ML22034A620

Shine Technologies, LLC, Application for Operating License Supplement 14, Revision to Final Safety Analysis Report, Chapter 6, Engineered Safety Features

ML22034A620
Person / Time
Site:	SHINE Medical Technologies
Issue date:	01/26/2022
From:	SHINE Technologies, SHINE Health. Illuminated
To:	Office of Nuclear Reactor Regulation
Shared Package
ML22034A612	List: ML22034A613 ML22034A614 ML22034A615 ML22034A616 ML22034A617 ML22034A618 ML22034A619 ML22034A620 ML22034A621 ML22034A622 ML22034A623 ML22034A624 ML22034A625 ML22034A626 ML22034A627 ML22034A628 ML22034A629 ML22034A630 ML22034A631 ML22034A632 ML22034A633
References
2022-SMT-0007
Download: ML22034A620 (70)

Text

Chapter 6 - Engineered Safety Features Table of Contents CHAPTER 6 ENGINEERED SAFETY FEATURES TABLE OF CONTENTS Section Title Page SHINE Medical Technologies 6-i Rev. 2 6a2 IRRADIATION FACILITY ENGINEERED SAFETY FEATURES..................... 6a2.1-1 6a2.1

SUMMARY

DESCRIPTION............................................................................. 6a2.1-1 6a2.2 DETAILED DESCRIPTIONS............................................................................ 6a2.2-1 6a2.2.1 CONFINEMENT............................................................................. 6a2.2-1 6a2.2.2 COMBUSTIBLE GAS MANAGEMENT.......................................... 6a2.2-3 6a2.3 NUCLEAR CRITICALITY SAFETY................................................................... 6a2.3-1 6a2.3.1 CRITICALITY SAFETY CONTROLS.............................................. 6a2.3-1 6a2.3.2 CRITICALITY ACCIDENT ALARM SYSTEM.................................. 6a2.3-2 6a

2.4 REFERENCES

................................................................................................. 6a2.4-1 6b RADIOISOTOPE PRODUCTION FACILITY ENGINEERED SAFETY FEATURES........................................................................................................ 6b.1-1 6b.1

SUMMARY

DESCRIPTION............................................................................... 6b.1-1 6b.2 DETAILED DESCRIPTIONS.............................................................................. 6b.2-1 6b.2.1 CONFINEMENT............................................................................... 6b.2-1 6b.2.2 PROCESS VESSEL VENT ISOLATION.......................................... 6b.2-3 6b.2.3 COMBUSTIBLE GAS MANAGEMENT............................................ 6b.2-3 6b.2.4 CHEMICAL PROTECTION.............................................................. 6b.2-4 6b.3 NUCLEAR CRITICALITY SAFETY.................................................................... 6b.3-1 6b.3.1 NUCLEAR CRITICALITY SAFETY PROGRAM............................... 6b.3-1 6b.3.2 CRITICALITY SAFETY CONTROLS................................................. 6b.3-8

Chapter 6 - Engineered Safety Features Table of Contents CHAPTER 6 ENGINEERED SAFETY FEATURES TABLE OF CONTENTS Section Title Page SHINE Medical Technologies 6-ii Rev. 2 6b.3.3 CRITICALITY ACCIDENT ALARM SYSTEM................................. 6b.3-21 6b.3.4 TECHNICAL SPECIFICATIONS.................................................... 6b.3-23 6b.4 REFERENCES................................................................................................... 6b.4-1

Chapter 6 - Engineered Safety Features List of Tables LIST OF TABLES Number Title SHINE Medical Technologies 6-iii Rev. 1 6a2.1-1 Summary of Engineered Safety Features and Design Basis Accidents Mitigated 6a2.1-2 Comparison of Unmitigated and Mitigated Radiological Doses for Select Irradiation Facility DBAs 6b.1-1 Summary of Engineered Safety Features and Design Basis Accidents Mitigated 6b.1-2 Comparison of Unmitigated and Mitigated Radiological Doses for Select Radioisotope Production Facility DBAs 6b.3-1 Summary of Benchmarks Selected for the SHINE Validation Report 6b.3-2 Area of Applicability Summary

Chapter 6 - Engineered Safety Features List of Figures LIST OF FIGURES Number Title SHINE Medical Technologies 6-iv Rev. 0 6a2.1-1 Irradiation Facility Engineered Safety Features Block Diagram 6a2.2-1 Primary Confinement Boundary 6a2.2-2 Tritium Confinement Boundary 6a2.2-3 Irradiation Facility Combustible Gas Management Functional Block Diagram 6b.1-1 Radioisotope Production Facility Engineered Safety Features Block Diagram 6b.2-1 Supercell Confinement Boundary 6b.2-2 Below Grade Confinement Boundary 6b.2-3 RPF Combustible Gas Management Functional Block Diagram 6b.3-1 Target Solution Staging System Overview 6b.3-2 Radioactive Liquid Waste System Overview 6b.3-3 Molybdenum Extraction and Purification System Overview 6b.3-4 Target Solution Preparation System Overview 6b.3-5 Vacuum Transfer System Overview 6b.3-6 Uranium Receipt and Storage System Overview 6b.3-7 Radioactive Drain System Overview 6b.3-8 Radioactive Liquid Waste Immobilization System Overview

Chapter 6 - Engineered Safety Features Acronyms and Abbreviations ACRONYMS AND ABBREVIATIONS Acronym/Abbreviation Definition SHINE Medical Technologies 6-v Rev. 1 ANS American Nuclear Society ANSI American National Standards Institute CAAS criticality accident alarm system CSP criticality safety program DBA design basis accident DCP double contingency principle ESF engineered safety feature ESFAS engineered safety features actuation system FCRS facility chemical reagent system FMO fissionable material operation gU/L grams of uranium per liter HEPA high efficiency particulate air HVAC heating, ventilation, and air conditioning ICBS irradiation cell biological shield IF irradiation facility

Chapter 6 - Engineered Safety Features Acronyms and Abbreviations ACRONYMS AND ABBREVIATIONS Acronym/Abbreviation Definition SHINE Medical Technologies 6-vi Rev. 1 IU irradiation unit IXP iodine and xenon purification and packaging LABS quality control and analytical testing laboratories LFL lower flammability limit MAC minimum accident of concern MEPS molybdenum extraction and purification system N2PS nitrogen purge system NCS nuclear criticality safety NCSE nuclear criticality safety evaluation NDAS neutron driver assembly system PAC protective action criteria PCLS primary closed loop cooling system PFBS production facility biological shield PSB primary system boundary PVVS process vessel vent system

Chapter 6 - Engineered Safety Features Acronyms and Abbreviations ACRONYMS AND ABBREVIATIONS Acronym/Abbreviation Definition SHINE Medical Technologies 6-vii Rev. 1 RDS radioactive drain system rem roentgen equivalent man RG Regulatory Guide RLWI radioactive liquid waste immobilization RLWS radioactive liquid waste storage RPCS radioisotope process facility cooling system RPF radioisotope production facility RVZ1 radiological ventilation zone 1 RVZ1e radiological ventilation zone 1 exhaust subsystem RVZ1r radiological ventilation zone 1 recirculation subsystem RVZ2 radiological ventilation zone 2 SCAS subcritical assembly system SNM special nuclear material SRWP solid radioactive waste packaging SSC structure, system, and component

Chapter 6 - Engineered Safety Features Acronyms and Abbreviations ACRONYMS AND ABBREVIATIONS Acronym/Abbreviation Definition SHINE Medical Technologies 6-viii Rev. 1 TOGS TSV off-gas system TPS tritium purification system TRPS TSV reactivity protection system TSPS target solution preparation system TSSS target solution staging system TSV target solution vessel UPSS uninterruptible electrical power supply system URSS uranium receipt and storage system VTS vacuum transfer system

Chapter 6 - Engineered Safety Features Summary Description SHINE Medical Technologies 6a2.1-1 Rev. 4 6a2 IRRADIATION FACILITY ENGINEERED SAFETY FEATURES 6a2.1

SUMMARY

DESCRIPTION This section provides a summary of the engineered safety features (ESFs) installed in the irradiation facility (IF). Table6a2.1-1 contains a summary of the ESFs and the IF design basis accidents (DBAs) they are designed to mitigate. Table6a2.1-2 provides unmitigated and mitigated doses for the public and the worker, with one DBA selected per confinement system, to demonstrate the mitigative effects of the confinements. The same methods described in Section13a2.2 were used to calculate the unmitigated doses, but with a leak path factor of 1 for both the worker and public. A block diagram for the IF ESFs is provided as Figure6a2.1-1. This block diagram shows the location and basic function of the structures, systems, and components (SSCs) providing the ESFs in the IF portion of the main production facility.

Confinement Systems Confinement systems are provided for protection against the potential release of radioactive material to the IF and the environment during normal conditions of operation and during and after DBAs. Passive confinement is performed by physical barriers such as concrete or steel boundaries, sealed access plugs, and sealed doors. The confinement systems provide active isolation of penetrations during and after certain DBAs that include process piping and heating, ventilation, and air conditioning (HVAC) systems penetrating confinement boundaries. The IF uses two confinement systems: (1) the primary confinement barrier for the irradiation unit (IU) cells, target solution vessel (TSV) off-gas system (TOGS) shielded cells, and the IU cell and TOGS cell HVAC enclosures; and (2) the tritium confinement barrier for the tritium purification system (TPS). A detailed description of these confinement systems is provided in Subsection6a2.2.1.

The accidents for which IF confinement systems are credited are described in detail in Section13a2.1 and listed in Table6a2.1-1. The accident sequences in the IF which require confinement are related to the release of irradiated target solution, radioactive off-gas from TOGS, or the release of tritium from the TPS.

The IF confinement systems remain operational during and following any of the DBAs, including seismic events and loss of off-site power. Active components which comprise portions of the confinement boundary are designed to fail safe on a loss of control or actuating power and maintain the integrity of the confinement boundary.

A listing of the automatic isolation valves included in the confinement boundaries is provided in Section7.4 and Section7.5.

Combustible Gas Management The combustible gas management systems perform mitigation functions for the primary system boundary (PSB). The combustible gas management system uses the nitrogen purge system (N2PS), PSB piping, and the process vessel vent system (PVVS) to establish an inert gas flow through the IUs.

One of the functions of the TOGS is to maintain PSB hydrogen concentrations below values which could result in a hydrogen explosion overpressure capable of rupturing the PSB during

Chapter 6 - Engineered Safety Features Summary Description SHINE Medical Technologies 6a2.1-2 Rev. 4 normal, shutdown, and initial accident conditions. A detailed description of TOGS is provided in Section4a2.8.

For long-term hydrogen gas mitigation during and after an accident, or if TOGS is unavailable, the N2PS provides sweep gas to dilute hydrogen within the TSV headspace, TSV dump tank, and TOGS piping and maintain the hydrogen gas concentration. The N2PS is described further in Subsection6a2.2.2, and a detailed description is provided in Subsection9b.6.2.

Chapter 6 - Engineered Safety Features Summary Description SHINE Medical Technologies 6a2.1-3 Rev. 4 Table 6a2.1 Summary of Engineered Safety Features and Design Basis Accidents Mitigated Credited Engineered Safety Feature (ESF)

Irradiation Facility Design Basis Accidents Mitigated by ESF Detailed Description Subsection Primary Confinement Boundary Mishandling or Malfunction of Target Solution (Subsection13a2.1.4)

External Events (Subsection13a2.1.6)

Mishandling or Malfunction of Equipment (Subsection13a2.1.7)

Facility-Specific Events (Subsection13a2.1.12) 6a2.2.1.1 Tritium Confinement Boundary External Events (Subsection13a2.1.6)

Unintended Exothermic Chemical Reactions Other Than Detonation (Subsection13a2.1.10)

Facility-Specific Events (Subsection13a2.1.12) 6a2.2.1.2 Combustible Gas Management Mishandling or Malfunction of Target Solution (Subsection13a2.1.4)

Loss of Off-Site Power (Subsection13a2.1.5)

Mishandling or Malfunction of Equipment (Subsection13a2.1.7)

Detonation and Deflagration in the Primary System Boundary (Subsection13a2.1.9) 6a2.2.2 None Insertion of Excess Reactivity (Subsection13a2.1.2)

Reduction in Cooling (Subsection13a2.1.3)

Large Undamped Power Oscillations (Subsection13a2.1.8)

System Interaction Events (Subsection13a2.1.11)

N/A

Chapter 6 - Engineered Safety Features Summary Description SHINE Medical Technologies 6a2.1-4 Rev. 4 Table 6a2.1 Comparison of Unmitigated and Mitigated Radiological Doses for Select Irradiation Facility DBAs Representative DBA Unmitigated Public Dose (rem)

Mitigated Public Dose (rem)

Public TEDE Worker TEDE Worker Limiting Organ Public TEDE Worker TEDE Worker Limiting Organ Mishandling or Malfunction of Target Solution (Primary Confinement Boundary - IU Cell) 5.3E+01 3.7E+01 8.6E+02 4.5E-01 1.2E+00 2.3E+01 Mishandling or Malfunction of Equipment (Primary Confinement Boundary - TOGS Cell) 5.3E+01 3.7E+01 8.6E+02 7.3E-01 1.9E+00 4.2E+01 Facility-Specific Events (Tritium Confinement Boundary) 2.5E+01 8.6E+01 8.6E+01 8.0E-01 1.4E+00 1.4E+00

Chapter 6 - Engineered Safety Features Summary Description SHINE Medical Technologies 6a2.1-5 Rev. 4 Figure 6a2.1 Irradiation Facility Engineered Safety Features Block Diagram



Chapter 6 - Engineered Safety Features Detailed Descriptions SHINE Medical Technologies 6a2.2-1 Rev. 4 6a2.2 DETAILED DESCRIPTIONS This section provides the details of the design, initiation, and operation of engineered safety features (ESFs) that are provided to mitigate design basis accidents (DBAs) in the irradiation facility (IF). The IF DBAs, the ESFs required to mitigate the DBAs, and the location of the bases for these determinations are listed in Table6a2.1-1.

6a2.2.1 CONFINEMENT The confinement systems are designed to limit the release of radioactive material to occupied or uncontrolled areas during and after DBAs to mitigate the consequences to facility staff, the public, and the environment. The principal objective of the confinement systems is to protect on-site personnel, the public, and the environment. The second objective is to minimize the reliance on administrative or active engineering controls to provide a confinement system that is as simple and fail-safe as reasonably possible. See Figure6a2.1-1 for an overview of the structures, systems, and components (SSCs) that provide IF confinement safety functions.

6a2.2.1.1 Primary Confinement Boundary The primary confinement boundary consists predominantly of the irradiation unit (IU) cell, the target solution vessel (TSV) off-gas system (TOGS) shielded cell, and the IU cell and TOGS cell heating, ventilation, and air conditioning (HVAC) enclosures. The IU and TOGS shielded cells are equipped with removable shield plugs which allow entry into the confined area. The primary confinement boundary is primarily passive, and the boundary for each IU is independent from the other IUs. In the event of a DBA that results in a release within the primary confinement boundary, radioactive material is confined primarily by the structural components of the boundary and process isolation valves which actuate to isolate the confinement. Gaskets and other non-structural features are used, as necessary, to provide sealing where separate structural components meet (e.g., shield plugs). Portions of the confinement are included as part of the irradiation cell biological shield (ICBS) and their shielding functions are described in Section4a2.5.

The IU cell portion of the primary confinement boundary holds the TSV, TSV dump tank, portions of the TOGS, portions of the primary closed loop cooling system (PCLS), associated primary system boundary (PSB) piping, the light water pool, and the neutron driver. The balance of the TOGS is located in the TOGS shielded cell. The TSV, TSV dump tank, TOGS, and primary system piping comprise the PSB which contains the target solution, fission products, and off-gas byproducts associated with the irradiation process. The neutron driver is independent from the PSB and contains an inventory of tritium gas. Figure6a2.2-1 provides a block diagram of the primary confinement boundary.

A number of process systems penetrate the primary confinement boundary as shown on Figure6a2.2-1. Each piping system capable of excessive leakage that penetrates the primary confinement boundary is equipped with one or more isolation valves which serve as active confinement components except for the N2PS supply and PVVS connections, which may remain open to provide combustible gas mitigation. Actuation of the isolation valves is controlled by the TSV reactivity protection system (TRPS). A detailed description of the TRPS is provided in Section7.4.

Chapter 6 - Engineered Safety Features Detailed Descriptions SHINE Medical Technologies 6a2.2-2 Rev. 4 The primary confinement boundary has a normally-closed atmosphere without connections to the facility ventilation system, except through the PCLS expansion tank. Closed loop ventilation units (i.e., radiological ventilation zone 1 recirculating subsystem [RVZ1r]) circulate and cool the air within the IU cell and the TOGS cell. Each subsystem is equipped with a cooling coil and high efficiency particulate air (HEPA) and carbon filters to remove contaminants in the circulated air.

The cooling coil is supplied by the radioisotope process facility cooling system (RPCS). The closed loop ventilation units are entirely located in the primary cooling rooms. There are no normally-open external connections between the RVZ1r subsystem and the main RVZ1 system.

A detailed discussion of RVZ1r is provided in Section9a2.1.

The PCLS expansion tank has a connection to radiological ventilation zone 1 exhaust subsystem (RVZ1e) which provides a vent path for radiolysis gases produced in the PCLS and light water pool, to avoid the buildup of hydrogen gas. The PCLS expansion tank is located in the IU cell but draws air from the TOGS cell atmosphere. A small line connecting the IU cell and TOGS cell atmospheres creates a flow path from the IU cell, into the TOGS cell, and out through the PCLS expansion tank to RVZ1e. This flow path normally maintains the cells at a slightly negative pressure. The connection to RVZ1e is equipped with redundant dampers or valves that close on a confinement actuation signal, isolating the cells from RVZ1. A detailed discussion of RVZ1e is provided in Section9a2.1.

The complete listing of variables within the TRPS that can cause the initiation of an IU Cell Safety Actuation is provided in Subsection7.4.3.1. The parameters indicating a release of radioactive material into the primary confinement boundary are high RVZ1e IU cell radiation (indicating a release of fission products), high tritium purification system (TPS) target chamber supply pressure, and high TPS target chamber exhaust pressure (indicating a release from the neutron driver assembly system [NDAS]).

Following an IU Cell Safety Actuation, PSB and primary confinement boundary isolation valves transition to their deenergized (safe) states. The normal flow of materials passes through the mezzanine RVZ1 exhaust filter bank before being released to the environment. RVZ filtration is not credited in the accident analysis. If sufficient radioactive material reaches the radiation monitors in the RVZ1 exhaust duct, the engineered safety features actuation system (ESFAS) will isolate the RVZ building supply and exhaust.

Following cell isolation, three mechanisms by which the primary confinement boundary exchanges air with the IF are considered in the accident analysis: pressure-driven flow, counter-current flow, and barometric breathing. The facility accident analysis models the combined effect of these mechanisms as a minor outflow of radioactive material from the primary confinement boundary directly to the IF and then to the environment under accident conditions. The evaluated accident sequences for which the primary confinement boundary is necessary are listed in Table6a2.1-1 and discussed further in Chapter13a2.

The requirements for the ICBS and TRPS needed for system operability, periodic surveillance, setpoints, and other specific requirements needed to ensure the functionality of the primary confinement boundary are located in the technical specifications.

Chapter 6 - Engineered Safety Features Detailed Descriptions SHINE Medical Technologies 6a2.2-3 Rev. 4 6a2.2.1.2 Tritium Confinement Boundary Portions of the TPS serve as the tritium confinement boundary. The TPS is described in detail in Section9a2.7. A functional block diagram of the tritium confinement is provided in Figure6a2.2-2.

Tritium in the IF is confined using active and passive features of the TPS. The TPS gloveboxes and secondary enclosure cleanup subsystems are credited passive confinement barriers. The TPS gloveboxes enclose TPS process equipment. The process equipment of the secondary enclosure cleanup subsystem is a credited passive confinement barrier. The TPS gloveboxes are maintained at negative pressure relative to the TPS room and have a helium atmosphere.

The TPS gloveboxes provide confinement in the event of a breach in the TPS process equipment that results in a release of tritium from the isotope separation process equipment.

The TPS gloveboxes include isolation valves on the helium supply, the glovebox pressure control exhaust, and the vacuum/impurity treatment subsystem process vents.

The TPS has isolation valves on the process connections to the NDAS target chamber supply and exhaust lines. The TPS-NDAS interface lines themselves are part of the credited tritium confinement boundary up to the interface with the primary confinement boundary.

When the isolation valves for a process line or glovebox close, the spread of radioactive material is limited to the glovebox plus the small amount between the glovebox and its isolation valves.

The liquid nitrogen supply and exhaust lines are credited to remain intact during a DBA and the internal interface between the gloveboxes and nitrogen lines serves as a passive section of the tritium confinement boundary.

Upon detection of high TPS exhaust to facility stack tritium concentration or high TPS glovebox tritium concentration, the ESFAS automatically initiates a TPS isolation. The active components required to function to maintain the confinement barrier are transitioned to their deenergized (safe) state by the ESFAS. A description of the ESFAS and a complete listing of the active components that transition state with a TPS isolation are provided in Section7.5.

In the event of a break in the process piping within the TPS glovebox, the release of tritium from the glovebox is uncontrolled for up to 20 seconds until the isolation valves close. Long-term leakage and permeation of the confinement barrier result in migration of tritium out of the confinement and into the TPS room, IF, and environment. The facility accident analysis considers the effect of this air exchange in its evaluation of radiological consequences. The evaluated accident sequences for which the tritium confinement boundary is necessary are listed in Table6a2.1-1 and further discussed in Chapter13a2.

The requirements for the TPS and ESFAS needed for system operability, periodic surveillance, setpoints, and other specific requirements needed to ensure the functionality of the tritium confinement boundary are located in the technical specifications.

6a2.2.2 COMBUSTIBLE GAS MANAGEMENT Hydrogen gas is produced by radiolysis in the target solution during and after irradiation. During normal operation the concentration of hydrogen gas is monitored and maintained below the lower flammability limit (LFL) using the TOGS. The management of combustible gases during

Chapter 6 - Engineered Safety Features Detailed Descriptions SHINE Medical Technologies 6a2.2-4 Rev. 4 normal operation and the TOGS is described in detail in Section4a2.8. If TOGS becomes unavailable, the buildup of hydrogen gas is limited using the combustible gas management system, which uses the N2PS, PSB piping, and the process vessel vent system (PVVS) to establish an inert gas flow through the IUs.

The principal objective of the combustible gas management system is to prevent the conditions required for a hydrogen deflagration within the PSB that results in an explosion overpressure exceeding the pressure safety limit of the PSB.

The N2PS provides back-up nitrogen sweep gas to each IU upon a loss of power or loss of normal sweep gas flow to maintain hydrogen concentrations in these systems below the values which could result in a hydrogen explosion overpressure capable of rupturing the PSB. A functional block diagram of the combustible gas management system is provided in Figure6a2.2-3.

High pressure nitrogen gas is stored in pressurized vessels which are located in an above-grade reinforced concrete structure adjacent to the main production facility. On a loss of power or receipt of an appropriate TRPS or ESFAS actuation signal, solenoid-operated isolation valves on the nitrogen discharge manifold open and supply nitrogen to the IU cell supply header. The nitrogen is regulated to a lower pressure and supplied to each TSV dump tank (as necessary) and flows through the TSV dump tank, the TSV, and the TOGS equipment and piping before being discharged to the PVVS. The nitrogen flows through the PVVS guard, delay beds, and HEPA filter before being discharged to the environment via a safety-related vent path. The nitrogen purge system is described in detail in Section 9b6.2.

The complete listing of variables within the TRPS that can cause the initiation of an IU Cell Nitrogen Purge is provided in Subsection7.4.3.1. These variables indicate a loss of flow or ability to recombine hydrogen by the TOGS. Upon initiation of an IU Cell Nitrogen Purge, active components required to function to establish and maintain the N2PS flow path are transitioned to their deenergized (safe) state by the TRPS and the ESFAS. Descriptions of the TRPS and ESFAS are provided in Sections7.4 and 7.5, respectively.

Failure of the TOGS to manage the combustible gases generated by the subcritical assembly can potentially result in a deflagration within the PSB. Hydrogen deflagration within the PSB is an initiating event and accident analyzed in Chapter13a2. The accident sequences for which the combustible gas management system is necessary are listed in Table6a2.1-1 and discussed in Chapter13a2.

The capacity of the system is sufficient to provide at least three days of flow to maintain the hydrogen concentration within acceptable limits with additional margin. The system is flow-balanced to ensure that sufficient nitrogen is provided to maintain hydrogen concentrations within acceptable limits.

The requirements for the TRPS, ESFAS, and N2PS systems needed for system operability, periodic surveillance, setpoints, and other specific requirements needed to ensure the functionality of the combustible gas management system are located in the technical specifications.

Chapter 6 - Engineered Safety Features Detailed Descriptions SHINE Medical Technologies 6a2.2-5 Rev. 4 Figure 6a2.2 Primary Confinement Boundary Irradiation Unit Cell TOGS Cell Subcritical Assembly Neutron Driver Assembly Dump Tank Return TSV Fill PCLS Supply PCLS Return TOGS Components TOGS Components RPCS Supply RPCS Return PVVS RVZ1e RVZ1r RVZ1r RPCS Supply RPCS Return NDAS Cooling Supply (x2)

NDAS Cooling Return (x2)

TOGS Gas Supply TOGS Vacuum Supply N2PS Nitrogen Supply Process Boundary Confinement Boundary Air Inlet Cooling Water NDAS Secondary Enclosure Cleanup Supply Target Chamber Exhaust Target Chamber Supply Ion Source Supply Vacuum / Impurity Treatment System NDAS Secondary Enclosure Cleanup Return PCLS Components

Chapter 6 - Engineered Safety Features Detailed Descriptions SHINE Medical Technologies 6a2.2-6 Rev. 4 Figure 6a2.2 Tritium Confinement Boundary

Chapter 6 - Engineered Safety Features Detailed Descriptions SHINE Medical Technologies 6a2.2-7 Rev. 4 Figure 6a2.2 Irradiation Facility Combustible Gas Management Functional Block Diagram Nitrogen Gas Storage IF Nitrogen Header Irradiation Units (8)

PVVS Guard Beds PVVS Delay Beds PVVS HEPA Filter PVVS Alternate Vent Path

Chapter 6 - Engineered Safety Features Nuclear Criticality Safety SHINE Medical Technologies 6a2.3-1 Rev. 1 6a2.3 NUCLEAR CRITICALITY SAFETY SHINE maintains a nuclear criticality safety program (CSP) that complies with applicable American National Standards Institute/American Nuclear Society (ANSI/ANS) standards, as endorsed by Regulatory Guide (RG) 3.71, Revision 3, Nuclear Criticality Safety Standards for Fuels and Material Facilities (USNRC, 2018). A description of the CSP is provided in Section6b.3.

Use, handling, and storage of fissile material in the irradiation facility (IF) is evaluated in accordance with the CSP, with the exception of the target solution vessel (TSV).

6a2.3.1 CRITICALITY SAFETY CONTROLS Criteria used to select controls and the use of controlled parameters are described in Section6b.3.2.

6a2.3.1.1 Subcritical Assembly System A detailed description of the subcritical assembly system (SCAS) is provided in Section4a2.2.

The system is designed to maintain fissile material in a subcritical state during irradiation and to safely store the target solution following irradiation in the TSV dump tank.

Criticality Safety Basis The nuclear criticality safety evaluation (NCSE) for the SCAS shows that the evaluated sections of the process will remain subcritical under normal and credible abnormal conditions. The TSV is designed to operate at a higher keff for the production of medical isotopes and is not considered as part of the NCSE. The effects of reactivity changes in the SCAS are provided in Subsections4a2.6.3.3 and 4a2.6.3.4.

The remaining portions of the SCAS are safe-by-design. The TSV dump tank is shown to remain under the upper subcritical limit under the most reactive credible conditions of concentration, reflection, and corrosion. Piping which contains fissile solutions between the TSV and the TSV dump tank is shown to be within the evaluated single parameters limits.

6a2.3.1.2 Target Solution Vessel Off-Gas System A detailed description of the TSV off-gas system (TOGS) is provided in Section4a2.8. The major components of the system are condenser demisters, a zeolite bed, blowers, hydrogen recombiners, recombiner condensers, a recombiner demister, and a vacuum tank. Components of TOGS are located in the irradiation unit (IU) cell and the adjacent TOGS cell. Components in the IU cell are the vacuum tank, condenser demisters, recombiner demister, and associated piping. The remaining components are arranged on a skid in the TOGS cell.

The system is designed to maintain the hydrogen concentration in the primary system boundary below the lower flammability limit by circulating gas from the TSV during irradiation and from the TSV dump tank during cool-down through its demisters, zeolite bed, and recombiner. The TOGS operates at slightly negative pressure. Under normal conditions, the system does not contain significant quantities of fissile material.

Chapter 6 - Engineered Safety Features Nuclear Criticality Safety SHINE Medical Technologies 6a2.3-2 Rev. 1 Criticality Safety Basis The NCSE for the TOGS shows that the entire system will remain subcritical under normal and credible abnormal conditions.

Under abnormal conditions, it is credible that significant quantities of fissile material enter the TOGS. Each of the individual components located in the IU cell and the skid arrangement of components in the TOGS cell has favorable geometry under the most reactive credible conditions.

Additional criticality safety considerations of the TOGS are provided in Subsection4a2.8.5.1.

6a2.3.2 CRITICALITY ACCIDENT ALARM SYSTEM The IF utilizes a criticality accident alarm system (CAAS) to detect a criticality event in the areas in which special nuclear material is used, handled, or stored outside of the IU cells. Coverage of special nuclear material storage in the TSV dump tanks and interconnecting piping is provided by the neutron flux detection system (NFDS) and level instrumentation in the TSV dump tank, which provides indication of abnormal conditions in the IU cells.

A description of the CAAS is provided in Subsection6b.3.3.

Chapter 6 - Engineered Safety Features References SHINE Medical Technologies 6a2.4-1 Rev. 1 6a

2.4 REFERENCES

USNRC, 2018. Nuclear Criticality Safety Standards for Fuels and Material Facilities, Regulatory Guide 3.71, Revision 3, 2018.

Chapter 6 - Engineered Safety Features Summary Description SHINE Medical Technologies 6b.1-1 Rev. 4 6b RADIOISOTOPE PRODUCTION FACILITY ENGINEERED SAFETY FEATURES 6b.1

SUMMARY

DESCRIPTION This section provides a summary of the engineered safety features (ESFs) installed in the radioisotope production facility (RPF). Table6b.1-1 contains a summary of the ESFs and the RPF design basis accidents (DBAs) they are designed to mitigate. Table6b.1-2 provides unmitigated and mitigated doses for the public and the worker, with one DBA selected per confinement system, to demonstrate the mitigative effects of the confinements. The same methods described in Section13a2.2 were used to calculate the unmitigated doses, but with a leak path factor of 1 for both the worker and public. A block diagram for the RPF ESFs is provided as Figure6b.1-1. This block diagram shows the location and basic function of the structure, system and components (SSCs) providing the ESFs in the RPF portion of the main production facility.

Confinement Systems Confinement systems provide active and passive protection against the potential release of radioactive material to the environment during normal conditions of operations and during and after a DBA. Passive confinement is performed by physical barriers such as concrete or steel boundaries, sealed access plugs, and sealed doors. The confinement systems provide active isolation of penetrations that include process piping and heating, ventilation, and air conditioning (HVAC) systems penetrating confinement boundaries during and after certain DBAs. The process confinement boundary includes two areas: (1) the supercell confinement, which includes the extraction, purification, and packaging hot cells, the iodine and xenon purification and packaging cell, and the process vessel ventilation system (PVVS) hot cell; and (2) the below grade confinement, which confines the PVVS delay beds, the target solution hold, storage, and waste tanks, the pipe trench and valve pits, and the waste processing tanks. A detailed description of the confinement systems is provided in Subsection6b.2.1.

The accidents for which confinement is credited are described in detail in Section13b.1 and listed in Table6b.1-1. The accident sequences in the RPF which require confinement are related to the release of radioactive liquids and gases from irradiated target solution, waste streams, or processing streams.

The RPF confinement systems remain operational during and following any of the DBAs, including seismic events and loss of off-site power. Active components which comprise portions of the confinement boundaries are designed to fail safe on a loss of actuating power and maintain the integrity of the confinement boundaries.

A listing of the automatic isolation valves included in the confinement boundaries is provided in Section7.4 and Section7.5.

Process Vessel Ventilation System Isolation The PVVS is equipped with isolation valves that actuate to confine and extinguish fires, which may occur in the PVVS carbon guard beds or carbon delay beds. These isolation functions are described in detail in Subsection6b.2.2. The PVVS is described in detail in Section9b.6.

Chapter 6 - Engineered Safety Features Summary Description SHINE Medical Technologies 6b.1-2 Rev. 4 Combustible Gas Management The combustible gas management system performs mitigation functions for the RPF systems and components that may potentially contain hydrogen gas from radiolysis. The PVVS maintains the hydrogen concentration in these areas below the lower flammability limit (LFL) during normal operating conditions. The PVVS is described in detail in Section9b.6.

For hydrogen gas mitigation during and after an accident, or if the PVVS is unavailable, the nitrogen purge system (N2PS) provides sweep gas to dilute the RPF tanks to maintain the hydrogen concentration below the LFL. The N2PS is described further in Subsection6b.2.3, and a detailed description is provided in Section9b.6.

Chapter 6 - Engineered Safety Features Summary Description SHINE Medical Technologies 6b.1-3 Rev. 4 Table 6b.1 Summary of Engineered Safety Features and Design Basis Accidents Mitigated Credited Engineered Safety Feature (ESF)

Radioisotope Production Facility Design Basis Accidents Mitigated by ESF Detailed Description Subsection Supercell Confinement Critical Equipment Malfunction (Subsection13b.2.4) 6b.2.1.1 Below Grade Confinement Critical Equipment Malfunction (Subsection13b.2.4) 6b.2.1.2 Process Vessel Ventilation Isolation Radioisotope Production Facility Fire (Subsection13b.2.6) 6b.2.2 Combustible Gas Management Loss of Electrical Power (Subsection13b.2.2)

Critical Equipment Malfunction (Subsection13b.2.4) 6b.2.3 None External Events (Subsection13b.2.3)

N/A

Chapter 6 - Engineered Safety Features Summary Description SHINE Medical Technologies 6b.1-4 Rev. 4 Table 6b.1 Comparison of Unmitigated and Mitigated Radiological Doses for Select Radioisotope Production Facility DBAs Representative DBA Unmitigated Public Dose (rem)

Mitigated Public Dose (rem)

Public TEDE Worker TEDE Worker Limiting Organ Public TEDE Worker TEDE Worker Limiting Organ Critical Equipment Malfunction (Process Confinement Boundary - Supercell) 8.0E+00 1.7E+01 2.5E+02 4.2E-02 7.6E-02 5.2E-01 Critical Equipment Malfunction (Process Confinement Boundary - Below Grade) 8.0E+00 1.7E+01 2.4E+02 2.4E-02 4.2E-02 2.9E-01

Chapter 6 - Engineered Safety Features Summary Description SHINE Medical Technologies 6b.1-5 Rev. 4 Figure 6b.1 Radioisotope Production Facility Engineered Safety Features Block Diagram ESFAS Confinement Isolation Signal Supercell Ventilation Isolation (Supply and Exhaust)

Supercell - RPF General Area N2PS Valves Facility-Wide RVZ1 Isolation Dampers (RCA Boundary)

Facility Mezzanine Hot cell Isolation Valves Supercell - RPF General Area Supercell Confinement Supercell - RPF General Area VTS Safety Actuation Supercell - RPF General Area N2PS Piping Facility-wide PVVS Carbon Beds and Piping Supercell and Delay Bed Vaults Delay Bed Isolation Valves Delay Bed Vault PVVS Safety Exhaust Valves Facility Mezzanine Active I & C Systems Active Components Passive Components PVVS Process Isolation Production Facility Biological Shield Components RPF Process Confinement Boundary Combustible Gas Management

Chapter 6 - Engineered Safety Features Detailed Descriptions SHINE Medical Technologies 6b.2-1 Rev. 3 6b.2 DETAILED DESCRIPTIONS This section provides the details of the design, initiation, and operation of engineered safety features (ESFs) that are provided to mitigate the design basis accidents (DBAs) in the radioisotope production facility (RPF). The RPF DBAs, the ESFs required to mitigate the DBAs, and the location of the bases for these determinations are listed in Table6b.1-1.

6b.2.1 CONFINEMENT The confinement systems are designed to limit the release of radioactive material to uncontrolled areas during and after DBAs to mitigate the consequences to workers, the public, and the environment. The principal objective of the confinement systems is to protect on-site personnel, the public, and the environment. The second objective is to minimize the reliance on administrative or active engineering controls to provide a confinement system that is as simple and fail-safe as reasonably possible. Figure6b.1-1 provides an overview of the structures, systems, and components that provide RPF confinement safety functions.

A listing of the automatic isolation valves included in the confinement boundaries is in Section7.5.

6b.2.1.1 Supercell Confinement The supercell is a set of hot cells in which isotope extraction, purification, and packaging is performed, and gaseous waste is handled. The supercell provides shielding and confinement to protect the workers, members of the public, and the environment by confining the airborne radioactive materials during normal operation and in the event of a release. The supercell includes features to allow the import of target solution, consumables, and process equipment; transfer between adjacent cells; and export of final products, waste, spent process equipment, and samples for analysis in the laboratory. The export features of the supercell are integrated into the confinement boundary to allow export operations while maintaining confinement. The supercell is described in detail in Section4b.2.

Figure6b.2-1 provides a block diagram of the supercell confinement boundary. The process support loop represents the MEPS hot water loop.

The hot cells are fitted with stainless steel boxes for confinement of materials and process equipment. The radiological ventilation zone 1 (RVZ1) draws air through each individual confinement box, drawing air from the general RPF area, to maintain negative pressure inside the confinement, minimizing release of radiological material to the facility. Filters and carbon adsorbers on the ventilation inlets and outlets control release of radioactive material to workers and the public. RVZ1 is described in Section9a2.1.

The supercell ventilation exhaust ductwork is fitted with radiation monitoring instrumentation to detect off-normal releases to the confinement boxes. Upon indication of a release exceeding setpoints, isolation dampers or valves on both the inlet and outlet ducts isolate the hot cells from the ventilation system. Additionally, the actuation signal closes isolation valves on the molybdenum extraction and purification system (MEPS) heating loops and conducts a vacuum transfer system (VTS) safety actuation. As part of VTS safety actuation, connections to the supercell from the facility chemical reagent system (FCRS) skid isolate, closing the MEPS and iodine and xenon purification and packaging (IXP) supply valves as described in

Chapter 6 - Engineered Safety Features Detailed Descriptions SHINE Medical Technologies 6b.2-2 Rev. 3 Subsection7.5.3.1.17. The active components required to function to maintain the confinement barrier are actuated by the engineered safety features actuation system (ESFAS). A description of the ESFAS is provided in Section7.5.

Contaminated air is confined to the supercell by the confinement boxes, the ventilation exhaust dampers or valves, and the process isolation valves.

The facility accident analysis considers the effect of air exchange from the confinement to the general areas in its evaluation of radiological consequences. This outflow of radioactive material from the confined area to the RPF and the environment is based on the leak rate of the supercell.

If sufficient radioactive material reaches the radiation monitors in the RVZ1 exhaust duct, ESFAS will isolate the RVZ building supply and exhaust. The evaluated accident sequence for which the supercell is necessary is listed in Table6b.1-1 and discussed further in Section13b.2.

The requirements needed for supercell confinement system operability, periodic surveillance, setpoints, and other specific requirements needed to ensure the functionality of the supercell are located in technical specifications.

6b.2.1.2 Below Grade Confinement The below grade confinement provides a barrier to protect workers, members of the public, and the environment by reducing radiation exposure. The below grade confinement includes the RPF tank vaults, valve pits, pipe trench, and carbon delay bed vault. Portions of the below grade confinement are identified as part of the production facility biological shield (PFBS), which is described in detail in Section4b.2.

Figure6b.2-2 provides a block diagram of the below grade confinement.

In the event of a DBA that results in a release within the process confinement boundary, radioactive material is confined primarily by the structural components of the boundary. Gaskets and other non-structural features are used, as necessary, to provide sealing where components meet (e.g., shield plugs and inspection ports). Each vault is equipped with a concrete cover plug fabricated in multiple sections with one or more inspection ports which allow remote inspection of the confined areas without personnel access. Each valve pit is equipped with a concrete cover plug fabricated in multiple sections with one inspection port. The pipe trench is equipped with concrete cover plugs fabricated in multiple sections with some having inspection ports. The pipe trench, vaults, and valve pits with equipment containing fissile material are equipped with drip pans and drains to the radioactive drain system (RDS).

The below grade confinement is primarily passive. Most process piping that passes through the confinement boundary is entering or exiting another confinement boundary. Process piping for auxiliary systems entering the boundary from outside confinement is provided with appropriate manual or automatic isolation capabilities. The confinement boundary includes cover plugs and inspection ports for access to the confined areas. Contaminated air is confined to the vaults, valve pits, and pipe trench.

The facility accident analysis considers the effect of air exchange from the confinement to the general areas in its evaluation of radiological consequences. Three mechanisms by which the process confinement boundary exchanges air with the RPF are considered: pressure-driven flow, counter-current flow, and barometric breathing. The combined effect of these mechanisms

Chapter 6 - Engineered Safety Features Detailed Descriptions SHINE Medical Technologies 6b.2-3 Rev. 3 is a minor outflow of radioactive material from the confined area to the RPF and the environment under accident conditions. If sufficient radioactive material reaches the radiation monitors in the RVZ1 exhaust duct, ESFAS will isolate the RVZ building supply and exhaust. The evaluated accident sequence for which the process confinement boundary is necessary is listed in Table6b.1-1 and discussed further in Section13b.2.

The requirements needed for process confinement boundary system operability, periodic surveillance, setpoints, and other specific requirements needed to ensure the functionality of the process confinement boundary are located in technical specifications.

6b.2.2 PROCESS VESSEL VENT ISOLATION The process vessel vent system (PVVS) captures or provides holdup for radioactive particulates, iodine, and noble gases generated within the RPF and primary system boundary. The system draws air from the process vessels through a series of processing components which remove the radioactive components by condensation, acid adsorption, mechanical filtration with high-efficiency particulate air (HEPA) filters, and adsorption in carbon beds. Two sets of carbon beds are used; the guard beds located in the supercell, and the delay beds located in the carbon delay bed vault.

Fires may occur in the carbon guard and delay beds which result in the release of radioactive material into the downstream PVVS system, which leads to the facility ventilation system and the environment. The PVVS guard and delay beds are equipped with isolation valves that isolate the affected guard bed or group of delay beds from the system and extinguish the fire. The isolation valves also serve to prevent the release of radioactive material to the environment. The delay beds are equipped with sensors to detect fires which provide indication to ESFAS. The isolation valves close within 30 seconds of the receipt of the actuation signal. The redundancy in the beds and the ability to isolate individual beds allows the PVVS to continue to operate following an isolation.

The evaluated accident sequence for which the PVVS isolation is necessary is listed in Table6b.1-1 and discussed further in Section13b.2.

The requirements to be specified in the technical specifications for system operability, periodic surveillance, setpoints, and other specific requirements needed to ensure the functionality of the PVVS isolations are located in Section7.5 and Section 9.6, which describes the ESFAS and the PVVS, respectively.

6b.2.3 COMBUSTIBLE GAS MANAGEMENT Hydrogen gas is produced by radiolysis in the target solution during and after irradiation. During normal operation, the PVVS removes radiolytic hydrogen and radioactive gases generated within the RPF and primary system boundary. The PVVS is described in detail in Section9b.6. If PVVS becomes unavailable, the buildup of hydrogen gas is limited using the combustible gas management system, which uses the nitrogen purge system (N2PS), process system piping, and the PVVS to establish an inert gas flow through the process vessels.

The principle objective of the combustible gas management system is to prevent the conditions required for a hydrogen deflagration in the gas spaces in the RPF process tanks.

Chapter 6 - Engineered Safety Features Detailed Descriptions SHINE Medical Technologies 6b.2-4 Rev. 3 The N2PS provides a backup supply of sweep gas following a loss of electrical power or loss of sweep gas flow to the RPF tanks which are normally ventilated by PVVS. A functional block diagram of the combustible gas management system is shown in Figure6b.2-3.

High pressure nitrogen gas is stored in pressurized vessels which are located in an above-grade reinforced concrete structure adjacent to the main production facility. On a loss of power or receipt of an ESFAS actuation signal, isolation valves on the radiological ventilation zone 2 (RVZ2) air supply to PVVS shut and isolation valves on the N2PS discharge manifold open, releasing nitrogen into the RPF N2PS distribution piping. The nitrogen gas flows through the RPF equipment and into the PVVS process piping. The discharged gases flow through the PVVS passive filtration equipment before being discharged to the alternate vent path in the PVVS. The N2PS is described in detail in Section9b.6.

The complete listing of variables within the ESFAS that can cause the initiation of an RPF Nitrogen Purge is provided in Subsection7.5.3.1. These variables indicate a loss of flow. The active components required to function to initiate the RPF Nitrogen Purge are actuated by the ESFAS. A detailed description of the ESFAS is provided in Section7.5.

The combustible gas management system prevents deflagrations and detonations in RPF process tanks which could lead to a tank or pipe failure and cause a target solution spill inside the process confinement boundary. The accident sequences for which the combustible gas management system is necessary are listed in Table6b.1-1 and discussed in Chapter13a2.

The requirements needed for PVVS system operability, periodic surveillance, setpoints, and other specific requirements needed to ensure the functionality of the combustible gas management system are located in technical specifications.

6b.2.4 CHEMICAL PROTECTION The chemical dose analysis is provided in Section13b.3 and has shown that no potential chemical release exceeds the established acceptance limits. As described in Section13b.3, confinement barriers (i.e., supercell, gloveboxes, subgrade vaults) are credited for mitigation of chemical dose consequences. The URSS uranium storage racks are seismically qualified to maintain their structure and position during seismic events to limit the material at risk for uranium oxide accidents.

Chapter 6 - Engineered Safety Features Detailed Descriptions SHINE Medical Technologies 6b.2-5 Rev. 3 Figure 6b.2 Supercell Confinement Boundary Below Grade Confinement Boundary Supercell Confinement Boundary RVZ1 Ventilation (Exhaust)

RVZ2 Ventilation (Supply)

Extraction and IXP Hot Cells Purification Hot Cells Packaging Hot Cells Process Vessel Vent System Hot Cell Cell Drains Process Piping Vacuum Transfer System Process Vessel Vent System Process Vessel Vent System Process Piping Process Support Loop Inlet Process Support Loop Outlet Process Boundary Confinement Boundary FCRS Reagent Skid Adjacent Confinement

Chapter 6 - Engineered Safety Features Detailed Descriptions SHINE Medical Technologies 6b.2-6 Rev. 3 Tank Vaults Process Valves Process Piping Process Tanks PVVS Delay Beds Irradiation Units Hot Cells PVVS Guard Beds N2PS TSPS Valve Pits Pipe Trench Carbon Delay Bed Vaults PVVS Primary Confinement Boundary Supercell Confinement Boundary Confinement Confinement Figure 6b.2 Below Grade Confinement Boundary

Chapter 6 - Engineered Safety Features Detailed Descriptions SHINE Medical Technologies 6b.2-7 Rev. 3 Figure 6b.2 RPF Combustible Gas Management Functional Block Diagram Nitrogen Gas Storage RPF Nitrogen Header RPF Process Tanks PVVS Guard Beds PVVS Delay Beds PVVS HEPA Filter PVVS Alternate Vent Path

Chapter 6 - Engineered Safety Features Nuclear Criticality Safety SHINE Medical Technologies 6b.3-1 Rev. 4 6b.3 NUCLEAR CRITICALITY SAFETY SHINE maintains a nuclear criticality safety program (CSP) that complies with applicable American National Standards Institute/American Nuclear Society (ANSI/ANS) standards, as endorsed by Regulatory Guide (RG) 3.71, Revision 3, Nuclear Criticality Safety Standards for Fuels and Material Facilities (USNRC, 2018). The CSP meets the following criticality safety requirements of 10 CFR 70:

The criticality accident requirements of 10 CFR 70.24; The criticality reporting requirements of 10 CFR 70.50, 10 CFR 70.52, and the SHINE-specific reporting requirements which meet the intent of 10 CFR 70, AppendixA, as described in the technical specifications; Application of 10 CFR 70.61(b) to criticality accidents, considering such accidents as high-consequence events; and Application of 10 CFR 70.61(d), ensuring that nuclear processes are subcritical under normal and credible abnormal conditions, including use of an approved margin of subcriticality and the use of preventative controls as the primary means of protection.

6b.3.1 NUCLEAR CRITICALITY SAFETY PROGRAM The CSP is administered through a written nuclear criticality safety (NCS) policy and program description, with an additional program description for NCS training and qualification. The CSP is executed by qualified NCS staff using written procedures. The program description and written procedures are formally controlled through the SHINE document control procedure.

The goal of the CSP is to ensure that workers, the public, and the environment are protected from the consequences of a nuclear criticality event. In order to accomplish this goal, all practicable measures are implemented to prevent an inadvertent criticality from occurring. The CSP also contains provisions necessary to mitigate the consequences (i.e., criticality accident alarm system [CAAS] and emergency response activities) should an inadvertent criticality occur.

6b.3.1.1 Nuclear Criticality Safety Program Organization The SHINE Chief Executive Officer holds overall responsibility for the CSP. The Safety Analysis Manager is the Responsible Manager for the CSP and may delegate administrative authority to an NCS Lead.

SHINE facility management holds the following responsibilities with respect to the CSP:

Formulate and maintain the NCS policy and ensure that personnel involved in fissionable material operations (FMOs) are informed of the policy.

Assign responsibility and delegate commensurate authority to implement the criticality safety policy and program.

Ensure that everyone, regardless of position, is made aware of their responsibilities for implementing the requirements of the CSP.

Ensure that appropriately trained and qualified NCS staff are available to provide technical guidance appropriate for the FMOs performed at the SHINE facility.

Establish and maintain a training and qualification program for NCS staff.

Establish a method to monitor the CSP.

Chapter 6 - Engineered Safety Features Nuclear Criticality Safety SHINE Medical Technologies 6b.3-2 Rev. 4 Participate in auditing the overall effectiveness of the CSP at least once every three years.

Establish and maintain a configuration management program that identifies and controls changes to facility, equipment, and processes important to NCS.

Establish a process for developing, reviewing, supplementing, and revising operating procedures important to NCS.

Require that activities involving fissile material are conducted using approved written procedures and for situations for which existing procedures are inadequate or do not exist, require personnel to take no action until the NCS staff has evaluated the situation and provided recovery instructions.

Require personnel to report defective NCS situations to operations supervision and the NCS staff.

Encourage the use of stop-work authority and reporting of defective conditions.

Supervisors responsible for FMOs hold the following responsibilities with respect to the CSP:

Accept responsibility for the safety of operations under their control.

Be knowledgeable in those aspects of NCS relevant to operations under their control.

Ensure that NCS training is provided to the personnel under their supervision.

Personnel under their supervision must understand procedures, limits, controls, and other NCS considerations such that personnel can be expected to perform their functions without undue risk.

Maintain records of training activities and verification of personnel understanding.

Develop or participate in the development of procedures applicable to the operations under their control. Maintain these procedures to reflect changes in operations as a continuous supervisory responsibility.

Verify compliance with NCS specifications for new or modified equipment before its use.

Verification may be based on inspection reports or other features of the quality assurance program.

Be responsible for the inspection, testing, and maintenance of engineered controls.

Require conformance with good safety practices, including unambiguous identification of fissile materials and good housekeeping.

NCS staff hold the following responsibilities with respect to the CSP:

Provide technical guidance for the design of equipment and processes and for the development of operating procedures.

Maintain familiarity with current developments in NCS standards and guides and other nuclear criticality information.

Maintain familiarity with operations within the SHINE facility requiring NCS controls. This shall be accomplished by individual staff members maintaining familiarity with operations for which they provide guidance.

Assist supervisors, on request, in training personnel.

Participate in the development of the NCS training program.

Provide oversight of NCS and the CSP at the SHINE facility.

Review facility non-conformances that have the potential to impact NCS and provide appropriate response recommendations to violations or deficiencies.

SHINE's NCS staff consists of an NCS Lead and one or more NCS Engineers, at least one of whom shall be qualified at the Senior level, and any number of individuals identified as NCS

Chapter 6 - Engineered Safety Features Nuclear Criticality Safety SHINE Medical Technologies 6b.3-3 Rev. 4 Engineers-in-Training. The NCS Lead is a qualified Senior NCS Engineer who serves as the supervisor for the NCS staff regarding conduct of NCS activities. SHINE may also qualify NCS Analysts, whose function is to perform and document NCS calculations in support of NCS evaluation (NCSE) development. NCS staff are kept administratively separate from operations to the extent practicable.

6b.3.1.2 Nuclear Criticality Safety Staff Qualifications The minimum qualification entry requirements for NCS staff are:

NCS Analyst: Baccalaureate degree in science or engineering from an accredited college or university, or at least five years of directly applicable experience, or an equivalent combination of education and experience.

NCS Engineer: Same as for an NCS Analyst Senior NCS Engineer: Current qualifications as an NCS Engineer, plus three years of experience as an NCS Engineer NCS qualifications use a tiered approach, with three qualification levels for NCS Staff and specific functional area qualifications for Fissile Material Handlers. The specific training requirements are taken from ANSI/ANS-8.26-2007 (R2016), Criticality Safety Engineer Training and Qualification Program (ANSI/ANS, 2007a). SHINE uses qualification cards to record an individual's progress towards qualification. Qualification cards list the necessary knowledge and performance requirements for NCS staff and provide a record of completion for qualification activities. Assignment of personnel for qualification is made by an engineering manager.

Maintenance of qualifications is required for NCS staff.

Qualifications granted by external organizations may be recognized based on verification and completion of SHINE facility-specific portions of the appropriate qualification card. Experience in NCS may be used to exempt individual training and qualification requirements. Where experience is used for exemptions, appropriate documentation is attached to the qualification card and retained. Facility familiarity and walk-through requirements may not be exempted and are required in addition to recognition of externally-completed qualifications. Maintenance of qualifications is required for NCS staff.

6b.3.1.3 Use of National Consensus Standards The CSP commits to the requirements of the following national consensus standards, subject to the clarifications and exceptions identified in RG 3.71, with certain SHINE-specific limitations described below:

Standards endorsed without clarifications or exceptions by the Nuclear Regulatory Commission (NRC) in RG 3.71:

ANSI/ANS-8.6-1983 (R2017), Safety in Conducting Subcritical Neutron-Multiplication Measurements In Situ (ANSI/ANS, 1983)

ANSI/ANS-8.7-1998 (R2017), Nuclear Criticality Safety in the Storage of Fissile Materials (ANSI/ANS, 1998)

Chapter 6 - Engineered Safety Features Nuclear Criticality Safety SHINE Medical Technologies 6b.3-4 Rev. 4 ANSI/ANS-8.19-2014, Administrative Practices for Nuclear Criticality Safety (ANSI/ANS, 2014a)

ANSI/ANS-8.20-1991 (R2015), Nuclear Criticality Safety Training (ANSI/ANS, 1991)

ANSI/ANS-8.22-1997 (R2016), Nuclear Criticality Safety Based on Limiting and Controlling Moderators (ANSI/ANS, 1997a)

ANSI/ANS-8.26-2007 (R2016), Criticality Safety Engineer Training and Qualification Program Standards endorsed in RG 3.71 with clarifications or exceptions:

ANSI/ANS-8.1-2014, Nuclear Criticality Safety in Operations with Fissionable Materials Outside Reactors (ANSI/ANS, 2014b)

The clarification applied to this standard is related to subcritical limits for plutonium isotopes and is not applicable to the SHINE facility.

ANSI/ANS-8.3-1997 (R2017), Criticality Accident Alarm System (ANSI/ANS, 1997b)

The clarifications and exceptions applied to this standard are applicable to the SHINE facility.

ANSI/ANS-8.23-2007 (R2012), Nuclear Criticality Accident Emergency Planning and Response (ANSI/ANS, 2007b)

The clarification applied to this standard is applicable to the SHINE facility.

ANSI/ANS-8.24-2017, Validation of Neutron Transport Methods for Nuclear Criticality Safety Calculations (ANSI/ANS, 2017)

The clarifications applied to this standard are applicable to the SHINE facility.

The following ANSI/ANS Series 8 Standards are not used by the SHINE CSP. For each standard, the basis for non-implementation is provided:

ANSI/ANS-8.5-1996 (R2017), Use of Borosilicate-Glass Raschig Rings as a Neutron Absorber in Solutions of Fissile Material.

Borosilicate-glass Raschig rings are not used in the SHINE facility.

ANSI/ANS-8.10-2015, Criteria for Nuclear Criticality Safety Controls in Operations with Shielding and Confinement (ANSI/ANS, 2015).

SHINE does not apply the criteria provided in this standard for determining the adequacy of shielding and confinement.

ANSI/ANS-8.12-1987 (R2016), Nuclear Criticality Control and Safety of Plutonium-Uranium Fuel Mixtures Outside Reactors.

Plutonium is not used as a fuel component at SHINE. Only small quantities are present due to burnup.

ANSI/ANS-8.14-2004 (R2016), Use of Soluble Neutron Absorbers in Nuclear Facilities Outside Reactors.

SHINE does not use soluble neutron absorbers for control of criticality.

ANSI/ANS-8.15-2014, Nuclear Criticality Control of Selected Actinide Nuclides.

SHINE does not conduct operations with non-negligible quantities of the selected actinide nuclides.

ANSI/ANS-8.17-2004 (R2014), Criticality Safety Criteria for the Handling, Storage and Transportation of LWR Fuel Outside Reactors.

SHINE does not handle, store, or transport LWR fuel rods or units.

ANSI/ANS-8.21-1995 (R2011), Use of Fixed Neutron Absorbers in Nuclear Facilities Outside Reactors (ANSI/ANS, 1995)

SHINE does not use fixed neutron absorbers for control of criticality.

Chapter 6 - Engineered Safety Features Nuclear Criticality Safety SHINE Medical Technologies 6b.3-5 Rev. 4 ANSI/ANS-8.27-2015, Burnup Credit for LWR Fuel.

SHINE does not possess irradiated LWR fuel assemblies.

6b.3.1.4 Nuclear Criticality Safety Evaluations NCSEs are conducted for each FMO to ensure that under normal and credible abnormal conditions, all nuclear processes remain subcritical with an approved margin of subcriticality for safety. An FMO is any process or system that has the potential to contain more than 250 g of non-exempt fissile material. This limit is selected based on one-half of the single parameter mass limit for uranium-233 identified in ANSI/ANS-8.1-2014. For the purposes of application of this limit, all fissionable isotopes in the process or system are considered to be fissile.

Exempt fissile material is defined as special nuclear material (SNM) that meets the requirements from classification as fissile nuclear material as specified in 10 CFR 71.15. The limits specified in 10 CFR 71.15 are derived for use in nuclear material transport and long-term storage and are acceptably conservative. When 10 CFR 71.15 is invoked to exempt a process or system, the NCSE must show that there are no credible means of changing the physical composition or configuration of the material.

NCS limits are derived based on assuming optimum or most-reactive credible parameter values unless specific controls are implemented to limit parameters to a particular range. If less-than-optimum values are used, the basis for use is included in the NCSE. Operating limits which take process variability and uncertainty into account are used to ensure NCS limits are unlikely to be exceeded. Controls used to enforce safety and operating limits are specified in the NCSEs.

The NCSEs are conducted using appropriate hazard evaluation techniques, including "What-if,"

"What-if Checklist," and Event Tree Analysis, to determine potential scenarios which could result in an inadvertent criticality event. Process hazards evaluations are referenced to identify additional potential scenarios that have been determined to have potential criticality safety implications (e.g. chemical safety, fire, radiological events). The identified scenarios are screened based on a qualitative determination of likelihood and those events which are deemed to be credible are evaluated for appropriate control selection. For the purposes of NCSEs, criticality events are always considered to be "high" consequence, with a strict emphasis on selection of controls to prevent criticality. Where the double contingency principle (DCP) is employed, the NCSE contains a description of its implementation.

The NCS limits used in the evaluations are derived from industry-accepted and peer-reviewed references, including ANS standards; from hand calculations using industry-accepted and peer-reviewed techniques, such as solid-angle or surface density calculation; or from computational methods. In cases where hand calculations are used, each technique is used consistent with any limitations.

6b.3.1.5 Computational System Validation Where computational methods are employed, the computational system is verified and validated using the guidance in NUREG/CR-6698 (USNRC, 2001).

A written validation report for the computational systems used for NCS calculations is documented and maintained in accordance with the SHINE document control process. The validation process was performed using Monte Carlo n-Particle (MCNP) software,

Chapter 6 - Engineered Safety Features Nuclear Criticality Safety SHINE Medical Technologies 6b.3-6 Rev. 4 versionMCNP5-1.60. Verification of the MCNP software installation was performed using developer-supplied verification tools, and re-verification of the computational system is conducted following any changes to the hardware or operating system.

The validation report uses benchmarks from the Handbook of the International Criticality Safety Benchmark Evaluation Project (ICBEP). Benchmarks were selected for evaluation based on their similarity to the SHINE solution system, as no plant-specific benchmark experiments are available. The fissile material, enrichment, chemical form, range of concentration, and reflector materials were considered in the selection of benchmarks. The selected benchmarks series, number of cases selected from each benchmark series, and a description of each physical system is provided in Table 6b.3-1. A summary of the area of applicability covered by the validation report is provided in Table 6b.3-2.

The bias and bias uncertainty were calculated using the methodology described in NUREG/CR-6698. The benchmark data were tested using a modified Shapiro-Wilk test for normality and were determined to be normally distributed. A single-sided tolerance limit approach was used to determine the bias uncertainty. The upper subcritical limit is the difference between unity and the sum of the bias (zero, because a positive bias was determined), the bias uncertainty, and the subcritical margin.

The margin of subcriticality used for SHINE solution processes is 0.06. A subcritical margin of 0.05 was conservatively selected based on the quantity and quality of the selected benchmarks.

An additional subcritical margin of 0.01 is applied to provide additional conservatism to account for the limited number of experimental benchmarks specific to uranyl sulfate systems. NCSEs ensure that the evaluated processes fall within the range of the validated computational system.

The validation range may be extended beyond the range of the benchmark data using additional subcritical margin or bias trending analysis to ensure that the existing subcritical margin is appropriate. Where extrapolation or wide interpolations are used to extend the validation range, the recommendations of NUREG/CR-6698 are used. When a positive bias is encountered, it is set to 0 for the purposes of calculating subcritical limits, and data outliers are only rejected based on inconsistency with known physical behavior; statistical rejection methods for outliers are not used. NCS limits are selected to incorporate appropriate margins to protect against uncertainty in process variables and to prevent a limit being accidently exceeded. Allowances for uncertainty in the methods, data, and bias are included in the selected limits. Studies are conducted to correlate the effects of changing one controlled parameter on other controlled parameters, such as to evaluate compliance with the DCP.

NCS program documentation, evaluations, and calculations are maintained in accordance with the SHINE records management system. Equipment characteristics relied on to maintain NCS limits are identified as NCS controls and are maintained by the SHINE configuration management system.

Process or design changes that could affect NCS limits or controls are evaluated using the facility change process requirements of 10 CFR 50.59. Prior to implementing the change, the NCSE is reviewed and updated if needed to determine that the entire process will be subcritical under both normal and credible accident scenarios.

Chapter 6 - Engineered Safety Features Nuclear Criticality Safety SHINE Medical Technologies 6b.3-7 Rev. 4 6b.3.1.6 Nuclear Criticality Safety Training In support of SHINE's CSP, a two-tiered NCS training program is established and maintained.

The first-tier training program includes the Program Content identified in ANSI/ANS-8.20-1991 (R2015), and is directed toward those who manage, work in, or work near areas where the potential exists for a criticality accident. The second-tier training is specific to NCS staff. NCS staff training meets the requirements identified in ANSI/ANS-8.26-2007 (R2016). Both tiers of NCS training include procedural compliance, stop-work authority, response to criticality alarms, and reporting of defective conditions.

6b.3.1.7 Criticality Safety Program Oversight Operations are reviewed at least annually to verify that procedures are being followed and that process conditions have not been altered to affect the NCSE. NCS staff conduct walkthroughs of facility processes and procedures as part of the annual operational review. These reviews are conducted, in consultation with operating personnel, by individuals who are knowledgeable in NCS and who, to the extent practicable, are not immediately responsible for the operation, and are documented. Active procedures are reviewed periodically by supervisors.

The NCS Lead schedules and coordinates routine NCS oversight activities:

NCS staff conduct and participate in routine audits of NCS practices, including compliance with procedures.

NCS staff examine reports of procedural violations and other deficiencies for possible improvement of safety practices and procedural requirements. Findings are reported to management.

NCS staff periodically review NCSEs to determine their continued applicability and validity. This should include a review of elements of the evaluation such as scope, assumptions, normal conditions, credible abnormal conditions, controls, and limits.

Annual reviews of NCSEs and calculations are conducted, with each evaluation and calculation being reviewed at least once every three years.

At least every three years, an audit of the overall effectiveness of the CSP is performed.

Management participates actively in this activity.

Equipment and procedures needed for NCS controls are clearly identified. Activities involving fissile material are conducted using written and approved procedures. For situations in which approved procedures are inadequate or do not exist, personnel are required to take no action until the NCS staff has evaluated the situation and provided recovery instructions. Procedures are supplemented by appropriate material labeling and postings, specifying material identification and limits on parameters, in areas, operations, workstations, and storage locations subject to procedural controls. Equipment and procedures are maintained as part of the facility management measures.

6b.3.1.8 Criticality Safety Nonconformances The adequacy of engineered and administrative NCS controls is routinely assessed as part of the SHINE facility audits and inspections. Deviations from procedures and unintended alterations in process conditions that affect NCS are promptly reported to management using the corrective action program, investigated promptly, corrected as appropriate, and documented. Action to correct such deviations or alterations is taken in accordance with procedural requirements and

Chapter 6 - Engineered Safety Features Nuclear Criticality Safety SHINE Medical Technologies 6b.3-8 Rev. 4 with guidance obtained from the NCS staff. Action is taken to prevent recurrence for significant conditions adverse to quality. Records of NCS deficiencies and associated corrective actions are maintained in the corrective action program.

Upon the loss of double contingency protection, operations are suspended and processes rendered safe until double contingency protection can be restored. Adequacy of the affected controls is subsequently assessed as part of the corrective actions.

NCS events are reported to the NRC in accordance with the reporting requirements of 10CFR70.50, 10 CFR 70.52, and the SHINE-specific reporting requirements which meet the intent of 10 CFR Part 70, Appendix A, as described in the technical specifications.

6b.3.1.8.1 Planned Response to Criticality Accidents The CAAS is described in Subsection6b.3.3.

SHINE maintains an emergency plan which includes the planned response to criticality accidents. The emergency plan contains information on the provision of personnel accident dosimeters in areas that require the CAAS and arrangements for on-site decontamination of personnel and the transport and medical treatment of exposed individuals. The SHINE emergency plan is further described in Section12.7.

6b.3.1.8.2 Criticality Safety Event Reporting Facility procedures include provisions for rapid evaluation of the significance of NCS events, including immediate notifications of facility NCS staff and the assessment of events with respect to the loss or degradation of double contingency protection.

The significance and reportability of NCS events is based on the loss or degradation of NCS controls and not on the event sequence with respect to whether or not limits were exceeded.

If an NCS event cannot be affirmatively determined to not require a one-hour report within one hour, it is reported as an event requiring a one-hour report.

6b.3.2 CRITICALITY SAFETY CONTROLS General The failure of a single NCS control which maintains two or more controlled parameters is considered a single process upset when determining whether the DCP is met.

Passive engineered geometry controls are the most preferred type of NCS controls. Otherwise, the preferred hierarchy of NCS controls is (1) passive engineered, (2) active engineered, (3)enhanced administrative, and (4) administrative. Use of explicit NCS controls is preferred to reliance on the natural and credible course of events. Generally, control on two independent criticality parameters is preferred over multiple controls on a single parameter. If redundant controls on a single parameter are used, a preference is given to diverse means of control on that parameter.

Chapter 6 - Engineered Safety Features Nuclear Criticality Safety SHINE Medical Technologies 6b.3-9 Rev. 4 Use of Controlled Parameters The controlled parameters used in the CSP are mass, moderation, enrichment, geometry, volume, concentration, interaction, physicochemical form, reflection, heterogeneous effects, density, and process variables. Where these parameters are used to control the criticality risk, the following guidance is implemented.

General:

When a single-parameter limit is used, all other parameters are evaluated at their optimum or most reactive credible values.

When process variables can affect the normal or most reactive credible values of parameters, controls to maintain them within specified ranges are established.

When measurement of a parameter is needed, instrumentation subject to the facility management measures is used.

When criticality control is based on measuring a single parameter, independent means of measurement are used.

Limits on controlled parameters are established, taking any tolerances and uncertainty into account.

Mass:

When mass limits are derived for a material that is assumed to have a given weight percent of SNM, determinations of mass are based on either (1) weighing the material and assuming that the entire mass is SNM, or (2) conducting physical measurements to establish the actual weight percent of SNM in the material.

When the dimensions of equipment or containers with a fixed geometry are used to limit the mass of SNM, a conservative process density is used to calculate the resulting mass.

When over-batching of SNM is credible, the largest mass resulting from a single failure is shown to be subcritical.

Moderation:

Physical structures are the preferred means of preventing ingress of moderators.

Moderation-controlled areas are used to exclude moderator from areas of the SHINE facility.

Moderation-controlled areas are conspicuously marked, and administrative controls are established to prevent the introduction of moderators.

Firefighting procedures for use in moderation-controlled areas are evaluated in NCSEs.

Restrictions on the use of moderating firefighting agents are included in procedures and training. The effects of fire and the activation of fire suppression systems is evaluated.

Enrichment:

A facility-wide maximum authorized enrichment is used, and the most limiting enrichment is applied to all material.

Chapter 6 - Engineered Safety Features Nuclear Criticality Safety SHINE Medical Technologies 6b.3-10 Rev. 4 Geometry:

Before beginning operations, in response to changes in operations, and at periodic intervals, all dimensions relied on in demonstrating subcriticality are verified. Relevant dimensions and material properties are maintained by the facility's configuration management program.

Means of losing geometry control are evaluated and controls are established as needed if they are credible.

Neutron interaction with other SNM-bearing equipment is considered as part of the demonstration of subcriticality, unless individual units meet the criteria for being considered neutronically isolated.

Density:

The general criteria listed above are applied.

Volume:

Fixed geometry is used to restrict the volume of SNM. Limiting material to part of a larger geometry using active level probes and overflow lines is also used.

The maximum subcritical volume is evaluated using the most reactive credible geometry, optimum moderation, and full water reflection.

Concentration:

Controls are established to limit concentration of SNM unless the process has been demonstrated to be subcritical at optimum concentration.

When using a tank containing concentration-controlled solution, the tank is kept closed and locked to prevent unauthorized introduction of precipitating agents.

Precautions are taken to preclude the inadvertent introduction of precipitating agents.

Transfers to unfavorable geometry tanks containing concentration-controlled solutions will only be authorized based on dual independent sampling and/or in-line monitoring. No single error may result in transfer of concentrated solution to a tank with unfavorable geometry.

Process variables that can affect the solubility of fissile solutions are controlled and monitored. The need to ensure homogeneity of the solution is assessed in the NCSEs.

Interaction:

To maintain physical separation between units, engineered controls are used. If engineered controls are not feasible, administrative controls with visual aids are used.

The structural integrity of spacers, storage racks, etc. is sufficient to ensure subcriticality under normal and credible abnormal conditions, including seismic events.

Engineered devices that are movable are inspected periodically for deformation.

Physicochemical Form:

Explicit controls are established to limit material composition to particular forms.

Both in-situ changes in the physicochemical form and the migration of material between process areas are considered in evaluating credible abnormal conditions.

Chapter 6 - Engineered Safety Features Nuclear Criticality Safety SHINE Medical Technologies 6b.3-11 Rev. 4 Process variables that can change the fissile material to a more reactive physicochemical form are identified as controls in the NCSEs.

Reflection:

In determining the subcritical limits for an individual unit, the wall thickness and all adjacent reflecting materials are considered in setting up the criticality model.

Criteria are established and documented in the NCSEs for determining when materials are sufficiently far away to be neglected in the criticality model.

When reflection is not controlled, full reflection is represented by 12 inches of tight-fitting water or 24 inches of tight-fitting concrete.

Minimum reflection conditions equivalent to a 1-inch tight-fitting water reflector are assumed to account for personnel and other transient incidental reflectors not explicitly included with fixed reflectors in the model.

When less-than-full reflection conditions are assumed in calculations, controls to limit reflection around individual units are established. Rigid barriers are preferred.

When evaluating arrays of units, the most reactive combination of interstitial moderation and exterior array reflection is considered and documented in the NCSE and/or calculation.

Heterogeneity Effects:

Methods of causing a fissile material to become inhomogeneous are evaluated in NCSEs and controls are established as necessary. If heterogeneity is considered credible, its effect is evaluated in criticality calculations.

Assumptions that can affect the physical scale of heterogeneity are based on observed physical characteristics of the material; process variables that can affect the scale of heterogeneity are controlled.

Process Variables:

Process variables relied on to control or monitor other controlled parameters are identified as controls in criticality safety evaluations; sufficient management measures are applied to ensure that the associated controlled parameter limit is not exceeded.

The associated controlled parameter is explicitly identified and the correlation of process variables to the associated parameter is established by experiment or plant-specific measurements.

6b.3.2.1 Target Solution Staging System The target solution staging system (TSSS) is the set of tanks and associated piping used to provide staging and storage of target solution in the radioisotope production facility (RPF). A process overview is provided in Figure6b.3-1.

The system consists of eight target solution hold tanks and two target solution storage tanks which receive target solution from the target solution preparation system (TSPS), the iodine and xenon purification and packaging (IXP), or the molybdenum extraction and purification system (MEPS). Each tank is connected to the vacuum transfer system (VTS) which allows transfer within the system and to other connected systems. The tanks in the system are geometrically favorable annular tanks and are in individual below grade vaults equipped with floor drains to the

Chapter 6 - Engineered Safety Features Nuclear Criticality Safety SHINE Medical Technologies 6b.3-12 Rev. 4 radioactive drain system (RDS). The valves and piping in the system are in the below grade valve pits and pipe trench, which are also equipped with drains to the RDS.

Criticality Safety Basis The NCSE for the TSSS shows that the entire process will remain subcritical under normal and credible abnormal conditions.

Under normal conditions, the system is safe-by-design. The pipe and valve sizes and arrangements within the system are individually within the evaluated single-parameter limits on geometry. Groups of piping have been evaluated and shown to be subcritical given worst-case conditions of concentration, reflection, and corrosion. The tanks in the system have an annular design that will remain subcritical under the most reactive conditions of concentration, reflection, and corrosion. Tanks are equipped with redundant overflows and tank vault drip trays are equipped with adequately sized drains in the event of a tank overflow or leak of target solution.

6b.3.2.2 Radioactive Liquid Waste Storage System The radioactive liquid waste storage (RLWS) system collects, stores, blends, conditions, and meters liquid wastes to the radioactive liquid waste immobilization (RLWI) system. A process overview is provided in Figure6b.3-2.

The system consists of two uranium liquid waste tanks, the first of which receive potentially high concentration (greater than 25 grams of uranium per liter [gU/L]) uranium-bearing wastes from the VTS, MEPS, or IXP. Wastes from VTS come from other upstream sources, such as TSSS.

The nominal uranium concentrations from the MEPS and IXP washes are less than 25 gU/L.

High concentration is only expected when a target solution batch is disposed of.

The uranium liquid waste tanks are of the same geometrically-favorable design as similar tanks in the TSSS and are contained in individual below grade vaults. The uranium liquid waste tanks are connected in series to preclude inadvertent direct transfers to the non-favorable-geometry liquid waste blending tanks.

Four radioactive liquid waste tanks are large volume, non-favorable-geometry tanks which receive and store negligible concentration (less than 1 gU/L) wastes from the process vessel vent system (PVVS), MEPS, and IXP.

Eight liquid waste blending tanks are large volume, non-favorable-geometry tanks which store low concentration (less than 25 gU/L) wastes. These tanks receive low concentration wastes from the second uranium liquid waste tank and negligible concentration waste from the upstream radioactive liquid waste tank.

The radioactive liquid waste tanks and liquid waste blending tanks are equipped with dedicated sampling equipment which is used to draw liquid samples of the tank contents to determine uranium concentration and pH. Samples from the uranium liquid waste tanks are obtained using the VTS and analyzed in the qualitiy control and analytical testing laboratories (LABS).

The normal process for receiving high concentration wastes proceeds as follows. First, the high concentration wastes are moved from an upstream system into the first uranium liquid waste tank. When the waste is desired to be transferred to the waste immobilization system, it is first

Chapter 6 - Engineered Safety Features Nuclear Criticality Safety SHINE Medical Technologies 6b.3-13 Rev. 4 down-blended if needed with PVVS condensate or water to less than 25 gU/L. The tank is sampled prior to the authorization of any transfers to verify this condition is met. Then, the waste is transferred to the second uranium liquid waste tank and re-sampled. If the sampling conditions are met, the low concentration waste is then transferred by vacuum to the liquid waste blending tank. The liquid waste blending tank may be further down-blended with negligible concentration wastes from the radioactive liquid waste tanks to meet downstream waste disposal specifications in the RLWI system.

Criticality Safety Basis The NCSE for the RLWS shows that the entire process will remain subcritical under normal and credible abnormal conditions.

Under normal conditions, portions of the system are safe-by-design. The pipe and valve sizes and arrangements within the system are individually within the evaluated single-parameter limits on geometry. Groups of piping have been evaluated and shown to be subcritical given worst-case conditions of concentration, reflection, and corrosion. The uranium liquid waste tanks have an annular design that will remain subcritical under worst-case conditions of concentration, reflection, and corrosion. The tanks are equipped with dual overflows and the tank vault drip tray is equipped with an adequately sized drain in the event of an overflow or leak from the tank.

The radioactive liquid waste tanks and the liquid waste blending tanks are not safe-by-design and require application of the DCP to prevent criticality accidents. The concentration limit for these tanks is significantly less than the single-parameter limit for uranium concentration.

Redundant in-series controls on concentration are relied upon to meet the DCP. The sampling and transfer processes consist of multiple independent sampling and authorization steps.

Before mixing begins, the first uranium liquid waste tank is isolated from its inputs. The second uranium liquid waste tank is isolated from the first tank and from the downstream liquid waste blending tanks. Before sampling, the tank is mixed well to ensure the sample is representative of the contents of the tank. A sample is drawn into the sample tank and an operator takes a sample and proceeds to test this sample using a prescribed sampling method. The solution in the sample tank is then returned to the first tank. Results of the sample are sent by the operator to the control room supervisor, who confirms the results are acceptable and authorizes the contents of the first uranium liquid waste tank to be transferred to the second uranium liquid waste tank.

Upon successful transfer to the second uranium liquid waste tank, the tank is isolated from the first tank until the completion of the transfer process to the liquid waste blending tanks. Before sampling, the second tank is mixed well to ensure the sample is representative of the contents of the tank. A sample is drawn into the sample tank and a different operator takes a sample and proceeds to test this sample using a prescribed sampling method, different from the previous sample. Once the operator has finished, they relay the results of the sample to the control room supervisor. The supervisor reviews the tests, confirms the results are acceptable, and authorizes the transfer to the liquid waste blending tanks.

6b.3.2.3 Molybdenum Extraction and Purification System The MEPS extracts and purifies molybdenum from irradiated target solution. A process overview is provided in Figure6b.3-3.

Chapter 6 - Engineered Safety Features Nuclear Criticality Safety SHINE Medical Technologies 6b.3-14 Rev. 4 The MEPS components are in the extraction cells and purification cells, which are part of the larger supercell. The purification cell contains components which do not contain fissile material.

The reagents used in the system are contained on a chemical reagents skid located outside the hot cell.

During the extraction process, target solution is lifted into the vacuum transfer tanks in the extraction cell and pumped through a regenerative and non-regenerative heat exchanger and the extraction column. The extraction column is an adsorption media column which separates out the molybdenum from the target solution. The target solution is returned to the TSSS after extraction for re-use, though it may be sent to the RLWS if desired. A series of acid and water washes to the RLWS are used to flush the extraction process lines following target solution to remove any residual target solution from the lines. After the wash, the three-way valves in the system are repositioned to allow sodium hydroxide to flow through the extraction column and release the adsorbed molybdenum into the eluate hold tank.

Criticality Safety Basis The NCSE for the MEPS shows that the entire process will remain subcritical under normal and credible abnormal conditions.

Under normal conditions, portions of the system containing fissile target solution are safe-by-design. The pipe, heat exchanger, valve, tank, column, and pump sizes are individually within the evaluated single-parameter limits on geometry and/or volume. Groups of piping and other components have been evaluated and shown to be subcritical given worst-case conditions of concentration, reflection, and corrosion with minimum edge-to-edge separation and minimum separation between adjacent extraction cells. The extraction cell is equipped with a drain to RDS and target solution through-cell transfer pipes are double walled, with the outer wall draining to RDS as well. The cell is fully enclosed to minimize the intrusion of moderating liquids.

The molybdenum eluate hold tank is not safe-by-design and requires application of the DCP to prevent criticality accidents. A three-way valve design prevents inadvertent transfer of target solution to the eluate tank. Additionally, an isolation valve is administratively closed to prevent inadvertent transfer if the three-way valve fails.

Inadvertent transfer of target solution to the facility chemical reagent system (FCRS) requires application of the DCP to prevent criticality accidents. A three-way valve design prevents flow of target solution toward the FCRS reagent vessels. An isolation valve is installed between the FCRS and upper vacuum lift tanks that is administratively closed during target solution processing, and a check-valve also exists to prevent inadvertent flow of target solution to the reagent vessels.

Precipitation due to the inadvertent addition of caustic reagents requires application of the DCP to prevent criticality accidents. The volume of caustic reagents and the sequence of column washes is administratively controlled to prevent potential precipitate formation. Additionally, a column frit filter prevents downstream transfer of any potential solid precipitates.

6b.3.2.4 Target Solution Preparation System The TSPS produces uranyl sulfate solution, referred to as target solution, from uranium oxide powder. The uranium oxide powder is dissolved in sulfuric acid to produce uranyl sulfate.

Chapter 6 - Engineered Safety Features Nuclear Criticality Safety SHINE Medical Technologies 6b.3-15 Rev. 4 Hydrogen peroxide may be used as a catalyst in this process, forming uranyl peroxide as an intermediate. A process overview is provided in Figure6b.3-4.

The uranium oxide powder is manually transferred from the uranium receipt and storage system (URSS) to the TSPS glovebox. The powder is stored and handled in sealed cans which are opened inside the glovebox. The oxide powder is then metered and poured into the dissolution tanks. The dissolution tank is then charged with hydrogen peroxide (if used) and sulfuric acid in sequence to produce the final uranyl sulfate product. The tanks are agitated and heated during the process to ensure proper dissolution. The tanks themselves are favorable geometry vessels with a controlled diameter to protect against potential criticality.

Once the dissolution process is complete, the tank contents are pumped through a filter into the target solution preparation tank and can then be transferred into the TSSS. The target solution preparation tank is a favorable-geometry annular tank like those found in the TSSS and RLWS.

Because the dissolution process evolves heat and water vapor, the off-gas from the process flows through a reflux condenser which condenses the vapor and returns it to the dissolution tank. The reflux condenser is cooled by the radioisotope process cooling system (RPCS). The glovebox and reflux condenser are vented to the facility radiological ventilation system.

Criticality Safety Basis The NCSE for the TSPS shows that the entire process will remain subcritical under normal and credible abnormal conditions.

The TSPS is subject to two sets of criticality safety limits. Portions of the system contain oxide powder in both dry and wet (partially-dissolved) conditions, and the remainder of the system contains uranyl sulfate. The uranium concentration in the uranyl sulfate may be higher in this system than in the rest of the facility due to the nature of the process.

Under normal process conditions, the mass of uranium oxide is controlled to less than the optimally-moderated, fully-reflected critical mass for uranium oxide of oxide per canister, and only a single oxide canister is permitted in the glovebox at any given time. High efficiency particulate air (HEPA) filters are favorable geometry within the single parameter limit and installed on the glovebox to prevent significant buildup of oxide powder outside of the glovebox or in downstream ventilation ductwork. Visual surveillance is performed to identify any spills of fissile material or introduction of moderators.

The TSPS room moderator exclusion features (e.g., non-hydrogenous fire protection, elevated floor) and glovebox itself are designed to preclude the intrusion of significant amounts of moderator. Therefore, the glovebox will remain safely subcritical under normal process conditions. The mass limit also protects the dissolution process in the dissolution tanks, though they are designed with favorable geometry even for the most reactive combination of uranium oxide and water.

Downstream of the dissolution tanks are pipes, transfer pumps, and filters, which are favorable geometry within the single parameter limit. The target solution preparation tank is favorable geometry including corrosion allowances and optimum concentration of solution. Interaction between components is controlled with minimum separation distances and a cage around the dissolution tanks.

Chapter 6 - Engineered Safety Features Nuclear Criticality Safety SHINE Medical Technologies 6b.3-16 Rev. 4 High level within the dissolution tanks requires application of the DCP to prevent criticality accidents. The dissolution tanks are equipped with high level controls that are interlocked with isolation valves on cooling and ventilation lines. There is a check-valve on the return side of the reflux condenser cooling line to prevent backflow of cooling water into the dissolution tanks, and the reflux condenser is favorable geometry within the single parameter limits. Additionally, a water-tight plug is inserted into the powder chute after oxide powder introduction into the dissolution tanks.

Addition of moderator during maintenance activities requires application of the DCP to prevent criticality accidents. Maintenance activities are administratively controlled, and independently verified, to ensure fissile material is removed prior to maintenance activities, and that all moderating materials are removed prior to re-starting operations.

Incomplete dissolution and transfer of solids downstream of the dissolution tanks requires application of the DCP to prevent criticality accidents. The dissolution procedure is administratively controlled, with supervisory oversight, to ensure the appropriate sequencing and volume of reagents is followed to ensure complete dissolution. Reagent tanks have unique connectors and limited volume to prevent inadvertent reagent addition. Additionally, downstream favorable geometry filters remove potential solids in the target solution.

6b.3.2.5 Vacuum Transfer System The VTS is an interconnected series of pipes and vacuum lift tanks which facilitate the transfer of target solution throughout the facility. A process overview is provided in Figure6b.3-5.

The lift tanks are capable of drawing solution from the TSSS, RLWS, subcritical assembly system (SCAS), and the RDS for various purposes and supply solution to the TSSS, RLWS, RLWI, SCAS, and MEPS. The tanks are supplied with vacuum through associated vacuum pumps and valves which regulate and maintain vacuum pressure throughout the system.

Vacuum is broken in the lift tanks by venting the tank through a three-way valve which isolates the vacuum header and allows inflow from radiological ventilation zone 2 (RVZ2). Breaking vacuum in a lift tank allows gravity drain of its contents to the desired destination in one of the connected systems. Note that two-way transfers are not possible for the MEPS, RLWI, and RDS.

VTS can only supply to MEPS and RLWI, and it can only remove target solution from the RDS.

Criticality Safety Basis The NCSE for the VTS shows that the entire process will remain subcritical under normal and credible abnormal conditions.

The VTS components which contain target solution are designed with favorable geometry for the most reactive concentration. The components individually have geometry within the evaluated single parameter limits for target solution. In cases where favorable geometry components are in proximity to each other, the interaction between the components is evaluated and controlled.

The VTS components are designed to prevent leaks of solution. Vaults or hot cells containing the VTS tanks or associated piping are equipped with drip trays and adequately sized drains that drain to RDS. The vacuum buffer tank is equipped with a demister that separates potentially entrained liquid in the vapor, which prevents transfer of target solution to downstream components.

Chapter 6 - Engineered Safety Features Nuclear Criticality Safety SHINE Medical Technologies 6b.3-17 Rev. 4 The inadvertent transfer of solution to a non-fissile system requires application of the DCP to prevent criticality accidents. The VTS piping design and features prevent transfer of target solution to non-favorable geometry components within the VTS. The vacuum headers are equipped with liquid detection that stops transfers upon detection of liquid. Additionally, a ball-check valve is located between the vacuum lift tanks and the vacuum buffer tank (VTS knockout pot) to prevent high level transfer of solution to the vacuum buffer tank.

6b.3.2.6 Process Vessel Vent System The PVVS is an off-gas management system for the process equipment which contains radioactive liquids with the potential for excessive hydrogen production in the IXP system, MEPS, RLWI, RLWS, TSSS, and VTS. The PVVS also periodically accepts gas from the target solution vessel (TSV) off-gas system (TOGS). The PVVS supplies ventilation flow and receives radioactive gas from the tanks and other equipment in these systems and processes it through a series of filters, delay beds, and blowers before it is released from the facility stack. The system does not normally contain significant fissile material.

Criticality Safety Basis The NCSE for the PVVS shows that the entire process will remain subcritical under normal and credible abnormal conditions. There are no identified criticality safety controls for the PVVS.

Inadvertent transfer of target solution into the PVVS is prevented in upstream systems.

6b.3.2.7 Uranium Receipt and Storage System The URSS receives and stores enriched uranium oxide and metal and converts uranium metal into oxide for use in the TSPS. A process overview is provided in Figure6b.3-6.

Activities for the receipt and measurements of uranium and the conversion from metal to oxide occur inside the URSS glovebox. Upon receipt, the convenience cans are removed from the shipping container and imported into the glovebox for measurement and repackaging into metal or oxide storage cans, as appropriate. Once the metal or oxide cans are appropriately loaded, they are moved to the appropriate storage rack. For conversion activities, a metal can is moved from the storage rack to the glovebox where it is converted using specified time and temperature constraints to the appropriate uranium oxide. The oxide is then measured, and an oxide can is loaded with the product which is then transferred to the oxide storage rack. Oxide may also be transferred to the TSPS for processing into solution.

Criticality Safety Basis The NCSE for the URSS shows that the entire process will remain subcritical under normal and credible abnormal conditions.

Receipt and handling of shipping containers which contain uranium is in accordance with the approved safety analysis for packaging associated with each container. Areas in which intact shipping containers are stored are controlled by limiting the aggregate criticality safety index for the storage area. Administrative controls are used to ensure the criticality safety index limits are not exceeded.

Chapter 6 - Engineered Safety Features Nuclear Criticality Safety SHINE Medical Technologies 6b.3-18 Rev. 4 Under normal process conditions, the mass of uranium metal and oxide is limited to quantities below evaluated safe subcritical limits. Moderators in the room and the glovebox are controlled to establish double contingency protection for the system. For a criticality to occur under normal conditions, a non-credible quantity of metal or oxide would need to be introduced into the system or mass limits would need to be exceeded concurrent with the introduction of a significant quantity of moderator. Moderator controls and the glovebox itself prevent the uncontrolled intrusion of moderators into areas containing exposed fissile material.

Introduction of high-enrichment uranium requires application of the DCP to prevent criticality accidents. Upon receipt of uranium, examination of the supplier certification is used to confirm the condition of received material prior to import of material to the glovebox. Confirmation of material form and enrichment by sample analysis are used to ensure that appropriate limits are applied.

Accumulation of excess mass requires application of the DCP to prevent criticality accidents. The mass of uranium in-and out-of-storage is administratively controlled. Material contained within sealed shipping containers, the glovebox, and the storage racks is considered to be in-storage and is subject to specific limits for each of these areas. Material out-of-storage is administratively limited to a value significantly below the single-parameter subcritical limit. Controls on the use and transport of moderators within the room are used to prevent the interaction of material out-of-storage with moderating materials. HEPA filters, which are favorable geometry within single parameter limits, prevent the accumulation of oxide outside of the glovebox or in downstream ventilation. Holdup of fissile material in the process is controlled in the glovebox and furnace by tracking mass and periodic cleanout of the glovebox and furnace based on the throughput of uranium. Cleanout of fissile material holdup is independently verified prior to restarting operations. During maintenance activities, fissile material is removed prior to maintenance and moderators are removed prior to restarting operations. Confirmation of fissile material and moderator removal is performed under supervisory oversight.

Incomplete oxidation of metal requires application of the DCP to prevent criticality accidents. The furnace oxidation steps are administratively controlled to ensure adequate oxidation.

Additionally, sample analysis following oxidation verifies oxide powder content and moisture content of the oxide. Operators visually confirm that only uranium oxide is added to an oxide canister.

The URSS oxide storage rack and metal storage rack are favorable geometry and maintain the appropriate storage cell size. The maximum number of storage cells is significantly below the allowable number of storage cells based on the mass per storage canister. The mass in each storage canister is administratively controlled. Movement of fissile material out-of-storage is maintained at an appropriate separation distance to other fissile material in storage to prevent unfavorable interaction.

6b.3.2.8 Radioactive Drain System The RDS collects overflows and leakage of target solution from systems in the RPF and directs it to two favorable-geometry tanks in below grade vaults. A process overview is provided in Figure6b.3-7.

The system is comprised of drip pans, piping, and collection tanks. The collection tanks are normally maintained empty and are equipped with instrumentation to alert personnel of an

Chapter 6 - Engineered Safety Features Nuclear Criticality Safety SHINE Medical Technologies 6b.3-19 Rev. 4 abnormal condition. The system operates by gravity drain, where overflows and leakage flow through installed piping directly to the RDS hold tanks. The hold tank contents can be mixed, sampled, and withdrawn through the VTS to the TSSS or RLWS as appropriate.

Criticality Safety Basis The NCSE for the RDS shows that the entire process will remain subcritical under normal and credible abnormal conditions.

Under normal process conditions, the RDS does not contain fissile material. Leakage or overflow of target solution to the RDS is considered an abnormal condition for the facility but is considered as a normal condition for the purpose of the criticality safety evaluation for the system. The RDS hold tanks and piping are favorable geometry for the most reactive concentration of target solution and are safe-by-design. The vacuum lift tanks within the RDS are favorable geometry within the single parameter limits. The hold tanks are equipped with overflow lines, and RDS drains are adequately sized to prevent buildup of solution in the vault drip tray. Drip trays are also sloped toward the drain lines. Interaction is controlled between components with minimum separation distances between components and between vaults.

Precipitation of solids requires application of the DCP to prevent criticality accidents. The hold tanks are equipped with level instrumentation to detect a leak of solution transferred to RDS.

Additionally, administrative controls ensure that, upon a leak, normal operations stop, the leaked solution is sampled, and appropriate recovery actions are performed.

6b.3.2.9 Radioactive Liquid Waste Immobilization System The RLWI system receives radioactive liquid waste from the RLWS and mixes it with solidifying agents to stabilize and solidify the liquid waste in drums. The drums are then moved into storage and eventually to long-term disposal. A process overview is provided in Figure6b.3-8.

Waste with a uranium concentration capable of meeting the waste acceptance and storage requirements enters the system from the RLWS liquid waste blending tanks and into the immobilization feed tank by drawing a vacuum on the immobilization feed tank. When the waste is ready to be immobilized, it is pumped from the immobilization feed tank by the liquid waste drum fill pump and into a radioactive liquid waste drum pre-loaded with solidification agents. The contents of the radioactive liquid waste drum are solidified and after adequate cure time, the solidified waste drum is remotely loaded into a shielded drum for transport to the material staging building.

Criticality Safety Basis The NCSE for the RLWI system shows that the entire process will remain subcritical under normal and credible abnormal conditions.

Under normal process conditions, the incoming feed stream from RLWS contains low concentrations of fissile material and is significantly below the single parameter limit for uranium concentration in solution. The operational limits on uranium concentration for the input stream are driven by waste acceptance requirements and are even lower than the allowable limits for criticality safety.

Chapter 6 - Engineered Safety Features Nuclear Criticality Safety SHINE Medical Technologies 6b.3-20 Rev. 4 The mass of fissile material in the drums is controlled to less than the single parameter limit on uranium-235 mass. The mass is further restricted by waste acceptance limits on uranium-235 activity. A barrel which meets the waste acceptance limits meets the criticality safety limits.

Sample analysis of solution transferred to RLWI is performed and compared to previous sample results and verify uranium concentration is within the established limits. The proper amount of solidification agents is added to a barrel and weighed prior to transfer of uranium-bearing solution to the barrel to ensure waste acceptance limits are satisfied for downstream storage of the waste barrels within the material staging building.

Interaction between barrels is controlled by limiting the number of barrels present within the immobilization skid.

Precipitation of uranium requires application of the DCP to prevent criticality accidents. Reagent vessels have unique nozzle connections to prevent inadvertent transfer of reagents, and the volume of the vessels is limited. Process lines are sloped, and equipment are equipped with drains to prevent holdup of fissile material. Additionally, solutions transferred to the RLWI system undergo dual, independent sample analysis to verify the pH of the solution is within limits prior to transferring the solution.

6b.3.2.10 Laboratories The LABS receive, store, and process liquid and solid analytical samples of oxides, metals, and irradiated and unirradiated target solution.

The laboratory is controlled by an overall limit on mass which is significantly below the subcritical limit on mass for uranium-235 and is subcritical under all conditions.

Criticality Safety Basis The NCSE for the LABS shows that the entire process will remain subcritical under normal and credible abnormal conditions.

The LABS system is administratively controlled to ensure the combined total uranium mass is significantly below the subcritical mass for uranium-235.

6b.3.2.11 Material Staging Building The material staging building exists to process, characterize, and store byproduct material and SNM, used in the production of medical isotopes. The material staging building provides a location for the packaged radioactive material to decay until it can be transported to an off-site final disposal location. The material staging building will mostly store standard-sized 55-gallon drums containing cured, solidified waste. Other forms of radioactive waste are stored in the material staging building (e.g., used neutron drivers, glassware).

Criticality Safety Basis The NCSE for the material staging building shows that the entire process will remain subcritical under normal and credible abnormal conditions.

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)

Chapter 6 - Engineered Safety Features Nuclear Criticality Safety SHINE Medical Technologies 6b.3-21 Rev. 4 The material stored in the material staging building is comprised entirely of exempt fissile material. To protect against damage to the material, the lift height of a barrel is limited so that if a barrel drop were to occur the barrel would remain undamaged. Because the SNM in the material staging building is exempt fissile material and there is no credible means of changing the state of the material, there is no need for additional controls.

6b.3.2.12 Iodine Extraction and Purification System The IXP is designed to separate iodine from irradiated uranyl sulfate target solution [

]PROP/ECI. The iodine is then purified into a sodium hydroxide solution. Xenon is collected from [

]PROP/ECI. The IXP is in a hot cell.

One operating line of the IXP is part of the RPF.

Criticality Safety Basis The NCSE for the IXP shows that the entire process will remain subcritical under normal and credible abnormal conditions.

The piping and equipment in the IXP containing target solution is favorable geometry within the single parameter limits. The IXP cell is equipped with a drain to RDS that is adequately sized to prevent buildup of solution in the cell.

The inadvertent transfer of target solution to the IXP eluate tank requires application of the DCP to prevent criticality accidents. A three-way valve is designed to prevent transfer of target solution to the eluate tank during extraction processing. Additionally, an isolation valve located between the three-way valve and eluate tank is administratively closed during processing of target solution.

Prevention of target solution backflow into the FCRS requires application of the DCP to prevent criticality accidents. A check valve is installed to prevent the flow of solution upstream to FCRS.

Additionally, an isolation valve located between the check valve and the FCRS is administratively closed during processing of target solution.

Precipitation due to inadvertent addition of caustic reagents requires application of the DCP to prevent criticality accidents. The IXP is equipped with unique nozzle hookups for each reagent to prevent improper FCRS hookups. Additionally, the wash sequence of the column is administratively controlled to prevent precipitation.

6b.3.3 CRITICALITY ACCIDENT ALARM SYSTEM The SHINE facility provides a CAAS to detect a criticality event in the areas in which non-exempt quantities of fissile material greater than the limits identified in 10 CFR 70.24(a) are used, handled, or stored outside the TSVs. The criticality accident alarm system at the SHINE facility is designed to meet the requirements of 10 CFR 70.24, and conforms to the requirements in ANSI/ANS-8.3-1997 (R2017), as endorsed by RG 3.71.

The CAAS consists of detectors located throughout the main production facility at locations designated to provide sufficient coverage of areas in which SNM is used, handled, and stored.

Chapter 6 - Engineered Safety Features Nuclear Criticality Safety SHINE Medical Technologies 6b.3-22 Rev. 4 6b.3.3.1 Minimum Accident of Concern The minimum accident of concern (MAC) for the SHINE facility is developed based on a critical sphere of 20 percent enriched uranyl sulfate solution. This system is representative of the majority of operations conducted within the SHINE facility. Process accidents involving solutions are also statistically more likely to occur, based on available historical data.

Detector placement is determined by neutron transport analysis using the MAC. The transport analysis converts the neutron and gamma spectrum of the MAC to a point source which is used with a computer model of the facility structure, shielding, and intervening equipment to determine appropriate detector placements and detection thresholds. The detection thresholds are based on the requirements of 10 CFR 70.24 and the detector response to neutron radiation. Selection of neutron detectors and neutron transport analysis are appropriate for the SHINE facility because the facility contains multiple sources of gamma radiation which could interfere with the operation of the CAAS in a way that would result in an unacceptable number of false alarms.

6b.3.3.2 Criticality Accident Alarm System Design The CAAS will energize visible and audible alarms in the affected area of the main production facility and in the facility control room if a criticality accident occurs. Mandatory evacuation areas are determined and clearly marked with evacuation routes for areas in which personnel would receive a dose exceeding 12 rads (0.12 grays) in free air. Evacuation routes are selected to ensure personnel are evacuated away from areas with potentially higher dose during a criticality accident.

The CAAS detectors are arranged so that each area outside of the irradiation unit cells in which special nuclear material is used, handled, or stored within the main production facility receives coverage from at least three detectors, which allows a single detector to be taken out of service for maintenance without impact to the operability of the system. Under normal conditions, the detector logic requires that two detectors are needed to trigger an alarm condition, which minimizes the potential for false actuations of the alarm. Protection against latent detector failures during maintenance conditions is achieved by locking in an alarm signal from any detectors which are out of service for maintenance, which reduces the detection requirement to a single detection within the affected zones.

The CAAS employs a logic unit, located in the facility control room, which contains redundant alarm logic to ensure that a latent failure in the logic unit does not preclude an alarm when needed. Electrical power is normally supplied by the facility normal electrical power supply system (NPSS), with a backup connection to the uninterruptible electrical power supply system (UPSS). Batteries are also supplied within the system itself. The system will remain in operation for at least two hours following a facility loss of off-site power, which ensures that operators have sufficient time to secure the movement of fissile material before loss of alarm system coverage.

Portable instruments may be used to provide equivalent coverage in rare circumstances.

Evaluation and deployment of portable instrumentation is managed on a case-by-case basis.

The CAAS is designed to be resistant from anticipated adverse effects such as a fire, explosion, corrosive atmosphere, seismic shock, or other adverse conditions that do not result in evacuation of the entire facility. The system is designed to preclude false alarms due to system failure and contains sufficient fault detection to alert operators as needed during failures.

Chapter 6 - Engineered Safety Features Nuclear Criticality Safety SHINE Medical Technologies 6b.3-23 Rev. 4 For maintenance or other conditions which would disable multiple detectors or the logic unit, the following compensatory measures are implemented to ensure an equivalent level of safety:

Temporary criticality detection equipment with audible alarms will be used for personnel remaining in or entering the affected area, and Personnel access to the affected area will be limited to essential activities.

These compensatory measures are specific to the affected area of the main production facility and provide a time allowance to restore the system to full operation in lieu of immediate process shutdown.

6b.3.4 TECHNICAL SPECIFICATIONS The controls required to maintain the criticality safety basis are contained in the SHINE technical specifications.

Chapter 6 - Engineered Safety Features Nuclear Criticality Safety SHINE Medical Technologies 6b.3-24 Rev. 4 Table 6b.3 Summary of Benchmarks Selected for the SHINE Validation Report Benchmark Series Cases Description of Physical Systems LEU-SOL-THERM-003 9

10.06% enriched uranyl nitrate, un-reflected IEU-SOL-THERM-002 13 30.45% enriched uranyl fluoride, water-reflected and un-reflected IEU-SOL-THERM-003 46 30.3% uranyl fluoride, water-reflected and un-reflected IEU-SOL-THERM-004 1

14.7% uranyl sulfate, reflected by beryllium oxide LEU-SOL-THERM-004 7

9.97% enriched uranyl nitrate, water-reflected LEU-SOL-THERM-007 5

9.97% enriched uranyl nitrate, un-reflected LEU-SOL-THERM-008 4

9.97% enriched uranyl nitrate, concrete-reflected LEU-SOL-THERM-016 7

9.97% enriched uranyl nitrate, water-reflected LEU-SOL-THERM-017 6

9.97% enriched uranyl nitrate, un-reflected LEU-SOL-THERM-018 6

9.97% enriched uranyl nitrate, concrete-reflected LEU-SOL-THERM-020 4

9.97% enriched uranyl nitrate, water-reflected LEU-SOL-THERM-021 4

9.97% enriched uranyl nitrate, un-reflected LEU-SOL-THERM-023 9

9.97% enriched uranyl nitrate, un-reflected LEU-SOL-THERM-025 7

9.97% enriched uranyl nitrate, concrete-reflected

Chapter 6 - Engineered Safety Features Nuclear Criticality Safety SHINE Medical Technologies 6b.3-25 Rev. 4 Table 6b.3 Area of Applicability Summary Parameter Area of Applicability Fissile Material and Composition Uranyl Sulfate Uranyl Nitrate Uranyl Fluoride Chemical Form Solution Average Neutron Energy Causing Fission (ANECF) (MeV) 0.004-0.064 Enrichment (wt. %)

10-30.5 Reflector Materials None Water Graphite Beryllium Oxide Concrete Uranium Concentration (g-U/L) 52.8-960 H/235U Ratio 75-1610

Chapter 6 - Engineered Safety Features Nuclear Criticality Safety SHINE Medical Technologies 6b.3-26 Rev. 4 Figure 6b.3 Target Solution Staging System Overview

Chapter 6 - Engineered Safety Features Nuclear Criticality Safety SHINE Medical Technologies 6b.3-27 Rev. 4 Figure 6b.3 Radioactive Liquid Waste System Overview

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)

Chapter 6 - Engineered Safety Features Nuclear Criticality Safety SHINE Medical Technologies 6b.3-28 Rev. 4 Figure 6b.3 Molybdenum Extraction and Purification System Overview

Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)

Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)

Chapter 6 - Engineered Safety Features Nuclear Criticality Safety SHINE Medical Technologies 6b.3-29 Rev. 4 Figure 6b.3 Target Solution Preparation System Overview

Chapter 6 - Engineered Safety Features Nuclear Criticality Safety SHINE Medical Technologies 6b.3-30 Rev. 4 Figure 6b.3 Vacuum Transfer System Overview RCA Ventilation Zone 2 Target Solution Staging System Radioactive Liquid Waste Storage Radioactive Drain System Subcritical Assembly System Molybdenum Extraction and Purification System Vacuum Lift Tanks VTS Vacuum Equipm ent Process Vessel Ventilation

Chapter 6 - Engineered Safety Features Nuclear Criticality Safety SHINE Medical Technologies 6b.3-31 Rev. 4 Figure 6b.3 Uranium Receipt and Storage System Overview Repackage to Oxide Storage Canister Oxide Metal Uranium Handling Glovebox Receive Shipping Package Remove Canisters Import Oxide Canister Import Metal Canister Repackage to Metal Storage Canister Repackage to Metal Storage Canister Export Oxide Storage Canister Export Metal Storage Canister Storage in Racks Storage in Racks Thermal Oxidation

Chapter 6 - Engineered Safety Features Nuclear Criticality Safety SHINE Medical Technologies 6b.3-32 Rev. 4 Figure 6b.3 Radioactive Drain System Overview RDS Hold Tanks Target Solution Staging System Molybdenum Extraction and Purification System Radioactive Liquid Waste Storage Tank Vault, Pipe Trench, and Valve Pit Drains Tank Overflow Lines Iodine and Xenon Purification System Vacuum Transfer System Supercell Drains

Chapter 6 - Engineered Safety Features Nuclear Criticality Safety SHINE Medical Technologies 6b.3-33 Rev. 4 Figure 6b.3 Radioactive Liquid Waste Immobilization System Overview Radioactive Liquid Waste System Imm obilization Feed Tank Liquid Waste Drum Pum p Drum Fill Head Vacuum Transfer System

Chapter 6 - Engineered Safety Features References SHINE Medical Technologies 6b.4-1 Rev. 0 6b.4 REFERENCES ANSI/ANS, 1983. Safety in Conducting Subcritical Neutron-Multiplication Measurements In Situ, ANSI/ANS-8.6-1983 (R2017), American National Standards Institute/American Nuclear Society, 1983.

ANSI/ANS, 1991. Nuclear Criticality Safety Training ANSI/ANS-8.20-1991 (R2015), American National Standards Institute/American Nuclear Society, 1991.

ANSI/ANS, 1995. Use of Fixed Neutron Absorbers in Nuclear Facilities Outside Reactors ANSI/ANS-8.21-1995 (R2011), American National Standards Institute/American Nuclear Society, 1995.

ANSI/ANS, 1997a. Nuclear Criticality Safety Based on Limiting and Controlling Moderators ANSI/ANS-8.22-1997 (R2016), American National Standards Institute/American Nuclear Society, 1997.

ANSI/ANS, 1997b. Criticality Accident Alarm System ANSI/ANS-8.3-1997 (R2017), American National Standards Institute/American Nuclear Society, 1997.

ANSI/ANS, 1998. Nuclear Criticality Safety in the Storage of Fissile Materials, ANSI/ANS-8.7-1998 (R2017), American National Standards Institute/American Nuclear Society, 1998.

ANSI/ANS, 2007a. Criticality Safety Engineer Training and Qualification Program ANSI/ANS-8.26-2007 (R2016), American National Standards Institute/American Nuclear Society, 2007.

ANSI/ANS, 2007b. Nuclear Criticality Accident Emergency Planning and Response ANSI/ANS-8.23-2007 (R2012), American National Standards Institute/American Nuclear Society, 2007.

ANSI/ANS, 2014a. Administrative Practices for Nuclear Criticality Safety ANSI/ANS-8.19-2014, American National Standards Institute/American Nuclear Society, 2014.

ANSI/ANS, 2014b. Nuclear Criticality Safety in Operations with Fissionable Materials Outside Reactors ANSI/ANS-8.1-2014, American National Standards Institute/American Nuclear Society, 2014.

ANSI/ANS, 2015. Criteria for Nuclear Criticality Safety Controls in Operations with Shielding and Confinement ANSI/ANS-8.10-2015, American National Standards Institute/American Nuclear Society, 2015.

ANSI/ANS, 2017. Validation of Neutron Transport Methods for Nuclear Criticality Safety Calculations ANSI/ANS-8.24-2017, American National Standards Institute/American Nuclear Society, 2017.

USNRC, 2001. Guide for Validation of Nuclear Criticality Safety Methodology. NUREG/CR-6698, 2001.

Chapter 6 - Engineered Safety Features References SHINE Medical Technologies 6b.4-2 Rev. 0 USNRC, 2018. Nuclear Criticality Safety Standards for Fuels and Material Facilities, Regulatory Guide 3.71, Revision 3, 2018.