ML15161A140

Shine Medical Technologies V. 0 - Chapter 13 - Accident Analysis

ML15161A140
Person / Time
Site:	SHINE Medical Technologies
Issue date:	05/21/2015
From:	Bynum R Shine Medical Technologies
To:	Office of Nuclear Reactor Regulation
Lynch S
References
SHINE, SHINE.SUBMISSION.18, SHN.PSAR.P, SHN.PSAR.P.8
Download: ML15161A140 (123)

Text

Chapter 13 - Accident Analysis Table of Contents CHAPTER 13 ACCIDENT ANALYSIS Table of Contents Section Title Page 13a1 HETEROGENEOUS REACTOR ACCIDENT ANALYSIS......................13a1-1 13a2 IRRADIATION FACILITY ACCIDENT ANALYSIS .................................13a2-1 13a2.1 ACCIDENT-INITIATING EVENTS AND SCENARIOS...........................13a2-1 13a2.1.1 MAXIMUM HYPOTHETICAL ACCIDENT ..............................................13a2-2 13a2.1.2 INSERTION OF EXCESS REACTIVITY/INADVERTENT CRITICALITY .........................................................................................13a2-4 13a2.1.3 REDUCTION IN COOLING....................................................................13a2-8 13a2.1.4 MISHANDLING OR MALFUNCTION OF TARGET SOLUTION ............13a2-11 13a2.1.5 LOSS OF OFF-SITE POWER................................................................13a2-13 13a2.1.6 EXTERNAL EVENTS .............................................................................13a2-15 13a2.1.7 MISHANDLING OR MALFUNCTION OF EQUIPMENT AFFECTING THE PSB...........................................................................13a2-16 13a2.1.8 LARGE UNDAMPED POWER OSCILLATIONS....................................13a2-18 13a2.1.9 DETONATION AND DEFLAGRATION IN PRIMARY SYSTEM BOUNDARY ...........................................................................13a2-20 13a2.1.10 UNINTENDED EXOTHERMIC CHEMICAL REACTIONS OTHER THAN DETONATION ...............................................................13a2-22 13a2.1.11 PRIMARY SYSTEM BOUNDARY SYSTEM INTERACTION EVENTS .................................................................................................13a2-22 13a2.1.12 FACILITY-SPECIFIC EVENTS ..............................................................13a2-29 13a2.2 ACCIDENT ANALYSIS AND DETERMINATION OF CONSEQUENCES.................................................................................13a2-36 13a2.2.1 TARGET SOLUTION RELEASE INTO THE IU CELL ...........................13a2-36 13a2.2.2 EXCESS REACTIVITY INSERTION ACCIDENT...................................13a2-44 13a2.2.3 REDUCTION IN COOLING....................................................................13a2-48 13a2.2.4 MISHANDLING OR MALFUNCTION OF TARGET SOLUTION ............13a2-48 13a2.2.5 LOSS OF OFF-SITE POWER................................................................13a2-51 13a2.2.6 EXTERNAL EVENTS .............................................................................13a2-52 13a2.2.7 MISHANDLING OR MALFUNCTION OF EQUIPMENT AFFECTING THE PSB...........................................................................13a2-52 13a2.2.8 LARGE UNDAMPED POWER OSCILLATION ......................................13a2-56 13a2.2.9 DETONATION AND DEFLAGRATION IN PRIMARY SYSTEM BOUNDARY ...........................................................................13a2-56 13a2.2.10 UNINTENDED EXOTHERMIC CHEMICAL REACTIONS OTHER THAN DETONATION ...............................................................13a2-57 13a2.2.11 PRIMARY SYSTEM BOUNDARY SYSTEM INTERACTION EVENTS .................................................................................................13a2-57 SHINE Medical Technologies 13-i Rev. 1

Chapter 13 - Accident Analysis Table of Contents Table of Contents (contd)

Section Title Page 13a2.2.12 FACILITY-SPECIFIC EVENTS ..............................................................13a2-57 13a3

SUMMARY

AND CONCLUSIONS .........................................................13a3-1 13a4 REFERENCES.......................................................................................13a4-1 13b RADIOISOTOPE PRODUCTION FACILITY ACCIDENT ANALYSES ............................................................................................13b-1 13b.1 RADIOISOTOPE PRODUCTION FACILITY ACCIDENT ANALYSIS METHODOLOGY ................................................................13b-1 13b.1.1 PROCESSES CONDUCTED OUTSIDE OF THE IRRADIATION FACILITY................................................................................................13b-1 13b.1.2 ACCIDENT INITIATING EVENTS..........................................................13b-3 13b.2 ANALYSES OF ACCIDENTS WITH RADIOLOGICAL CONSEQUENCES.................................................................................13b-4 13b.2.1 MAXIMUM HYPOTHETICAL ACCIDENT IN THE RPF .........................13b-4 13b.2.2 LOSS OF CONTAINMENT ....................................................................13b-12 13b.2.3 EXTERNAL EVENTS .............................................................................13b-13 13b.2.4 CRITICAL EQUIPMENT MALFUNCTION..............................................13b-14 13b.2.5 INADVERTENT NUCLEAR CRITICALITY IN THE RADIOISOTOPE PRODUCTION FACILITY ..........................................13b-24 13b.2.6 RADIOISOTOPE PRODUCTION FACILITY FIRE.................................13b-30 13b.3 ANALYSIS OF ACCIDENTS WITH HAZARDOUS CHEMICALS PRODUCED FROM LICENSED MATERIAL .........................................13b-37 13b.3.1 CHEMICAL ACCIDENTS DESCRIPTION .............................................13b-37 13b.3.2 CHEMICAL ACCIDENT CONSEQUENCES..........................................13b-41 13b.3.3 CHEMICAL PROCESS CONTROLS .....................................................13b-44 13b.3.4 CHEMICAL PROCESS SURVEILLANCE REQUIREMENTS................13b-45 13b.4 REFERENCES.......................................................................................13b-51 SHINE Medical Technologies 13-ii Rev. 1

Chapter 13 - Accident Analysis List of Tables List of Tables Number Title 13a2.2.1-1 Material at Risk for TSV Source Term 13a2.2.1-2 Parameters Used in the Dose Consequence Assessment 13a2.2.1-3 Public and Worker LPF for each DBA 13a2.2.1-4 Airborne Release and Respirable Fractions for each DBA 13a2.2.7-1 Material at Risk for TOGS Source Term 13a3-1 Potential Consequences of Postulated Accidents in the Irradiation Facility 13b.2.1-1 Source Terms for NGRS Storage Tanks 13b.2.1-2 Parameters Used in the Dose Consequence Assessment 13b.2.1-3 Public and Worker LPF for each DBA 13b.2.1-4 Airborne Release and Respirable Fractions for each DBA 13b.2.4-1 MAR for NGRS Storage Tank 13b.2.5-1 Safety-Related SSCs and Technical Specification Administrative Controls to Prevent Criticality Accidents 13b.2.6-1 Material at Risk for RPF Fire Source Term 13b.3-1 Bounding Inventory (lbs) of Significant Process Chemicals 13b.3-2 SHINE Toxic Chemical Source Terms and Concentrations SHINE Medical Technologies 13-iii Rev. 1

Chapter 13 - Accident Analysis Table of Contents List of Figures Number Title None SHINE Medical Technologies 13-iv Rev. 0

Chapter 13 - Accident Analysis Acronyms and Abbreviations Acronyms and Abbreviations Acronym/Abbreviation Definition ARF airborne release fraction AHR aqueous homogenous reactor AMSB ambient molecular sieve bed BR breathing rate BV building volume CAMS continuous air monitoring system CAAS criticality accident and alarm system CEDE committed effective dose equivalent DCF dose conversion factors DCS DC power supply system DDT deflagration detonation transition DBA design basis accident DBT design basis tornado DR damage ratio DV dispersion value keff effective neutron multiplication factor EDE external dose equivalent ESF engineered safety feature FFPS facility fire detection and suppression system FVZ4 facility ventilation Zone 4 FSAR Final Safety Analysis Report FHA Fire Hazard Analysis GDC General Design Criterion H/X moderator to fissile material ratio HAZOPS hazard and operability study SHINE Medical Technologies 13-v Rev. 1

Chapter 13 - Accident Analysis Acronyms and Abbreviations Acronyms and Abbreviations Acronym/Abbreviation Definition HRR heat release rate HEPA high efficiency particulate air HGL hot gas layer HMI human machine interface IE initiating event IF irradiation facility ISA integrated safety analysis ISG interim staff guidance IU irradiation unit L liter LOOP loss of off-site power LEU low enriched uranium LFL lower flammability limit LPF leak path factor LWPS light water pool system MAR material at risk MHA maximum hypothetical accident Mo-99 molybdenum-99 NDAS neutron driver assembly system NGRS noble gas removal system NSR non-safety related NPSS normal electrical power supply system PCLS primary closed loop cooling system PDP positive displacement pump PFBS production facility biological shielding PHA preliminary design hazard analysis SHINE Medical Technologies 13-vi Rev. 1

Chapter 13 - Accident Analysis Acronyms and Abbreviations Acronyms and Abbreviations Acronym/Abbreviation Definition PSB primary system boundary PVVS process vessel vent system RAMS radiation air monitoring system RF respiratory fraction RPCS radioisotope process cooling system RPF radioisotope production facility RCA radiologically controlled area RVZ1 RCA ventilation Zone 1 RVZ2 RCA ventilation Zone 2 RVZ3 RCA ventilation Zone 3 SSE safe shutdown earthquake SAR Safety Analysis Report SR safety-related SHINE SHINE Medical Technologies, Inc.

SWRA Southern Wisconsin Regional Airport SNM special nuclear material SDG standby diesel generator SCA subcritical assembly SCAS subcritical assembly system SCADA supervisory control and data acquisition SCADA/HMI supervisory control and data acquisition/human machine interface SSCs systems, structures, and components SSC system, structure, and component TEDE total effective dose equivalent TSV target solution vessel TCAP thermal cycling absorption process SHINE Medical Technologies 13-vii Rev. 0

Chapter 13 - Accident Analysis Acronyms and Abbreviations Acronyms and Abbreviations Acronym/Abbreviation Definition TDN thermal denitration TPS tritium purification system TOGS TSV off-gas system TPCS TSV process control system TRPS TSV reactivity protection system UPS uninterruptable power supply UPSS uninterruptable power supply system UREX uranium extraction UN uranyl nitrate SHINE Medical Technologies 13-viii Rev. 0

Chapter 13 - Accident Analysis Heterogeneous Reactor Accident Analysis CHAPTER 13 ACCIDENT ANALYSIS 13a1 HETEROGENEOUS REACTOR ACCIDENT ANALYSIS The SHINE Medical Technologies, Inc. (SHINE) facility is not a heterogeneous reactor; therefore, this section is not applicable.

SHINE Medical Technologies 13a1-1 Rev. 0

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis 13a2 IRRADIATION FACILITY ACCIDENT ANALYSIS 13a2.1 ACCIDENT-INITIATING EVENTS AND SCENARIOS The purpose of Section 13a2 is to identify the postulated initiating events (IEs) and credible accidents that form the design basis for the irradiation facility (IF), which includes the subcritical assembly system (SCAS) and its associated primary system boundary (PSB). Section 13b identifies the postulated IEs and credible accidents within the radioisotope production facility (RPF). The design basis accidents (DBAs) identified in Subsection 13a2.1 range from anticipated events, such as a loss of electrical power, to a postulated maximum hypothetical accident (MHA) that exceeds the radiological consequences of any accident considered to be credible. The MHA is intended to establish a bounding consequence and need not be credible.

The bases for the identification of DBAs and their IEs and associated accident scenarios are:

• Hazard and operability study (HAZOPS) and preliminary design hazard analysis (PHA) within the integrated safety analysis (ISA) summary, in accordance with NUREG-1520.

• List of IEs and accidents identified in the Final Interim Staff Guidance (ISG) Augmenting NUREG-1537.

• Experience of the hazard analysis team.

• Current preliminary design for the processes and facility.

The following categories of accidents are evaluated:

• MHA (Subsection 13a2.1.1).

• Insertion of excess reactivity and inadvertent criticality (Subsection 13a2.1.2).

• Reduction in cooling (Subsection 13a2.1.3).

• Mishandling or malfunction of target solution (Subsection 13a2.1.4).

• Loss of off-site power (Subsection 13a2.1.5).

• External events (Subsection 13a2.1.6).

• Mishandling or malfunction of equipment affecting the PSB (Subsection 13a2.1.7).

• Large undamped power oscillations (Subsection 13a2.1.8).

• Detonation and deflagration in the PSB (Subsection 13a2.1.9).

• Unintended exothermic chemical reactions other than detonation (Subsection 13a2.1.10).

• PSB system interaction events (Subsection 13a2.1.11).

• Facility specific events:

- Inadvertent exposure to neutrons from the neutron driver (Subsection 13a2.1.12.1).

- Irradiation facility cell fire (Subsection 13a2.1.12.2).

- Tritium purification system design basis accident (Subsection 13a2.1.12.3).

Qualitative evaluations were performed on the above categories of accidents to further identify the bounding or limiting accidents and scenarios that could result in the highest potential consequences. These evaluations were based on review of identification of causes, the initial conditions, and assumptions for each accident. A general scenario was reviewed for each IE and a general consequence analysis performed. The licensing basis conclusions of these qualitative evaluations identified the following DBAs requiring further analysis in Section 13a2.2:

• IF postulated MHA (Subsection 13a2.2.1).

• Insertion of excess reactivity (Subsection 13a2.2.2).

• Mishandling or malfunction of target solution (Subsection 13a2.2.4)

SHINE Medical Technologies 13a2-1 Rev. 0

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis

• Mishandling or malfunction of equipment affecting PSB (Subsection 13a2.2.7).

• Tritium purification system design basis accident (Subsection 13a2.2.12.3).

Further analysis of the above DBAs involved: (1) Identification of the limiting IE and bounding conditions, (2) Reviewing the sequence of events for functions and actions that change the course of the accident or mitigate the consequences, (3) Identifying damage to equipment or the facility that affects the consequences of the accident, (4) Review of the potential radiation source term and radiological consequences, and (5) Identification of facility-wide safety controls to prevent or mitigate the consequences of the accident.

Results of these analyses in Subsection 13a2.2, taking credit for safety-related SSCs and engineered safety features (ESFs) for each DBA, demonstrate that the mitigated consequences do not exceed the dose limits in 10 CFR 20.

13a2.1.1 MAXIMUM HYPOTHETICAL ACCIDENT In accordance with the guidance in the Final ISG Augmenting NUREG-1537, an MHA that bounds the potential radiological consequences of any accident considered to be credible is analyzed. The basis for selecting an MHA includes assumptions described below.

The SHINE facility is divided into two major process areas, the IF and the RPF areas. The IF includes eight IUs each containing, among other components, an SCAS (including the TSV and TSV dump tank), light water pool system (LWPS), and the TSV off-gas system (TOGS). The TSV, TOGS, TSV dump tank, and associated components make up the PSB. The RPF consists of several process areas that extract and purify the molybdenum-99 (Mo-99) product, recycle uranium, and extract other fission products. These include the molybdenum extraction cells, the purification cells, the uranium extraction (UREX) process cells, thermal denitration (TDN) area, and waste processing areas. A supercell is comprised of a molybdenum extraction area, a purification area, and a packaging area that form one hot cell structure. The RPF contains three supercells.

The MHA is used to demonstrate that the maximum consequences in operating the facility at a specific site are within acceptable regulatory limits of 10 CFR 20.1201 and 10 CFR 20.1301. The MHA is a non-credible accident scenario that results in a release with radiological consequences that bound the DBAs. The Final ISG Augmenting NUREG-1537 specifies several possible MHAs that could be considered.

13a2.1.1.1 Initial Conditions and Assumptions Potential MHA scenarios suggested by the Final ISG Augmenting NUREG-1537 include:

• Energetic dispersal of contents of the PSB with bypass of scrubbing capacity.

• Detonation of hydrogen in the recombiner resulting in waste gas tank failure and release of some or all of the target solution and fission-product contents in aerosolized form.

• Complete loss of target solution inventory (e.g., TSV break).

• Man-made external event that breaches the PSB of more than one IU.

• Facility-wide external event that breaches various systems containing radioactive fluids.

SHINE Medical Technologies 13a2-2 Rev. 2

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis Because the SHINE facility is being designed to withstand external events such as tornado, seismic, or man-made external events, scenarios that involve multiple IUs are not analyzed further. In addition, several internal events were eliminated as possible MHAs due to the design of the facility. Because production piping is located in covered, concrete trenches that are designed to contain loss of inventory and drain to criticality-safe sumps, this event was eliminated as a possible MHA for the RPF.

The postulated MHA in the IF is a release of irradiated target solution to the IU cell as a result of a loss of TSV integrity. It is assumed that the PSB and the subcritical assembly support structure (SASS) have breached. The presence of the light water pool is ignored for the purposes of the IF postulated MHA. The loss of TSV integrity encompasses either a TSV or TSV dump tank rupture.

Due to the robust design of the TSV, a rupture is not considered to be a credible event. However, for the purpose of the MHA analysis, it is postulated that a breach of the TSV occurs. Note that the MHA assumes that only one IU is compromised. Each IU cell is constructed with reinforced concrete walls and ceiling. Because of the robust design of each IU cell and the design against external events, events capable of rupturing more than one TSV inside of the IF are not considered to be credible.

The postulated MHA in the RPF area is a failure of the five noble gas removal system (NGRS) storage tanks with the inventory released inside the noble gas storage cell. Because the noble gas storage cell is designed as a robust structure to provide shielding and confinement, the release of noble gas is confined to the storage cell and the RCA ventilation Zone 1 (RVZ1) system piping, with some leakage assumed through storage cell penetrations.

For both MHAs considered above, (a complete loss of inventory of a TSV into the IU cell or a complete release of the NGRS inventory into the noble gas storage cell) the following initial conditions are assumed:

• Maximum radioisotope inventories in the TSV and the NGRS.

• The robust design of each IU cell provides isolation between IUs, therefore it is assumed that only one IU is affected by the event.

• IU cell penetrations for piping, ducts and electrical cables and airlocks are sealed within design specifications to limit the release of radioactive materials from the IU cell.

• The RVZ1 is operating normally at the time of the IE with:

- One fan in operation and a second fan in standby mode.

- Two passive multi-filter housing units containing two-stage high-efficiency particulate air (HEPA) filtration and single-stage carbon absorbers (Section 9a2.1).

- Ventilation inside the IU cells, noble gas storage cell, and hot cells of both the IF and RPF.

• RVZ1 bubble-tight isolation dampers (normally open/fail closed) are installed at the IU cell, noble gas storage cell, and hot cells, for both supply and exhaust. These are designed to be closed both automatically and manually on high radiation. Both the ventilation supply and exhaust penetrations have redundant bubble-tight dampers.

• The TSV reactivity protection system (TRPS) is functioning as designed during operating conditions. Therefore, the neutron driver is deactivated and fusion and fission reactions are terminated.

• Power and control cables that are needed for monitoring of the IUs and operation of the TOGS are routed and protected to prevent loss of both divisions of power from a single event.

SHINE Medical Technologies 13a2-3 Rev. 1

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis 13a2.1.1.2 General Scenario Description Irradiation Facility Postulated MHA The IF postulated MHA general scenario is a release of irradiated target solution to the IU cell as a result of a loss of TSV integrity. No credit is taken for light water pool scrubbing or subcritical assembly support structure (SASS) confinement. Therefore, the first mitigating safety feature is the robust IU cell structure. Because of this robust design, the structure remains intact and confines a majority of the inventory released from the TSV within the IU cell.

The release of irradiated target solution into the IU cell could result in a release to the environment through the facility stack via the RVZ1 flow path. Under accident conditions, the release is mitigated by filters in the RVZ1 and isolation of the IU cell by inlet and outlet dampers.

Radioisotope Production Facility Postulated MHA For the MHA postulated scenario in the RPF, the greatest potential radiological release would be the failure of the five NGRS storage tanks. The result for this scenario is a release of inventory of noble gases from NGRS storage tanks into the noble gas storage cell. The first mitigating safety feature is the robust noble gas storage cell structure that includes the thick concrete walls and ceiling that surround the five noble gas storage tanks. Because of the robust design, the storage cell structure remains intact and confines a majority of the inventory release of the NGRS storage tanks to within the noble gas storage cell. Therefore, the release is mitigated by a holdup of the noble gases in the storage cell, resulting in their further decay before further release.

The release of the noble gas inventory into the NGRS storage cell could result in a radioisotope release to the environment through the facility stack via the RVZ1 flow path. The release is mitigated by isolation of the noble gas storage cell by inlet and outlet dampers on abnormally high radiation levels. HEPA and charcoal filters in RVZ1 are ineffective in the mitigation of accidents involving a release of noble gases.

Based on the detailed consequence analysis in Subsections 13a2.2.1 and 13b.2.1, the RPF postulated MHA provides the bounding consequences to the public. Therefore, this is determined to be the MHA for the SHINE facility.

13a2.1.2 INSERTION OF EXCESS REACTIVITY/INADVERTENT CRITICALITY Both the Final ISG Augmenting NUREG-1537 and the ISA Summary have identified the insertion of excess reactivity during normal operations as a potential IE/scenario category that needs to be evaluated as part of the accident analysis. Furthermore, the ISA Summary also identified the potential for an inadvertent criticality during the startup process of the TSV as a scenario that needs to be evaluated.

Three operating conditions were evaluated for the TSV: (1) fill operations with uranyl sulfate (clean or previously irradiated) solution, (2) cold target solution immediately prior to neutron driver startup, and (3) irradiation operations once the neutron driver is started. For the subcritical TSV, excess reactivity is defined as an amount of potential added reactivity above normal conditions.

SHINE Medical Technologies 13a2-4 Rev. 1

[Proprietary Information - Withhold from public disclosure under 10 CFR 2.390(a)(4)]

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis For cold conditions at the end of the filling mode (Mode 1), the normal keff is approximately

[ Proprietary Information ]. For steady-state irradiation operations (Mode 2), normal keff is approximately [ Proprietary Information ]. The TSV is designed to be in a subcritical condition during all modes of operation with multiple safety controls to prevent and mitigate an insertion of excess reactivity or inadvertent criticality. The potential for an inadvertent criticality is greater during fill operations; however, as is discussed in the following subsections, such an event is not considered credible. The inadvertent criticality event outside the IU cell (in the RPF) is evaluated in detail in Subsection 13b.2.5. The consequences of credible excess reactivity insertion events are presented in Subsection 13a2.2.2.

13a2.1.2.1 Identification of Causes, Initial Conditions, and Assumptions As indicated previously, both the Final ISG Augmenting NUREG-1537 and the ISA Summary have identified postulated IEs or scenarios that could lead to an insertion of excess reactivity during operation:

• Increase in the target solution density (e.g., due to pressurization) during irradiation.

• Target solution temperature reduction (e.g., excessive cooldown).

• Moderator addition due to cooling system malfunction (e.g., [ Proprietary Information ]).

• Additional target solution injection during fill/startup and irradiation operations.

• Realistic, adverse geometry changes.

• Reactivity insertion due to moderator lumping effects.

• Inadvertent introduction of other materials into the target solution.

• Bulk boiling of the target solution.

• Chemical changes in the TSV target solution (including precipitation of uranium/fission products).

The following initial conditions or assumptions are made with respect to the TSV fill or startup and irradiation operations:

• TSV is filled to an approximate keff of [ Proprietary Information ] at a cold startup temperature of 68°F (20°C).

• TRPS is designed to trip the TSV on high neutron flux (high range and source range)

(power) level to protect the PSB.

• The TSV is operated in a subcritical state at all times with a nominal keff of approximately

[Proprietary Information] during steady-state irradiation operations.

• The TSV is designed to operate with the neutron driver in service for a source strength yielding a maximum value of [ Proprietary Information] within the target solution.

• The TSV is designed to operate at a nominal average temperature of 140°F (60°C);

maximum average temperature is expected to be below 176°F (80°C).

• For fill/startup operations, the worst case source term for the insertion of excess reactivity event would occur at the start of the final cycle just before irradiation.

• For irradiation operations, the worst case source term for the insertion of excess reactivity event would occur at the end of the final cycle.

• The target solution has high negative temperature and void coefficients (see Section 4a2.6).

SHINE Medical Technologies 13a2-5 Rev. 0

[Proprietary Information - Withhold from public disclosure under 10 CFR 2.390(a)(4)]

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis 13a2.1.2.2 General Scenario Description The general scenarios for each of the nine potential excess reactivity events listed in Subsection 13a2.1.2.1 are discussed in detail below.

13a2.1.2.2.1 Increase in the Target Solution Density During Operations During irradiation operations, pressurization of the target solution fluid could occur if there is an off-gas system or cooling system malfunction. A larger system pressurization could also occur following a deflagration in the headspace of the TSV due to hydrogen accumulation during or following irradiation operations. This event would require the failure of TOGS to perform its safety functions. The increase in TSV pressure would cause some void collapse, which is a positive reactivity addition, but not a large enough addition to cause the system reactivity to increase beyond the cold shutdown starting point, since the most bounding condition is a cold target solution with no voids (present at the beginning of irradiation). Therefore, this event causes a positive reactivity addition, but not large enough to reach a critical condition (keff = 1) or even reach cold startup keff values.

The target solution pressurization event is mitigated by the TRPS high neutron flux trip, which de-energizes the neutron driver and opens the TSV dump valves. Hydrogen deflagration is prevented by a number of controls that prevent the accumulation of hydrogen, including a TRPS IU trip upon detection of hydrogen above acceptable levels and the continuous recombination of hydrogen by the TOGS. Further analysis is presented in Subsection 13a2.2.2.

13a2.1.2.2.2 Target Solution Temperature Reduction The IU is cooled by the primary closed loop cooling system (PCLS) and the light water pool cooling system (LWPS). The PCLS is a closed loop that circulates cooling water [Proprietary Information] past the TSV walls to remove heat generated in the target solution during normal irradiation and shutdown operations. The LWPS circulates the light water pool water to remove heat generated during normal and shutdown operations.

An excessive cooldown could occur if either system malfunctions and overcools the target solution in the TSV, adding positive reactivity due to the negative temperature coefficient. An overcooling event is prevented by the TRPS trip on high neutron flux level or low PCLS temperature. Further analysis is presented in Subsection 13a2.2.2.

13a2.1.2.2.3 Moderator Addition Due to Cooling System Malfunction The PCLS is a closed loop that circulates cooling water [Proprietary Information] past the TSV walls to remove heat generated in the TSV during normal irradiation and shutdown operations. If there were a breach between the TSV and PCLS, cooling water could be added to the target solution. A dilution event such as this is expected to lower the overall reactivity of the target solution due to the high hydrogen to uranium ratio in the target solution (target solution is over-moderated).

SHINE Medical Technologies 13a2-6 Rev. 0

[Proprietary Information - Withhold from public disclosure under 10 CFR 2.390(a)(4)]

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis 13a2.1.2.2.4 Additional Target Solution Injection during Fill/Startup and Irradiation Operations During irradiation operations, target solution injection from the target solution hold tank is not credible due to the isolation of the TSV, and the fact that the TSV is located higher than the target solution hold tank, thus requiring the solution to be pumped into the TSV. The TSV fill pump and fill valves are de-energized and locked out/closed in order to allow neutron driver startup and ensure that no fissile material enters the TSV during irradiation. The TRPS provides a safety-related interlock to ensure the fill valves are closed prior to irradiation.

During fill/startup operations, excess fissile material is prevented from being added by several controls. The first is in the preparation of the target solution itself, where tight control of the uranium enrichment and concentration in the target solution is implemented. Other controls include limiting the size of the valves and piping to the TSV to provide control on fill rate, using fill procedures containing hold points at certain volume levels to verify expected system behavior, and requiring reduced fill increments until the desired subcritical multiplication is reached (using the 1/M method).

The TRPS control is being designed to close the fill valves and open the dump valves upon detection of high flux or count rates. Although not credited, a manual trip by the operators also causes the TSV solution to transfer to the TSV dump tank should an unsafe condition arise.

Further analysis is presented in Subsection 13a2.2.2.

13a2.1.2.2.5 Realistic, Adverse Geometry Changes Geometry changes are mitigated by having the TSV, subcritical assembly support structure (SASS), TSV dump tank, piping, and associated dump valves seismically-qualified and designed to withstand a potential deflagration if there is a failure in the TOGS. Consideration is given to the potential frothing and sloshing of the target solution caused by the disassociation of the water that might cause a localized excess reactivity event as voids form and collapse, but this is not expected to lead to any uncontrolled/undamped power oscillations (Subsection 13a2.1.8). Large adverse geometric changes could cause a pressure fluctuation and subsequent neutron flux increase that would be sensed by the TRPS and mitigated by a TSV trip resulting in the target solution dump to the criticality-safe by geometry TSV dump tank.

13a2.1.2.2.6 Reactivity Insertion Due to Moderator Lumping Effects The PCLS is a closed loop that circulates cooling water [ Proprietary Information ] past the TSV walls to remove heat generated in the TSV during normal irradiation and shutdown operations.

The cooling system design and operating characteristics preclude significant reactivity effects due to moderation changes in the subcritical TSV during operation.

13a2.1.2.2.7 Inadvertent Introduction of Other Materials into the Target Solution The inadvertent introduction of other materials into the target solution is prevented by isolating the TSV once it is filled and ready for irradiation operations. There is no need to add any chemicals to control the chemistry of the target solution during the irradiation cycle. The only systems that interact with the subcritical assembly system (SCAS) during irradiation operations are the TOGS, NDAS, LWPS, and PCLS. The TSV dump tank is located below the TSV and only accepts fluid from the TSV during a trip or when an operator takes action to drain the TSV SHINE Medical Technologies 13a2-7 Rev. 0

[Proprietary Information - Withhold from public disclosure under 10 CFR 2.390(a)(4)]

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis following an irradiation cycle. Therefore, water is the only significant material that could be potentially introduced into the TSV either through a leak from the PCLS or the return of water from the recombiner in the TOGS. A dilution event such as this lowers the reactivity of the TSV since the target solution is over-moderated and is expected to be well mixed.

13a2.1.2.2.8 Bulk Boiling of the Target Solution The maximum average operating temperature of the TSV during irradiation is expected to be approximately 176°F (80°C). Bulk boiling of the target solution is not expected under normal, abnormal, or accident conditions. Should bulk boiling occur, there would be an increased release of fission product gases contained in the target solution, which leads to a small positive reactivity addition; however, this effect is more than offset by the large negative reactivity addition due to the temperature increase of the target solution. Therefore, bulk boiling of the target solution does not lead to an excess reactivity insertion.

13a2.1.2.2.9 Chemical Change of the TSV Target Solution The chemical control of the target solution is performed during the preparation of the solution in the RPF. Once the target solution is prepared and transferred to the TSV hold tank, there are no additional chemical control additives. Independent measurement and verification of uranium concentrations along with other chemical additives is required prior to transferring target solution to the TSV to ensure allowable uranium concentrations are met and to preclude uranium precipitation during irradiation operations.

No significant pH changes are expected during irradiation due to the stability of sulfuric acid under irradiation.

13a2.1.3 REDUCTION IN COOLING NUREG-1537, the Final ISG Augmenting NUREG-1537, and the ISA Summary have identified loss or reduction in cooling as a potential IE scenario that needs evaluation as part of the accident analysis.

The following components were evaluated:

• The neutron driver.

• The [ Proprietary Information ] neutron multiplier.

• The TSV containing uranyl sulfate.

These components are cooled by the PCLS and the LWPS, as described in Section 5a2.2, during irradiation operations to maintain a target solution average temperature of approximately 140°F (60°C) at less than [ Proprietary Information ] of heat generation. Because the cooling pumps are driven by off-site power, a loss of coolant flow will occur due to power failure, and could occur due to failure of the pump or pumps, inadvertent valve closure, or a pipe break.

If cooling loop circulation flow is lost, the light water pool removes decay heat by passively absorbing the heat in its approximately [ Proprietary Information ] water volume.

Consequences of a reduction in cooling are presented in Subsection 13a2.2.3.

SHINE Medical Technologies 13a2-8 Rev. 0

[Proprietary Information - Withhold from public disclosure under 10 CFR 2.390(a)(4)]

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis 13a2.1.3.1 Identification of Causes, Initial Conditions, and Assumptions The IU and TSV are cooled by the PCLS and the LWPS. The PCLS is a closed loop that circulates cooling water [ Proprietary Information ] past the TSV walls to remove heat generated in the target solution during normal irradiation and shutdown operations. Section 5a2.2 specifies that the PCLS is designed to remove [ Proprietary Information ].

The LWPS circulates the water from the light water pool through a heat exchanger to remove heat generated during normal and shutdown operations. The LWPS is designed to remove

[ Proprietary Information ] of heat, as detailed in Section 5a2.2.

There are several IEs that can result in loss of cooling:

• Loss of off-site power (LOOP).

• Loss of or reduced flow of PCLS or LWPS due to:

- Flow blockage

- Pump malfunction

- Operator error

- Pipe break

- Valve closure These IEs create three possible scenarios for reduction in cooling evaluation:

a. Loss of off-site power resulting in loss of PCLS, LWPS, and de-energized neutron driver.

b. Loss of PCLS due to blockage, malfunction, or operator error (LWPS and neutron driver remain operating).

c. Loss of PLCS and LWPS due to electrical panel failure or operator error (neutron driver remains operating).

The initial conditions and assumptions for each event are summarized below.

Scenario A - Loss of Off-Site Power This results in a loss of coolant flow in the PCLS and the LWPS cooling loops. The TRPS is designed to trip, opening the TSV dump valves, which dump the target solution to the TSV dump tank. The neutron driver does not function without off-site power, and therefore no further heat is generated in the target solution with the exception of decay heat. Initial conditions below are taken from Section 5a2.2 and Subsection 13a2.1.2:

• [ Proprietary Information ] heat generated within the target solution and 10 percent uncertainty.

• Total heat load of [ Proprietary Information ], including uncertainty.

• Initial temperature is assumed to be 75°F (24°C) in the light water pool (Section 5a2.2).

• Bulk target solution temperature of up to 176°F (80°C) (Section 5a2.2).

• Continuous irradiation operation at a TSV power or [ Proprietary Information ] (with 10 percent uncertainty) for 6 days.

• No PCLS/LWPS pump coastdown.

• Complete loss of flow at time of initiating event resulting in an immediate transition from forced to natural convection to the light water pool.

SHINE Medical Technologies 13a2-9 Rev. 0

[Proprietary Information - Withhold from public disclosure under 10 CFR 2.390(a)(4)]

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis

• Light water pool volume of about [ Proprietary Information ] (Section 5a2.2).

Scenario B - Loss of or Reduced PCLS Flow This scenario assumes a loss of PCLS and an operator error that results in continued operation of the neutron driver. There are numerous events which could result in loss of total flow or flow reduction in the PCLS. Some of which could be operator error, loss of a pump due to a failure, loss of power to a pump, flow obstruction, and failure of active components in the PCLS. Initial conditions are the same as in Scenario A.

Scenario C - Loss of or Reduced PCLS and LWPS Flow This scenario is a low probability event not expected to occur during the facility lifetime, but that is still deemed credible. This scenario assumes a loss of PCLS and LWPS due to failures other than LOOP to the facility. Loss of power limited to the heat removal system may simultaneously de-energize both the PCLS and LWPS heat removal systems. Control failures or operator error result in continued operation of the neutron driver. Initial conditions are the same as in Scenario A. Of the three scenarios, this is the most limiting of the reduction in cooling events.

13a2.1.3.2 General Scenario Descriptions As noted in Subsection 13a2.1.3.1, there are three accident scenarios that have been postulated as events for evaluation of the temperature response of the light water pool and the target solution.

Scenario A - Loss of Off-Site Power This loss of the cooling flow is a result of a LOOP. The loss of coolant flow and loss of neutron driver power results in the TRPS setpoint trip, which terminates the fission and fusion reactions and reduces heat generated in the target solution prior to automatic opening of the TSV dump valves. Any increase in TSV temperature prior to the TRPS trip would introduce negative reactivity. The TSV dump valves open, draining the target solution to the TSV dump tanks located in the light water pool. The light water pool is the heat sink for the decay energy. The TSV dump tank is geometrically designed to be subcritical.

Scenario B - Loss of or Reduced PCLS Flow A loss of PCLS cooling with continued operation of the neutron driver and LWPS is assumed.

Loss of PCLS flow can occur due to numerous failures: failure of the power supply to the pump, pump shaft lockup or failure, or operator error. Loss of PCLS cooling could also result as a consequence of flow path isolation due to inadvertent valve closure, loss of heat sink, or PCLS leakage due to a piping or component rupture. Eventually, the neutron driver is de-energized by the TRPS on loss of PCLS flow trip. The TSV dump valves open and the target solution is dumped to the TSV dump tank. The heat removal system for the LWPS is assumed to maintain a constant heat removal rate, for simplicity of evaluation. The light water pool is the heat sink for the energy previously removed by the PCLS.

SHINE Medical Technologies 13a2-10 Rev. 0

[Proprietary Information - Withhold from public disclosure under 10 CFR 2.390(a)(4)]

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis Scenario C - Loss of or Reduced PCLS and LWPS Flow This final scenario assumes both a loss of PCLS and LWPS flow with continued operation of the neutron driver. This could be as a result of failure or damage to electrical supply at a common supply point. It could also be as a result of operator error, coupled with other failures that result in continued operation of the neutron driver or a common mode failure that would result in piping failures in both systems, such as a seismic event. If any of these accidents were to occur, the heat load would be transferred to the light water pool.

13a2.1.4 MISHANDLING OR MALFUNCTION OF TARGET SOLUTION The TSV uses a liquid target solution that generates fission products that are contained by the PSB. The accidents involving the mishandling or malfunction of the target solution, including a failure of the PSB within the IF, are analyzed here. Mishandling or malfunction of target solution within the RPF are addressed in Subsection 13b.2.4.

Within the boundaries of the IF, the target solution is contained in the target solution hold tank, TSV, the TSV dump tank, and associated connected piping. The irradiated target solution transfer pump is also located within the IF, so a malfunction or mishandling of this pump is considered. Note that the TOGS, PCLS, and LWPS are located in the IF, but the mishandling or malfunction of these systems is addressed in Subsections 13a2.1.7 and 13a2.1.3. Also, the insertion of excessive reactivity and inadvertent criticality events involving the target solution are discussed in Subsection 13a2.1.2.

13a2.1.4.1 Identification of Causes, Initial Conditions, and Assumptions The Final ISG Augmenting NUREG-1537 and the ISA Summary have identified several initiators:

namely, failure to control pH of the target solution, failure to control solution temperature and failure to control solution pressure. The ISA Summary and associated hazard analyses (HAZOPS/PHA) identified several potential IE including:

• Failure to control pH of the target solution leading to TSV corrosion ultimately leading to spills or leakage outside the TSV and tanks.

• Excessive cooling of target solution (addressed in Subsection 13a2.1.2).

• Failure to control pressure thereby initiating target solution boiling (addressed in Subsection 13a2.1.2).

• Failure of pumps, valves, piping, and tanks.

• Operator errors associated with inadvertently overflowing tanks or misdirecting flow.

The initial conditions and assumptions associated with mishandling or malfunction of target solution include:

• Each TSV is operated on a 5.5-day irradiation cycle with an additional [ Proprietary Information ] residence for the target solution in the TSV dump tank following irradiation to allow for decay of short-lived radioisotope fission products.

• The MAR for this event is conservatively taken to be the TSV inventory at shutdown, following the fourth irradiation cycle. Due to the dump tank being at approximately atmospheric pressure and the slow rate at which solution is pumped from the dump tank, only 25 percent of TSV inventory is assumed to leak to the IU cell prior to facility evacuation.

SHINE Medical Technologies 13a2-11 Rev. 1

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis

• The TSVs are operated independently, so that an event on one TSV does not affect another TSV or IU cell.

• Irradiation and target solution transfer operations of the TSVs are controlled by operators.

The mishandling or malfunction of equipment in these systems could potentially result in a spill or a misdirection of the target solution outside of the primary system boundary.

• The IU cells are isolated from the rest of the facility by robust walls, ceiling, and floor.

• Penetrations for piping, ducts and electrical cables, and airlocks are sealed within specifications to limit the release of radioactive materials from the facility.

• Piping systems that are open to the atmosphere of the IU or TOGS shielded cell are isolable by means of redundant, automatic isolation valves or by dual, normally closed manual valves.

• Ventilation ducts are isolable from the exhaust stack by means of bubble-tight dampers.

• The RCA ventilation system during normal operations maintains the IU cell at a negative pressure with respect to the rest of the facility.

• Tanks and piping that have the potential to contain fissile material, except the TSV, are designed with passive measures that prevent an inadvertent criticality of the target solution.

• Sumps and drains that lead from the pipe trenches and tank vaults are designed with a geometry that prevents an inadvertent criticality of the leaked target solution.

• RVZ1 is equipped with radiation monitoring to activate the isolation dampers prior to the release of excessive radioactive material.

13a2.1.4.2 General Scenario Description There are four general scenarios that are identified as mishandling or malfunction of the target solution within the IF. Each of these is distinguished from the others by where the target solution is directed. These four scenarios are: TSV overfill, TSV or dump tank leak into the light water pool, TSV leak into the primary cooling system, and a dump tank leak into the IU cell. Each of these scenarios and their potential causes are discussed below:

• Scenario 1 - TSV Overfill A TSV overfill flows into the dump tank through the TSV overflow lines. TSV level detection is also installed to alert the operator to any TSV overfill conditions. The reactivity insertion from this event is analyzed earlier in Subsection 13a2.1.2. Other than the consequences discussed in 13a2.2.2, this would only result in a process upset.

• Scenario 2 - TSV or Dump Tank Leak Into the Light Water Pool Leakage from the TSV or TSV dump tank into the light water pool could occur due to corrosion of the TSV, dump line, dump valves, or TSV dump tank. For a TSV leak, a leak in the PCLS would also have to occur in order for the target solution to reach the light water pool. In this scenario, the target solution leakage would be contained in the LWPS and IU cell where it would be contained from any workers in the facility. High area radiation monitor levels would alert the operators for significant leaks of target solution into the light water pool, while periodic sampling of the pool water is utilized to detect very small leaks and initiate corrective action. Dilution of the target solution and the geometry of the light water pool would prevent an inadvertent criticality.

SHINE Medical Technologies 13a2-12 Rev. 1

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis

• Scenario 3 - TSV Leak into the Primary Cooling System This scenario involves leakage of target solution into the PCLS. The PCLS is a closed system, but the flowpath leads outside of the IU cells. The PCLS pressure is normally above that of the TSV, so leakage of target solution into the PCLS is unlikely. However, even if leakage were to occur, periodic sampling can detect very low levels of leakage, and increases in area radiation, changes in reactivity, and changes in level can detect significant leakage. The PCLS is a closed system, thereby containing the leaked target solution. Dilution of the target solution would prevent an inadvertent criticality.

• Scenario 4 - Dump Tank Leak Into the IU Cell Leakage of target solution from the dump tank into the IU cell atmosphere (above the pool) could occur due to failure of the piping sections leading from the dump tank to the cell penetration or failure of associated components. The piping failure could be caused by a combination of corrosion, overpressure, or other mechanical failure of the piping.

Leakage here would not pass through the pool water, but would be contained within the IU cell. This is considered the limiting event and is further analyzed in Subsection 13a2.2.4.

Design features that prevent or mitigate target solution leakage scenarios within the IF include the choice of materials for the tanks and piping that resist corrosion from the target solution chemical characteristics, periodic maintenance on the mechanical components, and in-service inspection of the tanks and piping for indications of compromised integrity. Should a leak occur, additional design features such as cell shielding, sumps, and shielded trenches collect the leakage, and penetration seals at the IU cell boundary limit the spread of leakage. RAMs are designed to alert workers in the area and the control room operators of high radiation levels.

Finally, if leaked radioactive material becomes airborne, the RCA ventilation system has the capability of isolating the IU cell and the RCA upon a high radiation signal by the use of redundant bubble-tight dampers.

13a2.1.5 LOSS OF OFF-SITE POWER A LOOP can occur for a variety of reasons related to the reliability and operation of the transmission system, stress during peak grid load conditions, severe weather effects from high wind, tornado, or ice and snowstorms, a seismic event, or equipment failure in the supplying substation. It may also be a result of failure or malfunction of the facility normal electrical power supply system (NPSS) such as the facility transformers or switchgear. This may result in a partial or complete LOOP to the facility. Partial electrical power may also be lost within the facility resulting in partial system losses. System or equipment failures due to partial losses of electrical power within the facility are discussed under other accident analysis sections (e.g., Subsections 13a2.1.3 and 13a2.1.7). For the purposes of this discussion, it is assumed that a complete loss of off-site AC power occurs from causes that are external to the SHINE facility. Consequences of a complete LOOP to the facility are presented in Subsection 13a2.2.5.

SHINE Medical Technologies 13a2-13 Rev. 0

[Proprietary Information - Withhold from public disclosure under 10 CFR 2.390(a)(4)]

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis 13a2.1.5.1 Identification of Causes, Initial Conditions, and Assumptions The electrical power systems that support the SHINE facility are described in detail in Chapter 8.

The NPSS is supplied from the grid 12 kV feed to two separate facility transformers, which supply the main facility 480 V switchgear SWGR-A and SWGR-B. Each main switchgear in turn feeds various facility loads, including 480 V motor control centers A1, A2, B1, and B2, and the facility standby diesel generator (SDG) 480 V buses A & B.

The SDG is a commercial grade diesel generator that is not required for any Class 1E safety function at the SHINE facility. It is available as a normal back-up power supply for selected asset protection loads as discussed in Chapter 8, but is not credited as an emergency power source.

The UPSS provides two divisions of Class 1E emergency power to the SHINE facility. During normal operation the battery chargers provide power to the normal operational and shutdown loads while the battery banks are maintained fully charged. Upon a loss of normal AC power, the UPSS feeds two 120 VAC UPS Class 1E buses that provide power to essential equipment and instrumentation. The facility equipment that is served by the UPSS is identified in Subsection 8a2.2.3. This system is capable of delivering required emergency power for the required duration during normal and abnormal operation (Subsection 8a2.2.2).

A LOOP may occur during any combination of operating modes within the IF and RPF. The IEs are:

• Degradation (reliability) of the transmission system.

• Electrical grid stress during peak load conditions.

• Severe weather effects from high wind, tornado, ice or snowstorms.

• Seismic event.

• Equipment failure in the supplying substation.

• Failure or malfunction of facility transformers or switchgear.

• Possible internal flooding due to fire suppression system actuation/failure.

A partial loss of power within the facility is limited to those systems or processes affected. A total loss of electrical power affects all systems and processes; therefore, a LOOP is the bounding scenario that is evaluated herein. The initial conditions and assumptions are summarized below:

• Eight TSVs are conservatively assumed to be in irradiation operations mode.

• One TSV is at the end of its fourth irradiation cycle, maximizing radioisotope source term.

• Bulk target solution temperature of approximately 140°F (60°C).

• Both the PCLS and LWPS are operable, removing approximately [ Proprietary Information ] from each TSV.

• Initial light water pool temperature assumed to be 75°F (24°C).

• Complete loss of PCLS/LWPS flow at time of initiating event resulting in an immediate transition from forced to natural convection to the light water pool.

• Light water pool volume of about [ Proprietary Information ] providing sufficient passive heat sink to remove decay and residual heat from the TSV and IU.

• Hydrogen concentration in TSV and TOGS is maintained below the lower flammability limit (LFL).

• UPSS is available providing sufficient battery capacity for essential loads for at least two hours.

SHINE Medical Technologies 13a2-14 Rev. 0

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis 13a2.1.5.2 General Scenario Description As noted in Subsection 13a2.1.5.1, the worst case scenario is a LOOP. Although the interruption of off-site power is expected to be relatively brief, it is assumed for this analysis that off-site power remains unavailable for an extended period of time. This could potentially occur if the LOOP is due to severe weather or a seismic event that damages substation equipment or associated transmission lines.

The sequence of events for a LOOP is as follows:

• The UPSS automatically maintains power to the 120 VAC UPS buses A & B, supplying power to the equipment listed in Subsection 8a2.2.3.

• A LOOP results in the shutdown of all neutron drivers and associated irradiation operations and RPF operations. The uranyl sulfate solution in the operating TSVs drains to their respective TSV dump tanks, as designed.

• The TSV and primary cooling systems (PCLS and LWPS) lose power to their pumps.

Forced convection cooling ceases and heat is removed by natural convection to the light water pool.

• The neutron driver assembly system (NDAS) and the tritium purification system (TPS) equipment becomes de-energized on a LOOP. Neither of these systems are required for the safe shutdown of the SHINE facility. Both of these systems contain tritium, which remains contained within their respective pressure boundaries.

• Hydrogen generation continues to occur due to radiolysis from the decay of fission products. The 120 VAC UPS buses provide backup power to the TOGS.

• The UPSS supplies essential facility loads for a duration of two hours. The 120 VAC UPS buses automatically maintain power to essential instrumentation and equipment. This includes the TOGS equipment needed to control the build-up of hydrogen.

• Radiation monitoring systems of the facility continue to operate.

13a2.1.6 EXTERNAL EVENTS The following potential external events have been identified as DBAs for the SHINE facility:

• Seismic event affecting the IF and RPF (see Section 3.4).

• Tornado or high-winds affecting the IF and RPF (see Section 3.2).

• Small aircraft crash into the IF or RPF (see Section 3.4.5).

Plant SSCs, including their foundations and supports, that are designed to remain functional in the event of a design basis earthquake (DBEQ) are designated as Seismic Category I, as indicated in Table 3.5-1. SSCs designated SR are classified as Seismic Category I. SSCs whose failure as a result of a DBEQ could impact an SSC designated as SR are classified as Seismic Category I. SSCs that must maintain structural integrity post-DBEQ, but are not required to remain functional are Seismic Category II.

All Seismic Category I SSCs are analyzed under the loading conditions of the DBEQ and consider margins of safety appropriate for that earthquake. The margin of safety provided for safety class SSCs for the DBEQ are sufficient to ensure that their design functions are not jeopardized. For further details of seismic design criteria refer to Section 3.4.

SHINE Medical Technologies 13a2-15 Rev. 1

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis The SHINE production facility building is designed to survive credible wind and tornado loads, including missiles, as described in Section 3.2 and Subsection 3.4.2.6. It is also designed to withstand credible aircraft impacts as discussed in Subsection 3.4.5.

Due to the facility design, there are no consequences to the workers or the public for postulated external events.

13a2.1.7 MISHANDLING OR MALFUNCTION OF EQUIPMENT AFFECTING THE PSB Mishandling or malfunction of equipment has been identified explicitly by the Final ISG Augmenting NUREG-1537 as a category of IEs or accident scenarios that need to be evaluated for potential impact on the PSB, and these scenarios merit additional quantitative analysis.

Furthermore, the Final ISG Augmenting NUREG-1537 and the ISA Summary have identified several potential scenarios under this category: namely, failure of the TOGS, leading to release of noble gases and halogens. The accidents involving the mishandling or malfunction of the liquid systems or loss of the pressure boundary are analyzed in Subsection 13a2.1.4. The loss of vessels and line failures for systems within the RPF are analyzed in Subsection 13b.2.4. The analysis of the mishandling or malfunction of equipment affecting the PSB is, therefore, limited to those systems handling the gaseous radioactive products resulting from irradiation of the target solution and to the neutron driver and its support systems.

13a2.1.7.1 Identification of Causes, Initial Conditions, and Assumptions The ISA Summary and associated HAZOPS/PHA identified several potential IEs for mishandling or malfunction of equipment within the PSB, including failure of valves and tanks, human errors associated with inadvertently releasing the stored noble gases to the building stack, neutron driver and tritium processing malfunctions, and other credible scenarios.

The waste gases from irradiation of the target solution are of two major types: the hydrogen and oxygen produced by radiolysis of water in the target solution, and radioactive fission product gases. The detonation or deflagration of hydrogen within the TOGS or elsewhere within the PSB is addressed in Subsection 13a2.1.9. Other unintended exothermic chemical reactions within the PSB are addressed in Subsection 13a2.1.10. This section analyzes failures that could lead to the release of noble gases and halogens due to other causes.

The PHA identified malfunctions of the NDAS and the associated TPS that include inadvertent actuation of the neutron driver, accelerator misalignment, and loss of tritium.

The initial conditions and assumptions associated with mishandling or malfunction of equipment affecting the PSB include:

• Fission product gases (e.g., Kr, Xe, and halogens) produced during irradiation operations are monitored, processed, collected, stored, and disposed by TOGS and the NGRS.

Each TSV has a dedicated TOGS.

• The TOGS flow is retained within the off-gas system until the target solution batch irradiation cycle is completed. As the TOGS circulates sweep gas during the irradiation cycle, a portion of the iodine is removed by the zeolite beds, and hydrogen and oxygen is recombined by the catalytic recombiners, but no other gases are removed or purged.

SHINE Medical Technologies 13a2-16 Rev. 1

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis

• Since the TOGS is not a pressurized system, it is assumed that only 25 percent of the activity leaves the system prior to evacuation of the facility.

• Automatic trip of power to the NDAS occurs for several reasons, including TSV overpower and misalignment of the neutron driver beam.

The TPS process is performed in semi-batch steps, treating the contaminated flush gas and purifying the contaminated tritium gas.

13a2.1.7.2 General Scenario Description Scenarios involving the NDAS are mitigated by the system design. Automatic trip of the NDAS power supply occurs by means of safety-related relays and breakers (Subsection 4a2.3.8) actuated by an overpower event within the TSV, as detected by the TRPS. The impact of an overpower event on the integrity of the PSB is mitigated by negative reactivity feedback from voiding in the TSV. In the event of a neutron driver misalignment, the NDAS is shut down.

Interlocks prevent operation of the NDAS if personnel are present. Together, these minimize the potential for an overexposure of facility personnel. Events related to the neutron driver are further evaluated in Subsection 13a2.1.12.1.

Scenarios involving the TPS are mitigated by system and confinement design. The two TPS are contained within separate glovebox enclosures located in the IF. The glovebox atmosphere is inerted with nitrogen and oxygen levels are monitored. Equipment to clean the tritium is located in the glovebox atmosphere recirculation loop (see Subsection 9a2.7.1.3.1). The piping to and from the NDAS is double-walled and designed to maintain its integrity during normal, abnormal, and accident conditions. Any leakage of tritium from the glovebox enclosure or the external piping is detected to ensure facility personnel are protected. Events related to the TPS are further evaluated in Subsection 13a2.1.12.3.

The scenario is an inadvertent venting of the off-gas purge contents from one of the eight TOGS.

In this scenario, a malfunction or human error occurs that releases the off-gas purge volume from one of the eight TOGS to one of the TOGS shielded cells. Further analyses of this scenario and the associated consequences are preserved in Subsection 13a2.2.7.

The following engineering controls either prevent or mitigate this scenario:

• Integrity of the TOGS.

• Confinement provided by the cell in which the TOGS is located, including the ability to isolate the ventilation system supporting the cell through the use of bubble-tight isolation dampers upon a signal from the ESFAS.

The TOGS is provided with hydrogen monitors. Gas is only purged from the TOGS to the NGRS if hydrogen concentrations are below acceptable limits. The TOGS has hydrogen recombiner capabilities. The NGRS system is also provided with hydrogen detection.

SHINE Medical Technologies 13a2-17 Rev. 1

[Proprietary Information - Withhold from public disclosure under 10 CFR 2.390(a)(4)]

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis 13a2.1.8 LARGE UNDAMPED POWER OSCILLATIONS As required by the Final ISG Augmenting NUREG-1537, the TSV is evaluated for large undamped power oscillations as a potential event that could occur during irradiation operation due to reactivity variations in the target solution that lead to fluctuations in the neutron multiplication (keff) within the irradiated target solution.

The TSV experiences power oscillations with reactivity variations within the target solution.

However, any power oscillations that occur are self-limiting as a result of the inherent design and safety characteristics associated with the TSV and operating parameters.

13a2.1.8.1 Identification of Causes, Initial Conditions, and Assumptions Power oscillations may occur in the TSV as a result of normal anticipated reactivity variations within the target solution. The IEs or scenarios include:

• Radiolytic bubble formation and collapse within the target solution and at the solution surface.

• Migration of radiolytic bubbles to the target solution surface with removal by the TOGS.

• Target solution circulation due to temperature/void non-uniform distributions.

• Variations in the neutron driver production rate.

• Excessive reactivity insertions (see Subsection 13a2.1.2).

The TSV is designed to operate at subcritical conditions. Full power of the TSV is limited to a maximum heat generation of [ Proprietary Information ] in the target solution, with the maximum average target solution temperature of approximately 176°F (80°C). The full power target solution temperature results in an approximate operating range for keff of [ Proprietary Information ]. The thermodynamic operating characteristics, combined with subcritical operation and large negative temperature and void coefficients, provide the TSV with neutronic stability.

The initial conditions and assumptions for this scenario are as follows:

• TSV is filled to a level that is approximately 5 percent by volume below critical, with an estimated keff of [ Proprietary Information ] at cold shutdown conditions of 68°F (20°C).

• Neutron driver provides a continuous stream of neutrons into the subcritical target solution to generate a maximum of [ Proprietary Information ].

• TSV operates in a subcritical state with a nominal keff of approximately [ Proprietary Information ].

• TSV operates at a nominal temperature of 140°F (60°C).

• Negative temperature and void coefficients reduce keff during heatup of the target solution to nominal power conditions.

• TRPS trip setpoints are designed to activate on high neutron flux (power) level.

• Power density of target solution during irradiation operation provides TSV stability with self-limiting oscillations.

The neutron driver has small variability in neutron production rates (+/- 3 percent) due to normal accelerator variations in beam current and focusing; therefore, these variations lead to corresponding small variations in fission power in the SCAS. Since the neutron driver and SCAS are physically-independent systems, the resulting variations in the power level of the SCAS do SHINE Medical Technologies 13a2-18 Rev. 0

[Proprietary Information - Withhold from public disclosure under 10 CFR 2.390(a)(4)]

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis not have the potential to lead to feedback in the neutron driver performance. Analysis of neutron driver power variations is considered in transient analysis modeling of the SCAS performance to ensure that the target solution remains within its operating limits.

Aqueous homogeneous reactor (AHR) power density experiments performed at Russian ARGUS facility (maximum power density of 1 kWt/L of solution) and the French SILENE facility (maximum power density of 0.3 kWt/L) have shown that steady state, stable core conditions could be sustained as long as the average power density did not exceed approximately 1.8 kWt/L (BNL, 2012; IAEA, 2008; Barbry, 2007). 1.8 kW/L is based on operating experience of two 50 kW reactors, one at Walter Reed in the early 1960s and one at Armour Research Foundation at the Illinois Institute of Technology over the same time frame. Experiments indicated that operation at core power densities less than 2 kW/L may ensure core thermal stability (IAEA, 2008). The SILENE experiments (performed at approximately 3 kWt/L) were unsuccessful due to power instabilities. Both of these AHRs are designed to operate at critical conditions (keff of 1.0).

Therefore, a 1.8 kWt/L power density design limit is reasonable to maintain TSV stability.

For purposes of calculating a maximum possible operating TSV power density for evaluating stability and power oscillation occurrence, the following conservative assumptions are made:

• TSV solution volume of [ Proprietary Information ] (expected to range from [ Proprietary Information ] during normal operation).

• [ Proprietary Information ] (110 percent of maximum TSV power).

The above conservative assumptions result in a TSV maximum power density of [ Proprietary Information ]. The maximum power density for the TSV is at least [ Proprietary Information ] the 1.8 kWt/L for reactor stability of other AHRs evaluated. The TSV design characteristics of subcritical operation, low power density (conservatively calculated [ Proprietary Information ]),

and large negative temperature and void coefficients result in a stable TSV with self-limiting power oscillations under normal reactivity variations. The low power density and subcritical operating conditions prevent the occurrence of any undamped power oscillation.

13a2.1.8.2 General Scenario Description As noted in Subsection 13a2.1.8.1, power oscillations are expected to occur during normal operation as a result of target solution reactivity variations. Because of the TSV design and operating parameters, the reactivity variations are small at operating power, resulting in a very stable TSV with self-limiting power oscillations.

If a large undamped power oscillation occurs, the oscillation without operator action eventually exceeds the TRPS trip setpoint on high neutron flux. When the TRPS trip setpoint is exceeded, the neutron driver is automatically de-energized, the TSV dump tank valves automatically open, and the target solution is dumped (by force of gravity) into subcritical TSV dump tanks with criticality-safe geometry. Because power oscillations are slow transients, any consequences are bounded by the fast transients associated with excess reactivity insertion events. The capability of the SHINE facility to withstand the effects of an excess reactivity insertion, as addressed in Subsection 13a2.1.2, demonstrates that the PSB and other safety-related equipment and systems are capable of performing their functions in the event of a large undamped power oscillation. Further analyses and associated consequences are preserved in Subsection 13a2.2.8.

SHINE Medical Technologies 13a2-19 Rev. 0

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis 13a2.1.9 DETONATION AND DEFLAGRATION IN THE PRIMARY SYSTEM BOUNDARY Both the Final ISG Augmenting NUREG-1537 and the ISA Summary have identified the deflagration and detonation of hydrogen as a potential IE that is evaluated as part of the accident analysis. Further analyses and associated consequences are presented in Subsection 13a2.2.9.

This subsection discusses the effects of a hydrogen deflagration or detonation on the IF.

Irradiation of the uranium-bearing solution produces significant quantities of hydrogen and oxygen and small quantities of fission products. The TOGS is the primary control for mitigating hazards associated with the evolved gases. Functional requirements for the TOGS include maintaining the concentration of hydrogen to less than the LFL, recombining the hydrogen and oxygen as well as fission product gases, and returning the recombined water back to the TSV.

The TOGS functions as a closed loop during the irradiation process and is purged between each irradiation cycle.

13a2.1.9.1 Identification of Causes, Initial Conditions, and Assumptions The formation and release of hydrogen due to radiolytic decomposition is an inherent result of irradiation of water. The ISA Summary and the corresponding HAZOPS/PHA has identified several potential scenarios that could result in the accumulation of hydrogen and potential deflagration or detonation. As identified in the ISA Summary, a deflagration or detonation accident is most likely to occur when the TOGS fails, which allows hydrogen to accumulate in the TSV headspace, dump tank, or off-gas piping. Potential failures that have been identified include a loss of power to the TOGS blowers, plugged zeolite beds, and loss of the recombiner functionality. Hydrogen could also accumulate if there is a partial failure of the TOGS, such as reduced volumetric flow rate due to a partially-obstructed filter or reduced blower capability.

The initial conditions and assumptions associated with a deflagration or detonation of hydrogen gas are:

• The generation of radiolytic hydrogen for the TSV has been characterized. This analysis shows that during the irradiation cycle, the device is capable of developing flammable concentrations of hydrogen in the TSV headspace within seconds if the TOGS has failed.

• A hydrogen deflagration/detonation analysis was performed to determine the potential environmental conditions (e.g., overpressures, potential for deflagration detonation transition [DDT]). As part of the analysis, the potential for a DDT was evaluated using the detonation cell size as the basis. The characteristic length and width of the TSV headspace is much larger than the detonation cell size, implying that the potential for a DDT, even though unlikely, cannot be ruled out. The PSB is designed to withstand credible deflagration and detonation events.

• It is assumed that the risk for deflagration in the IU cell is dominated by the generation and potential accumulation of hydrogen in the headspace of the TSV due to the failure of the TSV off-gas system.

• Each TSV is serviced by a dedicated and independent TOGS. It is assumed a single TOGS fails, allowing hydrogen to accumulate in one TSV.

• In the event of failure of the PSB, confinement is provided by the IU cell and TOGS shielded cell.

SHINE Medical Technologies 13a2-20 Rev. 1

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis

• The failure of the TOGS is due to flow blockage, such as a plugged filter. This is a conservative assumption as it allows the generation of hydrogen and oxygen to accumulate and pressurize the headspace. Deflagration and detonation overpressures are proportional to the gas pressure immediately before ignition.

• The accumulation of hydrogen and oxygen is partly related to the delay between loss of the TOGS and shutdown of the neutron driver. The neutron driver is interlocked to the hydrogen monitoring in TOGS and the neutron driver is de-energized by TRPS if hydrogen concentrations exceed acceptable values.

• TOGS consists of a condenser, demister, zeolite beds, a blower, recombiner, and piping.

A blockage occurs if the beds are plugged, or the piping is damaged. The system has numerous and diverse monitors and sensors to alert the operator to abnormal and accident conditions.

• The solution is in the middle of the irradiation cycle when the TOGS fails. This is conservative since it implies the system is at full power generating hydrogen at the maximum rate and the target solution and vessel are at an elevated temperature.

Monitoring equipment provides input to the TRPS to shut down the driver on high hydrogen concentrations.

13a2.1.9.2 General Scenario Description A deflagration or detonation could occur if the TOGS were to fail during the irradiation process.

Irradiation of the uranium-bearing solution generates significant quantities of hydrogen and oxygen. The LFL for hydrogen in the headspace is reached in seconds if the TOGS fails and the neutron driver continues to operate.

For this accident scenario, it is assumed that the system fails due to flow blockage, loss of power, or loss of recombiner capability. The loss of TOGS allows the radiolytic gases to pressurize the headspace. The accumulation of hydrogen and oxygen significantly reduces the concentration of nitrogen and water vapor. Nitrogen and water vapor are diluents and would reduce the overpressure in the event of a deflagration or detonation.

In the event the TOGS fails to recombine hydrogen and oxygen, the TRPS de-energizes the neutron driver on high hydrogen concentrations exceeding trip setpoints. A delay between the loss of the TOGS and shut down of the neutron driver could allow an increased accumulation of hydrogen.

The robust design of the PSB ensures that it is capable of withstanding credible hydrogen deflagrations and detonations. Furthermore, in case of failure of the PSB, the IU cell provides additional confinement to potential airborne radioactive material that may be released during this postulated event. Radiation detectors within RVZ1 are interlocked with bubble-tight dampers to isolate the IU cell and allow for decay and potential control of radioactive material, thus reducing the potential consequences from such event.

SHINE Medical Technologies 13a2-21 Rev. 0

[Proprietary Information - Withhold from public disclosure under 10 CFR 2.390(a)(4)]

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis 13a2.1.10 UNINTENDED EXOTHERMIC CHEMICAL REACTIONS OTHER THAN DETONATION Both the Final ISG Augmenting NUREG-1537 and the ISA Summary have identified unintended exothermic chemical reactions other than detonation as a potential initiating event or category that needs to be evaluated as part of the accident analysis within the PSB. This section examines safety aspects of exothermic chemical reactions that are relevant for the IF, other than hydrogen deflagrations or detonations.

13a2.1.10.1 Identification of Causes, Initial Conditions, and Assumptions There are no chemical processing activities within the PSB. The target solution is uranyl sulfate

[ Proprietary Information ]. The target solution undergoes irradiation within the TSV with no potential for an exothermic chemical reaction to occur.

During fill/startup and irradiation operations when target solution is present in the TSV and target solution hold and dump tanks, administrative controls prohibit chemicals being stored or present within the IU cell, except for those required for normal operations.

Therefore, there is no potential for exothermic chemical reactions with the fission product gases released during irradiation. The potential for a hydrogen detonation and deflagration is addressed in Subsection 13a2.1.9. Therefore, there are no IEs associated with a potential for an unintended exothermic chemical reaction with target solution present within the PSB.

The TSV is constructed of zircaloy, which can react with steam in a high temperature environment to form large quantities of hydrogen gas which present deflagration and detonation hazards (ANL, 2002). There are no high temperature environments expected near the TSV.

13a2.1.10.2 General Scenario Description As discussed in Subsection 13a2.1.10.1, there is no potential for an unintended exothermic chemical reaction within the PSB other than a potential for hydrogen deflagration or detonation, which is addressed in Subsection 13a2.1.9.

No credible path to significantly high temperatures involving zircaloy and steam was identified in the HAZOPS/PHA performed for the SHINE facility. As such, this scenario is not considered credible.

Further analyses and associated consequences are preserved in Subsection 13a2.2.10.

13a2.1.11 PRIMARY SYSTEM BOUNDARY SYSTEM INTERACTION EVENTS This subsection discusses the effects of system interactions on the IF. The PSB, located within the IF, consists of the TSV, TSV dump tank, and the TOGS. These systems contain radionuclide material in the form of the TSV target solution and fission products. System interactions have the potential to cause damage that may lead to the release of these materials.

As defined in NUREG/CR-3922, a system interaction occurs when an event in one system, train, component or structure propagates through unanticipated or inconspicuous dependencies to cause an action or inaction in other systems, trains, components or structures.

SHINE Medical Technologies 13a2-22 Rev. 0

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis NUREG/CR-3922 further states that this definition contains three major points used for identifying system interactions: (1) initiating event, (2) propagation, and (3) unanticipated or inconspicuous dependencies. The initiating event can be a failure, action, or inaction of a system, train, component, or structure. This initiating event then propagates through unanticipated or inconspicuous dependencies to adversely affect at least one other system, train, component, or structure.

There are three categories of system interactions between systems located within the IF and the RPF that are considered in this analysis. The three types of interactions include: 1) functional interactions, 2) spatial interactions, and 3) human-intervention interactions.

Further analyses and associated consequences are preserved in Subsection 13a2.2.11.

Functional Interactions Functional interactions are interactions between systems or subsystems that result from a common interface. A functional interaction exists if the operation of one system can affect the performance of another system or subsystem. An adverse system interaction exists if the operation or lack thereof, causes a negative impact on the performance of any system during operation or during the mitigation of an accident. An adverse system interaction is defined when the operation and/or performance of an (initiating) system adversely affects the operation and/or performance of a safety-related (affected) system as it performs its safety-related function.

At the SHINE facility, there are a number of shared system interactions that need to be considered in the context of functional system interactions. The shared system interactions that are considered in this analysis are the following:

• Electrical power is common between SSCs contained within the IF as well as those SSCs contained within the RPF.

• Radioisotope process cooling system (RPCS)

- This system is used as a cooling medium for a number of heat exchangers located within the confines of the IF and the RPF, including the:

• TSV off-gas condenser

• TSV off-gas recombiner condenser

• Recycle target solution cooler

• Uranyl nitrate conversion tank cooler

• Evaporator overheads condenser

• RLWE liquid waste condenser

• Thermal denitration (TDN) overheads cooler

• PVVS acid gas scrubber cooler

• LWPS cooler

• PCLS cooler

• NDAS

- The RPCS is used as the heat sink for the primary cooling system for each TSV located within the PSB. The primary cooling system consists of the PCLS and the SHINE Medical Technologies 13a2-23 Rev. 0

[Proprietary Information - Withhold from public disclosure under 10 CFR 2.390(a)(4)]

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis LWPS. The PCLS removes generated heat from each TSV during normal and shutdown operations [ Proprietary Information ]. The LWPS removes heat from the light water pool that surrounds each TSV and TSV dump tank. The primary cooling system is a separate, independent system for each TSV.

• The facility fire protection system (FFPS) is common between the IF and the RPF.

However, the operations of the automatic suppression system in the RPF do not impact operations in the IF. Actuation of the automatic suppression system in the RPF does not cause flooding in the IF since design features are incorporated to prevent water from flowing from the RPF into the IF. Actuation of the automatic suppression system in the RPF does not impact the operations of the redundant equipment that supports the IF due to physical separation of that equipment. For this reason, system interaction of the FFPS in the RPF on the IF is not considered further in the system interaction analysis.

• RCA Ventilation

- The RVZ1 is common between the IU cells, TOGS shielded cells, and many potentially contaminated areas and systems in the RPF such as:

• UREX hot cells

• Thermal denitration

• Solid waste hot cell

• Pump transfer cell

• Waste evaporation hot cell

• Noble gas storage cell

• Supercells for extraction, purification, and packaging

• PVVS

• The TOGS for each TSV retains the gas produced during TSV irradiation operations.

Hydrogen and oxygen are recombined by the catalytic recombiners during normal operation. Once the irradiation process ceases, the gas is purged from the TSV to the NGRS after an acceptable hold time in the TOGS. The NGRS, which provides at least 40 days of holdup for radioactive decay prior to release to the facility exhaust stack, is the common collector system between the TOGS of each IU cell.

Spatial Interactions Spatial interactions are interactions resulting from the presence of two or more systems in proximate locations. The spatial interactions considered include the effects of fire, flood, pipe break, missile hazard, and seismic events. The protection required for safety-related systems and the potential for spatial interactions from nonsafety-related systems are largely independent of whether or not the nonsafety-related system is operating.

Human-Intervention Actions Adverse system interactions studied from a functional point of view were described earlier.

Adverse system interactions can also be examined from the point of view of potential human errors that can cause the same adverse interactions. Human errors in the RPF can also cause adverse system interactions in the TSV irradiation operations. For example, human errors can lead to insertion of excess reactivity in the TSV by incorrectly operating the TSV process control SHINE Medical Technologies 13a2-24 Rev. 0

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis system. Human errors in the RPF can also cause adverse system interactions in the TSV irradiation operations through mixing or transfer errors in the target solution hold tank. Human errors further upstream in the RPF process that are related to mixing or transfer errors are not considered here, but are considered in Subsection 13b.2.5.

13a2.1.11.1 Identification of Causes, Initial Conditions, and Assumptions Facility system interaction events are the influence of shared systems and coupled systems effect on the IF. These interactions represent events that can potentially cause damage to SSCs located within the IF.

The initial conditions and assumptions of the SSCs containing radionuclide material within the IF for system interactions are:

• The contents of one TSV has been irradiated for 5.5 days and has just been released to the TSV dump tank. This results in the maximum radionuclide material inventory in the TSV dump tank.

• The TOGS contains the maximum concentration of radionuclides following the end of the 5.5 day TSV irradiation cycle.

• Potential damage is assumed to occur for only one IU cell.

13a2.1.11.2 General Scenario Description Functional Interactions LOOP Scenarios Scenarios that could cause a LOOP include equipment failure or external events.

If a LOOP occurs, then the neutron drivers de-energize and both TSV dump valves fail open, causing the TSV solution to automatically dump to the TSV dump tank, stopping the irradiation process. TSV monitoring instrumentation is powered by the UPSS such that operators are able to monitor the condition of the TSV and TSV dump tank. Emergency battery-powered exit lights are located throughout the facility to allow an orderly evacuation of non-essential personnel from the facility and allow local operator monitoring of critical processes. Following a LOOP, the TOGS blower and the TOGS recombiner beds are supplied from the UPSS. The PVVS gas blower is also supplied from the UPSS. LOOP is discussed in Subsections 13a2.1.5 and 13a2.2.5.

Reduction of Cooling Scenarios Scenarios that could cause a reduction of cooling include equipment failure, LOOP, or external events.

A reduction of cooling is caused by a LOOP, in which case, irradiation of the TSV is shut down, with the TSV contents dumped to the TSV dump tank. Since the TSV and the TSV dump tank are both completely submerged in the light water pool, loss of active TSV cooling is alleviated by the passive cooling of the water in the pool. Reduction of cooling following a LOOP is analyzed in Subsection 13a2.1.5.

SHINE Medical Technologies 13a2-25 Rev. 0

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis Loss or reduction of cooling of the TSV through equipment failures results in a shutdown of the irradiation process. Passive cooling of the TSV and TSV dump tank contents occurs from the pool water. Loss or reduction in cooling is analyzed in Subsection 13a2.1.3. Since the RPCS is not an ESF, it is not expected to remain operable following an accident. In this case, loss of active TSV cooling is alleviated by the passive cooling provided by the volume of water contained in the light water pool.

Loss of RVZ1 Ventilation Scenarios Scenarios that could cause a loss of the RVZ1 include equipment failure, LOOP, or external events.

Loss of the RVZ1 results in the loss of exhaust airflow through the contaminated areas of the IF and RPF. The RVZ1 dampers close on loss of power. Loss of the RVZ1 does not result in the failures of SSCs required to prevent radiological releases from the IF.

NGRS Scenarios The system interactions scenario is the potential pressurization of the TOGS by one of the noble gas storage tanks. Isolation capabilities ensure that backflow from the NGRS does not pressurize the TOGS. In the event of failure of the NGRS, the TOGS cannot purge gases to the NGRS after completion of an irradiation cycle. The prevention of purging is controlled by interlocks and administrative controls. In addition, the gases are safely contained within TOGS until the NGRS is available.

Molybdenum Extraction and Purification Scenarios The molybdenum extraction and purification system (MEPS) is located downstream of the TSV dump tank. Isolation valves at the outlet of the TSV dump tank are normally closed to prevent backflow of fluids from MEPS into the TSV dump tank. The isolation valves are opened for the normal transfer of target solution to the MEPS. Once transfer of target solution to the MEPS is completed, the isolation valves are closed. Therefore, no potential system interaction effects are analyzed. This scenario is bounded by the maximum hypothetical accident for the IF where a release of target solution is postulated as described in Subsection 13a2.1.1.2.

Spatial Interactions Fire Scenarios Scenarios that may give rise to fires in the adjoining RPF could occur due to equipment failures or human errors that result in ignition of resident combustible materials. Fires that occur due to equipment failures typically involve electrical equipment fires where electrical failures ignite combustible components inside of the equipment. Equipment failures may also involve the release of flammable or combustible materials that become subject to ignition.

The reinforced concrete walls surrounding the IU cells in FA-2 of the IF have a three-hour fire rating and any cables penetrating the IF boundary have seals rated to the same fire rating as the barrier they penetrate. This prevents fires starting within the RPF from affecting SSCs located within the IF.

SHINE Medical Technologies 13a2-26 Rev. 0

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis Each TSV is contained within a separate IU cell constructed of reinforced concrete. The fire rating for these walls is three hours, such that fires originating within each IU cell remain contained within the IU cell and only affect the TSV and associated SSCs contained within the IU cell. The consequences of an IU cell fire are discussed in Subsection 13a2.2.12.2.

Another fire scenario involves a human error or malfunction of the TOGS, leading to a buildup of hydrogen gas in the TOGS or the TSV head space. Buildup of hydrogen can result in a hydrogen deflagration and ultimately spread fire to equipment contained within the TOGS shielded cell. Each TOGS is contained in a separate shielded cell within the IF. Each shielded cell consists of reinforced concrete. The reinforced concrete and any cable penetrations through the concrete have a three-hour fire rating, which results in the containment of fires within each TOGS shielded cell. Detonation and deflagration within the PSB is addressed in Subsection 13a2.1.9.

Exothermic Chemical Reaction Scenarios There are a number of potential scenarios involving exothermic chemical reactions initiated within the RPF that threaten the integrity of the IF. For example, retention of process chemicals and materials within the evaporator for an excessive amount of time can create increased concentrations and temperatures that promote the formation of unstable compounds, resulting in an explosion or deflagration. In another example, a buildup and ignition of combustible gas mixture in a liquid waste tank (e.g., from radiolytic decomposition gases) can lead to a deflagration. The mechanical damage from a deflagration or explosion initiated within the RPF might propagate to the IF. Also, the explosion or deflagration might initiate a fire within the RPF that could spread to the IF. However, the reinforced concrete exterior walls of the IF are expected to withstand secondary mechanical impacts, given their robust design. Furthermore, as previously discussed, the walls of the IF have a three-hour fire rating and any cables penetrating the IF boundary have seals rated to the same fire rating as the barrier they penetrate. These features prevent the propagation of damage into the PSB, given an exothermic chemical reaction initiated within the RPF. This scenario is discussed in Subsection 13a2.1.10.

Flooding Scenarios One scenario that may give rise to flooding in the adjoining RPF occurs due to equipment failures or human errors that result in the uncontrolled release of liquids into the RPF.

Because of the small volumes of liquid contained within piping systems and tanks located in below-grade vaults within the RPF, flooding initiated within the RPF is not expected to impact SSCs located within the IF.

A second scenario that could give rise to internal flooding within the PSB is through manual firefighting efforts using hose reels typically located outside fire areas. Fires within the IU cells and TOGS shielded cells are expected to remain within the cells due to the three-hour fire rating of the reinforced concrete walls surrounding the cells. Any external firefighting efforts are expected to be minimal. The amount of water required to contain fires originating within the PSB is expected to be limited, as the amount of combustibles is limited. For this reason, floods affecting more than a single IU cell or TOGS shielded cell are not expected to occur.

SHINE Medical Technologies 13a2-27 Rev. 0

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis Pipe Break Scenarios Safety-related systems are expected to be protected when required from the dynamic effects of pipe breaks in safety and nonsafety-related high energy piping systems (pressure greater than 275 psig and temperature greater than 200°F). The lack of high-energy piping systems in the SHINE facility precludes damage to components located within the IF from the effects of pipe break (e.g., pipe whip, jet spray). Also, pressure relief design features are used to prevent overpressurization of pumps and process components should a positive displacement pump (PDP) continue to operate while a downstream process line or pathway is blocked (e.g., operation of a PDP while it is deadheaded).

Human Intervention Interactions Human interventions can cause the same adverse system interactions because of the single common control room at the SHINE facility. Operators are able to control multiple systems within the IF and the RPF from the control room, enabling them to cause adverse system interactions through cognitive errors of commission. Maintenance activities during normal SHINE operations are expected to be required for normal and unexpected purposes. It is expected that maintenance activities may occur while irradiation or processing activities are in progress.

LOOP During normal operation of the SHINE facility, operations that could cause a LOOP are not expected to be routinely performed. The standby diesel generator installed at the facility to provide on-site AC power for asset protection in the event that normal power is lost is expected to require periodic testing. Operator errors in electrical switching operations required to parallel the SDG with the off-site grid, could result in the LOOP. If off-site power is then lost, the accident scenario is discussed in Subsection 13a2.1.5. Normal administrative controls, including procedural guidance and operator training, ensure proper system alignment.

Reduction of Cooling During normal operation of the SHINE facility, operations that could cause a reduction of cooling are not expected to be routinely performed. During preventative or corrective maintenance on SSCs contained within an IU cell, the loss or reduction of cooling may be isolated to the PCLS and LWPS, which supply cooling to the TSV and its associated light water pool. There is the potential for an operator error, resulting in the loss or reduction of cooling to one or multiple operating TSVs in the PSB. In this case, the accident scenario is analyzed in Subsection 13a2.1.3. Normal administrative controls, including procedural guidance and operator training, ensure proper system alignment.

Loss of RVZ1 During normal operation of the SHINE facility, operations that could cause the loss of the RVZ1 are not expected to be routinely performed. During preventative or corrective maintenance on an RVZ1 exhaust fan, operators could potentially cause loss of the RVZ1.

SHINE Medical Technologies 13a2-28 Rev. 0

[Proprietary Information - Withhold from public disclosure under 10 CFR 2.390(a)(4)]

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis Loss of the RVZ1 results in the loss of exhaust airflow throughout the contaminated areas of the IF and RPF. The RVZ1 is not used for any equipment cooling, but rather is used to maintain a negative pressure in areas of potential contamination to prevent leakage of contaminated material to areas of low contamination potential. The safety-related bubble-tight isolation dampers provide a mitigative function in the event of a release of radiological materials. However, the loss of ventilation itself does not initiate any events that result in a radiological release from the IF.

Target Solution Preparation Scenarios There are a number of operator-induced errors that result in reactivity insertion and potential spills from the TSV. These mixing errors have been identified together with the process controls available to mitigate the effects of operator-induced errors. These administrative controls include: inspections to verify proper enrichment of uranium received by the facility and fissile concentration limits. A combination of administrative, passive, and active engineering controls are used to prevent reaching criticality in the TSV due to incorrect uranium concentrations. Consequences associated with operator mixing errors can be found in Subsection 13a2.2.2.

13a2.1.12 FACILITY-SPECIFIC EVENTS 13a2.1.12.1 Inadvertent Exposure to Neutrons from the Neutron Driver As required by NUREG-1537 and the Final ISG Augmenting NUREG-1537, the SHINE facility has been evaluated for unique facility-specific IEs and DBAs. The ISA Summary identified some unique SHINE facility accident scenarios, with the potential for an inadvertent radiation exposure to plant staff. Because of neutron driver operations, inadvertent access or unexpected presence of personnel in the IU cell during operation has the potential for creating significant exposure to working personnel.

Exposure to personnel occurs during irradiation operations if personnel are present in the IU cell due to the radiation produced by fission products and neutrons produced during irradiation operations. However, this subsection focuses only on scenarios and controls to prevent the inadvertent exposure to neutrons from accelerator operation during irradiation.

The IU cell contains a neutron driver, a [ Proprietary Information ] neutron multiplier and a TSV containing uranyl sulfate. If personnel were to access or be present in the accelerator or TSV area during operation, exposure to neutron radiation would be possible.

13a2.1.12.1.1 Identification of Causes, Initial Conditions, and Assumptions The ISA Summary and associated PHA identified several potential IEs that could result in the inadvertent exposure of working personnel to neutrons from the neutron drivers:

• Inadvertent operation of neutron driver while personnel are in the IU cell.

• Inadvertent access to IU cell during irradiation.

• Inadvertent actuation of neutron driver during maintenance and assembly/disassembly activities.

SHINE Medical Technologies 13a2-29 Rev. 0

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis These are mostly caused by a failure to control access to the IU cell during operation or a failure to control neutron driver operation during maintenance.

There are other potential IEs or scenarios that result in releases of radioactive material to the environment or result in exposure to workers in the IF or RPF (e.g., streaming of radiation through shielding); however, these are either bounded by those IEs and DBAs identified above or are considered to be part of a safety program (e.g., radiation protection program for shielding).

Each IU cell is surrounded by approximately six-foot thick concrete walls and contains a concrete shield plug.

The neutron driver produces approximately 1x1014 neutrons per second with an average energy of 14.1 MeV for a nominal cycle length of 5.5 days.

13a2.1.12.1.2 General Scenario Description As noted in Subsection 13a2.1.12.1, this postulated scenario is mainly caused by a failure to control access to the IU cell during operation or a failure of controls for neutron driver operation during maintenance.

The most likely scenarios that can be envisioned are:

a. During IU cell operation, the IU cell shield plug is inappropriately removed or the personnel access door is inadvertently opened.

b. Actuating the neutron driver while personnel are in the IU cell.

Further analyses and consequences associated with this scenario are presented in Subsection 13a2.2.12.1.

13a2.1.12.2 Irradiation Facility Fires The IF contains the eight IUs and associated TOGS shielded cells. Other equipment associated with the irradiation process is contained in the main area of the IF.

The equipment and processes associated with the IF present a limited potential for fire.

Combustibles and ignition sources are limited in this area. The irradiation process liberates hydrogen and oxygen from the target solution, which is removed by the TOGS. A potential for a hydrogen deflagration and detonation in the TSV exists and is discussed in detail in Subsection 13a2.1.9. Another source of hydrogen exists in the TPS. The potential for a fire involving this process is discussed in this subsection. This subsection also discusses other fire scenarios involving equipment malfunctions, hot work, and fire spread from external sources.

13a2.1.12.2.1 Identification of Causes, Initial Conditions, and Assumptions IF fires have been identified as a potential accident IE and scenario by the ISA Summary performed for the SHINE facility. Fire events that are postulated in the IF may cause damage that could lead to radioactive release; however, such events are mitigated by ESFs. These fire scenarios are evaluated to determine their potential to cause such a release.

Initial conditions considered IU cells that are operating normally or shutdown for maintenance.

SHINE Medical Technologies 13a2-30 Rev. 0

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis Fires scenarios postulated in the IF may result from:

• Equipment malfunction (e.g. electrical equipment or pump fire).

• Ignition of transient combustibles.

• Loss of ignition or combustible material control.

• Fire propagation from areas exterior to the IF when fire area barriers are breached.

The following assumptions apply to the scenarios considered in this section:

• The quantity of lubricating or insulating oil contained in in-situ equipment is minimized.

• A fire in one IU cell does not adversely affect operation of adjacent IU cells (including loss of control or power cabling).

• The IU cell concrete shield plugs are closed during irradiation; however, the concrete shield plugs may be removed to support maintenance activities during outages.

• Electrical cable penetrations through the IU cell walls have the same fire rating as the wall to prevent fire spread.

• Procedural controls are in place to limit and control the presence of combustible materials within the IF.

• The RVZ1 is supplied with fire detection, which is interlocked to the RVZ1 isolation dampers to provide isolation.

13a2.1.12.2.2 General Scenario Description IF fire scenarios include equipment failures or human errors that result in ignition of in-situ or transient combustible materials. Fires associated with equipment malfunctions typically involve electrical equipment failures where the fire occurs in equipment, cabling, components, windings, or a combination of electrical components and lubricating/insulating oils or transient combustibles. Fires may also occur in combustible materials that are placed in the area to support maintenance or operations work activities. Such fires are usually associated with human error where combustible or ignition control is lost.

The first scenario type involves a malfunction of equipment that results in ignition of a fire. The equipment malfunction would stem from an electrical failure inside an electrical cabinet, electrical failure of a pump motor, failure of a pump or motor bearing, or similar malfunction that releases sufficient energy to ignite resident cabling or transient combustibles. Ignition of the cable or nearby transient combustibles spreads to cabling in a nearby cable tray. There are several engineering controls that mitigate the impact of this type scenario. Fire growth out of electrical equipment is limited through the use of fire retardant cabling. This design feature prevents spread of the fire beyond the initiator and the immediate fire plume.

Pump fires that may involve lubricating oils are limited by the small amount of oil available for ignition and a correspondingly small amount of energy available for release due to fire. Limitation of the fire size, growth, and potential spread mitigate the heat release rate (HRR) of potential fires and their potential to develop damaging temperatures in the fire area.

Separation of redundant safety-related SSCs ensures that one train of safety-related SSCs remains free of fire damage. Release of the products of combustion to the environment through the RVZ1 would be prevented by isolation of the RVZ1 isolation dampers initiated by fire detection in the RVZ1. Following discovery, firefighting personnel respond and suppress the fire.

SHINE Medical Technologies 13a2-31 Rev. 0

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis The second scenario involves a loss of control of combustibles and ignition sources. A reasonable scenario involves the performance of maintenance activities involving hot work, such as grinding, welding, or cutting, without appropriate controls of combustible materials. During performance of such work the generation of weld spatter, slag, or sparks may ignite combustible materials in the area. The impact of this type of fire is minimized through the establishment of administrative controls. Performance of hot work requires establishment of qualified fire watch personnel equipped with hand-held fire extinguishers. Qualification of the fire watch personnel ensures their capability to identify and extinguish fires in their incipient stages. Procedural requirements require minimization of combustible materials in the immediate vicinity of the work.

Accordingly, if such a fire were ignited, it would remain small, due a lack of combustibles and would be quickly extinguished by the fire watch. Fires that are not immediately extinguished are mitigated by the engineering controls discussed above for equipment malfunctions.

The TPS presents a potential for hydrogen release. This system is used to remove protium and deuterium impurities from the facility tritium inventory. The process uses a thermal diffusion column to separate the heavier tritium isotope from the lighter deuterium and protium isotopes by thermal cycling. Tritium is returned from the IUs and processed through the TPS for the purpose of removing deuterium and providing purified tritium gas. Tritium storage is located within the TPS gloveboxes with the bulk of the tritium in solid storage beds and thus unavailable to supply a leak. The glovebox is normally inerted, reducing the potential for hydrogen combustion.

Hydrogen fire in the TPS caused by a simultaneous hydrogen leak from TPS equipment and a loss of inert atmosphere in the glovebox, is prevented by the volume of the glovebox, which is large enough that a full release of tritium inventory would not result in hydrogen concentrations above the LFL. A fire external to the glovebox in the TPS room is mitigated by controls of combustible materials and the facility fire suppression system. Postulated fires are not expected to violate the integrity of the glovebox.

The deuterium source vessel for the accelerator presents a potential for hydrogen release inside the IU cell. The integrity of this deuterium vessel is assured by a periodic inspection program.

The final fire scenario involves fire spread from an area outside of the IF. The construction of the IF walls and associated components (e.g., doors, penetration seals, dampers) is sufficiently robust to provide a three hour fire rating. In some cases, non-fire rated components (e.g., airlock doors) are used to complete these barriers; however, these components provide fire separation equivalent to or greater than their rated counterparts. The postulated scenario would involve defeat of a fire barrier or its components, allowing fire spread into the IF from an external area.

Such a scenario would involve opening of airlock doors, removal of the concrete shield plugs and access doors from the IU cells, or removal of a rated penetration seal from an IF fire area (FA-2) barrier. Fire spread into the IF from an external fire could occur in any of these situations.

The need to remove the concrete shield plug and opening the personnel access door from an IU cell would occur during maintenance or modification activities which could potentially precipitate a fire. A fire under these conditions could involve transient combustibles located in the area to support the work activities. This type of scenario would be mitigated through application of both administrative and engineering controls. To prevent the development of conditions that could lead to fire, fire watch personnel are staged at unprotected fire area openings. These personnel are trained to recognize and eliminate fire hazards, thus preventing fire development. This administrative control prevents the development and/or spread of fire while openings are unprotected. Longer-term protection of openings is ensured through the placement of fire rated temporary penetration seals in barrier openings until the opening is permanently sealed. Finally, SHINE Medical Technologies 13a2-32 Rev. 1

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis maintenance activities are conducted in a manner that prevents unmitigated fire exposure of credited redundant safety-related SSCs due to a fire barrier breach. This is accomplished through preservation of barrier integrity. Discovery and response to a fire would be rapid due to the presence of fire watch personnel. The plant firefighting personnel would quickly respond and suppress the fire.

IF fires are limited to the initiator except where secondary combustibles in the form of transient combustibles or open electrical cable raceways provide a means for fire spread. Where fires are limited to the initiator, damage extent is defined by the potential for the initiator to develop a damaging hot-gas-layer (HGL) in a compartment. Where a compartment volume is sufficiently large, a fire in the initiator alone does not generate a damaging HGL.

The IF has a sufficiently large volume that fires limited to common initiators (i.e., electrical cabinets, transient combustibles, pumps, and electric motors) do not generate a damaging HGL.

Assurance that fires do not generate an HGL is further achieved by limiting the potential for fire spread through strict administrative control of transient combustibles and location of in-situ secondary combustibles. Admission of transient combustibles to the IF is limited and storage of combustibles is away from ignition sources. Hot work in this area is also strictly controlled and performed in accordance with approved hot work procedures. Open electrical raceways, such as cable trays and troughs, are not routed directly above fire initiators; cable drops to equipment are via metal clad cabling or conduits to limit the probability of fire spread to open raceways.

Further analyses and associated consequences are preserved in Subsection 13a2.2.12.2.

13a2.1.12.3 Tritium Purification System (TPS) Design Basis Accident This section presents the identification and evaluation of potential IEs and scenarios that could result from the operation of the TPS and the handling and storage of tritium within the facility.

The TPS is used to receive, purify, separate, and deliver tritium-containing gases to the accelerator target chamber, to produce neutrons in support of irradiation operations. Tritium is delivered to SHINE in DOT approved containers, which are loaded into gloveboxes where the tritium will be processed. The TPS gloveboxes are located within the IF. The TPS is divided into two isotope separation subsystems and a common supply and return piping system to provide tritium to the neutron drivers. Each TPS system is capable of treating the return gas from the operating irradiation units simultaneously at design capacity while meeting the tritium supply needs. This section analyzes failures that could lead to the release of tritium from the TPS.

13a2.1.12.3.1 Identification of Causes, Initial Conditions, and Assumptions The ISA Summary and associated hazards analyses (HAZOPS/PHA) identified the tritium in the tritium purification system (TPS) as a potential hazard that requires evaluation. Mishandling or malfunction of equipment in the TPS, including failure of piping, tritium processing equipment malfunctions, and human errors could lead to the inadvertent release of tritium.

SHINE Medical Technologies 13a2-33 Rev. 0

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis The initial conditions and assumptions associated with mishandling or malfunction of equipment affecting the TPS include:

a) The TPS process equipment is operated through a programmable logic controller/process automation controller (PLC/PAC). The process will be performed in semi-batch process steps of treating the contaminated flush gas and purifying the contaminated tritium gas. The process steps and local operator interfaces will be controlled and monitored by the PLC system.

b) Two independent TPS gloveboxes form a confinement boundary around the two isotope separation systems. Double-walled pipe forms a confinement boundary around the TPS supply and return tritium piping to and from the neutron drivers.

c) The glovebox atmosphere is inerted with nitrogen and oxygen levels are monitored.

d) The piping to and from the neutron driver accelerator system (NDAS) is double-walled and designed to maintain its integrity during normal and accident conditions.

e) Leakage of tritium from the system will be into either the double-wall piping or glovebox confinement.

f) Leakage of tritium from the glovebox enclosure or the external piping is detected by the RAMS or other leakage detection systems to ensure facility personnel are protected.

Details will be provided in the FSAR.

g) The TPS gloveboxes and piping are seismically designed and protected from external events by building design.

h) Automatic isolation valves are installed in the system to isolate sections of the system to minimize system release.

i) Tritium is delivered in robust DOT approved containers and transported in engineered transport containers, and is only handled inside the TPS gloveboxes or a transfer confinement.

j) TPS piping to and from the NDASs is normally operated at sub-atmospheric pressures.

13a2.1.12.3.2 General Scenario Description Scenarios involving the TPS will be mitigated by facility and system confinement design. The two TPS isotope separation systems are contained within separate glovebox enclosures located in the irradiation facility. The following TPS scenarios are to be evaluated:

• Loss of TPS system integrity inside the glovebox or double-wall piping.

• Loss of confinement integrity.

• Mishandling or dropping of a TPS ambient molecular sieve bed (AMSB) during maintenance.

• Release of tritium during a transfer operation.

• Fire.

Loss of TPS Integrity The TPS system is designed to withstand seismic events. The location within the building protects the system from other external events such as high winds or tornados. As such an external event should not cause any damage to the TPS. Should a break of TPS piping or a component inside the glovebox occur, the glovebox and double-wall piping protect the worker and public from a tritium release. The confinement and piping design protects the TPS from facility events that could damage the TPS piping, such as a fire.

SHINE Medical Technologies 13a2-34 Rev. 0

[Security-Related Information - Withhold Under 10 CFR 2.390]

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis The TPS system is designed with instrumentation and isolation valves to prevent excessive leakage from the system in the event of a system breach. The only significant portion of the tritium inventory that is not in a confinement or double-walled piping is the tritium in the neutron drivers. The eight neutron drivers have a combined tritium inventory of less than

[ Security-Related Information ]. Because the TPS is equipped with isolation features to mitigate large releases, there is no active single failure that could cause a large release of tritium. A break of TPS piping on a single neutron driver would be expected to release less than

[ Security-Related Information ] of tritium. Leakage from the balance of the system would be prevented by automatic isolation valves. To further mitigate a release, bubble-tight isolation dampers (fail closed) are installed for the RCA supply and exhaust lines. These are designed to be closed automatically on a high radiation signal or by manual operator action in the control room, and fail closed on a loss of power.

Loss of TPS Confinement The TPS resides inside a glovebox and double-walled piping system. The glovebox atmosphere is inerted using nitrogen. Tritium and oxygen levels are monitored using installed instrumentation. TPS gloveboxes are seismically-designed and protected from external events by facility design. During operation, the confinement space formed by the glovebox and double-walled piping would not contain tritium. A breach of confinement would not be expected to release tritium to either the facility or to the environment. Leakage of tritium from the process and components will be into either the glovebox or double-wall confinement, which will be monitored for tritium leakage. Detected leakage would result in the TPS being shut down and the cause of the tritium leak investigated. There is no active single failure that would result in a release of tritium to the environment.

Release of Tritium during Maintenance or Transfer Operations During maintenance it may be necessary to replace or remove components from the glovebox.

The component with the largest inventory of tritium that could be released following removal from the TPS glovebox is the AMSB. To prevent releases during and following AMSB removal, engineered transport containers are used to transport the AMSB. They are designed to contain any releases from the AMSB resulting from an event such as a drop.

Tritium is supplied to the facility in DOT approved transport containers. Tritium in the shipping container is in the form of uranium hydride. To complete transfer, an inner container is removed and connected to the TPS. The inner container is then heated to cause a release of tritium to the TPS. Transfer from the inner shipping container to the TPS will be done inside a confinement.

There is no postulated single active failure or human error that could cause a release of tritium during a transfer operation.

Fire The inerting of the gloveboxes and double-walled pipes protects the facility from a deflagration or detonation should TPS piping release tritium into the glovebox or double-walled pipe annular space. The size of the TPS glovebox is such that a credible release of tritium into the glovebox will not result in exceeding the LFL, even assuming the failure of the inerting system. As described in section 13a2.12.2, a fire external to the glovebox or double-wall pipe in the TPS room is mitigated by controls of combustible materials and the facility fire suppression system.

Postulated fires are not expected to violate the integrity of the glovebox.

SHINE Medical Technologies 13a2-35 Rev. 0

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis 13a2.2 ACCIDENT ANALYSIS AND DETERMINATION OF CONSEQUENCES This section further analyzes the accident conditions presented in Section 13a2.1 and provides a determination of the consequences where applicable. Every defined accident category is not necessarily credible; therefore, dose consequences to these accidents are not applicable. For accidents analyzed, further detail (e.g., uncertainties, margins of safety, detailed discussions of the computer codes used, code validating for the applications, etc.) will be provided in the FSAR.

13a2.2.1 TARGET SOLUTION RELEASE INTO THE IU CELL Target solution release into the IU cell is the IF postulated MHA. Based on the detailed consequence analysis in this subsection and Subsection 13b2.1, the RPF postulated MHA provides the bounding consequences; therefore, it is determined to be the MHA for the SHINE facility.

Initial conditions and assumptions are discussed in Subsection 13a2.1.1. TSV rupture with loss of SASS integrity is determined to be the limiting initiating event in the IF. The source terms and doses from this scenario bound the source term and consequence doses for all other postulated DBAs in the IF, and is thus identified as the worse-case scenario for the IF.

13a2.2.1.1 Initiating Event The target solution release in the IF is postulated to be a large rupture of the TSV and SASS resulting in a complete release of the target solution and fission product inventory into one IU cell. Due to the robust design of the TSV, a rupture is not considered to be a likely event.

However, for the purposes of this analysis, it is postulated that a breach of the TSV could be caused by corrosion, overpressure, maintenance, or operational errors.

13a2.2.1.2 Sequence of Events The target solution release scenario in the IF is the complete release of the radiological material inventory of a TSV into one IU cell. The sequence of events for the postulated scenario is as follows:

1. A release of target solution occurs from the TSV to the light water pool.

2. Airborne radiological material is released from the light water pool to the IU cell atmosphere with no credit given to the light water pool.

3. High radiation signal activates the bubble-tight isolation dampers after approximately one percent of the TSV inventory airborne activity is released to the RVZ1.

4. The airborne activity in RVZ1 is filtered prior to being released to the environment through the HVAC system until the bubble-tight dampers are isolated.

5. Ten percent of the airborne activity is released into the RCA through penetrations in the IU cell.

6. Radiation alarms are available locally or in the control room to notify facility personnel of any radiation leakage.

7. Facility personnel evacuate the immediate area upon actuation of the radiation area monitor alarms.

8. Since the TSV is not a pressurized system, it is assumed that only 25 percent of the activity leaves the system prior to evacuation of the facility.

SHINE Medical Technologies 13a2-36 Rev. 0

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis 13a2.2.1.3 Damage to Equipment The postulated scenario is initiated from damage or degradation to the pressure boundary integrity of the TSV. The effects of the TSV damage are contained within the IU cell due to the robust design and construction of the IU cell structure. Potential chemical and radiological contamination may therefore occur to systems within one IU cell. These include:

• NDAS

• PCLS

• LWPS

• NFDS These systems are exposed to the uranyl sulfate solution and fission products, which results in contamination but no physical damage. The LWPS is required to act as a passive heat sink to remove decay heat from the irradiated target solution. This requirement continues to be met, since the light water pool is constructed with a stainless steel liner surrounded by concrete and maintains the LWPS water inventory. The active functions of the LWPS, PCLS, NFDS, and NDAS are not required to maintain the IU in a safe shutdown condition.

13a2.2.1.4 Quantitative Evaluation of Accident Evolution In accordance with the Final ISG Augmenting NUREG-1537 guidance on the MHA, the initiating event, a breach of the TSV and SASS, is assumed without any quantitative evaluation. Once the target solution has drained to the IU cell, it becomes mixed with the light water pool inventory. No credit for source term reduction is given.

The RVZ1 exhaust is equipped with HEPA and charcoal filters with assumed efficiencies of 99 percent for particulates and 95 percent for halogens, respectively. This allows for degradation from design efficiencies.

The isolation dampers are of a fail-safe design, and close on high radiation within the IU cell or on a loss of power. The total release to RVZ1 through the bubble-tight isolation dampers during the accident is assumed to be no more than one percent of the airborne activity from the target solution based on design characteristics of the dampers and the response of the RAMs.

Each IU cell is constructed of steel-reinforced concrete walls and ceiling thick enough to contain the released material, provide shielding, and isolate the effects of the rupture or leakage from the other IU cells. The shielding provides protection to workers from the radiological materials remaining in the IU cell. Therefore, this source was determined to be insignificant in comparison to the overall dose received by workers in the RCA. The total release to the RCA through the IU cell penetrations during the accident is assumed to be no more than 10 percent of the airborne activity in the IU cell based on design characteristics of the penetrations.

SHINE Medical Technologies 13a2-37 Rev. 0

[Proprietary Information - Withhold from public disclosure under 10 CFR 2.390(a)(4)]

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis 13a2.2.1.5 Radiation Source Term Analysis The source term for this scenario is the TSV target solution inventory at the end of [ Proprietary Information ] irradiation cycles. The normal operations material at risk (MAR) values have been derived from ORIGEN-S calculations, and are based upon a range of scenarios including:

• Limiting normal operations parameters, including increased power [ Proprietary Information ], and maximum fission product carryover.

• A 5.5 day irradiation time.

• Zero hours of decay after TSV discharge.

For these scenarios, the MAR inventory expressed in curies has been analyzed for the TSV. The maximum TSV radionuclide inventory at the time of the loss of the MAR to the IU cell was used in the calculation.

Table 13a2.2.1-1 presents the MAR inventories for those nuclides contributing greater than one percent of the TEDE.

Airborne and respirable source terms are used to calculate the TEDE. The factors used to calculate the airborne and respirable source terms are the MAR, the damage ratio (DR), the leak path factor (LPF), the airborne release fraction (ARF), and for the respirable source term the respirable fraction (RF).

• The MAR is the amount of a radionuclide acted upon by a given physical stress.

• The DR is the fraction of the MAR actually impacted by the accident-generated conditions.

• The LPF is the fraction of the radionuclide made airborne that challenge the interface of the facility and ambient environment.

• The ARF is the coefficient used to estimate the amount of radioactive material that can be suspended in the atmosphere as an aerosol and made available for airborne transport under the specific set of induced physical stresses from a specific accident.

• The RF is the fraction of airborne radionuclide particles/aerosols that can be transported through air and inhaled into the human respiratory system commonly assumed to include particles 10 microns and smaller aerodynamic equivalent diameter.

The values used in this analysis for these factors are listed in Tables 13a2.2.1-2, 13a2.2.1-3 and 13a2.2.1-4.

13a2.2.1.6 Radiological Consequence Analysis The radiological dose consequence analysis is performed using the source term described above. The TEDE to workers and members of the public is calculated by determining the radiological dose due to internal and external radiation. The radionuclides deposited in the body produce an internal dose known as the committed effective dose equivalent (CEDE). The external dose equivalent (EDE) is due to radionuclides in the atmosphere that irradiate individuals, which consists of immersion and exposure to a contaminated surface. These are summed over all radionuclides for each exposure pathway to determine the TEDE. The factors used to determine the internal doses are the internal dose conversion factors (DCF), breathing rate (BR), building volume (BV) for workers, and dispersion value (DV) for members of the public.

Factors used to determine the immersion doses include immersion DCFs, and depending on the SHINE Medical Technologies 13a2-38 Rev. 0

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis exposed group either the BV or DV. Exposure due to surface contamination is only calculated for workers and the factors include areal contamination DCFs and surface areas. Another factor considered for workers in dose calculations is the time of exposure.

• The DCFs are used to:

- Convert activity inhaled to an internal dose,

- Convert an exposure to an external activity from immersion in air into an external dose and,

- Convert an external activity due to exposure to a contaminated area into an external dose.

• The BR is the volume rate of air inhaled by a reference person.

• The BV is the free volume within the enclosed building to determine dose due to immersion.

The values used in this analysis for these factors are listed in Table 13a2.2.1-2.

The resulting dose consequence of this event is a TEDE of 3.06 rem to the workers. The TEDE to a member of the public for this event is 0.0165 rem (site boundary) and 0.0023 rem (nearest residence). The resulting off-site doses are within the 0.1 rem TEDE regulatory limit specified in 10 CFR 20.1301, and on-site doses are within the 5 rem TEDE regulatory limit specified in 10 CFR 20.1201.

Finally, emergency operating procedures, recovery actions, and administrative controls are available to provide additional mitigation of failed isolation SSCs in the event of a release of radioactive material.

13a2.2.1.7 Safety Controls This is a postulated MHA for the IF. Safety-related SSCs and administrative controls for a similar event DBA are listed in Subsection 13a2.2.4.

SHINE Medical Technologies 13a2-39 Rev. 1

[Proprietary Information - Withhold from public disclosure under 10 CFR 2.390(a)(4)]

[Security-Related Information - Withhold Under 10 CFR 2.390]

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis Table 13a2.2.1-1 Material At Risk for TSV Source Term Nuclide Source Term (Ci)

Br-84 [ Proprietary Information ]

[ Security-Related Information ]

I-131 [ Proprietary Information ]

[ Security-Related Information ]

I-132 [ Proprietary Information ]

[ Security-Related Information ]

I-133 [ Proprietary Information ]

[ Security-Related Information ]

I-134 [ Proprietary Information ]

[ Security-Related Information ]

I-135 [ Proprietary Information ]

[ Security-Related Information ]

Kr-85m [ Proprietary Information ]

[ Security-Related Information ]

Kr-87 [ Proprietary Information ]

[ Security-Related Information ]

Kr-88 [ Proprietary Information ]

[ Security-Related Information ]

Xe-133 [ Proprietary Information ]

[ Security-Related Information ]

Xe-135 [ Proprietary Information ]

[ Security-Related Information ]

Xe-135m [ Proprietary Information ]

[ Security-Related Information ]

Xe-138 [ Proprietary Information ]

[ Security-Related Information ]

SHINE Medical Technologies 13a2-40 Rev. 0

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis Table 13a2.2.1-2 Parameters Used in the Dose Consequence Assessment Parameter Assumed Value Damage Ratio, DR 1.0 See Table Release Fraction from IU cell (public/worker) 13a2.2.1-3 HEPA Filter Particulate Removal Efficiency 0.99 Carbon Adsorber Iodine Removal Efficiency 0.95 See Table Airborne Release Fractions, ARF 13a2.2.1-4 See Table Respirable Fractions, RF 13a2.2.1-4 ICRP-30 Dose Conversion Factors, DCF FGR-12 Breathing Rate, BR 3.5E-04 m3/s Dispersion Value at the fence line, DV 3.88E-04 s/m3 (50th percentile)

Dispersion Value for Nearest Residence, DV 5.43E-05 s/m3 (50th percentile)

Building Volume (75% free volume) 35,296 m3 Worker Exposure Time 10 minutes(a) a) The 10 minute evacuation time is a conservative assumption. Workers in the RPF and IF are trained to immediately evacuate the area in response to a high radiation alarm or CAAS alarm. Radiological dose consequence evaluations performed show that worker doses are within regulatory limits. Additional detailed radiological dose consequence modeling and analysis will be performed for certain areas of the facility to increase the evacuation time. The results of this analysis will be described in the FSAR.

SHINE Medical Technologies 13a2-41 Rev. 0

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis Table 13a2.2.1-3 Public and Worker LPF for each DBA Event Material Public LPF Worker LPF Particulates 0.0001 0.025 Target Solution Release into the IU Cell (IF Halogens 0.0005 0.025 Postulated MHA)

Noble Gas 0.01 0.025 Particulates NP(a)

Mishandling and Malfunction of Equipment Halogens 0.0005 0.025 Affecting the PSB Noble Gas 0.01 0.025 Particulates 0.0001 0.025 Mishandling or Malfunction of Target Halogens 0.0005 0.025 Solution Noble Gas 0.01 0.025 Tritium Purification System Design Basis Tritium Gas 0.01 1.0 Event a) NP = Not Present in significant quantity SHINE Medical Technologies 13a2-42 Rev. 1

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis Table 13a2.2.1-4 Airborne Release and Respirable Fractions for each DBA Event Material ARF RF Particulates 0.0002 0.4 Target Solution Release from the Halogens 0.05 1.0 IU Cell (IF Postulated MHA)

Noble Gas 1.0 1.0 Particulates NP(a)

Mishandling and Malfunction of Halogens 0.05 1.0 Equipment Noble Gas 1.0 1.0 Particulates 0.0001 1.0 Mishandling and Malfunction of Halogens 0.05 1.0 Target Solution Noble Gas 0.1 1.0 Tritium Purification System Tritium Gas 1.0 1.0 Design Basis Accident a) NP = Not Present in significant quantities SHINE Medical Technologies 13a2-43 Rev. 1

[Proprietary Information - Withhold from public disclosure under 10 CFR 2.390(a)(4)]

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis 13a2.2.2 EXCESS REACTIVITY INSERTION ACCIDENT Subsection 13a2.1.2 identified excess reactivity insertion as a DBA requiring detailed accident analysis. During the subcritical irradiation operations with the neutron driver at full power, significant positive reactivity could be added to the TSV through a void collapse scenario.

Excessive cooldown, another reactivity insertion scenario, is only credible when the neutron driver is not operating. Positive reactivity is also added to the TSV during the fill operation to the desired keff value prior to energizing the neutron driver for the irradiation operations. The numerous safety controls designed into the IF ensure that the target solution does not reach criticality.

13a2.2.2.1 Initiating Events Subsection 13a2.1.2 identifies many potential IEs/scenarios with respect to an insertion of excess reactivity. Only three of these IEs warrant further analyses in this section, namely:

• Increase in the target solution density during operations (due to pressurization).

• Target solution temperature reduction (excessive cooldown).

• Additional target solution injection during fill/startup and irradiation operations.

Increase in the Target Solution Density During Operations:

The worst case system pressurization would occur following a deflagration or detonation in the headspace of the TSV due to hydrogen accumulation during irradiation operations. The increase in TSV pressure would cause a reduction in the TSV void fraction, which is in turn a positive reactivity addition (because of the negative void coefficient). The temperature of the TSV solution would remain steady or increase due to increased heat production. Therefore, the positive reactivity addition would not be large enough to cause the system reactivity to increase beyond the cold shutdown starting point, since the most bounding condition is a cold target solution with no voids (present at the beginning of irradiation). Therefore, this event would cause a positive reactivity addition, but not be large enough to reach a critical condition (keff = 1).

Target Solution Temperature Reduction:

The IU is cooled by the PCLS and the LWPS. The PCLS is a closed loop that circulates cooling water [ Proprietary Information ] past the TSV walls to remove heat generated in the target solution during normal irradiation and shutdown operations. The LWPS cooling system circulates the light water pool water to remove heat generated during normal and shutdown operations. An excessive cooldown could potentially occur if either system malfunctions and overcools the target solution (below the initial temperature of the fill/startup operation), thus adding positive reactivity due to the negative temperature coefficient. An overcooling event that drops the target solution temperature to a value of 5oC (9oF) below the initial fill temperature would add approximately 110 percent millirho (pcm). A reactivity insertion of this magnitude would not be expected to cause criticality in the TSV, however, trip setpoints for low temperature and high flux may be reached, resulting in the target solution being drained to the TSV dump tanks.

SHINE Medical Technologies 13a2-44 Rev. 0

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis Additional target solution injection during fill/startup and irradiation operations:

If the uranium enrichment is greater than assumed and/or the concentration of uranium in the uranyl sulfate is greater than planned, there is a potential for excess reactivity to be introduced into the TSV during fill/startup. Even if there is a subsequent mechanical failure (e.g. - the fill pump fails to stop on demand), due to the TRPS there would not be a criticality in the target solution.

13a2.2.2.2 Sequence of Events During irradiation operations with the TSV isolated from material additions, the target solution pressurization and excessive cooldown events cannot add enough positive reactivity to bring the TSV to a critical condition. For the excess reactivity accident, the most likely IE with the potential for a large reactivity insertion would be the introduction of excess fissile material during TSV fill.

However, the system is designed with multiple safety features in place to prevent criticality should a failure in the solution preparation process occur.

Maintaining subcritical conditions is a requirement for fill/startup and irradiation operations, therefore uranium enrichment and concentration limits are included in the Technical Specifications. Before fill operations commence, the target solution has been previously characterized during facility startup testing and a plot of desired fill heights versus neutron count rates (or flux levels) pre-established (using the 1/M method to ensure that target solution remains subcritical during fill and irradiation operations) to reach the desired operational subcritical multiplication. The pre-determined input values are implemented into operating procedures to establish hold points for determining the next incremental amount of target solution to be added.

This provides tight controls on fill/startup to meet acceptable criteria and desired target solution level for subsequent irradiation operations. A new 1/M plot is calculated during each startup, and if the curve deviates significantly even in early stages of the fill operation, it would indicate an issue with the solution preparation and fill operation would be suspended. However, this is an administrative control and is not credited in the transient analysis. Fill rate is also controlled by limiting the size of the fill valves and piping to the TSV ensuring a slow approach to the desired target solution fill height.

For the fill operation, the TRPS is designed with a setpoint on high neutron flux level. A TSV trip signal terminates the fill evolution by closing the fill valves and opening the TSV dump valves, placing the target solution in a subcritical condition inside the TSV dump tank. The fill rate, trip actuation time, potential error in fissile material concentration, and detector uncertainty are incorporated into the selection of a neutron flux trip setpoint to ensure that the solution is dumped prior to reaching criticality.

13a2.2.2.3 Damage to Equipment TRPS design ends the event and places the TSV in a safe subcritical shutdown condition without the need for operator action. TRPS function also prevents challenges to the integrity of the PSB.

No equipment damage results from the postulated excess reactivity events.

SHINE Medical Technologies 13a2-45 Rev. 0

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis 13a2.2.2.4 Quantitative Evaluation of Accident Evolution Quantitative transient analysis of these three events will be presented in the FSAR. A qualitative discussion of the transients follows.

During irradiation operations with the neutron driver on, a malfunction of the TOGS could lead to an increase in the hydrogen concentration in the head space and a potential deflagration or detonation which would increase the pressure in the target solution. This would cause a void collapse in the TSV and a positive reactivity addition (due to the negative void coefficient). The positive reactivity addition would not be large enough to cause an inadvertent criticality in the TSV as discussed earlier in this section. The TSV, TSV dump tank, piping, and associated dump valves are designed to withstand a credible deflagration or detonation; therefore, no release from the IU cell occurs. Similarly for the excessive cooldown event during irradiation, a critical condition does not occur and there is no release from the IU.

A transient analysis of excessive cooldown shows that this scenario evolves slowly enough to allow for operator action to terminate the event. If operator action is not taken, the TRPS trips on high flux or low temperature in the TSV/PCLS and opens the TSV dump valves, draining the solution to the TSV dump tanks. Reactivity values during these transients are calculated following detailed design, showing that the assembly does not reach critical.

For the fill/startup operation, if the uranium enrichment and concentration are not within limits and are not detected due to a sampling failure or human error, the potential for excess fissile material to be introduced into the TSV exists. Additionally, the fill pump could fail to stop on command during fill. This event does not lead to a criticality because the high neutron flux setpoint is set to trip the TSV prior to reaching a critical condition. There are multiple independent neutron detectors with independent trip circuits. The inputs to the trip setpoint include the highest credible uranium enrichment/concentration postulated, detector uncertainties, trip signal delay times, and dump valve actuation delay times. The TRPS trip ensures the target solution is transferred to the dump tank prior to going critical, terminating the event with no adverse source term or consequences to the workers or the public. Slightly elevated neutron fluxes present in the TSV due to elevated keff values have insignificant effects compared to irradiation mode neutron fluxes.

13a2.2.2.5 Radiation Source Term Analysis As discussed in this subsection, there are three scenarios that potentially result in an excess reactivity insertion event. The TSV is designed to operate under subcritical conditions at all times. An inadvertent criticality is prevented by a TRPS trip if unsafe conditions are approached.

Since there is no postulated scenario that could lead to a criticality without multiple failures, there would be no significant increase in the TSV fission product inventory for the excess reactivity event.

13a2.2.2.6 Radiological Consequence Analysis The excess reactivity insertion event does not challenge the integrity of the PSB. The TRPS is designed to initiate a trip on high neutron flux/high hydrogen concentration (during irradiation operations) and high neutron flux/low temperature (during fill and shutdown). During irradiation operations, the TRPS trip de-energizes the neutron driver, and transfers the contents of the TSV SHINE Medical Technologies 13a2-46 Rev. 0

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis to the criticality-safe TSV dump tank terminating the event. In addition, during a fill/startup evolution, the TRPS trip automatically stops the fill evolution by closing TSV fill valves and opening TSV dump valves. The TRPS serves to prevent an inadvertent criticality in the target solution and there would be minimal increase in the source term due to slightly elevated power.

Fission products are contained within the TSV, TOGS, dump tank and associated piping.

The robust design features of the PSB and remaining facility building are not challenged by an excess reactivity insertion event. The fission product inventory of the target solution and associated fission gases are contained within the TSV and associated systems thereby posing no significant increase in consequences to workers or the public.

13a2.2.2.7 Safety Controls There are several safety-related SSCs and administrative controls that prevent or provide mitigation for the consequences of an excess reactivity insertion event and ensure that the TSV remains subcritical.

Increase in Target Solution Density During Operations:

• TRPS trip on high hydrogen concentration (SR).

• TRPS trip on high range high neutron flux (SR).

Target Solution Temperature Reduction:

• TRPS trip on high neutron flux (high range and source range) (SR).

• TRPS trip on low PCLS temperature (SR).

Additional Target Solution Injection During Fill/Startup and Irradiation Operations:

• Target solution uranium enrichment limit and tolerance (Technical Specification parameter).

• Target solution uranium concentration limit and tolerance (Technical Specification parameter).

• Neutron driver high voltage power supply interlocked with TSV startup mode to prevent operation by TRPS (SR).

• Manual TSV trip capability incorporated into operator control panel (SR).

• TSV dump tank designed with criticality-safe geometry (keff < 0.95) (SR).

• TSV dump tank at a lower elevation than the TSV (SR).

• TSV fill valves, fill pipe sizing, and fill pump design (SR).

• TRPS trip on source range high neutron flux (SR).

• Two redundant TSV dump tank valves (SR).

• Procedural control of startup - Conduct of Operations (Technical Specification Administrative Control)

During the fill/startup operation, the TRPS trip signal automatically closes TSV fill valves and opens the TSV dump valves transferring the target solution from the TSV to the criticality-safe TSV dump tanks terminating the event. Only one of these events needs to occur to prevent criticality. The target solution is passively cooled for decay heat removal.

SHINE Medical Technologies 13a2-47 Rev. 1

[Proprietary Information - Withhold from public disclosure under 10 CFR 2.390(a)(4)]

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis Following fill/startup operation, the TSV fill valves and the fill pump are locked out and de-energized to prevent inadvertent fissile solution transfer to the TSV prior to and during irradiation operation.

During irradiation operations, the TRPS trip signal automatically de-energizes the neutron driver and opens the TSV dump tank valves.

Besides the TRPS, other principle SR design features to prevent or mitigate the consequences of an excess reactivity insertion event include:

• Robust design of the TSV.

• Robust design and reliability of the TOGS.

• Robust design of the dump tank, piping, and valves.

Finally, the instrumentation and monitoring equipment provides the means for the operators to monitor the TSV and assess the condition of the facility both inside and outside the IU cell area.

This includes radiation monitoring and alarms to notify facility personnel of elevated radiation levels for the protection of facility workers, and effluent monitoring to assess impact to the public.

Hydrogen control is also required in order to maintain the hydrogen concentration in the TOGS and TSV headspace below the lower flammability limit. SR Systems include the following:

• TRPS - TSV Reactivity Protection System.

• RAMS - Radiation Air Monitoring System.

• NGRS - Noble Gas Removal System.

13a2.2.3 REDUCTION IN COOLING The TRPS trips on loss of cooling. The temperature increase prior to TRPS trip results in a negative reactivity insertion within the TSV. The decay heat from the target solution is estimated to be approximately [ Proprietary Information ]. The volume of water in the light water pool is sufficient to act as a passive heat sink for the TSV dump tanks and the decay heat from the uranyl sulfate solution and sensible heat from the other TSV components. Therefore, cooling system operation is not required to remove decay heat from the target solution. Thus, there is no significant increased risk to workers or the public.

Safety Controls The safety-related systems that are required to function during a loss of cooling are:

• TRPS loss of cooling trip (loss of PCLS flow and/or PCLS high temperature) (SR).

• Light water pool (SR).

13a2.2.4 MISHANDLING OR MALFUNCTION OF TARGET SOLUTION The TSV overfill piping prevents any consequences from Scenario 1. Scenarios 2 and 4 could result in a release outside of the IU cell. Scenario 3 results in small amounts of target solution being relocated to the primary cooling systems, but any release is contained within those systems. Any resulting increase in area radiation within the IU cell is detected by the area radiation monitors and the workers are alerted.

SHINE Medical Technologies 13a2-48 Rev. 1

[Proprietary Information - Withhold from public disclosure under 10 CFR 2.390(a)(4)]

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis The bounding scenario to be analyzed as a DBA for mishandling or malfunction of target solution in the IF is Scenario 4, a release or leak of the entire contents of the dump tank into the IU cell after [ Proprietary Information ] cycles of irradiation.

A similar scenario has been previously identified as a postulated MHA for the IF but the MHA analysis assumes unrealistic airborne release fractions. This scenario is now being evaluated as a DBA for which a more detailed evaluation using realistic airborne release fractions is being provided along with the identification of safety controls to prevent or mitigate this scenario.

Initial conditions and assumptions are discussed in Subsection 13a2.1.4.1.

13a2.2.4.1 Initiating Events As indicated previously, TSV dump tank piping rupture into the IU cell is determined to be the limiting event for a complete release of the target solution and fission product inventory. IEs for this limiting event could be caused by corrosion (due to failure to control pH of the target solution), failure of piping due to weld or seal failures, and maintenance errors.

Due to the robust design of the TSV dump tank piping, a rupture of the piping is considered to be an unlikely event.

13a2.2.4.2 Sequence of Events The target solution release scenario in the IU cell is the release of 25 percent of the radiological material inventory of a TSV dump tank into one IU cell. The sequence of events for the postulated scenario is as follows:

1. A release of target solution occurs from the TSV dump tank directly to the IU cell atmosphere via a break in the dump tank outlet piping above the pool.

2. The rate at which the solution is being pumped limits the material released to the IU cell to 25 percent of the total inventory prior to evacuation of the facility.

3. RCA ventilation is functioning normally prior to the accident.

4. A high radiation signal activates the bubble-tight isolation dampers after approximately one percent of the airborne material is released to the RVZ1.

5. The airborne activity is filtered prior to being released to the environment through the RVZ1 system until the bubble-tight dampers are closed.

6. Ten percent of the airborne activity is released into the RCA through penetrations in the IU cell.

7. Radiation alarms are available locally or in the control room to notify facility personnel of any radiation leakage.

8. Facility personnel evacuate the immediate area upon actuation of the radiation area monitor alarms.

13a2.2.4.3 Damage to Equipment The postulated scenario is initiated from damage or degradation to the TSV dump tank piping.

The effects of the piping damage are contained within the IU cell due to the robust design and SHINE Medical Technologies 13a2-49 Rev. 0

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis construction of the IU cell structure. Potential chemical and radiological contamination may therefore occur to systems within one IU cell. These include:

• NDAS

• PCLS

• LWPS These systems are exposed to the uranyl sulfate solution and fission products, which results in contamination but no physical damage. The LWPS is required to act as a passive heat sink to remove decay heat from the irradiated target solution. This requirement continues to be met, since the light water pool is constructed with a stainless steel liner surrounded by concrete and maintains the LWPS water inventory. The active functions of the LWPS, PCLS, and NDAS are not required to maintain the IU in a safe shutdown condition.

13a2.2.4.4 Quantitative Evaluation of Accident Evolution The solubility of the fission products in the solution results in airborne release fractions for noble gases, halogens, and particulates of 0.1, 0.05, and 0.0001, respectively; thus reducing the previously estimated source terms in Subsection 13a2.2.1. Once the target solution has been released to the IU cell, it becomes mixed with the light water pool inventory.

The RVZ1 exhaust is equipped with HEPA and charcoal filters with assumed efficiencies of 99 percent for particulates and 95 percent for halogens, respectively. This allows for degradation from design efficiencies.

The isolation dampers are of a fail-safe design, and close on high radiation within the IU cell or on a loss of power. The total release to RVZ1 through the bubble-tight isolation dampers during the accident is assumed to be no more than one percent of the total airborne activity in the IU cell based on design characteristics of the dampers and the response of the RAMs.

Each IU cell is constructed of steel reinforced concrete walls and ceiling thick enough to contain the released material, provide shielding, and isolate the effects of the rupture or leakage from the other IU cells. The shielding provides protection to workers from the radiological materials remaining in the IU cell. Therefore, this source was determined to be insignificant in comparison to the overall dose received by workers in the RCA by airborne radioactive material that leaks into the RCA. The total release to the RCA through the IU cell penetrations during the accident is assumed to be no more than 10 percent of the airborne activity in the IU cell based on design characteristics of the penetrations.

13a2.2.4.5 Radiation Source Term Analysis Table 13a2.2.1-1 presents the MAR inventories that could be released for those radionuclides contributing greater than 1 percent of the TEDE.

Airborne and respirable source terms are used to calculate the TEDE. The factors used to calculate the airborne and respirable source terms are the product of the MAR, the damage ratio (DR), the release fraction from IU cell, the airborne release fraction (ARF), and the respirable fraction (RF). The values used in this analysis for these factors are listed in Table 13a2.2.1-2.

SHINE Medical Technologies 13a2-50 Rev. 0

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis 13a2.2.4.6 Radiological Consequence Analysis The radiological dose consequences for this DBA are calculated using the methods described in Subsection 13a2.2.1 and the values in Table 13a2.2.1-2.

The resulting TEDE for workers is 1.50 rem. The TEDE to a member of the public for this event is 2.19E-03 rem at the site boundary and 3.06E-04 rem for the nearest resident. Therefore, the resulting on-site and off-site doses are below the regulatory limits specified in 10 CFR 20.1301, and 10 CFR 20.1201.

13a2.2.4.7 Safety Controls The following engineering controls have been designed to prevent or mitigate the effects of the target solution spill in IU cell.

• TSV dump tank piping integrity (SR).

• The structural integrity, biological shielding, and low leakage construction (including penetrations) of the IU cells (SR).

• RVZ1 isolation bubble-tight dampers, exhaust filters, and ductwork (SR).

• RAMs high radiation signal (SR).

• ESFAS actuation (SR).

• Light water coolant activity monitoring program (TS Administrative Control).

• TSV overflow line (SR).

Instrumentation and monitoring equipment provides the means for the operators to monitor and assess the condition of the facility in the irradiation operations area. This includes radiation monitoring and alarms to notify facility personnel of elevated radiation levels for the protection of facility workers, and effluent monitoring to assess impact to the public. A 120 VAC UPSS is designed to provide power in the case of LOOP for monitoring of conditions in the IF.

13a2.2.5 LOSS OF OFF-SITE POWER Following a LOOP, the neutron driver is de-energized, however, hydrogen generation continues to occur in the target solution due to radiolysis from the decay of fission products. The UPSS is designed to power the TOGS loads needed to continue to remove hydrogen generated by radiolysis. The effects of loss of cooling due to a LOOP are discussed in Subsection 13a2.2.3.

Thus, there is no significant increased risk to workers or the public.

Safety Controls The following safety-related controls have been designed to prevent or mitigate the effects of a LOOP:

• TOGS blower (SR).

• PVVS blower (SR).

• Robust design and reliability of TOGS (SR).

• Process and radiation monitoring equipment needed to monitor the condition of the facility (TRPS, RAMS, CAAS (SR).

• UPSS and associated 120 VAC buses (SR).

SHINE Medical Technologies 13a2-51 Rev. 1

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis 13a2.2.6 EXTERNAL EVENTS The facility is designed to withstand credible external events as described in 13a2.1.6. Thus, there are no consequences to the workers or the public from external events.

Safety Controls The essential systems that are required to function during an external event are:

• Seismic Category I SSCs (SR).

13a2.2.7 MISHANDLING OR MALFUNCTION OF EQUIPMENT AFFECTING THE PSB This subsection contains the follow-on evaluation for the event identified in Subsection 13a2.1.7.

The conclusion of that subsection was that the release of the off-gas purge volume from one of the eight TOGS to the TOGS shielded cell requires further evaluation.

13a2.2.7.1 Initiating Event In this scenario, a malfunction or human error occurs that releases the off-gas purge volume from one of the eight TOGS to one of the TOGS shielded cells.

13a2.2.7.2 Sequence of Events This scenario is the complete release of the off-gas purge volume into the TOGS shielded cell.

The sequence of events for the postulated scenario is as follows:

a. A release of off-gas purge volume occurs from the TSV directly to the TOGS shielded cell as a result of TOGS pipe rupture.

b. Twenty-five percent of the TOGS activity enters the TOGS shielded cell prior to evacuation of the facility.

c. A high radiation signal activates the bubble-tight isolation dampers after approximately one percent of the total activity is released to the RVZ1.

d. The airborne activity is filtered prior to being released to the environment through the RVZ1 system until the bubble-tight dampers are closed.

e. Ten percent of the airborne activity is released into the RCA through penetrations in the TOGS shielded cell.

f. Radiation alarms are available locally or in the control room to notify facility personnel of any radiation leakage.

g. Facility personnel evacuate the immediate area upon actuation of the radiation area monitor alarms.

13a2.2.7.3 Damage to Equipment The postulated scenario is initiated from damage or degradation to the TOGS piping.

SHINE Medical Technologies 13a2-52 Rev. 0

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis The effects of the piping damage are contained within the TOGS shielded cell due to the robust design and construction of the TOGS shielded cell structure. Contamination inside the TOGS shielded cell occurs.

13a2.2.7.4 Quantitative Evaluation of Accident Evolution The airborne release fractions for noble gases and halogens are 1.0 and 0.05, respectively. The TSV and TOGS are assumed to have been purged after the previous irradiation cycle. Once the off-gas has been released to the TOGS shielded cell, it becomes mixed with the atmosphere inside the TOGS shielded cell.

The RVZ1 exhaust is equipped with HEPA and charcoal filters with assumed efficiencies of 99 percent for particulates and 95 percent for halogens, respectively. This allows for degradation from design efficiencies.

The isolation dampers are of a fail-safe design, and close on high radiation within the TOGS shielded cell or on a loss of power. The total release to RVZ1 through the bubble-tight isolation dampers during the accident is assumed to be no more than one percent of the airborne activity in the TOGS based on design characteristics of the dampers and the response of the RAMs.

Each TOGS shielded cell is constructed of reinforced concrete walls and ceiling thick enough to contain the released material, provide shielding, and isolate the effects of the rupture or leakage from the other areas of the IF. The shielding provides protection to workers from the radiological materials remaining in the TOGS shielded cell. Therefore, this source was determined to be insignificant in comparison to the overall dose received by workers in the RCA from airborne radioactive material that leaks into the RCA. The total release to the RCA through the TOGS shielded cell penetrations during the accident is assumed to be no more than 10 percent of the airborne activity in the TOGS shielded cell based on design characteristics of the penetrations.

13a2.2.7.5 Radiation Source Term Analysis Table 13a2.2.7-1 presents the MAR inventories that could be released for those radionuclides contributing greater than one percent of the TEDE. Airborne and respirable source terms are used to calculate the TEDE. The factors used to calculate the airborne and respirable source terms are the product of the MAR, the damage ratio (DR), the release fraction from IU cell, the airborne release fraction (ARF), and the respirable fraction (RF). The values used in this analysis for these factors are listed in Table 13a2.2.1-2.

13a2.2.7.6 Radiological Consequence Analysis The radiological dose consequences for this DBA are calculated using the methods described in Subsection 13a2.2.1 and the values in Table 13a2.2.1-2.

The resulting TEDE for workers is 1.87 rem. The TEDE to a member of the public for this event is 1.59E-02 rem at the site boundary and 2.23E-03 rem for the nearest resident. Therefore, the resulting on-site and off-site doses are below the regulatory limits specified in 10 CFR 20.1301, and 10 CFR 20.1201.

SHINE Medical Technologies 13a2-53 Rev. 0

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis 13a2.2.7.7 Safety Controls The following safety-related SSCs have been designed to prevent or mitigate the effects of the off-gas purge volume release into the TOGS shielded cell:

• Robust design and reliability of TOGS (SR).

• The structural integrity, biological shielding, and leak tight construction (including penetrations) of the TOGS shielded cells (SR).

• RVZ1 isolation bubble-tight dampers, exhaust filters, and ductwork (SR).

• RAMs high radiation signal (SR).

• ESFAS actuation (SR).

Instrumentation and monitoring equipment provides the means for the operators to monitor and assess the condition of the facility in the IF. This includes radiation monitoring and alarms to notify facility personnel of elevated radiation levels for the protection of facility workers, and effluent monitoring to assess impact to the public. A 120 VAC UPSS is designed to provide power in the case of LOOP for monitoring of conditions in the IF.

SHINE Medical Technologies 13a2-54 Rev. 1

[Proprietary Information - Withhold from public disclosure under 10 CFR 2.390(a)(4)]

[Security-Related Information - Withhold Under 10 CFR 2.390]

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis Table 13a2.2.7-1 Material At Risk for TOGS Source Term Nuclide Source Term (Ci)

I-131 [ Proprietary Information ]

[ Security-Related Information ]

I-133 [ Proprietary Information ]

[ Security-Related Information ]

I-135 [ Proprietary Information ]

[ Security-Related Information ]

Kr-85m [ Proprietary Information ]

[ Security-Related Information ]

Kr-87 [ Proprietary Information ]

[ Security-Related Information ]

Kr-88 [ Proprietary Information ]

[ Security-Related Information ]

Xe-133 [ Proprietary Information ]

[ Security-Related Information ]

Xe-135 [ Proprietary Information ]

[ Security-Related Information ]

Xe-135m [ Proprietary Information ]

[ Security-Related Information ]

Xe-138 [ Proprietary Information ]

[ Security-Related Information ]

SHINE Medical Technologies 13a2-55 Rev. 0

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis 13a2.2.8 LARGE UNDAMPED POWER OSCILLATION As described in Subsection 13a2.1.8, operating at a subcritical condition with a low power density and negative temperature and void reactivity coefficients provides TSV stability and self-limiting power oscillations. A TRPS setpoint is designed to activate on high neutron flux level should a large undamped power oscillation occur. Thus, there are no consequences to workers or the public.

Safety Controls The essential features required to function during a large undamped power oscillation are:

• Target solution properties.

- Negative temperature coefficient (Technical Specifications parameter).

- Negative void coefficient (Technical Specifications parameter).

• Thermal power limit of the TSV (Technical Specifications parameter).

• TRPS high neutron flux trip (SR).

13a2.2.9 DETONATION AND DEFLAGRATION IN PRIMARY SYSTEM BOUNDARY As discussed in Subsection 13a2.1.9, hydrogen and oxygen are released by radiolysis from the target solution both during and after irradiation, and high concentrations of hydrogen may result in detonation or deflagration. The TOGS provides ventilation of the headspace above the TSV to maintain hydrogen concentrations below the LFL. A failure of the TOGS to perform this design function may result in conditions that could lead to a hydrogen deflagration/detonation.

The pressure transient caused by a hydrogen deflagration/detonation in the PSB is contained by the construction of the TSV, TOGS, dump tank, and associated piping that constitutes the PSB.

The integrity of the PSB is maintained. The potential damage is limited plastic deformation of components of the PSB or internal to the PSB. The fission product inventory and associated fission gases are contained within the PSB, thereby resulting in no consequences to the workers or the public.

Safety Controls The following safety-related SSCs have been designed to prevent damage to the PSB in the event of hydrogen detonation or deflagration:

• The integrity of the PSB which has been designed to withstand credible hydrogen detonation or deflagration events (SR).

• Hydrogen detection in the TOGS (SR).

• TRPS trip on high hydrogen concentrations in the PSB (SR).

SHINE Medical Technologies 13a2-56 Rev. 1

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis 13a2.2.10 UNINTENDED EXOTHERMIC CHEMICAL REACTIONS OTHER THAN DETONATION As discussed in Subsection 13a2.1.10, because there is no potential for an unintended exothermic chemical reaction within the IF, there are no consequences to address. The potential for a hydrogen detonation is addressed in Subsection 13a2.1.9. Thus, there are no consequences to the workers or the public.

Safety Controls Because there is no potential for an unintended exothermic chemical reaction within the IF, there are no required safety controls to prevent or mitigate the event.

13a2.2.11 PRIMARY SYSTEM BOUNDARY SYSTEM INTERACTION EVENTS As discussed in Subsection 13a2.1.11, no releases are expected to occur as a result of PSB interaction events. Thus, there are no consequences to workers or the public.

Safety Controls The following safety-related SSCs and Technical Specifications prevent or mitigate the effects of PSB interaction events:

• TSV dump tank valves (SR).

• UPSS (SR).

• TOGS blower (SR).

• TOGS recombiner beds (SR).

• PVVS blower (SR).

• Light water pool (SR).

• IU cell integrity (SR).

• TOGS cell integrity (SR).

• IF wall (SR).

• NGRS backflow protection (SR).

• Target solution uranium enrichment (Technical Specifications).

• Target solution uranium concentration (Technical Specifications).

13a2.2.12 FACILITY-SPECIFIC EVENTS 13a2.2.12.1 Inadvertent Exposure to Neutrons from the Neutron Driver IU cell biological shielding and neutron driver/access door interlock prevent inadvertent exposure to neutrons (see Subsection 13a2.1.12.1). Thus, there are no consequences to workers or the public.

SHINE Medical Technologies 13a2-57 Rev. 1

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis Safety Controls The following safety-related SSCs and Technical Specification administrative controls prevent an inadvertent exposure to neutrons from the accelerator:

• IU cell walls and shield plug, biological shield (SR).

• Light water pool (SR).

• Neutron driver personnel access door interlock (SR).

• Use of accelerator audible/visual warnings (TS Administrative Control).

• Accelerator key switch to prevent the activation of the accelerator while personnel are present (SR).

• Accelerator local kill switch (SR).

• Accelerator manual shut-off switch (SR).

13a2.2.12.2 Irradiation Facility Fire Event Analysis of the IF fire contained in Subsection 13a2.1.12.2 identified four initiating events:

• A malfunction of equipment that results in the ignition of a fire.

• Loss of combustible and ignition control.

• Hydrogen release from the TPS.

• The spread of a fire from outside of the IF.

The effects of the fires resulting from these IEs are considered to be contained within the IF, with no impact other than fire damage internal to the IF. Fires within the cells of the IF are contained within their respective cells. The FFPS detects fires within the IF and initiates isolation of the fire area. Combustible loading within the IF areas containing radiological materials is limited to reduce the consequences of a fire. Detonation and deflagration within the PSB are addressed in Subsection 13a2.2.9.

Safety Controls The following safety-related SSCs and Technical Specification administrative controls have been designed to prevent or mitigate the effects of fire within the IF:

• TPS robust design (SR).

• TPS confinement boundary (SR).

• Limited combustible loading within the IU cells, the TOGS shielded cells, and the TPS room (TS Administrative Control).

• Limited tritium inventory based on TPS fixed glovebox volume (TS Administrative Control).

• IF boundary (FA-2) and components (e.g., doors, penetration seals, dampers)

(Fire-rated).

• Deuterium source vessel integrity program (TS Administrative Control).

Therefore, there is no need to further analyze consequences of fires within the IF.

SHINE Medical Technologies 13a2-58 Rev. 1

[Security-Related Information - Withhold Under 10 CFR 2.390]

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis 13a2.2.12.3 Tritium Purification System (TPS) Design Basis Accident This section contains the follow-on evaluation for the loss of TPS integrity (e.g., a break of the TPS piping that releases the entire tritium inventory of the neutron drivers [ Security-Related Information ].

13a2.2.12.3.1 Initiating Event In this scenario, a malfunction or external event occurs that releases the tritium from eight neutron drivers.

13a2.2.12.3.2 Sequence of Events The sequence of events for the postulated scenario is as follows:

a) A release of the tritium in the neutron driver system directly to the irradiation unit cell.

b) A high radiation signal (e.g., loss of vacuum in TPS piping) or other actuation signal activates the bubble-tight isolation dampers after approximately one percent of the material is released to the RVZ1, and actuates isolation of tritium supply and return piping.

c) The airborne activity is filtered prior to being released to the environment through the RVZ1 system until the bubble-tight dampers are closed.

d) Alarms are available locally or in the control room to notify facility personnel of radiation leakage due to loss of TPS integrity.

e) Facility personnel evacuate the immediate area upon actuation of the radiation area monitor alarms.

13a2.2.12.3.3 Damage to Equipment The postulated scenario is initiated from damage or degradation to the tritium piping on the neutron drivers. The effects of the piping damage are contained within the IU cell.

13a2.2.12.3.4 Quantitative Evaluation of Accident Evolution The airborne release fraction for tritium in the TPS is 1.0. Once the tritium has been released to the IU cell it becomes mixed with the atmosphere inside the cell.

The RVZ1 exhaust is equipped with HEPA and charcoal filters with assumed efficiencies of 99 percent for particulates and 95 percent for halogens, respectively, although not credited for any tritium removal. The isolation dampers are of a fail-safe design, and close on high radiation or other actuation signal within the IU shielded cell or on a loss of power. The total release to RVZ1 through the bubble-tight isolation dampers during the accident is assumed to be no more than one (1) percent of the airborne activity in the IU cell based on design characteristics of the dampers and the response of the actuating system.

SHINE Medical Technologies 13a2-59 Rev. 1

[Security-Related Information - Withhold Under 10 CFR 2.390]

Chapter 13 - Accident Analysis Irradiation Facility Accident Analysis Each IU cell is constructed of reinforced concrete walls and ceiling thick enough to contain the released material, provide shielding, and isolate the effects of the rupture or leakage from the other areas of the IF. Due to the decay mode and energy of tritium, the released tritium that stays within the IU cell does not affect workers outside the IU cell. While the confinement features of the IU cell would significantly reduce dose to workers, no reduction due to confinement features was assumed in this analysis.

13a2.2.12.3.5 Radiation Source Term Analysis The source term for this scenario is the tritium inventory of the eight neutron drivers,

[ Security-Related Information ] grams.

13a2.2.12.3.6 Radiological Consequence Analysis The only postulated credible release from the TPS is a break in the tritium piping on the neutron driver. Dose consequence analysis has been performed for a [ Security-Related Information ] g release of tritium. The resulting TEDE for workers is 2.4 rem. The TEDE to a member of the public for this event is 5.6E-04 rem at the site boundary. The resulting off-site doses are within the 0.1 rem TEDE regulatory limit specified in 10 CFR 20.1301, and on-site doses are within the 5 rem TEDE regulatory limit specified in 10 CFR 20.1201.

13a2.2.12.3.7 Safety Controls Safety-related SSCs and Technical Specification administrative controls to prevent or mitigate a TPS malfunction include:

• Robust TPS construction and confinement provided by the glovebox and double-wall pipe (SR).

• TPS confinement system (relief valves or rupture discs, monitoring instrumentation, isolation valves) (SR).

• Fire detection (SR).

• Engineered transport enclosures or containers (TS Administrative Control).

• RVZ1, isolation bubble-tight dampers (SR).

• RAMs high radiation signal (SR).

• TPS system sampling, inspection, testing and operating procedures (TS Administrative Control).

SHINE Medical Technologies 13a2-60 Rev. 1

Chapter 13 - Accident Analysis Summary and Conclusions 13a3

SUMMARY

AND CONCLUSIONS This section presents the summary and conclusions for the accident analysis for the IF.

The following accident categories were addressed for the irradiation facility:

• Maximum hypothetical accident (MHA).

• Excess reactivity insertion.

• Reduction in cooling events.

• Mishandling or malfunction of target solution.

• Loss of off-site power.

• External events.

• Mishandling or malfunction of equipment affecting the PSB.

• Large undamped power oscillations.

• Detonation or deflagration in the PSB.

• Unintended exothermic chemical reactions other than detonation.

• PSB system interaction events.

• Facility-specific events.

For the consequences of the bounding accident scenarios evaluated for each category, see Table 13a3-1. The consequences of the evaluated bounding accident scenarios are below the limits in 10 CFR 20.

SHINE Medical Technologies 13a3-1 Rev. 1

Chapter 13 - Accident Analysis Summary and Conclusions Table 13a3-1 Potential Consequences of Postulated Accidents in the Irradiation Facility Dose Consequences (rem TEDE)

General Public Accident Category (Limit = 0.1 rem) Worker (Bounding Scenario) Site Boundary Nearest Resident (Limit = 5.0 rem)

Postulated Maximum Hypothetical Accident 1.65E-02 2.30E-03 3.06E+00 (Target solution release into the IU cell)

Excess Reactivity Insertion (No consequences)

Reduction in Cooling (No consequences)

Mishandling or Malfunction of Target Solution 2.19E-03 3.06E-04 1.50 (Dump tank leak into an IU cell)

Loss of Off-Site Power (LOOP) (No consequences)

External Events (No consequences)

Mishandling or Malfunction of Equipment Affecting the PSB 1.59E-02 2.23E-03 1.87 Large Undamped Power Oscillations (No consequences)

Detonation and Deflagration in PSB (No consequences)

Unintended Exothermic Chemical Reactions other than (No consequences)

Detonation Primary System Boundary System Interaction Events (No consequences)

Facility-Specific Events (1) Inadvertent Exposure to Neutrons from the Neutron Driver (No consequences)

(2) Irradiation Facility Fire Event (3) Tritium Purification System DBA 5.6E-04 8.0E-05 2.4 SHINE Medical Technologies 13a3-2 Rev. 1

Chapter 13 - Accident Analysis References 13a4 REFERENCES ANS, 2007. The Development of Technical Specifications for Research Reactors, ANSI/ANS-15.1-2007, American Nuclear Society, April 2007.

Barbry, 2007. French CEA Experience on Homogeneous Aqueous Solution Nuclear Reactors, Francis Barbry, Commissariat a l Energie Atomique CEA/France, June 2007.

BNL, 2010. Aqueous Homogenous Reactor Technical Panel Report, BNL-94462-2010, Brookhaven National Laboratory, December 10, 2010.

Glasstone, 1981. Nuclear Reactor Engineering, ISBN 0-89464-567-6 (3rd edition), Samuel Glasstone and Alexander Sesonske, Krieger Publishing Company, Malabar, Florida 32950, 1981.

IAEA, 2008. Homogeneous Aqueous Solution Nuclear Reactors for the Production of Mo-99 and other Short Lived Radioisotopes, IAEA-TECDOC-1601, International Atomic Energy Agency, September 2008.

SHINE Medical Technologies 13a4-1 Rev. 0

[Proprietary Information - Withhold from public disclosure under 10 CFR 2.390(a)(4)]

[Security-Related Information - Withhold Under 10 CFR 2.390]

Radioisotope Production Facility Accident Chapter 13 - Accident Analysis Analysis Methodology 13b RADIOISOTOPE PRODUCTION FACILITY ACCIDENT ANALYSES 13b.1 RADIOISOTOPE PRODUCTION FACILITY ACCIDENT ANALYSIS METHODOLOGY 13b.1.1 PROCESSES CONDUCTED OUTSIDE OF THE IRRADIATION FACILITY The production of Mo-99 and other fission products occurs in the TSV. After the irradiation of the TSV solution is completed, the fluid is processed for radioisotope extraction and purification outside the IF. Other processes occurring outside the IF are target solution cleanup (UREX),

waste processing, and product packaging. The processes that occur outside the IF were evaluated through an ISA Summary and HAZOPS. IEs and scenarios identified in the ISA Summary for the RPF fall into the following categories:

• Operations with SNM

- Irradiated target solution processed for radioisotope extraction

- Irradiated target solution processed for reuse or for waste disposal

- Operations with unirradiated SNM

• Radiochemical operations

• Operations with hazardous chemicals Two types of hazard assessment methods were selected to evaluate the hazards of the facility.

These methods are a HAZOPS and a preliminary hazard analysis (PHA). A HAZOPS focuses on the evaluation of potential process upsets or deviations, which leads to identification of potential IEs and scenarios of concern which serve as input to the PHA and the identification of process controls. The PHA focuses on evaluating facility and external events that are common to the IF and RPF.

The systems selected for further evaluation in this section are categorized as follows:

The operations involving SNM include the target solution preparation system (TSPS), the molybdenum extraction and purification system (MEPS), the uranyl nitrate conversion system (UNCS) (including uranyl nitrate conversion, the target solution cleanup system [UREX], and the thermal denitration system [TDN]).

The MEPS removes the molybdenum from the irradiated target solution and purifies the resulting product. The extraction part of this system is categorized as irradiated target solution processed for radioisotope extraction, and contains significant quantities of uranium. Because of the presence of uranium, the MEPS process has the potential for a criticality. In addition, this process has radiological and chemical exposure hazards. The fission product inventory increases the consequence of a radiological exposure. The purification portion of MEPS is considered a radiochemical operation, but poses little hazard since this process deals with small quantities similar to that of a laboratory scale.

The TSPS is classified as an operation with unirradiated SNM and poses a criticality, radiological, and chemical hazard since it deals with approximately [ Proprietary Information ][ Security-Related Information ] of uranium per batch of target solution.

SHINE Medical Technologies 13b-1 Rev. 0

[Proprietary Information - Withhold from public disclosure under 10 CFR 2.390(a)(4)]

[Security-Related Information - Withhold Under 10 CFR 2.390]

Radioisotope Production Facility Accident Chapter 13 - Accident Analysis Analysis Methodology The uranyl nitrate conversion and the UREX are categorized as operations of irradiated target solution processed for reuse or waste disposal. The uranyl nitrate conversion step processes

[ Proprietary Information ][ Security-Related Information ] of uranium per batch of target solution, as does the UREX process. Therefore, the uranyl nitrate conversion process and UREX process pose a criticality, radiological, and chemical hazard.

The TDN is categorized as irradiated target solution processed for reuse or waste disposal. This process has a significant uranium inventory, so it also has the potential for a criticality event, as well as a radiological and hazardous chemical exposure. However, in this stage of the process, the radioactive fission product inventory is not as large as that of MEPS.

The remaining process, the process vessel vent system (PVVS), is also classified as a radiochemical operation. This process contains low concentrations of hazardous chemicals and small quantities of radionuclides.

SHINE Medical Technologies 13b-2 Rev. 0

Radioisotope Production Facility Accident Chapter 13 - Accident Analysis Analysis Methodology 13b.1.2 ACCIDENT INITIATING EVENTS The purpose of this section is to identify the postulated IEs and credible accidents that form the design basis for the RPF. The DBAs identified in Section 13b.2.1 range from anticipated events, such as a malfunction of equipment, to a postulated MHA that exceeds the radiological consequences of any accident considered to be credible. The MHA is intended to establish bounding consequences and need not be credible.

The bases for the identification of DBAs and their IEs and associated accident scenarios were:

• HAZOPS and PHA within the ISA Summary in accordance with NUREG-1520.

• List of IEs and accidents identified in the Final ISG Augmenting NUREG-1537.

• Experience of the hazard analysis team.

• Current preliminary design for the processes and facility.

The DBAs that have been identified for potential significant radiological consequences in the RPF include the following:

• MHA

• External Events

• Critical Equipment Malfunction

• RPF Fire

• Chemical Accidents These DBAs encompass LOOP and operator errors. Qualitative evaluations were performed on the above DBAs to further identify the bounding or limiting accidents and scenarios that could result in the highest potential consequences. These evaluations are based on review of identification of causes, the initial conditions, and assumptions for each accident.

SHINE Medical Technologies 13b-3 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences 13b.2 ANALYSES OF ACCIDENTS WITH RADIOLOGICAL CONSEQUENCES This section analyzes the RPF accidents with radiological consequences. Each defined accident does not necessarily lead to a release of radioactivity; therefore, consequences for those events are not applicable. For the accidents analyzed, further detail (e.g., uncertainties, margins of safety, detailed discussions of the computer codes used, code validating for the applications, etc.) will be provided in the FSAR.

13b.2.1 MAXIMUM HYPOTHETICAL ACCIDENT IN THE RPF Section 13a2.1.1 identifies a release of inventory stored in the NGRS storage tanks as the postulated MHA scenario for the RPF resulting in a maximum release of radiological material to the workers and individual members of the public. The event occurs within the confinement of the noble gas storage area, located in the RPF. This subsection discusses the detailed evaluation of the effects of the MHA event in the RPF including safety design features to mitigate the consequences of the MHA. A discussion of the effects of an MHA considered in the IF is presented in Subsection 13a2.2.1.

The RPF includes the MEPS, UNCS (including uranium extraction [UREX] and thermal denitration), and waste processing systems. These include the molybdenum extraction cells, the purification cells, UREX process cell, thermal denitration area, and waste processing areas. A supercell is comprised of a molybdenum extraction cell, purification cell, and packaging cell that form one structure. The RPF contains three supercells.

The MHA postulated for the RPF is a release of the inventory stored in the NGRS storage tanks.

This event occurs within the confinement of the noble gas storage cell. The radionuclide inventory released from the NGRS storage tanks represents the bounding source term for any other postulated accident in the RPF.

13b.2.1.1 Initial Conditions and Assumptions The purpose of the NGRS is to collect and store the radioactive gases from the TOGS and monitor the gases until the short-lived radioisotopes decay, prior to release. The NGRS consists of two gas compressors, five noble gas storage tanks, a condensate knock-out tank, and radiation monitoring instrumentation. Hydrogen is also present, and the TOGS catalytic recombiner ensures the hydrogen concentration is below the LFL prior to gas transfer to NGRS (see Section 9b.6.2). The noble gas storage cell is located in the RPF.

The initial conditions and assumptions of the SSCs at the time of the accident or that may be affected by the release of the inventory stored in the NGRS storage tanks into the noble gas storage cell are as follows:

• The largest source term inventory for a radioactive release in the RPF is the contents of the five noble gas storage tanks.

• Penetrations for piping, ducts and electrical cables, and access doors are sealed to limit the release of radioactive materials from noble gas storage cell into the RPF.

• Piping that penetrates the NGRS storage cell boundary and the RPF is isolable by means of redundant, automatic isolation valves or by dual, normally-closed manual valves.

• The RVZ1 is equipped with multi-filter housing units containing 2-stage HEPA filtration and single stage carbon adsorbers (see Subsection 9a.2.1).

SHINE Medical Technologies 13b-4 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences

• Bubble-tight isolation dampers (normally open/fail closed) are installed at the RVZ1 noble gas storage cell boundary penetrations for both supply and exhaust, and isolate the cell on high radiation indication.

• Radionuclides are distributed instantaneously and homogeneously throughout the cell during the accident.

The five noble gas storage tanks are located in a shielded storage cell. The cell is designed with thick concrete walls and ceiling that prevent any generated missile from a ruptured storage tank from breaching the cell. Therefore, events representing the release of inventory directly into the RPF from the noble gas storage cell are not credible.

13b.2.1.2 Identification of Initiating Events and Causes The MHA in the RPF is postulated to be a loss of the NGRS pressure boundary resulting in a release of inventory of the five noble gas storage tanks inside the robustly designed noble gas storage cell. While it is expected that only one tank contents could be released, the five tanks are postulated to rupture for conservatism. It is also assumed that these five tanks are full at time of rupture. Because the noble gas storage cell is designed as a robust structure to provide shielding and confinement, the release of noble gas is confined to the storage cell.

13b.2.1.3 Sequence of Events The sequence of events that occur for the postulated MHA in the RPF is:

1. The five noble gas tanks rupture simultaneously releasing the contents instantly to the noble gas storage cell.

2. The NGRS is at its maximum inventory of noble gas source term at the time of the event.

3. Redundant bubble-tight isolation dampers isolate the intake and exhaust ventilation penetrations for the noble gas storage cell on high radiation indication.

4. Operators are notified in the control room of an incursion of excess radiation levels in the noble gas storage cell. Operators ensure processes in the IF and RPF are in a stable condition.

5. Radiation alarms are available locally and in the control room to notify facility personnel of any radiation leakage. Workers evacuate the affected area.

6. High radiation levels detected in the RPF cause isolation of RVZ2.

13b.2.1.4 Damage to Equipment The effects of the MHA on other SSCs are contained within the robustly designed noble gas storage cell. Damage to equipment inside the noble gas storage cell could include:

• NGRS interconnecting piping.

• PVVS interconnecting piping.

• Noble gas storage cell fire detection and suppression.

• Instrumentation.

Excess contamination of the RVZ1 system may also occur. The noble gas storage cell is robustly designed to resist over-pressurization events of noble gas storage tanks. The noble gas storage cell structure is equipped with fail-safe bubble-tight isolation dampers on both the intake and exhaust lines and provides sufficient holdup of radionuclides for decay.

SHINE Medical Technologies 13b-5 Rev. 0

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences 13b.2.1.5 Quantitative Evaluation of Accident Evolution In accordance with the Final ISG Augmenting NUREG-1537 guidance on MHA, the initiating event, failure of the five NGRS storage tanks, is assumed without any quantitative evaluation.

The NGRS is at its maximum inventory of noble gas source term in the five tanks at the time of the event. The complete inventory is released into the noble gas storage cell and is instantaneously and homogeneously distributed throughout the cell.

Redundant bubble-tight isolation dampers isolate the intake and exhaust ventilation penetrations for the noble gas storage cell on high radiation indication. It is assumed that 10 percent of the activity released to the cell enters the RVZ1. This assumption includes the inventory that escapes confinement prior to full bubble-tight damper closure and accounts for inventory that may leak past the bubble-tight damper after closure. The ten percent inventory leakage assumption is conservative for several reasons: 1) the bubble-tight dampers are designed to rapidly close and ensure that the intake and exhaust ducts are quickly isolated, 2) the dampers are designed to automatically isolate on a high radiation signal limiting the total loss of inventory,

3) each cell served by RVZ1 has redundant bubble-tight dampers on the inlet and outlet ventilation path 3 and 4) dampers are designed to withstand environmental conditions encountered. Since the bubble-tight dampers rapidly close on a high radiation signal or loss of power, the total amount of inventory initially released through the RVZ1 is small.

Ten percent of the activity released to the cell enters the RCA. Radiation alarms are available locally and in the control room to notify facility personnel of any radiation leakage. Workers evacuate the affected area in ten minutes. The 10 minute evacuation time is a conservative assumption. Workers in the RPF and IF are trained to immediately evacuate the area in response to a high radiation alarm or CAAS alarm. Radiological dose consequence evaluations performed show that worker doses are within regulatory limits. Additional detailed radiological dose consequence modeling and analysis will be performed for certain areas of the facility to increase the evacuation time. The results of this analysis will be described in the FSAR.

RVZ2 is equipped with redundant isolation dampers that actuate on high radiation in the RPF to limit the release of radiological materials to the environment.

13b.2.1.6 Radiation Source Term Analysis As discussed in Subsection 13a2.1.1, a complete release of inventory of the NGRS would produce the maximum release of radiological material for the RPF. The background inventory is based on previous TOGS sent to the NGRS. It is conservatively assumed that the five noble gas tanks are filled to their capacity. Each of the eight TOGS are purged approximately every six days with corresponding decay of prior TOGS purged inventories.

For the MHA, the factors used to calculate the source term are: the material at risk (MAR), the damage ratio (DR), the leak path factor (LPF), the airborne release fraction (ARF), and for the respiratory source term, the respiratory fraction (RF). The MAR is the amount of a radionuclide acted upon by a given physical stress. The DR is the fraction of the MAR actually impacted by the accident-generated conditions. The LPF is the fraction of the radiological material made airborne that leaves the facility to the ambient environment.

SHINE Medical Technologies 13b-6 Rev. 0

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences

• For noble gases, the ARF and RF are 1.0.

• The LPF for the bubble-tight isolation dampers in the RVZ1 is 10 percent.

• All material is assumed to be involved in the MHA. Therefore, the DR is 1.0.

The source term for the noble gas storage tanks is shown in Table 13b.2.1-1.

13b.2.1.7 Radiological Consequence Analysis The MHA scenario assumes that MAR from the noble gas storage tanks is released and largely contained within the NGRS storage cell. A fraction of the MAR is released through the RVZ1 pathway through the RVZ1 exhaust filter housings and out of the facility stack to the environment. The RVZ1 bubble-tight isolation dampers close on detection of high radiation and limit the total quantity of the MAR released to the environment.

The radiological dose consequence analysis is performed using the MAR source term described above. The TEDE to the workers and to an individual member of the public is calculated by determining the radiological dose due to internal and external radiation. The radionuclides deposited in the body produce an internal dose known as the committed effective dose equivalent (CEDE). The external dose equivalent (EDE) is due to radionuclides in the atmosphere that irradiate individuals, which consists of immersion and exposure to contaminated surfaces. These are summed over all radionuclide source term groups to determine the TEDE.

The factors used to determine the internal and external doses are the dose conversion factors (DCF), breathing rate (BR), building volume (BV), and dispersion value (DV).

The DCFs are used to convert activity inhaled to an internal dose, convert an exposure to an external activity from immersion in air into an external dose, and convert an external activity due to exposure to a contaminated area into an external dose. The BR is the volume rate of air inhaled by a reference person. The BV is the free volume within the enclosed building to determine dose due to immersion.

The input values used to determine the radiological dose due to internal and external radiation are listed in Table 13b.2.1-2.

For the bounding TEDE for the RPF MHA scenario, the resulting dose consequence of this event is calculated to result in a TEDE to the workers of 3.59 rem. This dose represents the maximum release rate to workers with regards to the MHA scenario for the RPF. The TEDE to a member of the public for the MHA in the RPF is 0.0820 rem (site boundary) and 0.0115 rem (nearest resident). This represents maximum dose consequence to a member of the public resulting from the MHA scenario for the RPF. These doses for workers and individual members of the public are within the regulatory limits specified in 10 CFR 20.1201 and 10 CFR 20.1301.

SHINE Medical Technologies 13b-7 Rev. 0

[Proprietary Information - Withhold from public disclosure under 10 CFR 2.390(a)(4)]

[Security-Related Information - Withhold Under 10 CFR 2.390]

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences Table 13b.2.1-1 Source Terms for NGRS Storage Tanks Noble Gas Radioisotope Source Term (Ci)

[ Proprietary Information ]

Kr-85m [ Security-Related Information ]

[ Proprietary Information ]

Kr-87 [ Security-Related Information ]

[ Proprietary Information ]

Kr-88 [ Security-Related Information ]

[ Proprietary Information ]

Xe-133 [ Security-Related Information ]

[ Proprietary Information ]

Xe-133m

[ Security-Related Information ]

[ Proprietary Information ]

Xe-135

[ Security-Related Information ]

SHINE Medical Technologies 13b-8 Rev. 0

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences Table 13b.2.1-2 Parameters Used in the Dose Consequence Assessment Parameter Assumed Value Damage Ratio, DR 1.0 Leakpath Factor, LPF See Table 13b.2.1-3 HEPA Filter Particulate Removal Efficiency 0.99 Carbon Adsorber Iodine Removal Efficiency 0.95 Airborne Release Fractions, ARF See Table 13b.2.1-4 Respirable Fractions, RF See Table 13b.2.1-4 Dose Conversion Factors, DCF ICRP-30 FGR-12 Breathing Rate, BR (light activity) 3.5E-04 m3/s Dispersion Value at the Site Boundary, DV 3.88E-4 s/m3 (50th percentile value)

Dispersion Value for Nearest Residence, DV 5.43E-5 s/m3 (50th percentile value)

Building Volume (75% free of obstructions) 35,296 m3 Worker Exposure Time 10 minutes(a) a) The 10 minute evacuation time is a conservative assumption. Workers in the RPF and IF are trained to immediately evacuate the area in response to a high radiation alarm or CAAS alarm. Radiological dose consequence evaluations performed show that worker doses are within regulatory limits. Additional detailed radiological dose consequence modeling and analysis will be performed for certain areas of the facility to increase the evacuation time. The results of this analysis will be described in the FSAR.

SHINE Medical Technologies 13b-9 Rev. 0

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences Table 13b.2.1-3 Public and Worker LPF for each DBA Event Material Public LPF Worker LPF Particulates NP(a)

MHA (Release of Inventory Stored in NGRS Storage Tanks) Halogens NP(a)

Noble Gas 0.1 0.1 (a)

Particulates NP Critical Equipment Malfunction (Inadvertent Release from NGRS) Halogens NP(a)

Noble Gas 0.1 0.1 Particulates 0.0001 0.025 Critical Equipment Malfunction (Loss of Halogens 0.0005 0.025 Piping or Tank Integrity)

Noble Gas 0.01 0.025 Particulates 0.001 0.1 RPF Fire Halogens 0.005 0.1 Noble Gas 0.1 0.1 a) NP = Not Present in significant quantity (would contribute to less than one percent in dose) because of zeolite/filter decay SHINE Medical Technologies 13b-10 Rev. 0

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences Table 13b.2.1-4 Airborne Release and Respirable Fractions for each DBA Event Material ARF RF Particulates NP(a)

MHA (Release of Inventory Stored in NGRS Storage Tanks)

Halogens NP(a)

Noble Gas 1.0 1.0 Particulates NP(a)

Critical Equipment Malfunction (Inadvertent Release from NGRS)

Halogens NP(a)

Noble Gas 1.0 1.0 Particulates 0.0001 1.0 Critical Equipment Malfunction Halogens 0.05 1.0 (Loss of Piping or Tank Integrity)

Noble Gas 0.1 1.0 Particulates 0.002 1.0 RPF Fire Halogens 0.05 1.0 Noble Gas 0.1 1.0 a) NP = Not Present in significant quantity SHINE Medical Technologies 13b-11 Rev. 0

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences 13b.2.2 LOSS OF CONTAINMENT As discussed in Sections 6a2.2 and 6b.2.2, the SHINE facility does not employ a containment feature. The use of confinements as an ESF in the RPF is described in Section 6b.2.1. Control of the target solution is performed by piping systems and tanks. A loss of the integrity of piping systems or tanks containing target solution within the RPF is addressed in Subsection 13b.2.4.

SHINE Medical Technologies 13b-12 Rev. 0

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences 13b.2.3 EXTERNAL EVENTS The following potential external events have been identified as DBAs for the SHINE facility:

• Seismic event affecting the IF and RPF (see Section 3.4).

• Tornado or high-winds affecting the IF and RPF (see Section 3.2).

• Small aircraft crash into the IF or RPF (see Subsection 3.4.5).

Plant SSCs, including their foundations and supports, that are designed to remain functional in the event of a design basis earthquake (DBEQ) are designated as Seismic Category I, as indicated in Table 3.5-1. SSCs designated SR are classified as Seismic Category I. SSCs whose failure as a result of a DBEQ could impact an SSC designated as SR are classified as Seismic Category I. SSCs that must maintain structural integrity post-DBEQ, but are not required to remain functional are Seismic Category II.

Seismic Category I SSCs are analyzed under the loading conditions of the DBEQ and consider margins of safety appropriate for that earthquake. The margin of safety provided for safety class SSCs for the DBEQ are sufficient to ensure that their design functions are not jeopardized. For further details of seismic design criteria refer to Section 3.4.

The SHINE production facility building is designed to survive credible wind and tornado loads, including missiles, as described in Section 3.2 and Subsection 3.4.2.6. It is also designed to withstand credible aircraft impacts as discussed in Subsection 3.4.5.

The facility is designed to withstand credible external events as described in 13a2.1.6. Thus, there are no consequences to the workers or the public from external events.

Safety Controls The essential systems that are required to function during an external event are the Seismic Category I SSCs (SR).

SHINE Medical Technologies 13b-13 Rev. 1

[Proprietary Information - Withhold from public disclosure under 10 CFR 2.390(a)(4)]

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences 13b.2.4 CRITICAL EQUIPMENT MALFUNCTION This section presents the evaluation of a malfunction or mishandling of equipment (including vessel/line/valve failures, valve misalignments, and other process equipment failures) that leads to a loss of control of radiological material within the RPF.

Processes conducted within the RPF include the target solution preparation, molybdenum extraction, molybdenum purification, molybdenum packaging, uranyl nitrate conversion, target solution cleanup (UREX), thermal denitration, waste processing, noble gas decay storage, and process vessel vent gas treatment. Most of the associated process piping, vessels, and components are located within hot cells or other enclosures. However, transfer between the major processes is via transfer piping located along pipe trenches in the RPF. The liquid/aqueous radiological process streams that traverse the RPF are the target solution, uranyl nitrate solution, and UREX raffinate. Gaseous transfer lines are also present to transfer off gases from the IF to the NGRS for decay storage. Other process streams exist; however, the above processes represent the greatest radiological risk. Equipment malfunctions including a loss of integrity of these solution and gas lines presents the possibility of a radiological release at various locations in the RPF.

The molybdenum extraction, purification, and packaging takes place within the three separate sections of a hot cell referred to as a supercell. There are three supercells within the RPF that are operated in parallel, but independently, to process separate batches of irradiated target solution to extract, purify, and package the molybdenum product. The liquid and solid waste processing, pumping equipment, and storage tanks are located in hot cells and vaults located within the RPF.

The NGRS equipment is located within a separate shielded cell within the RPF.

This section addresses the potential for an inadvertent release of radiological material along the transfer lines throughout the RPF and within process hot cells and shielded cells due to a malfunction of critical equipment.

Loss of the PSB located in the irradiation operations area is not considered in this section. The potential for this accident is addressed in Subsections 13a2.1.4 and 13a2.1.7.

13b.2.4.1 Initial Conditions and Assumptions Major systems that handle aqueous/liquid process streams in the RPF include the molybdenum extraction and purification processing systems located in the supercells, UREX system, thermal denitration system, and associated piping and tanks. The irradiated target solution poses the greatest radiological hazard located in the RPF to the facility workers in the RCA. The NGRS poses the greatest radiological hazard for purposes of an off-site dose. The normal irradiation cycle for a batch of the target solution consists of a 5.5-day irradiation period within the TSV

[ Proprietary Information ]. The potential for a spill of irradiated target solution in the RPF subfloor trenches due to the failure of a transfer line or piping (including valves) directly from the TSV dump tank has also been considered. Following the decay time, the solution is processed through molybdenum extraction and purification processing systems located in the supercells to remove the molybdenum product.

SHINE Medical Technologies 13b-14 Rev. 0

[Proprietary Information - Withhold from public disclosure under 10 CFR 2.390(a)(4)]

[Security-Related Information - Withhold Under 10 CFR 2.390]

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences Following molybdenum extraction processing, the target solution is recycled for additional irradiation. Following [ Proprietary Information ] irradiation cycles, the solution is processed through the UREX system and thermal denitration process. The maximum activity of each batch of irradiated target solution while in the RPF is estimated to be approximately [ Proprietary Information ][ Security-Related Information ] based on a conservative [ Proprietary Information ]

cycles of irradiation.

Irradiated uranyl sulfate is processed through the UREX system for removal of waste materials and extraction of uranyl nitrate. This process generates a stream of uranyl nitrate and raffinate.

The uranyl nitrate solution is sent through the thermal denitration process to produce uranium oxide, which is stored in containers for later preparation of fresh target solution. This process results in waste off-gas which is processed through the process vessel vent system (PVVS).

Gaseous fission products from the IF are captured by the NGRS. The NGRS receives off-gases from the eight TOGS, compresses them into storage tanks, and holds them for the appropriate decay period. Gases are then processed through RVZ1.

The liquid waste system includes a liquid waste holding tank, a waste evaporation process, and a solidification process. The liquid waste treatment system takes inputs from several systems within the RPF, including some that also process the target solution. Process inputs to the liquid waste system include:

• Spent wash solutions from the molybdenum extraction column.

• [ Proprietary Information ].

• Rotary evaporator condensate from the molybdenum eluate rotary evaporator.

• Liquid waste from the MEPS acid waste collection bottle.

• [ Proprietary Information ] from the uranyl nitrate centrifuge.

• Raffinate from the UREX raffinate hold tank.

• Uranyl nitrate (UN) evaporator condensate from the UN evaporator vessel.

The NGRS collects TSV purge gases in storage tanks after each irradiation cycle is completed.

The NGRS storage tanks are located in a dedicated shielded cell, and they hold the purge gases in order to allow for adequate radioactive decay prior to release to the environment. The gases are sampled and verified to be within acceptable criteria prior to release.

Assumptions associated with the analysis of a critical equipment malfunction include:

• The target solution entering the RPF is conservatively assumed to have experienced no decay following shutdown of the neutron driver.

• Since operations carried out in one supercell are independent of processes in the other supercells, operations in the other supercells do not affect outcome of the event.

• The processing of the liquid waste in the evaporation hot cell and the solidification of that waste is also assumed to be a manual process performed by technicians in the respective hot cells using remote manipulators or remote controls as required.

• The solid radioactive waste packaging system consists of an area to store the spent

[ Proprietary Information ] columns and other equipment from the molybdenum extraction and purification processes, and other disposable radioactive materials such as filters.

Some of these materials are stored for specific minimum periods of time to allow for SHINE Medical Technologies 13b-15 Rev. 0

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences decay of short-lived isotopes, either in one of the hot cells or in the waste storage area.

• The RVZ1, RVZ2, and RVZ3 systems are normally operated in an automatic mode to maintain a negative pressure in the RPF with respect to the environment outside of the SHINE facility. Automatic isolation of the system occurs on either a loss of off-site power or on indication of a high radiation condition.

• Noble gases are received from the TOGS and stored in a bank of five noble gas storage tanks that are filled on a staggered basis. The noble gas storage tanks have enough capacity to store the generated noble gases for at least 40 days.

• NGRS noble gas storage tanks and associated equipment are located within a shielded cell with isolation and confinement capability.

The eight IUs are in operation for at least as long as required to fill the five noble gas storage tanks. The NGRS contains the TOGS contents for at least 40 days before they are discharged to RVZ1 and then, ultimately, to the stack.

13b.2.4.2 Identification of Causes Most processes covered by this evaluation are performed manually by RPF technicians. The manual nature of these operations makes human error a likely initiator for an event. Another potential cause is failure of the laboratory glassware used in the purification portion of the supercells. The glassware is replaced after every batch, but may possess a manufacturing flaw or sustain undetected damage during handling.

There are several process steps involved in the extraction of the molybdenum product and recycling of the target solution, which are performed in the RPF. A critical equipment malfunction due to human error or other failure in the RPF systems could result in a local liquid spill or release of stored fission product gases. For liquid spills, a vapor release would also be expected, especially for process streams with elevated temperatures. Processes in the RPF were reviewed for the potential of an error or failure that results in a radiological event. The following is a summary of that review:

Spills Inside of a Hot Cell Liquid or vapor releases from process equipment or piping inside a supercell, UREX hot cell, thermal denitration area, or one of the waste treatment hot cells would be contained by the physical design of these enclosures, and their drainage and ventilation systems. These releases could be caused by equipment failures and human errors such as valve or pump leaks/misalignments, contactor failures in UREX, column failures in MEPS, and corrosion.

Workers would be shielded from any direct gamma radiation by the hot cell biological shielding design. A spill of target solution in any of these cells would be directed to a drain or sump with a geometry that is criticality-safe. The area ventilation system would be shut down and isolated by bubble-tight dampers upon detection of excessive radiation to prevent release outside of the facility.

Radiological consequences to workers, the public, or the environment could result from a spill in one of the hot cells through the release of airborne radioactive material into the ventilation system (prior to the bubble-tight dampers isolating the cell) or penetrations into other portions of the RCA. Radiological spills within the hot cells are mitigated by facility and hot cell controls (such as sealed penetrations, detection of high radiation in RVZ1, and automatic actuation of SHINE Medical Technologies 13b-16 Rev. 2

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences isolation functions). Radiation exposures from these types of scenarios were evaluated and not considered to result in limiting consequences due to equipment malfunctions within the RPF.

Loss of Piping or Tank Integrity Process piping that traverses the RPF is contained in shielded subfloor trenches that are routed between the various hot cells and subfloor vessel vaults. Piping systems might fail for any one of several reasons, including corrosion, valve leaks or misalignments, assembly error following maintenance, or pressure buildup due to overheating or a blocked flowpath downstream of a positive displacement pump. Tanks are vented, so their failure would more likely be due to corrosion. Leakage from tanks or connecting piping would be confined to the tank vault or to the trench where the workers would be shielded by the vault or trench covers. Any release of airborne radioactivity would be limited by the seals around the shield blocks. If any airborne release in the tank vaults or pipe trenches did occur, the vault and trench covers would help confine the release; furthermore, the respective area ventilation system (i.e. RVZ2) would be isolated upon detection of excessive radiation to prevent release outside of the facility.

Radiological consequences to workers, the public, or the environment could result from a spill in the tank vaults or pipeway trenches through the release of airborne radioactive material through leakage in vault/trench penetrations and the ventilation system (prior to the bubble-tight dampers closing).

The most limiting scenario for these scenarios was determined to be a failure of the piping transporting solution from the IF to the supercell for isotope extraction. The piping failure is located within the pipe trenches. The TEDE to a member of the public for this event is 2.19E-03 rem at the site boundary and 3.06E-04 rem at the nearest resident. Worker doses were calculated to be approximately 3.58 rem. Worker consequences are considered to be very conservative since solution is being pumped at a very slow rate, but 25 percent of the target solution is assumed to immediately leak from the pipe and expose workers for 10 minutes. There is also no credit taken at this time for the 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> decay in the TSV dump tank. The trench, trench covers, and trench cover seals reduce the consequences from this event by containing 90 percent of the airborne activity. The 10 minute evacuation time is a conservative assumption.

Workers in the RPF and IF are trained to immediately evacuate the area in response to a high radiation alarm or CAAS alarm. Radiological dose consequence evaluations performed show that worker doses are within regulatory limits. Additional detailed radiological dose consequence modeling and analysis will be performed for certain areas of the facility to increase the evacuation time. The results of this analysis will be described in the FSAR.

Tank Overfill to Process Vessel Vent System There are several tanks, primarily those involved with the molybdenum separation, molybdenum purification, target solution preparation, and target solution cleanup processes, that are vented to the PVVS. The potential for process tank or vessel overflows by valve misalignments, blockages, or improper transfers could lead to spills of solution into the PVVS.

The most significant scenario of this type identified was the overflow of the Mo extraction feed tank during transfer from the IF to the supercell for isotope extraction. The overflow results in target solution being transferred through the Mo extraction feed tank vent into the PVVS. The release and potential consequences from this type of scenario is less than that from the spill in SHINE Medical Technologies 13b-17 Rev. 0

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences the pipe trench during the post-irradiation transfer from the IF into the RPF (described above),

and thus is not considered to be bounding for equipment malfunctions within the RPF. Even though this type of scenario is not bounding, the safety controls described in Section 13b2.4.8 are required to prevent and/or mitigate the consequences from this type of equipment malfunction.

Misdirection of Process Stream Flow An operator valving error could misdirect the process stream to an unintended location. The most likely locations to which a misdirected process stream could be sent are liquid waste treatment, the recycle target solution tank, and the uranyl nitrate conversion tank. These three locations are in shielded tank vaults that are designed to contain a liquid with at least some level of activity. It is unlikely that the RPF workers would be exposed to excessive direct radiation as a result of a misdirected process stream. Because these are closed systems, there is no significant risk of radiological consequences to the public or to the environment.

The releases and potential consequences from this type of scenario are not considered to be bounding for equipment malfunctions within the RPF. Even though this type of scenario is not bounding, the safety controls described in Section 13b2.4.8 are required to prevent and/or mitigate the consequences from this type of equipment malfunctions.

Inadvertent Release from NGRS As indicated previously, fission product gases from the TOGS are collected and decayed in the NGRS storage tanks located within the noble gas storage cell in the RPF. These fission products are collected and decayed for approximately 40 days before they are vented and diluted through the facility ventilation system. Safety interlocks ensure that the appropriate decay time has elapsed prior to venting. However, the potential exists for inadvertently releasing a tank containing recently transferred gases from the TOGS due to equipment malfunction, human errors, or loss of equipment integrity. A catastrophic failure leading to a large release of fission product gases from NGRS was identified as the MHA in Section 13b2.1.

The identified limiting scenario is the inadvertent release of the contents of the noble gas storage tanks due to a leak in an NGRS tank. Radiation releases and exposures from these types of scenarios were evaluated and considered to bound dose to the public for identified equipment malfunction scenarios in the RPF.

A malfunction (i.e. NGRS tank leak) occurs that releases the entire contents of one noble gas storage tank into the noble gas storage cell. It is conservatively assumed that the NGRS storage tank that experiences the leak is the tank currently receiving new TOGS purge volumes. Since these new purge volumes have decayed the least, they have greatest activity of the stored purge volumes. Furthermore, it is conservatively assumed that the NGRS storage tank that experiences the leak has just finished filling to capacity, again, resulting in the highest activity in the tank.

Since the inadvertent release of an NGRS storage tank has been identified as resulting in the bounding public dose for the equipment malfunction scenarios identified above, detailed evaluation of the accident progression, source terms, and dose estimates is provided in this section.

SHINE Medical Technologies 13b-18 Rev. 0

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences 13b.2.4.3 Sequence of Events The following sequence of events leads to inadvertent loss of stored gases from an NGRS storage tank:

• RCA ventilation and NGRS are operating normally prior to the event.

• The most recent transfer of the TOGS unit purge to NGRS, 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> post-shutdown, has just been completed prior to the leak developing.

• The NGRS storage tank under consideration is filled to its maximum allowed capacity with the most recent purge volumes.

• The NGRS storage tank develops a leak, resulting in transfer of radioactive gases to the noble gas storage cell.

• The radiation monitors in RVZ1 detect elevated radiation levels in the exhaust from the noble gas storage cell.

• RICS initiates isolation of the noble gas storage cell by closing the bubble-tight dampers upon radiation levels exceeding the isolation setpoint.

• The high radiation levels detected by the radiation monitors initiates an alarm.

Personnel evacuation from the RCA occurs within 10 minutes. The 10 minute evacuation time is a conservative assumption. Workers in the RPF and IF are trained to immediately evacuate the area in response to a high radiation alarm or CAAS alarm. Radiological dose consequence evaluations performed show that worker doses are within regulatory limits. Additional detailed radiological dose consequence modeling and analysis will be performed for certain areas of the facility to increase the evacuation time. The results of this analysis will be described in the FSAR.

13b.2.4.4 Damage to Equipment The only equipment damage involved in this event is that associated with the initiating event itself (e.g., equipment malfunction that led to the release of radioactive material). There is no consequential equipment damage associated with this event. The outcome of this event is elevated radiation levels in the areas around the NGRS storage room, RVZ1, and throughout the RCA. This event will likely result in equipment downtime to remove excess contamination and isolation of some of the affected areas to allow for decay of radioactive material before entry.

13b.2.4.5 Quantitative Evaluation of Accident Evolution The leak in the NGRS storage tank is assumed to occur as the initiating event. Once released, the gaseous fission products are assumed to mix with the noble gas storage cell atmosphere and a portion is transported into the RVZ1 exhaust.

RVZ1 exhaust system is equipped with HEPA and charcoal filters. The filter trains are present for the release but have no impact on a noble gas release.

The isolation dampers are of a fail-safe design, and close on high radiation within the noble gas storage cell or on a loss of power. The total release to RVZ1 through the bubble-tight isolation dampers during the accident is assumed to be no more than 10 percent of the airborne activity in the noble gas storage cell based on design characteristics of the dampers and the response of the RAMs.

SHINE Medical Technologies 13b-19 Rev. 0

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences Each noble gas storage cell is constructed of steel-reinforced concrete walls and a ceiling thick enough to contain the released material, provide shielding, and isolate the effects of the leakage from the surrounding SSCs. The shielding provides protection to workers from the radiological materials remaining in the noble gas storage cell. Therefore, the radioactive material within the cell was determined to have insignificant effects in comparison to the overall dose received by workers in the RCA by airborne radioactive material that leaves the noble gas storage cell. The total release to the RCA through the noble gas storage cell penetrations during the accident is assumed to be no more than 10 percent of the airborne activity in the cell based on design characteristics of the penetrations.

13b.2.4.6 Radiation Source Term Analysis It is conservatively assumed that the entire contents of one NGRS storage tank containing the most recent TOGS purge volumes is released due to a tank leak. The inventory from the most recent tank to be filled by noble gas is assumed to be released and the tank is assumed to have just completed the fill process.

It is assumed that the five noble gas tanks are filled to their capacity. Each of the eight TOGS are purged approximately every six days with corresponding decay of prior TOGS purged inventories.

13b.2.4.7 Radiological Consequences Analysis Ten percent of the activity in NGRS storage tank is assumed to be transported through RVZ1, and 10 percent is assumed to be released into the surrounding RCA environment through penetrations in the noble gas storage cell. A leak path factor calculation will be performed during the final design process to validate the release fractions and ensure that they are conservative.

Site boundary, nearest resident, and worker doses were calculated for this DBA. The radiological dose consequences for this DBA are calculated using the methods described in Subsection 13b.2.1 and the values in Table 13b.2.1-2.

The resulting TEDE for workers is 3.58 rem. The TEDE to a member of the public for this event is 8.17E-02 rem at the site boundary and 1.14E-02 rem for the nearest resident. Therefore, the resulting doses are below the regulatory limits specified in 10 CFR 20.1301and 10 CFR 20.1201.

13b.2.4.8 Safety Controls There are several safety controls that prevent or provide mitigation for the consequences of an inadvertent release from the NGRS and the other identified critical equipment malfunction scenarios. The following facility systems and components are identified as safety controls:

• Radiation area monitoring system (RAMS) (SR)

• Production facility biological shield (PFBS) system (including noble gas storage cell, hot cells, tank vaults, and pipe trenches) (SR)

• Noble gas removal system (NGRS) (SR)

• RVZ1 (including bubble-tight dampers for the noble gas storage cell and hot cells) and RVZ2 (SR)

• Radiological integrated control system (RICS) (SR)

• MEPS column pressure monitor (SR)

SHINE Medical Technologies 13b-20 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences

• Moisture-Leak Detection/Instrumentation and Alarm for tank overflow into PVVS (SR)

• Procurement and use of waste containers program (TS Administrative Control)

• Hydrogen monitor in NGRS (SR)

• Reverse flow indication and alarm for MEPS hot cell (SR)

• Criticality Safe Geometry Overflow- Part of Radioactive Drain System (SR)

• Raffinate hold tank level detection (SR)

• Piping and tank integrity (SR)

The RAMS are designed to alert both the control room operators and the facility staff in the RCA of abnormal radiation levels within the facility. The sensitivity of these radiation monitors will be set such that they will not alarm spuriously due to normal process variations but will be sensitive enough to alarm upon detection of upset conditions. The radiation monitoring components are relied upon to reduce the off-site dose consequences and to alert the facility staff. The RAMS is classified as a safety-related system.

The PFBS also mitigates the consequences of the postulated scenarios by providing a robust and passive barrier for retention of radioactive materials and providing shielding for facility workers. The PFBS is classified as a safety-related system.

The NGRS collects TOGS purge gases in storage tanks to allow for decay of noble gases released from the target solution during the irradiation cycle. The radiation level in the decayed gases is verified to be within acceptable criteria prior to release. The NGRS is classified as a safety-related system.

RVZ1 and RVZ2 provide confinement capabilities and filtration of halogens and particulates that may be released during postulated normal, abnormal, and accident conditions. The bubble-tight dampers isolate cells and ventilation zones when corresponding high radiation levels are detected. The bubble-tight isolation dampers reduce the off-site dose consequences for the postulated scenario. RVZ1 and RVZ2 are classified as safety-related systems.

RICS monitors parameters within the RPF and initiates the isolation functions necessary to achieve confinement, including closure of the bubble-tight dampers. The RICS is relied upon to reduce the off-site dose consequences and to alert the facility staff. RICS is classified as a safety-related system.

The MEPS column pressure monitor detects pressure increases from the positive displacement pump transferring solution from the TSV dump tank to prevent a spill.

The moisture-leak detection/instrumentation and alarm detects process tank overflows into the vent system which could allow a release pathway for fission products in a system designed for handling tank vapors.

The procurement and use of waste containers program ensures confinement for radioactive waste in the event of mishandling or other accidents.

Hydrogen monitors in the NGRS alert the operator to excessive hydrogen concentrations in this system so actions can be taken to prevent a hydrogen deflagration or detonation, preventing an inadvertent release from NGRS.

SHINE Medical Technologies 13b-21 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences The reverse flow indication and alarm for the MEPS hot cell alerts the operator to unanticipated transfer of target solution into the MEPS, resulting in a spill inside the hot cell. The alarm will allow the operator to secure the transfer and mitigate the spill.

The criticality-safe geometry overflow equipment (part of radioactive drain system) directs tank contents to the criticality-safe sump in the case of an inadvertent tank overflow to prevent excess liquid into inappropriate areas or systems like PVVS.

Raffinate hold tank level instrumentation prevents or mitigates a raffinate spill by alerting the operator of an overflow from the raffinate hold tank, preventing the transfer of fissile material to an unsafe geometry tank downstream.

A tank or piping failure is an initiating event to cause a release, but is unlikely due to the robust nature of tanks and piping containing radioactive materials.

SHINE Medical Technologies 13b-22 Rev. 1

[Proprietary Information - Withhold from public disclosure under 10 CFR 2.390(a)(4)]

[Security-Related Information - Withhold Under 10 CFR 2.390]

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences Table 13b.2.4-1 MAR for NGRS Storage Tank Nuclide Inventory (Ci)

Kr-85m [ Proprietary Information ]

[ Security-Related Information ]

Kr-87 [ Proprietary Information ]

[ Security-Related Information ]

Kr-88 [ Proprietary Information ]

[ Security-Related Information ]

Xe-133 [ Proprietary Information ]

[ Security-Related Information ]

Xe-133m [ Proprietary Information ]

[ Security-Related Information ]

Xe-135 [ Proprietary Information ]

[ Security-Related Information ]

SHINE Medical Technologies 13b-23 Rev. 0

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences 13b.2.5 INADVERTENT NUCLEAR CRITICALITY IN THE RADIOISOTOPE PRODUCTION FACILITY An accidental criticality is highly unlikely because the SHINE facility has been designed with passive engineering design features to prevent criticality, including the use of neutron absorbers, such as borated plastic. Additionally administrative controls and SR SSCs provide control on enrichments and target solution uranium concentration to further prevent inadvertent criticality.

Therefore this subsection identifies areas within the RPF where an inadvertent criticality is possible and discusses controls that are used to reduce the likelihood of an inadvertent criticality.

This section only considers processes in the RPF that involve SNM.

13b.2.5.1 Initial Conditions and Assumptions Processing, handling, and storage of SNM take place in many areas of the RPF. A brief description of each area is provided along with the general criticality-safety control strategy.

• Process 1 - Receipt of Uranium Metal and Dissolution in Nitric Acid.

Uranium metal is received into the plant and stored in criticality-safe storage containers in racks. Uranium metal is handled in criticality-safe storage containers and transferred to a criticality-safe vessel, where it is dissolved in nitric acid to produce uranyl nitrate. The uranyl nitrate is further processed through the criticality-safe thermal denitrator to yield uranium oxide. The uranium oxide is transferred to a criticality-safe container and stored in criticality-safe storage racks. Criticality control in this area is provided by passive engineering design features and administrative controls that are defined in the criticality-safety program (see Section 6b.3).

• Process 2 - Dissolving Uranium Oxide in Sulfuric Acid.

Containers of uranium oxide are transferred into a criticality-safe dissolution vessel (which includes neutron absorbers) and subsequently dissolved in sulfuric acid to create uranyl sulfate. Criticality control in this area is provided by passive engineering design features (including neutron absorbers) and administrative controls.

• Process 3 - Transfer of Solution to the Target Solution Vessel within the IF.

Solution is transferred to the TSV for subsequent irradiation through criticality-safe transfer piping. Upon transfer into the IF, the solution has left the RPF and is no longer covered by this discussion.

• Process 4 - Transfer of Irradiated Solution Back to the RPF (Mo-99).

The solution is transferred back to the RPF via criticality-safe piping and enters a number of different processing areas. These processing areas involve criticality-safe geometry (including neutron absorbers) for processing and storage, and are within radiation shielded areas of the facility. Criticality control in these areas is provided by passive engineering design features and administrative controls.

SHINE Medical Technologies 13b-24 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences

• Process 5 - Processing of Irradiated Solution via UREX Process.

After repeated cycles in the TSV, the irradiated solution is treated in a process known as UREX. There are two outputs from this process: clean uranyl nitrate solution and raffinate (fission and activation products including trace amounts of plutonium removed from the irradiated solution). The equipment used in the UREX process is shown to be geometrically-safe with respect to criticality-safety and is contained in radiation shielded areas of the facility. Criticality control in this area is provided by passive engineering design features and administrative controls.

The main concern for criticality-safety in this process is the transfer of the raffinate to large-capacity vessels that are not geometrically-safe with respect to criticality. Prior to transfer from the post-UREX criticality-safe geometry vessels to vessels that do not have criticality-safe geometry in the waste processing storage area, the raffinate is sampled to ensure that the uranium concentration is below the discharge limit. If an unacceptable concentration of uranium is measured, the transfer between the tanks does not occur.

Criticality control in this area is provided by passive engineering design features and administrative controls.

• Process 6 - Conversion of Uranyl Nitrate to Uranium Oxide.

The final step in the process is the conversion of uranyl nitrate back to uranium oxide.

This conversion process occurs in criticality-safe geometry vessels. In the final step, the uranium oxide material is transferred into a criticality-safe geometry container and stored in a criticality-safe storage rack. The uranium oxide containers are then used as feed material in the creation of uranyl sulfate (Process 2 above). Criticality control in this area is provided by passive engineering design features and administrative controls.

13b.2.5.2 Identification of Causes Credible scenarios that could lead to an accidental criticality within the RPF have been identified and engineered controls and design features have been included in the facility design to prevent such an event. Furthermore, the SR SSCs necessary to demonstrate that each credible scenario is highly unlikely have been identified.

There are four distinct types of criticality scenarios postulated:

• Scenario 1 - Accumulation of metal or oxide fissile material outside of a radiation shielded area of the facility, resulting in an inadvertent criticality.

• Scenario 2 - Accumulation of irradiated solution within a radiation shielded area of the facility, resulting in an inadvertent criticality.

• Scenario 3 - Accumulation of un-irradiated solution outside of a radiation shielded area of the facility, resulting in an inadvertent criticality.

• Scenario 4 - Accumulation of metal or oxide fissile material within a radiation shielded area of the facility, resulting in an inadvertent criticality.

Each of the above scenarios are developed further to show how these scenarios may evolve to cause an inadvertent criticality accident.

SHINE Medical Technologies 13b-25 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences

• Scenario 1 - The accumulation of metal or oxide material within the RPF outside of a radiation shielded area caused by a spill or other physical upset condition. Since the metal and oxide powder do not contain radioactive fission products, either can be safely handled without any significant radiation shielding material. Containers of uranium metal and oxide powder are handled routinely when transferred from storage racks to processing equipment and multiple containers could be spilled or accumulate into a configuration such that a critical geometry is achieved given the proper moderation conditions. This scenario would require multiple administrative control failures as well as the introduction of uncontrolled moderating material into the area.

• Scenario 2 - The accumulation of irradiated solution within a radiation shielded area caused by a spill or other physical upset. The processing and transfer of irradiated fissile material is accomplished within criticality-safe geometry vessels. In the unlikely event of a leak or spill, material is collected in a criticality-safe geometry sump and transferred to another criticality-safe geometry storage vessel. Should these systems fail to divert spilled material to the proper storage vessel, an accumulation of fissile solution in an unsafe geometry could occur. This scenario would require the failure of multiple passive engineered design features as well as the failure of administrative controls.

• Scenario 3 - The accumulation of un-irradiated solution outside of a radiation shielded area caused by a spill or other physical upset. The processing and transfer of un-irradiated fissile material is accomplished within criticality-safe geometry vessels. In the unlikely event of a leak or spill, material is collected in a criticality-safe geometry sump and transferred to another criticality-safe geometry storage vessel. Should these systems fail to divert spilled material to the proper storage vessel, an accumulation of fissile solution in an unsafe geometry could occur. This scenario would require the failure of multiple passive engineered design features as well as the failure of administrative controls.

• Scenario 4 - The accumulation of metal or oxide material within the RPF within a radiation shielded area could be caused by the incomplete dissolution of solid material in a process tank, and carry-over of this material further into the process system. This scenario would require the failure of multiple passive engineered design features as well as the failure of administrative controls.

Specific examples of events associated with the scenarios listed above are:

• Transfer of target solution between the RPF and IF.

Leaks in the piping resulting in target solution collecting in the sump and/or trenches that could lead to a criticality unsafe accumulation of fissile material. Changes in piping design or valve alignment that may result in misdirection to a tank that is not designed to be criticality-safe. Both scenarios may lead to an inadvertent criticality.

• Molybdenum extraction cell area.

Leaks in the piping or extraction process resulting in target solution collecting in the sump, trenches and/or drains that could lead to a criticality-unsafe accumulation of fissile material. Changes in piping design or valve alignment that may result in misdirection to a SHINE Medical Technologies 13b-26 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences tank that is not designed to be criticality-safe. Both scenarios may lead to an inadvertent criticality. Cell waste and shipping containers will have criticality-safe containers.

• Target solution clean-up via UREX process, uranium storage, and transfer.

Leaks in the piping or UREX process resulting in target solution collecting in the sump, trenches and/or drains that could lead to criticality-unsafe accumulation of fissile material.

Changes to spacing of uranium oxide containers in the uranium container storage racks that may result in a criticality-unsafe condition. Not following procedures and use of container transfer carts when transferring uranium oxide containers to the target solution preparation area. These scenarios may lead to an inadvertent criticality.

• Fission product waste stream.

Improper monitoring of the raffinate for unacceptable amounts of uranium prior to transfer of the raffinate to criticality unsafe vessels in the waste processing storage area. Failure to hold transfer of raffinate until the unacceptable amount of uranium is removed.

Transfer of waste with an unacceptable amount of uranium to criticality unsafe geometry vessels in the waste storage area may result in an inadvertent criticality.

• Uranium metal or uranium oxide dissolution.

Improper residence time or acid concentration in the uranium metal dissolution tank (1-TSPS-02T) or the uranyl sulfate preparation tank (1-TSPS-01T) could lead to carry-over of this material further into the process system. This scenario is prevented by the presence of filters downstream of these tanks. A differential pressure monitor is also installed at each filter to alert personnel of a build-up of uranium metal particles or other fissile particles on the filter.

13b.2.5.3 Sequence of Events An inadvertent criticality in the RPF is highly unlikely as it is prevented by the facility design using multiple passive safety-related engineered SSCs and administrative controls in the RPF. The SHINE definition for Safety-related SSCs, described in PSAR Section 3.5.1.1.1, assures that required SSCs remain functional during normal conditions and during and following design basis events such that all nuclear processes are subcritical, including use of an approved margin of subcriticality. Therefore, a radiological consequence analysis for a criticality accident was not performed.

13b.2.5.4 Safety Controls As stated before, the credible accident scenarios that could cause an inadvertent criticality are highly unlikely. This is accomplished by specifying safety controls that reduce the likelihood of such scenarios. A list of safety controls is provided in Table 13b.2.5-1.

SHINE Medical Technologies 13b-27 Rev. 2

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences Table 13b.2.5-1 Safety-Related SSCs and Technical Specification Administrative Controls to Prevent Criticality Accidents (Sheet 1 of 2)

Functional (c) (a) (b)

Control Function Qualification Requirement Metal or Oxide Criticality Outside Shielded Cells Criticality-safe P PEC Safe geometry containers and/or volume Fixed spacing P PEC Safe geometry racks /spacing Handling P AC Separate fissile controls material containers; operator training Solution Criticality Outside Shielded Cells Criticality-safe P PEC Safe geometry vessels /spacing Criticality-safe P PEC Safe geometry sumps and/or volume Sump level P AEC Detect high sensors level in sump Sump pumps P PEC Safe geometry and/or volume; AEC Pumps solution from sump upon high level detection Criticality-safe P PEC Safe geometry containers and/or volume Handling P AC Separate fissile controls material containers; operator training Solution Criticality Inside Shielded Cells Criticality-safe P PEC Safe geometry vessels /spacing Criticality-safe P PEC Safe geometry sumps and/or volume Sump level P AEC Detect high sensors level in sump SHINE Medical Technologies 13b-28 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences Table 13b.2.5-1 Safety-Related SSCs and Technical Specification Administrative Controls to Prevent Criticality Accidents (Sheet 2 of 2)

Functional (c) (a) (b)

Control Function Qualification Requirement Sump pumps P PEC Safe geometry and/or volume; AEC Pumps solution from sump upon high level detection Solution P AC Detect Sampling unacceptable uranium concentration prior to transfer to unsafe geometry Metal or Oxide Criticality Inside Shielded Cells Filters P AC Prevent solid material carry-over Differential P AC Detect solid Pressure material Monitors build-up on filters Solvent Control P AC Ensure Program dissolution is complete prior to transferring solution a) Function: P=Preventive b) Qualification: PEC=Passive Engineered Control; AEC=Active Engineered Control; AC=Technical Specification Administrative Control c) SSCs listed are safety-related SHINE Medical Technologies 13b-29 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences 13b.2.6 RADIOISOTOPE PRODUCTION FACILITY FIRE This subsection analyzes the credible accident conditions that could result in a release of radioactive material or hazardous chemicals produced from licensed materials into or outside of the controlled areas of the RPF. This subsection includes development and analysis of fire scenarios that are postulated in the RPF.

The RPF is located in the RCA outside of the IF. The RPF contains processes associated with extraction and purification of the Mo-99 product from irradiated target solution, preparation and recycling of the target solution, and the waste processing. Individual chemical processes are located in hot cells and glove boxes which are connected via piping located in pipe trenches throughout the RPF. Process storage tanks are located in concrete vaults, below grade in the RPF. Batch tanks, supporting various process operations are located within the process hot cell and glove box enclosures.

The equipment and processes in the RPF present a potential for fire. Ignition and fuel sources in this area are primarily small in nature with the greatest hazards located within process enclosures.

The potential exists for the accumulation of hydrogen in a noble gas storage tank because of a failure of the TOGS to recombine the hydrogen produced in the TSV. The deflagration or detonation of the hydrogen in the noble gas storage tank is assumed to cause activity of one noble gas storage tank to be released into the noble gas storage cell. The airborne activity is released to the environment through RVZ1, exposing the public until the bubble tight dampers are isolated after ten percent of the activity is released. In addition to the public exposure, ten percent of the activity is assumed to leak into the RCA through penetrations in the noble gas storage cell, which exposes workers until they exit the RCA. This scenario is the same as the inadvertent release of the contents of the noble gas storage tank into the noble gas storage cell due to a malfunction or mishandling of equipment evaluated in Subsection 13b.2.4. Therefore, this subsection discusses a fire inside a process enclosure such as a hot cell, glove box, or tank vault.

13b.2.6.1 Initial Conditions and Assumptions An RPF fire has been identified as a potential accident-initiating event (IE) by the Final ISG Augmenting NUREG 1537 and the ISA Summary performed for the SHINE facility. Production facility fire-initiating events have the potential to cause damage to SR SSCs located within the RPF. Fires that may damage SR SSCs are evaluated in this section to determine their potential to cause a radioactive release to the environment.

Initial conditions considered for these fires include:

• Normal RPF operations supporting chemical processing of irradiated target solution within process enclosures,

• Maintenance activities involving system overhaul or system modification within process enclosures,

• Normal operations within the RPF, outside of the process enclosures,

• Maintenance activities performed outside of process enclosures.

SHINE Medical Technologies 13b-30 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences Fires postulated in the RPF may result from:

• Equipment malfunction (e.g. electrical equipment or pump fire),

• Ignition of transient combustibles,

• Loss of ignition or combustible material control,

• Fire propagation from areas exterior to the RPF when fire area barriers are breached/open.

• Exothermic chemical reactions that may lead to a fire.

The following assumptions apply to the fires considered in this section:

• Small quantities of lubricating or insulating oil are contained in in-situ equipment (less than one gallon [3.8 L]),

• Tank enclosure and pipe trench shield/access plugs are normally closed; however, they may be removed to support maintenance activities during system outages.

• Power and control cables for redundant trains of SR SSCs are adequately separated to prevent direct fire damage and spread between trains.

• Procedural controls are in place to administratively limit the admission of transient combustible materials within the RPF to a maximum of 2 lbs/ft2.

• Electrical cabling exhibits limited combustibility and is self-extinguishing outside the presence of an ignition source.

• The RCA ventilation system is supplied with fire detection which is interlocked to the RCA ventilation system and isolation dampers to provide isolation when alarmed.

• Controls are in place to limit the possibility of incompatible chemicals coming into contact with each other leading to an exothermic chemical reaction.

13b.2.6.2 Identification of Causes Fires occurring in the RPF may be categorized as either a fire in the general area or a fire located inside of a process or system enclosure such as hot cells, glove boxes, tank vaults, and laboratories. The general area outside of these enclosures is open and provides a large volume for deposition of products of combustion. Fires originating inside process or system enclosures may generate a hot-gas-layer (HGL) that is capable of damaging SR SSCs outside of the immediate area of the fire; this is not likely to occur for fires located in the general area of the RPF.

An additional category involves fires originating outside of the RPF that propagate into the RPF where fire area barriers have been breached for maintenance or similar activities. Administrative control of fire barrier impairments ensures that an additional level of preventative fire protection controls and fire watch personnel are in place to prevent fire spread across compromised barriers. Controls include greater restriction on hot work and constraint of transient combustible storage in the immediate vicinity of any breach. These controls ensure that an IE involving fire spread from outside the RPF is bounded by a fire in the general area of the RPF.

IEs that could generate a fire involve various fire initiators. The capability of these to damage redundant trains of SR SSCs is dependent on their location and potential for fire growth/spread into other combustible materials. Events that could precipitate fire and lead to a fire-related accident are as follows:

SHINE Medical Technologies 13b-31 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences

• Electrical Equipment Failure - This event involves an electrical system failure in equipment such as an electrical distribution cabinet, junction box, motor control center, switchgear, or control cabinet. This IE may be caused by an error during maintenance resulting in a faulted circuit, failure of a fuse or circuit breaker during an overcurrent event, or faulting of a cable due to damaged jacketing.

• Electric Motor - This event involves failure of a ventilation, hoist, or pump motor. A fire involving an electrical motor involves electrical failure of the motor windings due to a locked rotor condition or bearing failure that ignites collocated secondary combustibles.

• Pump - This event involves failure of a pump lubrication system such as spillage and ignition of lubricant. This IE involves damage to the pump oilers such that lubricant is spilled to a pump skid. This IE may be caused by breakage of a pump oiler due to operations or maintenance activities in the vicinity of the pump and ignition of pre-heated lubricating oil.

• Transient Combustible - This event involves a human error that results in ignition of transient combustibles. he transient combustible provides the fuel source for the fire event, coupled with a sufficiently energetic IE such as improperly controlled hot work which results in development of a damaging fire.

• Exothermic Chemical Reactions - This event involves a human error or other failure that results in mixing chemicals within a hot cell enclosure that when in the presence of each other could lead to an exothermic reaction increasing temperature of the mixture that could increase the severity of a fire or result in a fire or explosion.

13b.2.6.3 Sequence of Events The RPF was reviewed and the design basis fire occurs inside a process enclosure such as a hot cell, glove box, or tank vault. A fire in these locations has the potential to entrain or release radiological materials as a direct result of the fire or damage to important equipment. Fires with the greatest potential for radiological release would involve either the Mo extraction feed tank or the Mo eluate hold tank located in each supercell. These tanks are used for hold up of the target solution prior to being routed to or from the extraction column. These tanks have similar radionuclide inventories. Fire damage that leads to spurious opening of a drain valve or damage to seals could precipitate a release of this material into the supercell. Such a fire may be caused by any of the previously identified IEs. The Mo extraction feed tank is the design basis fire in the RPF.

The potential for a radiological release involving the design basis fire associated with the Mo extraction feed tank is mitigated by several SR SSCs. The mechanical piping, valves and tank are not directly susceptible to fire damage, thus direct fire damage to these components would not likely lead to a release. Severe fire damage to flange or valve seals could precipitate leaks from the mechanical piping, valves and tank; however, the likelihood of such damage is very low because the low combustible loading of the supercells would prevent development of a severe fire. If a leak were precipitated by a fire it would likely release only small amounts of Mo-99 eluate, thus any radiological release would be bounded by a release of the entire tank. Also, the chemicals present within this process enclosure cell does not lead to an exothermic reaction causing a fire. Finally the supercell construction and its fire detection and suppression system would limit the effects of any fire occurring within. The supercell is constructed of thick concrete barriers, viewing windows, and access openings. These features are designed to provide radiation shielding however their robust design provides significant fire separation from the general area of the RPF. The hot cell fire detection and suppression system would detect any fire within and close isolation dampers located in the exhaust filter housing, which would limit SHINE Medical Technologies 13b-32 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences radiological release through the exhaust stack. The hot cell fire detection and suppression system would suppress the fire in its early stages and limit the amount of damage to any affected equipment.

The design basis fire is assumed to occur during normal irradiation and radiological processing operations. The sequence of events for this bounding fire would progress as follows:

a. A fire occurs inside of a supercell enclosure. Fire initiation is due to electrical equipment failure.

b. The enclosure fire detection system is activated alerting operations personnel.

c. The hot cell ventilation system is automatically shut down and isolated by the fire detection system interface.

d. The hot cell fire suppression is activated automatically or manually.

e. Normal operations within the RPF are terminated.

f. All radioisotope activities are secured and placed in a safe condition.

g. Fire spread and damage is limited to the hot cell interior by construction of the cell.

h. Firefighting personnel response ensures extinguishment and overhaul of the fire.

The fire effects would be contained to the affected process enclosure and related ventilation system. RPF operation would be maintained stable until recovery of the fire effects are completed.

13b.2.6.4 Damage to Equipment Fire damage to equipment in the RPF is typically limited to the initiator itself and items located directly in the fire plume (area directly above the fire) such as cabling in raceways. Damage beyond this region is limited by the ability to generate a damaging HGL. Where a damaging HGL is generated, equipment within the upper layer region of an enclosure could be damaged.

Fire damage due to a damaging HGL is limited by the volume of the space and the strength of the fire. Based on enclosure volume and strength of potential fires, an HGL does not form in the general area of the RPF; however, a damaging HGL can be formed in small enclosures such as the supercells, glove boxes, hot cells and process enclosure rooms. The probability that such a fire would occur is very low because it requires a maximum possible HRR from the initiator.

Fire damage is typically limited to combustible materials such as transient combustible materials and cabling. Fires do not typically damage the integrity of mechanical piping, valves, pumps, and tanks as discussed above. While credible fires may be expected to cause damage to motor windings or cabling, damage is not typically caused to the pressure boundary containing radiological material. Fire damage to cabling is limited by the fire resistive design of these materials.

13b.2.6.5 Quantitative Evaluation of Accident Evolution Prevention and mitigation of a fire event inside of a process enclosure and prevention of the spread of the fire outside the process enclosure is provided by a number of design features.

a. As described in Subsection 9a2.3.4, process enclosures are designed to provide radiation shielding through substantial non-combustible construction. This non-combustible construction provides substantial fire separation. This construction SHINE Medical Technologies 13b-33 Rev. 0

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences ensures that fires occurring inside a process enclosure, tank vault, pipe way, or glove box are contained by the construction of the enclosure.

b. Cabling in the RPF is qualified to IEEE 1202 which ensures limited combustibility and limits the potential for fire ignition, growth, and spread. Fire involving this cable does not spread beyond the initiating flame. This design ensures that fires involving electrical cable and fire spread to exposed cables is severely limited.

c. As defined in the fire hazards analysis (FHA), mechanical, electrical and ventilation penetrations into process enclosures are sealed in a manner that the seals provide fire separation equivalent to that provided by the separation barrier.

d. Redundant trains of SR SSCs are separated by fire barriers.

e. Combustible loading inside RPF and process enclosures, tank vaults, pipe trenches, or glove boxes is maintained at an average of less than 2 pounds per square foot.

f. Automatic or manual fire suppression is provided for vaults and hot cells.

g. Ventilation system isolation is provided by bubble-tight dampers. These dampers are interlocked to process enclosure fire detection systems to ensure system shut down and isolation for detected fires. This design ensures the ability to prevent passage of potentially contaminated products of combustion to the environment. The airborne activity is filtered and released to the environment through the HVAC system prior to isolation of the bubble-tight dampers allowing ten percent of the airborne activity to exit the facility.

The HEPA filter is assumed to have an efficiency of 99 percent for particulates and the charcoal filter is assumed to have an efficiency of 95 percent for halogens.

h. Controls are in place to prevent unintended chemicals from coming into contact with each other that may lead to an exothermic chemical reaction.

i. Ten percent of the released activity exposes workers in the RCA until they evacuate.

Personnel evacuation from the RCA occurs within 10 minutes.

13b.2.6.6 Radiation Source Term Analysis Tanks 1-MEPS-04T and 1-MEPS-02T were evaluated as potential source terms for this event. It was determined that the worst case fire scenario involves a fire affecting Tank 1-MEPS-02T.

The material at risk from Tank 1-MEPS-02T for isotopes contributing more than one percent of dose is given in Table 13b.2.6-1. Ten percent of the airborne material is assumed to be released through RVZ1 prior to isolation by the bubble-tight dampers. Ten percent of airborne activity is also assumed to be released to the RCA through penetrations in the supercell prior to evacuation of the facility.

13b.2.6.7 Radiological Consequence Analysis The maximum expected dose to a member of the public is 8.77E-04 rem (site boundary) and 1.23E-04 rem (nearest resident) and the maximum expected worker dose is 0.578 rem.

SHINE Medical Technologies 13b-34 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences 13b.2.6.8 Safety Controls Safety controls are credited to mitigate the effects of a design basis fire in the RPF. The following safety controls are identified as SR SSCs or Technical Specification administrative controls. As appropriate these items are included in the facility technical specifications pursuant to 10 CFR 50.36.

• Installed combustible loading in the RPF and process enclosures is low (TS Administrative Control).

• Supercells, hot cells, tank enclosures, process enclosures are robustly constructed of non-combustible materials which provide fire resistance and radiological shielding (SR).

• Administrative control of the admission and storage of transient combustible materials and the performance of hot work is maintained in the RPF (TS Administrative Control).

• Use of and storage of flammable and combustible liquids and gases is in accordance with the facility fire protection program (TS Administrative Control).

• Penetrations and components installed through fire area boundaries, hot cells, supercells and process enclosure barriers provide separation commensurate with the barrier protection (SR).

The above safety controls provide assurance that radiological releases and consequences to workers and the public are maintained within 10 CFR 20 limits.

SHINE Medical Technologies 13b-35 Rev. 1

[Proprietary Information - Withhold from public disclosure under 10 CFR 2.390(a)(4)]

[Security-Related Information - Withhold Under 10 CFR 2.390]

Chapter 13 - Accident Analysis Analyses of Accidents with Radiological Consequences Table 13b.2.6-1 Material at Risk for RPF Fire Source Term Nuclide Inventory (Ci)

Kr-85m [ Proprietary Information ]

[ Security-Related Information ]

Kr-87 [ Proprietary Information ]

[ Security-Related Information ]

Kr-88 [ Proprietary Information ]

[ Security-Related Information ]

Sr-89 [ Proprietary Information ]

[ Security-Related Information ]

Y-91 [ Proprietary Information ]

[ Security-Related Information ]

Te-132 [ Proprietary Information ]

[ Security-Related Information ]

I-131 [ Proprietary Information ]

[ Security-Related Information ]

I-132 [ Proprietary Information ]

[ Security-Related Information ]

I-133 [ Proprietary Information ]

[ Security-Related Information ]

I-134 [ Proprietary Information ]

[ Security-Related Information ]

I-135 [ Proprietary Information ]

[ Security-Related Information ]

Xe-133 [ Proprietary Information ]

[ Security-Related Information ]

Xe-135 [ Proprietary Information ]

[ Security-Related Information ]

Xe-133m [ Proprietary Information ]

[ Security-Related Information ]

Ce-144 [ Proprietary Information ]

[ Security-Related Information ]

Pr-143 [ Proprietary Information ]

[ Security-Related Information ]

U-234 [ Proprietary Information ]

[ Security-Related Information ]

Np-239 [ Proprietary Information ]

[ Security-Related Information ]

SHINE Medical Technologies 13b-36 Rev. 0

[Proprietary Information - Withhold from public disclosure under 10 CFR 2.390(a)(4)]

Chapter 13 - Accident Analysis Analyses of Accidents with Hazardous Chemicals Produced from Licensed Material 13b.3 ANALYSES OF ACCIDENTS WITH HAZARDOUS CHEMICALS PRODUCED FROM LICENSED MATERIAL The Final ISG Augmenting NUREG-1537 and the ISA Summary and the corresponding HAZOPS/PHA identified IEs and scenarios that involve chemical hazards that have the potential for significant consequences to workers, the public, or the environment. Only those hazards associated with chemicals produced from licensed material or that could affect the safety of licensed material will be evaluated for safety controls in this section.

The SHINE facility uses a variety of solid and liquid process chemicals, some of which are toxic chemicals. The chemicals are in relatively small (<1000 lbs) quantities. They include acids, bases, oxidizers, and flammables. Only a limited number of chemicals exceed 1000 lb quantities (e.g., nitric acid, sulfuric acid, and [ Proprietary Information ]).

These hazardous (including toxic) chemicals are used to support a wide variety of operations such as: (1) target solution preparation, (2) radioisotope production, extraction and purification, (3) target solution cleanup and thermal denitration, and (4) waste operations. Most of these operations are conducted in cells that have an inventory well below 100 lb. The bulk of the chemicals associated with licensed materials are stored in tank vaults inside the RCA.

This section focuses on identifying and evaluating the potential for chemical accidents involving significant quantities of hazardous chemicals that are produced from licensed material that could lead to exceeding the Emergency Response Planning Guideline (ERPG) or equivalent levels (Temporary Emergency Exposure Limits [TEEL] or Acute Exposure Guideline Levels [AEGL]) as stated in the SHINE definition of safety-related. It also focuses on identifying chemical process controls that could prevent or mitigate such accidents and thus ensure that workers and the public are protected from such hazards. Based on the potential for exceeding ERPG levels, some of those controls are identified as safety-related.

There are other process chemicals that could become fire and/or deflagration/explosion hazards (e.g., n-dodecane, deuterium, tritium), and as such are treated as potential initiators for those postulated accident categories. Only those that could result in the release of hazardous chemicals that are produced from licensed material are explicitly evaluated in this section. Other process chemicals are considered to be industrial hazards that could lead to asphyxiation, burns, and other commonly accepted industrial consequences. These later type of hazards are not considered in this section, and are assumed to be controlled by industrial safety and hygiene programs.

There are no external chemical safety issues related to plant conditions that affect or may affect the safety of licensed materials and thus do not increase radiation risk to workers, the public, or the environment.

13b.3.1 CHEMICAL ACCIDENTS DESCRIPTION This section identifies the chemical hazards, potential IEs, and accidents that could result in unacceptable consequences to workers and/or the public (e.g., exceed ERPG levels), along with initial conditions and assumptions related to chemical hazards. Postulated accidents are described with respect to the potential interaction of process chemicals with licensed materials, confinement vessels, facility SSCs, and facility workers. A brief description of the accident SHINE Medical Technologies 13b-37 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Hazardous Chemicals Produced from Licensed Material progression is presented with respect to the controls that is designed to prevent or mitigate such chemical accidents. Mitigation of the consequences of chemical accidents will be reflected in the emergency plan, which is provided in the FSAR. A detailed description of these controls is presented in Subsection 13b.3.3.

13b.3.1.1 Initial Conditions and Assumptions The initial conditions and assumptions associated with chemical hazards produced from licensed material or that could affect the safety of licensed material are as follows:

a. Table 13b.3-1 identifies the bounding inventories (lbs) for each predominant process chemical along with their location and process use. The chemicals on this list are only those with ERPG, TEEL, AEGL limits/levels and quantities of more than a few pounds.

b. It is conservatively assumed that all postulated IEs impact the entire inventory in a single location (e.g., storage area, or tank or vessel in a vault or cell).

c. Storage in the RCA is exclusively in tank vaults or cells. Uranyl sulfate storage and preparation is in a dedicated fire area.

d. Spills of chemicals within the facility are assumed to take place in a 100 ft2 area. This is a conservative assumption, given that most floor areas where chemicals are stored or present are <100 ft2, with the exception of the UREX hot cell, and waste evaporation cell; however, even for these areas, it is assumed that the area is 100 ft2. In the UREX cell the chemicals (e.g., nitric acid, acetohydroxamic acid) are in solution with the irradiated solution, so the hazards are predominantly due to fission products and fissile material, not the chemicals themselves. As a result of the fission product hazards, controls that mitigate radiological releases from this cell also mitigate chemical releases. A pool evaporation model is used to determine the amount of liquid chemicals that are released.

13b.3.1.2 Identification of Initiating Events and Causes There are several potential IEs or causes that could lead to releases of hazardous chemicals produced from licensed material, which if left uncontrolled, could potentially challenge the ERPG limits. These IEs and associated causes include:

a. Failure of tanks and/or vessels (including associated valves, piping, and overflow lines) with significant quantities of toxic chemicals inside vaults or cells is assumed to be due to operational mechanical failures, human errors, or natural phenomena that could result in releases of hazardous chemicals produced from licensed materials.

b. Failure of tanks and/or vessels with significant quantities of toxic chemicals inside vaults or cells (includes associated valves, piping, and overflow lines) due to fires.

c. Failure of tanks and/or vessels with quantities of toxic chemicals outside vaults or cells is assumed to be due to fires.

d. Exothermic reactions between chemicals leading to damage to tanks or vessels containing significant quantities of toxic materials.

e. Mishap during handling of chemicals leads to breach or spill of chemicals from tanks or vessels.

f. Mishap during handling of chemicals leads to spill of chemicals outside tanks or vessels.

SHINE Medical Technologies 13b-38 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Hazardous Chemicals Produced from Licensed Material

g. Excessive time of process solution in the evaporator creates increased concentrations and temperatures that promote formation of unstable compounds (e.g., reactions between nitric acid, Tri-Butyl Phosphate (TBP), and related decomposition products) that accumulate over time, resulting in an explosion and release of chemicals produced from licensed materials.

h. Degradation products not removed from Strip Solution, lead to solutions transferred for processing in the UN Evaporator and Thermal Denitrator causing a sudden reaction of unstable species giving rise to a chemical explosion in the UN Evaporator or Thermal Denitrator and a release of chemicals produced from licensed materials.

No significant quantities of hazardous chemicals produced from licensed materials are stored outside the facility.

13b.3.1.3 Sequence of Events The sequence of events following an initiated event that could potentially lead to a release of a toxic chemical depends on the cause of the IE and where it takes place. For scenarios that take place inside vaults or cells, the following sequence of events is likely to occur (as indicated previously, it is conservatively assumed that postulated IEs impact the entire inventory in a single location, e.g., storage area, or tanks or vessels in a vault or cell):

• The vessel or tank could, depending on the magnitude of the IE, survive or fail.

• For liquid chemicals, any loss of confinement or containment from a tank or vessel results in a spill into the cell or vault around the tank or vessel. No significant quantities of dry or powder forms of toxic chemicals are present in the vaults or cells as indicated in Table 13b.3-1.

• Methods are employed for detection of liquid spills.

• The vault or cells provide a secondary barrier to protect workers. The RCA ventilation system exhausts releases from the facility.

The impacts of these hazardous chemicals are expected to be confined within the vaults or cells.

The ventilation systems dilute the concentration of such toxic chemicals within these locations, and reduces potential releases by filtering any particulate hazardous chemicals (as long as they are compatible with the filtration media in the ventilation system), and ensure that release under normal operating conditions is released through the facility stack, thus further diluting or reducing the potential concentrations of hazardous toxic chemicals at the site boundary or to the nearest population.

13b.3.1.4 Quantitative Evaluation of Accident Evolution As discussed in Subsection 13b.3.1.2 several potential IEs were postulated that could lead to a release of hazardous chemicals produced from licensed materials. Depending on the IE, there are several facility design and operational controls that protect the tanks, vessels, or containers with hazardous chemicals.

For fire IEs, the low combustible loading, limited availability of ignition sources, and fire detection and suppression in cells and storage areas, along with the fire resistant construction of the tanks and vessels themselves make the potential for a chemical release unlikely (between 1E-4 and 1E-5/yr - according to the NUREG/CR-1520 likelihood categorization).

SHINE Medical Technologies 13b-39 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Hazardous Chemicals Produced from Licensed Material For natural phenomena IEs (e.g., seismic events), tanks and vessels within the RCA with significant quantities of hazardous toxic materials with the potential for exceeding ERPG levels are seismically anchored and designed not to fail during such events.

Human error IEs that could result in a release of significant amount of hazard chemicals are very limited. Most of these human errors are likely to result in relatively low quantities of chemicals spilled or released due to mishandling activities, filling or transfer operations. The limited access of personnel inside vaults and cells make this type of IEs unlikely (<1E-4/yr).

For scenarios caused by exothermic reactions between chemicals, the segregation and/or isolation of chemical storage based on the potential for exothermic reactions along with the integrity of the tanks and vessels themselves makes this type of IE unlikely to occur (between 1E-4 and 1E-5/yr).

See Subsection 2.2.3 for an analysis of chemical hazards near the facility.

SHINE Medical Technologies 13b-40 Rev. 1

[Proprietary Information - Withhold from public disclosure under 10 CFR 2.390(a)(4)]

Chapter 13 - Accident Analysis Analyses of Accidents with Hazardous Chemicals Produced from Licensed Material 13b.3.2 CHEMICAL ACCIDENT CONSEQUENCES The following analysis has been performed for hazardous toxic chemicals within the facility, and not just those produced from licensed materials, since the listed chemicals may or may not be produced from or associated with licensed materials depending on which point in the process or system is being considered. This analysis is therefore bounding for all hazardous chemicals produced from licensed materials. Safety-related or administrative controls have been developed only for those systems or processes where the hazardous chemical is produced from or otherwise associated with licensed materials.

The initial conditions and assumptions, identification of initiating events and causes, sequence of events, and the quantitative evaluation of accident evaluation are preserved in Subsection 13b.3.1. This subsection discusses the consequences of the scenarios described in Subsection 13b.3.1.

In the event of release of hazardous toxic chemicals within the facility, there is a potential for exposure to workers and to the public. Instead of trying to bound the potential releases and associated Chemical Dose (CD - or concentration) for the single most toxic chemical produced from licensed materials based on screening methodologies like the Vapor Hazard Ratio (DOE, 1999), the toxic chemicals with the highest inventories in Table 13b.3-1 and with the highest toxicity (lowest ERPG values) have been evaluated using widely accepted methodologies and/or computer codes, such as ALOHA or EPIcode. Both codes have been verified and validated (V&V) and are commonly used for safety analysis purposes by government agencies such as the Department of Energy (DOE).

A determination has been made as to whether the CD for such chemicals could exceed the ERPG limits for the various frequency categories (as defined in the consequence versus frequency category matrix provided by NUREG/CR-1520). Where ERPG limits are exceeded, SR controls are identified to prevent or mitigate the consequences from postulated scenarios when they relate to releases of hazardous chemicals produced from licensed materials.

13b.3.2.1 Damage to Equipment The release of toxic chemicals is not expected to result in damage to SR SSCs, with the exception of the damaged caused by the IE to tanks and vessels themselves. Tanks and vessels are compatible with the chemicals that they contain.

13b.3.2.2 Chemical Source Term Analysis As indicated in Table 13b.3-1, bounding inventories (or material-at-risk [MAR]) for the chemicals of concern have been provided. From this list of chemicals identified in Table 13b.3-1, 11 chemicals were identified for further analysis based on their toxicity, potential dispersibility, and inventory. The selected hazardous chemicals are: nitric and sulfuric acid, calcium hydroxide, caustic soda, [ Proprietary Information ], ammonium hydroxide, [ Proprietary Information ],

n-dodecane, potassium permanganate, tributyl phosphate, and uranium nitrate.

Of concern in a postulated accident is what fraction of the hazardous chemical inventory is impacted by the scenario (damage ratio [DR]), what fraction of the inventory becomes airborne (airborne release fraction [ARF]), and in some cases the respirable fraction (RF), and is readily SHINE Medical Technologies 13b-41 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Hazardous Chemicals Produced from Licensed Material transported outside of the facility (leakpath factor [LPF]). The five-factor formula is being used to determine the source term of dispersible/respirable material that is released to the environment; namely:

Source term = MAR x DR x ARF x RF x LPF (Equation 13b.3-1)

Source terms are evaluated using models and/or computer codes that conform to NUREG/CR-6410s methodologies. Conservatively, it is assumed that IEs impact the entire inventory in the bounding location; that is, a DR of 1.0 is assumed for postulated accidents.

Releases of liquid toxic chemicals are modeled to limit evaporation since none of the tanks or vessels containing toxic chemicals are pressurized. In all cases, the evaporation of the entire inventory takes several hours.

ARFs/RFs for solid or powder chemicals have been selected to bound those in NUREG/CR-6410, namely an ARF/RF of 1E-03/1.0 from a spill of powders. Notice that some chemicals are delivered in solid or powder form (e.g., caustic soda) but are prepared or used in liquid form; however, for conservatism, these were modeled as powders, since the source term is higher than when modeled as being released from an evaporating pool. An LPF of 1.0 has been assumed conservatively at this time for all chemicals except for nitric acid and n-dodecane. For nitric acid and n-dodecane, only those inventories associated with licensed materials have been analyzed for release. These inventories exist inside tank vault or hot cells. As such, an LPF of 0.1 has been assumed for these two release scenarios (see Table 13b.3-1). This LPF corresponds to the most conservative LPF used for the bubble-tight isolation dampers.

13b.3.2.3 Chemical Concentrations and Comparison to Acceptable Limits Consequence or chemical dose modeling are evaluated using dispersion models and/or computer codes that conform to NUREG/CR-6410 methodologies.

Typical computer codes to model chemical releases and determine the chemical dose (or concentration) are the ALOHA and EPIcode; as indicated previously both computer codes are widely used for supporting accident analysis and emergency response evaluations. Both codes have been used and accepted by DOE. V&V for both codes has been performed for modeling chemical hazards for the SHINE facility. Because ALOHA only can readily model only about half of these chemicals, the EPIcode was selected to perform chemical dose calculations in this section, and ALOHA was used to benchmark some of the EPIcode runs.

In running EPIcode, no credit is taken for depletion or plateout of chemicals within the facility or during transport to the site boundary or nearest population location. Dispersion calculations performed are done assuming stable meteorological conditions (i.e., stability F) and 3.3 ft/s (1 m/s) wind speed. These meteorological conditions are typically seen about 15 percent of the time at the site. Ambient temperature was assumed to be 75°F (24°C). A deposition velocity of 3.3 ft/s (1 m/s), a receptor height of 5 ft. (1.5 m) was used to simulate the height of an individual, concentrations are plume centerline values. Releases were conservatively modeled as ground non-buoyant.

Chemical doses or concentrations were determined for the 11 chemicals for a postulated collocated worker within the site boundary (328 ft. [100 m]) at the site boundary and at the nearest residence (817 ft. and 2585 ft. [249 m and 788 m], respectively). Table 13b.3-2, SHINE Medical Technologies 13b-42 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Hazardous Chemicals Produced from Licensed Material summarizes the results of the source term and concentration calculations for the 11 chemicals.

The acceptance limits were those identified in NUREG/CR-6410 and correspond to Protective Action Criteria (PAC) values corresponding to AEGLs, ERPGs, or TEELs values for such chemicals.

The chemical dose or concentration for the nearest residence is below the PAC 1, 2 and 3 levels (equivalent to ERPG-1, 2 and 3). For the workers postulated to be located within the boundary 328 ft. (100 m) downwind, the concentrations are below the PAC values.

SHINE Medical Technologies 13b-43 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Hazardous Chemicals Produced from Licensed Materials 13b.3.3 CHEMICAL PROCESS CONTROLS The safety controls preventing or mitigating the consequences of a hazardous chemical release produced from licensed materials are:

• Cell and vault physical barriers (SR).

• Thermal Denitrator Vent (SR).

• Uranyl Nitrate Evaporator Vessel Vent (SR).

• Solvent Control Program (TS Administrative Control).

SHINE Medical Technologies 13b-44 Rev. 1

Chapter 13 - Accident Analysis Analyses of Accidents with Hazardous Chemicals Produced from Licensed Material 13b.3.4 CHEMICAL PROCESS SURVEILLANCE REQUIREMENTS Potential variables, conditions, or other items that will be probable subjects of a technical specification associated with chemical processes controls are provided in Chapter 14.

SHINE Medical Technologies 13b-45 Rev. 0

[Proprietary Information - Withhold from public disclosure under 10 CFR 2.390(a)(4)]

Chapter 13 - Accident Analysis Analyses of Accidents with Hazardous Chemicals Produced from Licensed Material Table 13b.3-1 Bounding Inventory (lbs) of Significant Process Chemicals (Sheet 1 of 4)

Bounding Chemical Location Inventory (Lbs) Notes Acetohydroxamic Acid N/A 111 Facility total (AHA)

Acids Room 50 Storage inventory Liquid waste storage 41 Assumes both are full tank vaults Waste evaporation 2.8 hotcell Waste evaporation 16.1 Assumes both are full hotcell UREX hot cell 1 Consists of scrub and strip solutions Alpha-Benzoin Oxime Hot Lab 0 Ammonium Hydroxide Caustics Room 59

[ Proprietary Information ] N/A 645 Facility total Acids Room 606 Storage inventory Tank Vault 38 Calcium Hydroxide N/A 4773 Facility total Caustics Room 3182 Assume received in 1m3 supersacks Liquid waste 1591 Assume U-1203 holds 1.5 solidification cell supersacks Caustic (NaOH) N/A 1498 This row provides subtotal Caustics Room 1488 Facility total PVVS Cell 11.35 Assume 20 gal of 1 M caustic in acid gas scrubber loop SHINE Medical Technologies 13b-46 Rev. 0

Chapter 13 - Accident Analysis Analyses of Accidents with Hazardous Chemicals Produced from Licensed Material Table 13b.3-1 Bounding Inventory (lbs) of Significant Process Chemicals (Sheet 2 of 4)

Bounding Chemical Location Inventory (Lbs) Notes n-Dodecane N/A 1596 Facility total Caustics Room 1033 Storage inventory Tank Vault 259 Tank Vault 304 Bounding inventory for n-Dodecane associated with licensed materials.

Spills pure n-Dodecane from a tank into a hot cell.

Hydrochloric Acid Acids Room 3 Hydrogen Peroxide Caustics Room 3 Molybdenum Trioxide Hot Lab 0.66 Nitric Acid N/A 17556 Facility total Acids Room 6229 Storage inventory; assumes stored as received in 1000L IBC at 15.9 M HNO3.

Max inventory of 2 containers Uranyl Sulfate Prep 113 Tank Vault 23 Tank Vault 363 UREX hot cell 7 Consists of the scrub and strip solutions Tank Vault 721 Bounding inventory for nitric acid associated with licensed materials.

Spills 12 M nitric acid from a tank into a hot cell.

Tank Vault 4 TDN area 0.03 30L holdup volume Liquid waste storage 9648 Assumes both A&B tanks are full.

tank vaults SHINE Medical Technologies 13b-47 Rev. 1

[Proprietary Information - Withhold from public disclosure under 10 CFR 2.390(a)(4)]

Chapter 13 - Accident Analysis Analyses of Accidents with Hazardous Chemicals Produced from Licensed Material Table 13b.3-1 Bounding Inventory (lbs) of Significant Process Chemicals (Sheet 3 of 4)

Bounding Chemical Location Inventory (Lbs) Notes Waste evaporation 75.0 Assumes both A&B tanks are full.

hotcell Waste evaporation 0.3 Assumes both A&B tanks are full.

hotcell Waste evaporation 372 Assumes both A&B tanks are full.

hotcell Nitrogen2 Outdoor Storage Area 20000 Potassium Permanganate Hot Lab 66 Potassium Hot Lab 0.03 Hexachlororuthenate Rhodium Chloride Hot Lab 0.02 Silver Nitrate Hot Lab 1 Sodium Iodide Hot Lab 1

[ Proprietary Information ] N/A 4414 Facility total Acids Room 4104 Storage inventory 311 Sulfuric Acid N/A 8072 Facility total Acids Room 7770 Assume stored as received in 1000L IBC at 96wt% H2SO4. Max inventory of 2 containers 137 62 Irradiation Unit 62 Tank Vault 23 Tank Vault 18 SHINE Medical Technologies 13b-48 Rev. 0

Chapter 13 - Accident Analysis Analyses of Accidents with Hazardous Chemicals Produced from Licensed Material Table 13b.3-1 Bounding Inventory (lbs) of Significant Process Chemicals (Sheet 4 of 4)

Bounding Chemical Location Inventory (Lbs) Notes Tributyl Phosphate N/A 482 Facility total Caustics Room 333 Storage inventory Tank Vault 149 Uranyl Nitrate N/A 645 Facility total Uranyl Sulfate Prep 5 Tank Vault 240 Assumes 2 total batches in UNCS Tank Vault 240 Assumes 2 total batches in UNCS Tank Vault 160 Assumes 2 total batches in UNCS TDN area 1 30L holdup volume; Normal operation 2 total batches in UNCS Uranium Metal N/A 147 Facility total U Metal Storage Racks 143 Storage Inventory Uranyl Sulfate Prep 4 Uranium Oxide N/A 423 Facility total UO3 Storage Racks 229 Storage inventory TDN area 193 Assumes 1 batch plus 2/3 batch of seed UO3; normal operation 2 total batches in UNCS Uranyl Sulfate N/A 3089 Facility total Uranyl Sulfate Prep 294 One full tank 1175 Three full tanks Irradiation Unit 1175 Eight full TSVs Tank Vault 223 Tank Vault 223 Normal operation 2 total batches in UNCS SHINE Medical Technologies 13b-49 Rev. 0

[Proprietary Information - Withhold from public disclosure under 10 CFR 2.390(a)(4)]

Chapter 13 - Accident Analysis Analyses of Accidents with Hazardous Chemicals Produced from Licensed Material Table 13b.3-2 SHINE Toxic Chemical Source Terms and Concentrations Nearest Hazardous Source Worker MEI Residence Chemical/Release MAR Term(a) Concentration Concentration Concentration Mechanism (lb) ARF/RF (lb) PAC-1 PAC-2 PAC-3 (100 m) (249 m) (788 m)

Nitric Acid, 12 M, associated with licensed 721 1.0 721 0.53 ppm 24 ppm 92 ppm 0.49 ppm 0.090 ppm 0.012 ppm materials (Evaporating Liquid)

Sulfuric Acid 0.20 8.7mg/m 160 7,770 1.0 7,770 2.4E-06 ppm 4.7E-07 mg/m3 6.3E-08 mg/m3 (Evaporating Liquid) mg/m3 mg/m3 Calcium Hydroxide 240 1,500 3,182 0.001 3.182 15 mg/m3 0.86 mg/m3 0.16 mg/m3 0.020 mg/m3 (Dispersed Solid) mg/m3 mg/m3 Caustic Soda 0.5 50 (Dispersed as both a 1,488 0.001 1.488 3 5 mg/m3 0.40 mg/m3 0.073 mg/m3 0.010 mg/m3 mg/m mg/m3 powder and liquid)

[ Proprietary Information ] [ Proprietary [ Proprietary [ Proprietary 4,104 0.001 4.104 1.1 mg/m3 0.20 mg/m3 0.026 mg/m3 (Dispersed Solid) Information ] Information ] Information ]

Ammonium Hydroxide 2300 59 0.001 0.059 61 ppm 330 ppm 0.011 ppm 2.0E-03 ppm 2.6E-04 ppm (Evaporating Liquid) ppm

[ Proprietary Information ] [ Proprietary [ Proprietary [ Proprietary 606 0.001 0.606 0.16 mg/m3 0.03 mg/m3 3.9E-03 mg/m3 (Dispersed Solid) Information ] Information ] Information ]

Dodecane associated 0.0028 0.031 with licensed materials 304 1.0 304 7.9 ppm 0.0023 ppm 4.4E-04 ppm 5.9E-05 ppm ppm ppm (Evaporating Liquid)

Potassium Permanganate 8.6 14 78 66 0.001 0.001 0.018 mg/m3 3.3E-03 mg/m3 4.2E-04 mg/m3 (Dispersed Solid) mg/m3 mg/m3 mg/m3 Tributyl Phosphate 0.6 3.5 125 333 0.001 0.333 0.0082 ppm 1.5E-03 ppm 2.0E-04 ppm (Evaporating Liquid) mg/m3 mg/m3 mg/m3 Uranyl Nitrate 0.99 5.5 33 480 0.001 0.480 0.024 mg/m3 0.024 mg/m3 3.1E-03 mg/m3 (Dispersed as a powder) mg/m3 mg/m3 mg/m3 a) With the potential for exceeding ERPG-2 limits at site boundary SHINE Medical Technologies 13b-50 Rev. 1

Chapter 13 - Accident Analysis References 13b.4 REFERENCES DOE, 1999. Sandia Wide Environmental Impact Statement (EIS), DOE/EIS-0281, U.S.

Department of Energy, October 1999.

LANL, 2000. A Review of Criticality Accidents, LA-13638, 2000 Revision, May 2000.

SHINE Medical Technologies 13b-51 Rev. 0