accidents (SHINE FSAR section 13b.3).

Table 13-5 of this SER lists the DBA TEDE results for the public and the control room operator.

13b.4.3 Maximum Hypothetical Accident SHINE identified the MHA as the failure of the TSV TOGS pressure boundary resulting in a release of off-gas into the TOGS cell within the IF. This is a credible fission product-based DBA that bounds the radiological consequences for all other DBA categories except for the special-case tritium release DBA. The NRC staffs review of the MHA event is in section 13a.4.7 of this SER.

13-72 13b.4.4 Loss of Normal Electric Power The NRC staff evaluated the sufficiency of the applicants descriptions and discussions of this DBA category using the guidance and acceptance criteria from chapter 13, Accident Analyses, of NUREG-1537, Parts 1 and 2, and the ISG augmenting NUREG-1537, Parts 1 and 2.

SHINE FSAR section 13b.2.2, Loss of Electrical Power, describes that the LOOP event was evaluated in the accident analysis as an initiating event for a number of critical equipment malfunction scenarios. A facility-wide LOOP results in automatic actuation of multiple facility engineered safety features, which act to ensure that the risk associated with radiological or chemical releases is reduced to within acceptable limits. The facility-wide LOOP does not result in system or component failures within the RPF that result in unacceptable radiological or chemical consequences. The facility-wide LOOP analyses are further discussed in section 13a.4.5 of this SER.

13b.4.5 External Events The NRC staff evaluated the sufficiency of the applicants descriptions and discussions of this DBA category using the guidance and acceptance criteria from chapter 13, Accident Analyses, of NUREG-1537, Parts 1 and 2, and the ISG augmenting NUREG-1537, Parts 1 and 2.

SHINE FSAR section 13b.2.3, External Events, identifies seismic events, severe weather, flooding, and external fires as external events that can credibly affect the RPF. The external events represent natural or man-made events that occur outside the facility and have the potential to impact facility SSCs and challenge the integrity of the RPF process tanks containing irradiated uranyl sulfate. The SHINE facility structure is designed to withstand credible external events. Most of the analyzed accidents involving credible external events are prevented by the facility structure or the seismic qualification of affected SSCs. SSCs, including their foundations and supports, that are required to perform their safety function(s) in the event of a DBE are classified as Seismic Category I. SSCs that are co-located with a Seismic Category I SSC and required to maintain their structural integrity in the event of a DBE to prevent unacceptable interactions are classified as Seismic Category II. Seismic Category II SSCs are not required to remain functional in the event of a DBE. The facility-wide external events analyses are further discussed in section 13a.4.6 of this SER.

13b.4.6 Mishandling or Malfunction of Equipment The NRC staff evaluated the sufficiency of the applicants descriptions and discussions of this DBA category using the guidance and acceptance criteria from chapter 13, Accident Analyses, of NUREG-1537, Parts 1 and 2, and the ISG augmenting NUREG-1537, Parts 1 and 2.

SHINE FSAR section 13b.2.4, RPF Critical Equipment Malfunction, presents the evaluation of a mishandling or malfunction of equipment that leads to a loss of control of radiological material within the RPF. Two types of solutions are present in the RPF supercell: (1) irradiated target solution and (2) product eluate solutions. Spills of these solutions are analyzed to determine their radiological consequences. Multiple scenarios were identified as having potential radiological consequences and were selected for additional evaluation.

13-73 Consistent with NUREG-1537, Part 2, the NRC staff confirmed that SHINE systematically analyzed a series of credible scenarios of mishandling of, or malfunction involving, target solution and product eluate solutions by postulating the following scenarios:

Scenario 1 - Spill of Target Solution in the Supercell (MEPS Column Misalignment)

Scenario 2 - Spill of Target Solution in the Supercell (MEPS Over-pressurization)

Scenario 3 - Spill of Molybdenum Eluate Solution in the Supercell (Overfill or Drop of Rotovap Flask)

Scenario 4 - Spill of Target Solution in the Supercell (IXP Column Misalignment)

Scenario 5 - Spill of Target Solution in the Supercell (IXP Over-pressurization)

Scenario 6 - Spill of Target Solution in the Supercell (Liquid Nitrogen Leak in IXP Hot Cell)

Scenario 7 - Spill of Iodine Solution in the Supercell (Overfill or Drop of Iodine Solution Bottle)

Scenario 8 - Spill of Target Solution in the Pipe Trench from a Single Pipe Scenario 9 - Spill of Target Solution in the Pipe Trench from Multiple Pipes Scenario 10 - Spill of Target Solution in a Tank Vault (Hold Tank Leak or Rupture)

Scenario 11 - Spill of Target Solution in a Tank Vault (Hold Tank Deflagration)

Scenario 12 - Spill of Target Solution in a Tank Vault (Seismic Event)

Scenario 13 - Spill of Molybdenum Eluate in the Supercell (Deflagration)

Scenario 14 - Target Solution Leaking out of the Supercell (MEPS Preheater Tube Leak)

Scenario 15 - Extraction Column Three-Way Valve Misalignment Scenario 16 - Spill of Target Solution in a Valve Pit (Pipe Rupture or Leak)

Scenario 17 - Spill of Radioactive Liquid Waste in the RLWI Shielded Enclosure Scenario 18 - Heavy Load Drop onto RLWI Shielded Enclosure or Supercell Scenario 19 - Heavy Load Drop onto a Tank Vault or Pipe Trench Cover Block

13-74 Consistent with NUREG-1537, Part 2, the NRC staff confirmed that SHINE identified the most limiting scenario as Scenario 17, Spill of Radioactive Liquid Waste in the RLWI Shielded Enclosure, where the event is caused by a break and leak within the RLWI enclosure of the immobilization feed tank or RLWI system piping containing waste solution.

Consistent with NUREG-1537, Part 2, the NRC staff confirmed that prior to the events the system was assumed to be under normal operational conditions. A 380-liter batch of waste solution (diluted target solution) is present in the RLWI system immobilization feed tank at the time of the initiating event. The volume of solution in this scenario is based on the volume of the immobilization feed tank with a conservative scaling factor to account for the highest allowable concentration of radionuclides. The waste solution was assumed to have been irradiated using the assumptions in SHINE FSAR section 13a2.2 and been held for decay for 35 days post-shutdown. The post-shutdown hold time is based on the minimum hold time needed to reduce waste activity to within dose consequence limits and establishes an administrative control.

Consistent with NUREG-1537, Part 2, the NRC staff confirmed that SHINE identified the safety controls credited for mitigation for this event, which are:

Waste solution holdup times in the RLWS before processing in the RLWI; Concentration controls applied to waste solutions; Heavy load drop controls; and Facility personnel evacuate the immediate area within 10 minutes after receipt of electronic dosimeter or local radiation alarms.

Consistent with NUREG-1537, Part 2, the NRC staff confirmed that that SHINE applied a conservative MAR for this scenario by using 380 liters of waste solution at 35 days post-shutdown. The concentration of radionuclides for the waste solution was determined by multiplication of the ratio of the maximum uranium concentration permitted in the RLWI to the nominal uranium concentration of target solution. The action of the TOGS during the period when the original target solution was held in the TSV dump tank removes more than 67 percent of the iodine present in the solution at shutdown. It is assumed that 35 percent of the post-shutdown iodine inventory is released to the RLWI enclosure during the event.

The NRC staff reviewed the results of SHINEs RPF critical equipment malfunction event analyses, as discussed above. The staff finds that SHINEs analyses considered potential critical equipment malfunctions within the RPF. Further, the staff finds that the MHA bounds the dose consequences of the limiting credible event. The staff finds that the radiological doses to the workers and the public will be within acceptable limits and the health and safety of the workers and public will be adequately protected. Therefore, the staff concludes that SHINEs RPF critical equipment malfunction event analyses are acceptable.

13b.4.7 Inadvertent Nuclear Criticality in the Radioisotope Production Facility The NRC staff evaluated the sufficiency of the applicants descriptions and discussions of this DBA category using the guidance and acceptance criteria from chapter 13, Accident Analyses, of NUREG-1537, Parts 1 and 2, and the ISG augmenting NUREG-1537, Parts 1 and 2.

13-75 SHINE FSAR section 13b.2.5, RPF Inadvertent Nuclear Criticality, evaluates inadvertent nuclear criticality events in the accident analysis using the same methodology as non-criticality accidents. Nuclear criticality safety is achieved through the use of preventative controls throughout the RPF, which reduces the likelihood of a criticality accident to highly unlikely.

Further discussion of the criticality safety bases for RPF processes is included in SHINE FSAR section 6b.3 and the NRC staffs review in section 6b.4.3 of this SER.

13b.4.8 Radioisotope Production Facility Fire The NRC staff evaluated the sufficiency of the applicants descriptions and discussions of this DBA category using the guidance and acceptance criteria from chapter 13, Accident Analyses, of NUREG-1537, Parts 1 and 2, and the ISG augmenting NUREG-1537, Parts 1 and 2.

As described in SHINE FSAR section 13b.2.6, RPF Fire, SHINE evaluated fires within the RPF for internal fire risks based on the fire hazards analysis (FHA). The FHA documents the facility fire areas, with each area individually evaluated for fire risks. Internal facility fires are generally evaluated as an initiating event for the release of radioactive material.

Consistent with NUREG-1537, Part 2, the NRC staff confirmed that SHINE systematically analyzed credible fire events and categorized them into two scenarios, as follows:

PVVS Carbon Delay Bed Fire PVVS Carbon Guard Bed Fire Consistent with NUREG-1537, Part 2, the NRC staff confirmed that SHINE identified the most limiting scenario as Scenario 2, PVVS Carbon Guard Bed Fire.

Consistent with NUREG-1537, Part 2, the NRC staff confirmed that prior to the event the system was assumed to be under normal operational conditions. The PVVS is operating normally, with nominal flow through a carbon guard bed. The affected carbon guard bed contains iodine from RPF process streams.

Consistent with NUREG-1537, Part 2, the NRC staff confirmed that SHINE identified the sequence of events where an upset or malfunction in the PVVS may result in high moisture or high temperature flow through the carbon guard bed. The high moisture or high temperature results in ignition of the carbon guard bed absorber material. The ignition of the carbon guard bed results in an exothermic release of stored radioactive material to the PVVS downstream of the guard bed. Radioactive material is captured by the downstream carbon delay bed and filtered. It is assumed that one percent of the released radioactive material is released through the PVVS and the facility stack to the environment.

Consistent with NUREG-1537, Part 2, the staff confirmed that SHINE identified the safety controls credited for mitigation of the dose consequences for this accident as PVVS delay bed filtration.

The NRC staff reviewed the results of SHINEs RPF fire event analyses, as discussed above.

The staff finds that SHINEs analyses considered potential RPF fires. Further, the staff finds that the MHA bounds the dose consequences of the limiting credible event. The staff finds that radiological doses to the workers and the public will be within acceptable limits and the health

13-76 and safety of the workers and public will be adequately protected. Therefore, the staff concludes that SHINEs RPF fire event analyses are acceptable.

13b.4.9 Analyses of Accidents with Hazardous Chemicals Produced from Licensed Material The NRC staff evaluated the sufficiency of the applicants analysis of accidents with hazardous chemicals produced from licensed material, as presented in SHINE FSAR section 13b.3, Analyses of Accidents with Hazardous Chemicals, in part, by reviewing the chemical process description, chemical accidents description, and consequences estimates using the guidance and acceptance criteria from section 13b.2, Chemical Process Safety for the Radioisotope Processing Facility, of the ISG augmenting NUREG-1537, Parts 1 and 2.

SHINE proposed safety criteria in SHINE FSAR section 3.1 that include requirements for chemical safety for both individuals outside the controlled area (i.e., the public) and facility workers. The NRC staffs chemical safety review focused primarily on potential accident sequences involving chemical hazards that could impact the public.

Potential chemical exposure scenarios in the RPF were identified and evaluated by SHINE to assess chemical hazards and necessary controls. The evaluation used the limited inventories of chemicals used in the RPF as identified in table 13b.3-1 of the SHINE FSAR.

The NRC staff reviewed the SHINE hazard identification and analysis methodology discussed in SHINE FSAR section 13a2. The methodology includes consideration of chemical hazards. The methodology considers all modes of operation for potential process upsets and accident sequences. SHINEs implementation of the methodology leads to the identification of safety-related controls that are relied on to limit or prevent potential accidents or mitigate their consequences. It also identifies programmatic administrative controls that ensure the availability and reliability of identified safety systems.

The NRC staff also reviewed the SHINE implementation of the accident analysis methodology as it relates to the identification and analysis of chemical hazards. The more detailed identification and analysis of chemical hazards is documented in the SHINE SSA summary. The consequences of accidents involving chemical hazards are presented in CALC-2018-0049, Revision 4, Chemical Dose Analysis for Hypothetical Accidents in the SHINE Medical Production Facility. The SHINE analysis concludes that all offsite chemical exposures consequences were limited (i.e., concentrations were less than protective action criteria (PAC)-1) and that only a few chemical accidents would result in RCA workers being exposures to chemical concentrations greater than PAC-1, but in all cases less than PAC-2 levels. SHINE FSAR table 13b.3-2, Hazardous Chemical Source Terms and Concentration Levels, identifies the hazardous chemicals, release location, source term, and concentrations to the control room operator and at the site boundary.

The NRC staff reviewed the chemical accident scenarios identified in the SHINE FSAR and in the SHINE SSA summary and found them to be reasonable and consistent with facility description, chemical process description, and process equipment information presented in the SHINE FSAR about the RPF and the various RPF processes. The staff notes that the quantities of process chemicals is limited, the volume of process vessels is small, and the cells that contain the irradiated material processing operations are shielded.

13-77 The NRC staff also reviewed information about the consequences of accident scenarios involving the release of hazardous chemicals. The consequences are a function of the amount of material released, the release rate, and the dilution/dispersion of the hazardous chemical as it moves from the release point to the point of contact with the receptor.

The NRC staff reviewed the methods that SHINE used to estimate release quantities and the concentrations of hazardous chemicals to offsite receptors for the postulated accident sequences. The staff finds that the methods used are consistent with guidance provided in NUREG/CR-6410, which is recommended in the ISG augmenting NUREG-1537, Part 1.

Independent calculations by the staff confirmed the concentrations presented by SHINE for site boundary and offsite receptors and support the SHINE conclusion that the chemical hazards to off-site personnel from RPF operations are minimal. The staff notes that it previously reached this same general conclusion of limited potential impact to the public for the Cintichem facility which recovered Mo-99 from irradiated material and was previously licensed by the NRC as documented in Inspection Report 70-687/87-04 (ML20236S788). This conclusion is also consistent with an environmental analysis conducted by the U.S. Department of Energy (DOE) when it evaluated the environmental impact of Mo-99 production and recovery at DOE facilities (DOE/EIS-0249F, Medical Isotopes Projection Project: Molybdenum-99 and Related Isotopes, April 1996).

In addition to reviewing the consequences of chemical accidents to offsite individuals, the NRC staff reviewed the SHINE method for predicting concentrations of hazardous chemicals to RCA workers. The SHINE method assumes instantaneous release and mixing of the hazardous material into the RCA room volume. An actual release would occur over some time and so the predicted concentrations are conservatively higher than what would occur during a release period. In addition, worker evacuation is generally expected and so the actual exposure duration would be less than the 1-hour period associated with the PAC-2 concentrations used in the SHINE analysis. The staff finds that there is reasonable assurance that actual RCA worker exposure to hazardous materials will be below PAC-2 levels for 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> and that exposure will not exceed the chemical exposure criteria identified in SHINE FSAR section 3.1 (i.e.,

concentrations that would present the potential for irreversible or other serious, long-lasting health effects to a worker).

The NRC staff also reviewed the method used to predict the concentration of hazardous material in the control room. The general scenario identified in the SHINE analysis involves the release of a chemical from a rollup door that is on the eastern edge (right side) of the south side of the SHINE facility. The SHINE analysis assumes that the chemical released from the rollup door would be diluted as it moves to the ventilation intakes which are at a higher elevation than the rollup door and to the left of the door.

The transport of material from a release point on the right side of the southern face of the building to an intake point that is higher and near the center of the same side of the building involves complex flow processes that are influenced by many factors including wind speed and direction and the position of the release point and intake locations.

SHINE used the ALOHA (Areal Locations of Hazardous Atmospheres) code to predict control room concentrations. The ALOHA code does not specifically model the flow arrangement described in the SHINE accident sequence. SHINE described the flow arrangement as a release and intake on a common wall. The SHINE ALOHA analysis assumed Gaussian dispersion over the short distance and used an ALOHA feature that calculates an indoor air concentration in a downwind building based on an assumed building air change rate.

13-78 The NRC staff analyzed the meteorological transport processes to gain insight into any conservatism in the SHINE ALOHA analysis for control room workers. In order to evaluate the reasonableness of the control room concentrations calculated by SHINE using the ALOHA code, the staff compared the /Q value used in the SHINE ALOHA analysis with other /Q values developed by SHINE using NRC guidance specifically intended for control room habitability analysis. The staff reviewed the SHINE ALOHA results presented in CALC-2018-0049, Chemical Dose Analysis for Hypothetical Accidents in the SHINE Medical Production Facility. The staff found that the ALOHA analysis used a /Q value of around 3 sec/m3. This was compared to the /Q that SHINE developed in a separate calculation performed to support control room habitability analysis (CALC-2020-0018, Atmospheric Dispersion for Control Room Habitability Calculations). This separate analysis considered a southeasterly wind given the relative location of the rollup door and the ventilation intake structures and used the ARCON96 code to estimate the /Q for transport from the rollup door to the ventilation intake structure. This separate SHINE analysis estimated the /Q to be 1.4 x 10-2 sec/m3 for scenarios of less than 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> duration. The staff reviewed this SHINE ARCON96 analysis and finds it to be conservative.

The NRC staff compared the ARCON96 /Q values developed by SHINE with other near-field /Q reported values such as DOE reviews of models and methods for developing a /Q for workers at 100 meters. This review identified a conservative /Q of 3.5x10-3 for a collocated worker at 100 meters. The DOE analysis (Technical Report for Calculation of Atmospheric Dispersion at Onsite Locations for Department of Energy Nuclear Facilities, NSRD-2015-TD01) also examined different methods for estimating /Q at 100 meters including those in ARCON96 and ALOHA and found the recommended default value of 3.5 x 10-3 sec/m3 to be conservative when there was a building wake. The staff also reviewed a report prepared by the Center for Nuclear Waste Regulatory Analysis (Summary of Near-Field Methods for Atmospheric Release Modeling (ML072500257)). This report also examined different models for estimating /Q at short distances. The most conservative /Q identified in this analysis for F stability class and 1 m/sec wind speed was about 5 x 10-2 sec/m3 if there was no building and 9 x 10-3 sec/m3 if there was a building. The /Q from the analysis using the ARCON code was about 6 x 10-4 sec/m3 assuming that there was a building.

The NRC staff finds the SHINE ARCON96 /Q value of 1.4 x 10-2 sec/m3 to be appropriate and conservative because it considers winds from the southeast and takes into consideration the effects of the building which contains both the release point and the intake point. It is also consistent with other analyses of dispersion over short distances with building turbulence effects. Because the SHINE ALOHA analysis uses a higher /Q value, the staff determined the SHINE ALOHA dispersion analysis to be conservative by a factor of about 200 (3/1.4 x 10-2 sec/m3).

The NRC staff also reviewed the effect of the air exchange rate used in the SHINE ALOHA analysis, which was assumed to be 1.2 air exchanges per hour. The SHINE ALOHA analysis predicted indoor (i.e., control room) concentrations that were reduced by up to a factor of 50 when compared to the outdoor concentration predicted in the ALOHA analysis. The SHINE report CALC-2018-0048, Rev 6, Radiological Dose Consequences, presents information on the volume of the control room and the ventilation flow through that room. The document estimates the control room volume as 350 m3 and the ventilation flow through this volume as being approximately 2600 m3 per hour. The control room has about 7 air exchanges per hour which is higher than the 1.2 value used in the SHINE ALOHA analysis. The higher exchange

13-79 rate means that there will be less reduction of the indoor air concentration compared to the outdoor concentration that was calculated in the SHINE ALOHA analysis.

To understand the effect of this higher air exchange rate, the NRC staff performed an independent ALOHA analysis. The staff repeated the SHINE ALOHA analysis for nitric acid and produced results that were consistent with the SHINE analysis for the air exchange rate of 1.2. When the staff repeated the analysis with the higher air exchange rate, the staffs predicted indoor air concentration was essentially the same as the outdoor air concentration.

The staff determined that the SHINE ALOHA analysis used a non-conservative air exchange rate when estimating control room concentrations following chemical releases. However, the staff finds that the non-conservatism in this parameter is offset by the conservatism in the /Q value.

The NRC staffs review of the SHINE estimate of control room concentration concluded that the SHINE estimates of control room concentrations were conservative because of the ALOHA dilution/dispersion analysis (/Q) was conservative and compensated for the non-conservative estimate of air exchange rate for the SHINE control room. Based on its review, the staff has reasonable assurance that the design will meet the design criteria identified in SHINE FSAR section 3.1 when considering the chemical exposure of control room operators.

The NRC staff also reviewed the chemical process safety controls identified in the SHINE FSAR section 13b.3. The confinement barrier controls are of a general nature that lack the specificity of the controls identified in the SSA.

The NRC staff finds that the SHINE SSA identified and analyzed chemical hazards against the SHINE design criteria related to public health and safety which are presented in SHINE FSAR section 3.1. The staffs review and independent analysis led the staff to conclude that there is reasonable assurance that the design meets the requirements of 10 CFR 50.40 for protection of the public health and safety from process chemical hazards.

The NRC staff review of the analysis of consequences for hazardous chemical events to workers, both those in the control room and those in the RPF, is discussed above. The staff finds that there is reasonable assurance that the design meets the design criteria SHINE established for worker chemical safety in SHINE FSAR section 3.1 and that worker and public health and safety are protected. Therefore, the staff concludes that the results of SHINEs hazardous chemical accidents analyses are acceptable.

13b.4.10 Proposed Technical Specifications In accordance with 10 CFR 50.34(a)(1), the NRC staff evaluated the sufficiency of the applicants proposed TSs for the SHINE facility related to the RPF accident analysis.

The proposed TS 5.5.8, Chemical Control, states the following:

The SHINE chemical control program ensures that on-site chemicals are stored and used appropriately to prevent undue risk to workers and the facility. The chemical control program implements the following activities, as required by the accident analysis:

1.

Control of chemical quantities permitted in designated areas and processes;

2.

Chemical labeling, storage and handling; and

3.

Laboratory safe practices.

13-80 TS 5.5.8 requires that the chemical control program implement controls on chemical quantities, labeling, storage, handling, and safe laboratory practices. The NRC staff finds that the implementation of these controls will help manage the chemical process thereby minimizing the possibility of a significant chemical release and ensuring public health and safety. Therefore, the staff finds that TS 5.5.8 is acceptable.

13b.5 Review Findings The NRC staff reviewed the descriptions and discussions of the final SHINE RPF accident analysis, as described in SHINE FSARsection 13b, as supplemented, against the applicable regulatory requirements and using appropriate regulatory guidance and acceptance criteria.

Based onits review of the information in the FSAR and independent confirmatory review, as appropriate, the NRC staff determined that:

(1)

SHINE described theaccident analysisof the RPF and identified the major features or components incorporated therein for the protection of the health and safety of thepublic.

(2)

The processes to be performed,the operating procedures, the facility andequipment, the use of the facility,and other TSs provide reasonable assurance that theapplicant will comply with the applicable regulations in 10 CFR Part 50 and 10 CFR Part20 and that the health and safety of the public willbeprotected.

(3)

The issuance of an operating licensefor thefacility would not be inimical to the common defense and security or to the health and safety of thepublic.

Based on the above determinations, the NRC staff finds that the descriptions and discussions of the final SHINE RPF accident analysis are sufficient and meet the applicable regulatory requirements and guidance and acceptance criteria for the issuance of an operating license.