ML23053A080

NCP-2023-001: Non-Concurrence on Shine Technologies, LLC, Safety Evaluation Report for a Medical Isotope Production Facility

ML23053A080
Person / Time
Issue date:	02/22/2023
From:	Michael Balazik Office of Nuclear Reactor Regulation
To:
References
NCP-2023-001
Download: ML23053A080 (27)

Text

NRC FORM 757 (06-2019)

Page 1 of 14 Use ADAMS Template NRC-006 (ML063120159)

NRC FORM 757 U.S. NUCLEAR REGULATORY COMMISSION (06-2019)

NRC MD 10.158 NON-CONCURRENCE PROCESS COVER PAGE The U.S. Nuclear Regulatory Commission (NRC) strives to establish and maintain an environment that encourages all employees to promptly raise concerns and differing views without fear of reprisal and to promote methods for raising concerns that will enhance a strong safety culture and support the agencys mission.

Employees are expected to discuss their views and concerns with their immediate supervisors on a regular, ongoing basis. If informal discussions do not resolve concerns, employees have various mechanisms for expressing and having their concerns and differing views heard and considered by management.

Management Directive (MD) 10.158, NRC Non-Concurrence Process, describes the Non-Concurrence Process (NCP).

The NCP allows employees to document their differing views and concerns early in the decision-making process, have them responded to (if requested), and include them with proposed documents moving through the management approval chain to support the decision-making process.

NRC Form 757, Non-Concurrence Process, is used to document the process.

Section A of the form includes the personal opinions, views, and concerns of a non-concurring NRC employee.

Section B of the form includes the personal opinions and views of the non-concurring employees immediate supervisor.

Section C of the form includes the agencys evaluation of the concerns and the agencys final position and outcome.

NOTE: Content in Sections A and B reflects personal opinions and views and does not represent the official agencys position of the issues, nor official rationale for the agency decision. Section C includes the agencys official position on the facts, issues, and rationale for the final decision.

1.

Was this process discontinued? If so, please indicate the reason and skip questions 2 and 3:

Process was not discontinued 2.

At the completion of the process, the non-concurring employee(s):

Continued to non-concur 3.

For record keeping purposes:

This record has been reviewed and approved for public dissemination

1.

NCP Tracking Number

NRC FORM 757 (06-2019)

Page 2 of 14 Use ADAMS Template NRC-006 (ML063120159)

NRC FORM 757 U.S. NUCLEAR REGULATORY COMMISSION (06-2019)

NRC MD 10.158 NON-CONCURRENCE PROCESS (Continued)

NCP-2023-001 Date 2023-01-24 Section A - To Be Completed by Non-Concurring Employee 2.

Title of Subject Document Safety Evaluation Report for SHINE Technologies, LLC Operating License Application -

Chapter 13 3.

ADAMS Accession Number ML23047A025 4.

Document Signer Mohamed Shams - DIVISION DIRECTOR, DANU 5.

Document Signers Office NRR 6.

Document Signers Email Mohamed.Shams@nrc.gov 7.

Name of Non-Concurring Employees Mike Call - NUCLEAR ENGINEER

8.

Non-Concurring Employee Offices NMSS 9.

Employee Emails Michel.Call@nrc.gov

10.

Non-Concurring Employees Role for the Subject Document Document Contributor 11.

Name of Non-Concurring Employee Supervisors Jason Piotter - BRANCH CHIEF

12.

Non-Concurring Employee Supervisor Offices NMSS 13.

Supervisor Emails Jason.Piotter@nrc.gov

14.

I would like my non-concurrence considered and would like a written evaluation in Sections B and C.

15.

When the process is complete, I would like management to determine whether public release of the NCP Form (with or without redactions) is appropriate (Select No if you would like the NCP Form to be non-public):

Yes 16.

Reasons for the Non-Concurrence, Potential Impact on Mission, and the Proposed Alternatives See Attached Document 17.

Submitted By / Submitted On Mike Call - NUCLEAR ENGINEER 2023-01-24

NRC FORM 757 (06-2019)

Page 3 of 14 Use ADAMS Template NRC-006 (ML063120159)

NRC FORM 757 U.S. NUCLEAR REGULATORY COMMISSION (06-2019)

NRC MD 10.158 NON-CONCURRENCE PROCESS (Continued)

1.

NCP Tracking Number NCP-2023-001 Date 2023-01-25 Section B - To Be Completed by Non-Concurring Employees Supervisor 2.

Title of Subject Document Safety Evaluation Report for SHINE Technologies, LLC Operating License Application -

Chapter 13 3.

ADAMS Accession Number ML23047A025 4.

Name of Non-Concurring Employees Supervisor Jason Piotter - BRANCH CHIEF 5.

Non-Concurring Employees Supervisor Email Jason.Piotter@nrc.gov 6.

Office NMSS 7.

Comments for the NCP Reviewer to Consider I support my staff's use of the non-concurrence process and agree with the technical merits of this non-concurrence with respect to the issues raised. Both chapter 13 and subsequently chapter 12 of the Safety Evaluation Report (SER) are incomplete and inaccurate representations of the state of the review. On that basis alone, and certainly without even considering the technical merits, it is not possible for the NMSS reviewer to concur on the SER as written. Equally challenging to the ability of the reviewer to make a safety finding is that to date, there has been no justification by the applicant for deviating from the Integrated Safety Analysis (ISA)-like approach that was utilized in the original submittal and this lack of justification is in direct contravention to NRC guidance on the acceptability of using ISA-like approaches for safety reviews. Such a justification would have included among other things: 1) a detailed rationale for abandoning a complete ISA like approach while the technical review was underway and replacement with an unapproved alternative and 2) a detailed justification for eliminating the need for both a 50.59 and 70.72 change program in favor of the single change control program in 50.59 which was not and is not adequate for chemical hazards and processing. Had the applicant not deviated from this licensing strategy, which included the ISA-summary report remaining on the docket and the commitment to 70.72 facility changes and change process remaining in the technical specifications, the NMSS reviewer would have been readily able to make a safety finding and draft a complete and accurate SER.

8.

Reviewed By / Reviewed On Jason Piotter - BRANCH CHIEF 2023-01-25

NRC FORM 757 (06-2019)

Page 4 of 14 Use ADAMS Template NRC-006 (ML063120159)

NRC FORM 757 U.S. NUCLEAR REGULATORY COMMISSION (06-2019)

NRC MD 10.158 NON-CONCURRENCE PROCESS (Continued)

1.

NCP Tracking Number NCP-2023-001 Date 2023-01-27 Section C - To Be Completed by NCP Coordinator

2.

Title of Subject Document Safety Evaluation Report for SHINE Technologies, LLC Operating License Application -

Chapter 13

3.

ADAMS Accession Number ML23047A025

4.

Name of NCP Coordinator Michael Balazik - PROJECT MANAGER (NON POWER)

5.

NCP Coordinators Email Michael.Balazik@nrc.gov

6.

Office NRR

7.

Agreed Upon Summary of Issues Issue #1: As applied to the SHINE facility, the 10 CFR 50.59 change control process is inadequate for identifying risk significance to determine the need for prior NRC review and approval. It ignores important aspects of this non-power production/utilization facility and the safety analysis and safety program which the applicant has chosen to implement for this facility. These include: 1) the chemical hazards that are within NRCs regulatory mandate, 2) a lack of applicable regulatory limits to use for 50.59 evaluations (in lieu of which applicant-defined safety criteria are used for its safety analyses, which include consequence and likelihood/frequency criteria), 3) characteristics defining risk significant changes applicable to the applicants chosen safety analysis and safety program approach, and 4) a category of safety-related controls that dont deal with systems, structures, and components but are just as necessary to adequate safety for the facility (the specific administrative controls). (see issue 5 on pages 1-3 and 4-9 of Section A input)

Issue #2: SHINE does not clearly document in the FSAR or TS the commitment to maintain the SHINE Safety Analysis (SSA) accurate and current with the facility design. SHINEs response to a request to confirm information to maintain the SSA accurate and current is not enforceable and changes to a commitment that is only captured in a response to a request to confirm information would be outside the scope of regulatory change control processes such as 10 CFR 50.59. (see issue 2 on pages 3 and 9 of Section A input)

Issue #3: Neither the SHINE FSAR nor NRC SER specifically references the SSA Summary Report. The SSA Summary Report should be referenced in the FSAR and SER since it is a significant part of the safety analysis and safety program for SHINE and is a tool used to determine risk significance of a change for evaluation under SHINEs 10 CFR 50.59 program. The SSA Summary Report is where all the identified credible accidents for SHINE are demonstrated to be adequately controlled to not exceed the SHINE Safety Criteria for adequate safety (either by reducing likelihood or consequence). It is also where the reliability management measures that are applied to the safety-related controls is identified (i.e., which measures apply to which controls). The FSAR analysis is based on but does not describe this information. (see issue 3 on pages 3 and 9-10 of Section A input)

Issue #4: All safety-related controls identified in the SSA Summary Report are not explicitly identified in the FSAR and/or TS and therefore, the docketed licensing basis does not include all the safety-related controls which have been identified as necessary to ensure adequate safety. Further, any changes to these controls would be outside the scope of 10 CFR 50.59. Any arguments that such is not necessary (programs requiring procedures, differences in risk significance of controls in the FSAR vs. those that arent) show a lack of understanding of SHINEs ISA approach, its SSA approach in SHINEs terminology, and what constitutes a safety-related control versus the reliability management measures to ensure the performance of the control. They also demonstrate an attempt to create, after the fact, a distinction of risk significance levels among controls that the applicants descriptions and evaluations of the controls do not support. (see issue 4 on pages 3-4 and10-11 of Section A input)

NRC FORM 757 (06-2019)

Page 5 of 14 Use ADAMS Template NRC-006 (ML063120159)

Issue #5: SHINE TS 5.8.3.3.d needs to change the term safety-related structures, systems, and components to safety-related controls to ensure external events or natural phenomena impacting specific administrative controls are reported to the NRC Operations Center within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. This is needed to ensure this TS has the same intent and scope as the requirement from which it was derived and for which the TS was created. (see issue 5 on pages 11-12 of Section A input)

Issue #6: TS 5.5.4, Table 5.5.4, Criticality Safety the wording needs modification to make clear that TS Table 5.5.4 includes criticality controls identified in the nuclear criticality safety evaluations. (see issue 5 on pages 11-12 of Section A input)

Issue #7: The SER, Chapter 13, Subsection, SHINE Safety Analysis Methodology, list of accident categories is not a complete list of categories identified in the SSA. (see issue 5 on pages 11-12 of Section A input) a. Change loss of offsite power to loss of normal power, b. Remove in the RPF from the inadvertent nuclear criticality, and c. Add all categories identified in the tables of SSA Summary Report section 2.3.2; OR, d. Revise the language to clearly indicate the list is not exhaustive or all-inclusive.

Issue #8: The statement The staff evaluation of nuclear criticality safety is in chapter 6, Engineered Safety Features, of this SER should be removed because it is irrelevant to discussion in this SER section. (see issue 5 on pages 11-12 of Section A input)

Issue #9: Various SER wording was changed to past tense the gives the incorrect impression that the SSA is a single and done action instead of a living and ongoing approach. (see issue 5 on pages 11-12 of Section A input)

Issue #10: The SER emphasis on the SHINE Safety Analysis (SSA) not being a requirement, without equivalent statement on other aspects of SHINEs approach (e.g., the maximum hypothetical accident (MHA) approach) that are also not requirements. The implication is that, among other things, though SHINE chose to use an ISA approach to demonstrating safety, it need not completely follow the approach and need not propose or justify the acceptability of alternatives to the aspects of the ISA approach it doesnt follow (which implication contradicts the published guidance among other things and wouldnt be accepted for approaches used in other aspects of the application and review). (see issue 5 on pages 11-12 of Section A input)

Issue #11: The SER lacks a description of the staffs review and findings regarding resolution of issues 1 through 4 (in Ch 13 or, as was expected to be, in Ch 12 of the SER since Ch 13 currently points to Ch 12 for those descriptions). Without adequate resolution of those issues (as the staff has determined that to be), the staffs review and findings in SER Ch 13, as captured in the SSA section, are incomplete and lack needed support to be able to make the findings in the SSA section of SER Ch 13. (see page 1 of Section A input prior to the descriptions of the specific issues)

8.

Evaluation of Non-Concurrence and Rationale for Decision Overview of SHINE Licensing Basis The staff safety evaluation report (SER) documents the results of the staffs technical and safety review of the operating license application submitted by SHINE Technologies, LLC (SHINE), as supplemented by the applicants responses to NRC requests for additional information and as updated on August 31, 2022, for a medical radioisotope production facility in Janesville, Wisconsin. The facility consists of an irradiation facility and radioisotope production facility for the irradiation and processing of special nuclear material to produce medical radioisotopes, such as molybdenum-99. In turn, the irradiation facility would consist of eight subcritical operating assemblies which would each be licensed as utilization facilities, as defined in Title 10 of the Code of Federal Regulations (10 CFR) 50.2, Definitions; the radioisotope production facility would consist of hot cell structures and systems, licensed collectively as a production facility, as defined in 10 CFR 50.2. The regulatory requirements of 10 CFR Part 70, Domestic licensing of special nuclear material, and associated guidance do not apply to the SHINE facility licensed pursuant to 10 CFR Part 50, Domestic licensing of production and utilization facilities. A more thorough discussion of how SHINEs design criteria, technical specifications (TSs), and change control program demonstrate compliance with the applicable 10 CFR Part 50 regulations to demonstrate reasonable assurance of adequate protection of public health and safety is provided below. SHINEs design criteria establish the

NRC FORM 757 (06-2019)

Page 6 of 14 Use ADAMS Template NRC-006 (ML063120159) necessary design, fabrication, construction, testing, and performance requirements for, structures, systems, or components (SSCs) important to safety. The design criteria are reflected in the plant design, as documented in the final safety analysis report (FSAR) submitted by SHINE. SHINE evaluated a broad spectrum of SSCs important to safety covered by the design criteria. The analyses in the FSAR, assessed and confirmed by the NRC staff, form the bases from which SHINEs TSs are to be derived. If SHINE sought a change to its licensing or design basis, it is required to follow the 10 CFR 50.59 screening and evaluation process. One important aspect of licensing SHINE as a utilization and production facility under Part 50 is the need to establish TSs for the facility. Section 182 of the Atomic Energy Act, as implemented by 10 CFR 50.36, Technical specifications, requires that those design features of the facility which, if altered or modified, would have a significant effect on safety be included in TSs. Although a variety of features must be included in the design of a nuclear facility, only those aspects of the design and facility conditions that are required to assure adequate protection to the health and safety of the public need be controlled by the TSs required by 10 CFR 50.36. The TSs are "derived from the analyses and evaluation included in the safety analysis report." They do not cover every aspect of the design, but they establish, among other things, limiting conditions for operation, which are the lowest functional capability or performance levels of equipment required for safe operation of the facility. These TS requirements recognize that even for those design features and facility conditions that require close regulatory control, there are varying degrees of safety importance. Thus, in most cases, whenever a limiting condition for operation is not satisfied, remedial action, rather than a facility shutdown, is usually appropriate and specified.

The allowed outage times associated with the remedial actions generally vary with safety importance. SHINE TSs follow consensus standards and agency guidance, and they, along with other parts of the licensing basis, ensure the operation of the facility does not pose undue risk to the public and the environment. Specifically, SHINE FSAR chapter 14, Technical Specifications, states that the proposed TSs for the SHINE irradiation facility and radioisotope production facility were developed following the format and content guidance of American National Standards Institute/American Nuclear Society (ANSI/ANS)-15.1-2007, The Development of Technical Specifications for Research Reactors, and using the applicable guidance of NUREG-1537, Part 1, Guidelines for Preparing and Reviewing Applications for the Licensing of Non-Power Reactors: Format and Content, and Part 2, Guidelines for Preparing and Reviewing Applications for the Licensing of Non-Power Reactors: Standard Review Plan and Acceptance Criteria, and Final Interim Staff Guidance Augmenting NUREG-1537, Part 1, Guidelines for Preparing and Reviewing Applications for the Licensing of Non-Power Reactors: Format and Content, for Licensing Radioisotope Production Facilities and Aqueous Homogeneous Reactors, and Final Interim Staff Guidance Augmenting NUREG-1537, Part 2, Guidelines for Preparing and Reviewing Applications for the Licensing of Non-Power Reactors: Standard Review Plan and Acceptance Criteria, for Licensing Radioisotope Production Facilities and Aqueous Homogeneous Reactors. It further states that operation of the SHINE facility within the limits of the proposed TSs will not result in offsite radiation exposure exceeding the limits in 10 CFR Part 20, Standards for protection against radiation, and that the observance of the proposed TSs limits the likelihood and consequences of malfunctions.

Responses to Specific Concerns Raised in Non-concurrence Issue #1: As applied to the SHINE facility, the 10 CFR 50.59 change control process is inadequate for identifying risk significance to determine the need for prior NRC review and approval. It ignores important aspects of this non-power production/utilization facility and the safety analysis and safety program which the applicant has chosen to implement for this facility. These include: 1) the chemical hazards that are within NRCs regulatory mandate, 2) a lack of applicable regulatory limits to use for 50.59 evaluations (in lieu of which applicant-defined safety criteria are used for its safety analyses, which include consequence and likelihood/frequency criteria), 3) characteristics defining risk significant changes applicable to the applicants chosen safety analysis and safety program approach, and 4) a category of safety-related controls that dont deal with systems, structures, and components but are just as necessary to adequate safety for the facility (the specific administrative controls). (see issue 5 on pages 1-3 and 4-9 of Section A input)

Response: Issue 1 discusses perceived inadequacies of 10 CFR 50.59, Changes, tests and experiments, and the change control process for the SHINE facility. It offers a view that regulatory requirements for nuclear facilities licensed under 10 CFR 70, Domestic Licensing of Special Nuclear Material, would be more appropriate as SHINEs licensing basis. Specifically, regulatory requirements in

NRC FORM 757 (06-2019)

Page 7 of 14 Use ADAMS Template NRC-006 (ML063120159) 10 CFR 70.72, Facility changes and change process, and applicable guidance documents, would be better suited for SHINEs licensing basis. The regulatory requirements of 10 CFR 70.72 do not apply to the SHINE facility, as it is licensed pursuant to 10 CFR Part 50, which provides an equally comprehensive regulatory framework under which the current operating power and research and test reactors have been licensed and are safely operating. Part 50 contains provisions to appropriately control facility licensing basis changes in a safety-focused and risk-informed approach. Licensees may request a license amendment under 10 CFR 50.90, Application for amendment of license, construction permit, or early site permit. Also, licensees may perform facility changes without prior NRC approval if they satisfy 10 CFR 50.59 requirements. Pursuant to 10 CFR 50.59, specific aspects of those SSCs that are described in the FSAR may be changed by the licensee without prior NRC approval unless the changes are unreviewed safety questions or constitute a change in the TSs. Therefore, 10 CFR 50.59 provides a regulatory process for the licensee to modify the facility without prior NRC approval, provided the changes maintain an acceptable level of safety, as documented in the FSAR. Further, the 10 CFR 50.59 process is risk-informed and is structured around the licensing approach of design-basis events (anticipated operational occurrences and accidents), safety-related protection and mitigation systems, and consequence calculations for the design basis accidents (DBAs). As part of the 10 CFR 50.59 process, licensees conduct and document screenings and evaluations to identify if the proposed change(s) could affect the basis for licensing the facility, such that any safety and risk-significant changes are submitted for NRC review and approval to confirm their acceptability prior to implementation. A 10 CFR 50.59 evaluation is the documented evaluation of the proposed modification against eight criteria in 10 CFR 50.59(c)(2) to determine if a proposed change, test, or experiment requires prior NRC approval. Screening is that part of the 10 CFR 50.59 process for determining whether a proposed activity requires a 10 CFR 50.59 evaluation to be performed. The definitions in 10 CFR 50.59(a) of change, facility as described, procedures as described, and test or experiment not described constitute criteria for the 10 CFR 50.59 screening process. As part of its oversight process to ensure safe operations, the NRC conducts inspections of both licensees screenings and evaluations to ensure proper implementation of the change process. In addition to the change controls of 10 CFR 50.59, SHINE implemented several TS programs that provide additional controls over the items of concern. These safety programs address chemical hazards and safety controls, including administrative controls, and are described in TS 5.5.1 and TS 5.5.4, the SHINE Nuclear Safety Program and a Configuration Management Program, respectively. The SHINE Nuclear Safety Program documents and describes the methods used to minimize the probability and consequences of accidents resulting in radiological or chemical release.

The purpose of the Nuclear Safety Program is for the development and maintenance of the accident analysis, identification of safety-related controls credited for the prevention or mitigation of accidents, and establishment of programmatic administrative controls to ensure reliability of the credited controls. The SHINE Configuration Management Program provides oversight and control of design information, safety information, and records of modifications that might impact the ability of safety-related SSCs to perform their functions. The Configuration Management Program is used to maintain consistency among the design requirements, the physical configuration, and the facility documentation, and ensures changes are made in accordance with 10 CFR 50.59 and the administrative controls and reviews specified by this program. The NRC maintains regulatory oversight of these TS required programs and can take enforcement action if the licensee makes an inadequate risk-significant change without an appropriate approval. Additionally, as part of discussions to address the issues raised in the non-concurrence and to bolster and clarify SHINE's planned execution of its Configuration Management Program to control changes, the staff provided SHINE a request to confirm information (RCI). In response to RCI 13-19 (Agencywide Document Access Management System (ADAMS) Accession No. ML22356A193), SHINE confirmed the following text to be incorporated into the FSAR section 13a2, which provides additional assurances that changes will be appropriately considered and provides a clear path for enforcement if changes are not adequately conducted. In the SHINE configuration management program as described in TS 5.5.4, Configuration Management, SHINE will address: - Chemical exposure consequences - Changes that alter any safety-related control (engineered control or SAC) that is the sole safety-related control preventing or mitigating an accident sequence - Changes that remove, without at least an equivalent replacement of safety function, a safety-related control (engineered control or SAC), including changes to its reliability management measures The limits to use for evaluation of changes in consequences, likelihoods, and frequencies are the SHINE Safety Criteria in Section 3.1 of the FSAR. Issue 1 lists four aspects for which 10 CFR 50.59 is perceived to be inadequate as a change control process for certain aspects of SHINEs safety analysis and safety program. As outlined above, the 10 CFR 50.59(c) evaluation criteria do assess each of these issues. Some further specific considerations for these aspects are as follows:

NRC FORM 757 (06-2019)

Page 8 of 14 Use ADAMS Template NRC-006 (ML063120159)

Aspect #1 Chemical hazards are not addressed in the change process. Accidents associated with chemical hazards are explicitly identified in the FSAR and thus are within the scope of the SHINEs facility change process. As part of the staffs safety evaluation of SHINE, the staff evaluated the adequacy of the applicants analysis of accidents with hazardous chemicals produced from licensed material, as presented in SHINE FSAR section 13b.3, Analyses of Accidents with Hazardous Chemicals, and the SHINE Safety Analysis (SSA) Summary, in part, by reviewing the chemical process description, chemical accidents description, and accident consequence estimates using the guidance and acceptance criteria from section 13b.2, Chemical Process Safety for the Radioisotope Processing Facility, of the Interim Staff Guidance (ISG) augmenting NUREG-1537, Part 2. The SHINE FSAR includes consideration of chemical hazards as described in Chapter 3, Design of Structures, Systems, and Components. In FSAR Chapter 3, Table 3.1-3, SHINE Design Criteria, SHINE established Design Criterion 7, Chemical Protection, that provides for adequate protection against chemical risks produced from licensed material, facility conditions that affect the safety of licensed material, and hazardous chemicals produced from licensed material. The staff found that there is reasonable assurance that the design meets the design criteria SHINE established for worker chemical safety in FSAR section 3.1 and that worker and public health and safety are protected. The staff concluded that the results of SHINEs hazardous chemical accidents analyses are acceptable. Since the chemical hazards are explicitly evaluated in the FSAR, changes to the license or design that could impact the analysis are subject to 10 CFR 50.59. As described above, the 10 CFR 50.59 process requires licensees conduct and document screenings and evaluations to identify if the proposed change(s) could affect the basis for licensing the facility such that any safety and risk-significant changes are submitted for NRC review and approval to confirm their acceptability prior to implementation, and the licensees screening and evaluations are subject to NRC inspection.

Additionally, SHINEs Nuclear Safety Program and a Configuration Management Program in the TS provide controls for changes to chemical hazards and supporting analyses. SHINE also included a TS 5.5.8 program for chemical controls that requires SHINE to implement a chemical control program to prevent undue risk to workers and to support the accident analysis. This provides additional assurance that chemical hazards will be appropriately controlled.

Aspect #2 Lack of applicable regulatory limits to use for 50.59 evaluations (in lieu of which applicant-defined safety criteria are used for its safety analyses, which include consequence and likelihood/frequency criteria). The regulatory limits that SHINE uses for its safety analysis are the SHINE Safety Criteria established in Section 3.1 of the FSAR. The NRC staff documented its evaluation of the SHINE Safety Criteria in SER section 3.4.1.2, SHINE Facility Nuclear Safety Classification, and determined it was acceptable to meet NRC regulations and ensure public health and safety. The SHINE Safety Criteria is quantified by safety criteria used in the FSAR Chapter 13 accident analyses (e.g., protective action values for chemical release accidents). For any change to the facility, the licensee is required to continue to meet the established criteria in the FSAR. Section 2 of Nuclear Energy Institute (NEI) 21-06, Guidelines for 10 CFR 50.59 Implementation at Non-Power Production or Utilization Facilities, describes how principal design criteria and the design basis of the facility are related to the limiting accident analyses and 10 CFR 50.59. SHINE established the limiting accident analyses in FSAR chapter 13, which are used to demonstrate acceptable results to the safety criteria. As outlined in Section 2 of NEI 21-06, any change to those accident analyses or the supporting documentation that could impact the accident results, which are compared to the safety criteria (i.e., SHINE Safety Criteria), are subject to 10 CFR 50.59. In addition to 10 CFR 50.59 being applicable to changes to the accident analyses in Chapter 13 of the FSAR, 10 CFR 50.59 also applies to changes to the safety criteria used in the accident analyses. In Chapter 13 of the FSAR, SHINE documented the SSA methodology, which was used to identify postulated accident sequences to include in that chapter of the FSAR. Within the methodology, SHINE established safety criteria which includes consequence and likelihood/frequency considerations. A change to this element of the methodology would be subject to 10 CFR 50.59(c)(2)(viii) and could result in the need for prior NRC approval. While 10 CFR 50.59 provides sufficient considerations of the regulatory limits used in the license basis, SHINE's Configuration Management Program in the TS amplifies this and has provisions to ensure that changes to the design and licensing basis use the SHINE Safety Criteria. Specifically, SHINE will include the following text in FSAR section 13a2 in the description of the Configuration Management Program: The limits to use for evaluation of changes in consequences, likelihoods, and frequencies are the SHINE Safety Criteria in Section 3.1 of the FSAR. Therefore, even if a 10 CFR 50.59 screening does not result in a determination that prior NRC approval is required, or if SHINE fails to complete a sufficient 10 CFR 50.59 screen or evaluation, this TS provides additional assurances that changes will be appropriately considered and provide a clear path for enforcement if changes are not adequate.

NRC FORM 757 (06-2019)

Page 9 of 14 Use ADAMS Template NRC-006 (ML063120159)

Aspect #3 Inadequate characteristics defining risk significant changes applicable to the applicants chosen safety analysis and safety program approach. A discussion of SHINEs safety analysis approach is provided above in the section entitled, Overview of SHINE Licensing Basis. This approach utilizes consensus standards and agency guidance, along with other parts of the licensing basis, to ensure the operation of the facility does not pose undue risk to the public and the environment. Under 10 CFR 50.59, licensees are allowed to make changes in the facility and procedures, as described in the FSAR, without obtaining a license amendment provided specific criteria are met. Criterion 50.59(c)(2)(i), (ii), and (v), require the licensee to assess changes in risk-related aspects of the proposed change, such as the frequency of occurrence of a design basis accident, likelihood of occurrence of a malfunction of a SSC, and possibility for a malfunction of an SSC important to safety with a different result than any previously evaluated. Industry 10 CFR 50.59 guidance documents, NEI 96-07, Guidelines for 10 CFR 50.59 Evaluations and NEI 21-06, provide guidance for evaluating the risk related to the proposed change. Regardless of the change that is considered, the criteria in 10 CFR 50.59(c)(2) ensures that risk significant changes are identified and submitted for prior NRC approval. In addition to SSCs, procedures are also subject to the 10 CFR 50.59 change process. Procedures described in the FSAR means those that contain information as to how SSCs (i.e., active and passive engineered safety controls) are operated and controlled (including assumed operator actions and response times, if applicable). From NEI 96-07 and NEI 21-06, for the purposes of 10 CFR 50.59, "procedures" are not limited to plant procedures specifically identified in the FSAR (e.g., operating and emergency procedures). Procedures include FSAR descriptions of how actions related to system operation are to be performed and controlled over the performance of design functions. This includes FSAR descriptions of operator action sequencing or response times, certain descriptions of SSC operation and operating modes, operational and radiological controls, and similar information. Procedures and programs required by TSs are expected to contain the administrative controls identified in the SHINE SSA. If changes to these activities or controls are made, such changes are considered changes to procedures described in the FSAR, and the changes are subject to 10 CFR 50.59 which, as discussed previously, will capture risk-significant changes.

Aspect #4 Category of safety-related controls that dont deal with SSCs but are just as necessary to adequate safety for the facility (the specific administrative controls). The safety-related controls that are not SSCs are captured in various TS programs in the SHINE licensing basis (e.g., procedure program, fire protection program, training program, and radiation protection program). Under 10 CFR Part 50 licensing, these types of programs contain many controls to ensure their success, including the types identified in the SHINE safety analyses. Licensees have successfully used the provisions of 10 CFR 50.59 to evaluate whether a change to these programmatic elements requires prior NRC approval. In addition to the provisions of 10 CFR 50.59, the SHINE Configuration Management Program in TS requires that changes to the specific administrative controls are evaluated and are considered under 10 CFR 50.59. Therefore, there are additional assurances that changes will be appropriately considered and provide a clear path for enforcement if changes are not adequate. Considering the regulatory requirements and guidance associated with 10 CFR 50.59, the SHINE Nuclear Safety and Configuration Management Programs, the information contained in the SHINE FSAR and TS, and the NRCs oversight activities and ability to take enforcement actions when necessary and appropriate, SHINEs application of the 10 CFR 50.59 change control process provides reasonable assurance of adequate protection of public health and safety. For the reasons given above, no additional action was taken on this issue.

Issue #2: SHINE does not clearly document in the FSAR or TS the commitment to maintain the SHINE Safety Analysis (SSA) accurate and current with the facility design. SHINEs response to a request to confirm information to maintain the SSA accurate and current is not enforceable and changes to a commitment that is only captured in a response to a request to confirm information would be outside the scope of regulatory change control processes such as 10 CFR 50.59. (see issue 2 on pages 3 and 9 of Section A input)

Response: Issue 2 discusses a perceived lack of clear documentation or commitment in the FSAR or TS to maintain the SHINE Safety Analysis (SSA) accurate and current with the facility design. SHINE has identified its intentions to maintain the SSA accurate and current with the facility design. The SHINE SSA is listed in TS 5.2.4, Audit Function, Section 1.i, which requires SHINE to audit the nuclear safety program and SHINE Safety Analysis Summary Report. In response to RCI 13-9 (ML22304A126), SHINE clarified that the Nuclear Safety Program, required by TS 5.5.1 ensures the SHINE Safety Analysis and its supporting documentation will remain

NRC FORM 757 (06-2019)

Page 10 of 14 Use ADAMS Template NRC-006 (ML063120159) accurate and current, including prompt updates when changes are made to the facility, operations, or FSAR descriptions.

Additionally, the SHINE Quality Assurance Program Description (QAPD) requires the licensee to maintain records that would be of value in demonstrating capability for safe operation. As demonstrated during the SHINE application review, SHINE has implemented numerous updates to the SSA Summary because of design changes made to the facility. Since SHINE is required to implement a QAPD, and TSs requires audits of the SSA and implementation of the Nuclear Safety Program, there is reasonable assurance that SHINE will maintain the SSA current and accurate with the facility design. Through the NRCs oversight process, the SHINE SSA may be periodically reviewed by the staff to determine if it is appropriately maintained, and failure to maintain the SSA would be enforceable under TS 5.5.1 or 5.2.4, depending on the nature of the violation. For the reasons given above, no action was taken on this issue.

Issue #3: Neither the SHINE FSAR nor NRC SER specifically references the SSA Summary Report. The SSA Summary Report should be referenced in the FSAR and SER since it is a significant part of the safety analysis and safety program for SHINE and is a tool used to determine risk significance of a change for evaluation under SHINEs 10 CFR 50.59 program. The SSA Summary Report is where all the identified credible accidents for SHINE are demonstrated to be adequately controlled to not exceed the SHINE Safety Criteria for adequate safety (either by reducing likelihood or consequence). It is also where the reliability management measures that are applied to the safety-related controls is identified (i.e., which measures apply to which controls). The FSAR analysis is based on but does not describe this information. (see issue 3 on pages 3 and 9-10 of Section A input)

Response: Issue 3 discusses a lack of reference to the SSA Summary Report in the SHINE FSAR or the NRC SER. It discusses how the SSA should be referenced, that it contains a significant part of the safety analysis and safety program for SHINE and is a tool used to determine risk significance of a change for evaluation under SHINEs 10 CFR 50.59 program. The assertion is that this is pertinent, since the SSA Summary Report identifies credible accidents that need to be adequately controlled to not exceed the SHINE Safety Criteria for adequate safety as well as reliability management measures. A discussion of SHINEs licensing basis, including how design criteria, technical specifications, and change control program demonstrate compliance with the applicable Part 50 regulations is provided in the Overview of SHINE Licensing Basis and the response to issue 1. Paragraph b of 10 CFR 50.34, Contents of applications; technical information, identifies information that is required in the FSAR for a Part 50 facility. The SHINE SSA is not required for a 10 CFR Part 50 license to operate a production or utilization facility. The SSA is a licensee-controlled, design basis document that supports SHINEs approach for developing the accident analysis information in FSAR Chapter 13a2 Irradiation Facility Accident Analysis. The analyses identified in the SHINE SSA are reasonably bounded by the design-basis accident analyses described in Chapter 13. Operation of the facility, as implemented by 10 CFR 50.36, Technical specifications, requires that those design features of the facility which, if altered or modified, would have a significant effect on safety be included in TSs. Although a variety of features must be included in the design of a nuclear facility, only those aspects of the design and facility conditions that are required for reasonable assurance of adequate protection to the health and safety of the public need be controlled by the TSs required by 10 CFR 50.36. The TSs are derived from the analyses and evaluation included in the safety analysis report. They do not cover every aspect of the design but rather, they establish, among other things, limiting conditions for operation which are the lowest functional capability or performance levels of equipment required for safe operation of the facility. The SHINE facility off-site public exposures will not result in radiation exposures exceeding the 10 CFR Part 20 limits, when the facility is operated within the proposed TS limiting conditions of operation. Observance of the TSs limits the likelihood and consequences of malfunctions. Under accident conditions, all fission-product based DBAs and tritium-based accident results are less than the SHINE public dose accident acceptance criterion of 1 rem. In FSAR Section 13a2, SHINE describes the SSA methodology as follows: The SSA has been performed for the purpose of identifying relevant hazards, potential accident sequences and consequences, equipment and specific human actions credited for safety, and programmatic administrative controls necessary to ensure the availability and reliability of safety-related SSCs. This analysis takes into consideration the facility structure, equipment, activities, personnel, processes, and administrative controls in an integrated manner to identify and analyze hazards. The NRC staff audited the information in the SSA Summary Report and documented its review in a report on December 7, 2022 (ML22301A149). SHINE proposed TS 5.2.4, Audit Function, Section 1.i, which requires SHINE to audit the Nuclear Safety Program and SHINE Safety Analysis Summary Report every third calendar year. SHINE proposed TS 5.5.1, Nuclear Safety Program, which requires the following: The SHINE nuclear safety

NRC FORM 757 (06-2019)

Page 11 of 14 Use ADAMS Template NRC-006 (ML063120159) program documents and describes the methods used to minimize the probability and consequences of accidents resulting in radiological or chemical release. The program applies a graded approach to the design and management of processes to assure plant safety through risk reduction and satisfaction of SHINEs performance goals. The safety program accomplishes these goals through development and maintenance of the accident analysis, identification of safety-related controls credited for the prevention or mitigation of accidents, and establishment of programmatic administrative controls to ensure reliability of the credited controls.

During internal NRC staff discussions about the issues raised in the non-concurrence, the staff agreed that additional clarity could be provided. Therefore, a RCI was sent to SHINE inquiring about treatment of the SSA. In response to RCI 13-19 (ML22356A193) SHINE confirmed it will update SHINE FSAR Section 13a2 to read as follows: The configuration management program also lists SSA Summary Report, as updated-identified controls not otherwise included in Sections 3.0, 4.0, or 5.0 of the technical specifications that will be maintained under the configuration management program and will not be modified as described in the technical specifications without prior NRC approval. Since the SHINE SSA Summary Report is described and referenced in the TS, FSAR Section 13a2, and the NRC audit report, no additional action was taken on this issue.

Issue #4: All safety-related controls identified in the SSA Summary Report are not explicitly identified in the FSAR and/or TS and therefore, the docketed licensing basis does not include all the safety-related controls which have been identified as necessary to ensure adequate safety. Further, any changes to these controls would be outside the scope of 10 CFR 50.59. Any arguments that such is not necessary (programs requiring procedures, differences in risk significance of controls in the FSAR vs. those that arent) show a lack of understanding of SHINEs ISA approach, its SSA approach in SHINEs terminology, and what constitutes a safety-related control versus the reliability management measures to ensure the performance of the control. They also demonstrate an attempt to create, after the fact, a distinction of risk significance levels among controls that the applicants descriptions and evaluations of the controls do not support. (see issue 4 on pages 3-4 and10-11 of Section A input)

Response: Issue 4 discusses that safety-related controls identified in the SSA Summary Report are not explicitly identified in the FSAR and/or TS; and therefore, the docketed licensing basis does not include all the safety-related controls which have been identified as necessary to ensure adequate safety. Furthermore, it states that any changes to these controls would be outside the scope of 10 CFR 50.59. A discussion of SHINEs licensing basis, including how design criteria, technical specifications, and change control program demonstrate compliance with the applicable Part 50 regulations is provided in the Overview of SHINE Licensing Basis and the response to issue 1. The assertion in the non-concurrence that these administrative controls should be elevated to the FSAR/TSs fails to acknowledge/credit other regulatory programs for facilities licensed under Part 50. SHINE followed the guidance in the ISG augmenting NUREG-1537, Parts 1 and 2, and used an integrated safety analysis like methodology, identified as the SSA, to establish the hazards, potential accident sequences associated consequences, and credited safety controls to prevent and/or mitigate accidents. In the SSA, SHINE identified safety controls consisting of both active and passive engineered controls and specific administrative controls to prevent and/or mitigate a specific postulated accident sequence. SHINE did not docket the SSA as part of the licensing basis for the SHINE facility; however, the SSA Summary Report was audited by the NRC staff. The NRC audit report is in ADAMS (ML22301A149). The SHINE SSA is a design basis document that supports information in FSAR Chapter 13, Accident Analysis. FSAR Chapter 13 includes a description of the SSA methodology and a summary of the limiting accident scenarios, as identified in Sections 13a2 and 13b1 of the ISG augmenting NUREG-1537, Part 1, and associated safety controls. Consistent with the applicable regulatory guidance for this type of facility, not all safety controls identified in the SSA are explicitly identified in the FSAR and/or TS. SHINE identified that these administrative safety controls are located within established TS required procedures and/or programs. SHINE FSAR Section 13a2, Subsection Incorporation into the FSAR and Technical Specifications, states the following:

Section 5.0 of the technical specifications, Administrative Controls, includes the programmatic administrative controls identified in the SSA (e.g., maintenance of safety-related SSCs) and requires that those programs are established, implemented, and maintained.

Section 5.0 additionally requires the development and use of procedures that implement the specific administrative controls identified in the SSA. Section 5.0 also includes discussion of the configuration management program, which provides oversight and control of design information, safety information, and records of modifications that might impact the ability of safety-related SSCs to perform their intended functions. The configuration management program also lists SSA-identified controls not otherwise included in Sections 3.0, 4.0, or 5.0 of the technical specifications that will be maintained under the configuration management program. In TS

NRC FORM 757 (06-2019)

Page 12 of 14 Use ADAMS Template NRC-006 (ML063120159)

Section 5.0, Subsection 5.5, Programs, SHINE identifies programs such as nuclear safety program, training and qualification, radiation protection, configuration management, maintenance of safety-related SSCs, fire protection, nuclear criticality safety, and chemical control. Consistent with Part 50 licensing, administrative controls that are not explicitly in the FSAR/TS, can be included in these programs and/or within TS required procedures, as required by TS Section 5.4.3, Procedures. Furthermore, as part of the NRCs oversight process, TS required programs and procedures will be inspected by the NRC to verify inclusion of risk-significant safety controls during the operational readiness inspections and will provide further reasonable assurance of adequate protection of public health and safety to support issuance of the operating license. If an inadequate procedure is identified, the NRC can pursue enforcement action for a noncompliance with TS 5.4.3, which requires SHINE to prepare procedures for the facility. For the reasons given above, no action was taken on this issue.

Issue #5: SHINE TS 5.8.3.3.d needs to change the term safety-related structures, systems, and components to safety-related controls to ensure external events or natural phenomena impacting specific administrative controls are reported to the NRC Operations Center within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. This is needed to ensure this TS has the same intent and scope as the requirement from which it was derived and for which the TS was created. (see issue 5 on pages 11-12 of Section A input)

Response: Issue 5 discusses a change to the vocabulary of SHINE TS 5.8.3.3.d from term safety-related structures, systems, and components to safety-related controls. The basis provided is to ensure external events or natural phenomena impacting specific administrative controls are reported to the NRC Operations Center within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. Subparagraph (c)(5) of 10 CFR 50.36, Administrative controls, requires administrative control provisions relating to organization and management, procedures, recordkeeping, review and audit, and reporting necessary to assure operation of the facility in a safe manner. Each licensee shall submit any reports to the Commission pursuant to approved TSs as specified in 10 CFR 50.4, Written communication. Although the SHINE facility is not subject to Appendix A of 10 CFR 70, TS 5.8.3, Additional Event Reporting Requirements was developed using the information in Appendix A of 10 CFR Part 70 and states the following: Any natural phenomenon or other external event, including fires internal and external to the facility, that has affected or may have affected the intended safety function or availability or reliability of one or more safety-related structures, systems or components. TS 5.8.3.3.b states the following: Loss or degradation of credited controls, as documented in the SHINE Safety Analysis, other than those items controlled by a limiting condition of operation established in section 3 of the technical specifications, that results in failure to limit the risk of chemical, radiological, or criticality hazards to an acceptable risk level, as required by the SHINE Safety Analysis. The change proposed to TS 5.8.3.3.d in the nonconcurrence could make event reporting unclear and subjective regarding the availability and reliability of an administrative control impacted by natural phenomenon or other external events. The staffs position is that TS 5.8.3.3.b requires SHINE to report any impacted administrative control (loss or degraded) due to natural phenomenon or other external events. SHINEs Emergency Plan also requires reporting certain natural phenomenon or external events, including fires, to the NRC. The staff recognizes that there are multiple TS requirements for reporting risk-significant events to support the NRCs decision on its response (emergency response, reactive inspection, or routine inspection). If more information is needed on a particular event to support the NRCs event response, the NRC will obtain the necessary information from the licensee. For the reasons given above, no action was taken on this issue.

Issue #6: TS 5.5.4, Table 5.5.4, Criticality Safety the wording needs modification to make clear that TS Table 5.5.4 includes criticality controls identified in the nuclear criticality safety evaluations. (see issue 5 on pages 11-12 of Section A input)

Response: Issue 6 discusses modifying the wording in TS 5.5.4, Table 5.5.4, Criticality Safety for clarity that TS Table 5.5.4 includes criticality controls identified in the nuclear criticality safety evaluations. The wording in TS 5.5.4, Configuration Management, is clear that the criticality safety controls are included in TS Table 5.5.4. TS 5.5.4 states that, Table 5.5.4 lists the controls derived from the accident analysis not otherwise included in TS Section 3, 4, or 5. For Criticality Safety, these controls are the engineered and specific administrative controls. As stated in TS 5.5.4, the Configuration Management Program is used to maintain consistency among the design requirements, the physical configuration, and the facility documentation, and ensures changes are made in accordance

NRC FORM 757 (06-2019)

Page 13 of 14 Use ADAMS Template NRC-006 (ML063120159) with 10 CFR 50.59. Therefore, any changes to the controls in the nuclear criticality safety evaluations are evaluated using the 10 CFR 50.59 change process. As currently worded, TS 5.5.4 is clear that the Configuration Management Program applies to the engineered and specific administrative controls contained within the criticality safety evaluations, including items in Table 5.5.4 (see RCI 13-19, ML22356A193). For the reasons given above, no action was taken on this issue.

Issue #7: The SER, Chapter 13, Subsection, SHINE Safety Analysis Methodology, list of accident categories is not a complete list of categories identified in the SSA. (see issue 5 on pages 11-12 of Section A input) a. Change loss of offsite power to loss of normal power, b. Remove in the RPF from the inadvertent nuclear criticality, and c. Add all categories identified in the tables of SSA Summary Report section 2.3.2; OR, d. Revise the language to clearly indicate the list is not exhaustive or all-inclusive.

Response: Issue 7 discusses a revision to the list of accident categories in SER Chapter 13, Subsection, SHINE Safety Analysis Methodology. During final processing of the SER, an editorial change was made that resulted in the concern identified in issue 7.

To resolve this, the SER language was subsequently revised as proposed in option d above to make it clear that the list of accident categories listed in the SER is not exhaustive or all-inclusive compared to the SSA: The accident categories are include the following, evaluated for the IF and RPF as appropriate:

Issue #8: The statement The staff evaluation of nuclear criticality safety is in chapter 6, Engineered Safety Features, of this SER should be removed because it is irrelevant to discussion in this SER section. (see issue 5 on pages 11-12 of Section A input)

Response: Issue 8 discusses removal of the statement The staff evaluation of nuclear criticality safety is in chapter 6, Engineered Safety Features, of this SER. The SER section in question describes how criticality accidents and controls are evaluated. Within this SER section, the staff states that for nuclear criticality safety, the applicant treated criticality accidents as high consequence events and references SHINE FSAR section 6b.3, Nuclear Criticality Safety. A common approach in writing a SER is to direct the reader where more information on a specific topic is located within the SER. While this sentence may not add further understanding of the information in this section, the statement was added to direct a reader to where more information on nuclear criticality safety is located within the SER. A similar statement is provided in SER Section 13b.4.7, Inadvertent Nuclear Criticality in the Radioisotope Production Facility. This sentence doesnt impact the staffs evaluation of the finding associated with criticality safety controls. No action was taken on this issue.

Issue #9: Various SER wording was changed to past tense the gives the incorrect impression that the SSA is a single and done action instead of a living and ongoing approach. (see issue 5 on pages 11-12 of Section A input)

Response: Issue 9 discusses SER verbiage using past tense, giving the impression that the SSA is a single and done action instead of a living and ongoing approach. During final processing of the SE, an editorial change was made that resulted in the concern identified in issue 9. The reason for changing the wording to past tense was to make the SER language consistent throughout the document. It was not done to imply that the SSA is a single action. To ensure clarity in SHINEs approach to maintain the SSA as a living and ongoing approach, the following SHINE response to RCI 13-9 (ML22304A126) was added to section 13a.4 of the SER:

SHINE confirms that Section 5.5.1 of the Technical Specifications ensures the SHINE Safety Analysis and its supporting documentation will remain accurate and current, including prompt updates when changes are made to the facility, operations, or FSAR descriptions.

Issue #10: The SER emphasis on the SHINE Safety Analysis (SSA) not being a requirement, without equivalent statement on other aspects of SHINEs approach (e.g., the maximum hypothetical accident (MHA) approach) that are also not requirements. The implication is that, among other things, though SHINE chose to use an ISA approach to demonstrating safety, it need not completely follow the approach and need not propose or justify the acceptability of alternatives to the aspects of the ISA approach it doesnt

NRC FORM 757 (06-2019)

Page 14 of 14 Use ADAMS Template NRC-006 (ML063120159) follow (which implication contradicts the published guidance among other things and wouldnt be accepted for approaches used in other aspects of the application and review). (see issue 5 on pages 11-12 of Section A input)

Response: Issue 10 discusses the SERs emphasis on the SHINE SSA not being a requirement, without equivalent statement on other aspects of SHINEs approach (e.g., the maximum hypothetical accident (MHA) approach) that are also not requirements. To resolve issue 10, the SER was modified as follows: The SSA is considered a licensee-controlled document. and is not a requirement for a 10 CFR Part 50, Domestic Licensing of Production and Utilization Facilities, license.

Issue #11: The SER lacks a description of the staffs review and findings regarding resolution of issues 1 through 4 (in Ch 13 or, as was expected to be, in Ch 12 of the SER since Ch 13 currently points to Ch 12 for those descriptions). Without adequate resolution of those issues (as the staff has determined that to be), the staffs review and findings in SER Ch 13, as captured in the SSA section, are incomplete and lack needed support to be able to make the findings in the SSA section of SER Ch 13. (see page 1 of Section A input prior to the descriptions of the specific issues)

Response: Issue 11 discusses a lack of a description of the staffs review and findings regarding resolution of issues 1 through 4. See resolutions to issues 1-4 above for a discussion about the reasonable assurance of adequate protection findings in the SER. To ensure SER clarity in SHINEs approach to maintain the SSA current, the following SHINE response to RCI 13-9 (ML22304A126) was added to SER section 13a.4: SHINE confirms that Section 5.5.1 of the Technical Specifications ensures the SHINE Safety Analysis and its supporting documentation will remain accurate and current, including prompt updates when changes are made to the facility, operations, or FSAR descriptions. Further, the staff removed the SER statement directing to chapter 12 for the staffs evaluation of SHINEs process to maintain the SSA.

9.

Coordinated By / Coordinated On Michael Balazik 2023-02-22 10.

Approved By / Approved On Mohamed Shams - DIVISION DIRECTOR, DANU 2023-02-22

Attachment A

SHINE Operating License SHINE Safety Analysis (SSA) Review Decision: Non-concurrence due to inadequate resolution of issues resulting in incomplete SER with inadequately supported/unsupported findings Basis for Decision:

The SHINE facility, while being licensed under 10 CFR Part 50 as a non-power production or utilization facility (NPUF), has characteristics, processes, and hazards that are like those of facilities subject to 10 CFR Part 70, Subpart H. This includes chemical processing of licensed material and the use of hot cells for such processing, among others. In recognition of this, and consistent with the guidance in the ISG Augmenting NUREG-1537, SHINE has chosen to implement the Integrated Safety Analysis (ISA) approach of 10 CFR Part 70, Subpart H and the associated standard review plan, NUREG-1520. SHINEs ISA approach, now known as the SHINE Safety Analysis (SSA) approach, forms a significant part of the SHINE safety analysis and the basis for the SHINE safety program to ensure adequate protection of the health and safety of the public and of workers.

Over the course of the review, two significant changes were made to the submittal without justification which resulted in the currently outstanding significant issues with the SHINE application review. The first change was the retraction of the docketed ISA Summary, which included relabeling this document to be the SSA Summary Report and revising 10 CFR Part 70 terminology to SHINE-specific terminology (e.g., items relied on for safety are now safety-related controls). The SSA Summary Report still functions as an ISA Summary, containing the same information as described in 10 CFR 70.65, adapted to SHINEs Safety Criteria and terminology. The second change was the modification of the TS configuration management program commitment to evaluate changes against both 10 CFR 50.59 and 10 CFR 70.72 to remove the part for 10 CFR 70.72. These changes result in a significant part of the safety analysis and basis for SHINEs safety program being removed from the docket and the SHINE change control program being no longer adequate for properly identifying changes of sufficient risk significance to need prior NRC review and approval, causing the issues identified below.

Without adequate resolution of the issues that stem from these changes, the staff is unable to make its safety findings. The staff review and findings in the Chapter 13 SER regarding the SSA and the safety program were written (in April 2022, after the issues had been identified but still needed to be addressed) based on the assumption that these issues would be adequately resolved, with references to the Chapter 12 SER for descriptions of the staffs review and findings on these issues. Adequate resolution of these issues has still not been obtained. Hence, the Chapter 12 SER still does not include an accurate and complete description of the staffs review and findings with respect to those issues; thus, the Chapter 13 SER is incomplete, and the findings noted above cannot be made. Upon adequate resolution of the issues that the staff has determined to be necessary, the staff has SER input for Chapter 12 that can be quickly completed and provided.

These issues include the following:

1. A lack of a change control program adequate enough for a facility such as SHINE, and its safety analysis and safety program (which uses ISA approaches for its safety analysis and program), to identify changes of sufficient risk significance as to need prior NRC review and approval.

Gaps in a pure 50.59 program (one that is as written in 10 CFR 50.59 and relies only on the endorsed guidance of NEI 96-07, Rev 1 and Regulatory Guide (RG) 1.187 or NEI 21-06, Rev 1 and RG 2.8) for SHINE:

a. Definition of consequences limited to radiological dose This definition ignores entirely the chemical hazards associated with licensed material, which hazards are present at SHINE, and the NRCs mandate to regulate those hazards (from Congress and by MOU with OSHA).

b. Lack of regulatory limits for use in evaluation of consequences, likelihoods, and frequencies of accidents There are no accident regulatory limits, not even for radiological dose, for SHINE, as stated in the Ch 13 SER. In lieu of regulatory limits, SHINE has established SHINE Safety Criteria (FSAR Section 3.1) for defining limits for demonstrating adequate protection. Following the endorsed guidance would use regulatory radiological limits that have been determined to be inappropriate for SHINE and neglect the chemical hazards at SHINE.

c. Risk significance of changes in an ISA approach; gap in definition of more than a minimal increase The definition of more than a minimal increase for 50.59 evaluations provided in the endorsed guidance is not calibrated to handle evaluation of this criterion for ISA approaches to safety analyses and safety programs. For ISA approaches, altering of safety-related controls that are the sole controls for an accident sequence and removing safety-related controls without an equivalent replacement of safety function are risk significant changes.

d. Lack of criteria for administrative safety-related controls The 50.59 criteria are focused on systems, structures, and components (SSCs) and procedures for operating SSCs. Administrative safety-related controls are not procedures for SSCs, and various of these controls dont have any relation to SSCs, but these controls are necessary to ensure credible accidents are adequately controlled to not exceed the SHINE Safety Criteria for adequate protection.

Some discussion on this issue has focused on evaluation method (for SHINE, its SSA methods) and that being enough, conflating whether or not a method is followed with the risk significance of a change. Evaluation of the risk significance of a change is not about the method used to evaluate the change. Even in a pure 50.59 program, the risk significance evaluation for a change uses the methods in the FSAR, with the 50.59(c)(2)(i~vii) criteria being the criteria for risk significance. If the FSAR method is changed or not used for that evaluation, then the change to the method is evaluated versus criterion 50.59(c)(2)(viii).

Therefore, following a method or not to evaluate a change does not give an indication of the risk significance of the change. Arguments to the contrary are not supported by 50.59 nor its endorsed implementation guidance.

Without elements that address the gaps identified above, including those elements from 70.72, being used in the determination of the need for prior NRC review and approval of a change, the inspectors can only see whether SHINE followed certain steps to consider these elements in making a change. However, the inspector would have no understanding of the risk significance of the change, nor would the inspector have the needed tool to determine that the risk significance of the changes was such that prior NRC review and approval was needed.

Therefore, a commitment needs to be included in the FSAR, technical specifications, or a license condition that SHINEs 50.59 program includes elements that address the above-identified gaps, describing those elements and stating that they are part of the evaluation of the need for prior NRC review and approval of the change (i.e., a license amendment). The SHINE SER then needs to be updated to include the staffs review and findings regarding this commitment.

2. A lack of a clear commitment in a licensing basis document (in the FSAR at the least) regarding maintenance of the SSA The SSA remains a significant part of the SHINE safety analysis and basis for the safety program.

For the safety program to be effective and adequate to ensure adequate protection it must be based on an accurate and current SSA. Otherwise, hazards and accidents may be left unidentified or incorrectly analyzed and controlled, increasing the risk to the public and workers from facility operations and the facility exceeding the SHINE Safety Criteria for adequate protection. An effective commitment is one that is captured in a licensing basis document, such as the FSAR, that is subject to 50.59 and legally enforceable. Per various NRC statements and OGC statements, the SER does not impose commitments on an applicant. Commitments in responses to requests for confirmation of information (RCIs), which is all that currently exists at present for this issue, could be changed outside of any regulatory change control afforded by 50.59.

Therefore, a commitment is needed in the FSAR that clearly states that maintenance of the safety analysis described in TS 5.5.1 includes ensuring the SHINE Safety Analysis and its supporting documentation will remain accurate and current, including prompt updates when changes are made to the facility, operations, or FSAR descriptions. The SHINE SER then needs to be updated to include the staffs review and findings regarding this commitment.

3. A lack of reference to SSA Summary Report in the FSAR The SSA has a significant role in the SHINE safety analysis and safety program. The results in the SSA Summary Report are necessary to identify the safety significance of changes. The SSA Summary Report is where SHINE demonstrates that accidents are adequately controlled to not exceed the SHINE Safety Criteria for adequate safety as well identifies which reliability management measures apply to the safety-related controls. The analyses in the FSAR are based on the accident sequences being adequately controlled, but the FSAR does not provide the information that shows that to be so. Thus, an important part of the safety analyses is only in the SSA Summary Report and not in the FSAR.

Therefore, the FSAR needs to include a reference to the SSA Summary Report in FSAR Section 13a4 that is then used in the appropriate location(s) in FSAR Chapter 13. The SHINE SER then needs to be updated to include this as part of the staffs review and findings.

4. A lack of identification of all safety-related controls, engineered and administrative, in the licensing basis documents (at the least in the FSAR).

There are fewer than 20 of the numerous safety-related controls that are not identified in either the TS or the FSAR. With the 50.59 criteria focused on the FSAR as updated, these remaining

safety-related controls do not clearly fall with the scope of the SHINE 50.59 program and risk significant changes could be made to them or affecting them that would be missed by SHINEs 50.59 evaluations. While it has been claimed that indirect effects on the FSAR of changes outside of the FSAR may wrap into a 50.59 evaluations scope, it has not been demonstrated that that would be so in the case of these remaining safety-related controls. These controls have the same or similar risk, or safety, significance to them as several of the other engineered and administrative safety-related controls that are included in the FSAR and TS.

Therefore, the SHINE FSAR needs to be updated to include these remaining safety-related controls. The SHINE SER then needs to be updated to include this as part of the staffs review and findings.

5. Separately, there are several points of the Chapter 13 SER regarding the SSA and its review that need to be corrected that, as currently written, are not correct in their meaning or implications.

There are also two changes that still are needed to the TS to ensure they capture the full scope of safety-related controls and the TSs intended purpose is clearly understood. These items are discussed in the more detailed write up that is attached.

The issues regarding the two TS and the several points in the SER should be corrected as described in detailed description for them that is provided below.

Further detail regarding the issues is provided below.

1) Lack of adequacy of SHINEs change control program (a pure 50.59 program)

Part 50 and 50.59 History, Changes, Application Relevant to SHINE (and other NPUFs)

While Part 50 does include non-power production and utilization facilities (NPUFs) in its scope, there are a various evidences that show recognition that Part 50 as currently written is not adequate for an NPUF like SHINE and that purely Part 50 methods are not necessarily sufficient or the only way to ensure adequate protection. These evidences include:

The issuance of a draft rule for non-power production or utilization facilities SHINE SER Ch 13 section on Radiological and Design Criterion: Presently, no radiological accident dose criterion is set forth in regulation or guidance to assess the risk to public health and safety and control room operators for non-power production or utilization facilities.

Development of an ISG Augmenting NUREG-1537 that includes statements that:

o The NRC staff has not previously developed guidance in the form of a standard review plan for a 10 CFR Part 50 production facility, therefore this ISG will provide such guidance. (Part 1, page v) o NRC staff have determined that the use of Integrated Safety Analysis methodologies as described in 10 CFR 70 and NUREG-1520, application of radiological and chemical consequence and likelihood criteria contained in the performance requirements of 10 CFR 70.61, designation of items relied on for safety, and establishment of management measures are acceptable ways of demonstrating adequate safety for the medical isotopes production facility. Applicants may propose alternatives but need to justify their adequacy for ensuring protection of health and safety and minimizing danger to life and property (Part 1, page vi and page 70, Section 13b, among others)

o Applicable portions of 10 CFR Part 70 may be incorporated into the Part 50 license as license conditions. (Part 1, page 57, Section 12.11) o Several references to NUREG-1520 and Part 70 and their use in the ISG and by the applicant o Adaption of several requirements from Part 70 and adaption of requirements in Part 55 to address SHINE in a suitable manner If a pure Part 50 regulation and Part 50 approaches to applications, analyses and safety programs were truly sufficient for NPUFs and for SHINE, then none of these actions and statements would be necessary.

Thus, concerns about changing the regulatory framework in regard to the issues described herein is inconsistent with actions taken to date, including on the SHINE review, to address inadequacies of that framework on other issues.

While Part 50 has a change control program regulation in 10 CFR 50.59 and endorsed guidance for that in the form of NEI 96-07, Rev 1 (via Regulatory Guide (RG) 1.187), there are evidences of recognition that, as issues and different facility types arise, this regulation and its framework (of endorsed guidance) has had to change to address inadequacies. These evidences include:

significant change to 50.59 with the final rule published Oct 4, 1999 that revised the criteria in the regulation revision of NEI 96-07 to add appendices to address specific issues that have arisen since Rev 1 was issued after the 1999 final rule revisions of RG 1.187 to address specific issues recent issuance of RG 2.8 to endorse guidance for implementing 50.59 at NPUFs issuance of new NEI 21-06, Rev 1 to provide guidance for implementing 50.59 that is endorsed by a new RG 2.8 It is clear that 50.59 and its endorsed guidance have not been static and have had to be modified to address new issues and facility types as these have arisen. If it was sufficient as it was to address these issues and facility types, then such changes would not have been necessary. Further if the regulation and its implementation for power reactors were sufficient for NPUFs, of which SHINE is one, then there would be no need for issuance of NEI 21-06, Rev 1 nor RG 2.8 to endorse it.

Regulatory Change Control for ISA Approaches and SHINE Commitment History As is known, 10 CFR Part 70 Subpart H, where the Integrated Safety Analysis (ISA) approach is codified for facilities that fall within the scope of Part 70 Subpart H and so are required to perform ISAs, there is a change control regulation that was specifically developed and tailored for ISA approaches to the safety analyses and safety programs (10 CFR 70.72). Were 50.59 deemed appropriate for such approaches, 70.72 would have been an imitation of 50.59. However, it is not. As the ISG augmenting NUREG-1537 recognizes that at least some of the medical isotope production facility will be like fuel cycle facilities and acknowledges the ISA approach as an acceptable means for demonstrating and ensuring adequate protection, it is quite reasonable and appropriate to ensure and insist that any change control program be one that is tailored to the safety analysis approach and safety program for the facility. For a facility using an ISA-like approach, as SHINE does, this would mean using the change control program embodied in 10 CFR 70.72.

When SHINE initially submitted its application, it had an ISA Summary that was submitted on the docket.

Just like for 10 CFR Part 70 Subpart H facilities, SHINEs ISA Summary summarized the results of SHINEs ISA, including identification and evaluation of credible accident sequences, identification and evaluation of engineered and administrative controls needed to control the accidents sufficiently to ensure adequate protection, and identification of measures to ensure the availability and reliability of the controls. As part of its technical specifications, SHINE had a TS 5.5.4, Configuration Management program that included both 10 CFR 50.59 and 10 CFR 70.72 change control programs. The commitment to both had ensured that sufficiently significant changes would be adequately identified as needing prior NRC review and approval. Subsequently and without justification, SHINE removed the ISA Summary from the docket and changed the terminology of its ISA approach, though in substance the approach is the same (just no longer on the docket and with non-Part 70 terminology).

The changes in terminology meant that the 10 CFR 70.72 commitment in TS 5.5.4 would no longer be effective. Thus, in March 2022, the staff communicated this point to the applicant and requested that, as had been done for other Part 70-derived commitments, the 70.72 commitment be modified to use the terminology that SHINE was now using in what it now called its SSA approach. After that communication, the applicant simply removed the 70.72 commitment. It claimed that its 50.59 program included appropriate elements of 70.72 but never described what those elements are. The staff recognized the convenience and reasonableness of having one change control program; however, the staff stressed that the single change control program needs to be adequate for its purpose for the safety analysis and safety program it is used for and that the applicant needs to provide the appropriate elements in a commitment in the FSAR at the very minimum. This position of the staff has not changed.

Gap Analysis To support its review of the adequacy of the SHINE change control program and identify the needed elements for that program, the staff reviewed the regulation in 50.59 and its associated endorsed guidance (both NEI-96-07, Rev 1 and NEI 21-06, Rev 1) and 70.72 and its associated guidance (RG 3.74).

The staff identified several gaps in what 50.59 would be able to cover for safety analyses and programs that are based on ISA approaches, like SHINE has. The nature of SHINEs facility and operations also support that determination.

First, for 50.59, the regulation speaks to consequences without defining the scope of that term. In the endorsed guidance and Oct 4, 1999 FRN for the final rule, consequences are defined as radiological dose only. Thus, it ignores an entire category of consequences that are relevant for SHINE; that is chemical exposures. Chemical exposures are not an insignificant hazard for SHINE. The SSA Summary Report includes several accidents where the chemical exposures from unmitigated accidents exceed the SHINE Safety Criteria, which are the same as the performance standards in 70.61 for chemical exposures.

It should be remembered that one significant impetus to development of the Part 70 Subpart H rule and ISA approaches was a chemical exposure accident that led the death of a worker and exposures of personnel and members of the public to varying degrees, including significant exposures (several personnel were hospitalized). The NRC received Congressional direction to ensure regulatory coverage of all aspects of licensed facilities which could affect the safe use of licensed material. This includes the chemical hazards associated with the use of licensed material. An MOU was created to establish regulatory authority for these chemical hazards, distinguishing between NRCs and OSHAs authority.

From this NRC is responsible for regulating the chemical hazards from licensed material or hazardous chemicals produced from licensed material. By having a change control program, for which the

evaluation criteria completely ignore the chemical exposure consequences in determining the risk significance of the change and the need for NRC approval, the NRC will not be fulfilling its mandate to adequately regulate these hazards. Thus, changes with significant chemical exposure consequences could be made without appropriate regulatory review and oversight.

Second, for 50.59, the significance of the change is evaluated in terms of whether it represents more than a minimal increase in likelihood, frequency, or consequence or if it introduces an accident of different type or malfunction of a different result. The regulation does not define what constitutes a more than a minimal increase. The FRN for the final rule and the endorsed guidance include such definitions. These are set in terms of amount of reduction of margin to limits for consequences and changes in frequency category or design basis assumptions or requirements no longer being satisfied.

In terms of consequences, the margin is to be evaluated versus regulatory limits.

As noted above, the NRCs own SER for SHINE acknowledges that no accident radiological dose criterion exists for a facility like SHINE. Thus, this definition of the more than a minimal increase criterion is meaningless unless it is tied to the accident dose criteria applied to SHINE for both workers and the public. These criteria are in the SHINE Safety Criteria in FSAR Section 3.1. Without an appropriate limit to evaluate the margin against, any change could be determined to not be more than a minimal increase in consequences. If limits that do exist in the regulations are used, then risk significant changes in terms of consequences would be inappropriately determined to not be risk significant and not receive the needed regulatory review and oversight.

Additionally, for frequency and likelihood increases, the SHINE Safety Criteria define acceptable frequencies and likelihoods for accidents of different consequence levels (also specified in the SHINE Safety Criteria). The 50.59 requirements and guidance do not include anything that address changes in terms of having such criteria. These criteria set markers for understanding the risk significance of accidents and the extent of safety controls needed to prevent or mitigate them. So, an adequate change control program needs to point to these criteria for use in evaluating the risk significance of the changes and the needed regulatory review and oversight.

ISA approaches (the SSA approach for SHINE) are risk-based approaches to safety analyses and the safety program. The criteria for determining the risk significance of a change should be guided by criteria that are tailored to that approach. The definitions of more than a minimal increase in the guidance for 50.59 are not tailored to that approach and so would not be adequate to ensure appropriate identification of risk significant changes. Thus, the definition of more than a minimal increase needs to account for changes that alter any safety-related control (engineered or administrative) that is the sole control preventing or mitigating an accident sequence and changes that remove, without at least an equivalent replacement of safety function (accounting also for changes to/differences in reliability management measures applied to the controls), a safety-related control (engineered or administrative) are a more than a minimal increase. Such changes have been deemed under ISA approaches to be risk significant changes; however, under a pure 50.59 program, that would not be recognized and accounted for since the definitions of more than a minimal increase are not setup to handle ISA approaches.

Further, the 50.59 criteria only deal with safety-related SSCs and procedures to operate SSCs. This completely ignores that administrative controls are used in an ISA approach (including SHINEs SSA) to prevent or mitigate accidents. These administrative controls are not necessarily associated with SSCs and yet, without them the credible accidents may not be adequately controlled to not exceed the

criteria for adequate protection (the SHINE Safety Criteria in SHINEs case). Thus, risk significant changes could be made that involve a whole category of safety-related controls that a pure 50.59 program would not adequately identify as risk significant and so needing regulatory review and oversight.

Thus, a TS 5.5.4 program that addresses criteria such as those described above but does not include them in the change control program for ensuring changes get the needed regulatory review and oversight (including them as elements of SHINEs 50.59 program) is inadequate to ensure adequate protection. As can be seen from the points above, a pure 50.59 change control program is not adequate to identify risk significant changes associated with a safety analysis and safety program based on the risk-based ISA approach that need prior NRC review and approval.

Additional Points Statements regarding the SSA and risk significance of changes to the SSA, including the safety-related controls, and so forth show a lack of understanding of the SSA and what it does. It is a significant part of the SHINE safety basis and safety program. The MHA approach is also a part of the safety basis.

However, selection of a bounding accident and then a maximum hypothetical accident to bound the bounding accidents of each accident category does not really bound the accidents in the SSA.

The point in discussions has been raised that the design basis accident analysis shows all public doses being less than the 1 rem TEDE criterion in the SHINE Safety Criteria. However, that analysis presupposes that the safety-related controls identified in the SSA for all the SHINE-identified credible accidents perform their prevention or mitigation function. There are many accidents in the SSA that without the safety-related controls exceed the SHINE Safety Criteria, with high consequences (100 rem for the worker or 25 rem for the public) or with intermediate consequences (5-100 rem for workers and 1 to 25 rem for the public). For those where the controls are only preventive, this means that the likelihood/frequency of the accident is reduced to be highly unlikely. They are still credible accidents which still have those high or intermediate levels of consequences. They meet the SHINE Safety Criteria by being sufficiently unlikely in the controlled scenario. Thus, saying that the FSAR design basis accident analysis bounds the accidents in the SSA in terms of consequences is not accurate, and relying on the MHA as bounding for facility accidents is not appropriate for evaluating the risk significance of accidents in the SSA or the safety-related controls for the accidents. It should also be noted that the MHA approach focuses solely on the radiological consequences, ignoring the chemical hazards accidents.

A focus on following the SSA method misses the point about risk significance of changes that are done using the method. It also misses that even in 50.59, evaluation against the first seven criteria involves following the methods in the FSAR. If the FSAR methods were not followed, then the eighth criterion becomes an issue. Following the SSA method to make a change does not give an indication of the risk significance of the change. It is the impacts to the accident sequences, the needed safety-related controls, and the necessary reliability management measures, and the introduction of accidents of a different type than analyzed that indicates the risk significance of the changes and whether regulatory review is needed. Without tying the language being added to FSAR 13a2 for the configuration management program to the evaluation of the need for NRC review (aka the need for a license amendment), all that inspectors would be able to do is confirm that a change has considered those items in following the SSA methods to make the changes. Inspectors would not be able to identify the risk significance of the changes nor the threshold of risk significance for which NRC review and approval becomes necessary for those changes. This is because, without the language being tied to evaluation for the need for NRC review and approval (i.e., not being part of the SHINE 50.59 program criteria), the

inspectors would not have the tool needed to determine that the change was significant enough to require prior NRC approval.

2) Lack of clear commitment in licensing basis documents (at least in the FSAR) specifying that maintaining the SSA is part of TS 5.5.1 maintenance of accident analysis This understanding is currently only being provided in a response to a request for confirmation of information (RCI). While on the docket and given under oath and affirmation, it does not commit the applicant to always follow this understanding. Referencing the RCI in the staffs SER does not make that understanding legally binding upon the applicant either. The understanding should be a commitment that is, at the minimum, within the licensing basis documents that impose legal requirements on the applicant and are covered by a regulatory change control program such as 50.59 for assessing any change to that commitment, which RCI responses are not.

The inadequacy of the commitment being only in an RCI response and referenced in the SER is based in part on NRC statements such as those noted in 64 FR 53582 of October 4, 1999 (the statements of consideration for the final rule for 10 CFR 50.59 and 10 CFR 72.48) and other statements provided by OGC on the implications of the SER for applicants and licensees. In 64 FR 53582, the NRC addressed a petition for rulemaking related to 10 CFR Part 72. However, given the similarity of regulatory approaches between the relevant aspects of Part 72 and Part 50, the staff expects the comments apply for 10 CFR Part 50 cases as well. In particular, on page 53605 of the FRN, the NRC stated:

The NRC SER contains staff conclusions on the adequacy of the cask design, not applicant commitments to the NRC on the cask design.

While given in the context of denying the request to require the FSAR to conform to the staffs SER, it provides the point that the SER is to state the staffs conclusions on the adequacy of the applicants design and does not impose commitments on the applicant.

Even in the FRN for the proposed rule for 10 CFR 50.59 and 72.48 (63 FR 56098 of October 21, 1998), in the discussion regarding increases of consequences of an accident or malfunction (see page 56117 of the FRN), the NRC in Note 6 states that the SAR documents the licensees/applicants derived conclusion, and that the NRC SER is intended only to confirm or modify that conclusion.

While the discussion is in the context of limits and what can be used to establish values, it still provides the NRCs approach to what the SER can and cannot do.

Thus, an RCI response can be a true statement of what the applicant intends at the time of the response, but it doesnt legally bind the applicant, as a licensee, to follow that statement (even if referenced in the SER to be a basis for the staffs finding), nor does it place the commitment under a regulatory change control process, like 50.59. The way for it to be binding upon the applicant unless changed through a regulatory change control process, would be inclusion of the statement as a commitment in the FSAR.

The staff is aware of other OGC communications that also support the staffs concern that the RCI response and SER are not sufficient to capture an enforceable commitment.

3) Lack of a reference to the SSA Summary Report in the FSAR As already stated, the SSA is a significant part of the safety analysis and the basis for SHINE meeting the regulatory requirements and for its safety program. The SSA Summary Report includes information that demonstrates that each identified credible accident is adequately controlled so it doesnt exceed the SHINE Safety Criteria for adequate safety that the FSAR does not include but upon which the

information that is in the FSAR is premised. While the FSAR summarizes the SSA approach, it does not include the information to show that each accident has been adequately controlled so as not to exceed the SHINE Safety Criteria. The information in the FSAR uses the controlled accident sequences to do the MHA approach to accident analyses. Thus, the information that demonstrates that the accidents do not exceed the SHINE Safety Criteria is in the SSA Summary Report and not the FSAR.

In the best situation, the SSA Summary Report should be on the docket and within the scope of SHINEs 50.59 change control program. Since the SSA Summary Report is not on the docket and not within SHINEs 50.59 change control program, having all the safety-related controls in the FSAR (if not in the technical specifications), along with a summary of the SSA approach, helps ensure that enough information is in the FSAR so that changes get scoped into SHINEs 50.59 program. In this case, the SSA Summary Report and the SSA are the tool to determine the risk significance of the change for evaluation under SHINEs 50.59 program. Without all the safety-related controls in the FSAR, the program is inadequate as risk significant changes involving these controls will be missed from the scope of the program.

Thus, because of the significance of the SSA and the SSA Summary Report in the SHINEs safety analysis and safety program and the role of the SSA Summary Report for evaluating the risk significance of changes under an adequate SHINE 50.59 program, the SSA Summary report should be referenced in the FSAR. The reference itself doesnt have to specify a revision number for the SSA Summary Report (the reference description can say as updated in place of a revision number). While Section 13a2 of the FSAR includes mention of the SSA Summary Report, it is still not being included in the list of references in FSAR Section 13a4 with appropriate use of the reference in the text of Ch 13. In the same way and for the same reasons, the FSAR Supplement should include references to the SSA Summary Report Supplement. As is clear, this discussion has bearing on the need for all the safety-related controls to be in the FSAR (or technical specifications) as discussed below (see issue 4).

4) Lack of identification of all safety-related controls, engineered and administrative, in the licensing basis documents (at least in the FSAR)

There have been statements that the technical specifications programs require that administrative controls have procedures. However, a requirement to have procedures for an administrative safety-related control does not mean that the existence of a particular safety-related control is required, only that if it does exist, there must be procedures for it. Furthermore, as noted above, a pure 50.59 program is focused on changes to procedures for SSCs. There are administrative controls that dont involve SSCs but that SHINE needs to adequately prevent/mitigate accident sequences that otherwise exceed the SHINE Safety Criteria for adequate protection.

Reliability management measures (e.g., training and procedures and programs for these) are also being conflated as being administrative safety-related controls or that these management measures provide control over the administrative safety-related controls (SHINEs SACs). Reliability management measures and the programs for them ensure that SACs are available and reliable and perform their function to the degree credited in the SSA analyses. They are not a control for the SACs nor do they substitute for them.

With the SSA Summary Report not being on the docket and not part of the recognized licensing basis, all the safety-related controls need to be either in the FSAR or the technical specifications; programs for reliability management measures do not substitute for the SACs or engineered safety-related controls

being in the FSAR or technical specifications. All safety-related controls that are needed to prevent or mitigate accidents to ensure the SHINE Safety Criteria are not exceeded are risk significant enough to need to be in the FSAR at a minimum. Thus, those that do not currently appear in either the FSAR or the technical specifications need to be added to the FSAR at the least. There are only a little over a dozen of these controls. Comparison of the controls that are not currently included in the FSAR or technical specifications with those that are included will show that they are of similar risk significance. So, any argument that the controls that are not currently in the FSAR are not risk-significant is not supported by the SHINE application documentation.

5) Two TS issues and additional Ch 13 SER issues TS 5.8.3.3.d Issue With regard to TS 5.8.3.3.d, as part of the argument that no change is needed here, it has been asserted that SHINE does not have any items relied on for safety (IROFS). Such a statement, while accurate lacks nuance. It was precisely in recognition that SHINE doesnt identify IROFS but has controls with the same function and purpose (among other things), that the commitment to the reporting requirements in Part 70 Appendix A that were in the SHINE technical specifications was revised to commit to those reporting requirements but with the appropriate SHINE terminology and considerations. To have the same intent and scope as the Part 70 Appendix A requirement from which it was derived, TS 5.8.3.3.d needs to use the language safety-related controls in place of safety-related structures, systems or components.

TS 5.5.4, Table 5.5.4, Criticality entry issue Word are should be deleted or the word that should be placed just preceding the word are (i.e.,

make the entry read as that are identified). This entry is not to be a statement that controls are identified in the NCSEs but that Table 5.5.4 includes the criticality controls identified in the NCSEs.

Additional Ch 13 SER issues In addition, the staff identified various changes to its input which change the meaning of the SER input and also give certain implications with which the staff finds to be problematic. These changes can and should be corrected. Left uncorrected, they are additional reasons for non-concurrence.

Emphasis on the SSA not being a requirement. The MHA approach is also not a requirement, but no statement in that regard is included in the SER. Both are ways to demonstrate compliance with the regulations. SHINE chose to use the SSA, which is an ISA approach, along with the MHA approach. Since SHINE chose to use an ISA approach, it follows that implementing that approach as it is described in the guidance is necessary unless SHINE can propose adequate alternatives to that. Thus, discussion of the SSA not being a requirement is misleading in its implications.

The SER does not include reference to the SSA Summary Report. The discussion for issue 3 above also supports why the SER should also include a reference to the SSA Summary Report.

Page 13-8 text regarding accident categories was changed in a way that makes the list of categories presented appear to be an exhaustive, all inclusive list. The original text clearly indicated that was not so but that the analyzed accident categories included those that were listed. With the language now implying the list is exhaustive, the list on pages 13-8 and 13-9 needs to be modified to include all the categories identified in all the tables in Section 2.3.2 of the SSA Summary Report. The list further needs to be modified to change loss of offsite power to loss of normal power (for which offsite power loss is a subset) and to remove in the RPF from the inadvertent nuclear criticality category since the SSA includes inadvertent nuclear

criticality in the IF as well as in the RPF (which is plainly evident from the accident and safety-related controls descriptions and evaluations in the SSA Summary Report).

Page 13-12 includes a statement about the nuclear criticality safety review being in SER Ch 6.

While accurate, this statement really has no bearing on the discussion on pages 13-11 and 13-12, which is about how the criticality accidents and controls are evaluated to show adequate safety following the SSA approach. Thus, the statement is not really relevant and should be removed.

Various items have been changed to past tense (e.g., first paragraph for Identification of Reliability Management Measures). The staff has concerns that this gives the impression that the SSA is a one and done action. The SSA is a living, ongoing approach. SHINE will need to continue to perform these actions as needed as new accidents are identified or changes that affect safety-related controls are made during facility operations. The SER needs to be clear on this point.